@lerianstudio/matcher-mcp 1.5.0-beta.3 → 1.5.0-beta.4

package/dist/server.js

@@ -113,7 +113,7 @@ function registerTools(server) {
     registerListOperationsTool(server, index);
     registerDescribeOperationTool(server, index);
     // Generic invoke (task 1.2.3): assembles + validates + dispatches any of the
-    // 171 operations with the caller's relayed token (fail-closed). Shares the
+    // 174 operations with the caller's relayed token (fail-closed). Shares the
     // RFC 9457 → tool-error mapping (toToolError) with the curated surface.
     registerInvokeTool(server, index);
     // Curated fee-schedule vertical (task 1.3.2): six typed tools (create/list/

package/dist/spec/curated-operations.js

@@ -2,10 +2,10 @@
 // covers — the registry the drift guard checks against.
 //
 // WHY THIS EXISTS
-// The server exposes two surfaces over the 171-operation matcher spec:
+// The server exposes two surfaces over the 174-operation matcher spec:
 //   1. The GENERIC trio (matcher_list_operations / describe / invoke) reads the
 //      spec at runtime, so it tracks the spec automatically. `load.test.ts`
-//      already pins `index.operations.size === 171` as that side's canary.
+//      already pins `index.operations.size === 174` as that side's canary.
 //   2. The CURATED tools (the ~72 hand-written Zod tools under `src/tools/*/`)
 //      hard-code their own method+path. NOTHING in those tools consults the
 //      spec, and their unit tests assert against the same hard-coded literal —
@@ -162,5 +162,12 @@ export const GENERIC_ONLY_OPERATION_IDS = [
     // PUBLIC pre-login PKCE bootstrap for the console (client id + issuer per
     // workspace slug); browser-facing discovery, not an operator action.
     'workspace-auth-config', // GET /v1/workspaces/{slug}/auth-config
+    // standalone-SaaS Phase 2 control-plane (generic-only) — tenant billing read
+    // plus backoffice workspace-lifecycle admin. Straightforward body-less ops
+    // nobody has hand-curated a Zod tool for; billing read is tenant-scoped, the
+    // admin pair is an internal backoffice surface, not an operator action.
+    'workspace-billing', // GET /v1/workspace/billing
+    'admin-suspend-workspace', // PUT /v1/admin/workspaces/{slug}/suspend
