@noresponse/mcp 0.6.12 → 0.6.13

package/CHANGELOG.md

@@ -1,5 +1,15 @@
 # Changelog
 
+## 0.6.13
+
+* `SDK.assessments.create()`:  `response.detail.identifiers` **Added**
+* `SDK.assessments.get()`:  `response.detail.identifiers` **Added**
+* `SDK.assessments.query()`:  `response.items[].identifiers` **Added**
+* `SDK.assessments.search()`:  `response.items[].detail.identifiers` **Added**
+* `SDK.assessments.retrieveVersion()`:  `response.detail.identifiers` **Added**
+* `SDK.accounts.listAssessments()`:  `response.items[].identifiers` **Added**
+* `SDK.accounts.export()`:  `response.assessments[].detail.identifiers` **Added**
+
 ## 0.6.12
 
 * `SDK.webhookEndpoints.list()`:  `response.code` **Changed** (Breaking ⚠️)

package/bin/mcp-server.js

@@ -48117,9 +48117,9 @@ var init_config = __esm(() => {
   SDK_METADATA = {
     language: "typescript",
     openapiDocVersion: "1",
-    sdkVersion: "0.6.12",
+    sdkVersion: "0.6.13",
     genVersion: "internal",
-    userAgent: "noresponse-sdk/mcp-typescript 0.6.12 internal 1 @noresponse/mcp"
+    userAgent: "noresponse-sdk/mcp-typescript 0.6.13 internal 1 @noresponse/mcp"
   };
 });
 
@@ -50994,6 +50994,19 @@ var init_risk = __esm(() => {
   }).describe("The one risk decision for this event. score is 0 (safe) to 100 (risky), set by the reasons that fired under a hand-set, versioned heuristic policy. Each reason carries its direction and impact band; the policy's weights are not published. Every answer with a recommendation carries it, and the top-level recommendation equals risk.recommendation. It names no source or provider.");
 });
 
+// src/models/sentidentifiers.ts
+var SentIdentifiers$zodSchema;
+var init_sentidentifiers = __esm(() => {
+  init_zod();
+  SentIdentifiers$zodSchema = object({
+    email: string2().optional().describe("identifiers.email as the request sent it."),
+    ip: string2().optional().describe("identifiers.ip as the request sent it."),
+    name: string2().optional().describe("identifiers.name as the request sent it, before NFC normalisation."),
+    phone: string2().optional().describe("identifiers.phone as the request sent it."),
+    username: string2().optional().describe("identifiers.username as the request sent it.")
+  }).describe("The identifiers an assessment was sent: each member of the request's identifiers object exactly as received, before the server normalised it (the email domain keeps its case, the name its Unicode form). A member the request did not send is absent. NoResponse keeps them encrypted under the workspace's own key, does not index or log them, and deletes them with the assessment: on DELETE of the assessment or its account, at its expires_at, and with the workspace.");
+});
+
 // src/models/failurereason.ts
 var FailureReason$zodSchema;
 var init_failurereason = __esm(() => {
@@ -51239,6 +51252,7 @@ var init_assessmentdetail = __esm(() => {
   init_incompletesource();
   init_recommendation();
   init_risk();
+  init_sentidentifiers();
   init_signal();
   init_status();
   AssessmentDetail$zodSchema = object({
@@ -51250,6 +51264,7 @@ var init_assessmentdetail = __esm(() => {
     confidence: Confidence$zodSchema.describe("Ordinal confidence in the recommendation under the current policy: low, medium, high or unavailable."),
     created_at: string2().describe("When the assessment was created. Fixed for the life of the assessment: every revision carries the same created_at."),
     expires_at: string2().describe("After this instant the assessment is no longer served: GET /v1/assessments/{assessment_id} answers 404 and it leaves the account history. It is created_at plus your retention period at creation (default and maximum 365 days) and is fixed per record: a later revision keeps it, and a new assessment for the same account starts its own clock. If you later shorten retention, the effective expiry becomes created_at plus the shorter of the two periods."),
+    identifiers: SentIdentifiers$zodSchema.optional().describe("The identifiers an assessment was sent: each member of the request's identifiers object exactly as received, before the server normalised it (the email domain keeps its case, the name its Unicode form). A member the request did not send is absent. NoResponse keeps them encrypted under the workspace's own key, does not index or log them, and deletes them with the assessment: on DELETE of the assessment or its account, at its expires_at, and with the workspace."),
     incomplete_sources: array(IncompleteSource$zodSchema).describe("The lanes that did not settle, each listed once with a reason; lanes, not sources. In a detailed view a lane is listed exactly when one of its signals did not settle; a standard view carries no signals to match."),
     policy_basis: literal("heuristic_unvalidated").default("heuristic_unvalidated").optional().describe("Labels the v0 policy as hand-authored and not statistically validated."),
     policy_version: string2().describe("Version of the hand-authored heuristic policy that produced the recommendation, for example 'risk-2026-10.7'. A workspace threshold override adds a +t<N> suffix, e.g. 'risk-2026-10.7+t3'."),
@@ -52868,7 +52883,7 @@ var init_accountsExport2 = __esm(() => {
     name: "export_account",
     description: `Export an account
 
