@noresponse/mcp 0.6.12 → 0.6.14

package/bin/mcp-server.js

@@ -48117,9 +48117,9 @@ var init_config = __esm(() => {
   SDK_METADATA = {
     language: "typescript",
     openapiDocVersion: "1",
-    sdkVersion: "0.6.12",
+    sdkVersion: "0.6.14",
     genVersion: "internal",
-    userAgent: "noresponse-sdk/mcp-typescript 0.6.12 internal 1 @noresponse/mcp"
+    userAgent: "noresponse-sdk/mcp-typescript 0.6.14 internal 1 @noresponse/mcp"
   };
 });
 
@@ -50994,6 +50994,19 @@ var init_risk = __esm(() => {
   }).describe("The one risk decision for this event. score is 0 (safe) to 100 (risky), set by the reasons that fired under a hand-set, versioned heuristic policy. Each reason carries its direction and impact band; the policy's weights are not published. Every answer with a recommendation carries it, and the top-level recommendation equals risk.recommendation. It names no source or provider.");
 });
 
+// src/models/sentidentifiers.ts
+var SentIdentifiers$zodSchema;
+var init_sentidentifiers = __esm(() => {
+  init_zod();
+  SentIdentifiers$zodSchema = object({
+    email: string2().optional().describe("identifiers.email as the request sent it."),
+    ip: string2().optional().describe("identifiers.ip as the request sent it."),
+    name: string2().optional().describe("identifiers.name as the request sent it, before NFC normalisation."),
+    phone: string2().optional().describe("identifiers.phone as the request sent it."),
+    username: string2().optional().describe("identifiers.username as the request sent it.")
+  }).describe("The identifiers an assessment was sent: each member of the request's identifiers object exactly as received, before the server normalised it (the email domain keeps its case, the name its Unicode form). A member the request did not send is absent. NoResponse keeps them encrypted under the workspace's own key, does not index or log them, and deletes them with the assessment: on DELETE of the assessment or its account, at its expires_at, and with the workspace.");
+});
+
 // src/models/failurereason.ts
 var FailureReason$zodSchema;
 var init_failurereason = __esm(() => {
@@ -51239,6 +51252,7 @@ var init_assessmentdetail = __esm(() => {
   init_incompletesource();
   init_recommendation();
   init_risk();
+  init_sentidentifiers();
   init_signal();
   init_status();
   AssessmentDetail$zodSchema = object({
@@ -51250,6 +51264,7 @@ var init_assessmentdetail = __esm(() => {
     confidence: Confidence$zodSchema.describe("Ordinal confidence in the recommendation under the current policy: low, medium, high or unavailable."),
     created_at: string2().describe("When the assessment was created. Fixed for the life of the assessment: every revision carries the same created_at."),
     expires_at: string2().describe("After this instant the assessment is no longer served: GET /v1/assessments/{assessment_id} answers 404 and it leaves the account history. It is created_at plus your retention period at creation (default and maximum 365 days) and is fixed per record: a later revision keeps it, and a new assessment for the same account starts its own clock. If you later shorten retention, the effective expiry becomes created_at plus the shorter of the two periods."),
+    identifiers: SentIdentifiers$zodSchema.optional().describe("The identifiers an assessment was sent: each member of the request's identifiers object exactly as received, before the server normalised it (the email domain keeps its case, the name its Unicode form). A member the request did not send is absent. NoResponse keeps them encrypted under the workspace's own key, does not index or log them, and deletes them with the assessment: on DELETE of the assessment or its account, at its expires_at, and with the workspace."),
     incomplete_sources: array(IncompleteSource$zodSchema).describe("The lanes that did not settle, each listed once with a reason; lanes, not sources. In a detailed view a lane is listed exactly when one of its signals did not settle; a standard view carries no signals to match."),
     policy_basis: literal("heuristic_unvalidated").default("heuristic_unvalidated").optional().describe("Labels the v0 policy as hand-authored and not statistically validated."),
     policy_version: string2().describe("Version of the hand-authored heuristic policy that produced the recommendation, for example 'risk-2026-10.7'. A workspace threshold override adds a +t<N> suffix, e.g. 'risk-2026-10.7+t3'."),
@@ -52868,7 +52883,7 @@ var init_accountsExport2 = __esm(() => {
     name: "export_account",
     description: `Export an account
 
-Retrieve one consistent snapshot of retained customer-accessible records, including assessment revisions, account decisions, feedback, key associations, enforcements and request diagnostics. Secrets, restricted source information, other customers' data and legacy free-text notes are excluded. The same standard/detailed permissions apply. An export exceeding 10000 records or 8 MiB returns export_too_large without a partial result. Historical decisions that were not captured are identified as an exclusion.`,
+Retrieve one consistent snapshot of retained customer-accessible records, including assessment revisions, account decisions, feedback, key associations, enforcements and request diagnostics. Each assessment revision's detail.identifiers holds the identifiers that assessment was sent, exactly as received. Secrets, restricted source information, other customers' data and legacy free-text notes are excluded. The same standard/detailed permissions apply. An export exceeding 10000 records or 8 MiB returns export_too_large without a partial result. Historical decisions that were not captured are identified as an exclusion.`,
     annotations: {
       title: "Export this account's retained customer-accessible records",
       destructiveHint: false,
@@ -53206,7 +53221,7 @@ var init_accountsListAssessments2 = __esm(() => {
     name: "list_account_assessments",
     description: `Page through one account's unexpired assessments.
 
-The account's history: the same page as POST /v1/assessments/query for this account_id, newest first, each at its latest assessment_version. Requires the history scope. Read-only and safe to retry. An account with no assessments answers 200 with empty items. The cursor is opaque and bound to your workspace and the account; a tampered or expired cursor answers 400 invalid_cursor. response_mode=detailed needs the detailed scope. The account_id travels in the URL; use POST /v1/assessments/query to keep it out of access logs.`,
+The account's history: the same page as POST /v1/assessments/query for this account_id, newest first, each at its latest assessment_version. Requires the history scope. Read-only and safe to retry. An account with no assessments answers 200 with empty items. The cursor is opaque and bound to your workspace and the account; a tampered or expired cursor answers 400 invalid_cursor. response_mode=detailed needs the detailed scope. Each item's identifiers holds the identifiers its assessment was sent, exactly as received. The account_id travels in the URL; use POST /v1/assessments/query to keep it out of access logs.`,
     annotations: {
       title: "Page through an account's assessments",
       destructiveHint: false,
@@ -54430,6 +54445,202 @@ Retrieve the account decision at one recorded risk version. The answer uses the
   };
 });
 
