opedd-mcp 0.2.0 → 0.4.0

package/.github/workflows/ci.yml

@@ -12,7 +12,13 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        node-version: ["18", "20", "22"]
+        # Node 18 dropped 2026-05-24 — vitest 4.x (rolldown dep) requires
+        # `node:util.styleText` which is only available on Node 21.7+.
+        # Node 18 reaches active LTS end April 2025; engines.node in
+        # package.json bumped to ">=20" in the same commit. Re-add Node 18
+        # only if vitest downgrade ratified (which is the alternative;
+        # founder picked engines bump).
+        node-version: ["20", "22"]
     steps:
       - uses: actions/checkout@v4
 
@@ -23,11 +29,22 @@ jobs:
           cache: npm
 
       - name: Install dependencies
-        run: npm ci
+        # Using `npm install` rather than `npm ci` because the lockfile
+        # generated on macOS doesn't include Linux-conditional optional
+        # native deps (e.g. @emnapi/* used by vitest 4.x via napi-rs).
+        # `npm install` resolves transitively at install time per-platform;
+        # `npm ci` strictly validates lockfile-against-package.json and
+        # rejects when platform-specific transitive deps are missing.
+        # Trade-off: install is slower + slightly looser; acceptable for
+        # this repo's CI scale.
+        run: npm install
 
       - name: TypeScript compile
         run: npm run build
 
+      - name: Unit tests (vitest)
+        run: npm test
+
       - name: Verify dist/index.js produced
         run: |
           test -f dist/index.js || (echo "::error::dist/index.js not produced by tsc"; exit 1)

package/README.md

@@ -8,17 +8,20 @@ Lets AI assistants (Claude Desktop, Cursor, Windsurf, or any MCP-compatible host
 
 ## What it does
 
-Exposes up to 11 tools to any AI assistant (some are conditional on env vars):
+Exposes up to 16 tools to any AI assistant (some are conditional on env vars):
 
-**Always available — discovery + per-article purchase**
+**Always available — discovery + per-article purchase + onboarding + rights signaling**
 
 | Tool | Description |
 |------|-------------|
 | `lookup_content` | Look up an article by URL — returns title, publisher, pricing |
 | `purchase_license` | Buy a single-article license via Stripe — returns OP-XXXX-XXXX key |
 | `verify_license` | Verify a license key — returns validity, article, publisher, blockchain proof |
-| `browse_registry` | Browse the public Opedd registry (global or by publisher) |
+| `browse_registry` | Browse the public Opedd registry — lists issued LICENSES (use `publisher_directory` to browse publishers themselves) |
+| `publisher_directory` | Browse the public Opedd publisher catalog — paginated publishers with article counts + pricing + sample articles (primary buyer-discovery surface for AI labs) |
 | `purchase_enterprise_license` | Buy a bulk enterprise license covering multiple publishers (Phase 10) — returns Stripe `client_secret` |
+| `rsl_get` | Fetch a publisher's RSL Standard manifest — public discovery surface; `jsonld: true` returns CDSM Article 4(3) signed receipt (Phase 12 W1.1) |
+| `detect_platform` | Detect the content platform behind a URL — returns suggested onboarding workflow for Substack / Beehiiv / Ghost / Medium / Brevo / custom (Phase 12 W3.1) |
 
 **Requires `OPEDD_BUYER_TOKEN` (opedd_buyer_live_*)**
 
@@ -26,26 +29,38 @@ Exposes up to 11 tools to any AI assistant (some are conditional on env vars):
 |------|-------------|
 | `get_content` | Retrieve a licensed article — includes 7 Phase 11 M2 RAG metadata fields (author, language, word_count, content_hash, image_urls, canonical_url, tags) |
 
