@chaindaddy/mcp 0.4.2 → 0.6.0

package/build/login.js

@@ -0,0 +1,203 @@
+// The Chain Daddy CLI's stored login, used by this server when no API key is
+// set: run `chaindaddy login` once and the MCP server needs no key either.
+//
+// cli/src/lib/login.ts OWNS THE FORMAT (where it is stored, the record's
+// fields, the refresh lock). This is a compact copy of the parts a server
+// needs: read the record, refresh it under the same lock, and sign each
+// request with the login's DPoP key (RFC 9449). Change both together.
+import { createHash, createPrivateKey, randomBytes, sign } from "node:crypto";
+import { spawnSync } from "node:child_process";
+import { chmodSync, closeSync, existsSync, mkdirSync, openSync, readFileSync, renameSync, statSync, unlinkSync, writeFileSync, } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+/** Stands in for the login wherever a bearer is chosen; loginFetch replaces it. */
+export const CLI_LOGIN = "chaindaddy-login";
+const SERVICE = "chaindaddy-cli";
+const dir = () => join(homedir(), ".chaindaddy");
+const loginFile = () => join(dir(), "login.json");
+const lockFile = () => join(dir(), "login.lock");
+const forceFile = () => process.env.CHAINDADDY_LOGIN_STORE === "file";
+const onPath = (bin) => (process.env.PATH ?? "").split(":").some((d) => d && existsSync(join(d, bin)));
+const keychain = () => !forceFile() && process.platform === "darwin" && existsSync("/usr/bin/security");
+const secretTool = () => !forceFile() && process.platform === "linux" && onPath("secret-tool");
+function run(cmd, args, input) {
+    const r = spawnSync(cmd, args, { input, encoding: "utf-8", timeout: 10_000, stdio: ["pipe", "pipe", "pipe"] });
+    return { ok: r.status === 0 && !r.error, out: (r.stdout ?? "").trim() };
+}
+function fileStore() {
+    try {
+        return JSON.parse(readFileSync(loginFile(), "utf-8"));
+    }
+    catch {
+        return {};
+    }
+}
+function decode(raw) {
+    try {
+        return JSON.parse(Buffer.from(raw, "base64").toString("utf-8"));
+    }
+    catch {
+        return undefined;
+    }
+}
+function load(rawApiUrl) {
+    // Keyed by the API URL exactly as the CLI resolves it: no trailing slash.
+    const apiUrl = rawApiUrl.replace(/\/+$/, "");
+    if (keychain()) {
+        const r = run("/usr/bin/security", ["find-generic-password", "-s", SERVICE, "-a", apiUrl, "-w"]);
+        if (r.ok && r.out)
+            return decode(r.out);
+    }
+    else if (secretTool()) {
+        const r = run("secret-tool", ["lookup", "service", SERVICE, "account", apiUrl]);
+        if (r.ok && r.out)
+            return decode(r.out);
+    }
+    return fileStore()[apiUrl];
+}
+function writeFileStore(all) {
+    mkdirSync(dir(), { recursive: true, mode: 0o700 });
+    const tmp = `${loginFile()}.${process.pid}.tmp`;
+    writeFileSync(tmp, JSON.stringify(all, null, 2), { mode: 0o600 });
+    chmodSync(tmp, 0o600);
+    renameSync(tmp, loginFile());
+}
+function save(rec) {
+    const value = Buffer.from(JSON.stringify(rec)).toString("base64");
+    let wrote = false;
+    if (keychain() && !/["\\\s]/.test(rec.apiUrl)) {
+        run("/usr/bin/security", ["-i"], `add-generic-password -U -s ${SERVICE} -a "${rec.apiUrl}" -l "Chain Daddy CLI" -w ${value}\n`);
+        wrote = load(rec.apiUrl)?.refreshToken === rec.refreshToken;
+    }
+    else if (secretTool()) {
+        wrote = run("secret-tool", ["store", "--label=Chain Daddy CLI", "service", SERVICE, "account", rec.apiUrl], value).ok;
+    }
+    const all = fileStore();
+    if (wrote) {
+        // The keyring copy is the one read first; a file copy would only be stale.