+// src/models/aggregatedimension.ts
+var AggregateDimension$zodSchema;
+var init_aggregatedimension = __esm(() => {
+  init_zod();
+  AggregateDimension$zodSchema = _enum([
+    "decision",
+    "flow",
+    "recommendation",
+    "band",
+    "reason",
+    "lane",
+    "country",
+    "asn",
+    "list_match"
+  ]).describe("decision, recommendation and band: the first answer's. flow: the assessment's. list_match: the action of the list entry that decided the account when it was first answered. reason: a reason the first answer fired, with its impact band. lane: an evidence lane the first answer listed in incomplete_sources. country and asn: the submitted IP's, from the IP data.");
+});
+
+// src/models/answerrevision.ts
+var AnswerRevision$zodSchema;
+var init_answerrevision = __esm(() => {
+  init_zod();
+  AnswerRevision$zodSchema = _enum([
+    "latest",
+    "first"
+  ]).describe("Which answer of each assessment the filters describe: latest, the latest stored revision, or first, the first answer, as served when the assessment was first answered (POST /v1/assessments/aggregate counts first answers). A cell of an aggregate drills down to POST /v1/assessments/search with the same filters, revision first and the cell's bucket as from and to.");
+});
+
+// src/models/bucket.ts
+var Bucket$zodSchema;
+var init_bucket = __esm(() => {
+  init_zod();
+  Bucket$zodSchema = _enum([
+    "hour",
+    "day",
+    "week"
+  ]).describe("The period each count covers, in UTC; a week starts on Monday.");
+});
+
+// src/models/decision.ts
+var Decision$zodSchema;
+var init_decision = __esm(() => {
+  init_zod();
+  Decision$zodSchema = _enum([
+    "allow",
+    "step_up",
+    "review",
+    "block"
+  ]).describe("An assessment's own decision: block when its stored risk.block is true, otherwise its recommendation. It is not the account's decision or held-admission state.");
+});
+
+// src/models/assessmentaggregaterequest.ts
+var AssessmentAggregateRequestMetric$zodSchema, AssessmentAggregateRequest$zodSchema;
+var init_assessmentaggregaterequest = __esm(() => {
+  init_zod();
+  init_aggregatedimension();
+  init_answerrevision();
+  init_bucket();
+  init_decision();
+  init_flow();
+  init_recommendation();
+  init_status();
+  AssessmentAggregateRequestMetric$zodSchema = _enum([
+    "count",
+    "score_histogram",
+    "late_flips"
+  ]);
+  AssessmentAggregateRequest$zodSchema = object({
+    bucket: Bucket$zodSchema.describe("The period each count covers, in UTC; a week starts on Monday."),
+    decision: Decision$zodSchema.optional().describe("An assessment's own decision: block when its stored risk.block is true, otherwise its recommendation. It is not the account's decision or held-admission state."),
+    flow: Flow$zodSchema.optional().describe("The event an assessment is made for: account_creation (a user creates an account), login (a user returns to an existing account) or purchase (a payment or a credit grant). The account's risk is reported with the decision for this flow."),
+    from: string2().describe("The first bucket's start."),
+    group_by: array(AggregateDimension$zodSchema).optional().describe("At most two dimensions to count by, of which at most one is reason, lane, country or asn. An assessment counts once in each of its reasons and incomplete lanes, so those groups can add up to more than the bucket's count."),
+    limit: int().default(20).describe("The most groups answered: the largest over the whole range, then by value. groups_truncated says when there were more."),
+    metrics: array(AssessmentAggregateRequestMetric$zodSchema).optional().describe("count: each bucket's count and groups. score_histogram: first answers by flow and 5-point score bucket. late_flips: changes of an assessment's account decision for its flow after its first answer, by from, to and delay."),
+    recommendation: Recommendation$zodSchema.optional().describe("The recommended action: allow, step_up or review. Your application applies it."),
+    revision: AnswerRevision$zodSchema.optional().describe("Which answer of each assessment the filters describe: latest, the latest stored revision, or first, the first answer, as served when the assessment was first answered (POST /v1/assessments/aggregate counts first answers). A cell of an aggregate drills down to POST /v1/assessments/search with the same filters, revision first and the cell's bucket as from and to."),
+    status: Status$zodSchema.optional().describe("complete: final; nothing is still running. A lane that failed or missed its 10 s deadline stays listed in incomplete_sources, and confidence is lower. partial: a recommendation exists and at least one lane is still running or did not settle (see incomplete_sources). pending: nothing usable before the deadline; no recommendation yet, poll or wait for the webhook."),
+    to: string2().describe("The end, excluded: the start of the bucket after the last.")
+  }).describe("Count this environment's assessments created in [from,to) by bucket, from counts kept as each assessment is first answered, not by scanning assessments. Each assessment counts once, by its first answer (the answer served when it was first answered); later revisions and late results do not count it again, and late_flips counts its later account decision changes. from and to start a bucket (an hour, a UTC day, or a week from Monday 00:00 UTC), cover at most 366 days (31 for hour buckets) and from is inside the retention period. The filters are POST /v1/assessments/search's and describe the first answer, so a cell drills down to search with the same filters, revision first and the cell's bucket as from and to. Counts hold no identifier and stay when an assessment or account is deleted or erased; they expire with retention and go with the workspace. Reasons are counted by code and impact band, not by weight. No Idempotency-Key.");
+});
+
+// src/funcs/assessmentsAggregate.ts
+function assessmentsAggregate(client$, request, options) {
+  return new APIPromise($do14(client$, request, options));
+}
+async function $do14(client$, request, options) {
+  const parsed$ = safeParse2(request, (value$) => AssessmentAggregateRequest$zodSchema.parse(value$), "Input validation failed");
+  if (!parsed$.ok) {
+    return [parsed$, { status: "invalid" }];
+  }
+  const payload$ = parsed$.value;
+  const body$ = encodeJSON("body", payload$, { explode: true });
+  const path$ = pathToFunc("/v1/assessments/aggregate")();
+  const headers$ = new Headers(compactMap({
+    "Content-Type": "application/json",
+    Accept: options?.acceptHeaderOverride || "application/json;q=1, application/problem+json;q=0"
+  }));
+  const securityInput = await extractSecurity(client$._options.security);
+  const requestSecurity = resolveGlobalSecurity(securityInput);
+  const context = {
+    options: client$._options,
+    baseURL: options?.serverURL ?? client$._baseURL ?? "",
+    operationID: "aggregateAssessments",
+    oAuth2Scopes: null,
+    resolvedSecurity: requestSecurity,
+    securitySource: client$._options.security,
+    retryConfig: options?.retries || client$._options.retryConfig || {
+      strategy: "backoff",
+      backoff: {
+        initialInterval: 500,
+        maxInterval: 8000,
+        exponent: 2,
+        maxElapsedTime: 30000
+      },
+      retryConnectionErrors: true
+    },
+    retryCodes: options?.retryCodes || [
+      "408",
+      "429",
+      "5XX"
+    ]
+  };
+  const requestRes = client$._createRequest(context, {
+    security: requestSecurity,
+    method: "POST",
+    baseURL: options?.serverURL,
+    path: path$,
+    headers: headers$,
+    body: body$,
+    userAgent: client$._options.userAgent,
+    timeoutMs: options?.timeoutMs || client$._options.timeoutMs || -1
+  }, options);
+  if (!requestRes.ok) {
+    return [requestRes, { status: "invalid" }];
+  }
+  const req$ = requestRes.value;
+  const doResult = await client$._do(req$, {
+    context,
+    errorCodes: [],
+    retryConfig: context.retryConfig,
+    retryCodes: context.retryCodes
+  });
+  if (!doResult.ok) {
+    return [doResult, { status: "request-error", request: req$ }];
+  }
+  return [doResult, {
+    status: "complete",
+    request: req$,
+    response: doResult.value
+  }];
+}
+var init_assessmentsAggregate = __esm(() => {
+  init_encodings();
+  init_primitives();
+  init_schemas3();
+  init_security();
+  init_url();
+  init_assessmentaggregaterequest();
+  init_async();
+});
+
+// src/mcp-server/tools/assessmentsAggregate.ts
+var args14, tool$assessmentsAggregate;
+var init_assessmentsAggregate2 = __esm(() => {
+  init_assessmentsAggregate();
+  init_assessmentaggregaterequest();
+  init_tools();
+  args14 = {
+    request: AssessmentAggregateRequest$zodSchema
+  };
+  tool$assessmentsAggregate = {
+    name: "aggregate_assessments",
+    description: `Count assessments by time, decision and reason
+
+Count this environment's assessments created in [from,to) by hour, day or week, grouped by up to two of decision, flow, recommendation, band, reason, lane, country, asn and list_match. Each assessment counts once, by its first answer; late results do not count it again and appear in late_flips. Optional metrics add a score histogram per flow and late account decision changes. from and to start a bucket and cover at most 366 days (31 for hour buckets) inside the retention period. The filters are search's and describe the first answer: send them to search with revision first to list a cell's assessments. Counts hold no identifier, stay when an assessment or account is deleted, and report reasons by code and impact band. No Idempotency-Key.`,
+    annotations: {
+      title: "Count assessments by time, decision and reason",
+      destructiveHint: false,
+      idempotentHint: true,
+      openWorldHint: false,
+      readOnlyHint: true
+    },
+    args: args14,
+    tool: async (client, args, ctx) => {
+      const [result] = await assessmentsAggregate(client, args.request, { fetchOptions: { signal: ctx.mcpReq.signal } }).$inspect();
+      if (!result.ok) {
+        return {
+          content: [{ type: "text", text: result.error.message }],
+          isError: true
+        };
+      }
+      return formatResult(result.value);
+    }
+  };
+});
+
 // src/models/accountbindingrequest.ts
 var AccountBindingRequest$zodSchema;
 var init_accountbindingrequest = __esm(() => {
@@ -54480,9 +54691,9 @@ var init_bindprovisionalaccountop = __esm(() => {
 
 // src/funcs/assessmentsBindAccount.ts
 function assessmentsBindAccount(client$, request, options) {
-  return new APIPromise($do14(client$, request, options));
+  return new APIPromise($do15(client$, request, options));
 }
-async function $do14(client$, request, options) {
+async function $do15(client$, request, options) {
   const parsed$ = safeParse2(request, (value$) => BindProvisionalAccountRequest$zodSchema.parse(value$), "Input validation failed");
   if (!parsed$.ok) {
     return [parsed$, { status: "invalid" }];
@@ -54565,12 +54776,12 @@ var init_assessmentsBindAccount = __esm(() => {
 });
 
 // src/mcp-server/tools/assessmentsBindAccount.ts
-var args14, tool$assessmentsBindAccount;
+var args15, tool$assessmentsBindAccount;
 var init_assessmentsBindAccount2 = __esm(() => {
   init_assessmentsBindAccount();
   init_bindprovisionalaccountop();
   init_tools();
-  args14 = {
+  args15 = {
     request: BindProvisionalAccountRequest$zodSchema
   };
   tool$assessmentsBindAccount = {
@@ -54585,7 +54796,7 @@ One-time association to an opaque stable customer account. The assessment is its
       openWorldHint: false,
       readOnlyHint: false
     },
-    args: args14,
+    args: args15,
     tool: async (client, args, ctx) => {
       const [result] = await assessmentsBindAccount(client, args.request, { fetchOptions: { signal: ctx.mcpReq.signal } }).$inspect();
       if (!result.ok) {
@@ -54787,9 +54998,9 @@ var init_createassessmentop = __esm(() => {
 
 // src/funcs/assessmentsCreate.ts
 function assessmentsCreate(client$, request, options) {
-  return new APIPromise($do15(client$, request, options));
+  return new APIPromise($do16(client$, request, options));
 }
-async function $do15(client$, request, options) {
+async function $do16(client$, request, options) {
   const parsed$ = safeParse2(request, (value$) => CreateAssessmentRequest$zodSchema.parse(value$), "Input validation failed");
   if (!parsed$.ok) {
     return [parsed$, { status: "invalid" }];
@@ -54867,19 +55078,19 @@ var init_assessmentsCreate = __esm(() => {
 });
 
 // src/mcp-server/tools/assessmentsCreate.ts
-var args15, tool$assessmentsCreate;
+var args16, tool$assessmentsCreate;
 var init_assessmentsCreate2 = __esm(() => {
   init_assessmentsCreate();
   init_createassessmentop();
   init_tools();
-  args15 = {
+  args16 = {
     request: CreateAssessmentRequest$zodSchema
   };
   tool$assessmentsCreate = {
     name: "create_assessment",
     description: `Assess identifiers for a signup or gateway decision.
 