-**Requires `OPEDD_ACCESS_KEY` (eak_*) — buyer-side feed surfaces**
+**Requires `OPEDD_ACCESS_KEY` (ent_*) — buyer-side feed surfaces**
 
 | Tool | Description |
 |------|-------------|
 | `list_feed` | List articles from a buyer's licensed catalog with `since` delta-feed support (Phase 11 M5) |
 | `stream_feed_ndjson` | Bulk-export up to 1000 articles per call via NDJSON wire format (Phase 11 M3) |
 
-**Requires `OPEDD_BUYER_JWT` (Supabase JWT) — audit + compliance surfaces**
+**Requires `OPEDD_BUYER_JWT` (Supabase JWT) — buyer account + audit + compliance + EU AI Act surfaces**
 
 | Tool | Description |
 |------|-------------|
+| `get_buyer_account` | Fetch buyer profile + masked API key list — buyer-dashboard mental model |
 | `get_audit_events` | Per-event audit ledger with Tempo on-chain attestation inclusion proofs inline (Phase 9.x + 10 M5) |
 | `get_compliance_dossier` | Procurement-defense compliance dossier mapping retrievals to license terms (Phase 11 M4) |
+| `article_53_attestation` | Signed JWT attesting EU AI Act Article 53(1)(d) compliance for a license — the artifact AI labs hand to legal/procurement (Phase 12 W1.4) |
 
-**Requires `OPEDD_API_KEY` (op_*) — publisher-side**
+**Requires `OPEDD_PUB_BEARER` (opedd_pub_*) — publisher-side**
 
 | Tool | Description |
 |------|-------------|
 | `list_publisher_content` | List your own articles with pricing and stats |
 
