@noresponse/mcp 0.4.1 → 0.4.3

package/bin/mcp-server.js

@@ -48104,9 +48104,9 @@ var init_config = __esm(() => {
   SDK_METADATA = {
     language: "typescript",
     openapiDocVersion: "1",
-    sdkVersion: "0.4.1",
+    sdkVersion: "0.4.3",
     genVersion: "internal",
-    userAgent: "noresponse-sdk/mcp-typescript 0.4.1 internal 1 @noresponse/mcp"
+    userAgent: "noresponse-sdk/mcp-typescript 0.4.3 internal 1 @noresponse/mcp"
   };
 });
 
@@ -51194,7 +51194,8 @@ var init_conflicterrorcode = __esm(() => {
     "key_rotation_in_progress",
     "webhook_endpoint_limit_reached",
     "webhook_endpoint_unverified",
-    "too_many_integrations"
+    "too_many_integrations",
+    "risk_version_ahead"
   ]).describe("Machine codes an HTTP 409 answer can carry.");
 });
 
@@ -52393,6 +52394,428 @@ The account's history: the same page as POST /v1/assessments/query for this acco
   };
 });
 
+// src/models/accountlist.ts
+var AccountList$zodSchema;
+var init_accountlist = __esm(() => {
+  init_zod();
+  init_account();
+  AccountList$zodSchema = object({
+    items: array(Account$zodSchema),
+    next_cursor: string2().describe("Opaque cursor after the last change this page read, bound to the workspace and the environment of the calling key. Pass it back unchanged as changed_since. It is present on every page, the last one included: when nothing changed after changed_since it is the cursor that was sent, so a poller keeps calling with the latest next_cursor. A tampered or foreign cursor answers 400 invalid_cursor. Consumers do not parse it.")
+  }).describe("Body of the 200 answer to GET /v1/accounts: the calling workspace's accounts whose risk changed after changed_since, in the environment of the calling key, oldest change first. An account is listed when its risk_version advanced and it has a current risk, and each item is the account exactly as GET /v1/accounts/{account_id} answers it. An account appears once per page, at its latest change; when its risk changes again later, it appears again on a later page with the newer risk_version. next_cursor is always present: pass it back as changed_since to read the changes made after this page.");
+});
+
+// src/models/listaccountsop.ts
+var ListAccountsRequest$zodSchema, ListAccountsResponseResult$zodSchema, ListAccountsResponse$zodSchema;
+var init_listaccountsop = __esm(() => {
+  init_zod();
+  init_accountlist();
+  init_authenticationerror();
+  init_badrequesterror();
+  init_conflicterror();
+  init_notfounderror();
+  init_permissiondeniederror();
+  init_ratelimiterror();
+  ListAccountsRequest$zodSchema = object({
+    changed_since: string2().describe("next_cursor from an earlier page, unchanged. Absent, the list starts from the oldest change.").optional(),
+    limit: int().default(50).describe("Most accounts per page."),
+    unenforced: boolean2().default(false).describe("true lists only accounts with a decision other than allow for some flow and no applied enforcement at their current risk_version.")
+  });
+  ListAccountsResponseResult$zodSchema = union([
+    BadRequestError$zodSchema,
+    AuthenticationError$zodSchema,
+    PermissionDeniedError$zodSchema,
+    NotFoundError$zodSchema,
+    ConflictError$zodSchema,
+    RateLimitError$zodSchema,
+    AccountList$zodSchema
+  ]);
+  ListAccountsResponse$zodSchema = object({
+    Headers: record(string2(), array(string2())).default({}),
+    Result: union([
+      BadRequestError$zodSchema,
+      AuthenticationError$zodSchema,
+      PermissionDeniedError$zodSchema,
+      NotFoundError$zodSchema,
+      ConflictError$zodSchema,
+      RateLimitError$zodSchema,
+      AccountList$zodSchema
+    ])
+  });
+});
+
+// src/funcs/accountsListChanged.ts
+function accountsListChanged(client$, request, options) {
+  return new APIPromise($do5(client$, request, options));
+}
+async function $do5(client$, request, options) {
+  const parsed$ = safeParse2(request, (value$) => ListAccountsRequest$zodSchema.optional().parse(value$), "Input validation failed");
+  if (!parsed$.ok) {
+    return [parsed$, { status: "invalid" }];
+  }
+  const payload$ = parsed$.value;
+  const body$ = null;
+  const path$ = pathToFunc("/v1/accounts")();
+  const query$ = encodeFormQuery({
+    changed_since: payload$?.changed_since,
+    limit: payload$?.limit,
+    unenforced: payload$?.unenforced
+  });
+  const headers$ = new Headers(compactMap({
+    Accept: options?.acceptHeaderOverride || "application/json;q=1, application/problem+json;q=0"
+  }));
+  const securityInput = await extractSecurity(client$._options.security);
+  const requestSecurity = resolveGlobalSecurity(securityInput);
+  const context = {
+    options: client$._options,
+    baseURL: options?.serverURL ?? client$._baseURL ?? "",
+    operationID: "listAccounts",
+    oAuth2Scopes: null,
+    resolvedSecurity: requestSecurity,
+    securitySource: client$._options.security,
+    retryConfig: options?.retries || client$._options.retryConfig || {
+      strategy: "backoff",
+      backoff: {
+        initialInterval: 500,
+        maxInterval: 8000,
+        exponent: 2,
+        maxElapsedTime: 30000
+      },
+      retryConnectionErrors: true
+    },
+    retryCodes: options?.retryCodes || [
+      "408",
+      "429",
+      "5XX"
+    ]
+  };
+  const requestRes = client$._createRequest(context, {
+    security: requestSecurity,
+    method: "GET",
+    baseURL: options?.serverURL,
+    path: path$,
+    headers: headers$,
+    query: query$,
+    body: body$,
+    userAgent: client$._options.userAgent,
+    timeoutMs: options?.timeoutMs || client$._options.timeoutMs || -1
+  }, options);
+  if (!requestRes.ok) {
+    return [requestRes, { status: "invalid" }];
+  }
+  const req$ = requestRes.value;
+  const doResult = await client$._do(req$, {
+    context,
+    errorCodes: [],
+    retryConfig: context.retryConfig,
+    retryCodes: context.retryCodes
+  });
+  if (!doResult.ok) {
+    return [doResult, { status: "request-error", request: req$ }];
+  }
+  return [doResult, {
+    status: "complete",
+    request: req$,
+    response: doResult.value
+  }];
+}
+var init_accountsListChanged = __esm(() => {
+  init_encodings();
+  init_primitives();
+  init_schemas3();
+  init_security();
+  init_url();
+  init_listaccountsop();
+  init_async();
+});
+
+// src/mcp-server/tools/accountsListChanged.ts
+var args5, tool$accountsListChanged;
+var init_accountsListChanged2 = __esm(() => {
+  init_accountsListChanged();
+  init_listaccountsop();
+  init_tools();
+  args5 = {
+    request: ListAccountsRequest$zodSchema.optional()
+  };
+  tool$accountsListChanged = {
+    name: "list_changed_accounts",
+    description: `Poll the accounts whose risk changed.
+
+Your accounts whose risk changed, oldest change first, each as accounts.get answers it. Every page carries next_cursor: pass it back as changed_since to read the changes made after that page; without changed_since the list starts from the oldest change. When nothing changed, items is empty and next_cursor is the cursor you sent, so poll by calling again with the latest next_cursor. An account appears again each time its risk changes, with a higher risk_version; keep the copy with the highest. unenforced=true lists only accounts with a decision other than allow for some flow and no applied enforcement at their current risk_version; such a page can hold fewer than limit items, or none, while later changes exist, so keep polling with next_cursor. Requires the history scope. Read-only and safe to retry. A tampered or foreign cursor answers 400 invalid_cursor.`,
