opedd-mcp 0.3.0 → 0.4.0

package/README.md

@@ -45,7 +45,7 @@ Exposes up to 16 tools to any AI assistant (some are conditional on env vars):
 | `get_compliance_dossier` | Procurement-defense compliance dossier mapping retrievals to license terms (Phase 11 M4) |
 | `article_53_attestation` | Signed JWT attesting EU AI Act Article 53(1)(d) compliance for a license — the artifact AI labs hand to legal/procurement (Phase 12 W1.4) |
 
-**Requires `OPEDD_API_KEY` (op_*) — publisher-side**
+**Requires `OPEDD_PUB_BEARER` (opedd_pub_*) — publisher-side**
 
 | Tool | Description |
 |------|-------------|
@@ -84,7 +84,8 @@ Set environment variables to pre-configure the server:
 | `OPEDD_BUYER_TOKEN` | Optional | Buyer API token (`opedd_buyer_live_*` canonical; `opedd_buyer_test_*` for sandbox) — enables `get_content` |
 | `OPEDD_ACCESS_KEY` | Optional | Enterprise access key (`ent_*`) — enables `list_feed` + `stream_feed_ndjson` |
 | `OPEDD_BUYER_JWT` | Optional | Supabase session JWT from the buyer portal — enables `get_audit_events` + `get_compliance_dossier` |
-| `OPEDD_API_KEY` | Optional | Publisher API key (`op_...`) — enables `list_publisher_content` |
+| `OPEDD_PUB_BEARER` | Optional | Canonical Publisher API Bearer key (`opedd_pub_<env>_<32-hex>`; issued via `POST /publishers-api-keys action=create_api_key`) — enables `list_publisher_content`. **v0.4.0 canonical.** |
+| `OPEDD_API_KEY` | Deprecated | Legacy Publisher API key (`op_...`) — fallback during the transition window; will stop working when opedd-backend Phase C deploys. Migrate to `OPEDD_PUB_BEARER`. |
 | `OPEDD_API_URL` | Optional | Override the API base URL (default: Opedd production) |
 
 > **Getting a Stripe payment method ID**: Save a card in your Stripe account and retrieve the `pm_...` ID via the [Stripe API](https://stripe.com/docs/api/payment_methods).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "opedd-mcp",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "description": "MCP server for Opedd — discover, purchase, verify, and audit content licenses from AI assistants. Covers Phase 11 buyer-side surfaces + Phase 12 Wave 1 + 3 regulatory surfaces (CDSM Article 4(3) RSL + EU AI Act Article 53 attestation + platform onboarding helper).",
   "type": "module",
   "main": "dist/index.js",

package/src/index.ts

@@ -17,7 +17,16 @@ const API_BASE =
 
 const BUYER_EMAIL = process.env.OPEDD_BUYER_EMAIL;
 const PAYMENT_METHOD_ID = process.env.OPEDD_PAYMENT_METHOD_ID;
-const API_KEY = process.env.OPEDD_API_KEY; // publisher API key (op_...)
+// B91 v0.4.0 migration (2026-05-26): canonical Bearer auth.
+// OPEDD_PUB_BEARER is the new canonical opedd_pub_<env>_<32-hex> key
+// (issued via POST /publishers-api-keys action=create_api_key).
+// OPEDD_API_KEY retained as backward-compat alias for legacy op_ keys
+// during the dual-mode transition window on the /api endpoint (Phase A
+// shipped opedd-backend 2026-05-26). Backend Phase C will drop the
+// op_ path entirely; users MUST migrate to OPEDD_PUB_BEARER before
+// then. Prefer Bearer if both set.
+const PUB_BEARER = process.env.OPEDD_PUB_BEARER; // canonical opedd_pub_<env>_<32-hex>
+const API_KEY = process.env.OPEDD_API_KEY; // LEGACY op_<32-hex> — retiring per backend Phase C
 const BUYER_TOKEN = process.env.OPEDD_BUYER_TOKEN; // buyer API token (opedd_buyer_live_... or opedd_buyer_test_...)
 const ACCESS_KEY = process.env.OPEDD_ACCESS_KEY; // enterprise access key (ent_*); for /enterprise-license GET feed
 const BUYER_JWT = process.env.OPEDD_BUYER_JWT; // Supabase JWT; for /buyer-audit + /buyer-compliance-report
@@ -28,7 +37,9 @@ async function opeddFetch(path: string, options: RequestInit = {}): Promise<unkn
   const url = `${API_BASE}${path}`;
   const headers: Record<string, string> = {
     "Content-Type": "application/json",
-    ...(API_KEY ? { "X-API-Key": API_KEY } : {}),
+    // B91 v0.4.0 (2026-05-26): canonical Bearer preferred; legacy X-API-Key
+    // accepted only as fallback during transition window
+    ...(PUB_BEARER ? { Authorization: `Bearer ${PUB_BEARER}` } : (API_KEY ? { "X-API-Key": API_KEY } : {})),
     ...(options.headers as Record<string, string> ?? {}),
   };
   const res = await fetch(url, { ...options, headers });
@@ -50,7 +61,8 @@ async function opeddFetchNdjson(
   const url = `${API_BASE}${path}`;
   const headers: Record<string, string> = {
     Accept: "application/x-ndjson",
-    ...(API_KEY ? { "X-API-Key": API_KEY } : {}),
+    // B91 v0.4.0 (2026-05-26): canonical Bearer preferred; legacy fallback
+    ...(PUB_BEARER ? { Authorization: `Bearer ${PUB_BEARER}` } : (API_KEY ? { "X-API-Key": API_KEY } : {})),
     ...(options.headers as Record<string, string> ?? {}),
   };
   const res = await fetch(url, { ...options, headers });
@@ -570,11 +582,11 @@ if (BUYER_JWT) {
 }
 