+        if (all[rec.apiUrl]) {
+            delete all[rec.apiUrl];
+            writeFileStore(all);
+        }
+        return;
+    }
+    all[rec.apiUrl] = rec;
+    writeFileStore(all);
+}
+/** Whether `chaindaddy login` is stored for this API. */
+export function hasCliLogin(apiUrl) {
+    return !!load(apiUrl);
+}
+function proof(jwk, method, url, accessToken) {
+    const u = new URL(url);
+    const b64 = (s) => Buffer.from(s).toString("base64url");
+    const header = { typ: "dpop+jwt", alg: "ES256", jwk: { kty: "EC", crv: "P-256", x: jwk.x, y: jwk.y } };
+    const payload = {
+        jti: randomBytes(16).toString("base64url"),
+        htm: method.toUpperCase(),
+        htu: `${u.protocol}//${u.host}${u.pathname}`,
+        iat: Math.floor(Date.now() / 1000),
+    };
+    if (accessToken)
+        payload.ath = createHash("sha256").update(accessToken).digest("base64url");
+    const input = `${b64(JSON.stringify(header))}.${b64(JSON.stringify(payload))}`;
+    const sig = sign("sha256", Buffer.from(input), { key: createPrivateKey({ key: jwk, format: "jwk" }), dsaEncoding: "ieee-p1363" });
+    return `${input}.${sig.toString("base64url")}`;
+}
+async function locked(fn) {
+    mkdirSync(dir(), { recursive: true, mode: 0o700 });
+    const deadline = Date.now() + 70_000;
+    for (;;) {
+        try {
+            closeSync(openSync(lockFile(), "wx", 0o600));
+            break;
+        }
+        catch (e) {
+            if (e.code !== "EEXIST")
+                throw e;
+            try {
+                if (Date.now() - statSync(lockFile()).mtimeMs > 60_000)
+                    unlinkSync(lockFile());
+            }
+            catch {
+                /* gone already */
+            }
+            if (Date.now() > deadline)
+                throw new Error("another process is refreshing the Chain Daddy login; try again");
+            await new Promise((r) => setTimeout(r, 100));
+        }
+    }
+    try {
+        return await fn();
+    }
+    finally {
+        try {
+            unlinkSync(lockFile());
+        }
+        catch { /* already gone */ }
+    }
+}
+/** The login with a live access token, refreshed (once, under the lock) when needed. */
+async function current(apiUrl, stale) {
+    const fresh = (r) => (stale ? r.accessToken !== stale : Date.parse(r.accessExpiresAt) - Date.now() > 60_000);
+    const first = load(apiUrl);
+    if (!first)
+        throw new Error("NO_CREDENTIALS: not signed in; run `chaindaddy login` or set CHAINDADDY_API_KEY");
+    if (fresh(first))
+        return first;
+    return locked(async () => {
+        const rec = load(apiUrl);
+        if (!rec)
+            throw new Error("NO_CREDENTIALS: not signed in; run `chaindaddy login` or set CHAINDADDY_API_KEY");
+        if (fresh(rec))
+            return rec;
+        const url = `${rec.apiUrl}/api/v2/oauth/token`;
+        const resp = await fetch(url, {
+            method: "POST",
+            headers: { "Content-Type": "application/x-www-form-urlencoded", Accept: "application/json", DPoP: proof(rec.dpopJwk, "POST", url) },
+            body: new URLSearchParams({ grant_type: "refresh_token", refresh_token: rec.refreshToken, client_id: rec.clientId || "chaindaddy-cli" }).toString(),
+        });
+        const t = (await resp.json().catch(() => ({})));
+        if (!resp.ok) {
+            throw new Error(t.error === "invalid_grant"
+                ? "NO_CREDENTIALS: the Chain Daddy login has ended; run `chaindaddy login` again"
+                : `could not refresh the Chain Daddy login (HTTP ${resp.status})`);
+        }
+        const next = {
+            ...rec,
+            accessToken: String(t.access_token),
+            refreshToken: String(t.refresh_token),
+            accessExpiresAt: new Date(Date.now() + Number(t.expires_in ?? 3600) * 1000).toISOString(),
+            scope: typeof t.scope === "string" ? t.scope : rec.scope,
+        };
+        save(next);
+        return next;
+    });
+}
+/**
+ * fetch for a request whose bearer is CLI_LOGIN: sends it as the login
+ * (`Authorization: DPoP` + a proof), refreshing and retrying once when the API
+ * says the access token is dead. Any other request goes out unchanged.
