@noresponse/mcp 0.4.12 → 0.5.1

package/bin/mcp-server.js

@@ -48104,9 +48104,9 @@ var init_config = __esm(() => {
   SDK_METADATA = {
     language: "typescript",
     openapiDocVersion: "1",
-    sdkVersion: "0.4.12",
+    sdkVersion: "0.5.1",
     genVersion: "internal",
-    userAgent: "noresponse-sdk/mcp-typescript 0.4.12 internal 1 @noresponse/mcp"
+    userAgent: "noresponse-sdk/mcp-typescript 0.5.1 internal 1 @noresponse/mcp"
   };
 });
 
@@ -51200,7 +51200,9 @@ var init_conflicterrorcode = __esm(() => {
     "webhook_endpoint_limit_reached",
     "webhook_endpoint_unverified",
     "too_many_integrations",
-    "risk_version_ahead"
+    "risk_version_ahead",
+    "key_limit_reached",
+    "self_revocation"
   ]).describe("Machine codes an HTTP 409 answer can carry.");
 });
 
@@ -51254,7 +51256,8 @@ var PermissionDeniedErrorCode$zodSchema;
 var init_permissiondeniederrorcode = __esm(() => {
   init_zod();
   PermissionDeniedErrorCode$zodSchema = _enum([
-    "workspace_forbidden"
+    "workspace_forbidden",
+    "role_forbidden"
   ]).describe("Machine codes an HTTP 403 answer can carry.");
 });
 
@@ -52424,7 +52427,7 @@ var init_listaccountsop = __esm(() => {
   ListAccountsRequest$zodSchema = object({
     changed_since: string2().describe("next_cursor from an earlier page, unchanged. Absent, the list starts from the oldest change.").optional(),
     limit: int().default(50).describe("Most accounts per page."),
-    unenforced: boolean2().default(false).describe("true lists only accounts with a decision other than allow for some flow and no applied enforcement at their current risk_version.")
+    unenforced: boolean2().default(false).describe("true lists only accounts with no applied enforcement at their current risk_version that have a decision other than allow for some flow or a hold no later applied enforcement resolved.")
   });
   ListAccountsResponseResult$zodSchema = union([
     BadRequestError$zodSchema,
@@ -52579,8 +52582,9 @@ var init_enforcementaction = __esm(() => {
     "unrestrict",
     "fail_onboarding",
     "reject_activation",
+    "activate",
     "none"
-  ]).describe("What the workspace did in its identity provider: revoke_sessions (signed the account out everywhere), restrict (limited what the account can do), unrestrict (lifted an earlier restriction), fail_onboarding (stopped an account that was still onboarding), reject_activation (refused to activate a provisional account) or none (decided to take no action).");
+  ]).describe("What the workspace did in its identity provider: revoke_sessions (signed the account out everywhere), restrict (limited what the account can do), unrestrict (lifted an earlier restriction), fail_onboarding (stopped an account that was still onboarding), reject_activation (refused to activate a provisional account), activate (let a held onboarding or provisional account in) or none (decided to take no action).");
 });
 
 // src/models/enforcementprovider.ts
@@ -52629,7 +52633,7 @@ var init_enforcement = __esm(() => {
   init_flow();
   Enforcement$zodSchema = object({
     account_id: string2().describe("The account_id of the request path."),
-    action: EnforcementAction$zodSchema.describe("What the workspace did in its identity provider: revoke_sessions (signed the account out everywhere), restrict (limited what the account can do), unrestrict (lifted an earlier restriction), fail_onboarding (stopped an account that was still onboarding), reject_activation (refused to activate a provisional account) or none (decided to take no action)."),
+    action: EnforcementAction$zodSchema.describe("What the workspace did in its identity provider: revoke_sessions (signed the account out everywhere), restrict (limited what the account can do), unrestrict (lifted an earlier restriction), fail_onboarding (stopped an account that was still onboarding), reject_activation (refused to activate a provisional account), activate (let a held onboarding or provisional account in) or none (decided to take no action)."),
     created_at: string2().describe("When NoResponse first recorded this enforcement, in UTC. A failed record that becomes applied keeps it."),
     error_code: string2().optional().describe("Why a failed action failed, as a short code of the workspace's choosing (lower-case letters, digits, '_', '.' and '-'), such as the identity provider's error code. Allowed only with status failed: with status applied it answers 400 invalid_request. Keep personal data out of it."),
     flow: Flow$zodSchema.describe("The event an assessment is made for: account_creation (a user creates an account), login (a user returns to an existing account) or purchase (a payment or a credit grant). The account's risk is reported with the decision for this flow."),
@@ -52651,7 +52655,7 @@ var init_enforcementrequest = __esm(() => {
   init_enforcementstatus();
   init_flow();
   EnforcementRequest$zodSchema = object({
-    action: EnforcementAction$zodSchema.describe("What the workspace did in its identity provider: revoke_sessions (signed the account out everywhere), restrict (limited what the account can do), unrestrict (lifted an earlier restriction), fail_onboarding (stopped an account that was still onboarding), reject_activation (refused to activate a provisional account) or none (decided to take no action)."),
+    action: EnforcementAction$zodSchema.describe("What the workspace did in its identity provider: revoke_sessions (signed the account out everywhere), restrict (limited what the account can do), unrestrict (lifted an earlier restriction), fail_onboarding (stopped an account that was still onboarding), reject_activation (refused to activate a provisional account), activate (let a held onboarding or provisional account in) or none (decided to take no action)."),
     error_code: string2().optional().describe("Why a failed action failed, as a short code of the workspace's choosing (lower-case letters, digits, '_', '.' and '-'), such as the identity provider's error code. Allowed only with status failed: with status applied it answers 400 invalid_request. Keep personal data out of it."),
     flow: Flow$zodSchema.describe("The event an assessment is made for: account_creation (a user creates an account), login (a user returns to an existing account) or purchase (a payment or a credit grant). The account's risk is reported with the decision for this flow."),
     provider: EnforcementProvider$zodSchema.describe("The identity provider the action ran in; custom for the workspace's own user store."),
@@ -54231,6 +54235,857 @@ For Auth0, send {} and the answer's secret is the new shared secret, shown once.
   };
 });
 