-Assesses one account creation, login or purchase (flow) and answers with the account's one current risk: account.risk.decision is the decision for this flow (allow, step_up, review or block, where block means your block threshold was reached), and detail holds this assessment's own facts. depth sets how long the answer waits for sources: quick waits only for the fast ones (500 ms), full for the whole budget (3000 ms at most); it defaults to full for account_creation and purchase and quick for login. 200 carries complete or partial, 202 carries pending with Location and Retry-After. While the account's first assessment is pending, account is absent: apply your own fallback for that, 429, 503 or a timeout. NoResponse blocks nothing itself; you decide. Requires the assess scope. Idempotency-Key is optional in the SDK and is bound to the body for 24 hours: the same key with the same body replays the latest assessment with Idempotent-Replayed: true and starts no new work; the same key with a different body answers 409 idempotency_key_reused. response_mode defaults to standard; detailed needs the detailed scope.`,
+Assesses one account creation, login or purchase (flow) and answers with the account's one current risk: account.risk.decision is the decision for this flow (allow, step_up, review or block, where block means your block threshold was reached), and detail holds this assessment's own facts. depth sets how long the answer waits for sources: quick waits only for the fast ones (500 ms), full for the whole budget (3000 ms at most); it defaults to full for account_creation and purchase and quick for login. 200 carries complete or partial, 202 carries pending with Location and Retry-After. While the account's first assessment is pending, account is absent: apply your own fallback for that, 429, 503 or a timeout. NoResponse blocks nothing itself; you decide. Requires the assess scope. Idempotency-Key is optional in the SDK and is bound to the body for 24 hours: the same key with the same body replays the latest assessment with Idempotent-Replayed: true and starts no new work; the same key with a different body answers 409 idempotency_key_reused. response_mode defaults to standard; detailed needs the detailed scope. The answer leaves out detail.identifiers: you hold what you sent, and a key with the history scope gets them back with GET.`,
     annotations: {
       title: "Assess an account creation, login or purchase",
       destructiveHint: false,
@@ -54887,7 +55098,7 @@ Assesses one account creation, login or purchase (flow) and answers with the acc
       openWorldHint: false,
       readOnlyHint: false
     },
-    args: args15,
+    args: args16,
     tool: async (client, args, ctx) => {
       const [result] = await assessmentsCreate(client, args.request, { fetchOptions: { signal: ctx.mcpReq.signal } }).$inspect();
       if (!result.ok) {
@@ -54964,9 +55175,9 @@ var init_deleteassessmentop = __esm(() => {
 
 // src/funcs/assessmentsDelete.ts
 function assessmentsDelete(client$, request, options) {
-  return new APIPromise($do16(client$, request, options));
+  return new APIPromise($do17(client$, request, options));
 }
-async function $do16(client$, request, options) {
+async function $do17(client$, request, options) {
   const parsed$ = safeParse2(request, (value$) => DeleteAssessmentRequest$zodSchema.parse(value$), "Input validation failed");
   if (!parsed$.ok) {
     return [parsed$, { status: "invalid" }];
@@ -55048,12 +55259,12 @@ var init_assessmentsDelete = __esm(() => {
 });
 
 // src/mcp-server/tools/assessmentsDelete.ts
-var args16, tool$assessmentsDelete;
+var args17, tool$assessmentsDelete;
 var init_assessmentsDelete2 = __esm(() => {
   init_assessmentsDelete();
   init_deleteassessmentop();
   init_tools();
-  args16 = {
+  args17 = {
     request: DeleteAssessmentRequest$zodSchema
   };
   tool$assessmentsDelete = {
@@ -55068,7 +55279,7 @@ Deletes one assessment in the environment of your key, with its versions, eviden
       openWorldHint: false,
       readOnlyHint: false
     },
-    args: args16,
+    args: args17,
     tool: async (client, args, ctx) => {
       const [result] = await assessmentsDelete(client, args.request, { fetchOptions: { signal: ctx.mcpReq.signal } }).$inspect();
       if (!result.ok) {
@@ -55083,19 +55294,19 @@ Deletes one assessment in the environment of your key, with its versions, eviden
 });
 
 // src/mcp-server/tools/assessmentsGet.ts
-var args17, tool$assessmentsGet;
+var args18, tool$assessmentsGet;
 var init_assessmentsGet2 = __esm(() => {
   init_assessmentsGet();
   init_getassessmentop();
   init_tools();
-  args17 = {
+  args18 = {
     request: GetAssessmentRequest$zodSchema
   };
   tool$assessmentsGet = {
     name: "get_assessment",
     description: `Poll the authoritative assessment of one assessment.
 
-Returns the highest assessment_version, with the account's current risk. Requires the assess or history scope. While status is pending, or partial with a source still running, the response carries Retry-After; poll no faster than it says. Another workspace's assessment, an unknown or expired assessment and a malformed assessment_id all answer 404 not_found. response_mode=detailed needs the detailed scope.`,
+Returns the highest assessment_version, with the account's current risk. Requires the assess or history scope. While status is pending, or partial with a source still running, the response carries Retry-After; poll no faster than it says. Another workspace's assessment, an unknown or expired assessment and a malformed assessment_id all answer 404 not_found. response_mode=detailed needs the detailed scope. A key with the history scope also gets detail.identifiers, the identifiers the assessment was sent, exactly as received.`,
     annotations: {
       title: "Get an assessment",
       destructiveHint: false,
@@ -55103,7 +55314,7 @@ Returns the highest assessment_version, with the account's current risk. Require
       openWorldHint: false,
       readOnlyHint: true
     },
-    args: args17,
+    args: args18,
     tool: async (client, args, ctx) => {
       const [result] = await assessmentsGet(client, args.request, { fetchOptions: { signal: ctx.mcpReq.signal } }).$inspect();
       if (!result.ok) {
@@ -55132,9 +55343,9 @@ var init_assessmentquery = __esm(() => {
 
 // src/funcs/assessmentsQuery.ts
 function assessmentsQuery(client$, request, options) {
-  return new APIPromise($do17(client$, request, options));
+  return new APIPromise($do18(client$, request, options));
 }
-async function $do17(client$, request, options) {
+async function $do18(client$, request, options) {
   const parsed$ = safeParse2(request, (value$) => AssessmentQuery$zodSchema.parse(value$), "Input validation failed");
   if (!parsed$.ok) {
     return [parsed$, { status: "invalid" }];
@@ -55211,19 +55422,19 @@ var init_assessmentsQuery = __esm(() => {
 });
 
 // src/mcp-server/tools/assessmentsQuery.ts
-var args18, tool$assessmentsQuery;
+var args19, tool$assessmentsQuery;
 var init_assessmentsQuery2 = __esm(() => {
   init_assessmentsQuery();
   init_assessmentquery();
   init_tools();
-  args18 = {
+  args19 = {
     request: AssessmentQuery$zodSchema
   };
   tool$assessmentsQuery = {
     name: "query_assessments",
     description: `Page through one account's unexpired assessments.
 
-History is a POST with account_id in the body so an account identifier stays out of URLs and access logs. Requires the history scope. Read-only and safe to retry. Newest first, each at its latest assessment_version. An account with no assessments answers 200 with empty items. The cursor is opaque and bound to your workspace and the account; a tampered or expired cursor answers 400 invalid_cursor. response_mode=detailed needs the detailed scope.`,
+History is a POST with account_id in the body so an account identifier stays out of URLs and access logs. Requires the history scope. Read-only and safe to retry. Newest first, each at its latest assessment_version. An account with no assessments answers 200 with empty items. The cursor is opaque and bound to your workspace and the account; a tampered or expired cursor answers 400 invalid_cursor. response_mode=detailed needs the detailed scope. Each item's identifiers holds the identifiers its assessment was sent, exactly as received.`,
     annotations: {
       title: "List an account's assessments",
       destructiveHint: false,
@@ -55231,7 +55442,7 @@ History is a POST with account_id in the body so an account identifier stays out
       openWorldHint: false,
       readOnlyHint: true
     },
-    args: args18,
+    args: args19,
     tool: async (client, args, ctx) => {
       const [result] = await assessmentsQuery(client, args.request, { fetchOptions: { signal: ctx.mcpReq.signal } }).$inspect();
       if (!result.ok) {
@@ -55313,9 +55524,9 @@ var init_recordassessmentoutcomeop = __esm(() => {
 
 // src/funcs/assessmentsRecordOutcome.ts
 function assessmentsRecordOutcome(client$, request, options) {
-  return new APIPromise($do18(client$, request, options));
+  return new APIPromise($do19(client$, request, options));
 }
-async function $do18(client$, request, options) {
+async function $do19(client$, request, options) {
   const parsed$ = safeParse2(request, (value$) => RecordAssessmentOutcomeRequest$zodSchema.parse(value$), "Input validation failed");
   if (!parsed$.ok) {
     return [parsed$, { status: "invalid" }];
@@ -55399,12 +55610,12 @@ var init_assessmentsRecordOutcome = __esm(() => {
 });
 