+### Regulatory framing (CDSM Article 4 vs EU AI Act Article 53 — never conflated)
+
+Per the [opedd-backend INVARIANTS.md W1.6 amendment](https://github.com/Opedd/opedd-backend/blob/main/INVARIANTS.md):
+
+- **`rsl_get(publisher_id, jsonld=true)`** → publisher-side **CDSM Article 4(3)** opt-out declaration (signed JSON-LD receipt over the reservation state).
+- **`article_53_attestation(license_id)`** → buyer-side **EU AI Act Article 53** attestation (signed HS256 JWT scoped to one license).
+- **`get_compliance_dossier(from, to)`** → comprehensive procurement-defense dossier covering BOTH frameworks (publisher CDSM reservation honored + buyer Article 53 evidence chain).
+
+These serve different audit-defensibility modes and never share wire format. Tool descriptions cite the W1.6 invariant inline.
+
 ## Install
 
 ```bash
@@ -66,10 +81,11 @@ Set environment variables to pre-configure the server:
 |----------|----------|-------------|
 | `OPEDD_BUYER_EMAIL` | Recommended | Your email — used as default for all purchases |
 | `OPEDD_PAYMENT_METHOD_ID` | Recommended | Stripe `pm_...` ID — used for autonomous per-article purchasing |
-| `OPEDD_BUYER_TOKEN` | Optional | Buyer API token (`opedd_buyer_live_*` canonical post-5.2.1a; `bk_live_*` legacy) — enables `get_content` |
-| `OPEDD_ACCESS_KEY` | Optional | Enterprise access key (`eak_*`) — enables `list_feed` + `stream_feed_ndjson` |
+| `OPEDD_BUYER_TOKEN` | Optional | Buyer API token (`opedd_buyer_live_*` canonical; `opedd_buyer_test_*` for sandbox) — enables `get_content` |
+| `OPEDD_ACCESS_KEY` | Optional | Enterprise access key (`ent_*`) — enables `list_feed` + `stream_feed_ndjson` |
 | `OPEDD_BUYER_JWT` | Optional | Supabase session JWT from the buyer portal — enables `get_audit_events` + `get_compliance_dossier` |
-| `OPEDD_API_KEY` | Optional | Publisher API key (`op_...`) — enables `list_publisher_content` |
+| `OPEDD_PUB_BEARER` | Optional | Canonical Publisher API Bearer key (`opedd_pub_<env>_<32-hex>`; issued via `POST /publishers-api-keys action=create_api_key`) — enables `list_publisher_content`. **v0.4.0 canonical.** |
+| `OPEDD_API_KEY` | Deprecated | Legacy Publisher API key (`op_...`) — fallback during the transition window; will stop working when opedd-backend Phase C deploys. Migrate to `OPEDD_PUB_BEARER`. |
 | `OPEDD_API_URL` | Optional | Override the API base URL (default: Opedd production) |
 
 > **Getting a Stripe payment method ID**: Save a card in your Stripe account and retrieve the `pm_...` ID via the [Stripe API](https://stripe.com/docs/api/payment_methods).
@@ -121,6 +137,20 @@ Once configured, you can ask your AI assistant:
 
 > "Browse the latest licenses from The Information publisher."
 
+### Phase 12 Wave 1 + 3 surfaces (v0.3.0)
+
+> "What does publisher 8268c353-ffa3-4db3-bbb2-90ddbbb43e41 license? Pull the RSL manifest." — uses `rsl_get`
+
+> "Get me a CDSM Article 4(3) signed receipt for that publisher's reservation state — set `jsonld: true`." — uses `rsl_get` with content negotiation
+
+> "Generate an EU AI Act Article 53 attestation JWT for our license `11111111-...` covering the last 90 days. I need the artifact for our procurement audit committee." — uses `article_53_attestation` (requires `OPEDD_BUYER_JWT`)
+
+> "This publisher just signed up: `https://noahpinion.substack.com`. Which onboarding workflow should we use?" — uses `detect_platform`
+
+> "Browse the finance category in the Opedd catalog — show me publishers with at least 50 articles." — uses `publisher_directory`
+
+> "What's in my buyer account? Show me my active API keys." — uses `get_buyer_account` (requires `OPEDD_BUYER_JWT`)
+
 The assistant will call the appropriate Opedd tools, show you the results, and—if you've pre-configured a payment method—can complete a purchase autonomously.
 
 ## Payment methods

package/dist/index.js

@@ -2,14 +2,15 @@
 import { Server } from "@modelcontextprotocol/sdk/server/index.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { CallToolRequestSchema, ListToolsRequestSchema, } from "@modelcontextprotocol/sdk/types.js";
+import { pathToFileURL } from "node:url";
 // ─── Configuration ────────────────────────────────────────────────────────────
 const API_BASE = process.env.OPEDD_API_URL ??
     "https://api.opedd.com";
 const BUYER_EMAIL = process.env.OPEDD_BUYER_EMAIL;
 const PAYMENT_METHOD_ID = process.env.OPEDD_PAYMENT_METHOD_ID;
 const API_KEY = process.env.OPEDD_API_KEY; // publisher API key (op_...)
