@lerianstudio/matcher-mcp 1.5.0-beta.2 → 1.5.0-beta.4

package/dist/server.js

@@ -113,7 +113,7 @@ function registerTools(server) {
     registerListOperationsTool(server, index);
     registerDescribeOperationTool(server, index);
     // Generic invoke (task 1.2.3): assembles + validates + dispatches any of the
-    // 168 operations with the caller's relayed token (fail-closed). Shares the
+    // 174 operations with the caller's relayed token (fail-closed). Shares the
     // RFC 9457 → tool-error mapping (toToolError) with the curated surface.
     registerInvokeTool(server, index);
     // Curated fee-schedule vertical (task 1.3.2): six typed tools (create/list/

package/dist/spec/curated-operations.js

@@ -2,10 +2,10 @@
 // covers — the registry the drift guard checks against.
 //
 // WHY THIS EXISTS
-// The server exposes two surfaces over the 168-operation matcher spec:
+// The server exposes two surfaces over the 174-operation matcher spec:
 //   1. The GENERIC trio (matcher_list_operations / describe / invoke) reads the
 //      spec at runtime, so it tracks the spec automatically. `load.test.ts`
-//      already pins `index.operations.size === 168` as that side's canary.
+//      already pins `index.operations.size === 174` as that side's canary.
 //   2. The CURATED tools (the ~72 hand-written Zod tools under `src/tools/*/`)
 //      hard-code their own method+path. NOTHING in those tools consults the
 //      spec, and their unit tests assert against the same hard-coded literal —
@@ -153,5 +153,21 @@ export const GENERIC_ONLY_OPERATION_IDS = [
     // discovery hub (generic-only) — inbound streaming-hub event receiver; signed,
     // hub-driven delivery, not an operator-initiated action (cf. above).
     'receiveHubEvent', // POST /v1/discovery/hub/events
+    // self-service onboarding (generic-only) — PUBLIC, anonymous, PRE-TENANT
+    // routes for the console signup flow. The MCP relay authenticates every call
+    // with an already-provisioned tenant token, so "create me a workspace" is not
+    // an operator action on this surface (cf. the webhook receivers above).
+    'signup', // POST /v1/signup
+    'signup-verify', // POST /v1/signup/verify
+    // PUBLIC pre-login PKCE bootstrap for the console (client id + issuer per
+    // workspace slug); browser-facing discovery, not an operator action.
+    'workspace-auth-config', // GET /v1/workspaces/{slug}/auth-config
+    // standalone-SaaS Phase 2 control-plane (generic-only) — tenant billing read
+    // plus backoffice workspace-lifecycle admin. Straightforward body-less ops
