@lerianstudio/matcher-mcp 4.5.0-beta.22 → 4.5.0-beta.24

package/dist/spec/curated-operations.js

@@ -172,5 +172,11 @@ export const GENERIC_ONLY_OPERATION_IDS = [
     // required knowing the operationId.)
     'admin-suspend-workspace', // PUT /v1/admin/workspaces/{slug}/suspend
     'admin-reactivate-workspace', // PUT /v1/admin/workspaces/{slug}/reactivate
+    // billing webhook (generic-only) — the inbound payment-processor receiver. It is
+    // not an operator action in any sense: it is JWT-less, authenticated by a signature
+    // over the raw body under a secret only the server holds, and the relay
+    // authenticates with a tenant token that would not verify. A curated tool for it
+    // could not be called successfully by anyone (cf. the two webhook receivers above).
+    'receiveBillingWebhook', // POST /v1/billing/webhook
 ];
 //# sourceMappingURL=curated-operations.js.map

package/dist/spec/curated-operations.js.map

@@ -1 +1 @@
-{"version":3,"file":"curated-operations.js","sourceRoot":"","sources":["../../src/spec/curated-operations.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAChF,wDAAwD;AACxD,EAAE;AACF,kBAAkB;AAClB,uEAAuE;AACvE,gFAAgF;AAChF,4EAA4E;AAC5E,2EAA2E;AAC3E,+EAA+E;AAC/E,4EAA4E;AAC5E,+EAA+E;AAC/E,yEAAyE;AACzE,4EAA4E;AAC5E,EAAE;AACF,0EAA0E;AAC1E,+EAA+E;AAC/E,6EAA6E;AAC7E,+EAA+E;AAC/E,4EAA4E;AAC5E,gFAAgF;AAChF,8DAA8D;AAC9D,EAAE;AACF,kDAAkD;AAClD,kFAAkF;AAClF,+EAA+E;AAC/E,+EAA+E;AAC/E,6EAA6E;AAC7E,uDAAuD;AAEvD;;;GAGG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,6CAA6C;IAC7C,mBAAmB,EAAE,mDAAmD;IACxE,mBAAmB,EAAE,gEAAgE;IACrF,gBAAgB,EAAE,gEAAgE;IAClF,kBAAkB,EAAE,mDAAmD;IACvE,qBAAqB,EAAE,yEAAyE;IAChG,mBAAmB,EAAE,gEAAgE;IAErF,qCAAqC;IACrC,eAAe,EAAE,8DAA8D;IAC/E,eAAe,EAAE,qDAAqD;IACtE,YAAY,EAAE,qDAAqD;IACnE,cAAc,EAAE,8DAA8D;IAC9E,eAAe,EAAE,qDAAqD;IAEtE,yCAAyC;IACzC,iBAAiB,EAAE,6DAA6D;IAChF,iBAAiB,EAAE,sEAAsE;IACzF,cAAc,EAAE,sEAAsE;IACtF,gBAAgB,EAAE,6DAA6D;IAC/E,mBAAmB,EAAE,qEAAqE;IAC1F,iBAAiB,EAAE,sEAAsE;IAEzF,gHAAgH;IAChH,eAAe,EAAE,+CAA+C;IAChE,YAAY,EAAE,2DAA2D;IACzE,cAAc,EAAE,+CAA+C;IAC/D,eAAe,EAAE,2DAA2D;IAC5E,gBAAgB,EAAE,yEAAyE;IAC3F,gBAAgB,EAAE,yEAAyE;IAC3F,kBAAkB,EAAE,mFAAmF;IAEvG,8GAA8G;IAC9G,cAAc,EAAE,2DAA2D;IAC3E,WAAW,EAAE,sEAAsE;IACnF,aAAa,EAAE,2DAA2D;IAC1E,cAAc,EAAE,sEAAsE;IACtF,eAAe,EAAE,oFAAoF;IACrG,eAAe,EAAE,oFAAoF;IAErG,4EAA4E;IAC5E,gBAAgB,EAAE,mFAAmF;IACrG,qBAAqB,EAAE,mFAAmF;IAC1G,sBAAsB,EAAE,gEAAgE;IACxF,gBAAgB,EAAE,wDAAwD;IAC1E,gBAAgB,EAAE,wDAAwD;IAE1E,qCAAqC;IACrC,aAAa,EAAE,oDAAoD;IACnE,mBAAmB,EAAE,2DAA2D;IAChF,eAAe,EAAE,iEAAiE;IAClF,UAAU,EAAE,gEAAgE;IAE5E,wCAAwC;IACxC,YAAY,EAAE,0EAA0E;IACxF,sBAAsB,EAAE,8EAA8E;IACtG,sBAAsB,EAAE,+DAA+D;IACvF,wBAAwB,EAAE,iEAAiE;IAC3F,uBAAuB,EAAE,gEAAgE;IACzF,eAAe,EAAE,sFAAsF;IACvG,mBAAmB,EAAE,0EAA0E;IAC/F,qBAAqB,EAAE,6EAA6E;IACpG,cAAc,EAAE,iEAAiE;IACjF,qBAAqB,EAAE,yEAAyE;IAChG,cAAc,EAAE,0EAA0E;IAC1F,gBAAgB,EAAE,mDAAmD;IACrE,aAAa,EAAE,0EAA0E;IAEzF,mCAAmC;IACnC,cAAc,EAAE,gEAAgE;IAChF,YAAY,EAAE,0DAA0D;IACxE,cAAc,EAAE,8CAA8C;IAC9D,gBAAgB,EAAE,mEAAmE;IAErF,uCAAuC;IACvC,wBAAwB,EAAE,+FAA+F;IACzH,iBAAiB,EAAE,wFAAwF;IAC3G,qBAAqB,EAAE,qGAAqG;IAC5H,mBAAmB,EAAE,gFAAgF;IACrG,mBAAmB,EAAE,+GAA+G;IACpI,oBAAoB,EAAE,+FAA+F;IACrH,YAAY,EAAE,gJAAgJ;IAE9J,uCAAuC;IACvC,wBAAwB,EAAE,8EAA8E;IACxG,sBAAsB,EAAE,0FAA0F;IAClH,mBAAmB,EAAE,yFAAyF;IAC9G,4BAA4B,EAAE,sFAAsF;IACpH,aAAa,EAAE,kFAAkF;IACjG,oBAAoB,EAAE,+FAA+F;IACrH,gBAAgB,EAAE,qFAAqF;IAEvG,kCAAkC;IAClC,iBAAiB,EAAE,oFAAoF;IACvG,cAAc,EAAE,iFAAiF;IACjG,mBAAmB,EAAE,sFAAsF;IAC3G,gBAAgB,EAAE,mFAAmF;IACrG,wBAAwB,EAAE,qFAAqF;IAC/G,qBAAqB,EAAE,kFAAkF;IACzG,qBAAqB,EAAE,kFAAkF;IACzG,uBAAuB,EAAE,oFAAoF;IAC7G,sBAAsB,EAAE,mFAAmF;IAC3G,kBAAkB,EAAE,2EAA2E;IAC/F,kBAAkB,EAAE,2EAA2E;IAC/F,oBAAoB,EAAE,6EAA6E;IACnG,mBAAmB,EAAE,4EAA4E;IAEjG,iEAAiE;IACjE,mBAAmB,EAAE,sEAAsE;CACnF,CAAA;AAEV;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG;IACxC,8EAA8E;IAC9E,kEAAkE;IAClE,iBAAiB;IACjB,4EAA4E;IAC5E,+DAA+D;IAC/D,iBAAiB;IACjB,+EAA+E;IAC/E,wEAAwE;IACxE,wBAAwB,EAAE,8CAA8C;IACxE,yBAAyB,EAAE,8CAA8C;IACzE,0BAA0B,EAAE,oEAAoE;IAChG,0BAA0B,EAAE,6DAA6D;IACzF,8EAA8E;IAC9E,4DAA4D;IAC5D,0BAA0B,EAAE,wDAAwD;IACpF,+EAA+E;IAC/E,qEAAqE;IACrE,iBAAiB,EAAE,gCAAgC;IACnD,yEAAyE;IACzE,6EAA6E;IAC7E,8EAA8E;IAC9E,wEAAwE;IACxE,QAAQ,EAAE,kBAAkB;IAC5B,eAAe,EAAE,yBAAyB;IAC1C,0EAA0E;IAC1E,qEAAqE;IACrE,uBAAuB,EAAE,wCAAwC;IACjE,oEAAoE;IACpE,4EAA4E;IAC5E,6EAA6E;IAC7E,2EAA2E;IAC3E,8EAA8E;IAC9E,qCAAqC;IACrC,yBAAyB,EAAE,0CAA0C;IACrE,4BAA4B,EAAE,6CAA6C;CACnE,CAAA"}