+// src/models/keyenvironment.ts
+var KeyEnvironment$zodSchema;
+var init_keyenvironment = __esm(() => {
+  init_zod();
+  KeyEnvironment$zodSchema = _enum([
+    "live",
+    "test"
+  ]).describe("The environment the key belongs to. A live key assesses with live sources; a test key answers from the deterministic simulator.");
+});
+
+// src/models/keystatus.ts
+var KeyStatus$zodSchema;
+var init_keystatus = __esm(() => {
+  init_zod();
+  KeyStatus$zodSchema = _enum([
+    "active",
+    "expired",
+    "revoked"
+  ]).describe("active: the key authenticates. expired: a rotation's overlap window has ended (expires_at). revoked: the key was revoked (revoked_at) and answers 401.");
+});
+
+// src/models/key.ts
+var KeyScope$zodSchema, Key$zodSchema;
+var init_key = __esm(() => {
+  init_zod();
+  init_keyenvironment();
+  init_keystatus();
+  KeyScope$zodSchema = _enum([
+    "assess",
+    "history",
+    "delete",
+    "webhooks",
+    "detailed",
+    "integrations",
+    "management"
+  ]);
+  Key$zodSchema = object({
+    created_at: string2(),
+    created_by: string2().optional().describe("The external user id of the member who created the key through the console, or the prefix (nrk_<environment>_<key id>) of the management key that created it. Absent for a key NoResponse issued or a rotation made."),
+    environment: KeyEnvironment$zodSchema.describe("The environment the key belongs to. A live key assesses with live sources; a test key answers from the deterministic simulator."),
+    expires_at: string2().optional().describe("When a rotated key stops authenticating (POST /v1/keys/rotate). Absent for a key with no end."),
+    id: string2().describe("The key's public id, a 26-character ULID."),
+    key: string2().optional().describe("The credential, nrk_<environment>_<key id>_<secret>. Present only in the 201 answer that created the key."),
+    prefix: string2().describe("The public start of the credential, nrk_<environment>_<key id>, which identifies the key in logs and secret stores without its secret."),
+    revoked_at: string2().optional(),
+    revoked_by: string2().optional().describe("The external user id of the member who revoked the key through the console, or the prefix of the management key that revoked it. Absent when the key is not revoked or NoResponse revoked it."),
+    scopes: array(KeyScope$zodSchema).describe("The key's scopes, each at most once."),
+    status: KeyStatus$zodSchema.describe("active: the key authenticates. expired: a rotation's overlap window has ended (expires_at). revoked: the key was revoked (revoked_at) and answers 401."),
+    workspace_id: string2().describe("The workspace id, which is also its live environment's workspace id; the test environment's is the same id with :test appended. A workspace created through the API is tnt_ and a 26-character ULID.")
+  }).describe("One API key of your workspace. A key belongs to exactly one environment. key, the secret credential, is present only in the answer that created the key: NoResponse keeps a peppered digest of it, so store it now. Every other field is safe to show.");
+});
+
+// src/models/keylist.ts
+var KeyList$zodSchema;
+var init_keylist = __esm(() => {
+  init_zod();
+  init_key();
+  KeyList$zodSchema = object({
+    items: array(Key$zodSchema)
+  }).describe("GET /v1/workspaces/{workspace_id}/keys: the keys of both of the workspace's environments, newest first, at most 200 of each, revoked and expired keys included. No item carries a secret.");
+});
+
+// src/models/listkeysop.ts
+var ListKeysRequest$zodSchema, ListKeysResponseResult$zodSchema, ListKeysResponse$zodSchema;
+var init_listkeysop = __esm(() => {
+  init_zod();
+  init_authenticationerror();
+  init_badrequesterror();
+  init_conflicterror();
+  init_keylist();
+  init_notfounderror();
+  init_permissiondeniederror();
+  init_ratelimiterror();
+  ListKeysRequest$zodSchema = object({
+    workspace_id: string2().describe("Your workspace id, as each key lists it in workspace_id. Another workspace, a malformed id and a test environment's id answer 404.")
+  });
+  ListKeysResponseResult$zodSchema = union([
+    BadRequestError$zodSchema,
+    AuthenticationError$zodSchema,
+    PermissionDeniedError$zodSchema,
+    NotFoundError$zodSchema,
+    ConflictError$zodSchema,
+    RateLimitError$zodSchema,
+    KeyList$zodSchema
+  ]);
+  ListKeysResponse$zodSchema = object({
+    Headers: record(string2(), array(string2())).default({}),
+    Result: union([
+      BadRequestError$zodSchema,
+      AuthenticationError$zodSchema,
+      PermissionDeniedError$zodSchema,
+      NotFoundError$zodSchema,
+      ConflictError$zodSchema,
+      RateLimitError$zodSchema,
+      KeyList$zodSchema
+    ])
+  });
+});
+
+// src/funcs/keysList.ts
+function keysList(client$, request, options) {
+  return new APIPromise($do15(client$, request, options));
+}
+async function $do15(client$, request, options) {
+  const parsed$ = safeParse2(request, (value$) => ListKeysRequest$zodSchema.parse(value$), "Input validation failed");
+  if (!parsed$.ok) {
+    return [parsed$, { status: "invalid" }];
+  }
+  const payload$ = parsed$.value;
+  const body$ = null;
+  const pathParams$ = {
+    workspace_id: encodeSimple("workspace_id", payload$.workspace_id, {
+      explode: false,
+      charEncoding: "percent"
+    })
+  };
+  const path$ = pathToFunc("/v1/workspaces/{workspace_id}/keys")(pathParams$);
+  const headers$ = new Headers(compactMap({
+    Accept: options?.acceptHeaderOverride || "application/json;q=1, application/problem+json;q=0"
+  }));
+  const securityInput = await extractSecurity(client$._options.security);
+  const requestSecurity = resolveGlobalSecurity(securityInput);
+  const context = {
+    options: client$._options,
+    baseURL: options?.serverURL ?? client$._baseURL ?? "",
+    operationID: "listKeys",
+    oAuth2Scopes: null,
+    resolvedSecurity: requestSecurity,
+    securitySource: client$._options.security,
+    retryConfig: options?.retries || client$._options.retryConfig || {
+      strategy: "backoff",
+      backoff: {
+        initialInterval: 500,
+        maxInterval: 8000,
+        exponent: 2,
+        maxElapsedTime: 30000
+      },
+      retryConnectionErrors: true
+    },
+    retryCodes: options?.retryCodes || [
+      "408",
+      "429",
+      "5XX"
+    ]
+  };
+  const requestRes = client$._createRequest(context, {
+    security: requestSecurity,
+    method: "GET",
+    baseURL: options?.serverURL,
+    path: path$,
+    headers: headers$,
+    body: body$,
+    userAgent: client$._options.userAgent,
+    timeoutMs: options?.timeoutMs || client$._options.timeoutMs || -1
+  }, options);
+  if (!requestRes.ok) {
+    return [requestRes, { status: "invalid" }];
+  }
+  const req$ = requestRes.value;
+  const doResult = await client$._do(req$, {
+    context,
+    errorCodes: [],
+    retryConfig: context.retryConfig,
+    retryCodes: context.retryCodes
+  });
+  if (!doResult.ok) {
+    return [doResult, { status: "request-error", request: req$ }];
+  }
+  return [doResult, {
+    status: "complete",
+    request: req$,
+    response: doResult.value
+  }];
+}
+var init_keysList = __esm(() => {
+  init_encodings();
+  init_primitives();
+  init_schemas3();
+  init_security();
+  init_url();
+  init_listkeysop();
+  init_async();
+});
+
+// src/mcp-server/tools/keysList.ts
+var args15, tool$keysList;
+var init_keysList2 = __esm(() => {
+  init_keysList();
+  init_listkeysop();
+  init_tools();
+  args15 = {
+    request: ListKeysRequest$zodSchema
+  };
+  tool$keysList = {
+    name: "list_keys",
+    description: `List API keys.
+
+Lists the keys of the signing key's environment, newest first, at most 200, revoked and expired keys included, without secrets: each key's id, prefix, scopes, status, and who created and revoked it. Requires the management scope. Read-only and safe to retry.`,
+    annotations: {
+      title: "List the API keys of this environment",
+      destructiveHint: false,
+      idempotentHint: true,
+      openWorldHint: false,
+      readOnlyHint: true
+    },
+    args: args15,
+    tool: async (client, args, ctx) => {
+      const [result] = await keysList(client, args.request, { fetchOptions: { signal: ctx.mcpReq.signal } }).$inspect();
+      if (!result.ok) {
+        return {
+          content: [{ type: "text", text: result.error.message }],
+          isError: true
+        };
+      }
+      return formatResult(result.value);
+    }
+  };
+});
+
+// src/models/revokekeyop.ts
+var RevokeKeyRequest$zodSchema, RevokeKeyResponseResult$zodSchema, RevokeKeyResponse$zodSchema;
+var init_revokekeyop = __esm(() => {
+  init_zod();
+  init_authenticationerror();
+  init_badrequesterror();
+  init_conflicterror();
+  init_key();
+  init_notfounderror();
+  init_permissiondeniederror();
+  init_ratelimiterror();
+  RevokeKeyRequest$zodSchema = object({
+    key_id: string2().describe("The key's id. A key of another workspace answers 404, as does a key of the other environment to an API key."),
+    workspace_id: string2().describe("Your workspace id, as each key lists it in workspace_id. Another workspace, a malformed id and a test environment's id answer 404.")
+  });
+  RevokeKeyResponseResult$zodSchema = union([
+    Key$zodSchema,
+    BadRequestError$zodSchema,
+    AuthenticationError$zodSchema,
+    PermissionDeniedError$zodSchema,
+    NotFoundError$zodSchema,
+    ConflictError$zodSchema,
+    RateLimitError$zodSchema
+  ]);
+  RevokeKeyResponse$zodSchema = object({
+    Headers: record(string2(), array(string2())).default({}),
+    Result: union([
+      Key$zodSchema,
+      BadRequestError$zodSchema,
+      AuthenticationError$zodSchema,
+      PermissionDeniedError$zodSchema,
+      NotFoundError$zodSchema,
+      ConflictError$zodSchema,
+      RateLimitError$zodSchema
+    ])
+  });
+});
+
+// src/funcs/keysRevoke.ts
+function keysRevoke(client$, request, options) {
+  return new APIPromise($do16(client$, request, options));
+}
+async function $do16(client$, request, options) {
+  const parsed$ = safeParse2(request, (value$) => RevokeKeyRequest$zodSchema.parse(value$), "Input validation failed");
+  if (!parsed$.ok) {
+    return [parsed$, { status: "invalid" }];
+  }
+  const payload$ = parsed$.value;
+  const body$ = null;
+  const pathParams$ = {
+    key_id: encodeSimple("key_id", payload$.key_id, {
+      explode: false,
+      charEncoding: "percent"
+    }),
+    workspace_id: encodeSimple("workspace_id", payload$.workspace_id, {
+      explode: false,
+      charEncoding: "percent"
+    })
+  };
+  const path$ = pathToFunc("/v1/workspaces/{workspace_id}/keys/{key_id}")(pathParams$);
+  const headers$ = new Headers(compactMap({
+    Accept: options?.acceptHeaderOverride || "application/json;q=1, application/problem+json;q=0"
+  }));
+  const securityInput = await extractSecurity(client$._options.security);
+  const requestSecurity = resolveGlobalSecurity(securityInput);
+  const context = {
+    options: client$._options,
+    baseURL: options?.serverURL ?? client$._baseURL ?? "",
+    operationID: "revokeKey",
+    oAuth2Scopes: null,
+    resolvedSecurity: requestSecurity,
+    securitySource: client$._options.security,
+    retryConfig: options?.retries || client$._options.retryConfig || {
+      strategy: "backoff",
+      backoff: {
+        initialInterval: 500,
+        maxInterval: 8000,
+        exponent: 2,
+        maxElapsedTime: 30000
+      },
+      retryConnectionErrors: true
+    },
+    retryCodes: options?.retryCodes || [
+      "408",
+      "429",
+      "5XX"
+    ]
+  };
+  const requestRes = client$._createRequest(context, {
+    security: requestSecurity,
+    method: "DELETE",
+    baseURL: options?.serverURL,
+    path: path$,
+    headers: headers$,
+    body: body$,
+    userAgent: client$._options.userAgent,
+    timeoutMs: options?.timeoutMs || client$._options.timeoutMs || -1
+  }, options);
+  if (!requestRes.ok) {
+    return [requestRes, { status: "invalid" }];
+  }
+  const req$ = requestRes.value;
+  const doResult = await client$._do(req$, {
+    context,
+    errorCodes: [],
+    retryConfig: context.retryConfig,
+    retryCodes: context.retryCodes
+  });
+  if (!doResult.ok) {
+    return [doResult, { status: "request-error", request: req$ }];
+  }
+  return [doResult, {
+    status: "complete",
+    request: req$,
+    response: doResult.value
+  }];
+}
+var init_keysRevoke = __esm(() => {
+  init_encodings();
+  init_primitives();
+  init_schemas3();
+  init_security();
+  init_url();
+  init_revokekeyop();
+  init_async();
+});
+
+// src/mcp-server/tools/keysRevoke.ts
+var args16, tool$keysRevoke;