+ */
+export async function loginFetch(apiUrl, url, init = {}) {
+    const headers = new Headers(init.headers);
+    if (headers.get("authorization") !== `Bearer ${CLI_LOGIN}`)
+        return fetch(url, init);
+    headers.delete("x-api-key");
+    const method = (init.method ?? "GET").toUpperCase();
+    const send = (rec) => {
+        const h = new Headers(headers);
+        h.set("Authorization", `DPoP ${rec.accessToken}`);
+        h.set("DPoP", proof(rec.dpopJwk, method, url, rec.accessToken));
+        return fetch(url, { ...init, headers: h });
+    };
+    const rec = await current(apiUrl);
+    const resp = await send(rec);
+    if (resp.status !== 401)
+        return resp;
+    const body = (await resp.clone().json().catch(() => ({})));
+    if (body.error !== "invalid_token" && !(resp.headers.get("www-authenticate") ?? "").includes("invalid_token"))
+        return resp;
+    return send(await current(apiUrl, rec.accessToken));
+}
+//# sourceMappingURL=login.js.map

package/build/login.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"login.js","sourceRoot":"","sources":["../src/login.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAC7E,2EAA2E;AAC3E,EAAE;AACF,yEAAyE;AACzE,0EAA0E;AAC1E,wEAAwE;AACxE,sEAAsE;AAEtE,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,WAAW,EAAE,IAAI,EAAmB,MAAM,aAAa,CAAC;AAC/F,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EACL,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,YAAY,EAAE,UAAU,EAAE,QAAQ,EAAE,UAAU,EAAE,aAAa,GACrH,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,mFAAmF;AACnF,MAAM,CAAC,MAAM,SAAS,GAAG,kBAAkB,CAAC;AAC5C,MAAM,OAAO,GAAG,gBAAgB,CAAC;AAajC,MAAM,GAAG,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,aAAa,CAAC,CAAC;AACjD,MAAM,SAAS,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,YAAY,CAAC,CAAC;AAClD,MAAM,QAAQ,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,YAAY,CAAC,CAAC;AACjD,MAAM,SAAS,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,sBAAsB,KAAK,MAAM,CAAC;AACtE,MAAM,MAAM,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;AAC/G,MAAM,QAAQ,GAAG,GAAG,EAAE,CAAC,CAAC,SAAS,EAAE,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,IAAI,UAAU,CAAC,mBAAmB,CAAC,CAAC;AACxG,MAAM,UAAU,GAAG,GAAG,EAAE,CAAC,CAAC,SAAS,EAAE,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,aAAa,CAAC,CAAC;AAE/F,SAAS,GAAG,CAAC,GAAW,EAAE,IAAc,EAAE,KAAc;IACtD,MAAM,CAAC,GAAG,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;IAC/G,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;AAC1E,CAAC;AAED,SAAS,SAAS;IAChB,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,SAAS,EAAE,EAAE,OAAO,CAAC,CAAgC,CAAC;IACvF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,MAAM,CAAC,GAAW;IACzB,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAgB,CAAC;IACjF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,IAAI,CAAC,SAAiB;IAC7B,0EAA0E;IAC1E,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC7C,IAAI,QAAQ,EAAE,EAAE,CAAC;QACf,MAAM,CAAC,GAAG,GAAG,CAAC,mBAAmB,EAAE,CAAC,uBAAuB,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC;QACjG,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,GAAG;YAAE,OAAO,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAC1C,CAAC;SAAM,IAAI,UAAU,EAAE,EAAE,CAAC;QACxB,MAAM,CAAC,GAAG,GAAG,CAAC,aAAa,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC;QAChF,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,GAAG;YAAE,OAAO,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO,SAAS,EAAE,CAAC,MAAM,CAAC,CAAC;AAC7B,CAAC;AAED,SAAS,cAAc,CAAC,GAAgC;IACtD,SAAS,CAAC,GAAG,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACnD,MAAM,GAAG,GAAG,GAAG,SAAS,EAAE,IAAI,OAAO,CAAC,GAAG,MAAM,CAAC;IAChD,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAClE,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACtB,UAAU,CAAC,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC;AAC/B,CAAC;AAED,SAAS,IAAI,CAAC,GAAgB;IAC5B,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAClE,IAAI,KAAK,GAAG,KAAK,CAAC;IAClB,IAAI,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QAC9C,GAAG,CAAC,mBAAmB,EAAE,CAAC,IAAI,CAAC,EAAE,8BAA8B,OAAO,QAAQ,GAAG,CAAC,MAAM,6BAA6B,KAAK,IAAI,CAAC,CAAC;QAChI,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,YAAY,KAAK,GAAG,CAAC,YAAY,CAAC;IAC9D,CAAC;SAAM,IAAI,UAAU,EAAE,EAAE,CAAC;QACxB,KAAK,GAAG,GAAG,CAAC,aAAa,EAAE,CAAC,OAAO,EAAE,yBAAyB,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;IACxH,CAAC;IACD,MAAM,GAAG,GAAG,SAAS,EAAE,CAAC;IACxB,IAAI,KAAK,EAAE,CAAC;QACV,2EAA2E;QAC3E,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YACpB,OAAO,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACvB,cAAc,CAAC,GAAG,CAAC,CAAC;QACtB,CAAC;QACD,OAAO;IACT,CAAC;IACD,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,GAAG,CAAC;IACtB,cAAc,CAAC,GAAG,CAAC,CAAC;AACtB,CAAC;AAED,yDAAyD;AACzD,MAAM,UAAU,WAAW,CAAC,MAAc;IACxC,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AACxB,CAAC;AAED,SAAS,KAAK,CAAC,GAAe,EAAE,MAAc,EAAE,GAAW,EAAE,WAAoB;IAC/E,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACvB,MAAM,GAAG,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAChE,MAAM,MAAM,GAAG,EAAE,GAAG,EAAE,UAAU,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC;IACvG,MAAM,OAAO,GAA4B;QACvC,GAAG,EAAE,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;QAC1C,GAAG,EAAE,MAAM,CAAC,WAAW,EAAE;QACzB,GAAG,EAAE,GAAG,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE;QAC5C,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;KACnC,CAAC;IACF,IAAI,WAAW;QAAE,OAAO,CAAC,GAAG,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAC5F,MAAM,KAAK,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;IAC/E,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,GAAG,EAAE,gBAAgB,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC,CAAC;IAClI,OAAO,GAAG,KAAK,IAAI,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;AACjD,CAAC;AAED,KAAK,UAAU,MAAM,CAAI,EAAoB;IAC3C,SAAS,CAAC,GAAG,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACnD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC;IACrC,SAAS,CAAC;QACR,IAAI,CAAC;YACH,SAAS,CAAC,QAAQ,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;YAC7C,MAAM;QACR,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAK,CAA2B,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,CAAC,CAAC;YAC5D,IAAI,CAAC;gBACH,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC,OAAO,GAAG,MAAM;oBAAE,UAAU,CAAC,QAAQ,EAAE,CAAC,CAAC;YACjF,CAAC;YAAC,MAAM,CAAC;gBACP,kBAAkB;YACpB,CAAC;YACD,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ;gBAAE,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;YAC7G,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC;IACD,IAAI,CAAC;QACH,OAAO,MAAM,EAAE,EAAE,CAAC;IACpB,CAAC;YAAS,CAAC;QACT,IAAI,CAAC;YAAC,UAAU,CAAC,QAAQ,EAAE,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,CAAC;IAC9D,CAAC;AACH,CAAC;AAED,wFAAwF;AACxF,KAAK,UAAU,OAAO,CAAC,MAAc,EAAE,KAAc;IACnD,MAAM,KAAK,GAAG,CAAC,CAAc,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,KAAK,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,eAAe,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,CAAC;IAC1H,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;IAC3B,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,iFAAiF,CAAC,CAAC;IAC/G,IAAI,KAAK,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC/B,OAAO,MAAM,CAAC,KAAK,IAAI,EAAE;QACvB,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;QACzB,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,iFAAiF,CAAC,CAAC;QAC7G,IAAI,KAAK,CAAC,GAAG,CAAC;YAAE,OAAO,GAAG,CAAC;QAC3B,MAAM,GAAG