+    // nobody has hand-curated a Zod tool for; billing read is tenant-scoped, the
+    // admin pair is an internal backoffice surface, not an operator action.
+    'workspace-billing', // GET /v1/workspace/billing
+    'admin-suspend-workspace', // PUT /v1/admin/workspaces/{slug}/suspend
+    'admin-reactivate-workspace', // PUT /v1/admin/workspaces/{slug}/reactivate
 ];
 //# sourceMappingURL=curated-operations.js.map

package/dist/spec/curated-operations.js.map

@@ -1 +1 @@
-{"version":3,"file":"curated-operations.js","sourceRoot":"","sources":["../../src/spec/curated-operations.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAChF,wDAAwD;AACxD,EAAE;AACF,kBAAkB;AAClB,uEAAuE;AACvE,gFAAgF;AAChF,4EAA4E;AAC5E,2EAA2E;AAC3E,+EAA+E;AAC/E,4EAA4E;AAC5E,+EAA+E;AAC/E,yEAAyE;AACzE,4EAA4E;AAC5E,EAAE;AACF,0EAA0E;AAC1E,+EAA+E;AAC/E,6EAA6E;AAC7E,+EAA+E;AAC/E,4EAA4E;AAC5E,gFAAgF;AAChF,8DAA8D;AAC9D,EAAE;AACF,kDAAkD;AAClD,kFAAkF;AAClF,+EAA+E;AAC/E,+EAA+E;AAC/E,6EAA6E;AAC7E,uDAAuD;AAEvD;;;GAGG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,6CAA6C;IAC7C,mBAAmB,EAAE,mDAAmD;IACxE,mBAAmB,EAAE,gEAAgE;IACrF,gBAAgB,EAAE,gEAAgE;IAClF,kBAAkB,EAAE,mDAAmD;IACvE,qBAAqB,EAAE,yEAAyE;IAChG,mBAAmB,EAAE,gEAAgE;IAErF,qCAAqC;IACrC,eAAe,EAAE,8DAA8D;IAC/E,eAAe,EAAE,qDAAqD;IACtE,YAAY,EAAE,qDAAqD;IACnE,cAAc,EAAE,8DAA8D;IAC9E,eAAe,EAAE,qDAAqD;IAEtE,yCAAyC;IACzC,iBAAiB,EAAE,6DAA6D;IAChF,iBAAiB,EAAE,sEAAsE;IACzF,cAAc,EAAE,sEAAsE;IACtF,gBAAgB,EAAE,6DAA6D;IAC/E,mBAAmB,EAAE,qEAAqE;IAC1F,iBAAiB,EAAE,sEAAsE;IAEzF,gHAAgH;IAChH,eAAe,EAAE,+CAA+C;IAChE,YAAY,EAAE,2DAA2D;IACzE,cAAc,EAAE,+CAA+C;IAC/D,eAAe,EAAE,2DAA2D;IAC5E,gBAAgB,EAAE,yEAAyE;IAC3F,gBAAgB,EAAE,yEAAyE;IAC3F,kBAAkB,EAAE,mFAAmF;IAEvG,8GAA8G;IAC9G,cAAc,EAAE,2DAA2D;IAC3E,WAAW,EAAE,sEAAsE;IACnF,aAAa,EAAE,2DAA2D;IAC1E,cAAc,EAAE,sEAAsE;IACtF,eAAe,EAAE,oFAAoF;IACrG,eAAe,EAAE,oFAAoF;IAErG,4EAA4E;IAC5E,gBAAgB,EAAE,mFAAmF;IACrG,qBAAqB,EAAE,mFAAmF;IAC1G,sBAAsB,EAAE,gEAAgE;IACxF,gBAAgB,EAAE,wDAAwD;IAC1E,gBAAgB,EAAE,wDAAwD;IAE1E,qCAAqC;IACrC,aAAa,EAAE,oDAAoD;IACnE,mBAAmB,EAAE,2DAA2D;IAChF,eAAe,EAAE,iEAAiE;IAClF,UAAU,EAAE,gEAAgE;IAE5E,wCAAwC;IACxC,YAAY,EAAE,0EAA0E;IACxF,sBAAsB,EAAE,8EAA8E;IACtG,sBAAsB,EAAE,+DAA+D;IACvF,wBAAwB,EAAE,iEAAiE;IAC3F,uBAAuB,EAAE,gEAAgE;IACzF,eAAe,EAAE,sFAAsF;IACvG,mBAAmB,EAAE,0EAA0E;IAC/F,qBAAqB,EAAE,6EAA6E;IACpG,cAAc,EAAE,iEAAiE;IACjF,qBAAqB,EAAE,yEAAyE;IAChG,cAAc,EAAE,0EAA0E;IAC1F,gBAAgB,EAAE,mDAAmD;IACrE,aAAa,EAAE,0EAA0E;IAEzF,mCAAmC;IACnC,cAAc,EAAE,gEAAgE;IAChF,YAAY,EAAE,0DAA0D;IACxE,cAAc,EAAE,8CAA8C;IAC9D,gBAAgB,EAAE,mEAAmE;IAErF,uCAAuC;IACvC,wBAAwB,EAAE,+FAA+F;IACzH,iBAAiB,EAAE,wFAAwF;IAC3G,qBAAqB,EAAE,qGAAqG;IAC5H,mBAAmB,EAAE,gFAAgF;IACrG,mBAAmB,EAAE,+GAA+G;IACpI,oBAAoB,EAAE,+FAA+F;IACrH,YAAY,EAAE,gJAAgJ;IAE9J,uCAAuC;IACvC,wBAAwB,EAAE,8EAA8E;IACxG,sBAAsB,EAAE,0FAA0F;IAClH,mBAAmB,EAAE,yFAAyF;IAC9G,4BAA4B,EAAE,sFAAsF;IACpH,aAAa,EAAE,kFAAkF;IACjG,oBAAoB,EAAE,+FAA+F;IACrH,gBAAgB,EAAE,qFAAqF;IAEvG,kCAAkC;IAClC,iBAAiB,EAAE,oFAAoF;IACvG,cAAc,EAAE,iFAAiF;IACjG,mBAAmB,EAAE,sFAAsF;IAC3G,gBAAgB,EAAE,mFAAmF;IACrG,wBAAwB,EAAE,qFAAqF;IAC/G,qBAAqB,EAAE,kFAAkF;IACzG,qBAAqB,EAAE,kFAAkF;IACzG,uBAAuB,EAAE,oFAAoF;IAC7G,sBAAsB,EAAE,mFAAmF;IAC3G,kBAAkB,EAAE,2EAA2E;IAC/F,kBAAkB,EAAE,2EAA2E;IAC/F,oBAAoB,EAAE,6EAA6E;IACnG,mBAAmB,EAAE,4EAA4E;CACzF,CAAA;AAEV;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG;IACxC,8EAA8E;IAC9E,kEAAkE;IAClE,iBAAiB;IACjB,4EAA4E;IAC5E,+DAA+D;IAC/D,iBAAiB;IACjB,+EAA+E;IAC/E,wEAAwE;IACxE,wBAAwB,EAAE,8CAA8C;IACxE,yBAAyB,EAAE,8CAA8C;IACzE,0BAA0B,EAAE,oEAAoE;IAChG,0BAA0B,EAAE,6DAA6D;IACzF,8EAA8E;IAC9E,4DAA4D;IAC5D,0BAA0B,EAAE,wDAAwD;IACpF,+EAA+E;IAC/E,qEAAqE;IACrE,iBAAiB,EAAE,gCAAgC;CAC3C,CAAA"}
+{"version":3,"file":"curated-operations.js","sourceRoot":"","sources":["../../src/spec/curated-operations.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAChF,wDAAwD;AACxD,EAAE;AACF,kBAAkB;AAClB,uEAAuE;AACvE,gFAAgF;AAChF,4EAA4E;AAC5E,2EAA2E;AAC3E,+EAA+E;AAC/E,4EAA4E;AAC5E,+EAA+E;AAC/E,yEAAyE;AACzE,4EAA4E;AAC5E,EAAE;AACF,0EAA0E;AAC1E,+EAA+E;AAC/E,6EAA6E;AAC7E,+EAA+E;AAC/E,4EAA4E;AAC5E,gFAAgF;AAChF,8DAA8D;AAC9D,EAAE;AACF,kDAAkD;AAClD,kFAAkF;AAClF,+EAA+E;AAC/E,+EAA+E;AAC/E,6EAA6E;AAC7E,uDAAuD;AAEvD;;;GAGG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,6CAA6C;IAC7C,mBAAmB,EAAE,mDAAmD;IACxE,mBAAmB,EAAE,gEAAgE;IACrF,gBAAgB,EAAE,gEAAgE;IAClF,kBAAkB,EAAE,mDAAmD;IACvE,qBAAqB,EAAE,yEAAyE;IAChG,mBAAmB,EAAE,gEAAgE;IAErF,qCAAqC;IACrC,eAAe,EAAE,8DAA8D;IAC/E,eAAe,EAAE,qDAAqD;IACtE,YAAY,EAAE,qDAAqD;IACnE,cAAc,EAAE,8DAA8D;IAC9E,eAAe,EAAE,qDAAqD;IAEtE,yCAAyC;IACzC,iBAAiB,EAAE,6DAA6D;IAChF,iBAAiB,EAAE,sEAAsE;IACzF,cAAc,EAAE,sEAAsE;IACtF,gBAAgB,EAAE,6DAA6D;IAC/E,mBAAmB,EAAE,qEAAqE;IAC1F,iBAAiB,EAAE,sEAAsE;IAEzF,gHAAgH;IAChH,eAAe,EAAE,+CAA+C;IAChE,YAAY,EAAE,2DAA2D;IACzE,cAAc,EAAE,+CAA+C;IAC/D,eAAe,EAAE,2DAA2D;IAC5E,gBAAgB,EAAE,yEAAyE;IAC3F,gBAAgB,EAAE,yEAAyE;IAC3F,kBAAkB,EAAE,mFAAmF;IAEvG,8GAA8G;IAC9G,cAAc,EAAE,2DAA2D;IAC3E,WAAW,EAAE,sEAAsE;IACnF,aAAa,EAAE,2DAA2D;IAC1E,cAAc,EAAE,sEAAsE;IACtF,eAAe,EAAE,oFAAoF;IACrG,eAAe,EAAE,oFAAoF;IAErG,4EAA4E;IAC5E,gBAAgB,EAAE,mFAAmF;IACrG,qBAAqB,EAAE,mFAAmF;IAC1G,sBAAsB,EAAE,gEAAgE;IACxF,gBAAgB,EAAE,wDAAwD;IAC1E,gBAAgB,EAAE,wDAAwD;IAE1E,qCAAqC;IACrC,aAAa,EAAE,oDAAoD;IACnE,mBAAmB,EAAE,2DAA2D;IAChF,eAAe,EAAE,iEAAiE;IAClF,UAAU,EAAE,gEAAgE;IAE5E,wCAAwC;IACxC