+var init_keysRevoke2 = __esm(() => {
+  init_keysRevoke();
+  init_revokekeyop();
+  init_tools();
+  args16 = {
+    request: RevokeKeyRequest$zodSchema
+  };
+  tool$keysRevoke = {
+    name: "revoke_key",
+    description: `Revoke an API key.
+
+Revokes a key of the signing key's environment at once: its next request answers 401. Requires the management scope. A key of the other environment or of another workspace answers 404 not_found. A key cannot revoke itself (409 self_revocation): rotate it with keys.rotate, or revoke it with another management key. Revoking a revoked key changes nothing and answers the key as it was revoked, so a retry is safe.`,
+    annotations: {
+      title: "Revoke an API key of this environment",
+      destructiveHint: true,
+      idempotentHint: true,
+      openWorldHint: false,
+      readOnlyHint: false
+    },
+    args: args16,
+    tool: async (client, args, ctx) => {
+      const [result] = await keysRevoke(client, args.request, { fetchOptions: { signal: ctx.mcpReq.signal } }).$inspect();
+      if (!result.ok) {
+        return {
+          content: [{ type: "text", text: result.error.message }],
+          isError: true
+        };
+      }
+      return formatResult(result.value);
+    }
+  };
+});
+
+// src/models/admission.ts
+var Admission$zodSchema;
+var init_admission = __esm(() => {
+  init_zod();
+  Admission$zodSchema = _enum([
+    "immediate",
+    "held"
+  ]).describe("immediate (the default): an assessment of this flow is decided from the evidence its answer has, and later evidence may change the decision. held: while the account's current assessment of this flow has not completed, the account's decision for the flow is held, and the final decision arrives as account.risk_changed when the investigation completes or hold_seconds pass, whichever is first. Each flow has its own admission.");
+});
+
+// src/models/defaultdepth.ts
+var DefaultDepth$zodSchema;
+var init_defaultdepth = __esm(() => {
+  init_zod();
+  DefaultDepth$zodSchema = _enum([
+    "quick",
+    "full"
+  ]).describe("The depth a request for this flow that names none is served at. Defaults: full for account_creation and purchase, quick for login.");
+});
+
+// src/models/onexpiry.ts
+var OnExpiry$zodSchema;
+var init_onexpiry = __esm(() => {
+  init_zod();
+  OnExpiry$zodSchema = _enum([
+    "allow",
+    "review",
+    "block"
+  ]).describe("The decision a held assessment takes when hold_seconds pass before its investigation completes, unless the evidence so far gives a stricter one (default review). It is announced as account.risk_changed like any other change, so an expired hold is always announced. A hosted provider hook, which cannot wait, answers a held account by it at once: deny for block, allow otherwise. Kept while the flow is immediate.");
+});
+
+// src/models/flowsettings.ts
+var FlowSettings$zodSchema;
+var init_flowsettings = __esm(() => {
+  init_zod();
+  init_admission();
+  init_defaultdepth();
+  init_onexpiry();
+  FlowSettings$zodSchema = object({
+    admission: Admission$zodSchema.describe("immediate (the default): an assessment of this flow is decided from the evidence its answer has, and later evidence may change the decision. held: while the account's current assessment of this flow has not completed, the account's decision for the flow is held, and the final decision arrives as account.risk_changed when the investigation completes or hold_seconds pass, whichever is first. Each flow has its own admission."),
+    block: int().optional().describe("The score from which the decision is block. Absent while blocking is off, the default."),
+    default_depth: DefaultDepth$zodSchema.describe("The depth a request for this flow that names none is served at. Defaults: full for account_creation and purchase, quick for login."),
+    hold_seconds: int().describe("How long a held flow's assessment is held after it was created, 30 to 86400 seconds (default 300). Kept while the flow is immediate."),
+    inherits_account_creation: boolean2().describe("true while this flow has no thresholds of its own and uses account_creation's, the default for login and purchase. Always false for signup."),
+    on_expiry: OnExpiry$zodSchema.describe("The decision a held assessment takes when hold_seconds pass before its investigation completes, unless the evidence so far gives a stricter one (default review). It is announced as account.risk_changed like any other change, so an expired hold is always announced. A hosted provider hook, which cannot wait, answers a held account by it at once: deny for block, allow otherwise. Kept while the flow is immediate."),
+    review: int(),
+    step_up: int()
+  }).describe("One flow's policy in force. A score below step_up is allow, below review step_up, and from review review; from block, when present, the decision is block. admission says when the flow's decision is final.");
+});
+
+// src/models/settingsflows.ts
+var SettingsFlows$zodSchema;
+var init_settingsflows = __esm(() => {
+  init_zod();
+  init_flowsettings();
+  SettingsFlows$zodSchema = object({
+    account_creation: FlowSettings$zodSchema.describe("One flow's policy in force. A score below step_up is allow, below review step_up, and from review review; from block, when present, the decision is block. admission says when the flow's decision is final."),
+    login: FlowSettings$zodSchema.describe("One flow's policy in force. A score below step_up is allow, below review step_up, and from review review; from block, when present, the decision is block. admission says when the flow's decision is final."),
+    purchase: FlowSettings$zodSchema.describe("One flow's policy in force. A score below step_up is allow, below review step_up, and from review review; from block, when present, the decision is block. admission says when the flow's decision is final.")
+  });
+});
+
+// src/models/sourceid.ts
+var SourceId$zodSchema;
+var init_sourceid = __esm(() => {
+  init_zod();
+  SourceId$zodSchema = _enum([
+    "github",
+    "phone",
+    "breach",
+    "rdap",
+    "mx",
+    "ipintel"
+  ]).describe("A NoResponse source: github (GitHub accounts), phone (the phone lookup), breach (breach exposure), rdap (the email domain's registration), mx (the email domain's mail servers) or ipintel (IP intelligence).");
+});
+
+// src/models/settings.ts
+var Settings$zodSchema;
+var init_settings = __esm(() => {
+  init_zod();
+  init_keyenvironment();
+  init_settingsflows();
+  init_sourceid();
+  Settings$zodSchema = object({
+    environment: KeyEnvironment$zodSchema.describe("The environment the key belongs to. A live key assesses with live sources; a test key answers from the deterministic simulator."),
+    flows: SettingsFlows$zodSchema,
+    policy_version: int().describe("How many times this environment's policy has changed; 0 while the defaults apply. A served risk.policy_version ends in +t<policy_version> once it is above 0."),
+    refused_sources: array(SourceId$zodSchema).describe("The sources this environment refuses, sorted; empty, the default, refuses none. An assessment leaves a refused source out: its coverage is missing (an identifier with no other source lists coverage-unavailable as unavailable) rather than not_found, and a stored result of a refused source is not reused."),
+    retention_days: int().describe("Days an assessment is kept after it is created, 1 to 365 (default 365). Shortening hides older assessments at once."),
+    updated_at: string2().optional().describe("When the policy last changed. Absent while the defaults apply."),
+    updated_by: string2().optional().describe("Who last changed the policy: the member's external user id for a change made through the console, the prefix (nrk_<environment>_<key id>) of the management key that made it, or NoResponse. Absent while the defaults apply."),
+    workspace_id: string2().describe("The workspace id, which is also its live environment's workspace id; the test environment's is the same id with :test appended. A workspace created through the API is tnt_ and a 26-character ULID.")
+  }).describe("One environment's settings: how long its assessments are kept, and for each flow the risk thresholds that decide it and the depth a request that names none is served at, and the sources it refuses. Live and test each have their own. A flow without thresholds of its own uses account_creation's (inherits_account_creation). Every change is recorded in the audit log as settings.updated, with who made it.");
+});
+
+// src/models/getsettingsop.ts
+var GetSettingsRequest$zodSchema, GetSettingsResponseResult$zodSchema, GetSettingsResponse$zodSchema;
+var init_getsettingsop = __esm(() => {
+  init_zod();
+  init_authenticationerror();
+  init_badrequesterror();
+  init_conflicterror();
+  init_keyenvironment();
+  init_notfounderror();
+  init_permissiondeniederror();
+  init_ratelimiterror();
+  init_settings();
+  GetSettingsRequest$zodSchema = object({
+    environment: KeyEnvironment$zodSchema.describe("The environment: live or test. Each has its own settings. Any other value answers 400. An API key reads and changes only its own environment's; the other answers 404."),
+    workspace_id: string2().describe("Your workspace id, as each key lists it in workspace_id. Another workspace, a malformed id and a test environment's id answer 404.")
+  });
+  GetSettingsResponseResult$zodSchema = union([
+    Settings$zodSchema,
+    BadRequestError$zodSchema,
+    AuthenticationError$zodSchema,
+    PermissionDeniedError$zodSchema,
+    NotFoundError$zodSchema,
+    ConflictError$zodSchema,
+    RateLimitError$zodSchema
+  ]);
+  GetSettingsResponse$zodSchema = object({
+    Headers: record(string2(), array(string2())).default({}),
+    Result: union([
+      Settings$zodSchema,
+      BadRequestError$zodSchema,
+      AuthenticationError$zodSchema,
+      PermissionDeniedError$zodSchema,
+      NotFoundError$zodSchema,
+      ConflictError$zodSchema,
+      RateLimitError$zodSchema
+    ])
+  });
+});
+
+// src/funcs/settingsGet.ts
+function settingsGet(client$, request, options) {
+  return new APIPromise($do17(client$, request, options));
+}
+async function $do17(client$, request, options) {
+  const parsed$ = safeParse2(request, (value$) => GetSettingsRequest$zodSchema.parse(value$), "Input validation failed");
+  if (!parsed$.ok) {
+    return [parsed$, { status: "invalid" }];
+  }
+  const payload$ = parsed$.value;
+  const body$ = null;
+  const pathParams$ = {
+    environment: encodeSimple("environment", payload$.environment, {
+      explode: false,
+      charEncoding: "percent"
+    }),
+    workspace_id: encodeSimple("workspace_id", payload$.workspace_id, {
+      explode: false,
+      charEncoding: "percent"
+    })
+  };
+  const path$ = pathToFunc("/v1/workspaces/{workspace_id}/settings/{environment}")(pathParams$);
+  const headers$ = new Headers(compactMap({
+    Accept: options?.acceptHeaderOverride || "application/json;q=1, application/problem+json;q=0"
+  }));
+  const securityInput = await extractSecurity(client$._options.security);
+  const requestSecurity = resolveGlobalSecurity(securityInput);
+  const context = {
+    options: client$._options,
+    baseURL: options?.serverURL ?? client$._baseURL ?? "",
+    operationID: "getSettings",
+    oAuth2Scopes: null,
+    resolvedSecurity: requestSecurity,
+    securitySource: client$._options.security,
+    retryConfig: options?.retries || client$._options.retryConfig || {
+      strategy: "backoff",
+      backoff: {
+        initialInterval: 500,
+        maxInterval: 8000,
+        exponent: 2,
+        maxElapsedTime: 30000
+      },
+      retryConnectionErrors: true
+    },
+    retryCodes: options?.retryCodes || [
+      "408",
+      "429",
+      "5XX"
+    ]
+  };
+  const requestRes = client$._createRequest(context, {
+    security: requestSecurity,
+    method: "GET",
+    baseURL: options?.serverURL,
+    path: path$,
+    headers: headers$,
+    body: body$,
+    userAgent: client$._options.userAgent,
+    timeoutMs: options?.timeoutMs || client$._options.timeoutMs || -1
+  }, options);
+  if (!requestRes.ok) {
+    return [requestRes, { status: "invalid" }];
+  }
+  const req$ = requestRes.value;
+  const doResult = await client$._do(req$, {
+    context,
+    errorCodes: [],
+    retryConfig: context.retryConfig,
+    retryCodes: context.retryCodes
+  });
+  if (!doResult.ok) {
+    return [doResult, { status: "request-error", request: req$ }];
+  }
+  return [doResult, {
+    status: "complete",
+    request: req$,
+    response: doResult.value
+  }];
+}
+var init_settingsGet = __esm(() => {
+  init_encodings();
+  init_primitives();