+{"version":3,"file":"curated-operations.js","sourceRoot":"","sources":["../../src/spec/curated-operations.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAChF,wDAAwD;AACxD,EAAE;AACF,kBAAkB;AAClB,uEAAuE;AACvE,gFAAgF;AAChF,4EAA4E;AAC5E,2EAA2E;AAC3E,+EAA+E;AAC/E,4EAA4E;AAC5E,+EAA+E;AAC/E,yEAAyE;AACzE,4EAA4E;AAC5E,EAAE;AACF,0EAA0E;AAC1E,+EAA+E;AAC/E,6EAA6E;AAC7E,+EAA+E;AAC/E,4EAA4E;AAC5E,gFAAgF;AAChF,8DAA8D;AAC9D,EAAE;AACF,kDAAkD;AAClD,kFAAkF;AAClF,+EAA+E;AAC/E,+EAA+E;AAC/E,6EAA6E;AAC7E,uDAAuD;AAEvD;;;GAGG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,6CAA6C;IAC7C,mBAAmB,EAAE,mDAAmD;IACxE,mBAAmB,EAAE,gEAAgE;IACrF,gBAAgB,EAAE,gEAAgE;IAClF,kBAAkB,EAAE,mDAAmD;IACvE,qBAAqB,EAAE,yEAAyE;IAChG,mBAAmB,EAAE,gEAAgE;IAErF,qCAAqC;IACrC,eAAe,EAAE,8DAA8D;IAC/E,eAAe,EAAE,qDAAqD;IACtE,YAAY,EAAE,qDAAqD;IACnE,cAAc,EAAE,8DAA8D;IAC9E,eAAe,EAAE,qDAAqD;IAEtE,yCAAyC;IACzC,iBAAiB,EAAE,6DAA6D;IAChF,iBAAiB,EAAE,sEAAsE;IACzF,cAAc,EAAE,sEAAsE;IACtF,gBAAgB,EAAE,6DAA6D;IAC/E,mBAAmB,EAAE,qEAAqE;IAC1F,iBAAiB,EAAE,sEAAsE;IAEzF,gHAAgH;IAChH,eAAe,EAAE,+CAA+C;IAChE,YAAY,EAAE,2DAA2D;IACzE,cAAc,EAAE,+CAA+C;IAC/D,eAAe,EAAE,2DAA2D;IAC5E,gBAAgB,EAAE,yEAAyE;IAC3F,gBAAgB,EAAE,yEAAyE;IAC3F,kBAAkB,EAAE,mFAAmF;IAEvG,8GAA8G;IAC9G,cAAc,EAAE,2DAA2D;IAC3E,WAAW,EAAE,sEAAsE;IACnF,aAAa,EAAE,2DAA2D;IAC1E,cAAc,EAAE,sEAAsE;IACtF,eAAe,EAAE,oFAAoF;IACrG,eAAe,EAAE,oFAAoF;IAErG,4EAA4E;IAC5E,gBAAgB,EAAE,mFAAmF;IACrG,qBAAqB,EAAE,mFAAmF;IAC1G,sBAAsB,EAAE,gEAAgE;IACxF,gBAAgB,EAAE,wDAAwD;IAC1E,gBAAgB,EAAE,wDAAwD;IAE1E,qCAAqC;IACrC,aAAa,EAAE,oDAAoD;IACnE,mBAAmB,EAAE,2DAA2D;IAChF,eAAe,EAAE,iEAAiE;IAClF,UAAU,EAAE,gEAAgE;IAE5E,wCAAwC;IACxC,YAAY,EAAE,0EAA0E;IACxF,sBAAsB,EAAE,8EAA8E;IACtG,sBAAsB,EAAE,+DAA+D;IACvF,wBAAwB,EAAE,iEAAiE;IAC3F,uBAAuB,EAAE,gEAAgE;IACzF,eAAe,EAAE,sFAAsF;IACvG,mBAAmB,EAAE,0EAA0E;IAC/F,qBAAqB,EAAE,6EAA6E;IACpG,cAAc,EAAE,iEAAiE;IACjF,qBAAqB,EAAE,yEAAyE;IAChG,cAAc,EAAE,0EAA0E;IAC1F,gBAAgB,EAAE,mDAAmD;IACrE,aAAa,EAAE,0EAA0E;IAEzF,mCAAmC;IACnC,cAAc,EAAE,gEAAgE;IAChF,YAAY,EAAE,0DAA0D;IACxE,cAAc,EAAE,8CAA8C;IAC9D,gBAAgB,EAAE,mEAAmE;IAErF,uCAAuC;IACvC,wBAAwB,EAAE,+FAA+F;IACzH,iBAAiB,EAAE,wFAAwF;IAC3G,qBAAqB,EAAE,qGAAqG;IAC5H,mBAAmB,EAAE,gFAAgF;IACrG,mBAAmB,EAAE,+GAA+G;IACpI,oBAAoB,EAAE,+FAA+F;IACrH,YAAY,EAAE,gJAAgJ;IAE9J,uCAAuC;IACvC,wBAAwB,EAAE,8EAA8E;IACxG,sBAAsB,EAAE,0FAA0F;IAClH,mBAAmB,EAAE,yFAAyF;IAC9G,4BAA4B,EAAE,sFAAsF;IACpH,aAAa,EAAE,kFAAkF;IACjG,