-Retrieve one consistent snapshot of retained customer-accessible records, including assessment revisions, account decisions, feedback, key associations, enforcements and request diagnostics. Secrets, restricted source information, other customers' data and legacy free-text notes are excluded. The same standard/detailed permissions apply. An export exceeding 10000 records or 8 MiB returns export_too_large without a partial result. Historical decisions that were not captured are identified as an exclusion.`,
+Retrieve one consistent snapshot of retained customer-accessible records, including assessment revisions, account decisions, feedback, key associations, enforcements and request diagnostics. Each assessment revision's detail.identifiers holds the identifiers that assessment was sent, exactly as received. Secrets, restricted source information, other customers' data and legacy free-text notes are excluded. The same standard/detailed permissions apply. An export exceeding 10000 records or 8 MiB returns export_too_large without a partial result. Historical decisions that were not captured are identified as an exclusion.`,
     annotations: {
       title: "Export this account's retained customer-accessible records",
       destructiveHint: false,
@@ -53206,7 +53221,7 @@ var init_accountsListAssessments2 = __esm(() => {
     name: "list_account_assessments",
     description: `Page through one account's unexpired assessments.
 
-The account's history: the same page as POST /v1/assessments/query for this account_id, newest first, each at its latest assessment_version. Requires the history scope. Read-only and safe to retry. An account with no assessments answers 200 with empty items. The cursor is opaque and bound to your workspace and the account; a tampered or expired cursor answers 400 invalid_cursor. response_mode=detailed needs the detailed scope. The account_id travels in the URL; use POST /v1/assessments/query to keep it out of access logs.`,
+The account's history: the same page as POST /v1/assessments/query for this account_id, newest first, each at its latest assessment_version. Requires the history scope. Read-only and safe to retry. An account with no assessments answers 200 with empty items. The cursor is opaque and bound to your workspace and the account; a tampered or expired cursor answers 400 invalid_cursor. response_mode=detailed needs the detailed scope. Each item's identifiers holds the identifiers its assessment was sent, exactly as received. The account_id travels in the URL; use POST /v1/assessments/query to keep it out of access logs.`,
     annotations: {
       title: "Page through an account's assessments",
       destructiveHint: false,
@@ -54879,7 +54894,7 @@ var init_assessmentsCreate2 = __esm(() => {
     name: "create_assessment",
     description: `Assess identifiers for a signup or gateway decision.
 