+  init_schemas3();
+  init_security();
+  init_url();
+  init_getsettingsop();
+  init_async();
+});
+
+// src/mcp-server/tools/settingsGet.ts
+var args17, tool$settingsGet;
+var init_settingsGet2 = __esm(() => {
+  init_settingsGet();
+  init_getsettingsop();
+  init_tools();
+  args17 = {
+    request: GetSettingsRequest$zodSchema
+  };
+  tool$settingsGet = {
+    name: "get_settings",
+    description: `Read an environment's settings.
+
+Reads the settings of the signing key's environment: retention in days; per flow (account_creation, login, purchase) the step_up, review and block thresholds, the default depth and the admission; and the sources the environment refuses. A flow without thresholds of its own shows account_creation's with inherits_account_creation true. Requires the management scope; the other environment answers 404 not_found. Read-only and safe to retry.`,
+    annotations: {
+      title: "Read this environment's settings",
+      destructiveHint: false,
+      idempotentHint: true,
+      openWorldHint: false,
+      readOnlyHint: true
+    },
+    args: args17,
+    tool: async (client, args, ctx) => {
+      const [result] = await settingsGet(client, args.request, { fetchOptions: { signal: ctx.mcpReq.signal } }).$inspect();
+      if (!result.ok) {
+        return {
+          content: [{ type: "text", text: result.error.message }],
+          isError: true
+        };
+      }
+      return formatResult(result.value);
+    }
+  };
+});
+
+// src/models/flowchange.ts
+var FlowChange$zodSchema;
+var init_flowchange = __esm(() => {
+  init_zod();
+  init_admission();
+  init_defaultdepth();
+  init_onexpiry();
+  FlowChange$zodSchema = object({
+    admission: Admission$zodSchema.optional().describe("immediate (the default): an assessment of this flow is decided from the evidence its answer has, and later evidence may change the decision. held: while the account's current assessment of this flow has not completed, the account's decision for the flow is held, and the final decision arrives as account.risk_changed when the investigation completes or hold_seconds pass, whichever is first. Each flow has its own admission."),
+    block: int().nullable().optional().describe("The score from which the decision is block; null turns blocking off."),
+    default_depth: DefaultDepth$zodSchema.optional().describe("The depth a request for this flow that names none is served at. Defaults: full for account_creation and purchase, quick for login."),
+    hold_seconds: int().optional().describe("How long a held flow's assessment is held after it was created, 30 to 86400 seconds (default 300). Kept while the flow is immediate."),
+    inherits_account_creation: boolean2().optional().describe("Login or purchase only: drop the flow's own thresholds so it uses account_creation's again. Not combined with step_up, review or block. Send true; false is refused."),
+    inherits_signup: boolean2().optional().describe("Alias of inherits_account_creation, still accepted. Send true; false is refused."),
+    on_expiry: OnExpiry$zodSchema.optional().describe("The decision a held assessment takes when hold_seconds pass before its investigation completes, unless the evidence so far gives a stricter one (default review). It is announced as account.risk_changed like any other change, so an expired hold is always announced. A hosted provider hook, which cannot wait, answers a held account by it at once: deny for block, allow otherwise. Kept while the flow is immediate."),
+    review: int().optional(),
+    step_up: int().optional()
+  }).describe("A change to one flow. A field left out keeps the value in force. Thresholds set on login or purchase start from the values in force, account_creation's while it inherits them. After the change, 0 < step_up < review <= 100 and block is off or review <= block <= 100.");
+});
+
+// src/models/settingsrequestflows.ts
+var SettingsRequestFlows$zodSchema;
+var init_settingsrequestflows = __esm(() => {
+  init_zod();
+  init_flowchange();
+  SettingsRequestFlows$zodSchema = object({
+    account_creation: FlowChange$zodSchema.optional().describe("A change to one flow. A field left out keeps the value in force. Thresholds set on login or purchase start from the values in force, account_creation's while it inherits them. After the change, 0 < step_up < review <= 100 and block is off or review <= block <= 100."),
+    login: FlowChange$zodSchema.optional().describe("A change to one flow. A field left out keeps the value in force. Thresholds set on login or purchase start from the values in force, account_creation's while it inherits them. After the change, 0 < step_up < review <= 100 and block is off or review <= block <= 100."),
+    purchase: FlowChange$zodSchema.optional().describe("A change to one flow. A field left out keeps the value in force. Thresholds set on login or purchase start from the values in force, account_creation's while it inherits them. After the change, 0 < step_up < review <= 100 and block is off or review <= block <= 100."),
+    signup: FlowChange$zodSchema.optional().describe("A change to one flow. A field left out keeps the value in force. Thresholds set on login or purchase start from the values in force, account_creation's while it inherits them. After the change, 0 < step_up < review <= 100 and block is off or review <= block <= 100.")
+  }).describe("Use account_creation or its deprecated alias signup, not both.");
+});
+
+// src/models/settingsrequest.ts
+var SettingsRequest$zodSchema;
+var init_settingsrequest = __esm(() => {
+  init_zod();
+  init_settingsrequestflows();
+  init_sourceid();
+  SettingsRequest$zodSchema = object({
+    flows: SettingsRequestFlows$zodSchema.optional().describe("Use account_creation or its deprecated alias signup, not both."),
+    refused_sources: array(SourceId$zodSchema).optional().describe("Replaces the refused sources; [] refuses none. A change applies to new assessments within a minute."),
+    retention_days: int().optional()
+  }).describe("PATCH /v1/workspaces/{workspace_id}/settings/{environment} body. Changes only what it names, in one transaction; a policy change is one new policy_version. Needs the admin or owner role, or an API key with the management scope for its own environment.");
+});
+
+// src/models/updatesettingsop.ts
+var UpdateSettingsRequest$zodSchema, UpdateSettingsResponseResult$zodSchema, UpdateSettingsResponse$zodSchema;
+var init_updatesettingsop = __esm(() => {
+  init_zod();
+  init_authenticationerror();
+  init_badrequesterror();
+  init_conflicterror();
+  init_keyenvironment();
+  init_notfounderror();
+  init_permissiondeniederror();
+  init_ratelimiterror();
+  init_settings();
+  init_settingsrequest();
+  UpdateSettingsRequest$zodSchema = object({
+    body: SettingsRequest$zodSchema,
+    environment: KeyEnvironment$zodSchema.describe("The environment: live or test. Each has its own settings. Any other value answers 400. An API key reads and changes only its own environment's; the other answers 404."),
+    workspace_id: string2().describe("Your workspace id, as each key lists it in workspace_id. Another workspace, a malformed id and a test environment's id answer 404.")
+  });
+  UpdateSettingsResponseResult$zodSchema = union([
+    Settings$zodSchema,
+    BadRequestError$zodSchema,
+    AuthenticationError$zodSchema,
+    PermissionDeniedError$zodSchema,
+    NotFoundError$zodSchema,
+    ConflictError$zodSchema,
+    RateLimitError$zodSchema
+  ]);
+  UpdateSettingsResponse$zodSchema = object({
+    Headers: record(string2(), array(string2())).default({}),
+    Result: union([
+      Settings$zodSchema,
+      BadRequestError$zodSchema,
+      AuthenticationError$zodSchema,
+      PermissionDeniedError$zodSchema,
+      NotFoundError$zodSchema,
+      ConflictError$zodSchema,
+      RateLimitError$zodSchema
+    ])
+  });
+});
+
+// src/funcs/settingsUpdate.ts
+function settingsUpdate(client$, request, options) {
+  return new APIPromise($do18(client$, request, options));
+}
+async function $do18(client$, request, options) {
+  const parsed$ = safeParse2(request, (value$) => UpdateSettingsRequest$zodSchema.parse(value$), "Input validation failed");
+  if (!parsed$.ok) {
+    return [parsed$, { status: "invalid" }];
+  }
+  const payload$ = parsed$.value;
+  const body$ = encodeJSON("body", payload$.body, { explode: true });
+  const pathParams$ = {
+    environment: encodeSimple("environment", payload$.environment, {
+      explode: false,
+      charEncoding: "percent"
+    }),
+    workspace_id: encodeSimple("workspace_id", payload$.workspace_id, {
+      explode: false,
+      charEncoding: "percent"
+    })
+  };
+  const path$ = pathToFunc("/v1/workspaces/{workspace_id}/settings/{environment}")(pathParams$);
+  const headers$ = new Headers(compactMap({
+    "Content-Type": "application/json",
+    Accept: options?.acceptHeaderOverride || "application/json;q=1, application/problem+json;q=0"
+  }));
+  const securityInput = await extractSecurity(client$._options.security);
+  const requestSecurity = resolveGlobalSecurity(securityInput);
+  const context = {
+    options: client$._options,
+    baseURL: options?.serverURL ?? client$._baseURL ?? "",
+    operationID: "updateSettings",
+    oAuth2Scopes: null,
+    resolvedSecurity: requestSecurity,
+    securitySource: client$._options.security,
+    retryConfig: options?.retries || client$._options.retryConfig || {
+      strategy: "backoff",
+      backoff: {
+        initialInterval: 500,
+        maxInterval: 8000,
+        exponent: 2,
+        maxElapsedTime: 30000
+      },
+      retryConnectionErrors: true
+    },
+    retryCodes: options?.retryCodes || [
+      "408",
+      "429",
+      "5XX"
+    ]
+  };
+  const requestRes = client$._createRequest(context, {
+    security: requestSecurity,
+    method: "PATCH",
+    baseURL: options?.serverURL,
+    path: path$,
+    headers: headers$,
+    body: body$,
+    userAgent: client$._options.userAgent,
+    timeoutMs: options?.timeoutMs || client$._options.timeoutMs || -1
+  }, options);
+  if (!requestRes.ok) {
+    return [requestRes, { status: "invalid" }];
+  }
+  const req$ = requestRes.value;
+  const doResult = await client$._do(req$, {
+    context,
+    errorCodes: [],
+    retryConfig: context.retryConfig,
+    retryCodes: context.retryCodes
+  });
+  if (!doResult.ok) {
+    return [doResult, { status: "request-error", request: req$ }];
+  }
+  return [doResult, {
+    status: "complete",
+    request: req$,
+    response: doResult.value
+  }];
+}
+var init_settingsUpdate = __esm(() => {
+  init_encodings();
+  init_primitives();
+  init_schemas3();
+  init_security();
+  init_url();
+  init_updatesettingsop();
+  init_async();
+});
+
+// src/mcp-server/tools/settingsUpdate.ts
+var args18, tool$settingsUpdate;
+var init_settingsUpdate2 = __esm(() => {
+  init_settingsUpdate();
+  init_updatesettingsop();
+  init_tools();
+  args18 = {
+    request: UpdateSettingsRequest$zodSchema
+  };
+  tool$settingsUpdate = {
+    name: "update_settings",
+    description: `Change an environment's settings.
+
+Changes only what the body names, in one transaction: retention_days, refused_sources, and per flow step_up, review, block (null turns blocking off), default_depth, admission, hold_seconds, on_expiry, or inherits_account_creation to return login or purchase to account_creation's thresholds. After the change each flow keeps 0 < step_up < review <= 100 and block off or review <= block <= 100; a change that breaks it answers 400 naming the flow. A policy change is one new policy_version with the signing key's prefix as updated_by, and every change is recorded in the workspace's audit log with the key as its actor. Requires the management scope; the other environment answers 404 not_found. A change reaches assessments within a minute.`,
+    annotations: {
+      title: "Change this environment's settings",
+      destructiveHint: false,
+      idempotentHint: false,
+      openWorldHint: false,
+      readOnlyHint: false
+    },
+    args: args18,
+    tool: async (client, args, ctx) => {
+      const [result] = await settingsUpdate(client, args.request, { fetchOptions: { signal: ctx.mcpReq.signal } }).$inspect();
+      if (!result.ok) {
+        return {
+          content: [{ type: "text", text: result.error.message }],
+          isError: true
+        };
+      }
+      return formatResult(result.value);
+    }
+  };
+});
+
 // src/models/webhookendpointrequest.ts
 var WebhookEndpointRequest$zodSchema;
 var init_webhookendpointrequest = __esm(() => {
@@ -54244,9 +55099,9 @@ var init_webhookendpointrequest = __esm(() => {
 
