@lerianstudio/matcher-mcp 6.0.0-beta.2 → 6.0.0-beta.20

package/dist/spec/openapi.yaml

@@ -247,78 +247,6 @@ components:
         - createdAt
         - updatedAt
       type: object
-    AdminAssignPlanInputBody:
-      additionalProperties: false
-      properties:
-        plan:
-          description: "The plan code to assign. ONLY \"enterprise\" is accepted: self-serve plans are bought through checkout and converged from the live subscription's price, so assigning one here would be a payment-processor bypass the next processor delivery silently reverts. Any other code is refused with 409."
-          maxLength: 64
-          type: string
-      required:
-        - plan
-      type: object
-    AdminAssignPlanResult:
-      additionalProperties: false
-      properties:
-        billingStatus:
-          description: The commercial standing the workspace now holds. An enterprise contract is in good standing the moment it is signed, so this is always "active".
-          type: string
-        plan:
-          description: The plan the workspace now holds.
-          type: string
-        slug:
-          description: The workspace assigned.
-          type: string
-      required:
-        - slug
-        - plan
-        - billingStatus
-      type: object
-    AdminWorkspaceBilling:
-      additionalProperties: false
-      properties:
-        companyName:
-          description: Legal name the workspace signed up with — the party the invoice is issued to.
-          type: string
-        email:
-          description: Billing contact the invoice is sent to.
-          type: string
-        overageUncoveredCents:
-          description: "Overage already incurred that the credit balance has not covered, in integer BRL cents — what this workspace owes, and the amount to invoice. It is a receivable and never a negative balance: a new billing period does NOT clear it, it survives a trial-to-paid conversion, and a credit purchase settles it. 0 when nothing is owed."
-          format: int64
-          type: integer
-        slug:
-          description: The workspace read.
-          type: string
-        taxIdStatus:
-          description: "Whether the tax id could be read: \"available\" (on file, returned below), \"not_collected\" (the customer supplied none, or never reached checkout), or \"unavailable\" (the payment processor could not be asked — retry; this is NOT \"none supplied\")."
-          type: string
-        taxIdType:
-          description: "Which Brazilian tax id is held: br_cpf (individual) or br_cnpj (company). Present only when taxIdStatus is \"available\"."
-          type: string
-        taxIdValue:
-          description: The CPF/CNPJ as the customer entered it. Customer PII — present only when taxIdStatus is "available".
-          type: string
-      required:
-        - slug
-        - companyName
-        - email
-        - taxIdStatus
-        - overageUncoveredCents
-      type: object
-    AdminWorkspaceResult:
-      additionalProperties: false
-      properties:
-        action:
-          description: "The action applied: \"suspended\" or \"reactivated\"."
-          type: string
-        slug:
-          description: The workspace acted on.
-          type: string
-      required:
-        - slug
-        - action
-      type: object
     AgeBucketDTO:
       additionalProperties: false
       properties:
@@ -1326,38 +1254,6 @@ components:
       required:
         - status
       type: object
-    CheckoutBody:
-      additionalProperties: false
-      properties:
-        interval:
-          description: "Billing interval: \"monthly\" or \"annual\". It selects the payment methods the session offers — monthly is card, annual is boleto and Pix."
-          examples:
-            - monthly
-          maxLength: 16
-          type: string
-        plan:
-          description: Plan code to subscribe to. Must be a self-serve plan in the price list.
-          examples:
-            - tier_1
-          maxLength: 64
-          type: string
-      required:
-        - plan
-        - interval
-      type: object
-    CheckoutSessionResponse:
-      additionalProperties: false
-      properties:
-        sessionId:
-          description: "Processor-side session identifier, for support and correlation. It activates nothing: activation happens only through the verified webhook."
-          type: string
-        url:
-          description: Hosted checkout URL. Redirect the browser here.
-          type: string
-      required:
-        - url
-        - sessionId
-      type: object
     CloneContextRequest:
       additionalProperties: false
       properties:
@@ -2621,75 +2517,6 @@ components:
         - credentialId
         - createdAt
       type: object
-    CreditLedgerEntry:
-      additionalProperties: false
-      properties:
-        amountCents:
-          description: "How much the balance moved, in integer BRL cents. SIGNED: positive for a purchase, negative for a debit, so the entries sum to the balance."
-          format: int64
-          type: integer
-        balanceAfterCents:
-          description: The balance this movement left behind, in integer BRL cents.
-          format: int64
-          type: integer
-        createdAt:
-          description: When the movement was recorded (UTC).
-          format: date-time
-          type: string
-        period:
-          description: The enforcement period a debit was taken FOR. Omitted on a purchase, which belongs to no period, and on a trial's lifetime debit, which has none.
-          format: date-time
-          type: string
-        reason:
-          description: "Why the balance moved: \"purchase\", \"overage_debit\", or \"overage_debit_shortfall\" (the debit could not be covered in full and took the balance to zero)."
-          type: string
-        stripePaymentId:
-          description: The payment behind a purchase, for support and correlation. Omitted on a debit, which charges nothing.