-const BUYER_TOKEN = process.env.OPEDD_BUYER_TOKEN; // buyer API token (opedd_buyer_live_... or bk_live_...)
-const ACCESS_KEY = process.env.OPEDD_ACCESS_KEY; // enterprise access key (eak_*); for /enterprise-license GET feed
+const BUYER_TOKEN = process.env.OPEDD_BUYER_TOKEN; // buyer API token (opedd_buyer_live_... or opedd_buyer_test_...)
+const ACCESS_KEY = process.env.OPEDD_ACCESS_KEY; // enterprise access key (ent_*); for /enterprise-license GET feed
 const BUYER_JWT = process.env.OPEDD_BUYER_JWT; // Supabase JWT; for /buyer-audit + /buyer-compliance-report
 // ─── HTTP helpers ─────────────────────────────────────────────────────────────
 async function opeddFetch(path, options = {}) {
@@ -73,7 +74,7 @@ function err(msg) {
     return { content: [{ type: "text", text: `Error: ${msg}` }], isError: true };
 }
 // ─── Tool definitions ─────────────────────────────────────────────────────────
-const TOOLS = [
+export const TOOLS = [
     {
         name: "lookup_content",
         description: "Look up a piece of content on the Opedd registry by URL. " +
@@ -180,12 +181,101 @@ const TOOLS = [
             },
         },
     },
+    // ─── Public buyer-discovery — catalog browse ──────────────────────────────
+    {
+        name: "publisher_directory",
+        description: "Browse the public Opedd publisher catalog via GET /publisher-directory. " +
+            "Returns paginated publishers with article counts, pricing (per-article + annual + monthly-forward-feed), " +
+            "plan, and sample articles (RAG-extended metadata). " +
+            "**The primary discovery surface for AI labs to find Opedd-licensable publishers** — distinct from " +
+            "`browse_registry` (which lists issued LICENSES, not publishers). " +
+            "Filter by category (case-insensitive substring), min_articles, or verified status. " +
+            "Public no-auth — useful pre-purchase scoping before buyers commit to enterprise-license POST.",
+        inputSchema: {
+            type: "object",
+            properties: {
+                category: {
+                    type: "string",
+                    description: "Case-insensitive substring filter on publisher category (e.g. 'finance', 'AI').",
+                },
+                min_articles: {
+                    type: "number",
+                    description: "Filter to publishers with at least this many licensable articles.",
+                },
+                verified: {
+                    type: "string",
+                    description: "'true' to show only verified publishers (default), 'false' for unverified.",
+                },
+                limit: {
+                    type: "number",
+                    description: "Page size cap.",
+                },
+                offset: {
+                    type: "number",
+                    description: "Pagination offset.",
+                },
+            },
+        },
+    },
+    // ─── Phase 12 Wave 3 W3.1 — onboarding helpers ────────────────────────────
+    {
+        name: "detect_platform",
+        description: "Detect the content platform behind a URL via POST /detect-platform (Phase 12 Wave 3 W3.1). " +
+            "Public no-auth lookup. Given a URL, identifies what platform powers it " +
+            "(Substack / Beehiiv / Ghost / Medium / Brevo / custom) and returns the suggested onboarding workflow. " +
+            "Hostname-detectable platforms (Substack subdomain, Beehiiv suffix, etc.) resolve in milliseconds; " +
+            "custom domains may take ~few seconds while the detector probes well-known platform endpoints in parallel. " +
+            "Returns: {platform, confidence, archive_method, forward_method, required_credentials, instructions}. " +
+            "The archive_method + forward_method fields are the two onboarding-workflow inputs Opedd's setup wizard reads " +
+            "(one for historical content backfill, one for new-content forward stream). " +
+            "instructions is human-readable operator copy explaining the inferred path.",
+        inputSchema: {
+            type: "object",
+            required: ["url"],
+            properties: {
+                url: {
+                    type: "string",
+                    description: "Publisher URL to inspect (any well-formed URL works; hostname-match short-circuits the probe path).",
+                },