+    'admin-reactivate-workspace', // PUT /v1/admin/workspaces/{slug}/reactivate
 ];
 //# sourceMappingURL=curated-operations.js.map

package/dist/spec/curated-operations.js.map

@@ -1 +1 @@
-{"version":3,"file":"curated-operations.js","sourceRoot":"","sources":["../../src/spec/curated-operations.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAChF,wDAAwD;AACxD,EAAE;AACF,kBAAkB;AAClB,uEAAuE;AACvE,gFAAgF;AAChF,4EAA4E;AAC5E,2EAA2E;AAC3E,+EAA+E;AAC/E,4EAA4E;AAC5E,+EAA+E;AAC/E,yEAAyE;AACzE,4EAA4E;AAC5E,EAAE;AACF,0EAA0E;AAC1E,+EAA+E;AAC/E,6EAA6E;AAC7E,+EAA+E;AAC/E,4EAA4E;AAC5E,gFAAgF;AAChF,8DAA8D;AAC9D,EAAE;AACF,kDAAkD;AAClD,kFAAkF;AAClF,+EAA+E;AAC/E,+EAA+E;AAC/E,6EAA6E;AAC7E,uDAAuD;AAEvD;;;GAGG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,6CAA6C;IAC7C,mBAAmB,EAAE,mDAAmD;IACxE,mBAAmB,EAAE,gEAAgE;IACrF,gBAAgB,EAAE,gEAAgE;IAClF,kBAAkB,EAAE,mDAAmD;IACvE,qBAAqB,EAAE,yEAAyE;IAChG,mBAAmB,EAAE,gEAAgE;IAErF,qCAAqC;IACrC,eAAe,EAAE,8DAA8D;IAC/E,eAAe,EAAE,qDAAqD;IACtE,YAAY,EAAE,qDAAqD;IACnE,cAAc,EAAE,8DAA8D;IAC9E,eAAe,EAAE,qDAAqD;IAEtE,yCAAyC;IACzC,iBAAiB,EAAE,6DAA6D;IAChF,iBAAiB,EAAE,sEAAsE;IACzF,cAAc,EAAE,sEAAsE;IACtF,gBAAgB,EAAE,6DAA6D;IAC/E,mBAAmB,EAAE,qEAAqE;IAC1F,iBAAiB,EAAE,sEAAsE;IAEzF,gHAAgH;IAChH,eAAe,EAAE,+CAA+C;IAChE,YAAY,EAAE,2DAA2D;IACzE,cAAc,EAAE,+CAA+C;IAC/D,eAAe,EAAE,2DAA2D;IAC5E,gBAAgB,EAAE,yEAAyE;IAC3F,gBAAgB,EAAE,yEAAyE;IAC3F,kBAAkB,EAAE,mFAAmF;IAEvG,8GAA8G;IAC9G,cAAc,EAAE,2DAA2D;IAC3E,WAAW,EAAE,sEAAsE;IACnF,aAAa,EAAE,2DAA2D;IAC1E,cAAc,EAAE,sEAAsE;IACtF,eAAe,EAAE,oFAAoF;IACrG,eAAe,EAAE,oFAAoF;IAErG,4EAA4E;IAC5E,gBAAgB,EAAE,mFAAmF;IACrG,qBAAqB,EAAE,mFAAmF;IAC1G,sBAAsB,EAAE,gEAAgE;IACxF,gBAAgB,EAAE,wDAAwD;IAC1E,gBAAgB,EAAE,wDAAwD;IAE1E,qCAAqC;IACrC,aAAa,EAAE,oDAAoD;IACnE,mBAAmB,EAAE,2DAA2D;IAChF,eAAe,EAAE,iEAAiE;IAClF,UAAU,EAAE,gEAAgE;IAE5E,wCAAwC;IACxC,YAAY,EAAE,0EAA0E;IACxF,sBAAsB,EAAE,8EAA8E;IACtG,sBAAsB,EAAE,+DAA+D;IACvF,wBAAwB,EAAE,iEAAiE;IAC3F,uBAAuB,EAAE,gEAAgE;IACzF,eAAe,EAAE,sFAAsF;IACvG,mBAAmB,EAAE,0EAA0E;IAC/F,qBAAqB,EAAE,6EAA6E;IACpG,cAAc,EAAE,iEAAiE;IACjF,qBAAqB,EAAE,yEAAyE;IAChG,cAAc,EAAE,0EAA0E;IAC1F,gBAAgB,EAAE,mDAAmD;IACrE,aAAa,EAAE,0EAA0E;IAEzF,mCAAmC;IACnC,cAAc,EAAE,gEAAgE;IAChF,YAAY,EAAE,0DAA0D;IACxE,cAAc,EAAE,8CAA8C;IAC9D,gBAAgB,EAAE,mEAAmE;IAErF,uCAAuC;IACvC,wBAAwB,EAAE,+FAA+F;IACzH,iBAAiB,EAAE,wFAAwF;IAC3G,qBAAqB,EAAE,qGAAqG;IAC5H,mBAAmB,EAAE,gFAAgF;IACrG,mBAAmB,EAAE,+GAA+G;IACpI,oBAAoB,EAAE,+FAA+F;IACrH,YAAY,EAAE,gJAAgJ;IAE9J,uCAAuC;IACvC,wBAAwB,EAAE,8EAA8E;IACxG,sBAAsB,EAAE,0FAA0F;IAClH,mBAAmB,EAAE,yFAAyF;IAC9G,4BAA4B,EAAE,sFAAsF;IACpH,aAAa,EAAE,kFAAkF;IACjG,oBAAoB,EAAE,+FAA+F;IACrH,gBAAgB,EAAE,qFAAqF;IAEvG,kCAAkC;IAClC,iBAAiB,EAAE,oFAAoF;IACvG,cAAc,EAAE,iFAAiF;IACjG,mBAAmB,EAAE,sFAAsF;IAC3G,gBAAgB,EAAE,mFAAmF;IACrG,wBAAwB,EAAE,qFAAqF;IAC/G,qBAAqB,EAAE,kFAAkF;IACzG,qBAAqB,EAAE,kFAAkF;IACzG,uBAAuB,EAAE,oFAAoF;IAC7G,sBAAsB,EAAE,mFAAmF;IAC3G,kBAAkB,EAAE,2EAA2E;IAC/F,kBAAkB,EAAE,2EAA2E;IAC/F,oBAAoB,EAAE,6EAA6E;IACnG,mBAAmB,EAAE,4EAA4E;CACzF,CAAA;AAEV;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG;IACxC,8EAA8E;IAC9E,kEAAkE;IAClE,iBAAiB;IACjB,4EAA4E;IAC5E,+DAA+D;IAC/D,iBAAiB;IACjB,+EAA+E;IAC/E,wEAAwE;IACxE,wBAAwB,EAAE,8CAA8C;IACxE,yBAAyB,EAAE,8CAA8C;IACzE,0BAA0B,EAAE,oEAAoE;IAChG,0BAA0B,EAAE,6DAA6D;IACzF,8EAA8E;IAC9E,4DAA4D;IAC5D,0BAA0B,EAAE,wDAAwD;IACpF,+EAA+E;IAC/E,qEAAqE;IACrE,iBAAiB,EAAE,gCAAgC;IACnD,yEAAyE;IACzE,6EAA6E;IAC7E,8EAA8E;IAC9E,wEAAwE;IACxE,QAAQ,EAAE,kBAAkB;IAC5B,eAAe,EAAE,yBAAyB;IAC1C,0EAA0E;IAC1E,qEAAqE;IACrE,uBAAuB,EAAE,wCAAwC;CACzD,CAAA"}
+{"version":3,"file":"curated-operations.js","sourceRoot":"","sources":["../../src/spec/curated-operations.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAChF,wDAAwD;AACxD,EAAE;AACF,kBAAkB;AAClB,uEAAuE;AACvE,gFAAgF;AAChF,4EAA4E;AAC5E,2EAA2E;AAC3E,+EAA+E;AAC/E,4EAA4E;AAC5E,+EAA+E;AAC/E,yEAAyE;AACzE,4EAA4E;AAC5E,EAAE;AACF,0EAA0E;AAC1E,+EAA+E;AAC/E,6EAA6E;AAC7E,+EAA+E;AAC/E,4EAA4E;AAC5E,gFAAgF;AAChF,8DAA8D;AAC9D,EAAE;AACF,kDAAkD;AAClD,kFAAkF;AAClF,+EAA+E;AAC/E,+EAA+E;AAC/E,6EAA6E;AAC7E,uDAAuD;AAEvD;;;GAGG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,6CAA6C;IAC7C,mBAAmB,EAAE,mDAAmD;IACxE,mBAAmB,EAAE,gEAAgE;IACrF,gBAAgB,EAAE,gEAAgE;IAClF,kBAAkB,EAAE,mDAAmD;IACvE,qBAAqB,EAAE,yEAAyE;IAChG,mBAAmB,EAAE,gEAAgE;IAErF,qCAAqC;IACrC,eAAe,EAAE,8DAA8D;IAC/E,eAAe,EAAE,qDAAqD;IACtE,YAAY,EAAE,qDAAqD;IACnE,cAAc,EAAE,8DAA8D;IAC9E,eAAe,EAAE,qDAAqD;IAEtE,yCAAyC;IACzC,iBAAiB,EAAE,6DAA6D;IAChF,iBAAiB,EAAE,sEAAsE;IACzF,cAAc,EAAE,sEAAsE;IACtF,gBAAgB,EAAE,6DAA6D;IAC/E,mBAAmB,EAAE,qEAAqE;IAC1F,iBAAiB,EAAE,sEAAsE;IAEzF,gHAAgH;IAChH,eAAe,EAAE,+CAA+C;IAChE,YAAY,EAAE,2DAA2D;IACzE,cAAc,EAAE,+CAA+C;IAC/D,eAAe,EAAE,2DAA2D;IAC5E,gBAAgB,EAAE,yEAAyE;IAC3F,gBAAgB,EAAE,yEAAyE;IAC3F,kBAAkB,EAAE,mFAAmF;IAEvG,8GAA8G;IAC9G,cAAc,EAAE,2DAA2D;IAC3E,WAAW,EAAE,sEAAsE;IACnF,aAAa,EAAE,2DAA2D;IAC1E,cAAc,EAAE,sEAAsE;IACtF,eAAe,EAAE,oFAAoF;IACrG,eAAe,EAAE,oFAAoF;IAErG,4EAA4E;IAC5E,gBAAgB,EAAE,mFAAmF;IACrG,qBAAqB,EAAE,mFAAmF;IAC1G,sBAAsB,EAAE,gEAAgE;IACxF,gBAAgB,EAAE,wDAAwD;IAC1E,gBAAgB,EAAE,wDAAwD;IAE1E,qCAAqC;IACrC,aAAa,EAAE,oDAAoD;IACnE,mBAAmB,EAAE,2DAA2D;IAChF,eAAe,EAAE,iEAAiE;IAClF,UAAU,EAAE,gEAAgE;IAE5E,wCAAwC;IACxC,YAAY,EAAE,0EAA0E;IACxF,sBAAsB,EAAE,8EAA8E;IACtG,sBAAsB,EAAE,+DAA+D;IACvF,wBAAwB,EAAE,iEAAiE;IAC3F,uBAAuB,EAAE,gEAAgE;IACzF,eAAe,EAAE,sFAAsF;IACvG,mBAAmB,EAAE,0EAA0E;IAC/F,qBAAqB,EAAE,6EAA6E;IACpG,cAAc,EAAE,iEAAiE;IACjF,qBAAqB,EAAE,yEAAyE;IAChG,cAAc,EAAE,0EAA0E;IAC1F,gBAAgB,EAAE,mDAAmD;IACrE,aAAa,EAAE,0EAA0E;IAEzF,mCAAmC;IACnC,cAAc,EAAE,gEAAgE;IAChF,YAAY,EAAE,0DAA0D;IACxE,cAAc,EAAE,8CAA8C;IAC9D,gBAAgB,EAAE,mEAAmE;IAErF,uCAAuC;IACvC,wBAAwB,EAAE,+FAA+F;IACzH,iBAAiB,EAAE,wFAAwF;IAC3G,qBAAqB,EAAE,qGAAqG;IAC5H,mBAAmB,EAAE,gFAAgF;IACrG,mBAAmB,EAAE,+GAA+G;IACpI,oBAAoB,EAAE,+FAA+F;IACrH,YAAY,EAAE,gJAAgJ;IAE9J,uCAAuC;IACvC,wBAAwB,EAAE,8EAA8E;IACxG,sBAAsB,EAAE,0FAA0F;IAClH,mBAAmB,EAAE,yFAAyF;IAC9G,4BAA4B,EAAE,sFAAsF;IACpH,aAAa,EAAE,kFAAkF;IACjG,oBAAoB,EAAE,+FAA+F;IACrH,gBAAgB,EAAE,qFAAqF;IAEvG,kCAAkC;IAClC,iBAAiB,EAAE,oFAAoF;IACvG,cAAc,EAAE,iFAAiF;IACjG,mBAAmB,EAAE,sFAAsF;IAC3G,gBAAgB,EAAE,mFAAmF;IACrG,wBAAwB,EAAE,qFAAqF;IAC/G,qBAAqB,EAAE,kFAAkF;IACzG,qBAAqB,EAAE,kFAAkF;IACzG,uBAAuB,EAAE,oFAAoF;IAC7G,sBAAsB,EAAE,mFAAmF;IAC3G,kBAAkB,EAAE,2EAA2E;IAC/F,kBAAkB,EAAE,2EAA2E;IAC/F,oBAAoB,EAAE,6EAA6E;IACnG,mBAAmB,EAAE,4EAA4E;CACzF,CAAA;AAEV;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG;IACxC,8EAA8E;IAC9E,kEAAkE;IAClE,iBAAiB;IACjB,4EAA4E;IAC5E,+DAA+D;IAC/D,iBAAiB;IACjB,+EAA+E;IAC/E,wEAAwE;IACxE,wBAAwB,EAAE,8CAA8C;IACxE,yBAAyB,EAAE,8CAA8C;IACzE,0BAA0B,EAAE,oEAAoE;IAChG,0BAA0B,EAAE,6DAA6D;IACzF,8EAA8E;IAC9E,4DAA4D;IAC5D,0BAA0B,EAAE,wDAAwD;IACpF,+EAA+E;IAC/E,qEAAqE;IACrE,iBAAiB,EAAE,gCAAgC;IACnD,yEAAyE;IACzE,6EAA6E;IAC7E,8EAA8E;IAC9E,wEAAwE;IACxE,QAAQ,EAAE,kBAAkB;IAC5B,eAAe,EAAE,yBAAyB;IAC1C,0EAA0E;IAC1E,qEAAqE;IACrE,uBAAuB,EAAE,wCAAwC;IACjE,6EAA6E;IAC7E,2EAA2E;IAC3E,6EAA6E;IAC7E,wEAAwE;IACxE,mBAAmB,EAAE,4BAA4B;IACjD,yBAAyB,EAAE,0CAA0C;IACrE,4BAA4B,EAAE,6CAA6C;CACnE,CAAA"}

