opedd-mcp 0.2.0 → 0.3.0

package/src/index.ts

@@ -7,6 +7,7 @@ import {
   ListToolsRequestSchema,
   type Tool,
 } from "@modelcontextprotocol/sdk/types.js";
+import { pathToFileURL } from "node:url";
 
 // ─── Configuration ────────────────────────────────────────────────────────────
 
@@ -17,8 +18,8 @@ const API_BASE =
 const BUYER_EMAIL = process.env.OPEDD_BUYER_EMAIL;
 const PAYMENT_METHOD_ID = process.env.OPEDD_PAYMENT_METHOD_ID;
 const API_KEY = process.env.OPEDD_API_KEY; // publisher API key (op_...)
-const BUYER_TOKEN = process.env.OPEDD_BUYER_TOKEN; // buyer API token (opedd_buyer_live_... or bk_live_...)
-const ACCESS_KEY = process.env.OPEDD_ACCESS_KEY; // enterprise access key (eak_*); for /enterprise-license GET feed
+const BUYER_TOKEN = process.env.OPEDD_BUYER_TOKEN; // buyer API token (opedd_buyer_live_... or opedd_buyer_test_...)
+const ACCESS_KEY = process.env.OPEDD_ACCESS_KEY; // enterprise access key (ent_*); for /enterprise-license GET feed
 const BUYER_JWT = process.env.OPEDD_BUYER_JWT; // Supabase JWT; for /buyer-audit + /buyer-compliance-report
 
 // ─── HTTP helpers ─────────────────────────────────────────────────────────────
@@ -94,7 +95,7 @@ function err(msg: string): ToolResult {
 
 // ─── Tool definitions ─────────────────────────────────────────────────────────
 