+            },
+        },
+    },
+    // ─── Phase 12 Wave 1 W1.1 — public RSL Standard manifest ─────────────────
+    {
+        name: "rsl_get",
+        description: "Fetch a publisher's RSL Standard manifest via GET /rsl-manifest (Phase 12 Wave 1 W1.1). " +
+            "Public no-auth endpoint — discovery surface for AI agents/crawlers wanting to know what's licensable " +
+            "from a publisher BEFORE going through the buyer-account signup flow. " +
+            "Returns the 4 canonical license types (ai_retrieval, ai_training, human_per_article, human_full_archive) " +
+            "the publisher has opted into, plus the EU CDSM Article 4(3) opt-out posture (`tdm_reservation`). " +
+            "Set `jsonld: true` to request the JSON-LD shape with embedded HMAC-SHA256 signed receipt over the " +
+            "CDSM Article 4(3) reservation state + `tdm:reservationSignedAt` timestamp — regulators can post-hoc " +
+            "verify the reservation was the claimed value at the claimed time. Default `jsonld: false` returns " +
+            "the raw RSL Standard JSON manifest. " +
+            "Per INVARIANTS.md W1.6: this is the PUBLISHER-side CDSM Article 4(3) declaration surface. It is NOT " +
+            "an EU AI Act Article 53 attestation (which is buyer-side, JWT-auth, via article_53_attestation tool).",
+        inputSchema: {
+            type: "object",
+            required: ["publisher_id"],
+            properties: {
+                publisher_id: {
+                    type: "string",
+                    description: "UUID of the publisher whose RSL manifest to fetch. Publisher must be verified.",
+                },
+                jsonld: {
+                    type: "boolean",
+                    description: "If true, request JSON-LD shape (Accept: application/ld+json) with embedded HMAC-SHA256 signed receipt. " +
+                        "Default false returns raw RSL Standard JSON shape.",
+                },
+            },
+        },
+    },
     // ─── Phase 10 + 11 buyer-side surfaces (M6.4) ─────────────────────────────
     {
         name: "purchase_enterprise_license",
         description: "Purchase a bulk enterprise license covering multiple publishers (Phase 10). " +
             "Returns a Stripe client_secret for payment completion + the enterprise_license_id. " +
-            "After payment, an eak_* access key is emailed to buyer_email. " +
+            "After payment, an ent_* access key is emailed to buyer_email. " +
             "Scopes: 'custom' (pass-through publisher_ids), 'platform_wide' (auto-resolve all opted-in publishers), 'filtered' (Phase 10 filter_rules). " +
             "License tiers: 'rag' (= ai_retrieval), 'training' (= ai_training, flat-fee not metered), 'inference' (= ai_retrieval), 'full_ai' (writes both retrieval + training records).",
         inputSchema: {
@@ -240,7 +330,7 @@ const TOOLS = [
 if (BUYER_TOKEN) {
     TOOLS.push({
         name: "get_content",
-        description: "Retrieve the full body of a licensed article using a buyer API token (opedd_buyer_live_* canonical post-5.2.1a; bk_live_* legacy). " +
+        description: "Retrieve the full body of a licensed article using a buyer API token (opedd_buyer_live_* canonical; opedd_buyer_test_* for sandbox). " +
             "Requires OPEDD_BUYER_TOKEN env var (create one at opedd.com/licenses after purchasing). " +
             "Works for per-article licenses (token scoped to that article) and archive licenses (token covers all publisher content). " +
             "The publisher must have content delivery enabled and must have pushed content for the article. " +
@@ -257,7 +347,7 @@ if (BUYER_TOKEN) {
                 },
                 buyer_token: {
                     type: "string",
-                    description: "Buyer API token (opedd_buyer_live_* or bk_live_*). Falls back to OPEDD_BUYER_TOKEN env var.",
+                    description: "Buyer API token (opedd_buyer_live_* or opedd_buyer_test_*). Falls back to OPEDD_BUYER_TOKEN env var.",
                 },
             },
         },
@@ -271,7 +361,7 @@ if (ACCESS_KEY) {
             "Returns JSON-format response with paginated articles. " +
             "Use `since` (ISO 8601) for delta-feed polling — only articles published after the timestamp. " +
             "Use `cursor` for pagination across pages. " +
-            "Requires OPEDD_ACCESS_KEY (eak_* enterprise access key). " +