,GAAG,GAAG,GAAG,CAAC,MAAM,qBAAqB,CAAC;QAC/C,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAC5B,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE,MAAM,EAAE,kBAAkB,EAAE,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE;YACnI,IAAI,EAAE,IAAI,eAAe,CAAC,EAAE,UAAU,EAAE,eAAe,EAAE,aAAa,EAAE,GAAG,CAAC,YAAY,EAAE,SAAS,EAAE,GAAG,CAAC,QAAQ,IAAI,gBAAgB,EAAE,CAAC,CAAC,QAAQ,EAAE;SACpJ,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAA4B,CAAC;QAC3E,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,KAAK,eAAe;gBACzC,CAAC,CAAC,+EAA+E;gBACjF,CAAC,CAAC,iDAAiD,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;QACvE,CAAC;QACD,MAAM,IAAI,GAAgB;YACxB,GAAG,GAAG;YACN,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC;YACnC,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC;YACrC,eAAe,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC,UAAU,IAAI,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE;YACzF,KAAK,EAAE,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK;SACzD,CAAC;QACF,IAAI,CAAC,IAAI,CAAC,CAAC;QACX,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,MAAc,EAAE,GAAW,EAAE,OAAoB,EAAE;IAClF,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC1C,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,KAAK,UAAU,SAAS,EAAE;QAAE,OAAO,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACpF,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAC5B,MAAM,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;IACpD,MAAM,IAAI,GAAG,CAAC,GAAgB,EAAE,EAAE;QAChC,MAAM,CAAC,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;QAC/B,CAAC,CAAC,GAAG,CAAC,eAAe,EAAE,QAAQ,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;QAClD,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC;QAChE,OAAO,KAAK,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;IAC7C,CAAC,CAAC;IACF,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;IAClC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IACrC,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAuB,CAAC;IACjF,IAAI,IAAI,CAAC,KAAK,KAAK,eAAe,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,eAAe,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3H,OAAO,IAAI,CAAC,MAAM,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC;AACtD,CAAC"}

package/build/skills.d.ts

@@ -0,0 +1,10 @@
+export interface Skill {
+    name: string;
+    title: string;
+    description: string;
+    body: string;
+}
+export declare function parseSkill(dir: string, text: string): Skill;
+/** Every skill, sorted by name. Throws when a SKILL.md is malformed. */
+export declare function loadSkills(root?: string): Skill[];
+//# sourceMappingURL=skills.d.ts.map

package/build/skills.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"skills.d.ts","sourceRoot":"","sources":["../src/skills.ts"],"names":[],"mappings":"AAWA,MAAM,WAAW,KAAK;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;CACd;AAKD,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,KAAK,CAkB3D;AAED,wEAAwE;AACxE,wBAAgB,UAAU,CAAC,IAAI,GAAE,MAAmB,GAAG,KAAK,EAAE,CAK7D"}

package/build/skills.js

@@ -0,0 +1,46 @@
+/**
+ * Chain Daddy's Agent Skills, read from the package's skills/ directory: one
+ * directory per skill holding a SKILL.md (frontmatter with name and
+ * description, then the Markdown body). In the source tree that is mcp/skills,
+ * the single source of truth the remote server embeds too (mcp/skills/skills.go
+ * parses them the same way); in the installed package it sits beside build/.
+ */
+import { existsSync, readdirSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+import { fileURLToPath } from "node:url";
+const SKILLS_DIR = fileURLToPath(new URL("../skills/", import.meta.url));
+// Frontmatter is flat "key: value" lines; a quoted value loses its quotes.