+    annotations: {
+      title: "List the accounts whose risk changed",
+      destructiveHint: false,
+      idempotentHint: true,
+      openWorldHint: false,
+      readOnlyHint: true
+    },
+    args: args5,
+    tool: async (client, args, ctx) => {
+      const [result] = await accountsListChanged(client, args.request, { fetchOptions: { signal: ctx.mcpReq.signal } }).$inspect();
+      if (!result.ok) {
+        return {
+          content: [{ type: "text", text: result.error.message }],
+          isError: true
+        };
+      }
+      return formatResult(result.value);
+    }
+  };
+});
+
+// src/models/enforcementaction.ts
+var EnforcementAction$zodSchema;
+var init_enforcementaction = __esm(() => {
+  init_zod();
+  EnforcementAction$zodSchema = _enum([
+    "revoke_sessions",
+    "restrict",
+    "unrestrict",
+    "fail_onboarding",
+    "reject_activation",
+    "none"
+  ]).describe("What the workspace did in its identity provider: revoke_sessions (signed the account out everywhere), restrict (limited what the account can do), unrestrict (lifted an earlier restriction), fail_onboarding (stopped an account that was still onboarding), reject_activation (refused to activate a provisional account) or none (decided to take no action).");
+});
+
+// src/models/enforcementprovider.ts
+var EnforcementProvider$zodSchema;
+var init_enforcementprovider = __esm(() => {
+  init_zod();
+  EnforcementProvider$zodSchema = _enum([
+    "clerk",
+    "workos",
+    "auth0",
+    "custom"
+  ]).describe("The identity provider the action ran in; custom for the workspace's own user store.");
+});
+
+// src/models/enforcementstate.ts
+var EnforcementState$zodSchema;
+var init_enforcementstate = __esm(() => {
+  init_zod();
+  EnforcementState$zodSchema = _enum([
+    "onboarding",
+    "provisional",
+    "active",
+    "restricted",
+    "rejected"
+  ]).describe("The account's state in the workspace's identity provider just before the action: onboarding, provisional (created, not yet activated), active, restricted or rejected.");
+});
+
+// src/models/enforcementstatus.ts
+var EnforcementStatus$zodSchema;
+var init_enforcementstatus = __esm(() => {
+  init_zod();
+  EnforcementStatus$zodSchema = _enum([
+    "applied",
+    "failed"
+  ]).describe("applied when the identity provider accepted the action, failed when it refused it or could not be reached. Only applied counts as enforced.");
+});
+
+// src/models/enforcement.ts
+var Enforcement$zodSchema;
+var init_enforcement = __esm(() => {
+  init_zod();
+  init_enforcementaction();
+  init_enforcementprovider();
+  init_enforcementstate();
+  init_enforcementstatus();
+  init_flow();
+  Enforcement$zodSchema = object({
+    account_id: string2().describe("The account_id of the request path."),
+    action: EnforcementAction$zodSchema.describe("What the workspace did in its identity provider: revoke_sessions (signed the account out everywhere), restrict (limited what the account can do), unrestrict (lifted an earlier restriction), fail_onboarding (stopped an account that was still onboarding), reject_activation (refused to activate a provisional account) or none (decided to take no action)."),
+    created_at: string2().describe("When NoResponse first recorded this enforcement, in UTC. A failed record that becomes applied keeps it."),
+    error_code: string2().optional().describe("Why a failed action failed, as a short code of the workspace's choosing (lower-case letters, digits, '_', '.' and '-'), such as the identity provider's error code. Allowed only with status failed: with status applied it answers 400 invalid_request. Keep personal data out of it."),
+    flow: Flow$zodSchema.describe("The event an assessment is made for: account_creation (a user creates an account), login (a user returns to an existing account) or purchase (a payment or a credit grant). The account's risk is reported with the decision for this flow."),
+    id: string2().describe("Opaque, server-assigned id of one recorded enforcement: 'enf_' and 26 Crockford base32 characters. Unique within the workspace."),
+    provider: EnforcementProvider$zodSchema.describe("The identity provider the action ran in; custom for the workspace's own user store."),
+    risk_version: int().describe("The account's risk_version the workspace acted on. It can be older than the account's current risk_version: such a record is kept and does not count for unenforced."),
+    state_before: EnforcementState$zodSchema.describe("The account's state in the workspace's identity provider just before the action: onboarding, provisional (created, not yet activated), active, restricted or rejected."),
+    status: EnforcementStatus$zodSchema.describe("applied when the identity provider accepted the action, failed when it refused it or could not be reached. Only applied counts as enforced.")
+  }).describe("The answer of POST /v1/accounts/{account_id}/enforcements: one enforcement of one of the calling workspace's accounts, kept once per (account, risk_version, flow, action). The first report answers 201 with the new record. A repeat answers 200 with the record as first stored, whatever the repeat's state_before, status, provider or error_code. The one exception is a stored failed record followed by an applied report: the record becomes applied, keeps its id and created_at, takes the applied report's state_before and provider, drops error_code and answers 201, so a successful retry after a failure is recorded. Only an applied record at the account's current risk_version takes the account out of GET /v1/accounts?unenforced=true.");
+});
+
+// src/models/enforcementrequest.ts
+var EnforcementRequest$zodSchema;
+var init_enforcementrequest = __esm(() => {
+  init_zod();
+  init_enforcementaction();
+  init_enforcementprovider();
+  init_enforcementstate();
+  init_enforcementstatus();
+  init_flow();
+  EnforcementRequest$zodSchema = object({
+    action: EnforcementAction$zodSchema.describe("What the workspace did in its identity provider: revoke_sessions (signed the account out everywhere), restrict (limited what the account can do), unrestrict (lifted an earlier restriction), fail_onboarding (stopped an account that was still onboarding), reject_activation (refused to activate a provisional account) or none (decided to take no action)."),
+    error_code: string2().optional().describe("Why a failed action failed, as a short code of the workspace's choosing (lower-case letters, digits, '_', '.' and '-'), such as the identity provider's error code. Allowed only with status failed: with status applied it answers 400 invalid_request. Keep personal data out of it."),
+    flow: Flow$zodSchema.describe("The event an assessment is made for: account_creation (a user creates an account), login (a user returns to an existing account) or purchase (a payment or a credit grant). The account's risk is reported with the decision for this flow."),
+    provider: EnforcementProvider$zodSchema.describe("The identity provider the action ran in; custom for the workspace's own user store."),
+    risk_version: int().describe("The account's risk_version the workspace acted on, as read from GET /v1/accounts/{account_id}, GET /v1/accounts, an assessment answer or account.risk_changed. A version older than the account's current one is accepted and stored; a version newer than the current one answers 409 risk_version_ahead."),
