opedd-mcp 0.6.10 → 0.6.12

package/dist/index.d.ts

@@ -1,5 +1,6 @@
 #!/usr/bin/env node
 import { type Tool } from "@modelcontextprotocol/sdk/types.js";
+export declare const CURRENT_MSA_VERSION = "master-services-agreement-2026-07-22b";
 export interface Credentials {
     apiBase: string;
     buyerEmail?: string;

package/dist/index.js

@@ -5,6 +5,12 @@ import { CallToolRequestSchema, ListToolsRequestSchema, } from "@modelcontextpro
 import { pathToFileURL } from "node:url";
 import { initTelemetry, captureToolCall, shutdownTelemetry } from "./telemetry.js";
 import { SERVER_VERSION } from "./version.js";
+// ─── Configuration ────────────────────────────────────────────────────────────
+// Current Opedd Master Services Agreement version label. MUST match
+// opedd-backend supabase/functions/_shared/msa-version.ts CURRENT_MSA_VERSION
+// (the backend rejects superseded labels). On an MSA version bump, update this
+// constant and cut a new package release.
+export const CURRENT_MSA_VERSION = "master-services-agreement-2026-07-22b";
 export function envCredentials() {
     return {
         apiBase: process.env.OPEDD_API_URL ?? "https://api.opedd.com",
@@ -322,11 +328,17 @@ function buildTools(has) {
                 "Returns a Stripe client_secret for payment completion + the enterprise_license_id. " +
                 "After payment, an ent_* access key is emailed to buyer_email. " +
                 "Scopes: 'custom' (pass-through publisher_ids), 'platform_wide' (auto-resolve all opted-in publishers), 'filtered' (Phase 10 filter_rules). " +
-                "License tiers: 'rag' (= ai_retrieval), 'training' (= ai_training, flat-fee not metered), 'inference' (= ai_retrieval), 'full_ai' (writes both retrieval + training records).",
+                "License tiers: 'rag' (= ai_retrieval), 'training' (= ai_training, flat-fee not metered), 'inference' (= ai_retrieval), 'full_ai' (writes both retrieval + training records). " +
+                "The buyer must accept the Opedd Master Services Agreement (opedd.com/terms) before purchase — set terms_accepted=true to record it.",
             inputSchema: {
                 type: "object",
-                required: ["publisher_ids", "buyer_email", "buyer_org"],
+                required: ["publisher_ids", "buyer_email", "buyer_org", "terms_accepted"],
                 properties: {
+                    terms_accepted: {
+                        type: "boolean",
+                        description: "REQUIRED. Set true only after the buyer (your principal) has accepted the Opedd Master Services Agreement at opedd.com/terms. " +
+                            "The current MSA version label is recorded with the licence; purchases without genuine acceptance are rejected (HTTP 400).",
+                    },
                     publisher_ids: {
                         type: "array",
                         items: { type: "string" },
@@ -794,7 +806,7 @@ export async function dispatchTool(name, args, creds = ENV_CREDS) {
             }
             // ── purchase_enterprise_license (Phase 10) ─────────────────────────────
             case "purchase_enterprise_license": {
-                const { publisher_ids, buyer_email: pelEmail, buyer_org, billing_type = "annual", license_tier = "rag", duration_months = 12, scope = "custom", filter_rules, buyer_webhook_url, } = args;
+                const { publisher_ids, buyer_email: pelEmail, buyer_org, billing_type = "annual", license_tier = "rag", duration_months = 12, scope = "custom", filter_rules, buyer_webhook_url, terms_accepted, } = args;
                 if (!Array.isArray(publisher_ids) || publisher_ids.length === 0) {
                     if (scope === "custom") {
                         return err("publisher_ids array is required for scope='custom'");
@@ -804,6 +816,9 @@ export async function dispatchTool(name, args, creds = ENV_CREDS) {
                     return err("buyer_email is required");
                 if (!buyer_org)
                     return err("buyer_org is required");
+                if (terms_accepted !== true) {
+                    return err("terms_accepted must be true — confirm with the buyer that they accept the Opedd Master Services Agreement (opedd.com/terms) before purchasing.");
+                }
                 const body = {
                     publisher_ids: publisher_ids ?? [],
                     buyer_email: pelEmail,
@@ -812,6 +827,12 @@ export async function dispatchTool(name, args, creds = ENV_CREDS) {
                     license_tier,
                     duration_months,
                     scope,
+                    // Genuine assent moment: the agent asserted terms_accepted=true just
+                    // now. The backend requires the MSA version label (fail-closed since
+                    // 2026-07-31) and rejects superseded labels — on an MSA version bump
+                    // this constant must be updated (new package release) to match
+                    // opedd-backend _shared/msa-version.ts CURRENT_MSA_VERSION.
+                    terms_version: CURRENT_MSA_VERSION,
                     ...(filter_rules ? { filter_rules } : {}),
                     ...(buyer_webhook_url ? { buyer_webhook_url } : {}),
                 };
@@ -828,7 +849,6 @@ export async function dispatchTool(name, args, creds = ENV_CREDS) {
                 }
                 const { since, cursor, limit = 50 } = args;
                 const params = new URLSearchParams({
-                    access_key: creds.accessKey,
                     format: "json",
                     limit: String(Math.min(Number(limit) || 50, 200)),
                 });
@@ -836,7 +856,11 @@ export async function dispatchTool(name, args, creds = ENV_CREDS) {
                     params.set("since", since);
                 if (cursor)
                     params.set("cursor", cursor);
-                const data = await opeddFetch(creds, `/enterprise-license?${params.toString()}`);
+                // Security 2026-07-27: enterprise key travels in a header, not the
+                // query string (query strings are logged verbatim by proxies/edge).
+                const data = await opeddFetch(creds, `/enterprise-license?${params.toString()}`, {
+                    headers: { "X-Enterprise-Key": creds.accessKey },
+                });
                 return ok(data);
             }
             // ── stream_feed_ndjson (Phase 11 M3) ───────────────────────────────────
@@ -846,7 +870,6 @@ export async function dispatchTool(name, args, creds = ENV_CREDS) {
                 }
                 const { since, cursor, limit = 200 } = args;
                 const params = new URLSearchParams({
-                    access_key: creds.accessKey,
                     format: "ndjson",
                     limit: String(Math.min(Number(limit) || 200, 1000)),
                 });
@@ -854,7 +877,11 @@ export async function dispatchTool(name, args, creds = ENV_CREDS) {
                     params.set("since", since);
                 if (cursor)
                     params.set("cursor", cursor);
-                const data = await opeddFetchNdjson(creds, `/enterprise-license?${params.toString()}`);
+                // Security 2026-07-27: enterprise key travels in a header, not the
+                // query string (query strings are logged verbatim by proxies/edge).
+                const data = await opeddFetchNdjson(creds, `/enterprise-license?${params.toString()}`, {
+                    headers: { "X-Enterprise-Key": creds.accessKey },
+                });
                 return ok(data);
             }
             // ── get_audit_events (Phase 9.x + 10 M5 attestation) ───────────────────

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "opedd-mcp",
-  "version": "0.6.10",
+  "version": "0.6.12",
   "description": "Licensed, rights-cleared content for AI agents — verifiable license keys, on-chain proof, and EU AI Act attestation. The MCP alternative to unlicensed scraping for RAG and AI search.",
   "type": "module",
   "main": "dist/index.js",