 // src/mcp-server/tools/assessmentsRecordOutcome.ts
-var args19, tool$assessmentsRecordOutcome;
+var args20, tool$assessmentsRecordOutcome;
 var init_assessmentsRecordOutcome2 = __esm(() => {
   init_assessmentsRecordOutcome();
   init_recordassessmentoutcomeop();
   init_tools();
-  args19 = {
+  args20 = {
     request: RecordAssessmentOutcomeRequest$zodSchema
   };
   tool$assessmentsRecordOutcome = {
@@ -55419,7 +55630,7 @@ Records what you later learned about an assessed account: confirmed_abuse, accou
       openWorldHint: false,
       readOnlyHint: false
     },
-    args: args19,
+    args: args20,
     tool: async (client, args, ctx) => {
       const [result] = await assessmentsRecordOutcome(client, args.request, { fetchOptions: { signal: ctx.mcpReq.signal } }).$inspect();
       if (!result.ok) {
@@ -55475,9 +55686,9 @@ var init_getassessmentversionop = __esm(() => {
 
 // src/funcs/assessmentsRetrieveVersion.ts
 function assessmentsRetrieveVersion(client$, request, options) {
-  return new APIPromise($do19(client$, request, options));
+  return new APIPromise($do20(client$, request, options));
 }
-async function $do19(client$, request, options) {
+async function $do20(client$, request, options) {
   const parsed$ = safeParse2(request, (value$) => GetAssessmentVersionRequest$zodSchema.parse(value$), "Input validation failed");
   if (!parsed$.ok) {
     return [parsed$, { status: "invalid" }];
@@ -55567,19 +55778,19 @@ var init_assessmentsRetrieveVersion = __esm(() => {
 });
 
 // src/mcp-server/tools/assessmentsRetrieveVersion.ts
-var args20, tool$assessmentsRetrieveVersion;
+var args21, tool$assessmentsRetrieveVersion;
 var init_assessmentsRetrieveVersion2 = __esm(() => {
   init_assessmentsRetrieveVersion();
   init_getassessmentversionop();
   init_tools();
-  args20 = {
+  args21 = {
     request: GetAssessmentVersionRequest$zodSchema
   };
   tool$assessmentsRetrieveVersion = {
     name: "get_assessment_version",
     description: `Retrieve an exact assessment revision
 
-Retrieve a retained assessment version with its original decision, policy, flow and depth. This response excludes the current account decision. Current retention and response-mode permissions still apply.`,
+Retrieve a retained assessment version with its original decision, policy, flow and depth. This response excludes the current account decision. Current retention and response-mode permissions still apply. detail.identifiers holds the identifiers the assessment was sent, exactly as received.`,
     annotations: {
       title: "Read an exact assessment revision",
       destructiveHint: false,
@@ -55587,7 +55798,7 @@ Retrieve a retained assessment version with its original decision, policy, flow
       openWorldHint: false,
       readOnlyHint: true
     },
-    args: args20,
+    args: args21,
     tool: async (client, args, ctx) => {
       const [result] = await assessmentsRetrieveVersion(client, args.request, { fetchOptions: { signal: ctx.mcpReq.signal } }).$inspect();
       if (!result.ok) {
@@ -55601,22 +55812,11 @@ Retrieve a retained assessment version with its original decision, policy, flow
   };
 });
 
-// src/models/decision.ts
-var Decision$zodSchema;
-var init_decision = __esm(() => {
-  init_zod();
-  Decision$zodSchema = _enum([
-    "allow",
-    "step_up",
-    "review",
-    "block"
-  ]).describe("The decision of the assessment's latest stored revision: block when its stored risk.block is true, otherwise its recommendation. This is not the account's current decision or held-admission state. Combined with recommendation using AND.");
-});
-
 // src/models/assessmentsearchrequest.ts
 var AssessmentSearchRequest$zodSchema;
 var init_assessmentsearchrequest = __esm(() => {
   init_zod();
+  init_answerrevision();
   init_decision();
   init_flow();
   init_recommendation();
@@ -55625,12 +55825,13 @@ var init_assessmentsearchrequest = __esm(() => {
   AssessmentSearchRequest$zodSchema = object({
     account_id: string2().optional().describe("Your own opaque identifier for the account being checked, scoped to your workspace. Use an id you mint, with no direct identifier (email, phone, name or national id) in it. '|' is accepted so an Auth0 user id such as 'auth0|64abc' passes unchanged; '@', '+', '$' and whitespace are refused by the pattern, as is an exact-shape JWT; a hex digest such as a SHA-256 is allowed, because hashing an internal id is a common pseudonymous scheme. A value such as '07700900123' or 'jane.doe.gmail.com' cannot be told apart from an opaque id. It travels in bodies, and in a URL only as the path segment of GET /v1/accounts/{account_id} and its /assessments. An assessment requested by a provider hook at pre_registration, which has no account yet, carries the server-issued account_id pre: followed by its assessment_id."),
     cursor: string2().optional().describe("Opaque, expiring cursor bound to this environment, operation and every filter. Keep the filters unchanged."),
-    decision: Decision$zodSchema.optional().describe("The decision of the assessment's latest stored revision: block when its stored risk.block is true, otherwise its recommendation. This is not the account's current decision or held-admission state. Combined with recommendation using AND."),
+    decision: Decision$zodSchema.optional().describe("An assessment's own decision: block when its stored risk.block is true, otherwise its recommendation. It is not the account's decision or held-admission state."),
     flow: Flow$zodSchema.optional().describe("The event an assessment is made for: account_creation (a user creates an account), login (a user returns to an existing account) or purchase (a payment or a credit grant). The account's risk is reported with the decision for this flow."),
     from: string2(),
     limit: int().default(20),
     recommendation: Recommendation$zodSchema.optional().describe("The recommended action: allow, step_up or review. Your application applies it."),
     response_mode: ResponseMode$zodSchema.optional().describe("standard returns the consolidated risk response; detailed adds merged provider-neutral facts when the key has detailed scope. There is no raw mode."),
+    revision: AnswerRevision$zodSchema.optional().describe("Which answer of each assessment the filters describe: latest, the latest stored revision, or first, the first answer, as served when the assessment was first answered (POST /v1/assessments/aggregate counts first answers). A cell of an aggregate drills down to POST /v1/assessments/search with the same filters, revision first and the cell's bucket as from and to."),
     status: Status$zodSchema.optional().describe("complete: final; nothing is still running. A lane that failed or missed its 10 s deadline stays listed in incomplete_sources, and confidence is lower. partial: a recommendation exists and at least one lane is still running or did not settle (see incomplete_sources). pending: nothing usable before the deadline; no recommendation yet, poll or wait for the webhook."),
     to: string2()
   }).describe("Search retained assessments created in [from,to), over at most 366 days. Filters use each assessment decision, rather than the current account decision. Results can change between pages. Keep the assessment version to retrieve the exact decision later. This read does not require an idempotency key.");
@@ -55638,9 +55839,9 @@ var init_assessmentsearchrequest = __esm(() => {
 
 // src/funcs/assessmentsSearch.ts
 function assessmentsSearch(client$, request, options) {
-  return new APIPromise($do20(client$, request, options));
+  return new APIPromise($do21(client$, request, options));
 }
-async function $do20(client$, request, options) {
+async function $do21(client$, request, options) {
   const parsed$ = safeParse2(request, (value$) => AssessmentSearchRequest$zodSchema.parse(value$), "Input validation failed");
   if (!parsed$.ok) {
     return [parsed$, { status: "invalid" }];
@@ -55717,19 +55918,19 @@ var init_assessmentsSearch = __esm(() => {
 });
 
 // src/mcp-server/tools/assessmentsSearch.ts
-var args21, tool$assessmentsSearch;
+var args22, tool$assessmentsSearch;
 var init_assessmentsSearch2 = __esm(() => {
   init_assessmentsSearch();
   init_assessmentsearchrequest();
   init_tools();
-  args21 = {
+  args22 = {
     request: AssessmentSearchRequest$zodSchema
   };
   tool$assessmentsSearch = {
     name: "search_assessments",
     description: `Search assessments across this environment
 
-Search retained assessments created in [from,to), over at most 366 days. Filters use each assessment decision, rather than the current account decision. Results can change between pages. Keep the assessment version to retrieve the exact decision later. This read does not require an idempotency key.`,
+Search retained assessments created in [from,to), over at most 366 days. Filters use each assessment decision, rather than the current account decision. Results can change between pages. Keep the assessment version to retrieve the exact decision later. Each item's detail.identifiers holds the identifiers its assessment was sent, exactly as received. This read does not require an idempotency key.`,
     annotations: {
       title: "Search assessments in this environment",
       destructiveHint: false,
@@ -55737,7 +55938,7 @@ Search retained assessments created in [from,to), over at most 366 days. Filters
       openWorldHint: false,
       readOnlyHint: true
     },
-    args: args21,
+    args: args22,
     tool: async (client, args, ctx) => {
       const [result] = await assessmentsSearch(client, args.request, { fetchOptions: { signal: ctx.mcpReq.signal } }).$inspect();
       if (!result.ok) {
@@ -55787,9 +55988,9 @@ var init_integrationrequest = __esm(() => {
 