-          type: string
-      required:
-        - amountCents
-        - balanceAfterCents
-        - reason
-        - createdAt
-      type: object
-    CreditLedgerPage:
-      additionalProperties: false
-      properties:
-        entries:
-          description: Recorded movements of the prepaid overage balance, newest first, capped server-side.
-          items:
-            $ref: "#/components/schemas/CreditLedgerEntry"
-          type:
-            - array
-            - "null"
-      required:
-        - entries
-      type: object
-    CreditPurchaseBody:
-      additionalProperties: false
-      properties:
-        amountCents:
-          description: How much credit to buy, in integer cents (BRL). The minimum and maximum come from the price list.
-          examples:
-            - 50000
-          format: int64
-          type: integer
-      required:
-        - amountCents
-      type: object
-    CreditPurchaseResponse:
-      additionalProperties: false
-      properties:
-        sessionId:
-          description: "Processor-side session identifier, for support and correlation. It credits nothing: the balance moves only through the verified webhook."
-          type: string
-        url:
-          description: Hosted payment URL. Redirect the browser here.
-          type: string
-      required:
-        - url
-        - sessionId
-      type: object
     CurrencyExposureResponse:
       additionalProperties: false
       properties:
@@ -3157,12 +2984,13 @@ components:
             - BUSINESS_DECISION
           type: string
         resolutionType:
-          description: "How the exception was resolved: FORCE_MATCH (override match), ADJUST_ENTRY (monetary correction), MANUAL_MATCH (the manual match that paired it), AUTO_CONSUME (closed automatically when a run settled its transaction against a carried open item) or UNMATCH_WITHDRAWN (withdrawn by an un-match: the match that raised it, or the manual match that resolved it, was undone)"
+          description: "How the exception was resolved: FORCE_MATCH (override match), ADJUST_ENTRY (monetary correction), MANUAL_MATCH (the manual match that paired it), AUTO_CONSUME (closed automatically when a run settled its transaction against a carried open item), AUTO_MATCH (closed automatically when a run matched its transaction, for a break whose reason only said its counterpart was missing or unusable: UNMATCHED, FX_RATE_UNAVAILABLE, MISSING_BASE_AMOUNT, MISSING_BASE_CURRENCY or SPLIT_INCOMPLETE) or UNMATCH_WITHDRAWN (withdrawn by an un-match: the match that raised it, or the match that resolved it, was undone)"
           enum:
             - FORCE_MATCH
             - ADJUST_ENTRY
             - MANUAL_MATCH
             - AUTO_CONSUME
+            - AUTO_MATCH
             - UNMATCH_WITHDRAWN
           examples:
             - FORCE_MATCH
@@ -6171,15 +5999,6 @@ components:
         - createdAt
         - updatedAt
       type: object
-    PortalSessionResponse:
-      additionalProperties: false
-      properties:
-        url:
-          description: Hosted customer-portal URL. Redirect the browser here. It is short-lived and single-customer.
-          type: string
-      required:
-        - url
-      type: object
     ProcessCallbackRequest:
       additionalProperties: false
       properties:
@@ -7406,43 +7225,6 @@ components:
         - left
         - right
       type: object
-    SignupBody:
-      additionalProperties: false
-      properties:
-        acceptTos:
-          description: Must be true; acceptance is recorded with a timestamp.
-          type: boolean
-        companyName:
-          description: Company/organization name; a URL-safe slug is derived from it.
-          examples:
-            - Acme Payments
-          maxLength: 200
-          type: string
-        email:
-          description: Work email; disposable domains are rejected.
-          examples:
-            - founder@acme.com
-          maxLength: 254
-          type: string
-        password:
-          description: Account password; 12–72 characters with letters and digits. The 72-byte cap is bcrypt's input limit.
-          maxLength: 72
-          type: string
-      required:
-        - email
-        - password
-        - companyName
-        - acceptTos
-      type: object
-    SignupResponse:
-      additionalProperties: false
-      properties:
-        message:
-          description: Human-readable acknowledgement (identical for known and unknown emails).
-          type: string
-      required:
-        - message
-      type: object
     SimulateFeeItem:
       additionalProperties: false
       properties:
@@ -9035,29 +8817,6 @@ components:
         - adjustmentsApplied
         - outstandingVariance
       type: object
-    VerifyBody:
-      additionalProperties: false
-      properties:
-        token:
-          description: The verification token from the signup email link.
-          maxLength: 512
-          type: string
-      required:
-        - token
-      type: object
-    VerifyResponse:
-      additionalProperties: false
-      properties:
-        message:
-          description: Human-readable verification result.
-          type: string
-        slug:
-          description: Workspace handle (the company slug) whose setup is now under way. Empty when the link was already used or has expired.
-          type: string
-      required:
-        - message
-        - slug
-      type: object
     VersionBody:
       additionalProperties: false
       properties:
@@ -9132,125 +8891,12 @@ components:
         - periodStart
         - periodEnd
       type: object
-    WorkspaceAuthConfig:
-      additionalProperties: false
-      properties:
-        clientId:
-          description: OAuth client id of the workspace's console application.
-          type: string
-        issuer:
-          description: Public base URL of the identity provider (the PKCE issuer).