-const TOOLS: Tool[] = [
+export const TOOLS: Tool[] = [
   {
     name: "lookup_content",
     description:
@@ -207,13 +208,106 @@ const TOOLS: Tool[] = [
       },
     },
   },
+  // ─── Public buyer-discovery — catalog browse ──────────────────────────────
+  {
+    name: "publisher_directory",
+    description:
+      "Browse the public Opedd publisher catalog via GET /publisher-directory. " +
+      "Returns paginated publishers with article counts, pricing (per-article + annual + monthly-forward-feed), " +
+      "plan, and sample articles (RAG-extended metadata). " +
+      "**The primary discovery surface for AI labs to find Opedd-licensable publishers** — distinct from " +
+      "`browse_registry` (which lists issued LICENSES, not publishers). " +
+      "Filter by category (case-insensitive substring), min_articles, or verified status. " +
+      "Public no-auth — useful pre-purchase scoping before buyers commit to enterprise-license POST.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        category: {
+          type: "string",
+          description: "Case-insensitive substring filter on publisher category (e.g. 'finance', 'AI').",
+        },
+        min_articles: {
+          type: "number",
+          description: "Filter to publishers with at least this many licensable articles.",
+        },
+        verified: {
+          type: "string",
+          description: "'true' to show only verified publishers (default), 'false' for unverified.",
+        },
+        limit: {
+          type: "number",
+          description: "Page size cap.",
+        },
+        offset: {
+          type: "number",
+          description: "Pagination offset.",
+        },
+      },
+    },
+  },
+  // ─── Phase 12 Wave 3 W3.1 — onboarding helpers ────────────────────────────
+  {
+    name: "detect_platform",
+    description:
+      "Detect the content platform behind a URL via POST /detect-platform (Phase 12 Wave 3 W3.1). " +
+      "Public no-auth lookup. Given a URL, identifies what platform powers it " +
+      "(Substack / Beehiiv / Ghost / Medium / Brevo / custom) and returns the suggested onboarding workflow. " +
+      "Hostname-detectable platforms (Substack subdomain, Beehiiv suffix, etc.) resolve in milliseconds; " +
+      "custom domains may take ~few seconds while the detector probes well-known platform endpoints in parallel. " +
+      "Returns: {platform, confidence, archive_method, forward_method, required_credentials, instructions}. " +
+      "The archive_method + forward_method fields are the two onboarding-workflow inputs Opedd's setup wizard reads " +
+      "(one for historical content backfill, one for new-content forward stream). " +
+      "instructions is human-readable operator copy explaining the inferred path.",
+    inputSchema: {
+      type: "object",
+      required: ["url"],
+      properties: {
+        url: {
+          type: "string",
+          description: "Publisher URL to inspect (any well-formed URL works; hostname-match short-circuits the probe path).",
+        },
+      },
+    },
+  },
+  // ─── Phase 12 Wave 1 W1.1 — public RSL Standard manifest ─────────────────
+  {
+    name: "rsl_get",
+    description:
+      "Fetch a publisher's RSL Standard manifest via GET /rsl-manifest (Phase 12 Wave 1 W1.1). " +
+      "Public no-auth endpoint — discovery surface for AI agents/crawlers wanting to know what's licensable " +
+      "from a publisher BEFORE going through the buyer-account signup flow. " +
+      "Returns the 4 canonical license types (ai_retrieval, ai_training, human_per_article, human_full_archive) " +
+      "the publisher has opted into, plus the EU CDSM Article 4(3) opt-out posture (`tdm_reservation`). " +
+      "Set `jsonld: true` to request the JSON-LD shape with embedded HMAC-SHA256 signed receipt over the " +
+      "CDSM Article 4(3) reservation state + `tdm:reservationSignedAt` timestamp — regulators can post-hoc " +
+      "verify the reservation was the claimed value at the claimed time. Default `jsonld: false` returns " +
+      "the raw RSL Standard JSON manifest. " +
+      "Per INVARIANTS.md W1.6: this is the PUBLISHER-side CDSM Article 4(3) declaration surface. It is NOT " +
+      "an EU AI Act Article 53 attestation (which is buyer-side, JWT-auth, via article_53_attestation tool).",
+    inputSchema: {
+      type: "object",
+      required: ["publisher_id"],
+      properties: {
+        publisher_id: {
+          type: "string",
+          description: "UUID of the publisher whose RSL manifest to fetch. Publisher must be verified.",
+        },
+        jsonld: {
+          type: "boolean",
+          description:
+            "If true, request JSON-LD shape (Accept: application/ld+json) with embedded HMAC-SHA256 signed receipt. " +
+            "Default false returns raw RSL Standard JSON shape.",
+        },
+      },
+    },
+  },
   // ─── Phase 10 + 11 buyer-side surfaces (M6.4) ─────────────────────────────
   {
     name: "purchase_enterprise_license",
     description:
       "Purchase a bulk enterprise license covering multiple publishers (Phase 10). " +
       "Returns a Stripe client_secret for payment completion + the enterprise_license_id. " +
-      "After payment, an eak_* access key is emailed to buyer_email. " +
+      "After payment, an ent_* access key is emailed to buyer_email. " +
       "Scopes: 'custom' (pass-through publisher_ids), 'platform_wide' (auto-resolve all opted-in publishers), 'filtered' (Phase 10 filter_rules). " +
