@lerianstudio/matcher-mcp 6.0.0-beta.16 → 6.0.0-beta.18

package/dist/spec/openapi.yaml

@@ -8933,6 +8933,10 @@ info:
     Two bounds close the contract. A response larger than about 1 MB is delivered to its caller in full, but it is not stored for replay: a duplicate under the same key is answered 409 `MTCH-0022` instead of replayed. And an over-sized body is refused with 413 and spends nothing. On every route but one the service-wide request body limit refuses it before the key is read. The streaming upload (`POST /v1/imports/contexts/{contextId}/sources/{sourceId}/upload`) is exempt from that limit: the key is read first and ingestion enforces its own upload limit inside the handler, so its 413 is a third answer that releases the key, and a smaller file may be re-sent under it.
 
     Secret mints are another, sharper exception. `POST /v1/discovery/aggregator-connections/{id}/connect-token`, `POST /v1/discovery/webhooks/tokens`, `POST /v1/exceptions/callbacks/credentials` and `POST /v1/exceptions/callbacks/credentials/{credentialId}/rotate` each return a raw credential exactly ONCE, and storing that answer would keep the secret re-readable for the life of the key — so those four routes IGNORE the idempotency header entirely. Nothing is stored, nothing is replayed, and `X-Idempotency-Replayed` is never sent on them. A retry under the same key MINTS AGAIN and leaves a second live credential behind, so treat a mint as non-idempotent: read the first attempt's response rather than resending it. A surplus callback credential or aggregator webhook token shows in its list operation (metadata only, never the secret) and is revoked through its own operation.
+
+    ## Refusals
+
+    An authorization refusal is answered with an `application/problem+json` document carrying a code, title and sentence. On every `/v1` route Matcher first checks a token that parses: on a multi-tenant deployment a token with no tenant claim is refused 403 `MTCH-0004`, and a malformed tenant claim or a missing `sub` is refused 401 `MTCH-0003`. The authorization layer then answers with its own codes: 401 `AUT-0006` (no bearer token) or `AUT-0007` (token expired, invalid or malformed); 401 `AUT-1009` or `AUT-1010` (the credential's partner is suspended or outside its validity period); 403 `AUT-1020` (the credential may not perform the `resource:action` the detail names); 403 `AUT-1016`, `AUT-1017`, `AUT-1018` or `AUT-1019` (the partner the request was made on behalf of belongs to another tenant, is suspended, is no longer valid, or may not perform it); 503 `AUT-0033` (the Access Manager did not decide the request) and 504 `AUT-1021` (it did not answer in time). Nothing ran on either 5xx: retry the same request, under the same idempotency key. A code the Access Manager answered itself, such as 403 `AUT-0021` (caller address not on the tenant allowlist), is relayed as code, title and detail at its status.
   license:
     name: Lerian Studio General License
   title: Matcher Reconciliation API

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lerianstudio/matcher-mcp",
-  "version": "6.0.0-beta.16",
+  "version": "6.0.0-beta.18",
   "type": "module",
   "description": "Model Context Protocol server for the Matcher reconciliation engine",
   "license": "LicenseRef-Lerian-Proprietary",