-          type: string
-        organization:
-          description: Identity-provider organization name for the workspace.
-          type: string
-      required:
-        - clientId
-        - organization
-        - issuer
-      type: object
-    WorkspaceBilling:
-      additionalProperties: false
-      properties:
-        billingStatus:
-          description: "Commercial lifecycle: trialing, active, past_due, trial_expired (the free trial ran out of clock — the console stays readable and the upgrade path stays open), or suspended."
-          type: string
-        daysRemaining:
-          description: Whole days left in the trial (time axis), derived server-side. 0 when there is no trial or it has already ended.
-          format: int64
-          type: integer
-        expiryReason:
-          description: "Why the trial is over: \"\" (not expired), \"time\", \"volume\", or \"time_and_volume\"."
-          type: string
-        linesRemaining:
-          description: Free matched-line allotment left (volume axis), floored at 0. 0 when there is no trial or the allotment is spent.
-          format: int64
-          type: integer
-        matchedLineLimit:
-          description: Free-trial line ceiling the volume axis is measured against, read from the plan catalogue.
-          format: int64
-          type: integer
-        matchedLines:
-          description: "Lines consumed against the free-trial allotment (volume axis): distinct transactions matched, so a transaction re-matched under a different classification consumes one line and not two — the same figure the quota gate enforces on. Meaningful for a trialing or lapsed workspace; 0 for a paid plan."
-          format: int64
-          type: integer
-        maxCreditPurchaseCents:
-          description: Largest credit purchase the payment route accepts, in integer BRL cents.
-          format: int64
-          type: integer
-        minCreditPurchaseCents:
-          description: Smallest credit purchase the payment route accepts, in integer BRL cents.
-          format: int64
-          type: integer
-        monthlyLineAllowance:
-          description: Billable lines the plan includes per month, from the price list. Monthly on every plan regardless of billing interval. 0 when the plan is unmetered (see volumeUnmetered) or the stored plan code is not in the catalogue.
-          format: int64
-          type: integer
-        overageCreditBalanceCents:
-          description: Prepaid overage credit left, in integer BRL cents. Overage is debited from it daily; an exhausted balance blocks new matching, and unspent credit never expires.
-          format: int64
-          type: integer
-        overageRateCentsPerThousandLines:
-          description: What lines beyond the allowance cost, in integer BRL cents per THOUSAND lines (per-thousand because the entry rate is 0,4 cents a line and would truncate to zero). 0 when the plan is unmetered (see volumeUnmetered) or the stored plan code is not in the catalogue.
-          format: int64
-          type: integer
-        overageUncoveredCents:
-          description: "Overage already incurred that the credit balance has not covered, in integer BRL cents — what the workspace owes. It is a receivable and never a negative balance: a new billing period does NOT clear it, it survives a trial-to-paid conversion, and the next credit purchase settles it. 0 when nothing is owed."
-          format: int64
-          type: integer
-        plan:
-          description: Commercial plan the workspace is on ("free" or a paid tier).
-          type: string
-        provisioningFailed:
-          description: Whether setup has terminally failed. A failed setup is NOT retried — re-driving it cannot resolve the cause — and is distinguishable from one still in progress without reading logs.
-          type: boolean
-        provisioningState:
-          description: "Setup lifecycle of the workspace: \"provisioning\" (still being built), \"active\" (ready to use), or \"failed\" (setup will not complete on its own — we have been told)."
-          type: string
-        provisioningStep:
-          description: "The setup step that is owed: \"create_tenant\", \"associate_service\", \"migrate_tenant\", \"provision_console\", \"grant_admin\", or \"\" when nothing is owed. On a failed workspace this is the step it died on."
-          type: string
-        trialEndsAt:
-          description: When the free trial ends (UTC). Omitted for a paid plan that never trialed.
-          format: date-time
-          type: string
-        trialExpired:
-          description: Whether the trial is over on EITHER axis (time or volume), or the workspace is already suspended.
-          type: boolean
-        volumeUnmetered:
-          description: "Whether this plan is unmetered: its volume ceiling and its overage price are contractual (enterprise) rather than from the price list. When true, monthlyLineAllowance and overageRateCentsPerThousandLines are both 0 because no figure applies — do NOT render them as terms, and do not read the zero rate as free overage."
-          type: boolean
-      required:
-        - plan
-        - billingStatus
-        - daysRemaining
-        - matchedLines
-        - matchedLineLimit
-        - linesRemaining
-        - trialExpired
-        - expiryReason
-        - provisioningState
-        - provisioningStep
-        - provisioningFailed
-        - volumeUnmetered
-        - monthlyLineAllowance
-        - overageRateCentsPerThousandLines
-        - overageCreditBalanceCents
-        - overageUncoveredCents
-        - minCreditPurchaseCents
-        - maxCreditPurchaseCents
-      type: object
   securitySchemes:
     BearerAuth:
       bearerFormat: JWT
       description: JWT bearer token issued by the identity provider.
       scheme: bearer
       type: http
-    BillingWebhookSignature:
-      description: Timestamped HMAC-SHA256 over the raw request body under the configured signing secret, proving an inbound billing event originated from the payment processor and is inside its tolerance window.