       "License tiers: 'rag' (= ai_retrieval), 'training' (= ai_training, flat-fee not metered), 'inference' (= ai_retrieval), 'full_ai' (writes both retrieval + training records).",
     inputSchema: {
@@ -270,7 +364,7 @@ if (BUYER_TOKEN) {
   TOOLS.push({
     name: "get_content",
     description:
-      "Retrieve the full body of a licensed article using a buyer API token (opedd_buyer_live_* canonical post-5.2.1a; bk_live_* legacy). " +
+      "Retrieve the full body of a licensed article using a buyer API token (opedd_buyer_live_* canonical; opedd_buyer_test_* for sandbox). " +
       "Requires OPEDD_BUYER_TOKEN env var (create one at opedd.com/licenses after purchasing). " +
       "Works for per-article licenses (token scoped to that article) and archive licenses (token covers all publisher content). " +
       "The publisher must have content delivery enabled and must have pushed content for the article. " +
@@ -287,7 +381,7 @@ if (BUYER_TOKEN) {
         },
         buyer_token: {
           type: "string",
-          description: "Buyer API token (opedd_buyer_live_* or bk_live_*). Falls back to OPEDD_BUYER_TOKEN env var.",
+          description: "Buyer API token (opedd_buyer_live_* or opedd_buyer_test_*). Falls back to OPEDD_BUYER_TOKEN env var.",
         },
       },
     },
@@ -303,7 +397,7 @@ if (ACCESS_KEY) {
       "Returns JSON-format response with paginated articles. " +
       "Use `since` (ISO 8601) for delta-feed polling — only articles published after the timestamp. " +
       "Use `cursor` for pagination across pages. " +
-      "Requires OPEDD_ACCESS_KEY (eak_* enterprise access key). " +
+      "Requires OPEDD_ACCESS_KEY (ent_* enterprise access key). " +
       "For larger bulk corpus pulls, use stream_feed_ndjson (up to 1000 articles per call vs 200 here).",
     inputSchema: {
       type: "object",
@@ -332,7 +426,7 @@ if (ACCESS_KEY) {
       "Use `since` (ISO 8601) for delta-feed. Use `cursor` to paginate beyond 1000. " +
       "Backend supports 5000 articles per call; the MCP cap is 1000 for transport reasonability. " +
       "Real bulk-ingest pipelines should use the Python SDK (pip install opedd) directly — not via MCP. " +
-      "Requires OPEDD_ACCESS_KEY (eak_*).",
+      "Requires OPEDD_ACCESS_KEY (ent_*).",
     inputSchema: {
       type: "object",
       properties: {
@@ -391,6 +485,59 @@ if (BUYER_JWT) {
       },
     },
   });
+  TOOLS.push({
+    name: "get_buyer_account",
+    description:
+      "Fetch the authenticated buyer's account profile + masked API key list via GET /buyer-account. " +
+      "Returns the enterprise_buyers row (contact_email, buyer_org, created_at, etc.) plus a list of all " +
+      "buyer-side API keys with masked prefixes (NEVER plaintext post-issuance — only the 12-char " +
+      "key_prefix is returned, e.g. 'opedd_buyer_'). " +
+      "Use cases: post-signup verification ('what was just issued to me?'), buyer dashboard mental model " +
+      "('what licenses do I currently hold?'), audit prep ('show me the key list before rotation'). " +
+      "For full mid-lifecycle license details (filter_rules, billing, payouts), buyers consult the buyer portal at opedd.com/buyer. " +
+      "Requires OPEDD_BUYER_JWT.",
+    inputSchema: {
+      type: "object",
+      properties: {},
+    },
+  });
+  TOOLS.push({
+    name: "article_53_attestation",
+    description:
+      "Issue a signed JWT attesting to EU AI Act Article 53 compliance for a specific license via " +
+      "GET /eu-ai-act/article-53-attestation (Phase 12 Wave 1 W1.4). " +
+      "Returns a freshly-signed HS256 JWT regulators can verify offline against the canonical signing key. " +
+      "Embeds: license context, usage-count over the attestation window, the most-recent Tempo Merkle root, " +
+      "and canonical claims (iss/sub/iat/exp/jti/aud). " +
+      "**The artifact AI labs hand to legal/procurement for EU AI Act Article 53(1)(d) transparency-obligation evidence.** " +
+      "Per INVARIANTS.md W1.6: this attests to EU AI Act Article 53 ONLY (buyer-side GPAI-model-provider " +
+      "transparency obligation). It does NOT discharge a publisher's CDSM Article 4(3) reservation obligation — " +
+      "that lives on the rsl_get tool (jsonld=true variant). Never conflate. " +
+      "Optional `content_id` scopes the attestation to one article; default is license-wide. " +
+      "Window cap: 365 days. Requires OPEDD_BUYER_JWT.",
+    inputSchema: {
+      type: "object",
+      required: ["license_id"],
+      properties: {
+        license_id: {
+          type: "string",
+          description: "UUID of the enterprise_license OR legacy individual license to attest. Buyer must own it.",
+        },
+        content_id: {
+          type: "string",
+          description: "Optional UUID of a specific article to scope the attestation. Default: license-wide.",
+        },
+        window_start: {
+          type: "string",
+          description: "ISO 8601 lower bound of the attestation window. Default: now - 90 days.",
+        },
+        window_end: {
+          type: "string",
+          description: "ISO 8601 upper bound. Default: now. Window may not exceed 365 days (hard cap).",
+        },
+      },
+    },
+  });
   TOOLS.push({
     name: "get_compliance_dossier",
     description:
@@ -454,15 +601,28 @@ if (API_KEY) {
 // ─── MCP Server ───────────────────────────────────────────────────────────────
 