package/dist/spec/openapi.yaml

@@ -224,6 +224,19 @@ components:
         - createdAt
         - updatedAt
       type: object
+    AdminWorkspaceResult:
+      additionalProperties: false
+      properties:
+        action:
+          description: "The action applied: \"suspended\" or \"reactivated\"."
+          type: string
+        slug:
+          description: The workspace acted on.
+          type: string
+      required:
+        - slug
+        - action
+      type: object
     AgeBucketDTO:
       additionalProperties: false
       properties:
@@ -7931,6 +7944,28 @@ components:
         - organization
         - issuer
       type: object
+    WorkspaceBilling:
+      additionalProperties: false
+      properties:
+        billingStatus:
+          description: "Commercial lifecycle: trialing, active, past_due, or suspended."
+          type: string
+        daysRemaining:
+          description: Whole days left in the trial, derived server-side. 0 when there is no trial or it has already ended.
+          format: int64
+          type: integer
+        plan:
+          description: Commercial plan the workspace is on ("free" or a paid tier).
+          type: string
+        trialEndsAt:
+          description: When the free trial ends (UTC). Omitted for a paid plan that never trialed.
+          format: date-time
+          type: string
+      required:
+        - plan
+        - billingStatus
+        - daysRemaining
+      type: object
   securitySchemes:
     BearerAuth:
       bearerFormat: JWT
@@ -8009,6 +8044,68 @@ paths:
       summary: Readiness check
       tags:
         - Health
+  /v1/admin/workspaces/{slug}/reactivate:
+    put:
+      description: "Restores a suspended workspace: persists billing_status=active, re-enables interactive console login at the IdP, reactivates the tenant at the Tenant Manager (best-effort), and evicts the billing edge-gate cache. The target slug comes from the URL path (backoffice operation, workspace admin action). Idempotent. Errors use RFC 9457 problem+json."