-      in: header
-      name: Stripe-Signature
-      type: apiKey
     CallbackToken:
       description: Opaque bearer token authenticating an external system's inbound exception callback.
       in: header
@@ -9278,15 +8924,19 @@ info:
 
     A retry must repeat the original request. On an ordinary route the body is part of what identifies it, so a completed key re-sent with a DIFFERENT body is refused with 422 and nothing is applied — send the correction under a new key. The two file routes (`POST /v1/imports/contexts/{contextId}/sources/{sourceId}/upload` and the matching `/preview`) consume their body as a live stream and cannot re-read it, so there the key itself is the identity under that method and path: a completed key re-sent replays the first answer whatever file the retry carries.
 
-    A key is ONE attempt. A refusal the request earned is recorded like any other answer, and every resend under that key replays it for the retention window — a caller that wants to correct its request mints a new key. Three answers do NOT spend the key, because none of them is an answer to the request itself: a 429 from the rate limiter, a 402 from the volume quota, and a 502 with code `MTCH-0513`, where the dispatch target answered and DECLINED before anything was created there. Every other 5xx HOLDS the key, including that code's near neighbour, the dispatch whose outcome could not be confirmed (502, code `MTCH-0514`), whose exception may already exist in the target system: the outcome was not recorded, so every resend under that key is refused 409 `MTCH-0022` and nothing is sent again. Deliberately attempting such an operation again therefore requires a NEW key.
+    A key is ONE attempt. A refusal the request earned is recorded like any other answer, and every resend under that key replays it for the retention window — a caller that wants to correct its request mints a new key. Two answers do NOT spend the key, because neither is an answer to the request itself: a 429 from the rate limiter and a 502 with code `MTCH-0513`, where the dispatch target answered and DECLINED before anything was created there. Every other 5xx HOLDS the key, including that code's near neighbour, the dispatch whose outcome could not be confirmed (502, code `MTCH-0514`), whose exception may already exist in the target system: the outcome was not recorded, so every resend under that key is refused 409 `MTCH-0022` and nothing is sent again. Deliberately attempting such an operation again therefore requires a NEW key.
 
     `X-Idempotency-Fenced` rides every response whose outcome the guard could not receipt, a 2xx included. `true` means the hold landed: the key still protects the operation and every resend under it is refused 409. Only `false` means a resend would EXECUTE — the answer in hand may already have applied and the key no longer protects it, so check whether the first attempt took effect before sending anything again.
 
     `MTCH-0022` is the one code for a 409 saying an earlier attempt under this key already ran: it may already have applied and nothing is run again under that key, so keep the key and check the outcome before sending anything. Every other 409 refuses the request itself.
 
-    Two bounds close the contract. A response larger than about 1 MB is delivered to its caller in full, but it is not stored for replay: a duplicate under the same key is answered 409 `MTCH-0022` instead of replayed. And an over-sized body is refused with 413 and spends nothing. On every route but one the service-wide request body limit refuses it before the key is read. The streaming upload (`POST /v1/imports/contexts/{contextId}/sources/{sourceId}/upload`) is exempt from that limit: the key is read first and ingestion enforces its own upload limit inside the handler, so its 413 is a fourth answer that releases the key, and a smaller file may be re-sent under it.
+    Two bounds close the contract. A response larger than about 1 MB is delivered to its caller in full, but it is not stored for replay: a duplicate under the same key is answered 409 `MTCH-0022` instead of replayed. And an over-sized body is refused with 413 and spends nothing. On every route but one the service-wide request body limit refuses it before the key is read. The streaming upload (`POST /v1/imports/contexts/{contextId}/sources/{sourceId}/upload`) is exempt from that limit: the key is read first and ingestion enforces its own upload limit inside the handler, so its 413 is a third answer that releases the key, and a smaller file may be re-sent under it.
 
     Secret mints are another, sharper exception. `POST /v1/discovery/aggregator-connections/{id}/connect-token`, `POST /v1/discovery/webhooks/tokens`, `POST /v1/exceptions/callbacks/credentials` and `POST /v1/exceptions/callbacks/credentials/{credentialId}/rotate` each return a raw credential exactly ONCE, and storing that answer would keep the secret re-readable for the life of the key — so those four routes IGNORE the idempotency header entirely. Nothing is stored, nothing is replayed, and `X-Idempotency-Replayed` is never sent on them. A retry under the same key MINTS AGAIN and leaves a second live credential behind, so treat a mint as non-idempotent: read the first attempt's response rather than resending it. A surplus callback credential or aggregator webhook token shows in its list operation (metadata only, never the secret) and is revoked through its own operation.