+export function parseSkill(dir, text) {
+    if (!text.startsWith("---\n"))
+        throw new Error(`${dir}: SKILL.md does not start with a --- frontmatter line`);
+    const end = text.indexOf("\n---\n", 3);
+    if (end < 0)
+        throw new Error(`${dir}: frontmatter is not closed by a --- line`);
+    const fields = {};
+    for (const line of text.slice(4, end).split("\n")) {
+        const i = line.indexOf(":");
+        if (i < 0)
+            throw new Error(`${dir}: frontmatter line ${JSON.stringify(line)} is not key: value`);
+        let v = line.slice(i + 1).trim();
+        if (v.length >= 2 && (v[0] === '"' || v[0] === "'") && v[v.length - 1] === v[0])
+            v = v.slice(1, -1);
+        fields[line.slice(0, i).trim()] = v;
+    }
+    const body = text.slice(end + 5).replace(/^\n+/, "");
+    const title = body.split("\n").find((l) => l.startsWith("# "))?.slice(2).trim() ?? "";
+    if (fields.name !== dir)
+        throw new Error(`${dir}: name ${JSON.stringify(fields.name)} does not match its directory`);
+    if (!fields.description)
+        throw new Error(`${dir}: no description`);
+    if (!title)
+        throw new Error(`${dir}: body has no # heading to title it`);
+    return { name: fields.name, title, description: fields.description, body };
+}
+/** Every skill, sorted by name. Throws when a SKILL.md is malformed. */
+export function loadSkills(root = SKILLS_DIR) {
+    return readdirSync(root, { withFileTypes: true })
+        .filter((d) => d.isDirectory() && existsSync(join(root, d.name, "SKILL.md")))
+        .map((d) => parseSkill(d.name, readFileSync(join(root, d.name, "SKILL.md"), "utf8")))
+        .sort((a, b) => (a.name < b.name ? -1 : a.name > b.name ? 1 : 0));
+}
+//# sourceMappingURL=skills.js.map

package/build/skills.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"skills.js","sourceRoot":"","sources":["../src/skills.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAChE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AASzC,MAAM,UAAU,GAAG,aAAa,CAAC,IAAI,GAAG,CAAC,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAEzE,2EAA2E;AAC3E,MAAM,UAAU,UAAU,CAAC,GAAW,EAAE,IAAY;IAClD,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,GAAG,uDAAuD,CAAC,CAAC;IAC9G,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;IACvC,IAAI,GAAG,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,GAAG,2CAA2C,CAAC,CAAC;IAChF,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QAClD,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,GAAG,GAAG,sBAAsB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;QACjG,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACjC,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACpG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC;IACtC,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACrD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC;IACtF,IAAI,MAAM,CAAC,IAAI,KAAK,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,GAAG,UAAU,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;IACrH,IAAI,CAAC,MAAM,CAAC,WAAW;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,GAAG,kBAAkB,CAAC,CAAC;IACnE,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,GAAG,qCAAqC,CAAC,CAAC;IACzE,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC;AAC7E,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,UAAU,CAAC,OAAe,UAAU;IAClD,OAAO,WAAW,CAAC,IAAI,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;SAC9C,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC;SAC5E,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,EAAE,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,UAAU,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;SACpF,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACtE,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@chaindaddy/mcp",
-  "version": "0.4.2",
+  "version": "0.6.0",
   "description": "MCP server for Chain Daddy: search tickers, launch or import a token, and run its creator store",
   "mcpName": "io.chaindaddy/mcp",
   "homepage": "https://docs.chaindaddy.io/developer/store-and-rewards#tools-for-agents",
@@ -56,6 +56,7 @@
   },
   "files": [
     "build",
+    "skills/*/SKILL.md",
     "README.md"
   ]
 }

package/skills/add-crypto-to-your-game/SKILL.md

@@ -0,0 +1,114 @@
+---
+name: add-crypto-to-your-game
+description: The end-to-end path for putting a game, app or site on crypto with Chain Daddy - pick or launch a token, sell items for it, sign players in with their wallet, verify purchases on your server, and run it all on a no-money test store first. Use when someone wants to add a token, sell in-game items for crypto, give holders perks, or "add crypto" to a game, app or dApp.
+license: MIT
+---
+
+# Add crypto to your game or app
+
+Chain Daddy gives a token a verified page and a **store**: items you sell for that token, a record of what
+each wallet owns, and a signed receipt for every purchase. Your game reads what a player owns; it never
+moves money.
+
+## How it fits together
+
+```
+your token ── its page on chaindaddy.io ── its store (items, what each wallet owns, receipts)
+                                               │
+          your game client ── asks to buy ─────┤  the buyer's wallet pays your payout wallet on chain
+                                               │
+          your server ── store key ────────────┘  creates orders, verifies receipts, spends items
+```
+
+1. **Money never passes through your code.** The buyer's wallet pays the token's payout wallet directly,
+   in one on-chain transaction. Chain Daddy then grants the item and signs a receipt.