 const server = new Server(
-  { name: "opedd-mcp", version: "0.2.0" },
+  { name: "opedd-mcp", version: "0.3.0" },
   { capabilities: { tools: {} } }
 );
 
 server.setRequestHandler(ListToolsRequestSchema, async () => ({ tools: TOOLS }));
 
-server.setRequestHandler(CallToolRequestSchema, async (request) => {
-  const { name, arguments: args = {} } = request.params;
+server.setRequestHandler(CallToolRequestSchema, async (request) =>
+  dispatchTool(request.params.name, (request.params.arguments ?? {}) as Record<string, unknown>),
+);
 
+// ─── Tool dispatcher (exported for unit tests) ────────────────────────────────
+//
+// Extracted from the inline handler 2026-05-24 EEST as part of the opedd-mcp
+// test cohort ship. Behavior-preserving: the server.setRequestHandler above
+// is a thin delegation to dispatchTool. Exporting allows unit tests to mock
+// global fetch + invoke each tool's handler directly without spawning a
+// stdio subprocess.
+
+export async function dispatchTool(
+  name: string,
+  args: Record<string, unknown>,
+): Promise<ToolResult> {
   try {
     switch (name) {
       // ── lookup_content ─────────────────────────────────────────────────────
@@ -583,6 +743,55 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
         return ok(data);
       }
 
+      // ── publisher_directory (buyer-discovery catalog browse) ───────────────
+      case "publisher_directory": {
+        const { category, min_articles, verified, limit, offset } = args as {
+          category?: string;
+          min_articles?: number;
+          verified?: string;
+          limit?: number;
+          offset?: number;
+        };
+        const params = new URLSearchParams();
+        if (category) params.set("category", category);
+        if (min_articles !== undefined) params.set("min_articles", String(min_articles));
+        if (verified !== undefined) params.set("verified", verified);
+        if (limit !== undefined) params.set("limit", String(limit));
+        if (offset !== undefined) params.set("offset", String(offset));
+
+        const query = params.toString();
+        const data = await opeddFetch(`/publisher-directory${query ? `?${query}` : ""}`);
+        return ok(data);
+      }
+
+      // ── detect_platform (Phase 12 Wave 3 W3.1) ─────────────────────────────
+      case "detect_platform": {
+        const { url } = args as { url: string };
+        if (!url) return err("url is required");
+
+        const data = await opeddFetch("/detect-platform", {
+          method: "POST",
+          body: JSON.stringify({ url }),
+        });
+        return ok(data);
+      }
+
+      // ── rsl_get (Phase 12 Wave 1 W1.1) ─────────────────────────────────────
+      case "rsl_get": {
+        const { publisher_id, jsonld = false } = args as {
+          publisher_id: string;
+          jsonld?: boolean;
+        };
+        if (!publisher_id) return err("publisher_id is required");
+
+        const accept = jsonld ? "application/ld+json" : "application/json";
+        const data = await opeddFetch(
+          `/rsl-manifest?publisher_id=${encodeURIComponent(publisher_id)}`,
+          { headers: { Accept: accept } },
+        );
+        return ok(data);
+      }
+
       // ── purchase_enterprise_license (Phase 10) ─────────────────────────────
       case "purchase_enterprise_license": {
         const {
@@ -637,7 +846,7 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
       // ── list_feed (Phase 10 + 11) ──────────────────────────────────────────
       case "list_feed": {
         if (!ACCESS_KEY) {
-          return err("OPEDD_ACCESS_KEY env var is required for this tool (eak_* enterprise access key)");
+          return err("OPEDD_ACCESS_KEY env var is required for this tool (ent_* enterprise access key)");
         }
         const { since, cursor, limit = 50 } = args as {
           since?: string;
@@ -659,7 +868,7 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
       // ── stream_feed_ndjson (Phase 11 M3) ───────────────────────────────────
       case "stream_feed_ndjson": {
         if (!ACCESS_KEY) {
-          return err("OPEDD_ACCESS_KEY env var is required for this tool (eak_* enterprise access key)");
+          return err("OPEDD_ACCESS_KEY env var is required for this tool (ent_* enterprise access key)");
         }
         const { since, cursor, limit = 200 } = args as {
           since?: string;
@@ -704,6 +913,42 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
         return ok(data);
       }
 