+    state_before: EnforcementState$zodSchema.describe("The account's state in the workspace's identity provider just before the action: onboarding, provisional (created, not yet activated), active, restricted or rejected."),
+    status: EnforcementStatus$zodSchema.describe("applied when the identity provider accepted the action, failed when it refused it or could not be reached. Only applied counts as enforced.")
+  }).describe("POST /v1/accounts/{account_id}/enforcements body: what the workspace did to the account in its identity provider after reading the account's risk at risk_version. The account is named by the path and the workspace by the API key, so neither is a body member. An enforcement is the workspace's own action, not an outcome: what the workspace later learned about an assessment goes to POST /v1/assessments/{assessment_id}/outcomes. The record's key is (account, risk_version, flow, action), so a retry of the same report is safe and needs no Idempotency-Key.");
+});
+
+// src/models/recordenforcementop.ts
+var RecordEnforcementRequest$zodSchema, RecordEnforcementResponseResult$zodSchema, RecordEnforcementResponse$zodSchema;
+var init_recordenforcementop = __esm(() => {
+  init_zod();
+  init_authenticationerror();
+  init_badrequesterror();
+  init_conflicterror();
+  init_enforcement();
+  init_enforcementrequest();
+  init_notfounderror();
+  init_permissiondeniederror();
+  init_ratelimiterror();
+  RecordEnforcementRequest$zodSchema = object({
+    account_id: string2().describe("The account_id the workspace sends with its assessments, as one path segment (percent-encode '|' and ':' if the client requires it). A value that does not match the account_id shape answers 400 invalid_request."),
+    body: EnforcementRequest$zodSchema
+  });
+  RecordEnforcementResponseResult$zodSchema = union([
+    Enforcement$zodSchema,
+    BadRequestError$zodSchema,
+    AuthenticationError$zodSchema,
+    PermissionDeniedError$zodSchema,
+    NotFoundError$zodSchema,
+    ConflictError$zodSchema,
+    RateLimitError$zodSchema
+  ]);
+  RecordEnforcementResponse$zodSchema = object({
+    Headers: record(string2(), array(string2())).default({}),
+    Result: union([
+      Enforcement$zodSchema,
+      BadRequestError$zodSchema,
+      AuthenticationError$zodSchema,
+      PermissionDeniedError$zodSchema,
+      NotFoundError$zodSchema,
+      ConflictError$zodSchema,
+      RateLimitError$zodSchema
+    ])
+  });
+});
+
+// src/funcs/accountsRecordEnforcement.ts
+function accountsRecordEnforcement(client$, request, options) {
+  return new APIPromise($do6(client$, request, options));
+}
+async function $do6(client$, request, options) {
+  const parsed$ = safeParse2(request, (value$) => RecordEnforcementRequest$zodSchema.parse(value$), "Input validation failed");
+  if (!parsed$.ok) {
+    return [parsed$, { status: "invalid" }];
+  }
+  const payload$ = parsed$.value;
+  const body$ = encodeJSON("body", payload$.body, { explode: true });
+  const pathParams$ = {
+    account_id: encodeSimple("account_id", payload$.account_id, {
+      explode: false,
+      charEncoding: "percent"
+    })
+  };
+  const path$ = pathToFunc("/v1/accounts/{account_id}/enforcements")(pathParams$);
+  const headers$ = new Headers(compactMap({
+    "Content-Type": "application/json",
+    Accept: options?.acceptHeaderOverride || "application/json;q=1, application/problem+json;q=0"
+  }));
+  const securityInput = await extractSecurity(client$._options.security);
+  const requestSecurity = resolveGlobalSecurity(securityInput);
+  const context = {
+    options: client$._options,
+    baseURL: options?.serverURL ?? client$._baseURL ?? "",
+    operationID: "recordEnforcement",
+    oAuth2Scopes: null,
+    resolvedSecurity: requestSecurity,
+    securitySource: client$._options.security,
+    retryConfig: options?.retries || client$._options.retryConfig || {
+      strategy: "backoff",
+      backoff: {
+        initialInterval: 500,
+        maxInterval: 8000,
+        exponent: 2,
+        maxElapsedTime: 30000
+      },
+      retryConnectionErrors: true
+    },
+    retryCodes: options?.retryCodes || [
+      "408",
+      "429",
+      "5XX"
+    ]
+  };
+  const requestRes = client$._createRequest(context, {
+    security: requestSecurity,
+    method: "POST",
+    baseURL: options?.serverURL,
+    path: path$,
+    headers: headers$,
+    body: body$,
+    userAgent: client$._options.userAgent,
+    timeoutMs: options?.timeoutMs || client$._options.timeoutMs || -1
+  }, options);
+  if (!requestRes.ok) {
+    return [requestRes, { status: "invalid" }];
+  }
+  const req$ = requestRes.value;
+  const doResult = await client$._do(req$, {
+    context,
+    errorCodes: [],
+    retryConfig: context.retryConfig,
+    retryCodes: context.retryCodes
+  });
+  if (!doResult.ok) {
+    return [doResult, { status: "request-error", request: req$ }];
+  }
+  return [doResult, {
+    status: "complete",
+    request: req$,
+    response: doResult.value
+  }];
+}
+var init_accountsRecordEnforcement = __esm(() => {
+  init_encodings();
+  init_primitives();
+  init_schemas3();
+  init_security();
+  init_url();
+  init_recordenforcementop();
+  init_async();
+});
+
+// src/mcp-server/tools/accountsRecordEnforcement.ts
+var args6, tool$accountsRecordEnforcement;
+var init_accountsRecordEnforcement2 = __esm(() => {
+  init_accountsRecordEnforcement();
+  init_recordenforcementop();
+  init_tools();
+  args6 = {
+    request: RecordEnforcementRequest$zodSchema
+  };
+  tool$accountsRecordEnforcement = {
+    name: "record_enforcement",
+    description: `Record what you did to an account in your identity provider.
+
+Records what you did to the account in your identity provider for one flow's decision at one risk_version: the action (or none), the account's state before it, the provider and whether it was applied or failed. It is your action, not an outcome, and it leaves the account's risk unchanged. A record is kept once per account, risk_version, flow and action: the first report answers 201, and a repeat answers 200 with the stored record unchanged, so retries are safe without an Idempotency-Key. An applied report after a failed one replaces the failed record, keeping its id and created_at, and answers 201. A risk_version older than the account's current one is accepted and stored, but only an applied record at the current risk_version takes the account out of listChanged with unenforced=true; a newer one answers 409 risk_version_ahead. An account with no current risk answers 404 not_found. error_code is allowed only with status failed. Requires the history scope.`,
+    annotations: {
+      title: "Record an enforcement of an account",
+      destructiveHint: false,
+      idempotentHint: true,
+      openWorldHint: false,
+      readOnlyHint: false
+    },
+    args: args6,
+    tool: async (client, args, ctx) => {
+      const [result] = await accountsRecordEnforcement(client, args.request, { fetchOptions: { signal: ctx.mcpReq.signal } }).$inspect();
+      if (!result.ok) {
+        return {
+          content: [{ type: "text", text: result.error.message }],
+          isError: true
+        };
+      }
+      return formatResult(result.value);
+    }
+  };
+});
+
 // src/models/platform.ts
 var Platform$zodSchema;
 var init_platform = __esm(() => {
@@ -52581,9 +53004,9 @@ var init_createassessmentop = __esm(() => {
 