oBAAoB,EAAE,+FAA+F;IACrH,gBAAgB,EAAE,qFAAqF;IAEvG,kCAAkC;IAClC,iBAAiB,EAAE,oFAAoF;IACvG,cAAc,EAAE,iFAAiF;IACjG,mBAAmB,EAAE,sFAAsF;IAC3G,gBAAgB,EAAE,mFAAmF;IACrG,wBAAwB,EAAE,qFAAqF;IAC/G,qBAAqB,EAAE,kFAAkF;IACzG,qBAAqB,EAAE,kFAAkF;IACzG,uBAAuB,EAAE,oFAAoF;IAC7G,sBAAsB,EAAE,mFAAmF;IAC3G,kBAAkB,EAAE,2EAA2E;IAC/F,kBAAkB,EAAE,2EAA2E;IAC/F,oBAAoB,EAAE,6EAA6E;IACnG,mBAAmB,EAAE,4EAA4E;IAEjG,iEAAiE;IACjE,mBAAmB,EAAE,sEAAsE;CACnF,CAAA;AAEV;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG;IACxC,8EAA8E;IAC9E,kEAAkE;IAClE,iBAAiB;IACjB,4EAA4E;IAC5E,+DAA+D;IAC/D,iBAAiB;IACjB,+EAA+E;IAC/E,wEAAwE;IACxE,wBAAwB,EAAE,8CAA8C;IACxE,yBAAyB,EAAE,8CAA8C;IACzE,0BAA0B,EAAE,oEAAoE;IAChG,0BAA0B,EAAE,6DAA6D;IACzF,8EAA8E;IAC9E,4DAA4D;IAC5D,0BAA0B,EAAE,wDAAwD;IACpF,+EAA+E;IAC/E,qEAAqE;IACrE,iBAAiB,EAAE,gCAAgC;IACnD,yEAAyE;IACzE,6EAA6E;IAC7E,8EAA8E;IAC9E,wEAAwE;IACxE,QAAQ,EAAE,kBAAkB;IAC5B,eAAe,EAAE,yBAAyB;IAC1C,0EAA0E;IAC1E,qEAAqE;IACrE,uBAAuB,EAAE,wCAAwC;IACjE,oEAAoE;IACpE,4EAA4E;IAC5E,6EAA6E;IAC7E,2EAA2E;IAC3E,8EAA8E;IAC9E,qCAAqC;IACrC,yBAAyB,EAAE,0CAA0C;IACrE,4BAA4B,EAAE,6CAA6C;IAC3E,iFAAiF;IACjF,oFAAoF;IACpF,wEAAwE;IACxE,iFAAiF;IACjF,oFAAoF;IACpF,uBAAuB,EAAE,2BAA2B;CAC5C,CAAA"}

package/dist/spec/openapi.yaml

@@ -8326,6 +8326,11 @@ components:
       description: JWT bearer token issued by the identity provider.
       scheme: bearer
       type: http
+    BillingWebhookSignature:
+      description: Timestamped HMAC-SHA256 over the raw request body under the configured signing secret, proving an inbound billing event originated from the payment processor and is inside its tolerance window.
+      in: header
+      name: Stripe-Signature
+      type: apiKey
     CallbackToken:
       description: Opaque bearer token authenticating an external system's inbound exception callback.
       in: header
@@ -8460,6 +8465,39 @@ paths:
       summary: Suspend a workspace (backoffice)
       tags:
         - Onboarding
+  /v1/billing/webhook:
+    post:
+      description: "Receives a signed billing event from the payment processor and applies it to the workspace's commercial state. This route carries NO operator JWT and no tenant identifier of any kind: a processor event has no tenant until its customer id is resolved server-side. Authentication is the Stripe-Signature signature over the RAW request body, verified inside the processor's own tolerance window. It is fail-closed on configuration — with no signing secret configured every event is rejected, and there is no value that means accept anything. Delivery is idempotent by the processor's event id: a redelivery of an event already applied returns a quiet 200 and changes nothing, an event still being applied elsewhere returns 503 so the processor retries, and an event id reused with a DIFFERENT body is a 409 rather than an acknowledgement. A processing failure returns 5xx and never records the event as applied, so the processor's retry reclaims it. Errors use the RFC 9457 application/problem+json contract and never echo the signature, the secret or the body."
+      operationId: receiveBillingWebhook
+      parameters:
+        - description: The processor's signature over the raw body, verified inside the processor's own tolerance window.
+          in: header
+          name: Stripe-Signature
+          schema:
+            description: The processor's signature over the raw body, verified inside the processor's own tolerance window.
+            type: string
+      requestBody:
+        content:
+          application/octet-stream:
+            schema:
+              contentMediaType: application/octet-stream
+              format: binary
+              type: string
+        required: true
+      responses:
+        "200":
+          description: OK
+        default:
+          content:
+            application/problem+json:
+              schema:
+                $ref: "#/components/schemas/Detail"
+          description: Error
+      security:
+        - BillingWebhookSignature: []
+      summary: Receive a payment-processor billing event
+      tags:
+        - Onboarding
   /v1/contexts:
     get:
       description: Returns a cursor-paginated list of reconciliation contexts, optionally filtered by type and status.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lerianstudio/matcher-mcp",
-  "version": "4.5.0-beta.22",
+  "version": "4.5.0-beta.24",
   "type": "module",
   "description": "Model Context Protocol server for the Matcher reconciliation engine",
   "license": "Apache-2.0",