 // src/funcs/webhookEndpointsCreate.ts
 function webhookEndpointsCreate(client$, request, options) {
-  return new APIPromise($do15(client$, request, options));
+  return new APIPromise($do19(client$, request, options));
 }
-async function $do15(client$, request, options) {
+async function $do19(client$, request, options) {
   const parsed$ = safeParse2(request, (value$) => WebhookEndpointRequest$zodSchema.parse(value$), "Input validation failed");
   if (!parsed$.ok) {
     return [parsed$, { status: "invalid" }];
@@ -54310,12 +55165,12 @@ var init_webhookEndpointsCreate = __esm(() => {
 });
 
 // src/mcp-server/tools/webhookEndpointsCreate.ts
-var args15, tool$webhookEndpointsCreate;
+var args19, tool$webhookEndpointsCreate;
 var init_webhookEndpointsCreate2 = __esm(() => {
   init_webhookEndpointsCreate();
   init_webhookendpointrequest();
   init_tools();
-  args15 = {
+  args19 = {
     request: WebhookEndpointRequest$zodSchema
   };
   tool$webhookEndpointsCreate = {
@@ -54330,7 +55185,7 @@ Registers a webhook endpoint and returns it with its first signing secret, shown
       openWorldHint: false,
       readOnlyHint: false
     },
-    args: args15,
+    args: args19,
     tool: async (client, args, ctx) => {
       const [result] = await webhookEndpointsCreate(client, args.request, { fetchOptions: { signal: ctx.mcpReq.signal } }).$inspect();
       if (!result.ok) {
@@ -54380,9 +55235,9 @@ var init_deletewebhookendpointop = __esm(() => {
 