+      // ── get_buyer_account (buyer profile + masked key list) ────────────────
+      case "get_buyer_account": {
+        if (!BUYER_JWT) {
+          return err("OPEDD_BUYER_JWT env var is required for this tool (Supabase session JWT)");
+        }
+        const data = await opeddFetch("/buyer-account", {
+          headers: { Authorization: `Bearer ${BUYER_JWT}` },
+        });
+        return ok(data);
+      }
+
+      // ── article_53_attestation (Phase 12 Wave 1 W1.4) ──────────────────────
+      case "article_53_attestation": {
+        if (!BUYER_JWT) {
+          return err("OPEDD_BUYER_JWT env var is required for this tool (Supabase session JWT)");
+        }
+        const { license_id, content_id, window_start, window_end } = args as {
+          license_id: string;
+          content_id?: string;
+          window_start?: string;
+          window_end?: string;
+        };
+        if (!license_id) return err("license_id is required");
+
+        const params = new URLSearchParams({ license_id });
+        if (content_id) params.set("content_id", content_id);
+        if (window_start) params.set("window_start", window_start);
+        if (window_end) params.set("window_end", window_end);
+
+        const data = await opeddFetch(
+          `/eu-ai-act/article-53-attestation?${params.toString()}`,
+          { headers: { Authorization: `Bearer ${BUYER_JWT}` } },
+        );
+        return ok(data);
+      }
+
       // ── get_compliance_dossier (Phase 11 M4) ───────────────────────────────
       case "get_compliance_dossier": {
         if (!BUYER_JWT) {
@@ -758,10 +1003,20 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
     const msg = e instanceof Error ? e.message : String(e);
     return err(`Request failed: ${msg}`);
   }
-});
+}
 
 // ─── Start ────────────────────────────────────────────────────────────────────
 
-const transport = new StdioServerTransport();
-await server.connect(transport);
-console.error("[opedd-mcp] Server running on stdio");
+// Skip stdio bootstrap when imported as a module (unit tests need TOOLS +
+// dispatchTool without the server.connect side-effect). Detect via
+// `import.meta.url === pathToFileURL(process.argv[1]).href` — the canonical
+// "am I the entry point" check for ESM Node modules.
+if (
+  typeof process !== "undefined" &&
+  process.argv?.[1] &&
+  import.meta.url === pathToFileURL(process.argv[1]).href
+) {
+  const transport = new StdioServerTransport();
+  await server.connect(transport);
+  console.error("[opedd-mcp] Server running on stdio");
+}

