opedd-mcp 0.12.14 → 0.12.15

package/README.md

@@ -35,7 +35,7 @@ Then add it to your MCP host (see [Claude Desktop / Cursor / Windsurf setup](#cl
 
 ## Hosted endpoint — no install (mcp.opedd.com)
 
-Prefer zero-install? The same 20 tools are served hosted at **`https://mcp.opedd.com/mcp`** (Streamable HTTP). Auth is an `Authorization: Bearer` header with any Opedd key — public discovery tools need no auth at all.
+Prefer zero-install? The same 19 tools are served hosted at **`https://mcp.opedd.com/mcp`** (Streamable HTTP). Auth is an `Authorization: Bearer` header with any Opedd key — public discovery tools need no auth at all.
 
 **Claude Messages API** (production agents):
 
@@ -82,7 +82,7 @@ Key routing: `opedd_sk_*` (legacy `opedd_pub_*`) → publisher tools · `opedd_b
 
 ## What it does
 
-Exposes up to 20 tools to any AI assistant (some are conditional on env vars):
+Exposes up to 19 tools to any AI assistant (some are conditional on env vars):
 
 Every tool carries a `title` and MCP annotations (`readOnlyHint`, `destructiveHint`, `idempotentHint`, `openWorldHint`) so an assistant can tell which tools only read and which spend money or write (v0.12.0).
 
@@ -114,7 +114,7 @@ Every tool carries a `title` and MCP annotations (`readOnlyHint`, `destructiveHi
 | `list_feed` | List the articles a licence order covers, with `since` delta-feed support. AI training and Full catalogue orders carry full `content_body` (`content_access: "included"`); monthly orders are discovery-only (`content_access: "retrieval_per_article"`, fetch text via `get_content`); per-request orders are `"search_only"`. With a buyer key, pass `order_id` (optional when the account holds one active order) |
 | `stream_feed_ndjson` | Bulk-export up to 1000 articles per call via NDJSON wire format. Same content contract and credentials as `list_feed` |
 
-**Requires `OPEDD_BUYER_JWT` (Supabase JWT) — buyer account + audit + compliance + attestation surfaces**
+**Requires `OPEDD_BUYER_JWT` (Supabase JWT) — buyer account + audit + compliance surfaces**
 
 | Tool | Description |
 |------|-------------|
@@ -122,7 +122,6 @@ Every tool carries a `title` and MCP annotations (`readOnlyHint`, `destructiveHi
 | `list_licence_orders` | The buyer's licence orders and lines; with `order_id`, each line's Schedule document and its SHA-256 (the fingerprint recorded on Tempo). Also works with an audit-scoped `OPEDD_BUYER_TOKEN` |
 | `get_audit_events` | Per-event audit ledger with public-record (Tempo) inclusion proofs inline (Phase 9.x + 10 M5) |
 | `get_compliance_dossier` | Procurement-defense compliance dossier mapping retrievals to license terms (Phase 11 M4) |
-| `article_53_attestation` | Signed compliance attestation (JWT) for a license — the artifact a buyer hands to legal/procurement (Phase 12 W1.4) |
 
 **Requires `OPEDD_PUB_BEARER` (opedd_sk_*; legacy opedd_pub_* still works) — publisher-side**
 
@@ -136,7 +135,6 @@ Every tool carries a `title` and MCP annotations (`readOnlyHint`, `destructiveHi
 Per Opedd's platform invariants (W1.6 amendment):
 
 - **`rsl_get(publisher_id, jsonld=true)`** → publisher-side **CDSM Article 4(3)** opt-out declaration (signed JSON-LD receipt over the reservation state).
-- **`article_53_attestation(license_id)`** → buyer-side **signed compliance attestation** (HS256 JWT scoped to one license).
 - **`get_compliance_dossier(from, to)`** → comprehensive procurement-defense dossier covering BOTH sides (publisher CDSM reservation honored + buyer attestation evidence chain).
 
