@smartytalent/mcp-tools 0.7.1 → 0.7.3

package/dist/tools.json

@@ -349,7 +349,15 @@
                 "plan": {
                   "type": "string",
                   "minLength": 1,
-                  "maxLength": 255
+                  "maxLength": 255,
+                  "enum": [
+                    "startup",
+                    "growth",
+                    "expansion",
+                    "corporate",
+                    "system"
+                  ],
+                  "description": "Billing plan. The API Gateway authorizer maps custom:userPlan onto a usage plan key and falls back to `system` - the PLATFORM's own plan - for anything it does not recognise, so an invented name does not fail, it silently meters that customer against our internal quota. `enterprise` was such a name (a second word for `corporate`) and was folded into it 2026-07-27. NOTE: the server checks this list explicitly, because validate_item honours type/pattern/length but IGNORES enum."
                 },
                 "activeLanguages": {
                   "type": "array",
@@ -809,7 +817,15 @@
                 "plan": {
                   "type": "string",
                   "minLength": 1,
-                  "maxLength": 255
+                  "maxLength": 255,
+                  "enum": [
+                    "startup",
+                    "growth",
+                    "expansion",
+                    "corporate",
+                    "system"
+                  ],
+                  "description": "Billing plan. The API Gateway authorizer maps custom:userPlan onto a usage plan key and falls back to `system` - the PLATFORM's own plan - for anything it does not recognise, so an invented name does not fail, it silently meters that customer against our internal quota. `enterprise` was such a name (a second word for `corporate`) and was folded into it 2026-07-27. NOTE: the server checks this list explicitly, because validate_item honours type/pattern/length but IGNORES enum."
                 },
                 "activeLanguages": {
                   "type": "array",
@@ -1314,6 +1330,14 @@
                   "type": "string",
                   "description": "The admin-consent link an operator sends to the customer's IT. Built server-side so the app registration id is never hardcoded in a client. Absent if the platform Microsoft provider cannot be read."
                 },
+                "sessionsRevoked": {
+                  "type": "integer",
+                  "description": "POST response, present ONLY on the transition to required=true: how many accounts were signed out everywhere. The PreAuthentication gate stops new password sign-ins but never fires on token refresh, and a refresh token lives 30 days - so without this sweep the switch would take a month to take effect for anyone already signed in. Nobody is exempt, including the break-glass roles: they keep their password and simply sign in again."
+                },
+                "sessionsFailed": {
+                  "type": "integer",
+                  "description": "POST response, alongside sessionsRevoked: accounts the sweep could not sign out. Non-zero means the door is partially open - those sessions keep working until their refresh token expires - and the operator is the only one positioned to see it, which is why it is returned rather than only logged."
+                },
                 "idpDeleted": {
                   "type": "boolean",
                   "description": "DELETE response only: whether the customer's Cognito identity provider was actually removed. False when it was already gone, so a retry of the teardown reads as success rather than an error."
@@ -1327,7 +1351,7 @@
                 },
                 "loginUrl": {
                   "type": "string",
-                  "description": "Ready-made login link for this customer's employees (a tile in their Entra My Apps, an intranet bookmark, the welcome email). Carries identity_provider so Cognito goes straight to their Entra. There is deliberately no email-domain discovery endpoint: Cognito's own domain routing is SAML-only, and a public discovery endpoint would be an oracle for whether a given company is our customer. Lands in the myaccount app, which every role can reach - a JIT employee in the pending state has no role yet, so a role-scoped app would refuse them and the link would look broken. Derived on read, never stored. Absent if the enterprise app client cannot be read."
+                  "description": "Ready-made login link for this customer's employees (a tile in their Entra My Apps, an intranet bookmark, the welcome email), of the form https://myaccount.{domain}/sso?idp=ms-{shortCode}. It points at the APP, never at Cognito's authorize endpoint: nextauth refuses a callback it did not initiate, because the state, nonce and PKCE verifier it validates against live in cookies it sets while building the authorize URL itself - a hand-assembled Cognito link fails with 'State cookie was missing' however correct its parameters are. The page forwards idp as identity_provider, which also keeps the enterprise client's hosted page from drawing a button for every customer IdP on it. There is deliberately no email-domain discovery endpoint: Cognito's own domain routing is SAML-only, and a public discovery endpoint would be an oracle for whether a given company is our customer. Lands in the myaccount app, which every role can reach - a JIT employee in the pending state has no role yet, so a role-scoped app would refuse them and the link would look broken. Derived on read, never stored."
                 }
               }
             }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@smartytalent/mcp-tools",
-  "version": "0.7.1",
+  "version": "0.7.3",
   "description": "MCP tool definitions for SmartyTalent API",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",