 // src/funcs/webhookEndpointsDelete.ts
 function webhookEndpointsDelete(client$, request, options) {
-  return new APIPromise($do16(client$, request, options));
+  return new APIPromise($do20(client$, request, options));
 }
-async function $do16(client$, request, options) {
+async function $do20(client$, request, options) {
   const parsed$ = safeParse2(request, (value$) => DeleteWebhookEndpointRequest$zodSchema.parse(value$), "Input validation failed");
   if (!parsed$.ok) {
     return [parsed$, { status: "invalid" }];
@@ -54464,12 +55319,12 @@ var init_webhookEndpointsDelete = __esm(() => {
 });
 
 // src/mcp-server/tools/webhookEndpointsDelete.ts
-var args16, tool$webhookEndpointsDelete;
+var args20, tool$webhookEndpointsDelete;
 var init_webhookEndpointsDelete2 = __esm(() => {
   init_webhookEndpointsDelete();
   init_deletewebhookendpointop();
   init_tools();
-  args16 = {
+  args20 = {
     request: DeleteWebhookEndpointRequest$zodSchema
   };
   tool$webhookEndpointsDelete = {
@@ -54484,7 +55339,7 @@ Deletes the endpoint and its signing keys. Deliveries still queued for it are dr
       openWorldHint: false,
       readOnlyHint: false
     },
-    args: args16,
+    args: args20,
     tool: async (client, args, ctx) => {
       const [result] = await webhookEndpointsDelete(client, args.request, { fetchOptions: { signal: ctx.mcpReq.signal } }).$inspect();
       if (!result.ok) {
@@ -54500,9 +55355,9 @@ Deletes the endpoint and its signing keys. Deliveries still queued for it are dr
 