package/tests/dispatcher.env-gated.test.ts

@@ -0,0 +1,278 @@
+// Env-gated tool tests — covers the 7 tools that register conditionally
+// based on env-var presence:
+//
+//   article_53_attestation, get_buyer_account, get_audit_events,
+//   get_compliance_dossier  (require OPEDD_BUYER_JWT)
+//   list_feed, stream_feed_ndjson  (require OPEDD_ACCESS_KEY)
+//   list_publisher_content  (requires OPEDD_API_KEY)
+//
+// Separate file from dispatcher.test.ts because the TOOLS array push +
+// CallTool switch cases evaluate env-var presence at module-import time;
+// mixing env-set and env-unset tests in the same file requires vitest
+// resetModules() round-trips that compound state-leak risk. One file =
+// one env-vector for cleaner test isolation.
+
+import { afterEach, beforeAll, describe, expect, it, vi } from "vitest";
+
+const TEST_BUYER_TOKEN = "opedd_buyer_test_env_gated_xxx";
+const TEST_BUYER_JWT = "eyJhbGc.env-gated-test.sig";
+const TEST_ACCESS_KEY = "ent_env_gated_test";
+const TEST_API_KEY = "op_env_gated_test_pub";
+const TEST_BUYER_EMAIL = "env-gated@opedd-test.com";
+
+// Stub ALL env vars before any import — guarantees every conditional
+// TOOLS push registers + every env-gated switch case is callable.
+beforeAll(() => {
+  vi.stubEnv("OPEDD_BUYER_TOKEN", TEST_BUYER_TOKEN);
+  vi.stubEnv("OPEDD_BUYER_JWT", TEST_BUYER_JWT);
+  vi.stubEnv("OPEDD_ACCESS_KEY", TEST_ACCESS_KEY);
+  vi.stubEnv("OPEDD_API_KEY", TEST_API_KEY);
+  vi.stubEnv("OPEDD_BUYER_EMAIL", TEST_BUYER_EMAIL);
+  vi.stubEnv("OPEDD_API_URL", "https://api.opedd.com");
+});
+
+afterEach(() => {
+  vi.restoreAllMocks();
+});
+
+async function loadDispatcher() {
+  vi.resetModules();
+  return await import("../src/index.ts");
+}
+
+function mockFetchOk(body: unknown, status = 200) {
+  const fn = vi.fn(async () =>
+    new Response(JSON.stringify(body), {
+      status,
+      headers: { "content-type": "application/json" },
+    }),
+  );
+  globalThis.fetch = fn as unknown as typeof fetch;
+  return fn;
+}
+
+function mockFetchNdjson(lines: unknown[]): ReturnType<typeof vi.fn> {
+  const body = lines.map((l) => JSON.stringify(l)).join("\n") + "\n";
+  const fn = vi.fn(async () =>
+    new Response(body, {
+      status: 200,
+      headers: { "content-type": "application/x-ndjson" },
+    }),
+  );
+  globalThis.fetch = fn as unknown as typeof fetch;
+  return fn;
+}
+
+// ───────────────────────────── all env-gated tools register ─────────────────────────────
+
+describe("TOOLS array with all env vars set", () => {
+  it("exposes the 7 env-gated tools alongside the 8 always-available", async () => {
+    const { TOOLS } = await loadDispatcher();
+    const names = TOOLS.map((t) => t.name);
+    // BUYER_TOKEN-gated
+    expect(names).toContain("get_content");
+    // BUYER_JWT-gated
+    expect(names).toContain("get_buyer_account");
+    expect(names).toContain("article_53_attestation");
+    expect(names).toContain("get_audit_events");
+    expect(names).toContain("get_compliance_dossier");
+    // ACCESS_KEY-gated
+    expect(names).toContain("list_feed");
+    expect(names).toContain("stream_feed_ndjson");
+    // API_KEY-gated
+    expect(names).toContain("list_publisher_content");
+    expect(names.length).toBe(16);
+  });
+});
+
+// ───────────────────────────── BUYER_TOKEN-gated tool ─────────────────────────────
+
+describe("dispatchTool: get_content (BUYER_TOKEN gated)", () => {
+  it("sends GET /content-delivery with bearer auth", async () => {
+    const f = mockFetchOk({ success: true, data: { id: "art-1", content: "..." } });
+    const { dispatchTool } = await loadDispatcher();
+    await dispatchTool("get_content", { article_id: "art-1" });
+    const call = f.mock.calls[0];
