first commit

docs/PLATFORM-STATUS.md

@@ -0,0 +1,60 @@
+# Live platform status — mcp.loyaly.ai
+
+Probed 2026-09-09. `LOYALY_API_BASE=https://mcp.loyaly.ai`
+
+The host is confirmed as the Behavision platform: it answers the documented flat
+`{"error": "...", "message": "..."}` contract with the documented codes
+(`bad_credentials`, `unauthorized`, `not_found`, `bad_request`).
+
+**8 of the 16 endpoints the spec documents are not deployed yet.**
+A `401 unauthorized` proves the route exists and is gated. A
+`404 {"error":"not_found","message":"No such endpoint."}` means it is absent.
+
+## Live
+
+| Endpoint | Probe | Console feature |
+|---|---|---|
+| `POST /api/auth/login` | 401 `bad_credentials` | Sign in — **wired** |
+| `POST /api/auth/refresh` | 400 `refresh_token is required` | Token rotation — **wired** |
+| `POST /api/auth/logout` | 401 `unauthorized` | Sign out — **wired** |
+| `GET /api/auth/me` | 401 `unauthorized` | Session confirmation — **wired** |
+| `GET /api/sites` | 401 `unauthorized` | Site switcher + Store page — **wired** |
+| `GET /api/visitors` | 401 `unauthorized` | Customer directory — service written, UI not built |
+| `GET /api/reports/footfall` | 401 `unauthorized` | Visitors KPI + Footfall chart — **wired** |
+| `GET /api/reports/conversion` | 401 `unauthorized` | Purchases/Revenue/Conversion + Sales — **wired** |
+
+## Not deployed
+
+| Endpoint | Probe | Blocks |
+|---|---|---|
+| `GET /api/visits` | 404 | **Recent arrivals feed, Activity page** |
+| `POST /api/purchases` | 404 | **Mobile → dashboard purchase flow** |
+| `GET /api/team` | 404 | Leaderboard team table |
+| `GET /api/team/invitations` | 404 | Invite flow |
+| `GET /api/auth/invitation` | 404 | Join preview |
+| `POST /api/auth/register` | 404 | Redeeming an invitation |
+| `GET /api/auth/sessions` | 404 | Device management |
+| `GET /api/cameras` | 404 | Camera list / live view |
+
+## Consequence for the "most important requirement"
+
+The brief's §7 flow —
+
+```
+Mobile → POST /api/visits → DB → Dashboard GET /api/visits → new visit appears
+Mobile → POST /api/purchases → DB → reports update
+```
+
+— cannot run today. **Neither `/api/visits` nor `/api/purchases` is deployed.**
+The console side is built and pointed at both; they return 404 until the
+platform ships them.
+
+What *does* work end to end once there is an account: sign in, site switching,
+and every KPI and chart on the Dashboard and Sales pages, since those read the
+two report endpoints that are live.
+
+## Still needed
+
+A valid account on `mcp.loyaly.ai`. There is no open registration by design,
+and `POST /api/auth/register` is not deployed either — so an account has to be
+created directly on the platform side.