 // src/funcs/integrationsCreate.ts
 function integrationsCreate(client$, request, options) {
-  return new APIPromise($do21(client$, request, options));
+  return new APIPromise($do22(client$, request, options));
 }
-async function $do21(client$, request, options) {
+async function $do22(client$, request, options) {
   const parsed$ = safeParse2(request, (value$) => IntegrationRequest$zodSchema.parse(value$), "Input validation failed");
   if (!parsed$.ok) {
     return [parsed$, { status: "invalid" }];
@@ -55853,12 +56054,12 @@ var init_integrationsCreate = __esm(() => {
 });
 
 // src/mcp-server/tools/integrationsCreate.ts
-var args22, tool$integrationsCreate;
+var args23, tool$integrationsCreate;
 var init_integrationsCreate2 = __esm(() => {
   init_integrationsCreate();
   init_integrationrequest();
   init_tools();
-  args22 = {
+  args23 = {
     request: IntegrationRequest$zodSchema
   };
   tool$integrationsCreate = {
@@ -55873,7 +56074,7 @@ Registers a WorkOS, Auth0 or Supabase integration and returns its hosted endpoin
       openWorldHint: false,
       readOnlyHint: false
     },
-    args: args22,
+    args: args23,
     tool: async (client, args, ctx) => {
       const [result] = await integrationsCreate(client, args.request, { fetchOptions: { signal: ctx.mcpReq.signal } }).$inspect();
       if (!result.ok) {
@@ -55923,9 +56124,9 @@ var init_deleteintegrationop = __esm(() => {
 
 // src/funcs/integrationsDelete.ts
 function integrationsDelete(client$, request, options) {
-  return new APIPromise($do22(client$, request, options));
+  return new APIPromise($do23(client$, request, options));
 }
-async function $do22(client$, request, options) {
+async function $do23(client$, request, options) {
   const parsed$ = safeParse2(request, (value$) => DeleteIntegrationRequest$zodSchema.parse(value$), "Input validation failed");
   if (!parsed$.ok) {
     return [parsed$, { status: "invalid" }];
@@ -56007,12 +56208,12 @@ var init_integrationsDelete = __esm(() => {
 });
 
 // src/mcp-server/tools/integrationsDelete.ts
-var args23, tool$integrationsDelete;
+var args24, tool$integrationsDelete;
 var init_integrationsDelete2 = __esm(() => {
   init_integrationsDelete();
   init_deleteintegrationop();
   init_tools();
-  args23 = {
+  args24 = {
     request: DeleteIntegrationRequest$zodSchema
   };
   tool$integrationsDelete = {
@@ -56027,7 +56228,7 @@ Removes the integration and its secrets; its endpoint answers 404 from then on,
       openWorldHint: false,
       readOnlyHint: false
     },
-    args: args23,
+    args: args24,
     tool: async (client, args, ctx) => {
       const [result] = await integrationsDelete(client, args.request, { fetchOptions: { signal: ctx.mcpReq.signal } }).$inspect();
       if (!result.ok) {
@@ -56043,9 +56244,9 @@ Removes the integration and its secrets; its endpoint answers 404 from then on,
 
 // src/funcs/integrationsList.ts
 function integrationsList(client$, options) {
-  return new APIPromise($do23(client$, options));
+  return new APIPromise($do24(client$, options));
 }
-async function $do23(client$, options) {
+async function $do24(client$, options) {
   const path$ = pathToFunc("/v1/integrations")();
   const headers$ = new Headers(compactMap({
     Accept: options?.acceptHeaderOverride || "application/json;q=1, application/problem+json;q=0"
@@ -56208,9 +56409,9 @@ var init_rotateintegrationsecretop = __esm(() => {
 
 // src/funcs/integrationsRotate.ts
 function integrationsRotate(client$, request, options) {
-  return new APIPromise($do24(client$, request, options));
+  return new APIPromise($do25(client$, request, options));
 }
-async function $do24(client$, request, options) {
+async function $do25(client$, request, options) {
   const parsed$ = safeParse2(request, (value$) => RotateIntegrationSecretRequest$zodSchema.parse(value$), "Input validation failed");
   if (!parsed$.ok) {
     return [parsed$, { status: "invalid" }];
@@ -56280,12 +56481,12 @@ var init_integrationsRotate = __esm(() => {
 });
 
 // src/mcp-server/tools/integrationsRotate.ts
-var args24, tool$integrationsRotate;
+var args25, tool$integrationsRotate;
 var init_integrationsRotate2 = __esm(() => {
   init_integrationsRotate();
   init_rotateintegrationsecretop();
   init_tools();
-  args24 = {
+  args25 = {
     request: RotateIntegrationSecretRequest$zodSchema
   };
   tool$integrationsRotate = {
@@ -56300,7 +56501,7 @@ For Auth0, send {} and the answer's secret is the new shared secret, shown once.
       openWorldHint: false,
       readOnlyHint: false
     },
-    args: args24,
+    args: args25,
     tool: async (client, args, ctx) => {
       const [result] = await integrationsRotate(client, args.request, { fetchOptions: { signal: ctx.mcpReq.signal } }).$inspect();
       if (!result.ok) {
@@ -56415,9 +56616,9 @@ var init_listkeysop = __esm(() => {
 
 // src/funcs/keysList.ts
 function keysList(client$, request, options) {
-  return new APIPromise($do25(client$, request, options));
+  return new APIPromise($do26(client$, request, options));
 }
-async function $do25(client$, request, options) {
+async function $do26(client$, request, options) {
   const parsed$ = safeParse2(request, (value$) => ListKeysRequest$zodSchema.parse(value$), "Input validation failed");
   if (!parsed$.ok) {
     return [parsed$, { status: "invalid" }];
@@ -56499,12 +56700,12 @@ var init_keysList = __esm(() => {
 });
 
 // src/mcp-server/tools/keysList.ts
-var args25, tool$keysList;
+var args26, tool$keysList;
 var init_keysList2 = __esm(() => {
   init_keysList();
   init_listkeysop();
   init_tools();
-  args25 = {
+  args26 = {
     request: ListKeysRequest$zodSchema
   };
   tool$keysList = {
@@ -56519,7 +56720,7 @@ Lists the keys of the signing key's environment, newest first, at most 200, revo
       openWorldHint: false,
       readOnlyHint: true
     },
-    args: args25,
+    args: args26,
     tool: async (client, args, ctx) => {
       const [result] = await keysList(client, args.request, { fetchOptions: { signal: ctx.mcpReq.signal } }).$inspect();
       if (!result.ok) {
@@ -56573,9 +56774,9 @@ var init_revokekeyop = __esm(() => {
 
 // src/funcs/keysRevoke.ts
 function keysRevoke(client$, request, options) {
-  return new APIPromise($do26(client$, request, options));
+  return new APIPromise($do27(client$, request, options));
 }
-async function $do26(client$, request, options) {
+async function $do27(client$, request, options) {
   const parsed$ = safeParse2(request, (value$) => RevokeKeyRequest$zodSchema.parse(value$), "Input validation failed");
   if (!parsed$.ok) {
     return [parsed$, { status: "invalid" }];
@@ -56661,12 +56862,12 @@ var init_keysRevoke = __esm(() => {
 });
 
 // src/mcp-server/tools/keysRevoke.ts
-var args26, tool$keysRevoke;
+var args27, tool$keysRevoke;
 var init_keysRevoke2 = __esm(() => {
   init_keysRevoke();
   init_revokekeyop();
   init_tools();
-  args26 = {
+  args27 = {
     request: RevokeKeyRequest$zodSchema
   };
   tool$keysRevoke = {
@@ -56681,7 +56882,7 @@ Revokes a key of the signing key's environment at once: its next request answers
       openWorldHint: false,
       readOnlyHint: false
     },
-    args: args26,
+    args: args27,
     tool: async (client, args, ctx) => {
       const [result] = await keysRevoke(client, args.request, { fetchOptions: { signal: ctx.mcpReq.signal } }).$inspect();
       if (!result.ok) {
@@ -56792,9 +56993,9 @@ var init_createlistentryop = __esm(() => {
 
 // src/funcs/listsCreate.ts
 function listsCreate(client$, request, options) {
-  return new APIPromise($do27(client$, request, options));
+  return new APIPromise($do28(client$, request, options));
 }
-async function $do27(client$, request, options) {
+async function $do28(client$, request, options) {
   const parsed$ = safeParse2(request, (value$) => CreateListEntryRequest$zodSchema.parse(value$), "Input validation failed");
   if (!parsed$.ok) {
     return [parsed$, { status: "invalid" }];
@@ -56881,12 +57082,12 @@ var init_listsCreate = __esm(() => {
 });
 
 // src/mcp-server/tools/listsCreate.ts
-var args27, tool$listsCreate;
+var args28, tool$listsCreate;
 var init_listsCreate2 = __esm(() => {
   init_listsCreate();
   init_createlistentryop();
   init_tools();
-  args27 = {
+  args28 = {
     request: CreateListEntryRequest$zodSchema
   };
   tool$listsCreate = {
@@ -56901,7 +57102,7 @@ Adds an exact email (kind email) or an email domain (kind email_domain) to the s
       openWorldHint: false,
       readOnlyHint: false
     },
-    args: args27,
+    args: args28,
     tool: async (client, args, ctx) => {
       const [result] = await listsCreate(client, args.request, { fetchOptions: { signal: ctx.mcpReq.signal } }).$inspect();
       if (!result.ok) {
@@ -56954,9 +57155,9 @@ var init_deletelistentryop = __esm(() => {
 