+
+    ## Refusals
+
+    An authorization refusal is answered with an `application/problem+json` document carrying a code, title and sentence. On every `/v1` route Matcher first checks a token that parses: on a multi-tenant deployment a token with no tenant claim is refused 403 `MTCH-0004`, and a malformed tenant claim or a missing `sub` is refused 401 `MTCH-0003`. The authorization layer then answers with its own codes: 401 `AUT-0006` (no bearer token) or `AUT-0007` (token expired, invalid or malformed); 401 `AUT-1009` or `AUT-1010` (the credential's partner is suspended or outside its validity period); 403 `AUT-1020` (the credential may not perform the `resource:action` the detail names); 403 `AUT-1016`, `AUT-1017`, `AUT-1018` or `AUT-1019` (the partner the request was made on behalf of belongs to another tenant, is suspended, is no longer valid, or may not perform it); 503 `AUT-0033` (the Access Manager did not decide the request) and 504 `AUT-1021` (it did not answer in time). Nothing ran on either 5xx: retry the same request, under the same idempotency key. A code the Access Manager answered itself, such as 403 `AUT-0021` (caller address not on the tenant allowlist), is relayed as code, title and detail at its status.
   license:
     name: Lerian Studio General License
   title: Matcher Reconciliation API
@@ -9340,169 +8990,6 @@ paths:
       summary: Readiness check
       tags:
         - Health
-  /v1/admin/workspaces/{slug}/billing:
-    get:
-      description: "Returns what a human needs to issue this workspace's NFS-e by hand: the legal name, the billing contact, the CPF/CNPJ the customer supplied at checkout — read through from the payment processor on demand, never stored on this side — and the standing unpaid overage the invoice is for, in integer BRL cents. That amount is a receivable, not a negative balance: a new billing period does not clear it and it survives a trial-to-paid conversion, so what an operator reads here is what the customer still owes. taxIdStatus distinguishes \"available\" from \"not_collected\" (the customer supplied none) and \"unavailable\" (the processor could not be asked), so an unreachable processor degrades to a stated answer instead of an error and is never mistaken for a customer with no tax id. The tax id is customer PII and is returned ONLY here, to an operator gated by the workspace admin action; it is never logged or traced. The target slug comes from the URL path: this is a backoffice operation, NOT a tenant-scoped route. An unknown workspace returns 404. Errors use RFC 9457 problem+json."
-      operationId: admin-workspace-billing
-      parameters:
-        - description: Slug of the workspace to act on.
-          in: path
-          name: slug
-          required: true
-          schema:
-            description: Slug of the workspace to act on.
-            maxLength: 255
-            type: string
-      responses:
-        "200":
-          content:
-            application/json:
-              schema:
-                $ref: "#/components/schemas/AdminWorkspaceBilling"
-          description: OK
-        default:
-          content:
-            application/problem+json:
-              schema:
-                $ref: "#/components/schemas/Detail"
-          description: Error
-      security:
-        - BearerAuth: []
-      summary: Read a workspace's invoicing identification (backoffice)
-      tags:
-        - Onboarding
-  /v1/admin/workspaces/{slug}/plan:
-    put:
-      description: "Puts a workspace on the contractual enterprise plan: persists plan=enterprise and billing_status=active together, then evicts the billing edge-gate and volume-resolver caches so the contractual ceiling applies immediately. ONLY \"enterprise\" is accepted. This is not a generic set-plan operation: self-serve plans are bought through hosted checkout and converged from the live subscription's price, so assigning one by hand would be a payment-processor bypass that the next processor delivery silently reverts — any other plan code returns 409. It REFUSES a workspace whose subscription the payment processor could still bill (409): the operator cancels there first, where the proration and refund decision gets human eyes, and this route never moves processor money. That refusal covers every subscription that is not permanently over — one awaiting card authentication or one that is paused is not charging today and resumes tomorrow, and it would revert this plan the moment it does; only a cancelled or expired subscription is assignable over. If the processor cannot be asked, the request is refused as retryable (503) rather than allowed through. A suspended workspace is refused (409) because this operation moves no access posture — reactivate it first, and the write is compare-and-swapped on the status read, so a suspension landing mid-request is refused rather than reversed. There is no reverse: removing the enterprise plan is not offered. The target slug comes from the URL path (backoffice operation, workspace admin action). An unknown workspace returns 404. Errors use RFC 9457 problem+json. Every refusal on this route carries its own product code, because the sentence of a 503 is scrubbed before it leaves the process and the code is then the whole answer: 409 MTCH-0803 (a subscription the processor can still bill — cancel it there first), 409 MTCH-0804 (a plan code other than enterprise), 409 MTCH-0805 (the workspace's billing status does not allow the change — reload it), 503 MTCH-0802 (the processor could not be asked — retry) and 503 MTCH-0801 (no payment processor is configured on this deployment — NO retry clears it; the lever is configuration). MTCH-0805 is the same code the suspend and reactivate routes answer for a refused billing-status transition."
-      operationId: admin-assign-workspace-plan
-      parameters:
-        - description: Slug of the workspace to assign the plan to.
-          in: path
-          name: slug
-          required: true
-          schema:
-            description: Slug of the workspace to assign the plan to.