+      operationId: admin-reactivate-workspace
+      parameters:
+        - description: Slug of the workspace to act on.
+          in: path
+          name: slug
+          required: true
+          schema:
+            description: Slug of the workspace to act on.
+            maxLength: 255
+            type: string
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/AdminWorkspaceResult"
+          description: OK
+        default:
+          content:
+            application/problem+json:
+              schema:
+                $ref: "#/components/schemas/Detail"
+          description: Error
+      security:
+        - BearerAuth: []
+      summary: Reactivate a suspended workspace (backoffice)
+      tags:
+        - Onboarding
+  /v1/admin/workspaces/{slug}/suspend:
+    put:
+      description: "Suspends a workspace's commercial access: persists billing_status=suspended (source of truth), cuts interactive console login at the IdP, suspends the tenant's matcher service association at the Tenant Manager (best-effort), and evicts the billing edge-gate cache so API traffic is cut within the gate TTL. The target slug comes from the URL path: this is a backoffice operation gated by the workspace admin action, NOT a tenant-scoped route — the operator acts across workspaces. Idempotent. Errors use RFC 9457 problem+json."
+      operationId: admin-suspend-workspace
+      parameters:
+        - description: Slug of the workspace to act on.
+          in: path
+          name: slug
+          required: true
+          schema:
+            description: Slug of the workspace to act on.
+            maxLength: 255
+            type: string
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/AdminWorkspaceResult"
+          description: OK
+        default:
+          content:
+            application/problem+json:
+              schema:
+                $ref: "#/components/schemas/Detail"
+          description: Error
+      security:
+        - BearerAuth: []
+      summary: Suspend a workspace (backoffice)
+      tags:
+        - Onboarding
   /v1/contexts:
     get:
       description: Returns a cursor-paginated list of reconciliation contexts, optionally filtered by type and status.
@@ -15472,6 +15569,28 @@ paths:
       summary: Verify a self-service signup
       tags:
         - Onboarding
+  /v1/workspace/billing:
+    get:
+      description: "Returns the authenticated tenant's own commercial state: its plan, billing status, trial deadline, and the whole days remaining in the trial (derived server-side). The tenant is resolved from the JWT tenant-slug claim — this endpoint never accepts a tenant identifier in the request and can only read the caller's own workspace. A tenant with no self-serve workspace record (the default/system tenant, or an unknown slug) returns 404. Errors use the RFC 9457 application/problem+json contract."
+      operationId: workspace-billing
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/WorkspaceBilling"
+          description: OK
+        default:
+          content:
+            application/problem+json:
+              schema:
+                $ref: "#/components/schemas/Detail"
+          description: Error
+      security:
+        - BearerAuth: []
+      summary: Read the current workspace's commercial state
+      tags:
+        - Onboarding
   /v1/workspaces/{slug}/auth-config:
     get:
       description: "Resolves the minimum a browser needs to start a PKCE login for a workspace: the console OAuth client id, the identity-provider organization, and the public issuer URL. This is a PUBLIC, anonymous, read-only, pre-tenant route: it carries no operator JWT and returns nothing about the account, its owner, or its lifecycle. It answers only for ACTIVE workspaces; a nonexistent, still-provisioning, or suspended workspace returns an IDENTICAL 404 (no enumeration of lifecycle state). The response is briefly cacheable and the route is rate-limited per client IP. Errors use the RFC 9457 application/problem+json contract."

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lerianstudio/matcher-mcp",
-  "version": "1.5.0-beta.3",
+  "version": "1.5.0-beta.4",
   "type": "module",
   "description": "Model Context Protocol server for the Matcher reconciliation engine",
   "license": "Apache-2.0",