-Assesses one account creation, login or purchase (flow) and answers with the account's one current risk: account.risk.decision is the decision for this flow (allow, step_up, review or block, where block means your block threshold was reached), and detail holds this assessment's own facts. depth sets how long the answer waits for sources: quick waits only for the fast ones (500 ms), full for the whole budget (3000 ms at most); it defaults to full for account_creation and purchase and quick for login. 200 carries complete or partial, 202 carries pending with Location and Retry-After. While the account's first assessment is pending, account is absent: apply your own fallback for that, 429, 503 or a timeout. NoResponse blocks nothing itself; you decide. Requires the assess scope. Idempotency-Key is optional in the SDK and is bound to the body for 24 hours: the same key with the same body replays the latest assessment with Idempotent-Replayed: true and starts no new work; the same key with a different body answers 409 idempotency_key_reused. response_mode defaults to standard; detailed needs the detailed scope.`,
+Assesses one account creation, login or purchase (flow) and answers with the account's one current risk: account.risk.decision is the decision for this flow (allow, step_up, review or block, where block means your block threshold was reached), and detail holds this assessment's own facts. depth sets how long the answer waits for sources: quick waits only for the fast ones (500 ms), full for the whole budget (3000 ms at most); it defaults to full for account_creation and purchase and quick for login. 200 carries complete or partial, 202 carries pending with Location and Retry-After. While the account's first assessment is pending, account is absent: apply your own fallback for that, 429, 503 or a timeout. NoResponse blocks nothing itself; you decide. Requires the assess scope. Idempotency-Key is optional in the SDK and is bound to the body for 24 hours: the same key with the same body replays the latest assessment with Idempotent-Replayed: true and starts no new work; the same key with a different body answers 409 idempotency_key_reused. response_mode defaults to standard; detailed needs the detailed scope. The answer leaves out detail.identifiers: you hold what you sent, and a key with the history scope gets them back with GET.`,
     annotations: {
       title: "Assess an account creation, login or purchase",
       destructiveHint: false,
@@ -55095,7 +55110,7 @@ var init_assessmentsGet2 = __esm(() => {
     name: "get_assessment",
     description: `Poll the authoritative assessment of one assessment.
 
-Returns the highest assessment_version, with the account's current risk. Requires the assess or history scope. While status is pending, or partial with a source still running, the response carries Retry-After; poll no faster than it says. Another workspace's assessment, an unknown or expired assessment and a malformed assessment_id all answer 404 not_found. response_mode=detailed needs the detailed scope.`,
+Returns the highest assessment_version, with the account's current risk. Requires the assess or history scope. While status is pending, or partial with a source still running, the response carries Retry-After; poll no faster than it says. Another workspace's assessment, an unknown or expired assessment and a malformed assessment_id all answer 404 not_found. response_mode=detailed needs the detailed scope. A key with the history scope also gets detail.identifiers, the identifiers the assessment was sent, exactly as received.`,
     annotations: {
       title: "Get an assessment",
       destructiveHint: false,
@@ -55223,7 +55238,7 @@ var init_assessmentsQuery2 = __esm(() => {
     name: "query_assessments",
     description: `Page through one account's unexpired assessments.
 
-History is a POST with account_id in the body so an account identifier stays out of URLs and access logs. Requires the history scope. Read-only and safe to retry. Newest first, each at its latest assessment_version. An account with no assessments answers 200 with empty items. The cursor is opaque and bound to your workspace and the account; a tampered or expired cursor answers 400 invalid_cursor. response_mode=detailed needs the detailed scope.`,
+History is a POST with account_id in the body so an account identifier stays out of URLs and access logs. Requires the history scope. Read-only and safe to retry. Newest first, each at its latest assessment_version. An account with no assessments answers 200 with empty items. The cursor is opaque and bound to your workspace and the account; a tampered or expired cursor answers 400 invalid_cursor. response_mode=detailed needs the detailed scope. Each item's identifiers holds the identifiers its assessment was sent, exactly as received.`,
     annotations: {
       title: "List an account's assessments",
       destructiveHint: false,
@@ -55579,7 +55594,7 @@ var init_assessmentsRetrieveVersion2 = __esm(() => {
     name: "get_assessment_version",
     description: `Retrieve an exact assessment revision
 
-Retrieve a retained assessment version with its original decision, policy, flow and depth. This response excludes the current account decision. Current retention and response-mode permissions still apply.`,
+Retrieve a retained assessment version with its original decision, policy, flow and depth. This response excludes the current account decision. Current retention and response-mode permissions still apply. detail.identifiers holds the identifiers the assessment was sent, exactly as received.`,
     annotations: {
       title: "Read an exact assessment revision",
       destructiveHint: false,
@@ -55729,7 +55744,7 @@ var init_assessmentsSearch2 = __esm(() => {
     name: "search_assessments",
     description: `Search assessments across this environment
 