-            maxLength: 255
-            type: string
-      requestBody:
-        content:
-          application/json:
-            schema:
-              $ref: "#/components/schemas/AdminAssignPlanInputBody"
-        required: true
-      responses:
-        "200":
-          content:
-            application/json:
-              schema:
-                $ref: "#/components/schemas/AdminAssignPlanResult"
-          description: OK
-        default:
-          content:
-            application/problem+json:
-              schema:
-                $ref: "#/components/schemas/Detail"
-          description: Error
-      security:
-        - BearerAuth: []
-      summary: Assign the enterprise plan to a workspace (backoffice)
-      tags:
-        - Onboarding
-  /v1/admin/workspaces/{slug}/reactivate:
-    put:
-      description: "Restores a suspended workspace: persists billing_status=active, re-enables interactive console login at the IdP, reactivates the tenant at the Tenant Manager (best-effort), and evicts the billing edge-gate cache. The target slug comes from the URL path (backoffice operation, workspace admin action). Idempotent. Errors use RFC 9457 problem+json."
-      operationId: admin-reactivate-workspace
-      parameters:
-        - description: Slug of the workspace to act on.
-          in: path
-          name: slug
-          required: true
-          schema:
-            description: Slug of the workspace to act on.
-            maxLength: 255
-            type: string
-      responses:
-        "200":
-          content:
-            application/json:
-              schema:
-                $ref: "#/components/schemas/AdminWorkspaceResult"
-          description: OK
-        default:
-          content:
-            application/problem+json:
-              schema:
-                $ref: "#/components/schemas/Detail"
-          description: Error
-      security:
-        - BearerAuth: []
-      summary: Reactivate a suspended workspace (backoffice)
-      tags:
-        - Onboarding
-  /v1/admin/workspaces/{slug}/suspend:
-    put:
-      description: "Suspends a workspace's commercial access: persists billing_status=suspended (source of truth), cuts interactive console login at the IdP, suspends the tenant's matcher service association at the Tenant Manager (best-effort), and evicts the billing edge-gate cache so API traffic is cut within the gate TTL. The target slug comes from the URL path: this is a backoffice operation gated by the workspace admin action, NOT a tenant-scoped route — the operator acts across workspaces. Idempotent. Errors use RFC 9457 problem+json."
-      operationId: admin-suspend-workspace
-      parameters:
-        - description: Slug of the workspace to act on.
-          in: path
-          name: slug
-          required: true
-          schema:
-            description: Slug of the workspace to act on.
-            maxLength: 255
-            type: string
-      responses:
-        "200":
-          content:
-            application/json:
-              schema:
-                $ref: "#/components/schemas/AdminWorkspaceResult"
-          description: OK
-        default:
-          content:
-            application/problem+json:
-              schema:
-                $ref: "#/components/schemas/Detail"
-          description: Error
-      security:
-        - BearerAuth: []
-      summary: Suspend a workspace (backoffice)
-      tags:
-        - Onboarding
-  /v1/billing/webhook:
-    post:
-      description: "Receives a signed billing event from the payment processor and applies it to the workspace's commercial state. This route carries NO operator JWT and no tenant identifier of any kind: a processor event has no tenant until its customer id is resolved server-side. Authentication is the Stripe-Signature signature over the RAW request body, verified inside the processor's own tolerance window. It is fail-closed on configuration — with no signing secret configured every event is rejected, and there is no value that means accept anything. Delivery is idempotent by the processor's event id: a redelivery of an event already applied returns a quiet 200 and changes nothing, an event still being applied elsewhere returns 503 so the processor retries, and an event id reused with a DIFFERENT body is a 409 rather than an acknowledgement. A processing failure returns 5xx and never records the event as applied, so the processor's retry reclaims it. Errors use the RFC 9457 application/problem+json contract and never echo the signature, the secret or the body. The divergent-replay conflict carries its own product code, 409 MTCH-0811."
-      operationId: receiveBillingWebhook
-      parameters:
-        - description: The processor's signature over the raw body, verified inside the processor's own tolerance window.
-          in: header
-          name: Stripe-Signature
-          schema:
-            description: The processor's signature over the raw body, verified inside the processor's own tolerance window.
-            type: string
-      requestBody:
-        content:
-          application/octet-stream:
-            schema:
-              contentMediaType: application/octet-stream
-              format: binary
-              type: string
-        required: true
-      responses:
-        "200":
-          description: OK
-        default:
-          content:
-            application/problem+json:
-              schema:
-                $ref: "#/components/schemas/Detail"
-          description: Error
-      security:
-        - BillingWebhookSignature: []
-      summary: Receive a payment-processor billing event
-      tags:
-        - Onboarding
   /v1/contexts:
     get:
       description: Returns a cursor-paginated list of reconciliation contexts, optionally filtered by type and status.
@@ -17175,219 +16662,6 @@ paths:
       summary: Export variance report
       tags:
         - Reporting
-  /v1/signup:
-    post:
-      description: "Starts self-service onboarding. This is a PUBLIC, anonymous, pre-tenant route: it carries no operator JWT and creates no account yet. It validates the payload (email, password policy, company name, and mandatory Terms of Service acceptance) and stores a pending record whose TTL is the whole expiry mechanism. A company name whose derived slug is reserved (e.g. admin, api, www) is rejected with a 400 application/problem+json error. To prevent account enumeration, an email that is already registered or pending returns the SAME 202 response as a new one; a repeat signup for a still-pending email re-sends the verification email, throttled per address. The route is rate-limited per client IP. All errors use the RFC 9457 application/problem+json contract."