 // src/funcs/assessmentsCreate.ts
 function assessmentsCreate(client$, request, options) {
-  return new APIPromise($do5(client$, request, options));
+  return new APIPromise($do7(client$, request, options));
 }
-async function $do5(client$, request, options) {
+async function $do7(client$, request, options) {
   const parsed$ = safeParse2(request, (value$) => CreateAssessmentRequest$zodSchema.parse(value$), "Input validation failed");
   if (!parsed$.ok) {
     return [parsed$, { status: "invalid" }];
@@ -52661,12 +53084,12 @@ var init_assessmentsCreate = __esm(() => {
 });
 
 // src/mcp-server/tools/assessmentsCreate.ts
-var args5, tool$assessmentsCreate;
+var args7, tool$assessmentsCreate;
 var init_assessmentsCreate2 = __esm(() => {
   init_assessmentsCreate();
   init_createassessmentop();
   init_tools();
-  args5 = {
+  args7 = {
     request: CreateAssessmentRequest$zodSchema
   };
   tool$assessmentsCreate = {
@@ -52681,7 +53104,7 @@ Assesses one account creation, login or purchase (flow) and answers with the acc
       openWorldHint: false,
       readOnlyHint: false
     },
-    args: args5,
+    args: args7,
     tool: async (client, args, ctx) => {
       const [result] = await assessmentsCreate(client, args.request, { fetchOptions: { signal: ctx.mcpReq.signal } }).$inspect();
       if (!result.ok) {
@@ -52758,9 +53181,9 @@ var init_deleteassessmentop = __esm(() => {
 
 // src/funcs/assessmentsDelete.ts
 function assessmentsDelete(client$, request, options) {
-  return new APIPromise($do6(client$, request, options));
+  return new APIPromise($do8(client$, request, options));
 }
-async function $do6(client$, request, options) {
+async function $do8(client$, request, options) {
   const parsed$ = safeParse2(request, (value$) => DeleteAssessmentRequest$zodSchema.parse(value$), "Input validation failed");
   if (!parsed$.ok) {
     return [parsed$, { status: "invalid" }];
@@ -52842,12 +53265,12 @@ var init_assessmentsDelete = __esm(() => {
 });
 
 // src/mcp-server/tools/assessmentsDelete.ts
-var args6, tool$assessmentsDelete;
+var args8, tool$assessmentsDelete;
 var init_assessmentsDelete2 = __esm(() => {
   init_assessmentsDelete();
   init_deleteassessmentop();
   init_tools();
-  args6 = {
+  args8 = {
     request: DeleteAssessmentRequest$zodSchema
   };
   tool$assessmentsDelete = {
@@ -52862,7 +53285,7 @@ Deletes one assessment in the environment of your key, with its versions, eviden
       openWorldHint: false,
       readOnlyHint: false
     },
-    args: args6,
+    args: args8,
     tool: async (client, args, ctx) => {
       const [result] = await assessmentsDelete(client, args.request, { fetchOptions: { signal: ctx.mcpReq.signal } }).$inspect();
       if (!result.ok) {
@@ -52877,12 +53300,12 @@ Deletes one assessment in the environment of your key, with its versions, eviden
 });
 