 // src/funcs/webhookEndpointsList.ts
 function webhookEndpointsList(client$, options) {
-  return new APIPromise($do17(client$, options));
+  return new APIPromise($do21(client$, options));
 }
-async function $do17(client$, options) {
+async function $do21(client$, options) {
   const path$ = pathToFunc("/v1/webhooks")();
   const headers$ = new Headers(compactMap({
     Accept: options?.acceptHeaderOverride || "application/json;q=1, application/problem+json;q=0"
@@ -54694,9 +55549,9 @@ var init_listwebhookdeliveriesop = __esm(() => {
 
 // src/funcs/webhookEndpointsListDeliveries.ts
 function webhookEndpointsListDeliveries(client$, request, options) {
-  return new APIPromise($do18(client$, request, options));
+  return new APIPromise($do22(client$, request, options));
 }
-async function $do18(client$, request, options) {
+async function $do22(client$, request, options) {
   const parsed$ = safeParse2(request, (value$) => ListWebhookDeliveriesRequest$zodSchema.parse(value$), "Input validation failed");
   if (!parsed$.ok) {
     return [parsed$, { status: "invalid" }];
@@ -54783,12 +55638,12 @@ var init_webhookEndpointsListDeliveries = __esm(() => {
 });
 
 // src/mcp-server/tools/webhookEndpointsListDeliveries.ts
-var args17, tool$webhookEndpointsListDeliveries;
+var args21, tool$webhookEndpointsListDeliveries;
 var init_webhookEndpointsListDeliveries2 = __esm(() => {
   init_webhookEndpointsListDeliveries();
   init_listwebhookdeliveriesop();
   init_tools();
-  args17 = {
+  args21 = {
     request: ListWebhookDeliveriesRequest$zodSchema
   };
   tool$webhookEndpointsListDeliveries = {
@@ -54803,7 +55658,7 @@ Every POST the endpoint received, newest first: the event id and type, which att
       openWorldHint: false,
       readOnlyHint: true
     },
-    args: args17,
+    args: args21,
     tool: async (client, args, ctx) => {
       const [result] = await webhookEndpointsListDeliveries(client, args.request, { fetchOptions: { signal: ctx.mcpReq.signal } }).$inspect();
       if (!result.ok) {
@@ -54877,9 +55732,9 @@ var init_replaywebhookdeliveryop = __esm(() => {
 
 // src/funcs/webhookEndpointsReplayDelivery.ts
 function webhookEndpointsReplayDelivery(client$, request, options) {
-  return new APIPromise($do19(client$, request, options));
+  return new APIPromise($do23(client$, request, options));
 }
-async function $do19(client$, request, options) {
+async function $do23(client$, request, options) {
   const parsed$ = safeParse2(request, (value$) => ReplayWebhookDeliveryRequest$zodSchema.parse(value$), "Input validation failed");
   if (!parsed$.ok) {
     return [parsed$, { status: "invalid" }];
@@ -54953,12 +55808,12 @@ var init_webhookEndpointsReplayDelivery = __esm(() => {
 });
 
 // src/mcp-server/tools/webhookEndpointsReplayDelivery.ts
-var args18, tool$webhookEndpointsReplayDelivery;
+var args22, tool$webhookEndpointsReplayDelivery;
 var init_webhookEndpointsReplayDelivery2 = __esm(() => {
   init_webhookEndpointsReplayDelivery();
   init_replaywebhookdeliveryop();
   init_tools();
-  args18 = {
+  args22 = {
     request: ReplayWebhookDeliveryRequest$zodSchema
   };
   tool$webhookEndpointsReplayDelivery = {
@@ -54973,7 +55828,7 @@ Queues the event for the endpoint again: the same event id and body it received,
       openWorldHint: false,
       readOnlyHint: false
     },
-    args: args18,
+    args: args22,
     tool: async (client, args, ctx) => {
       const [result] = await webhookEndpointsReplayDelivery(client, args.request, { fetchOptions: { signal: ctx.mcpReq.signal } }).$inspect();
       if (!result.ok) {
@@ -55059,9 +55914,9 @@ var init_rotatewebhooksigningkeyop = __esm(() => {
 
 // src/funcs/webhookEndpointsRotateSigningKey.ts
 function webhookEndpointsRotateSigningKey(client$, request, options) {
-  return new APIPromise($do20(client$, request, options));
+  return new APIPromise($do24(client$, request, options));
 }
-async function $do20(client$, request, options) {
+async function $do24(client$, request, options) {
   const parsed$ = safeParse2(request, (value$) => RotateWebhookSigningKeyRequest$zodSchema.parse(value$), "Input validation failed");
   if (!parsed$.ok) {
     return [parsed$, { status: "invalid" }];
@@ -55131,12 +55986,12 @@ var init_webhookEndpointsRotateSigningKey = __esm(() => {
 });
 
 // src/mcp-server/tools/webhookEndpointsRotateSigningKey.ts
-var args19, tool$webhookEndpointsRotateSigningKey;
+var args23, tool$webhookEndpointsRotateSigningKey;
 var init_webhookEndpointsRotateSigningKey2 = __esm(() => {
   init_webhookEndpointsRotateSigningKey();
   init_rotatewebhooksigningkeyop();
   init_tools();
-  args19 = {
+  args23 = {
     request: RotateWebhookSigningKeyRequest$zodSchema
   };
   tool$webhookEndpointsRotateSigningKey = {
@@ -55151,7 +56006,7 @@ Issues a new signing key for the endpoint and returns its secret once. Every del
       openWorldHint: false,
       readOnlyHint: false
     },
-    args: args19,
+    args: args23,
     tool: async (client, args, ctx) => {
       const [result] = await webhookEndpointsRotateSigningKey(client, args.request, { fetchOptions: { signal: ctx.mcpReq.signal } }).$inspect();
       if (!result.ok) {
@@ -55252,9 +56107,9 @@ var init_sendwebhooktesteventop = __esm(() => {
 