+            "Requires OPEDD_ACCESS_KEY (ent_* enterprise access key). " +
             "For larger bulk corpus pulls, use stream_feed_ndjson (up to 1000 articles per call vs 200 here).",
         inputSchema: {
             type: "object",
@@ -299,7 +389,7 @@ if (ACCESS_KEY) {
             "Use `since` (ISO 8601) for delta-feed. Use `cursor` to paginate beyond 1000. " +
             "Backend supports 5000 articles per call; the MCP cap is 1000 for transport reasonability. " +
             "Real bulk-ingest pipelines should use the Python SDK (pip install opedd) directly — not via MCP. " +
-            "Requires OPEDD_ACCESS_KEY (eak_*).",
+            "Requires OPEDD_ACCESS_KEY (ent_*).",
         inputSchema: {
             type: "object",
             properties: {
@@ -356,6 +446,57 @@ if (BUYER_JWT) {
             },
         },
     });
+    TOOLS.push({
+        name: "get_buyer_account",
+        description: "Fetch the authenticated buyer's account profile + masked API key list via GET /buyer-account. " +
+            "Returns the enterprise_buyers row (contact_email, buyer_org, created_at, etc.) plus a list of all " +
+            "buyer-side API keys with masked prefixes (NEVER plaintext post-issuance — only the 12-char " +
+            "key_prefix is returned, e.g. 'opedd_buyer_'). " +
+            "Use cases: post-signup verification ('what was just issued to me?'), buyer dashboard mental model " +
+            "('what licenses do I currently hold?'), audit prep ('show me the key list before rotation'). " +
+            "For full mid-lifecycle license details (filter_rules, billing, payouts), buyers consult the buyer portal at opedd.com/buyer. " +
+            "Requires OPEDD_BUYER_JWT.",
+        inputSchema: {
+            type: "object",
+            properties: {},
+        },
+    });
+    TOOLS.push({
+        name: "article_53_attestation",
+        description: "Issue a signed JWT attesting to EU AI Act Article 53 compliance for a specific license via " +
+            "GET /eu-ai-act/article-53-attestation (Phase 12 Wave 1 W1.4). " +
+            "Returns a freshly-signed HS256 JWT regulators can verify offline against the canonical signing key. " +
+            "Embeds: license context, usage-count over the attestation window, the most-recent Tempo Merkle root, " +
+            "and canonical claims (iss/sub/iat/exp/jti/aud). " +
+            "**The artifact AI labs hand to legal/procurement for EU AI Act Article 53(1)(d) transparency-obligation evidence.** " +
+            "Per INVARIANTS.md W1.6: this attests to EU AI Act Article 53 ONLY (buyer-side GPAI-model-provider " +
+            "transparency obligation). It does NOT discharge a publisher's CDSM Article 4(3) reservation obligation — " +
+            "that lives on the rsl_get tool (jsonld=true variant). Never conflate. " +
+            "Optional `content_id` scopes the attestation to one article; default is license-wide. " +
+            "Window cap: 365 days. Requires OPEDD_BUYER_JWT.",
+        inputSchema: {
+            type: "object",
+            required: ["license_id"],
+            properties: {
+                license_id: {
+                    type: "string",
+                    description: "UUID of the enterprise_license OR legacy individual license to attest. Buyer must own it.",
+                },
+                content_id: {
+                    type: "string",
+                    description: "Optional UUID of a specific article to scope the attestation. Default: license-wide.",
+                },
+                window_start: {
+                    type: "string",
+                    description: "ISO 8601 lower bound of the attestation window. Default: now - 90 days.",
+                },
+                window_end: {
+                    type: "string",
+                    description: "ISO 8601 upper bound. Default: now. Window may not exceed 365 days (hard cap).",
+                },
+            },
+        },
+    });
     TOOLS.push({
         name: "get_compliance_dossier",
         description: "Generate a procurement-defense compliance dossier via GET /buyer-compliance-report (Phase 11 M4). " +
@@ -413,10 +554,17 @@ if (API_KEY) {
     });
 }
 // ─── MCP Server ───────────────────────────────────────────────────────────────
-const server = new Server({ name: "opedd-mcp", version: "0.2.0" }, { capabilities: { tools: {} } });