,YAAY,EAAE,0EAA0E;IACxF,sBAAsB,EAAE,8EAA8E;IACtG,sBAAsB,EAAE,+DAA+D;IACvF,wBAAwB,EAAE,iEAAiE;IAC3F,uBAAuB,EAAE,gEAAgE;IACzF,eAAe,EAAE,sFAAsF;IACvG,mBAAmB,EAAE,0EAA0E;IAC/F,qBAAqB,EAAE,6EAA6E;IACpG,cAAc,EAAE,iEAAiE;IACjF,qBAAqB,EAAE,yEAAyE;IAChG,cAAc,EAAE,0EAA0E;IAC1F,gBAAgB,EAAE,mDAAmD;IACrE,aAAa,EAAE,0EAA0E;IAEzF,mCAAmC;IACnC,cAAc,EAAE,gEAAgE;IAChF,YAAY,EAAE,0DAA0D;IACxE,cAAc,EAAE,8CAA8C;IAC9D,gBAAgB,EAAE,mEAAmE;IAErF,uCAAuC;IACvC,wBAAwB,EAAE,+FAA+F;IACzH,iBAAiB,EAAE,wFAAwF;IAC3G,qBAAqB,EAAE,qGAAqG;IAC5H,mBAAmB,EAAE,gFAAgF;IACrG,mBAAmB,EAAE,+GAA+G;IACpI,oBAAoB,EAAE,+FAA+F;IACrH,YAAY,EAAE,gJAAgJ;IAE9J,uCAAuC;IACvC,wBAAwB,EAAE,8EAA8E;IACxG,sBAAsB,EAAE,0FAA0F;IAClH,mBAAmB,EAAE,yFAAyF;IAC9G,4BAA4B,EAAE,sFAAsF;IACpH,aAAa,EAAE,kFAAkF;IACjG,oBAAoB,EAAE,+FAA+F;IACrH,gBAAgB,EAAE,qFAAqF;IAEvG,kCAAkC;IAClC,iBAAiB,EAAE,oFAAoF;IACvG,cAAc,EAAE,iFAAiF;IACjG,mBAAmB,EAAE,sFAAsF;IAC3G,gBAAgB,EAAE,mFAAmF;IACrG,wBAAwB,EAAE,qFAAqF;IAC/G,qBAAqB,EAAE,kFAAkF;IACzG,qBAAqB,EAAE,kFAAkF;IACzG,uBAAuB,EAAE,oFAAoF;IAC7G,sBAAsB,EAAE,mFAAmF;IAC3G,kBAAkB,EAAE,2EAA2E;IAC/F,kBAAkB,EAAE,2EAA2E;IAC/F,oBAAoB,EAAE,6EAA6E;IACnG,mBAAmB,EAAE,4EAA4E;CACzF,CAAA;AAEV;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG;IACxC,8EAA8E;IAC9E,kEAAkE;IAClE,iBAAiB;IACjB,4EAA4E;IAC5E,+DAA+D;IAC/D,iBAAiB;IACjB,+EAA+E;IAC/E,wEAAwE;IACxE,wBAAwB,EAAE,8CAA8C;IACxE,yBAAyB,EAAE,8CAA8C;IACzE,0BAA0B,EAAE,oEAAoE;IAChG,0BAA0B,EAAE,6DAA6D;IACzF,8EAA8E;IAC9E,4DAA4D;IAC5D,0BAA0B,EAAE,wDAAwD;IACpF,+EAA+E;IAC/E,qEAAqE;IACrE,iBAAiB,EAAE,gCAAgC;IACnD,yEAAyE;IACzE,6EAA6E;IAC7E,8EAA8E;IAC9E,wEAAwE;IACxE,QAAQ,EAAE,kBAAkB;IAC5B,eAAe,EAAE,yBAAyB;IAC1C,0EAA0E;IAC1E,qEAAqE;IACrE,uBAAuB,EAAE,wCAAwC;IACjE,6EAA6E;IAC7E,2EAA2E;IAC3E,6EAA6E;IAC7E,wEAAwE;IACxE,mBAAmB,EAAE,4BAA4B;IACjD,yBAAyB,EAAE,0CAA0C;IACrE,4BAA4B,EAAE,6CAA6C;CACnE,CAAA"}

package/dist/spec/openapi.yaml

@@ -224,6 +224,19 @@ components:
         - createdAt
         - updatedAt
       type: object
+    AdminWorkspaceResult:
+      additionalProperties: false
+      properties:
+        action:
+          description: "The action applied: \"suspended\" or \"reactivated\"."
+          type: string
+        slug:
+          description: The workspace acted on.
+          type: string
+      required:
+        - slug
+        - action
+      type: object
     AgeBucketDTO:
       additionalProperties: false
       properties:
@@ -6466,6 +6479,43 @@ components:
         - left
         - right
       type: object
+    SignupBody:
+      additionalProperties: false
+      properties:
+        acceptTos:
+          description: Must be true; acceptance is recorded with a timestamp.