 // src/mcp-server/tools/assessmentsGet.ts
-var args7, tool$assessmentsGet;
+var args9, tool$assessmentsGet;
 var init_assessmentsGet2 = __esm(() => {
   init_assessmentsGet();
   init_getassessmentop();
   init_tools();
-  args7 = {
+  args9 = {
     request: GetAssessmentRequest$zodSchema
   };
   tool$assessmentsGet = {
@@ -52897,7 +53320,7 @@ Returns the highest assessment_version, with the account's current risk. Require
       openWorldHint: false,
       readOnlyHint: true
     },
-    args: args7,
+    args: args9,
     tool: async (client, args, ctx) => {
       const [result] = await assessmentsGet(client, args.request, { fetchOptions: { signal: ctx.mcpReq.signal } }).$inspect();
       if (!result.ok) {
@@ -52926,9 +53349,9 @@ var init_assessmentquery = __esm(() => {
 
 // src/funcs/assessmentsQuery.ts
 function assessmentsQuery(client$, request, options) {
-  return new APIPromise($do7(client$, request, options));
+  return new APIPromise($do9(client$, request, options));
 }
-async function $do7(client$, request, options) {
+async function $do9(client$, request, options) {
   const parsed$ = safeParse2(request, (value$) => AssessmentQuery$zodSchema.parse(value$), "Input validation failed");
   if (!parsed$.ok) {
     return [parsed$, { status: "invalid" }];
@@ -53005,12 +53428,12 @@ var init_assessmentsQuery = __esm(() => {
 });
 
 // src/mcp-server/tools/assessmentsQuery.ts
-var args8, tool$assessmentsQuery;
+var args10, tool$assessmentsQuery;
 var init_assessmentsQuery2 = __esm(() => {
   init_assessmentsQuery();
   init_assessmentquery();
   init_tools();
-  args8 = {
+  args10 = {
     request: AssessmentQuery$zodSchema
   };
   tool$assessmentsQuery = {
@@ -53025,7 +53448,7 @@ History is a POST with account_id in the body so an account identifier stays out
       openWorldHint: false,
       readOnlyHint: true
     },
-    args: args8,
+    args: args10,
     tool: async (client, args, ctx) => {
       const [result] = await assessmentsQuery(client, args.request, { fetchOptions: { signal: ctx.mcpReq.signal } }).$inspect();
       if (!result.ok) {
@@ -53121,9 +53544,9 @@ var init_recordassessmentoutcomeop = __esm(() => {
 
 // src/funcs/assessmentsRecordOutcome.ts
 function assessmentsRecordOutcome(client$, request, options) {
-  return new APIPromise($do8(client$, request, options));
+  return new APIPromise($do10(client$, request, options));
 }
-async function $do8(client$, request, options) {
+async function $do10(client$, request, options) {
   const parsed$ = safeParse2(request, (value$) => RecordAssessmentOutcomeRequest$zodSchema.parse(value$), "Input validation failed");
   if (!parsed$.ok) {
     return [parsed$, { status: "invalid" }];
@@ -53207,12 +53630,12 @@ var init_assessmentsRecordOutcome = __esm(() => {
 });
 
 // src/mcp-server/tools/assessmentsRecordOutcome.ts
-var args9, tool$assessmentsRecordOutcome;
+var args11, tool$assessmentsRecordOutcome;
 var init_assessmentsRecordOutcome2 = __esm(() => {
   init_assessmentsRecordOutcome();
   init_recordassessmentoutcomeop();
   init_tools();
-  args9 = {
+  args11 = {
     request: RecordAssessmentOutcomeRequest$zodSchema
   };
   tool$assessmentsRecordOutcome = {
@@ -53227,7 +53650,7 @@ Records what you later learned about an assessed account: confirmed_abuse, accou
       openWorldHint: false,
       readOnlyHint: false
     },
-    args: args9,
+    args: args11,
     tool: async (client, args, ctx) => {
       const [result] = await assessmentsRecordOutcome(client, args.request, { fetchOptions: { signal: ctx.mcpReq.signal } }).$inspect();
       if (!result.ok) {
@@ -53276,9 +53699,9 @@ var init_integrationrequest = __esm(() => {
 
 // src/funcs/integrationsCreate.ts
 function integrationsCreate(client$, request, options) {
-  return new APIPromise($do9(client$, request, options));
+  return new APIPromise($do11(client$, request, options));
 }
-async function $do9(client$, request, options) {
+async function $do11(client$, request, options) {
   const parsed$ = safeParse2(request, (value$) => IntegrationRequest$zodSchema.parse(value$), "Input validation failed");
   if (!parsed$.ok) {
     return [parsed$, { status: "invalid" }];
@@ -53342,12 +53765,12 @@ var init_integrationsCreate = __esm(() => {
 });
 
 // src/mcp-server/tools/integrationsCreate.ts
-var args10, tool$integrationsCreate;
+var args12, tool$integrationsCreate;
 var init_integrationsCreate2 = __esm(() => {
   init_integrationsCreate();
   init_integrationrequest();
   init_tools();
-  args10 = {
+  args12 = {
     request: IntegrationRequest$zodSchema
   };
   tool$integrationsCreate = {
@@ -53362,7 +53785,7 @@ Registers a WorkOS or Auth0 integration and returns its hosted endpoint, url, so
       openWorldHint: false,
       readOnlyHint: false
     },
-    args: args10,
+    args: args12,
     tool: async (client, args, ctx) => {
       const [result] = await integrationsCreate(client, args.request, { fetchOptions: { signal: ctx.mcpReq.signal } }).$inspect();
       if (!result.ok) {
@@ -53412,9 +53835,9 @@ var init_deleteintegrationop = __esm(() => {
 
 // src/funcs/integrationsDelete.ts
 function integrationsDelete(client$, request, options) {
-  return new APIPromise($do10(client$, request, options));
+  return new APIPromise($do12(client$, request, options));
 }
-async function $do10(client$, request, options) {
+async function $do12(client$, request, options) {
   const parsed$ = safeParse2(request, (value$) => DeleteIntegrationRequest$zodSchema.parse(value$), "Input validation failed");
   if (!parsed$.ok) {
     return [parsed$, { status: "invalid" }];
@@ -53496,12 +53919,12 @@ var init_integrationsDelete = __esm(() => {
 });
 
