opedd-mcp 0.6.7 → 0.6.9

package/README.md

@@ -128,7 +128,7 @@ Exposes up to 17 tools to any AI assistant (some are conditional on env vars):
 
 ### Regulatory framing (CDSM Article 4 vs EU AI Act Article 53 — never conflated)
 
-Per the [opedd-backend INVARIANTS.md W1.6 amendment](https://github.com/Opedd/opedd-backend/blob/main/INVARIANTS.md):
+Per Opedd's platform invariants (W1.6 amendment):
 
 - **`rsl_get(publisher_id, jsonld=true)`** → publisher-side **CDSM Article 4(3)** opt-out declaration (signed JSON-LD receipt over the reservation state).
 - **`article_53_attestation(license_id)`** → buyer-side **EU AI Act Article 53** attestation (signed HS256 JWT scoped to one license).

package/dist/index.js

@@ -41,7 +41,15 @@ async function opeddFetch(creds, path, options = {}) {
         let msg = `HTTP ${res.status}`;
         try {
             const errBody = await res.json();
-            msg = errBody?.error || errBody?.message || msg;
+            // Backend envelope upgraded to structured errors ({ error: { code,
+            // message } }); the old string-shape is kept as fallback. Passing the
+            // object into Error() rendered "[object Object]" — every agent-facing
+            // failure was unreadable (launch-gaps follow-on, 2026-07-17).
+            const e = errBody?.error;
+            msg =
+                (typeof e === "object" && e !== null ? [e.code, e.message].filter(Boolean).join(": ") : e) ||
+                    errBody?.message ||
+                    msg;
         }
         catch {
             // non-JSON error body — keep the HTTP-status default
@@ -66,7 +74,15 @@ async function opeddFetchNdjson(creds, path, options = {}) {
         let msg = `HTTP ${res.status}`;
         try {
             const errBody = await res.json();
-            msg = errBody?.error || errBody?.message || msg;
+            // Backend envelope upgraded to structured errors ({ error: { code,
+            // message } }); the old string-shape is kept as fallback. Passing the
+            // object into Error() rendered "[object Object]" — every agent-facing
+            // failure was unreadable (launch-gaps follow-on, 2026-07-17).
+            const e = errBody?.error;
+            msg =
+                (typeof e === "object" && e !== null ? [e.code, e.message].filter(Boolean).join(": ") : e) ||
+                    errBody?.message ||
+                    msg;
         }
         catch {
             // non-JSON error body — keep the HTTP-status default
@@ -396,7 +412,7 @@ function buildTools(has) {
                     },
                     cursor: {
                         type: "string",
-                        description: "Opaque cursor from prior response's _meta.next_cursor",
+                        description: "Opaque cursor from the prior response's data.pagination.next_cursor",
                     },
                     limit: {
                         type: "number",
@@ -423,7 +439,7 @@ function buildTools(has) {
                     },
                     cursor: {
                         type: "string",
-                        description: "Opaque cursor from prior response's _meta.next_cursor",
+                        description: "Opaque cursor from the prior result's meta.next_cursor",
                     },
                     limit: {
                         type: "number",
@@ -640,7 +656,10 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
     // dispatchTool) keeps unit tests, which call dispatchTool directly, silent.
     const start = Date.now();
     const result = await dispatchTool(request.params.name, (request.params.arguments ?? {}));
-    captureToolCall(request.params.name, Date.now() - start, result.isError !== true);
+    // channel:"stdio" lets the channel report separate local (npx) usage from
+    // hosted-gateway usage (channel:"gateway"); the Phase-2 hosted trigger
+    // counts only the latter.
+    captureToolCall(request.params.name, Date.now() - start, result.isError !== true, { channel: "stdio" });
     return result;
 });
 // ─── Tool dispatcher (exported for unit tests) ────────────────────────────────

package/dist/telemetry.js

@@ -37,12 +37,17 @@ export function isTelemetryEnabled() {
  * the privacy invariant directly.
  */
 export function toolCallProperties(tool, durationMs, ok, extra) {
+    // Spread `extra` FIRST so it can never overwrite the privacy-critical /
+    // integrity fields below. Otherwise a future caller passing e.g.
+    // { tool: ... } or { ok: ... } could silently forge metrics or shadow the
+    // canonical fields — the "nothing sensitive by construction" guarantee
+    // must hold even against a coding mistake in a caller.
     return {
+        ...extra,
         tool,
         duration_ms: Math.round(durationMs),
         ok,
         server_version: SERVER_VERSION,
-        ...extra,
     };
 }
 let client = null;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "opedd-mcp",
-  "version": "0.6.7",
-  "description": "Licensed, rights-cleared content for AI agents \u2014 verifiable license keys, on-chain proof, and EU AI Act attestation. The MCP alternative to unlicensed scraping for RAG and AI search.",
+  "version": "0.6.9",
+  "description": "Licensed, rights-cleared content for AI agents — verifiable license keys, on-chain proof, and EU AI Act attestation. The MCP alternative to unlicensed scraping for RAG and AI search.",
   "type": "module",
   "main": "dist/index.js",
   "mcpName": "com.opedd/opedd-mcp",