+          type: boolean
+        companyName:
+          description: Company/organization name; a URL-safe slug is derived from it.
+          examples:
+            - Acme Payments
+          maxLength: 200
+          type: string
+        email:
+          description: Work email; disposable domains are rejected.
+          examples:
+            - founder@acme.com
+          maxLength: 254
+          type: string
+        password:
+          description: Account password; 12–72 characters with letters and digits. The 72-byte cap is bcrypt's input limit.
+          maxLength: 72
+          type: string
+      required:
+        - email
+        - password
+        - companyName
+        - acceptTos
+      type: object
+    SignupResponse:
+      additionalProperties: false
+      properties:
+        message:
+          description: Human-readable acknowledgement (identical for known and unknown emails).
+          type: string
+      required:
+        - message
+      type: object
     SimulateFeeItem:
       additionalProperties: false
       properties:
@@ -7784,6 +7834,25 @@ components:
         - totalActual
         - netVariance
       type: object
+    VerifyBody:
+      additionalProperties: false
+      properties:
+        token:
+          description: The verification token from the signup email link.
+          maxLength: 512
+          type: string
+      required:
+        - token
+      type: object
+    VerifyResponse:
+      additionalProperties: false
+      properties:
+        message:
+          description: Human-readable verification result.
+          type: string
+      required:
+        - message
+      type: object
     VersionBody:
       additionalProperties: false
       properties:
@@ -7858,6 +7927,45 @@ components:
         - periodStart
         - periodEnd
       type: object
+    WorkspaceAuthConfig:
+      additionalProperties: false
+      properties:
+        clientId:
+          description: OAuth client id of the workspace's console application.
+          type: string
+        issuer:
+          description: Public base URL of the identity provider (the PKCE issuer).
+          type: string
+        organization:
+          description: Identity-provider organization name for the workspace.
+          type: string
+      required:
+        - clientId
+        - organization
+        - issuer
+      type: object
+    WorkspaceBilling:
+      additionalProperties: false
+      properties:
+        billingStatus:
+          description: "Commercial lifecycle: trialing, active, past_due, or suspended."