+    expect(String(call[0])).toContain("/content-delivery?article_id=art-1");
+    const headers = (call[1] as RequestInit).headers as Record<string, string>;
+    expect(headers["Authorization"]).toBe(`Bearer ${TEST_BUYER_TOKEN}`);
+  });
+});
+
+// ───────────────────────────── BUYER_JWT-gated tools ─────────────────────────────
+
+describe("dispatchTool: get_buyer_account (BUYER_JWT gated, chip 13)", () => {
+  it("sends GET /buyer-account with JWT auth", async () => {
+    const f = mockFetchOk({ success: true, data: { buyer: { contact_email: "x" } } });
+    const { dispatchTool } = await loadDispatcher();
+    await dispatchTool("get_buyer_account", {});
+    const call = f.mock.calls[0];
+    expect(String(call[0])).toContain("/buyer-account");
+    const headers = (call[1] as RequestInit).headers as Record<string, string>;
+    expect(headers["Authorization"]).toBe(`Bearer ${TEST_BUYER_JWT}`);
+  });
+});
+
+describe("dispatchTool: article_53_attestation (BUYER_JWT gated, chip 2)", () => {
+  it("happy path — license_id only", async () => {
+    const f = mockFetchOk({
+      success: true,
+      data: { jwt: "eyJ.test.sig", claims: { eu_ai_act_article: 53, aud: "eu-ai-act-article-53" } },
+    });
+    const { dispatchTool } = await loadDispatcher();
+    await dispatchTool("article_53_attestation", {
+      license_id: "11111111-2222-3333-4444-555555555555",
+    });
+    const call = f.mock.calls[0];
+    expect(String(call[0])).toContain(
+      "/eu-ai-act/article-53-attestation?license_id=11111111-2222-3333-4444-555555555555",
+    );
+  });
+
+  it("with all optional params (content_id + window_start + window_end)", async () => {
+    const f = mockFetchOk({ success: true, data: {} });
+    const { dispatchTool } = await loadDispatcher();
+    await dispatchTool("article_53_attestation", {
+      license_id: "11111111-2222-3333-4444-555555555555",
+      content_id: "22222222-3333-4444-5555-666666666666",
+      window_start: "2026-02-22T00:00:00Z",
+      window_end: "2026-05-22T00:00:00Z",
+    });
+    const call = String(f.mock.calls[0][0]);
+    expect(call).toContain("content_id=22222222");
+    expect(call).toContain("window_start=2026-02-22T00%3A00%3A00Z");
+    expect(call).toContain("window_end=2026-05-22T00%3A00%3A00Z");
+  });
+
+  it("rejects missing license_id", async () => {
+    mockFetchOk({});
+    const { dispatchTool } = await loadDispatcher();
+    const result = await dispatchTool("article_53_attestation", {});
+    expect(result.isError).toBe(true);
+    expect(result.content[0].text).toContain("license_id is required");
+  });
+});
+
+describe("dispatchTool: get_audit_events (BUYER_JWT gated)", () => {
+  it("happy path with all filters", async () => {
+    const f = mockFetchOk({ success: true, events: [] });
+    const { dispatchTool } = await loadDispatcher();
+    await dispatchTool("get_audit_events", {
+      from: "2026-05-01",
+      to: "2026-05-15",
+      event_type: "content_access",
+      limit: 50,
+    });
+    const call = String(f.mock.calls[0][0]);
+    expect(call).toContain("from=2026-05-01");
+    expect(call).toContain("event_type=content_access");
+    expect(call).toContain("limit=50");
+  });
+
+  it("limit capped at 200", async () => {
+    const f = mockFetchOk({ success: true, events: [] });
+    const { dispatchTool } = await loadDispatcher();
+    await dispatchTool("get_audit_events", { limit: 999 });
+    const call = String(f.mock.calls[0][0]);
+    expect(call).toContain("limit=200");
+  });
+});
+
+describe("dispatchTool: get_compliance_dossier (BUYER_JWT gated)", () => {
+  it("happy path — from + to required", async () => {
+    const f = mockFetchOk({
+      success: true,
+      dossier_metadata: { summary: { total_retrievals: 100 } },