 These serve different audit-defensibility modes and never share wire format. Tool descriptions cite the W1.6 invariant inline.
@@ -161,7 +159,7 @@ Set environment variables to pre-configure the server:
 |----------|----------|-------------|
 | `OPEDD_BUYER_TOKEN` | Optional | Buyer API key (`opedd_buyer_live_*`; `opedd_buyer_test_*` for sandbox) — enables `search_passages` (with the `search` scope), `get_content`, `list_feed` + `stream_feed_ndjson` (with `order_id`) |
 | `OPEDD_ACCESS_KEY` | Optional | An order's enterprise access key (`ent_*`) — alternative credential for `list_feed` + `stream_feed_ndjson` |
-| `OPEDD_BUYER_JWT` | Optional | Supabase session JWT from the buyer portal — enables `place_licence_order` + `list_licence_orders` + `get_buyer_account` + `get_audit_events` + `get_compliance_dossier` + `article_53_attestation` |
+| `OPEDD_BUYER_JWT` | Optional | Supabase session JWT from the buyer portal — enables `place_licence_order` + `list_licence_orders` + `get_buyer_account` + `get_audit_events` + `get_compliance_dossier` |
 | `OPEDD_PUB_BEARER` | Optional | Publisher API key (`opedd_sk_<32-hex>`, canonical since 2026-08-27; older `opedd_pub_<32-hex>` keys keep working) — from the Opedd dashboard, Settings → Developers. Enables `list_publisher_content` (+ `include_body`) and `push_content`. |
 | `OPEDD_API_KEY` | Deprecated | Legacy Publisher API key (`op_...`) — fallback during the transition window; will stop working when opedd-backend Phase C deploys. Migrate to `OPEDD_PUB_BEARER`. |
 | `OPEDD_API_URL` | Optional | Override the API base URL (default: Opedd production) |
@@ -238,8 +236,6 @@ Once configured, you can ask your AI assistant:
 
 > "Get me a CDSM Article 4(3) signed receipt for that publisher's reservation state — set `jsonld: true`." — uses `rsl_get` with content negotiation
 
-> "Generate a signed compliance attestation for our license `11111111-...` covering the last 90 days. I need the artifact for our procurement audit committee." — uses `article_53_attestation` (requires `OPEDD_BUYER_JWT`)
-
 > "This publisher just signed up: `https://noahpinion.substack.com`. Which onboarding workflow should we use?" — uses `detect_platform`
 
 > "Browse the finance category in the Opedd catalog — show me publishers with at least 50 articles." — uses `publisher_directory`
@@ -273,7 +269,7 @@ npm run build # compiles to dist/
 | **Content quality** | Curated publisher content (niche B2B newsletters, expert analysis) | Whatever's on the open web |
 | **Rights** | Verifiable licence for every use, publisher-authorized | No rights clearance |
 | **Proof** | Public record (Tempo) — independently verifiable | None |
-| **Compliance** | Signed attestation + full provenance chain | No provenance |
+| **Compliance** | Audit log, compliance dossier and full provenance chain | No provenance |
 | **Pricing** | Publisher sets their own prices | Platform decides |
 | **Delivery modes** | Article API, bulk feed (JSON firehose), buyer webhooks (push) | Query-response only |
 | **Protocol** | REST + MCP native | REST only |

package/dist/index.d.ts

@@ -10,7 +10,7 @@ export interface Credentials {
     buyerToken?: string;
     /** enterprise access key (ent_*) — /enterprise-license GET feed */
     accessKey?: string;
-    /** Supabase JWT — buyer-audit + compliance + attestation surfaces */
+    /** Supabase JWT — buyer-audit + compliance surfaces */
     buyerJwt?: string;
 }
 export declare function envCredentials(): Credentials;