 // src/mcp-server/tools/integrationsDelete.ts
-var args11, tool$integrationsDelete;
+var args13, tool$integrationsDelete;
 var init_integrationsDelete2 = __esm(() => {
   init_integrationsDelete();
   init_deleteintegrationop();
   init_tools();
-  args11 = {
+  args13 = {
     request: DeleteIntegrationRequest$zodSchema
   };
   tool$integrationsDelete = {
@@ -53516,7 +53939,7 @@ Removes the integration and its secrets; its endpoint answers 404 from then on,
       openWorldHint: false,
       readOnlyHint: false
     },
-    args: args11,
+    args: args13,
     tool: async (client, args, ctx) => {
       const [result] = await integrationsDelete(client, args.request, { fetchOptions: { signal: ctx.mcpReq.signal } }).$inspect();
       if (!result.ok) {
@@ -53532,9 +53955,9 @@ Removes the integration and its secrets; its endpoint answers 404 from then on,
 
 // src/funcs/integrationsList.ts
 function integrationsList(client$, options) {
-  return new APIPromise($do11(client$, options));
+  return new APIPromise($do13(client$, options));
 }
-async function $do11(client$, options) {
+async function $do13(client$, options) {
   const path$ = pathToFunc("/v1/integrations")();
   const headers$ = new Headers(compactMap({
     Accept: options?.acceptHeaderOverride || "application/json;q=1, application/problem+json;q=0"
@@ -53697,9 +54120,9 @@ var init_rotateintegrationsecretop = __esm(() => {
 
 // src/funcs/integrationsRotate.ts
 function integrationsRotate(client$, request, options) {
-  return new APIPromise($do12(client$, request, options));
+  return new APIPromise($do14(client$, request, options));
 }
-async function $do12(client$, request, options) {
+async function $do14(client$, request, options) {
   const parsed$ = safeParse2(request, (value$) => RotateIntegrationSecretRequest$zodSchema.parse(value$), "Input validation failed");
   if (!parsed$.ok) {
     return [parsed$, { status: "invalid" }];
@@ -53769,12 +54192,12 @@ var init_integrationsRotate = __esm(() => {
 });
 
 // src/mcp-server/tools/integrationsRotate.ts
-var args12, tool$integrationsRotate;
+var args14, tool$integrationsRotate;
 var init_integrationsRotate2 = __esm(() => {
   init_integrationsRotate();
   init_rotateintegrationsecretop();
   init_tools();
-  args12 = {
+  args14 = {
     request: RotateIntegrationSecretRequest$zodSchema
   };
   tool$integrationsRotate = {
@@ -53789,7 +54212,7 @@ For Auth0, send {} and the answer's secret is the new shared secret, shown once.
       openWorldHint: false,
       readOnlyHint: false
     },
-    args: args12,
+    args: args14,
     tool: async (client, args, ctx) => {
       const [result] = await integrationsRotate(client, args.request, { fetchOptions: { signal: ctx.mcpReq.signal } }).$inspect();
       if (!result.ok) {
@@ -53816,9 +54239,9 @@ var init_webhookendpointrequest = __esm(() => {
 
 // src/funcs/webhookEndpointsCreate.ts
 function webhookEndpointsCreate(client$, request, options) {
-  return new APIPromise($do13(client$, request, options));
+  return new APIPromise($do15(client$, request, options));
 }
-async function $do13(client$, request, options) {
+async function $do15(client$, request, options) {
   const parsed$ = safeParse2(request, (value$) => WebhookEndpointRequest$zodSchema.parse(value$), "Input validation failed");
   if (!parsed$.ok) {
     return [parsed$, { status: "invalid" }];
@@ -53882,12 +54305,12 @@ var init_webhookEndpointsCreate = __esm(() => {
 });
 
 // src/mcp-server/tools/webhookEndpointsCreate.ts
-var args13, tool$webhookEndpointsCreate;
+var args15, tool$webhookEndpointsCreate;
 var init_webhookEndpointsCreate2 = __esm(() => {
   init_webhookEndpointsCreate();
   init_webhookendpointrequest();
   init_tools();
-  args13 = {
+  args15 = {
     request: WebhookEndpointRequest$zodSchema
   };
   tool$webhookEndpointsCreate = {
@@ -53902,7 +54325,7 @@ Registers a webhook endpoint and returns it with its first signing secret, shown
       openWorldHint: false,
       readOnlyHint: false
     },
-    args: args13,
+    args: args15,
     tool: async (client, args, ctx) => {
       const [result] = await webhookEndpointsCreate(client, args.request, { fetchOptions: { signal: ctx.mcpReq.signal } }).$inspect();
       if (!result.ok) {
@@ -53952,9 +54375,9 @@ var init_deletewebhookendpointop = __esm(() => {
 
 // src/funcs/webhookEndpointsDelete.ts
 function webhookEndpointsDelete(client$, request, options) {
-  return new APIPromise($do14(client$, request, options));
+  return new APIPromise($do16(client$, request, options));
 }
-async function $do14(client$, request, options) {
+async function $do16(client$, request, options) {
   const parsed$ = safeParse2(request, (value$) => DeleteWebhookEndpointRequest$zodSchema.parse(value$), "Input validation failed");
   if (!parsed$.ok) {
     return [parsed$, { status: "invalid" }];
@@ -54036,12 +54459,12 @@ var init_webhookEndpointsDelete = __esm(() => {
 });
 
 // src/mcp-server/tools/webhookEndpointsDelete.ts
-var args14, tool$webhookEndpointsDelete;
+var args16, tool$webhookEndpointsDelete;
 var init_webhookEndpointsDelete2 = __esm(() => {
   init_webhookEndpointsDelete();
   init_deletewebhookendpointop();
   init_tools();
-  args14 = {
+  args16 = {
     request: DeleteWebhookEndpointRequest$zodSchema
   };
   tool$webhookEndpointsDelete = {
@@ -54056,7 +54479,7 @@ Deletes the endpoint and its signing keys. Deliveries still queued for it are dr
       openWorldHint: false,
       readOnlyHint: false
     },
-    args: args14,
+    args: args16,
     tool: async (client, args, ctx) => {
       const [result] = await webhookEndpointsDelete(client, args.request, { fetchOptions: { signal: ctx.mcpReq.signal } }).$inspect();
       if (!result.ok) {
@@ -54072,9 +54495,9 @@ Deletes the endpoint and its signing keys. Deliveries still queued for it are dr
 