 // src/funcs/webhookEndpointsSendTestEvent.ts
 function webhookEndpointsSendTestEvent(client$, request, options) {
-  return new APIPromise($do21(client$, request, options));
+  return new APIPromise($do25(client$, request, options));
 }
-async function $do21(client$, request, options) {
+async function $do25(client$, request, options) {
   const parsed$ = safeParse2(request, (value$) => SendWebhookTestEventRequest$zodSchema.parse(value$), "Input validation failed");
   if (!parsed$.ok) {
     return [parsed$, { status: "invalid" }];
@@ -55324,12 +56179,12 @@ var init_webhookEndpointsSendTestEvent = __esm(() => {
 });
 
 // src/mcp-server/tools/webhookEndpointsSendTestEvent.ts
-var args20, tool$webhookEndpointsSendTestEvent;
+var args24, tool$webhookEndpointsSendTestEvent;
 var init_webhookEndpointsSendTestEvent2 = __esm(() => {
   init_webhookEndpointsSendTestEvent();
   init_sendwebhooktesteventop();
   init_tools();
-  args20 = {
+  args24 = {
     request: SendWebhookTestEventRequest$zodSchema
   };
   tool$webhookEndpointsSendTestEvent = {
@@ -55344,7 +56199,7 @@ endpoint.verification sends a signed challenge now and answers whether the endpo
       openWorldHint: false,
       readOnlyHint: false
     },
-    args: args20,
+    args: args24,
     tool: async (client, args, ctx) => {
       const [result] = await webhookEndpointsSendTestEvent(client, args.request, { fetchOptions: { signal: ctx.mcpReq.signal } }).$inspect();
       if (!result.ok) {
@@ -55362,7 +56217,7 @@ endpoint.verification sends a signed challenge now and answers whether the endpo
 function createMCPServer(deps) {
   const server = new McpServer({
     name: "NoResponse",
-    version: "0.4.12"
+    version: "0.5.1"
   });
   const getClient = deps.getSDK || (() => new NoResponseCore({
     security: deps.security,
@@ -55391,6 +56246,8 @@ function createMCPServer(deps) {
   tool(tool$accountsDelete);
   tool(tool$accountsListAssessments);
   tool(tool$accountsRecordEnforcement);
+  tool(tool$keysList);
+  tool(tool$keysRevoke);
   tool(tool$integrationsCreate);
   tool(tool$integrationsList);
   tool(tool$integrationsDelete);
@@ -55402,6 +56259,8 @@ function createMCPServer(deps) {
   tool(tool$webhookEndpointsSendTestEvent);
   tool(tool$webhookEndpointsListDeliveries);
   tool(tool$webhookEndpointsReplayDelivery);
+  tool(tool$settingsGet);
+  tool(tool$settingsUpdate);
   if (deps.dynamic) {
     registerDynamicTools(deps.logger, server, getClient, toolMap, scopes);
   }
@@ -55429,6 +56288,10 @@ var init_server = __esm(() => {
   init_integrationsDelete2();
   init_integrationsList2();
   init_integrationsRotate2();
+  init_keysList2();
+  init_keysRevoke2();
+  init_settingsGet2();
+  init_settingsUpdate2();
   init_webhookEndpointsCreate2();
   init_webhookEndpointsDelete2();
   init_webhookEndpointsList2();
@@ -55501,6 +56364,18 @@ The account's history: the same page as POST /v1/assessments/query for this acco
       description: `Record what you did to an account in your identity provider.
 
 Records what you did to the account in your identity provider for one flow's decision at one risk_version: the action (or none), the account's state before it, the provider and whether it was applied or failed. It is your action, not an outcome, and it leaves the account's risk unchanged. A record is kept once per account, risk_version, flow and action: the first report answers 201, and a repeat answers 200 with the stored record unchanged, so retries are safe without an Idempotency-Key. An applied report after a failed one replaces the failed record, keeping its id and created_at, and answers 201. A risk_version older than the account's current one is accepted and stored, but only an applied record at the current risk_version takes the account out of listChanged with unenforced=true; a newer one answers 409 risk_version_ahead. An account with no current risk answers 404 not_found. error_code is allowed only with status failed. Requires the history scope.`
+    },
+    {
+      name: "list_keys",
+      description: `List API keys.
+
+Lists the keys of the signing key's environment, newest first, at most 200, revoked and expired keys included, without secrets: each key's id, prefix, scopes, status, and who created and revoked it. Requires the management scope. Read-only and safe to retry.`
+    },
+    {
+      name: "revoke_key",
+      description: `Revoke an API key.
+
+Revokes a key of the signing key's environment at once: its next request answers 401. Requires the management scope. A key of the other environment or of another workspace answers 404 not_found. A key cannot revoke itself (409 self_revocation): rotate it with keys.rotate, or revoke it with another management key. Revoking a revoked key changes nothing and answers the key as it was revoked, so a retry is safe.`
     },
     {
       name: "create_integration",
@@ -55567,6 +56442,18 @@ Every POST the endpoint received, newest first: the event id and type, which att
       description: `Send one delivery again.
 
 Queues the event for the endpoint again: the same event id and body it received, with a new NR-Webhook-Timestamp and a signature from the endpoint's current signing key, retried like any other delivery and listed with replay: true. Your receiver deduplicates on the event id. The endpoint must be verified. Requires the webhooks scope. Not idempotent: each call, a retry included, sends the event again.`
+    },
+    {
+      name: "get_settings",
+      description: `Read an environment's settings.
+
+Reads the settings of the signing key's environment: retention in days; per flow (account_creation, login, purchase) the step_up, review and block thresholds, the default depth and the admission; and the sources the environment refuses. A flow without thresholds of its own shows account_creation's with inherits_account_creation true. Requires the management scope; the other environment answers 404 not_found. Read-only and safe to retry.`
+    },
+    {
+      name: "update_settings",
+      description: `Change an environment's settings.
+
+Changes only what the body names, in one transaction: retention_days, refused_sources, and per flow step_up, review, block (null turns blocking off), default_depth, admission, hold_seconds, on_expiry, or inherits_account_creation to return login or purchase to account_creation's thresholds. After the change each flow keeps 0 < step_up < review <= 100 and block off or review <= block <= 100; a change that breaks it answers 400 naming the flow. A policy change is one new policy_version with the signing key's prefix as updated_by, and every change is recorded in the workspace's audit log with the key as its actor. Requires the management scope; the other environment answers 404 not_found. A change reaches assessments within a minute.`
     },
     {
       name: "wait_for_assessment",
@@ -64067,7 +64954,7 @@ var routes = buildRouteMap({
 var app = buildApplication(routes, {
   name: "mcp",
   versionInfo: {
-    currentVersion: "0.4.12"
+    currentVersion: "0.5.1"
   }
 });
 run(app, process3.argv.slice(2), buildContext(process3));
@@ -64075,5 +64962,5 @@ export {
   app
 };
 
-//# debugId=AABF80C5EB322F5264756E2164756E21
+//# debugId=5FA85E752ADB8A5364756E2164756E21
 //# sourceMappingURL=mcp-server.js.map