+2. **The client asks, the server decides.** Anything with value (spending credits, a ranked result, a
+   prize) is decided on your server, with a store key only the server holds.
+3. **Test first.** A test store runs the whole loop with no wallet, no chain and no money.
+
+## What the human needs first
+
+Check these before writing code, and stop with a clear next step if one is missing:
+
+| Need | How to check | If missing |
+|---|---|---|
+| A token page they own or manage, and its **chain key** (`base`) and **crown id** (the registration id) | `find-and-check-a-token` skill | Import a token they made elsewhere, or `launch-a-token` |
+| A plan that can open a store: Developer, Partner or Enterprise, or Developer Beta Program membership | `GET https://api.chaindaddy.io/api/v2/iap/eligibility` (signed in) | Any paid plan, then sign the agreement at https://chaindaddy.io/_developer |
+| Signed in on this computer | `chaindaddy whoami` | They run `chaindaddy login` and approve in the browser (any wallet or email/social sign-in); the CLI and the local MCP server both use it. A server or CI job gets a `cd_live_…` key instead (`chaindaddy keys create`) |
+
+Never ask the human to paste a key into the chat. Ask them to set it as an environment variable.
+
+## The path
+
+### 1. Pick the token
+
+- **Their own token, made elsewhere:** they import it on chaindaddy.io (one fee, or free for established
+  tokens). A store can only sell for a token whose page the wallet owns or manages.
+- **A new token:** see `launch-a-token`. A token launched in a Chain Daddy launchpad pool pays **0%** on
+  store sales; any other token pays **2.5%**, taken out of the price at checkout.
+
+### 2. Decide where the game runs
+
+| The game runs… | How it sells | Skill |
+|---|---|---|
+| On the token page, as a Crown App | Sends the `iap-purchase` action; the page shows its own purchase sheet and handles the wallet. No server or payment code needed | `build-a-crown-app` |
+| In your own site, app or client | Your server creates an order; your client pays with the order's `payment` block | `sell-items-in-your-app` |
+| Anywhere, with no code | A payment link: `https://chaindaddy.io/<symbol>/<chain>?buy=<sku>` | `sell-items-in-your-app` |
+
+### 3. Design the catalog
+
+| Type | Use it for |
+|---|---|
+| `non_consumable` | Owned for good, one per wallet: a skin, a badge, a level pack |
+| `consumable` | Used up: credits, boosts. A bundle `grants` other items |
+| `timed` | Access for a while: a season pass, a rental |
+| `unlock` | Never sold. Held while a rule holds, e.g. "holds at least 1,000 tokens" |
+
+Put what the game needs to apply an item in its `metadata`: that JSON is the contract between the store and
+the game. Price in dollars (`priceUsdMicros`, with `minPrice` / `maxPrice` bounds) and take payment in the
+token, so prices don't swing with the market.
+
+### 4. Build against the test store
+
+Open the test store beside the live one (`iap_open_test_store` / `chaindaddy iap store test <storeId>`), make
+a `cd_iap_test_…` key on it, then run the whole loop: create an order, pay it with `iap_test_pay`, verify the
+receipt (`livemode: false`), read and spend the items, and receive the webhook. Details in
+`sell-items-in-your-app`.
+
+### 5. Know who the player is
+
+- In a Crown App: the `session-token` action gives a short-lived token your server verifies.
+- On your own site or app: Sign in with Chain Daddy (standard OpenID Connect) - see `sign-in-with-chain-daddy`.
+
+Both identify the player by wallet (`sub`). Key accounts by that wallet.
+
+### 6. Verify on your server
+
+Verify every receipt and session token on the server before acting on it - see `verify-receipts-and-sessions`.
+Deliver on `confirmed`, credit each `orderId` once, and treat the store's item ledger
+(`GET …/entitlements?wallet=`) as the source of truth.
+
+### 7. Go live
+
+Switch the server to the live store's key. Read the store id from the key (`GET /api/v2/iap/stores` with a
+store key returns its own store) so nothing else changes. In production, check `storeId` is the live store and
+`livemode` is `true`.