+          type: string
+        daysRemaining:
+          description: Whole days left in the trial, derived server-side. 0 when there is no trial or it has already ended.
+          format: int64
+          type: integer
+        plan:
+          description: Commercial plan the workspace is on ("free" or a paid tier).
+          type: string
+        trialEndsAt:
+          description: When the free trial ends (UTC). Omitted for a paid plan that never trialed.
+          format: date-time
+          type: string
+      required:
+        - plan
+        - billingStatus
+        - daysRemaining
+      type: object
   securitySchemes:
     BearerAuth:
       bearerFormat: JWT
@@ -7936,6 +8044,68 @@ paths:
       summary: Readiness check
       tags:
         - Health
+  /v1/admin/workspaces/{slug}/reactivate:
+    put:
+      description: "Restores a suspended workspace: persists billing_status=active, re-enables interactive console login at the IdP, reactivates the tenant at the Tenant Manager (best-effort), and evicts the billing edge-gate cache. The target slug comes from the URL path (backoffice operation, workspace admin action). Idempotent. Errors use RFC 9457 problem+json."
+      operationId: admin-reactivate-workspace
+      parameters:
+        - description: Slug of the workspace to act on.
+          in: path
+          name: slug
+          required: true
+          schema:
+            description: Slug of the workspace to act on.
+            maxLength: 255
+            type: string
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/AdminWorkspaceResult"
+          description: OK
+        default:
+          content:
+            application/problem+json:
+              schema:
+                $ref: "#/components/schemas/Detail"
+          description: Error
+      security:
+        - BearerAuth: []
+      summary: Reactivate a suspended workspace (backoffice)
+      tags:
+        - Onboarding
+  /v1/admin/workspaces/{slug}/suspend:
+    put:
+      description: "Suspends a workspace's commercial access: persists billing_status=suspended (source of truth), cuts interactive console login at the IdP, suspends the tenant's matcher service association at the Tenant Manager (best-effort), and evicts the billing edge-gate cache so API traffic is cut within the gate TTL. The target slug comes from the URL path: this is a backoffice operation gated by the workspace admin action, NOT a tenant-scoped route — the operator acts across workspaces. Idempotent. Errors use RFC 9457 problem+json."
+      operationId: admin-suspend-workspace
+      parameters:
+        - description: Slug of the workspace to act on.
+          in: path
+          name: slug
+          required: true
+          schema:
+            description: Slug of the workspace to act on.
+            maxLength: 255
+            type: string
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/AdminWorkspaceResult"
+          description: OK
+        default:
+          content:
+            application/problem+json:
+              schema:
+                $ref: "#/components/schemas/Detail"
+          description: Error
+      security:
+        - BearerAuth: []
+      summary: Suspend a workspace (backoffice)
+      tags:
+        - Onboarding
   /v1/contexts:
     get:
       description: Returns a cursor-paginated list of reconciliation contexts, optionally filtered by type and status.
@@ -15345,6 +15515,119 @@ paths:
       summary: Export variance report
       tags:
         - Reporting
+  /v1/signup:
+    post:
+      description: "Starts self-service onboarding. This is a PUBLIC, anonymous, pre-tenant route: it carries no operator JWT and creates no account yet. It validates the payload (email, password policy, company name, and mandatory Terms of Service acceptance) and stores a pending record whose TTL is the whole expiry mechanism. A company name whose derived slug is reserved (e.g. admin, api, www) is rejected with a 400 application/problem+json error. To prevent account enumeration, an email that is already registered or pending returns the SAME 202 response as a new one; a repeat signup for a still-pending email re-sends the verification email, throttled per address. The route is rate-limited per client IP. All errors use the RFC 9457 application/problem+json contract."
+      operationId: signup
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/SignupBody"
+        required: true
+      responses:
+        "202":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/SignupResponse"
+          description: Accepted
+        default:
+          content:
+            application/problem+json:
+              schema:
+                $ref: "#/components/schemas/Detail"
+          description: Error
+      security: []
+      summary: Create a self-service signup
+      tags:
+        - Onboarding
+  /v1/signup/verify:
+    post:
+      description: "Completes self-service onboarding. This is a PUBLIC, anonymous, pre-tenant route: it exchanges the emailed verification token for a provisioned workspace. It is idempotent and re-entrant: a repeat call re-drives an incomplete provisioning to completion, and a token that no longer resolves (already used or expired) returns the same 200 response. The route is rate-limited per client IP."