-Search retained assessments created in [from,to), over at most 366 days. Filters use each assessment decision, rather than the current account decision. Results can change between pages. Keep the assessment version to retrieve the exact decision later. This read does not require an idempotency key.`,
+Search retained assessments created in [from,to), over at most 366 days. Filters use each assessment decision, rather than the current account decision. Results can change between pages. Keep the assessment version to retrieve the exact decision later. Each item's detail.identifiers holds the identifiers its assessment was sent, exactly as received. This read does not require an idempotency key.`,
     annotations: {
       title: "Search assessments in this environment",
       destructiveHint: false,
@@ -59032,7 +59047,7 @@ endpoint.verification sends a signed challenge now and answers whether the endpo
 function createMCPServer(deps) {
   const server = new McpServer({
     name: "NoResponse",
-    version: "0.6.12"
+    version: "0.6.13"
   });
   const getClient = deps.getSDK || (() => new NoResponseCore({
     security: deps.security,
@@ -59152,13 +59167,13 @@ var init_tool_names = __esm(() => {
       name: "create_assessment",
       description: `Assess identifiers for a signup or gateway decision.
 
-Assesses one account creation, login or purchase (flow) and answers with the account's one current risk: account.risk.decision is the decision for this flow (allow, step_up, review or block, where block means your block threshold was reached), and detail holds this assessment's own facts. depth sets how long the answer waits for sources: quick waits only for the fast ones (500 ms), full for the whole budget (3000 ms at most); it defaults to full for account_creation and purchase and quick for login. 200 carries complete or partial, 202 carries pending with Location and Retry-After. While the account's first assessment is pending, account is absent: apply your own fallback for that, 429, 503 or a timeout. NoResponse blocks nothing itself; you decide. Requires the assess scope. Idempotency-Key is optional in the SDK and is bound to the body for 24 hours: the same key with the same body replays the latest assessment with Idempotent-Replayed: true and starts no new work; the same key with a different body answers 409 idempotency_key_reused. response_mode defaults to standard; detailed needs the detailed scope.`
+Assesses one account creation, login or purchase (flow) and answers with the account's one current risk: account.risk.decision is the decision for this flow (allow, step_up, review or block, where block means your block threshold was reached), and detail holds this assessment's own facts. depth sets how long the answer waits for sources: quick waits only for the fast ones (500 ms), full for the whole budget (3000 ms at most); it defaults to full for account_creation and purchase and quick for login. 200 carries complete or partial, 202 carries pending with Location and Retry-After. While the account's first assessment is pending, account is absent: apply your own fallback for that, 429, 503 or a timeout. NoResponse blocks nothing itself; you decide. Requires the assess scope. Idempotency-Key is optional in the SDK and is bound to the body for 24 hours: the same key with the same body replays the latest assessment with Idempotent-Replayed: true and starts no new work; the same key with a different body answers 409 idempotency_key_reused. response_mode defaults to standard; detailed needs the detailed scope. The answer leaves out detail.identifiers: you hold what you sent, and a key with the history scope gets them back with GET.`
     },
     {
       name: "get_assessment",
       description: `Poll the authoritative assessment of one assessment.
 
-Returns the highest assessment_version, with the account's current risk. Requires the assess or history scope. While status is pending, or partial with a source still running, the response carries Retry-After; poll no faster than it says. Another workspace's assessment, an unknown or expired assessment and a malformed assessment_id all answer 404 not_found. response_mode=detailed needs the detailed scope.`
+Returns the highest assessment_version, with the account's current risk. Requires the assess or history scope. While status is pending, or partial with a source still running, the response carries Retry-After; poll no faster than it says. Another workspace's assessment, an unknown or expired assessment and a malformed assessment_id all answer 404 not_found. response_mode=detailed needs the detailed scope. A key with the history scope also gets detail.identifiers, the identifiers the assessment was sent, exactly as received.`
     },
     {
       name: "delete_assessment",
@@ -59176,19 +59191,19 @@ Records what you later learned about an assessed account: confirmed_abuse, accou
       name: "query_assessments",
       description: `Page through one account's unexpired assessments.
 