 // src/funcs/listsDelete.ts
 function listsDelete(client$, request, options) {
-  return new APIPromise($do28(client$, request, options));
+  return new APIPromise($do29(client$, request, options));
 }
-async function $do28(client$, request, options) {
+async function $do29(client$, request, options) {
   const parsed$ = safeParse2(request, (value$) => DeleteListEntryRequest$zodSchema.parse(value$), "Input validation failed");
   if (!parsed$.ok) {
     return [parsed$, { status: "invalid" }];
@@ -57046,12 +57247,12 @@ var init_listsDelete = __esm(() => {
 });
 
 // src/mcp-server/tools/listsDelete.ts
-var args28, tool$listsDelete;
+var args29, tool$listsDelete;
 var init_listsDelete2 = __esm(() => {
   init_listsDelete();
   init_deletelistentryop();
   init_tools();
-  args28 = {
+  args29 = {
     request: DeleteListEntryRequest$zodSchema
   };
   tool$listsDelete = {
@@ -57066,7 +57267,7 @@ Removes an entry from the signing key's environment's list and re-decides the ac
       openWorldHint: false,
       readOnlyHint: false
     },
-    args: args28,
+    args: args29,
     tool: async (client, args, ctx) => {
       const [result] = await listsDelete(client, args.request, { fetchOptions: { signal: ctx.mcpReq.signal } }).$inspect();
       if (!result.ok) {
@@ -57131,9 +57332,9 @@ var init_listlistentriesop = __esm(() => {
 
 // src/funcs/listsList.ts
 function listsList(client$, request, options) {
-  return new APIPromise($do29(client$, request, options));
+  return new APIPromise($do30(client$, request, options));
 }
-async function $do29(client$, request, options) {
+async function $do30(client$, request, options) {
   const parsed$ = safeParse2(request, (value$) => ListListEntriesRequest$zodSchema.parse(value$), "Input validation failed");
   if (!parsed$.ok) {
     return [parsed$, { status: "invalid" }];
@@ -57219,12 +57420,12 @@ var init_listsList = __esm(() => {
 });
 
 // src/mcp-server/tools/listsList.ts
-var args29, tool$listsList;
+var args30, tool$listsList;
 var init_listsList2 = __esm(() => {
   init_listsList();
   init_listlistentriesop();
   init_tools();
-  args29 = {
+  args30 = {
     request: ListListEntriesRequest$zodSchema
   };
   tool$listsList = {
@@ -57239,7 +57440,7 @@ Lists every entry of the signing key's environment's list, newest first: each an
       openWorldHint: false,
       readOnlyHint: true
     },
-    args: args29,
+    args: args30,
     tool: async (client, args, ctx) => {
       const [result] = await listsList(client, args.request, { fetchOptions: { signal: ctx.mcpReq.signal } }).$inspect();
       if (!result.ok) {
@@ -57309,9 +57510,9 @@ var init_listrequestdiagnosticsop = __esm(() => {
 
 // src/funcs/requestsList.ts
 function requestsList(client$, request, options) {
-  return new APIPromise($do30(client$, request, options));
+  return new APIPromise($do31(client$, request, options));
 }
-async function $do30(client$, request, options) {
+async function $do31(client$, request, options) {
   const parsed$ = safeParse2(request, (value$) => ListRequestDiagnosticsRequest$zodSchema.parse(value$), "Input validation failed");
   if (!parsed$.ok) {
     return [parsed$, { status: "invalid" }];
@@ -57397,12 +57598,12 @@ var init_requestsList = __esm(() => {
 });
 
 // src/mcp-server/tools/requestsList.ts
-var args30, tool$requestsList;
+var args31, tool$requestsList;
 var init_requestsList2 = __esm(() => {
   init_requestsList();
   init_listrequestdiagnosticsop();
   init_tools();
-  args30 = {
+  args31 = {
     request: ListRequestDiagnosticsRequest$zodSchema
   };
   tool$requestsList = {
@@ -57417,7 +57618,7 @@ Search authenticated request attempts by time, route, status or request correlat
       openWorldHint: false,
       readOnlyHint: true
     },
-    args: args30,
+    args: args31,
     tool: async (client, args, ctx) => {
       const [result] = await requestsList(client, args.request, { fetchOptions: { signal: ctx.mcpReq.signal } }).$inspect();
       if (!result.ok) {
@@ -57567,9 +57768,9 @@ var init_getsettingsop = __esm(() => {
 
 // src/funcs/settingsGet.ts
 function settingsGet(client$, request, options) {
-  return new APIPromise($do31(client$, request, options));
+  return new APIPromise($do32(client$, request, options));
 }
-async function $do31(client$, request, options) {
+async function $do32(client$, request, options) {
   const parsed$ = safeParse2(request, (value$) => GetSettingsRequest$zodSchema.parse(value$), "Input validation failed");
   if (!parsed$.ok) {
     return [parsed$, { status: "invalid" }];
@@ -57655,12 +57856,12 @@ var init_settingsGet = __esm(() => {
 });
 
 // src/mcp-server/tools/settingsGet.ts
-var args31, tool$settingsGet;
+var args32, tool$settingsGet;
 var init_settingsGet2 = __esm(() => {
   init_settingsGet();
   init_getsettingsop();
   init_tools();
-  args31 = {
+  args32 = {
     request: GetSettingsRequest$zodSchema
   };
   tool$settingsGet = {
@@ -57675,7 +57876,7 @@ Reads the settings of the signing key's environment: retention in days; per flow
       openWorldHint: false,
       readOnlyHint: true
     },
-    args: args31,
+    args: args32,
     tool: async (client, args, ctx) => {
       const [result] = await settingsGet(client, args.request, { fetchOptions: { signal: ctx.mcpReq.signal } }).$inspect();
       if (!result.ok) {
@@ -57778,9 +57979,9 @@ var init_updatesettingsop = __esm(() => {
 
 // src/funcs/settingsUpdate.ts
 function settingsUpdate(client$, request, options) {
-  return new APIPromise($do32(client$, request, options));
+  return new APIPromise($do33(client$, request, options));
 }
-async function $do32(client$, request, options) {
+async function $do33(client$, request, options) {
   const parsed$ = safeParse2(request, (value$) => UpdateSettingsRequest$zodSchema.parse(value$), "Input validation failed");
   if (!parsed$.ok) {
     return [parsed$, { status: "invalid" }];
@@ -57867,12 +58068,12 @@ var init_settingsUpdate = __esm(() => {
 });
 
 // src/mcp-server/tools/settingsUpdate.ts
-var args32, tool$settingsUpdate;
+var args33, tool$settingsUpdate;
 var init_settingsUpdate2 = __esm(() => {
   init_settingsUpdate();
   init_updatesettingsop();
   init_tools();
-  args32 = {
+  args33 = {
     request: UpdateSettingsRequest$zodSchema
   };
   tool$settingsUpdate = {
@@ -57887,7 +58088,7 @@ Changes only what the body names, in one transaction: retention_days, refused_so
       openWorldHint: false,
       readOnlyHint: false
     },
-    args: args32,
+    args: args33,
     tool: async (client, args, ctx) => {
       const [result] = await settingsUpdate(client, args.request, { fetchOptions: { signal: ctx.mcpReq.signal } }).$inspect();
       if (!result.ok) {
@@ -57914,9 +58115,9 @@ var init_webhookendpointrequest = __esm(() => {
 
 // src/funcs/webhookEndpointsCreate.ts
 function webhookEndpointsCreate(client$, request, options) {
-  return new APIPromise($do33(client$, request, options));
+  return new APIPromise($do34(client$, request, options));
 }
-async function $do33(client$, request, options) {
+async function $do34(client$, request, options) {
   const parsed$ = safeParse2(request, (value$) => WebhookEndpointRequest$zodSchema.parse(value$), "Input validation failed");
   if (!parsed$.ok) {
     return [parsed$, { status: "invalid" }];
@@ -57980,12 +58181,12 @@ var init_webhookEndpointsCreate = __esm(() => {
 });
 
 // src/mcp-server/tools/webhookEndpointsCreate.ts
-var args33, tool$webhookEndpointsCreate;
+var args34, tool$webhookEndpointsCreate;
 var init_webhookEndpointsCreate2 = __esm(() => {
   init_webhookEndpointsCreate();
   init_webhookendpointrequest();
   init_tools();
-  args33 = {
+  args34 = {
     request: WebhookEndpointRequest$zodSchema
   };
   tool$webhookEndpointsCreate = {
@@ -58000,7 +58201,7 @@ Registers a webhook endpoint and returns it with its first signing secret, shown
       openWorldHint: false,
       readOnlyHint: false
     },
-    args: args33,
+    args: args34,
     tool: async (client, args, ctx) => {
       const [result] = await webhookEndpointsCreate(client, args.request, { fetchOptions: { signal: ctx.mcpReq.signal } }).$inspect();
       if (!result.ok) {
@@ -58050,9 +58251,9 @@ var init_deletewebhookendpointop = __esm(() => {
 