+      operationId: signup-verify
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/VerifyBody"
+        required: true
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/VerifyResponse"
+          description: OK
+        default:
+          content:
+            application/problem+json:
+              schema:
+                $ref: "#/components/schemas/Detail"
+          description: Error
+      security: []
+      summary: Verify a self-service signup
+      tags:
+        - Onboarding
+  /v1/workspace/billing:
+    get:
+      description: "Returns the authenticated tenant's own commercial state: its plan, billing status, trial deadline, and the whole days remaining in the trial (derived server-side). The tenant is resolved from the JWT tenant-slug claim — this endpoint never accepts a tenant identifier in the request and can only read the caller's own workspace. A tenant with no self-serve workspace record (the default/system tenant, or an unknown slug) returns 404. Errors use the RFC 9457 application/problem+json contract."
+      operationId: workspace-billing
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/WorkspaceBilling"
+          description: OK
+        default:
+          content:
+            application/problem+json:
+              schema:
+                $ref: "#/components/schemas/Detail"
+          description: Error
+      security:
+        - BearerAuth: []
+      summary: Read the current workspace's commercial state
+      tags:
+        - Onboarding
+  /v1/workspaces/{slug}/auth-config:
+    get:
+      description: "Resolves the minimum a browser needs to start a PKCE login for a workspace: the console OAuth client id, the identity-provider organization, and the public issuer URL. This is a PUBLIC, anonymous, read-only, pre-tenant route: it carries no operator JWT and returns nothing about the account, its owner, or its lifecycle. It answers only for ACTIVE workspaces; a nonexistent, still-provisioning, or suspended workspace returns an IDENTICAL 404 (no enumeration of lifecycle state). The response is briefly cacheable and the route is rate-limited per client IP. Errors use the RFC 9457 application/problem+json contract."
+      operationId: workspace-auth-config
+      parameters:
+        - description: Workspace slug as typed on the login screen.
+          in: path
+          name: slug
+          required: true
+          schema:
+            description: Workspace slug as typed on the login screen.
+            examples:
+              - acme
+            maxLength: 63
+            type: string
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/WorkspaceAuthConfig"
+          description: OK
+          headers:
+            Cache-Control:
+              schema:
+                description: Short public cache lifetime for the login config.
+                type: string
+        default:
+          content:
+            application/problem+json:
+              schema:
+                $ref: "#/components/schemas/Detail"
+          description: Error
+      security: []
+      summary: Resolve a workspace's public login configuration
+      tags:
+        - Onboarding
   /version:
     get:
       description: Returns the service build version (from the VERSION environment variable, default 0.0.0) and the server UTC timestamp.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lerianstudio/matcher-mcp",
-  "version": "1.5.0-beta.2",
+  "version": "1.5.0-beta.4",
   "type": "module",
   "description": "Model Context Protocol server for the Matcher reconciliation engine",
   "license": "Apache-2.0",
@@ -48,11 +48,11 @@
     "@anthropic-ai/sdk": "^0.110.0",
     "@modelcontextprotocol/sdk": "^1.29.0",
     "@opentelemetry/api": "1.9.1",
-    "@opentelemetry/exporter-metrics-otlp-http": "0.219.0",
-    "@opentelemetry/exporter-trace-otlp-http": "0.219.0",
-    "@opentelemetry/resources": "2.8.0",
-    "@opentelemetry/sdk-metrics": "2.8.0",
-    "@opentelemetry/sdk-node": "0.219.0",
+    "@opentelemetry/exporter-metrics-otlp-http": "0.220.0",
+    "@opentelemetry/exporter-trace-otlp-http": "0.220.0",
+    "@opentelemetry/resources": "2.9.0",
+    "@opentelemetry/sdk-metrics": "2.9.0",
+    "@opentelemetry/sdk-node": "0.220.0",
     "@opentelemetry/semantic-conventions": "1.41.1",
     "ajv": "^8.20.0",
     "openai": "^6.45.0",