-History is a POST with account_id in the body so an account identifier stays out of URLs and access logs. Requires the history scope. Read-only and safe to retry. Newest first, each at its latest assessment_version. An account with no assessments answers 200 with empty items. The cursor is opaque and bound to your workspace and the account; a tampered or expired cursor answers 400 invalid_cursor. response_mode=detailed needs the detailed scope.`
+History is a POST with account_id in the body so an account identifier stays out of URLs and access logs. Requires the history scope. Read-only and safe to retry. Newest first, each at its latest assessment_version. An account with no assessments answers 200 with empty items. The cursor is opaque and bound to your workspace and the account; a tampered or expired cursor answers 400 invalid_cursor. response_mode=detailed needs the detailed scope. Each item's identifiers holds the identifiers its assessment was sent, exactly as received.`
     },
     {
       name: "search_assessments",
       description: `Search assessments across this environment
 
-Search retained assessments created in [from,to), over at most 366 days. Filters use each assessment decision, rather than the current account decision. Results can change between pages. Keep the assessment version to retrieve the exact decision later. This read does not require an idempotency key.`
+Search retained assessments created in [from,to), over at most 366 days. Filters use each assessment decision, rather than the current account decision. Results can change between pages. Keep the assessment version to retrieve the exact decision later. Each item's detail.identifiers holds the identifiers its assessment was sent, exactly as received. This read does not require an idempotency key.`
     },
     {
       name: "get_assessment_version",
       description: `Retrieve an exact assessment revision
 
-Retrieve a retained assessment version with its original decision, policy, flow and depth. This response excludes the current account decision. Current retention and response-mode permissions still apply.`
+Retrieve a retained assessment version with its original decision, policy, flow and depth. This response excludes the current account decision. Current retention and response-mode permissions still apply. detail.identifiers holds the identifiers the assessment was sent, exactly as received.`
     },
     {
       name: "bind_provisional_account",
@@ -59218,7 +59233,7 @@ Erases the account in the environment of your key, for an erasure request from y
       name: "list_account_assessments",
       description: `Page through one account's unexpired assessments.
 
-The account's history: the same page as POST /v1/assessments/query for this account_id, newest first, each at its latest assessment_version. Requires the history scope. Read-only and safe to retry. An account with no assessments answers 200 with empty items. The cursor is opaque and bound to your workspace and the account; a tampered or expired cursor answers 400 invalid_cursor. response_mode=detailed needs the detailed scope. The account_id travels in the URL; use POST /v1/assessments/query to keep it out of access logs.`
+The account's history: the same page as POST /v1/assessments/query for this account_id, newest first, each at its latest assessment_version. Requires the history scope. Read-only and safe to retry. An account with no assessments answers 200 with empty items. The cursor is opaque and bound to your workspace and the account; a tampered or expired cursor answers 400 invalid_cursor. response_mode=detailed needs the detailed scope. Each item's identifiers holds the identifiers its assessment was sent, exactly as received. The account_id travels in the URL; use POST /v1/assessments/query to keep it out of access logs.`
     },
     {
       name: "record_enforcement",
@@ -59266,7 +59281,7 @@ Mark this association retired, idempotently. This does not revoke the actual key
       name: "export_account",
       description: `Export an account
 
-Retrieve one consistent snapshot of retained customer-accessible records, including assessment revisions, account decisions, feedback, key associations, enforcements and request diagnostics. Secrets, restricted source information, other customers' data and legacy free-text notes are excluded. The same standard/detailed permissions apply. An export exceeding 10000 records or 8 MiB returns export_too_large without a partial result. Historical decisions that were not captured are identified as an exclusion.`
+Retrieve one consistent snapshot of retained customer-accessible records, including assessment revisions, account decisions, feedback, key associations, enforcements and request diagnostics. Each assessment revision's detail.identifiers holds the identifiers that assessment was sent, exactly as received. Secrets, restricted source information, other customers' data and legacy free-text notes are excluded. The same standard/detailed permissions apply. An export exceeding 10000 records or 8 MiB returns export_too_large without a partial result. Historical decisions that were not captured are identified as an exclusion.`
     },
     {
       name: "list_keys",
@@ -67881,7 +67896,7 @@ var routes = buildRouteMap({
 var app = buildApplication(routes, {
   name: "mcp",
   versionInfo: {
-    currentVersion: "0.6.12"
+    currentVersion: "0.6.13"
   }
 });
 run(app, process3.argv.slice(2), buildContext(process3));
@@ -67889,5 +67904,5 @@ export {
   app
 };
 
-//# debugId=01809CD030BCB09364756E2164756E21
+//# debugId=C65D8B95DD85934464756E2164756E21
 //# sourceMappingURL=mcp-server.js.map