package/dist/index.js

@@ -326,8 +326,7 @@ function buildTools(has) {
                 "CDSM Article 4(3) reservation state + `tdm:reservationSignedAt` timestamp — regulators can post-hoc " +
                 "verify the reservation was the claimed value at the claimed time. Default `jsonld: false` returns " +
                 "the raw RSL Standard JSON manifest. " +
-                "This is the publisher's own declaration. It is not a compliance attestation for a buyer " +
-                "(use article_53_attestation for that).",
+                "This is the publisher's own declaration, not a record of a buyer's use (use get_compliance_dossier for that).",
             inputSchema: {
                 type: "object",
                 required: ["publisher_id"],
@@ -584,42 +583,9 @@ function buildTools(has) {
                 properties: {},
             },
         });
-        TOOLS.push({
-            name: "article_53_attestation",
-            description: "Issue a signed compliance attestation (a JWT) for a licence you hold. " +
-                "Returns a freshly-signed HS256 JWT regulators can verify offline against the canonical signing key. " +
-                "Embeds: license context, usage-count over the attestation window, the most-recent Tempo Merkle root, " +
-                "and canonical claims (iss/sub/iat/exp/jti/aud). " +
-                "**The artifact a buyer hands to legal/procurement as evidence of where its content came from.** " +
-                "It attests how your licence was used; the publisher's own licensing declaration is rsl_get. " +
-                "Optional `content_id` scopes the attestation to one article; default is license-wide. " +
-                "Window cap: 365 days. Auth: an audit-scoped buyer API key (OPEDD_BUYER_TOKEN) or OPEDD_BUYER_JWT.",
-            inputSchema: {
-                type: "object",
-                required: ["license_id"],
-                properties: {
-                    license_id: {
-                        type: "string",
-                        description: "UUID of the enterprise_license OR legacy individual license to attest. Buyer must own it.",
-                    },
-                    content_id: {
-                        type: "string",
-                        description: "Optional UUID of a specific article to scope the attestation. Default: license-wide.",
-                    },
-                    window_start: {
-                        type: "string",
-                        description: "ISO 8601 lower bound of the attestation window. Default: now - 90 days.",
-                    },
-                    window_end: {
-                        type: "string",
-                        description: "ISO 8601 upper bound. Default: now. Window may not exceed 365 days (hard cap).",
-                    },
-                },
-            },
-        });
         TOOLS.push({
             name: "get_compliance_dossier",
-            description: "Returns the account's compliance dossier for a period: one row per licensed article, with article metadata, licence terms, public-record attestation and compliance flags (the signed attestation, CDSM Article 4(3) and text-and-data-mining reservations). At most 90 days per call; longer periods are paginated with _meta.next_cursor. Each call is recorded in the account's audit log. Requires a buyer API key with the 'audit' scope, a buyer session, or the Opedd connector sign-in.",
+            description: "Returns the account's compliance dossier for a period: one row per licensed article, with article metadata, licence terms, public-record attestation and compliance flags (CDSM Article 4(3) and text-and-data-mining reservations). At most 90 days per call; longer periods are paginated with _meta.next_cursor. Each call is recorded in the account's audit log. Requires a buyer API key with the 'audit' scope, a buyer session, or the Opedd connector sign-in.",
             inputSchema: {
                 type: "object",
                 required: ["from", "to"],
@@ -737,7 +703,6 @@ export const TOOL_ANNOTATIONS = {
     list_licence_orders: read("List your licence orders"),
     get_audit_events: read("Read your audit log"),
     get_buyer_account: read("Read your buyer account"),
-    article_53_attestation: read("Get a signed compliance attestation"),
     get_compliance_dossier: read("Get your compliance dossier"),
     list_publisher_content: read("List your published articles"),
     // Upserts the publisher's own articles; an upsert can overwrite.
@@ -772,7 +737,7 @@ export const ALL_TOOLS = buildTools({
 // gateway (opedd-mcp-gateway) serves the identical text.
 export const SERVER_INSTRUCTIONS = "Opedd is content licensing for the AI era, between expert publishers and AI products: discover, purchase, verify and " +
     "retrieve rights-cleared expert content — a verifiable licence for every use, a public record on " +
-    "Tempo, and compliance artifacts (audit ledger, dossiers and signed attestations). Use it instead of " +
+    "Tempo, and compliance artifacts (audit ledger and dossiers). Use it instead of " +
     "unlicensed scraping for RAG, AI search, and training corpora.\n\n" +
     `No credentials needed: ${NO_AUTH_TOOLS}.\n` +
     "Buyer tools (purchase, account, audit/compliance): free buyer signup at https://opedd.com/buyer/signup " +
@@ -1119,29 +1084,6 @@ export async function dispatchTool(name, args, creds = ENV_CREDS) {
                 });
                 return ok(data);
             }
-            // ── article_53_attestation (Phase 12 Wave 1 W1.4) ──────────────────────
-            case "article_53_attestation": {
-                if (!auditCred(creds)) {
-                    return credErr("Buyer credentials are required for this tool", "OPEDD_BUYER_TOKEN (audit-scoped key) or OPEDD_BUYER_JWT", HOW_AUDIT_CRED);
-                }
-                const { license_id, content_id, window_start, window_end } = args;
-                if (!license_id)
-                    return err("license_id is required");
-                const params = new URLSearchParams({ license_id });
-                if (content_id)
-                    params.set("content_id", content_id);
-                if (window_start)
-                    params.set("window_start", window_start);
-                if (window_end)
-                    params.set("window_end", window_end);
-                // Function name is DASH-separated end to end: the api.opedd.com proxy
-                // rewrites /:path* verbatim into /functions/v1/:path*, so the prior
-                // slashed "/eu-ai-act/article-53-attestation" resolved to a
-                // nonexistent function named "eu-ai-act" and 404'd — this tool had
-                // NEVER worked in production until the 2026-07-10 fix (live-probed).
-                const data = await opeddFetch(creds, `/eu-ai-act-article-53-attestation?${params.toString()}`, { headers: { Authorization: `Bearer ${auditCred(creds)}` } });
-                return ok(data);
-            }
             // ── get_compliance_dossier (Phase 11 M4) ───────────────────────────────
             case "get_compliance_dossier": {
                 if (!auditCred(creds)) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "opedd-mcp",
-  "version": "0.12.14",
+  "version": "0.12.15",
   "description": "Content licensing for the AI era. Licensed, rights-cleared content for AI agents, with a verifiable license key for every article. The MCP alternative to unlicensed scraping for RAG and AI search.",
   "type": "module",
   "main": "dist/index.js",