-      operationId: signup
-      requestBody:
-        content:
-          application/json:
-            schema:
-              $ref: "#/components/schemas/SignupBody"
-        required: true
-      responses:
-        "202":
-          content:
-            application/json:
-              schema:
-                $ref: "#/components/schemas/SignupResponse"
-          description: Accepted
-        default:
-          content:
-            application/problem+json:
-              schema:
-                $ref: "#/components/schemas/Detail"
-          description: Error
-      security: []
-      summary: Create a self-service signup
-      tags:
-        - Onboarding
-  /v1/signup/verify:
-    post:
-      description: "Completes email verification and starts self-service onboarding. This is a PUBLIC, anonymous, pre-tenant route: it exchanges the emailed verification token for a workspace whose setup is now under way, and returns the workspace handle. It does NOT wait for setup to finish — creating the environment includes a schema migration whose duration the server does not control, so a background worker drives it to completion and the response comes back immediately. It is idempotent: a repeat call records nothing new, and a token that no longer resolves (already used or expired) returns the same 200 response. The route is rate-limited per client IP. Its two conflicts carry their own product codes, and they are not the same answer: 409 MTCH-0812 (the workspace already exists and MAY be the caller's own — sign in, or sign up under another company name) and 409 MTCH-0813 (the name belongs to another account — only a different company name clears it)."
-      operationId: signup-verify
-      requestBody:
-        content:
-          application/json:
-            schema:
-              $ref: "#/components/schemas/VerifyBody"
-        required: true
-      responses:
-        "200":
-          content:
-            application/json:
-              schema:
-                $ref: "#/components/schemas/VerifyResponse"
-          description: OK
-        default:
-          content:
-            application/problem+json:
-              schema:
-                $ref: "#/components/schemas/Detail"
-          description: Error
-      security: []
-      summary: Verify a self-service signup
-      tags:
-        - Onboarding
-  /v1/workspace/billing:
-    get:
-      description: "Returns the authenticated tenant's own commercial state: its plan, billing status, and BOTH trial axes — the time axis (trial deadline + whole days remaining) and the volume axis (matched lines consumed, the free-tier ceiling, and lines remaining) — plus the unified trial-expiry verdict (whether the trial is over and why), all derived server-side. The tenant is resolved from the JWT tenant-slug claim — this endpoint never accepts a tenant identifier in the request and can only read the caller's own workspace. A tenant with no self-serve workspace record (the default/system tenant, or an unknown slug) returns 404. Errors use the RFC 9457 application/problem+json contract."
-      operationId: workspace-billing
-      responses:
-        "200":
-          content:
-            application/json:
-              schema:
-                $ref: "#/components/schemas/WorkspaceBilling"
-          description: OK
-        default:
-          content:
-            application/problem+json:
-              schema:
-                $ref: "#/components/schemas/Detail"
-          description: Error
-      security:
-        - BearerAuth: []
-      summary: Read the current workspace's commercial state
-      tags:
-        - Onboarding
-  /v1/workspace/billing-portal:
-    post:
-      description: "Opens the payment processor's hosted customer portal for the AUTHENTICATED tenant's own workspace and returns the URL to redirect the browser to. Card update, invoice history and cancellation live there, not here; cancellation takes effect at the end of the period already paid for. Errors use the RFC 9457 application/problem+json contract. Its two refusals carry their own product codes: 409 MTCH-0806 (plan set by contract, so there is no self-serve subscription to manage) and 409 MTCH-0810 (no billing account yet — subscribe first)."
-      operationId: workspace-billing-portal
-      responses:
-        "200":
-          content:
-            application/json:
-              schema:
-                $ref: "#/components/schemas/PortalSessionResponse"
-          description: OK
-        default:
-          content:
-            application/problem+json:
-              schema:
-                $ref: "#/components/schemas/Detail"
-          description: Error
-      security:
-        - BearerAuth: []
-      summary: Open the customer billing portal for the current workspace
-      tags:
-        - Onboarding
-  /v1/workspace/checkout:
-    post:
-      description: "Opens a hosted checkout session that subscribes the AUTHENTICATED tenant's own workspace to a self-serve plan, and returns the URL to redirect the browser to. The workspace is resolved from the JWT tenant-slug claim: this endpoint never accepts a tenant identifier in the body, path, query or headers, and the session is bound to the caller's tenant. The billing interval selects the payment methods — monthly is card, annual is boleto and Pix — so a session is never created with an instrument the amount cannot clear. A plan that is not self-serve, an unknown plan or interval, and a workspace that already has a subscription are all refused before the processor is called. The return URLs carry no activation-bearing parameter: the plan is activated only by the verified webhook, and the return page reads the resulting state from GET /v1/workspace/billing. Errors use the RFC 9457 application/problem+json contract. Each refusal carries its own product code so a client never has to read the sentence: 409 MTCH-0806 (plan set by contract), 409 MTCH-0807 (already subscribed), 409 MTCH-0808 (a checkout is open for a different plan or interval), 409 MTCH-0809 (a checkout is being opened right now — retry), 422 MTCH-0814 (the plan is not sold self-serve) and 400 MTCH-0001 (unknown plan or interval)."