+const server = new Server({ name: "opedd-mcp", version: "0.3.0" }, { capabilities: { tools: {} } });
 server.setRequestHandler(ListToolsRequestSchema, async () => ({ tools: TOOLS }));
-server.setRequestHandler(CallToolRequestSchema, async (request) => {
-    const { name, arguments: args = {} } = request.params;
+server.setRequestHandler(CallToolRequestSchema, async (request) => dispatchTool(request.params.name, (request.params.arguments ?? {})));
+// ─── Tool dispatcher (exported for unit tests) ────────────────────────────────
+//
+// Extracted from the inline handler 2026-05-24 EEST as part of the opedd-mcp
+// test cohort ship. Behavior-preserving: the server.setRequestHandler above
+// is a thin delegation to dispatchTool. Exporting allows unit tests to mock
+// global fetch + invoke each tool's handler directly without spawning a
+// stdio subprocess.
+export async function dispatchTool(name, args) {
     try {
         switch (name) {
             // ── lookup_content ─────────────────────────────────────────────────────
@@ -490,6 +638,44 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
                 const data = await opeddFetch(`/content-delivery?article_id=${encodeURIComponent(article_id)}`, { headers: { Authorization: `Bearer ${token}` } });
                 return ok(data);
             }
+            // ── publisher_directory (buyer-discovery catalog browse) ───────────────
+            case "publisher_directory": {
+                const { category, min_articles, verified, limit, offset } = args;
+                const params = new URLSearchParams();
+                if (category)
+                    params.set("category", category);
+                if (min_articles !== undefined)
+                    params.set("min_articles", String(min_articles));
+                if (verified !== undefined)
+                    params.set("verified", verified);
+                if (limit !== undefined)
+                    params.set("limit", String(limit));
+                if (offset !== undefined)
+                    params.set("offset", String(offset));
+                const query = params.toString();
+                const data = await opeddFetch(`/publisher-directory${query ? `?${query}` : ""}`);
+                return ok(data);
+            }
+            // ── detect_platform (Phase 12 Wave 3 W3.1) ─────────────────────────────
+            case "detect_platform": {
+                const { url } = args;
+                if (!url)
+                    return err("url is required");
+                const data = await opeddFetch("/detect-platform", {
+                    method: "POST",
+                    body: JSON.stringify({ url }),
+                });
+                return ok(data);
+            }
+            // ── rsl_get (Phase 12 Wave 1 W1.1) ─────────────────────────────────────
+            case "rsl_get": {
+                const { publisher_id, jsonld = false } = args;
+                if (!publisher_id)
+                    return err("publisher_id is required");
+                const accept = jsonld ? "application/ld+json" : "application/json";
+                const data = await opeddFetch(`/rsl-manifest?publisher_id=${encodeURIComponent(publisher_id)}`, { headers: { Accept: accept } });
+                return ok(data);
+            }
             // ── purchase_enterprise_license (Phase 10) ─────────────────────────────
             case "purchase_enterprise_license": {
                 const { publisher_ids, buyer_email: pelEmail, buyer_org, billing_type = "annual", license_tier = "rag", duration_months = 12, scope = "custom", filter_rules, buyer_webhook_url, } = args;
@@ -522,7 +708,7 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
             // ── list_feed (Phase 10 + 11) ──────────────────────────────────────────
             case "list_feed": {
                 if (!ACCESS_KEY) {
-                    return err("OPEDD_ACCESS_KEY env var is required for this tool (eak_* enterprise access key)");
+                    return err("OPEDD_ACCESS_KEY env var is required for this tool (ent_* enterprise access key)");
                 }
                 const { since, cursor, limit = 50 } = args;
                 const params = new URLSearchParams({
@@ -540,7 +726,7 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
             // ── stream_feed_ndjson (Phase 11 M3) ───────────────────────────────────