 // src/funcs/webhookEndpointsDelete.ts
 function webhookEndpointsDelete(client$, request, options) {
-  return new APIPromise($do34(client$, request, options));
+  return new APIPromise($do35(client$, request, options));
 }
-async function $do34(client$, request, options) {
+async function $do35(client$, request, options) {
   const parsed$ = safeParse2(request, (value$) => DeleteWebhookEndpointRequest$zodSchema.parse(value$), "Input validation failed");
   if (!parsed$.ok) {
     return [parsed$, { status: "invalid" }];
@@ -58134,12 +58335,12 @@ var init_webhookEndpointsDelete = __esm(() => {
 });
 
 // src/mcp-server/tools/webhookEndpointsDelete.ts
-var args34, tool$webhookEndpointsDelete;
+var args35, tool$webhookEndpointsDelete;
 var init_webhookEndpointsDelete2 = __esm(() => {
   init_webhookEndpointsDelete();
   init_deletewebhookendpointop();
   init_tools();
-  args34 = {
+  args35 = {
     request: DeleteWebhookEndpointRequest$zodSchema
   };
   tool$webhookEndpointsDelete = {
@@ -58154,7 +58355,7 @@ Deletes the endpoint and its signing keys. Deliveries still queued for it are dr
       openWorldHint: false,
       readOnlyHint: false
     },
-    args: args34,
+    args: args35,
     tool: async (client, args, ctx) => {
       const [result] = await webhookEndpointsDelete(client, args.request, { fetchOptions: { signal: ctx.mcpReq.signal } }).$inspect();
       if (!result.ok) {
@@ -58170,9 +58371,9 @@ Deletes the endpoint and its signing keys. Deliveries still queued for it are dr
 
 // src/funcs/webhookEndpointsList.ts
 function webhookEndpointsList(client$, options) {
-  return new APIPromise($do35(client$, options));
+  return new APIPromise($do36(client$, options));
 }
-async function $do35(client$, options) {
+async function $do36(client$, options) {
   const path$ = pathToFunc("/v1/webhooks")();
   const headers$ = new Headers(compactMap({
     Accept: options?.acceptHeaderOverride || "application/json;q=1, application/problem+json;q=0"
@@ -58364,9 +58565,9 @@ var init_listwebhookdeliveriesop = __esm(() => {
 
 // src/funcs/webhookEndpointsListDeliveries.ts
 function webhookEndpointsListDeliveries(client$, request, options) {
-  return new APIPromise($do36(client$, request, options));
+  return new APIPromise($do37(client$, request, options));
 }
-async function $do36(client$, request, options) {
+async function $do37(client$, request, options) {
   const parsed$ = safeParse2(request, (value$) => ListWebhookDeliveriesRequest$zodSchema.parse(value$), "Input validation failed");
   if (!parsed$.ok) {
     return [parsed$, { status: "invalid" }];
@@ -58453,12 +58654,12 @@ var init_webhookEndpointsListDeliveries = __esm(() => {
 });
 
 // src/mcp-server/tools/webhookEndpointsListDeliveries.ts
-var args35, tool$webhookEndpointsListDeliveries;
+var args36, tool$webhookEndpointsListDeliveries;
 var init_webhookEndpointsListDeliveries2 = __esm(() => {
   init_webhookEndpointsListDeliveries();
   init_listwebhookdeliveriesop();
   init_tools();
-  args35 = {
+  args36 = {
     request: ListWebhookDeliveriesRequest$zodSchema
   };
   tool$webhookEndpointsListDeliveries = {
@@ -58473,7 +58674,7 @@ Every POST the endpoint received, newest first: the event id and type, which att
       openWorldHint: false,
       readOnlyHint: true
     },
-    args: args35,
+    args: args36,
     tool: async (client, args, ctx) => {
       const [result] = await webhookEndpointsListDeliveries(client, args.request, { fetchOptions: { signal: ctx.mcpReq.signal } }).$inspect();
       if (!result.ok) {
@@ -58547,9 +58748,9 @@ var init_replaywebhookdeliveryop = __esm(() => {
 
 // src/funcs/webhookEndpointsReplayDelivery.ts
 function webhookEndpointsReplayDelivery(client$, request, options) {
-  return new APIPromise($do37(client$, request, options));
+  return new APIPromise($do38(client$, request, options));
 }
-async function $do37(client$, request, options) {
+async function $do38(client$, request, options) {
   const parsed$ = safeParse2(request, (value$) => ReplayWebhookDeliveryRequest$zodSchema.parse(value$), "Input validation failed");
   if (!parsed$.ok) {
     return [parsed$, { status: "invalid" }];
@@ -58623,12 +58824,12 @@ var init_webhookEndpointsReplayDelivery = __esm(() => {
 });
 
 // src/mcp-server/tools/webhookEndpointsReplayDelivery.ts
-var args36, tool$webhookEndpointsReplayDelivery;
+var args37, tool$webhookEndpointsReplayDelivery;
 var init_webhookEndpointsReplayDelivery2 = __esm(() => {
   init_webhookEndpointsReplayDelivery();
   init_replaywebhookdeliveryop();
   init_tools();
-  args36 = {
+  args37 = {
     request: ReplayWebhookDeliveryRequest$zodSchema
   };
   tool$webhookEndpointsReplayDelivery = {
@@ -58643,7 +58844,7 @@ Queues the event for the endpoint again: the same event id and body it received,
       openWorldHint: false,
       readOnlyHint: false
     },
-    args: args36,
+    args: args37,
     tool: async (client, args, ctx) => {
       const [result] = await webhookEndpointsReplayDelivery(client, args.request, { fetchOptions: { signal: ctx.mcpReq.signal } }).$inspect();
       if (!result.ok) {
@@ -58729,9 +58930,9 @@ var init_rotatewebhooksigningkeyop = __esm(() => {
 
 // src/funcs/webhookEndpointsRotateSigningKey.ts
 function webhookEndpointsRotateSigningKey(client$, request, options) {
-  return new APIPromise($do38(client$, request, options));
+  return new APIPromise($do39(client$, request, options));
 }
-async function $do38(client$, request, options) {
+async function $do39(client$, request, options) {
   const parsed$ = safeParse2(request, (value$) => RotateWebhookSigningKeyRequest$zodSchema.parse(value$), "Input validation failed");
   if (!parsed$.ok) {
     return [parsed$, { status: "invalid" }];
@@ -58801,12 +59002,12 @@ var init_webhookEndpointsRotateSigningKey = __esm(() => {
 });
 
 // src/mcp-server/tools/webhookEndpointsRotateSigningKey.ts
-var args37, tool$webhookEndpointsRotateSigningKey;
+var args38, tool$webhookEndpointsRotateSigningKey;
 var init_webhookEndpointsRotateSigningKey2 = __esm(() => {
   init_webhookEndpointsRotateSigningKey();
   init_rotatewebhooksigningkeyop();
   init_tools();
-  args37 = {
+  args38 = {
     request: RotateWebhookSigningKeyRequest$zodSchema
   };
   tool$webhookEndpointsRotateSigningKey = {
@@ -58821,7 +59022,7 @@ Issues a new signing key for the endpoint and returns its secret once. Every del
       openWorldHint: false,
       readOnlyHint: false
     },
-    args: args37,
+    args: args38,
     tool: async (client, args, ctx) => {
       const [result] = await webhookEndpointsRotateSigningKey(client, args.request, { fetchOptions: { signal: ctx.mcpReq.signal } }).$inspect();
       if (!result.ok) {
@@ -58922,9 +59123,9 @@ var init_sendwebhooktesteventop = __esm(() => {
 
 // src/funcs/webhookEndpointsSendTestEvent.ts
 function webhookEndpointsSendTestEvent(client$, request, options) {
-  return new APIPromise($do39(client$, request, options));
+  return new APIPromise($do40(client$, request, options));
 }
-async function $do39(client$, request, options) {
+async function $do40(client$, request, options) {
   const parsed$ = safeParse2(request, (value$) => SendWebhookTestEventRequest$zodSchema.parse(value$), "Input validation failed");
   if (!parsed$.ok) {
     return [parsed$, { status: "invalid" }];
@@ -58994,12 +59195,12 @@ var init_webhookEndpointsSendTestEvent = __esm(() => {
 });
 
 // src/mcp-server/tools/webhookEndpointsSendTestEvent.ts
-var args38, tool$webhookEndpointsSendTestEvent;
+var args39, tool$webhookEndpointsSendTestEvent;
 var init_webhookEndpointsSendTestEvent2 = __esm(() => {
   init_webhookEndpointsSendTestEvent();
   init_sendwebhooktesteventop();
   init_tools();
-  args38 = {
+  args39 = {
     request: SendWebhookTestEventRequest$zodSchema
   };
   tool$webhookEndpointsSendTestEvent = {
@@ -59014,7 +59215,7 @@ endpoint.verification sends a signed challenge now and answers whether the endpo
       openWorldHint: false,
       readOnlyHint: false
     },
-    args: args38,
+    args: args39,
     tool: async (client, args, ctx) => {
       const [result] = await webhookEndpointsSendTestEvent(client, args.request, { fetchOptions: { signal: ctx.mcpReq.signal } }).$inspect();
       if (!result.ok) {
@@ -59032,7 +59233,7 @@ endpoint.verification sends a signed challenge now and answers whether the endpo
 function createMCPServer(deps) {
   const server = new McpServer({
     name: "NoResponse",
-    version: "0.6.12"
+    version: "0.6.14"
   });
   const getClient = deps.getSDK || (() => new NoResponseCore({
     security: deps.security,
@@ -59056,6 +59257,7 @@ function createMCPServer(deps) {
   tool(tool$assessmentsDelete);
   tool(tool$assessmentsRecordOutcome);
   tool(tool$assessmentsQuery);
+  tool(tool$assessmentsAggregate);
   tool(tool$assessmentsSearch);
   tool(tool$assessmentsRetrieveVersion);
   tool(tool$assessmentsBindAccount);
@@ -59115,6 +59317,7 @@ var init_server = __esm(() => {
   init_accountsRecordOutcome2();
   init_accountsRetireCredential2();
   init_accountsRetrieveDecision2();
+  init_assessmentsAggregate2();
   init_assessmentsBindAccount2();
   init_assessmentsCreate2();
   init_assessmentsDelete2();
@@ -59152,13 +59355,13 @@ var init_tool_names = __esm(() => {
       name: "create_assessment",
       description: `Assess identifiers for a signup or gateway decision.
 
