opedd-mcp 0.6.9 → 0.6.11

package/dist/index.js

@@ -141,8 +141,13 @@ function buildTools(has) {
                 "License types: 'human' = republication rights, 'ai' = training dataset rights, 'ai_inference' = inference/RAG rights.",
             inputSchema: {
                 type: "object",
-                required: ["license_type"],
+                required: ["license_type", "terms_accepted"],
                 properties: {
+                    terms_accepted: {
+                        type: "boolean",
+                        description: "REQUIRED. Set true only after the buyer (your principal) has accepted the Opedd licence terms at opedd.com/terms. " +
+                            "The acceptance timestamp is recorded with the licence; purchases without genuine acceptance are rejected.",
+                    },
                     article_url: {
                         type: "string",
                         description: "URL of the article to license (use this OR article_id)",
@@ -686,6 +691,10 @@ export async function dispatchTool(name, args, creds = ENV_CREDS) {
                 if (!article_url && !article_id) {
                     return err("Either article_url or article_id is required");
                 }
+                const termsAccepted = args.terms_accepted;
+                if (termsAccepted !== true) {
+                    return err("terms_accepted must be true — confirm with the buyer that they accept the Opedd licence terms (opedd.com/terms) before purchasing.");
+                }
                 const buyerEmail = argEmail || creds.buyerEmail;
                 if (!buyerEmail) {
                     return err("buyer_email is required (or set the OPEDD_BUYER_EMAIL env var)");
@@ -698,6 +707,8 @@ export async function dispatchTool(name, args, creds = ENV_CREDS) {
                 const body = {
                     license_type,
                     buyer_email: buyerEmail,
+                    // Genuine assent moment: the agent asserted terms_accepted=true just now.
+                    terms_accepted_at: new Date().toISOString(),
                     payment: { method: "stripe_pm", payment_method_id: paymentMethodId },
                     ...(article_id ? { article_id } : { article_url }),
                     ...(buyer_name ? { buyer_name } : {}),
@@ -817,7 +828,6 @@ export async function dispatchTool(name, args, creds = ENV_CREDS) {
                 }
                 const { since, cursor, limit = 50 } = args;
                 const params = new URLSearchParams({
-                    access_key: creds.accessKey,
                     format: "json",
                     limit: String(Math.min(Number(limit) || 50, 200)),
                 });
@@ -825,7 +835,11 @@ export async function dispatchTool(name, args, creds = ENV_CREDS) {
                     params.set("since", since);
                 if (cursor)
                     params.set("cursor", cursor);
-                const data = await opeddFetch(creds, `/enterprise-license?${params.toString()}`);
+                // Security 2026-07-27: enterprise key travels in a header, not the
+                // query string (query strings are logged verbatim by proxies/edge).
+                const data = await opeddFetch(creds, `/enterprise-license?${params.toString()}`, {
+                    headers: { "X-Enterprise-Key": creds.accessKey },
+                });
                 return ok(data);
             }
             // ── stream_feed_ndjson (Phase 11 M3) ───────────────────────────────────
@@ -835,7 +849,6 @@ export async function dispatchTool(name, args, creds = ENV_CREDS) {
                 }
                 const { since, cursor, limit = 200 } = args;
                 const params = new URLSearchParams({
-                    access_key: creds.accessKey,
                     format: "ndjson",
                     limit: String(Math.min(Number(limit) || 200, 1000)),
                 });
@@ -843,7 +856,11 @@ export async function dispatchTool(name, args, creds = ENV_CREDS) {
                     params.set("since", since);
                 if (cursor)
                     params.set("cursor", cursor);
-                const data = await opeddFetchNdjson(creds, `/enterprise-license?${params.toString()}`);
+                // Security 2026-07-27: enterprise key travels in a header, not the
+                // query string (query strings are logged verbatim by proxies/edge).
+                const data = await opeddFetchNdjson(creds, `/enterprise-license?${params.toString()}`, {
+                    headers: { "X-Enterprise-Key": creds.accessKey },
+                });
                 return ok(data);
             }
             // ── get_audit_events (Phase 9.x + 10 M5 attestation) ───────────────────

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "opedd-mcp",
-  "version": "0.6.9",
+  "version": "0.6.11",
   "description": "Licensed, rights-cleared content for AI agents — verifiable license keys, on-chain proof, and EU AI Act attestation. The MCP alternative to unlicensed scraping for RAG and AI search.",
   "type": "module",
   "main": "dist/index.js",