 // If a publisher API key is configured, expose publisher-specific tooling
-if (API_KEY) {
+if (PUB_BEARER || API_KEY) {
   TOOLS.push({
     name: "list_publisher_content",
     description:
-      "List all licensable articles for the authenticated publisher (requires OPEDD_API_KEY). " +
+      "List all licensable articles for the authenticated publisher (requires OPEDD_PUB_BEARER, or legacy OPEDD_API_KEY). " +
       "Returns articles with titles, descriptions, pricing, and sales statistics. " +
       "Use article IDs from this list to purchase licenses via purchase_license.",
     inputSchema: {
@@ -977,8 +989,8 @@ export async function dispatchTool(
 
       // ── list_publisher_content ─────────────────────────────────────────────
       case "list_publisher_content": {
-        if (!API_KEY) {
-          return err("OPEDD_API_KEY env var is required for this tool");
+        if (!PUB_BEARER && !API_KEY) {
+          return err("OPEDD_PUB_BEARER env var is required for this tool (canonical Bearer; legacy OPEDD_API_KEY also accepted during transition)");
         }
 
         const { limit = 20, type, offset = 0 } = args as {

package/tests/dispatcher.env-gated.test.ts

@@ -4,7 +4,7 @@
 //   article_53_attestation, get_buyer_account, get_audit_events,
 //   get_compliance_dossier  (require OPEDD_BUYER_JWT)
 //   list_feed, stream_feed_ndjson  (require OPEDD_ACCESS_KEY)
-//   list_publisher_content  (requires OPEDD_API_KEY)
+//   list_publisher_content  (requires OPEDD_PUB_BEARER OR legacy OPEDD_API_KEY)
 //
 // Separate file from dispatcher.test.ts because the TOOLS array push +
 // CallTool switch cases evaluate env-var presence at module-import time;
@@ -18,6 +18,7 @@ const TEST_BUYER_TOKEN = "opedd_buyer_test_env_gated_xxx";
 const TEST_BUYER_JWT = "eyJhbGc.env-gated-test.sig";
 const TEST_ACCESS_KEY = "ent_env_gated_test";
 const TEST_API_KEY = "op_env_gated_test_pub";
+const TEST_PUB_BEARER = "opedd_pub_test_env_gated_test_pub_canonical_xxxx"; // v0.4.0 canonical Bearer
 const TEST_BUYER_EMAIL = "env-gated@opedd-test.com";
 
 // Stub ALL env vars before any import — guarantees every conditional
@@ -27,6 +28,7 @@ beforeAll(() => {
   vi.stubEnv("OPEDD_BUYER_JWT", TEST_BUYER_JWT);
   vi.stubEnv("OPEDD_ACCESS_KEY", TEST_ACCESS_KEY);
   vi.stubEnv("OPEDD_API_KEY", TEST_API_KEY);
+  vi.stubEnv("OPEDD_PUB_BEARER", TEST_PUB_BEARER);
   vi.stubEnv("OPEDD_BUYER_EMAIL", TEST_BUYER_EMAIL);
   vi.stubEnv("OPEDD_API_URL", "https://api.opedd.com");
 });
@@ -257,15 +259,18 @@ describe("dispatchTool: stream_feed_ndjson (ACCESS_KEY gated)", () => {
 
 // ───────────────────────────── API_KEY-gated tool ─────────────────────────────
 
-describe("dispatchTool: list_publisher_content (API_KEY gated)", () => {
-  it("happy path — sends /api?action=articles + X-API-Key header", async () => {
+describe("dispatchTool: list_publisher_content (PUB_BEARER preferred; API_KEY fallback)", () => {
+  it("happy path — sends /api?action=articles + Authorization: Bearer canonical (v0.4.0)", async () => {
     const f = mockFetchOk({ success: true, data: { articles: [] } });
     const { dispatchTool } = await loadDispatcher();
     await dispatchTool("list_publisher_content", { limit: 20 });
     const call = f.mock.calls[0];
     expect(String(call[0])).toContain("/api?action=articles");
     const headers = (call[1] as RequestInit).headers as Record<string, string>;
-    expect(headers["X-API-Key"]).toBe(TEST_API_KEY);
+    // v0.4.0: Bearer preferred when OPEDD_PUB_BEARER is set; X-API-Key
+    // legacy fallback only when PUB_BEARER unset.
+    expect(headers["Authorization"]).toBe("Bearer " + TEST_PUB_BEARER);
+    expect(headers["X-API-Key"]).toBeUndefined();
   });
 
   it("limit capped at 100", async () => {