-Assesses one account creation, login or purchase (flow) and answers with the account's one current risk: account.risk.decision is the decision for this flow (allow, step_up, review or block, where block means your block threshold was reached), and detail holds this assessment's own facts. depth sets how long the answer waits for sources: quick waits only for the fast ones (500 ms), full for the whole budget (3000 ms at most); it defaults to full for account_creation and purchase and quick for login. 200 carries complete or partial, 202 carries pending with Location and Retry-After. While the account's first assessment is pending, account is absent: apply your own fallback for that, 429, 503 or a timeout. NoResponse blocks nothing itself; you decide. Requires the assess scope. Idempotency-Key is optional in the SDK and is bound to the body for 24 hours: the same key with the same body replays the latest assessment with Idempotent-Replayed: true and starts no new work; the same key with a different body answers 409 idempotency_key_reused. response_mode defaults to standard; detailed needs the detailed scope.`
+Assesses one account creation, login or purchase (flow) and answers with the account's one current risk: account.risk.decision is the decision for this flow (allow, step_up, review or block, where block means your block threshold was reached), and detail holds this assessment's own facts. depth sets how long the answer waits for sources: quick waits only for the fast ones (500 ms), full for the whole budget (3000 ms at most); it defaults to full for account_creation and purchase and quick for login. 200 carries complete or partial, 202 carries pending with Location and Retry-After. While the account's first assessment is pending, account is absent: apply your own fallback for that, 429, 503 or a timeout. NoResponse blocks nothing itself; you decide. Requires the assess scope. Idempotency-Key is optional in the SDK and is bound to the body for 24 hours: the same key with the same body replays the latest assessment with Idempotent-Replayed: true and starts no new work; the same key with a different body answers 409 idempotency_key_reused. response_mode defaults to standard; detailed needs the detailed scope. The answer leaves out detail.identifiers: you hold what you sent, and a key with the history scope gets them back with GET.`
     },
     {
       name: "get_assessment",
       description: `Poll the authoritative assessment of one assessment.
 
-Returns the highest assessment_version, with the account's current risk. Requires the assess or history scope. While status is pending, or partial with a source still running, the response carries Retry-After; poll no faster than it says. Another workspace's assessment, an unknown or expired assessment and a malformed assessment_id all answer 404 not_found. response_mode=detailed needs the detailed scope.`
+Returns the highest assessment_version, with the account's current risk. Requires the assess or history scope. While status is pending, or partial with a source still running, the response carries Retry-After; poll no faster than it says. Another workspace's assessment, an unknown or expired assessment and a malformed assessment_id all answer 404 not_found. response_mode=detailed needs the detailed scope. A key with the history scope also gets detail.identifiers, the identifiers the assessment was sent, exactly as received.`
     },
     {
       name: "delete_assessment",
@@ -59176,19 +59379,25 @@ Records what you later learned about an assessed account: confirmed_abuse, accou
       name: "query_assessments",
       description: `Page through one account's unexpired assessments.
 
-History is a POST with account_id in the body so an account identifier stays out of URLs and access logs. Requires the history scope. Read-only and safe to retry. Newest first, each at its latest assessment_version. An account with no assessments answers 200 with empty items. The cursor is opaque and bound to your workspace and the account; a tampered or expired cursor answers 400 invalid_cursor. response_mode=detailed needs the detailed scope.`
+History is a POST with account_id in the body so an account identifier stays out of URLs and access logs. Requires the history scope. Read-only and safe to retry. Newest first, each at its latest assessment_version. An account with no assessments answers 200 with empty items. The cursor is opaque and bound to your workspace and the account; a tampered or expired cursor answers 400 invalid_cursor. response_mode=detailed needs the detailed scope. Each item's identifiers holds the identifiers its assessment was sent, exactly as received.`
+    },
+    {
+      name: "aggregate_assessments",
+      description: `Count assessments by time, decision and reason
+
+Count this environment's assessments created in [from,to) by hour, day or week, grouped by up to two of decision, flow, recommendation, band, reason, lane, country, asn and list_match. Each assessment counts once, by its first answer; late results do not count it again and appear in late_flips. Optional metrics add a score histogram per flow and late account decision changes. from and to start a bucket and cover at most 366 days (31 for hour buckets) inside the retention period. The filters are search's and describe the first answer: send them to search with revision first to list a cell's assessments. Counts hold no identifier, stay when an assessment or account is deleted, and report reasons by code and impact band. No Idempotency-Key.`
     },
     {
       name: "search_assessments",
       description: `Search assessments across this environment
 
-Search retained assessments created in [from,to), over at most 366 days. Filters use each assessment decision, rather than the current account decision. Results can change between pages. Keep the assessment version to retrieve the exact decision later. This read does not require an idempotency key.`
+Search retained assessments created in [from,to), over at most 366 days. Filters use each assessment decision, rather than the current account decision. Results can change between pages. Keep the assessment version to retrieve the exact decision later. Each item's detail.identifiers holds the identifiers its assessment was sent, exactly as received. This read does not require an idempotency key.`
     },
     {
       name: "get_assessment_version",
       description: `Retrieve an exact assessment revision
 
-Retrieve a retained assessment version with its original decision, policy, flow and depth. This response excludes the current account decision. Current retention and response-mode permissions still apply.`
+Retrieve a retained assessment version with its original decision, policy, flow and depth. This response excludes the current account decision. Current retention and response-mode permissions still apply. detail.identifiers holds the identifiers the assessment was sent, exactly as received.`
     },
     {
       name: "bind_provisional_account",
@@ -59218,7 +59427,7 @@ Erases the account in the environment of your key, for an erasure request from y
       name: "list_account_assessments",
       description: `Page through one account's unexpired assessments.
 
-The account's history: the same page as POST /v1/assessments/query for this account_id, newest first, each at its latest assessment_version. Requires the history scope. Read-only and safe to retry. An account with no assessments answers 200 with empty items. The cursor is opaque and bound to your workspace and the account; a tampered or expired cursor answers 400 invalid_cursor. response_mode=detailed needs the detailed scope. The account_id travels in the URL; use POST /v1/assessments/query to keep it out of access logs.`
+The account's history: the same page as POST /v1/assessments/query for this account_id, newest first, each at its latest assessment_version. Requires the history scope. Read-only and safe to retry. An account with no assessments answers 200 with empty items. The cursor is opaque and bound to your workspace and the account; a tampered or expired cursor answers 400 invalid_cursor. response_mode=detailed needs the detailed scope. Each item's identifiers holds the identifiers its assessment was sent, exactly as received. The account_id travels in the URL; use POST /v1/assessments/query to keep it out of access logs.`
     },
     {
       name: "record_enforcement",
@@ -59266,7 +59475,7 @@ Mark this association retired, idempotently. This does not revoke the actual key
       name: "export_account",
       description: `Export an account
 
-Retrieve one consistent snapshot of retained customer-accessible records, including assessment revisions, account decisions, feedback, key associations, enforcements and request diagnostics. Secrets, restricted source information, other customers' data and legacy free-text notes are excluded. The same standard/detailed permissions apply. An export exceeding 10000 records or 8 MiB returns export_too_large without a partial result. Historical decisions that were not captured are identified as an exclusion.`
+Retrieve one consistent snapshot of retained customer-accessible records, including assessment revisions, account decisions, feedback, key associations, enforcements and request diagnostics. Each assessment revision's detail.identifiers holds the identifiers that assessment was sent, exactly as received. Secrets, restricted source information, other customers' data and legacy free-text notes are excluded. The same standard/detailed permissions apply. An export exceeding 10000 records or 8 MiB returns export_too_large without a partial result. Historical decisions that were not captured are identified as an exclusion.`
     },
     {
       name: "list_keys",
@@ -67881,7 +68090,7 @@ var routes = buildRouteMap({
 var app = buildApplication(routes, {
   name: "mcp",
   versionInfo: {
-    currentVersion: "0.6.12"
+    currentVersion: "0.6.14"
   }
 });
 run(app, process3.argv.slice(2), buildContext(process3));
@@ -67889,5 +68098,5 @@ export {
   app
 };
 
-//# debugId=01809CD030BCB09364756E2164756E21
+//# debugId=FF0E38F80AA6CB4764756E2164756E21
 //# sourceMappingURL=mcp-server.js.map