             case "stream_feed_ndjson": {
                 if (!ACCESS_KEY) {
-                    return err("OPEDD_ACCESS_KEY env var is required for this tool (eak_* enterprise access key)");
+                    return err("OPEDD_ACCESS_KEY env var is required for this tool (ent_* enterprise access key)");
                 }
                 const { since, cursor, limit = 200 } = args;
                 const params = new URLSearchParams({
@@ -577,6 +763,34 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
                 });
                 return ok(data);
             }
+            // ── get_buyer_account (buyer profile + masked key list) ────────────────
+            case "get_buyer_account": {
+                if (!BUYER_JWT) {
+                    return err("OPEDD_BUYER_JWT env var is required for this tool (Supabase session JWT)");
+                }
+                const data = await opeddFetch("/buyer-account", {
+                    headers: { Authorization: `Bearer ${BUYER_JWT}` },
+                });
+                return ok(data);
+            }
+            // ── article_53_attestation (Phase 12 Wave 1 W1.4) ──────────────────────
+            case "article_53_attestation": {
+                if (!BUYER_JWT) {
+                    return err("OPEDD_BUYER_JWT env var is required for this tool (Supabase session JWT)");
+                }
+                const { license_id, content_id, window_start, window_end } = args;
+                if (!license_id)
+                    return err("license_id is required");
+                const params = new URLSearchParams({ license_id });
+                if (content_id)
+                    params.set("content_id", content_id);
+                if (window_start)
+                    params.set("window_start", window_start);
+                if (window_end)
+                    params.set("window_end", window_end);
+                const data = await opeddFetch(`/eu-ai-act/article-53-attestation?${params.toString()}`, { headers: { Authorization: `Bearer ${BUYER_JWT}` } });
+                return ok(data);
+            }
             // ── get_compliance_dossier (Phase 11 M4) ───────────────────────────────
             case "get_compliance_dossier": {
                 if (!BUYER_JWT) {
@@ -621,8 +835,16 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
         const msg = e instanceof Error ? e.message : String(e);
         return err(`Request failed: ${msg}`);
     }
-});
+}
 // ─── Start ────────────────────────────────────────────────────────────────────
-const transport = new StdioServerTransport();
-await server.connect(transport);
-console.error("[opedd-mcp] Server running on stdio");
+// Skip stdio bootstrap when imported as a module (unit tests need TOOLS +
+// dispatchTool without the server.connect side-effect). Detect via
+// `import.meta.url === pathToFileURL(process.argv[1]).href` — the canonical
+// "am I the entry point" check for ESM Node modules.
+if (typeof process !== "undefined" &&
+    process.argv?.[1] &&
+    import.meta.url === pathToFileURL(process.argv[1]).href) {
+    const transport = new StdioServerTransport();
+    await server.connect(transport);
+    console.error("[opedd-mcp] Server running on stdio");
+}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "opedd-mcp",
-  "version": "0.2.0",
-  "description": "MCP server for Opedd — discover, purchase, verify, and audit content licenses from AI assistants. Covers Phase 11 buyer-side surfaces.",
+  "version": "0.4.0",
+  "description": "MCP server for Opedd — discover, purchase, verify, and audit content licenses from AI assistants. Covers Phase 11 buyer-side surfaces + Phase 12 Wave 1 + 3 regulatory surfaces (CDSM Article 4(3) RSL + EU AI Act Article 53 attestation + platform onboarding helper).",
   "type": "module",
   "main": "dist/index.js",
   "bin": {
@@ -10,7 +10,9 @@
   "scripts": {
     "build": "tsc",
     "start": "node dist/index.js",
-    "dev": "tsx src/index.ts"
+    "dev": "tsx src/index.ts",
+    "test": "vitest run",
+    "test:watch": "vitest"
   },
   "keywords": [
     "mcp",
@@ -26,11 +28,12 @@
     "@modelcontextprotocol/sdk": "^1.0.0"
   },
   "devDependencies": {
-    "@types/node": "^22.0.0",
+    "@types/node": "^22.19.19",
     "tsx": "^4.0.0",
-    "typescript": "^5.0.0"
+    "typescript": "^5.0.0",
+    "vitest": "^4.1.7"
   },
   "engines": {
-    "node": ">=18"
+    "node": ">=20"
   }
 }