+    });
+    const { dispatchTool } = await loadDispatcher();
+    await dispatchTool("get_compliance_dossier", {
+      from: "2026-04-01",
+      to: "2026-04-30",
+    });
+    const call = String(f.mock.calls[0][0]);
+    expect(call).toContain("from=2026-04-01");
+    expect(call).toContain("to=2026-04-30");
+    expect(call).toContain("format=json");
+  });
+
+  it("rejects missing from", async () => {
+    mockFetchOk({});
+    const { dispatchTool } = await loadDispatcher();
+    const result = await dispatchTool("get_compliance_dossier", { to: "2026-04-30" });
+    expect(result.isError).toBe(true);
+    expect(result.content[0].text).toContain("from");
+  });
+});
+
+// ───────────────────────────── ACCESS_KEY-gated tools ─────────────────────────────
+
+describe("dispatchTool: list_feed (ACCESS_KEY gated)", () => {
+  it("happy path — sends access_key + format=json", async () => {
+    const f = mockFetchOk({ success: true, data: { articles: [] } });
+    const { dispatchTool } = await loadDispatcher();
+    await dispatchTool("list_feed", { limit: 50 });
+    const call = String(f.mock.calls[0][0]);
+    expect(call).toContain("access_key=" + TEST_ACCESS_KEY);
+    expect(call).toContain("format=json");
+    expect(call).toContain("limit=50");
+  });
+
+  it("limit capped at 200", async () => {
+    const f = mockFetchOk({ success: true, data: {} });
+    const { dispatchTool } = await loadDispatcher();
+    await dispatchTool("list_feed", { limit: 5000 });
+    const call = String(f.mock.calls[0][0]);
+    expect(call).toContain("limit=200");
+  });
+});
+
+describe("dispatchTool: stream_feed_ndjson (ACCESS_KEY gated)", () => {
+  it("parses NDJSON lines + extracts _meta", async () => {
+    const f = mockFetchNdjson([
+      { id: "art-1", title: "A" },
+      { id: "art-2", title: "B" },
+      { _meta: { count: 2, truncated: false } },
+    ]);
+    const { dispatchTool } = await loadDispatcher();
+    const result = await dispatchTool("stream_feed_ndjson", {});
+    const call = String(f.mock.calls[0][0]);
+    expect(call).toContain("format=ndjson");
+    const payload = JSON.parse(result.content[0].text) as {
+      articles: Array<Record<string, unknown>>;
+      meta: Record<string, unknown>;
+    };
+    expect(payload.articles.length).toBe(2);
+    expect(payload.articles[0].id).toBe("art-1");
+    expect(payload.meta.count).toBe(2);
+  });
+
+  it("limit capped at 1000", async () => {
+    const f = mockFetchNdjson([{ _meta: {} }]);
+    const { dispatchTool } = await loadDispatcher();
+    await dispatchTool("stream_feed_ndjson", { limit: 99999 });
+    const call = String(f.mock.calls[0][0]);
+    expect(call).toContain("limit=1000");
+  });
+});
+
+// ───────────────────────────── API_KEY-gated tool ─────────────────────────────
+
+describe("dispatchTool: list_publisher_content (API_KEY gated)", () => {
+  it("happy path — sends /api?action=articles + X-API-Key header", async () => {
+    const f = mockFetchOk({ success: true, data: { articles: [] } });
+    const { dispatchTool } = await loadDispatcher();
+    await dispatchTool("list_publisher_content", { limit: 20 });
+    const call = f.mock.calls[0];
+    expect(String(call[0])).toContain("/api?action=articles");
+    const headers = (call[1] as RequestInit).headers as Record<string, string>;
+    expect(headers["X-API-Key"]).toBe(TEST_API_KEY);
+  });
+
+  it("limit capped at 100", async () => {
+    const f = mockFetchOk({ success: true, data: {} });
+    const { dispatchTool } = await loadDispatcher();
+    await dispatchTool("list_publisher_content", { limit: 999 });
+    const call = String(f.mock.calls[0][0]);
+    expect(call).toContain("limit=100");
+  });
+});