 // src/funcs/webhookEndpointsList.ts
 function webhookEndpointsList(client$, options) {
-  return new APIPromise($do15(client$, options));
+  return new APIPromise($do17(client$, options));
 }
-async function $do15(client$, options) {
+async function $do17(client$, options) {
   const path$ = pathToFunc("/v1/webhooks")();
   const headers$ = new Headers(compactMap({
     Accept: options?.acceptHeaderOverride || "application/json;q=1, application/problem+json;q=0"
@@ -54266,9 +54689,9 @@ var init_listwebhookdeliveriesop = __esm(() => {
 
 // src/funcs/webhookEndpointsListDeliveries.ts
 function webhookEndpointsListDeliveries(client$, request, options) {
-  return new APIPromise($do16(client$, request, options));
+  return new APIPromise($do18(client$, request, options));
 }
-async function $do16(client$, request, options) {
+async function $do18(client$, request, options) {
   const parsed$ = safeParse2(request, (value$) => ListWebhookDeliveriesRequest$zodSchema.parse(value$), "Input validation failed");
   if (!parsed$.ok) {
     return [parsed$, { status: "invalid" }];
@@ -54355,12 +54778,12 @@ var init_webhookEndpointsListDeliveries = __esm(() => {
 });
 
 // src/mcp-server/tools/webhookEndpointsListDeliveries.ts
-var args15, tool$webhookEndpointsListDeliveries;
+var args17, tool$webhookEndpointsListDeliveries;
 var init_webhookEndpointsListDeliveries2 = __esm(() => {
   init_webhookEndpointsListDeliveries();
   init_listwebhookdeliveriesop();
   init_tools();
-  args15 = {
+  args17 = {
     request: ListWebhookDeliveriesRequest$zodSchema
   };
   tool$webhookEndpointsListDeliveries = {
@@ -54375,7 +54798,7 @@ Every POST the endpoint received, newest first: the event id and type, which att
       openWorldHint: false,
       readOnlyHint: true
     },
-    args: args15,
+    args: args17,
     tool: async (client, args, ctx) => {
       const [result] = await webhookEndpointsListDeliveries(client, args.request, { fetchOptions: { signal: ctx.mcpReq.signal } }).$inspect();
       if (!result.ok) {
@@ -54449,9 +54872,9 @@ var init_replaywebhookdeliveryop = __esm(() => {
 
 // src/funcs/webhookEndpointsReplayDelivery.ts
 function webhookEndpointsReplayDelivery(client$, request, options) {
-  return new APIPromise($do17(client$, request, options));
+  return new APIPromise($do19(client$, request, options));
 }
-async function $do17(client$, request, options) {
+async function $do19(client$, request, options) {
   const parsed$ = safeParse2(request, (value$) => ReplayWebhookDeliveryRequest$zodSchema.parse(value$), "Input validation failed");
   if (!parsed$.ok) {
     return [parsed$, { status: "invalid" }];
@@ -54525,12 +54948,12 @@ var init_webhookEndpointsReplayDelivery = __esm(() => {
 });
 
 // src/mcp-server/tools/webhookEndpointsReplayDelivery.ts
-var args16, tool$webhookEndpointsReplayDelivery;
+var args18, tool$webhookEndpointsReplayDelivery;
 var init_webhookEndpointsReplayDelivery2 = __esm(() => {
   init_webhookEndpointsReplayDelivery();
   init_replaywebhookdeliveryop();
   init_tools();
-  args16 = {
+  args18 = {
     request: ReplayWebhookDeliveryRequest$zodSchema
   };
   tool$webhookEndpointsReplayDelivery = {
@@ -54545,7 +54968,7 @@ Queues the event for the endpoint again: the same event id and body it received,
       openWorldHint: false,
       readOnlyHint: false
     },
-    args: args16,
+    args: args18,
     tool: async (client, args, ctx) => {
       const [result] = await webhookEndpointsReplayDelivery(client, args.request, { fetchOptions: { signal: ctx.mcpReq.signal } }).$inspect();
       if (!result.ok) {
@@ -54631,9 +55054,9 @@ var init_rotatewebhooksigningkeyop = __esm(() => {
 
 // src/funcs/webhookEndpointsRotateSigningKey.ts
 function webhookEndpointsRotateSigningKey(client$, request, options) {
-  return new APIPromise($do18(client$, request, options));
+  return new APIPromise($do20(client$, request, options));
 }
-async function $do18(client$, request, options) {
+async function $do20(client$, request, options) {
   const parsed$ = safeParse2(request, (value$) => RotateWebhookSigningKeyRequest$zodSchema.parse(value$), "Input validation failed");
   if (!parsed$.ok) {
     return [parsed$, { status: "invalid" }];
@@ -54703,12 +55126,12 @@ var init_webhookEndpointsRotateSigningKey = __esm(() => {
 });
 
 // src/mcp-server/tools/webhookEndpointsRotateSigningKey.ts
-var args17, tool$webhookEndpointsRotateSigningKey;
+var args19, tool$webhookEndpointsRotateSigningKey;
 var init_webhookEndpointsRotateSigningKey2 = __esm(() => {
   init_webhookEndpointsRotateSigningKey();
   init_rotatewebhooksigningkeyop();
   init_tools();
-  args17 = {
+  args19 = {
     request: RotateWebhookSigningKeyRequest$zodSchema
   };
   tool$webhookEndpointsRotateSigningKey = {
@@ -54723,7 +55146,7 @@ Issues a new signing key for the endpoint and returns its secret once. Every del
       openWorldHint: false,
       readOnlyHint: false
     },
-    args: args17,
+    args: args19,
     tool: async (client, args, ctx) => {
       const [result] = await webhookEndpointsRotateSigningKey(client, args.request, { fetchOptions: { signal: ctx.mcpReq.signal } }).$inspect();
       if (!result.ok) {
@@ -54824,9 +55247,9 @@ var init_sendwebhooktesteventop = __esm(() => {
 