-      operationId: workspace-checkout
-      requestBody:
-        content:
-          application/json:
-            schema:
-              $ref: "#/components/schemas/CheckoutBody"
-        required: true
-      responses:
-        "200":
-          content:
-            application/json:
-              schema:
-                $ref: "#/components/schemas/CheckoutSessionResponse"
-          description: OK
-        default:
-          content:
-            application/problem+json:
-              schema:
-                $ref: "#/components/schemas/Detail"
-          description: Error
-      security:
-        - BearerAuth: []
-      summary: Open a subscription checkout for the current workspace
-      tags:
-        - Onboarding
-  /v1/workspace/credit-ledger:
-    get:
-      description: "Returns the AUTHENTICATED tenant's own prepaid overage-credit movements, newest first: every purchase and every daily overage debit, each with its signed amount, the balance it left behind, and why it happened. The daily debit only does its job if the customer can see it — a balance that moves with no readable explanation is money nobody can reconcile. The workspace is resolved from the JWT tenant-slug claim: this endpoint never accepts a tenant identifier in the request and can only read the caller's own movements. The result is capped server-side and has no pagination. A tenant with no self-serve workspace record returns 404. Errors use the RFC 9457 application/problem+json contract."
-      operationId: workspace-credit-ledger
-      responses:
-        "200":
-          content:
-            application/json:
-              schema:
-                $ref: "#/components/schemas/CreditLedgerPage"
-          description: OK
-        default:
-          content:
-            application/problem+json:
-              schema:
-                $ref: "#/components/schemas/Detail"
-          description: Error
-      security:
-        - BearerAuth: []
-      summary: Read the current workspace's prepaid-credit movements
-      tags:
-        - Onboarding
-  /v1/workspace/credit-purchase:
-    post:
-      description: "Opens a ONE-OFF hosted payment session that buys prepaid overage credit for the AUTHENTICATED tenant's own workspace, and returns the URL to redirect the browser to. It is never a subscription. The workspace is resolved from the JWT tenant-slug claim: this endpoint never accepts a tenant identifier in the body, path, query or headers. Any workspace on a self-serve plan may buy — trialing, lapsed, monthly or annual — because the customer who has run out of allowance is the one being told to buy. A workspace on a CONTRACTUAL plan is refused with 409: its volume is not metered, so prepaid overage credit buys it nothing. Payment is by CARD on every plan, including annual: the instrument that funds overage credit is deliberately not the subscription's instrument, and the card is saved for future CREDIT purchases only. An amount outside the price list's minimum and maximum is refused before the processor is called. The credit balance moves ONLY when the processor confirms the payment through the verified webhook — never on the return page and never in this response. Errors use the RFC 9457 application/problem+json contract. Its two refusals carry their own product codes: 422 MTCH-0815 (the amount is outside the purchasable range) and 409 MTCH-0806 (plan set by contract, so volume is not metered and credit buys nothing)."
-      operationId: workspace-credit-purchase
-      requestBody:
-        content:
-          application/json:
-            schema:
-              $ref: "#/components/schemas/CreditPurchaseBody"
-        required: true
-      responses:
-        "200":
-          content:
-            application/json:
-              schema:
-                $ref: "#/components/schemas/CreditPurchaseResponse"
-          description: OK
-        default:
-          content:
-            application/problem+json:
-              schema:
-                $ref: "#/components/schemas/Detail"
-          description: Error
-      security:
-        - BearerAuth: []
-      summary: Buy prepaid overage credit for the current workspace
-      tags:
-        - Onboarding
-  /v1/workspaces/{slug}/auth-config:
-    get:
-      description: "Resolves the minimum a browser needs to start a PKCE login for a workspace: the console OAuth client id, the identity-provider organization, and the public issuer URL. This is a PUBLIC, anonymous, read-only, pre-tenant route: it carries no operator JWT and returns nothing about the account, its owner, or its lifecycle. It answers only for ACTIVE workspaces; a nonexistent, still-provisioning, or suspended workspace returns an IDENTICAL 404 (no enumeration of lifecycle state). The response is briefly cacheable and the route is rate-limited per client IP. Errors use the RFC 9457 application/problem+json contract."
-      operationId: workspace-auth-config
-      parameters:
-        - description: Workspace slug as typed on the login screen.
-          in: path
-          name: slug
-          required: true
-          schema:
-            description: Workspace slug as typed on the login screen.
-            examples:
-              - acme
-            maxLength: 63
-            type: string
-      responses:
-        "200":
-          content:
-            application/json:
-              schema:
-                $ref: "#/components/schemas/WorkspaceAuthConfig"
-          description: OK
-          headers:
-            Cache-Control:
-              schema:
-                description: Short public cache lifetime for the login config.
-                type: string
-        default:
-          content:
-            application/problem+json:
-              schema:
-                $ref: "#/components/schemas/Detail"
-          description: Error
-      security: []
-      summary: Resolve a workspace's public login configuration
-      tags:
-        - Onboarding
   /version:
     get:
       description: Returns the service build version (from the VERSION environment variable, default 0.0.0) and the server UTC timestamp.