 // src/funcs/webhookEndpointsSendTestEvent.ts
 function webhookEndpointsSendTestEvent(client$, request, options) {
-  return new APIPromise($do19(client$, request, options));
+  return new APIPromise($do21(client$, request, options));
 }
-async function $do19(client$, request, options) {
+async function $do21(client$, request, options) {
   const parsed$ = safeParse2(request, (value$) => SendWebhookTestEventRequest$zodSchema.parse(value$), "Input validation failed");
   if (!parsed$.ok) {
     return [parsed$, { status: "invalid" }];
@@ -54896,12 +55319,12 @@ var init_webhookEndpointsSendTestEvent = __esm(() => {
 });
 
 // src/mcp-server/tools/webhookEndpointsSendTestEvent.ts
-var args18, tool$webhookEndpointsSendTestEvent;
+var args20, tool$webhookEndpointsSendTestEvent;
 var init_webhookEndpointsSendTestEvent2 = __esm(() => {
   init_webhookEndpointsSendTestEvent();
   init_sendwebhooktesteventop();
   init_tools();
-  args18 = {
+  args20 = {
     request: SendWebhookTestEventRequest$zodSchema
   };
   tool$webhookEndpointsSendTestEvent = {
@@ -54916,7 +55339,7 @@ endpoint.verification sends a signed challenge now and answers whether the endpo
       openWorldHint: false,
       readOnlyHint: false
     },
-    args: args18,
+    args: args20,
     tool: async (client, args, ctx) => {
       const [result] = await webhookEndpointsSendTestEvent(client, args.request, { fetchOptions: { signal: ctx.mcpReq.signal } }).$inspect();
       if (!result.ok) {
@@ -54934,7 +55357,7 @@ endpoint.verification sends a signed challenge now and answers whether the endpo
 function createMCPServer(deps) {
   const server = new McpServer({
     name: "NoResponse",
-    version: "0.4.1"
+    version: "0.4.3"
   });
   const getClient = deps.getSDK || (() => new NoResponseCore({
     security: deps.security,
@@ -54958,9 +55381,11 @@ function createMCPServer(deps) {
   tool(tool$assessmentsDelete);
   tool(tool$assessmentsRecordOutcome);
   tool(tool$assessmentsQuery);
+  tool(tool$accountsListChanged);
   tool(tool$accountsGet);
   tool(tool$accountsDelete);
   tool(tool$accountsListAssessments);
+  tool(tool$accountsRecordEnforcement);
   tool(tool$integrationsCreate);
   tool(tool$integrationsList);
   tool(tool$integrationsDelete);
@@ -54988,6 +55413,8 @@ var init_server = __esm(() => {
   init_accountsDelete2();
   init_accountsGet2();
   init_accountsListAssessments2();
+  init_accountsListChanged2();
+  init_accountsRecordEnforcement2();
   init_assessmentsCreate2();
   init_assessmentsDelete2();
   init_assessmentsGet2();
@@ -55039,6 +55466,12 @@ Records what you later learned about an assessed account: confirmed_abuse, accou
       description: `Page through one account's unexpired assessments.
 
 History is a POST with account_id in the body so an account identifier stays out of URLs and access logs. Requires the history scope. Read-only and safe to retry. Newest first, each at its latest assessment_version. An account with no assessments answers 200 with empty items. The cursor is opaque and bound to your workspace and the account; a tampered or expired cursor answers 400 invalid_cursor. response_mode=detailed needs the detailed scope.`
+    },
+    {
+      name: "list_changed_accounts",
+      description: `Poll the accounts whose risk changed.
+
+Your accounts whose risk changed, oldest change first, each as accounts.get answers it. Every page carries next_cursor: pass it back as changed_since to read the changes made after that page; without changed_since the list starts from the oldest change. When nothing changed, items is empty and next_cursor is the cursor you sent, so poll by calling again with the latest next_cursor. An account appears again each time its risk changes, with a higher risk_version; keep the copy with the highest. unenforced=true lists only accounts with a decision other than allow for some flow and no applied enforcement at their current risk_version; such a page can hold fewer than limit items, or none, while later changes exist, so keep polling with next_cursor. Requires the history scope. Read-only and safe to retry. A tampered or foreign cursor answers 400 invalid_cursor.`
     },
     {
       name: "get_account",
@@ -55057,6 +55490,12 @@ Erases the account in the environment of your key, for an erasure request from y
       description: `Page through one account's unexpired assessments.
 
 The account's history: the same page as POST /v1/assessments/query for this account_id, newest first, each at its latest assessment_version. Requires the history scope. Read-only and safe to retry. An account with no assessments answers 200 with empty items. The cursor is opaque and bound to your workspace and the account; a tampered or expired cursor answers 400 invalid_cursor. response_mode=detailed needs the detailed scope. The account_id travels in the URL; use POST /v1/assessments/query to keep it out of access logs.`
+    },
+    {
+      name: "record_enforcement",
+      description: `Record what you did to an account in your identity provider.
+
+Records what you did to the account in your identity provider for one flow's decision at one risk_version: the action (or none), the account's state before it, the provider and whether it was applied or failed. It is your action, not an outcome, and it leaves the account's risk unchanged. A record is kept once per account, risk_version, flow and action: the first report answers 201, and a repeat answers 200 with the stored record unchanged, so retries are safe without an Idempotency-Key. An applied report after a failed one replaces the failed record, keeping its id and created_at, and answers 201. A risk_version older than the account's current one is accepted and stored, but only an applied record at the current risk_version takes the account out of listChanged with unenforced=true; a newer one answers 409 risk_version_ahead. An account with no current risk answers 404 not_found. error_code is allowed only with status failed. Requires the history scope.`
     },
     {
       name: "create_integration",
@@ -63623,7 +64062,7 @@ var routes = buildRouteMap({
 var app = buildApplication(routes, {
   name: "mcp",
   versionInfo: {
-    currentVersion: "0.4.1"
+    currentVersion: "0.4.3"
   }
 });
 run(app, process3.argv.slice(2), buildContext(process3));
@@ -63631,5 +64070,5 @@ export {
   app
 };
 
-//# debugId=1151B0B30959E3AA64756E2164756E21
+//# debugId=04ECF577D7FFCD0864756E2164756E21
 //# sourceMappingURL=mcp-server.js.map