+
+To pay out real tokens as prizes, see https://docs.chaindaddy.io/developer/token-prizes (live stores only).
+
+## Mistakes to avoid
+
+- Granting an item on `paid`. `paid` means the payment is on chain but still confirming. Deliver on `confirmed`.
+- Trusting a receipt or session token because the client sent it. Verify it on the server, every time.
+- Shipping a store key, account key or webhook secret in client code, a repo or a log.
+- A new random idempotency key on each retry. Build it from something stable (`user-42-milestone-10`).
+- Items with a random outcome (loot boxes, mystery boxes): not allowed.
+- Describing items as money. They can't be transferred between wallets or exchanged for tokens or cash.
+- Asking for a private key or seed phrase, or sending a transaction for the human. They sign in their own wallet.
+
+## Docs
+
+- Store and rewards: https://docs.chaindaddy.io/developer/store-and-rewards
+- Test your integration: https://docs.chaindaddy.io/developer/test-your-integration
+- Build a game: https://docs.chaindaddy.io/developer/build-a-game
+- Everything, for an agent: https://docs.chaindaddy.io/llms.txt (raw pages at `/md/<path>.md`)

package/skills/build-a-crown-app/SKILL.md

@@ -0,0 +1,123 @@
+---
+name: build-a-crown-app
+description: Build, test and publish a Crown App - an app any Chain Daddy token page can install - as a sandboxed React widget, a headless runner that receives signed events, or both. Covers the CLI path, capp.json manifest and permissions, the sandbox rules, actions like iap-purchase and session-token, local testing, review, and what paid apps can and can't do today. Use when someone wants to put a game, storefront, gallery or tool on a token page.
+license: MIT
+---
+
+# Build a Crown App
+
+A Crown App runs on token pages. The token's owner adds it from the page's **Apps** tab; every app is free to
+install on every plan.
+
+| Type | What it is | Scaffold |
+|---|---|---|
+| `widget` | A React component, sandboxed in a frame on the page | `chaindaddy app init widget my-app` |
+| `headless` | A runner: your HTTPS endpoint that receives the page's signed events | `chaindaddy app init headless my-runner` |
+| `full` | A widget and a runner | `chaindaddy app init full my-app` |
+
+Starters with working code: `game` (three.js arcade game with a shop), `interactive` (canvas piece),
+`community` (poll, links, holder count): `chaindaddy app init game my-game`.
+
+## Who can publish
+
+- **Testing locally needs no account.** Start there.
+- **Publishing** needs any active paid plan (not a trial) and the Developer Beta Program Agreement, signed at
+  https://chaindaddy.io/_developer with the wallet that holds the plan. Check with `chaindaddy app whoami`.
+- Every build is a signed `.capp` package, checked automatically, then reviewed by a person.
+
+## The path
+
+```bash
+npm install -g @chaindaddy/cli@beta           # Node 20+
+chaindaddy app init widget my-app && cd my-app && npm install
+npm run dev                                   # or chaindaddy app dev: a token page on 127.0.0.1:5180
+# when it works:
+chaindaddy login                              # the human approves in their browser; no key to paste
+npm run validate && npm run build && npm run scan
+npm run pack && npm run sign && npm run submit
+chaindaddy app submit --request-review        # or press Submit for review on the build in the portal
+```
+
+Add `--json --non-interactive` to CLI calls you run as an agent. Exit codes: `0` ok, `1` user error, `2`
+system, `3` validation failed, `4` auth, `5` server.
+
+`app dev` runs the widget in the real sandbox at real slot sizes, answers every host action from sample data
+(a store, purchases, sign-in, signatures), refuses what a real page refuses, and prints every violation. Fix
+those before submitting.
+
+## The widget
+
+- One named export (a plain function component, the name in `entryComponent`), one ESM file, at most
+  2,000,000 bytes, with `react`, `react-dom` and `react/jsx-runtime` left external. `chaindaddy app build`
+  enforces this.
+- Props: `appData` (the token's data), `settings` (the owner's settings, from your `configSchema`), `theme`
+  (use its colors), `connectedAddress`, `signedIn`, `isOwner`, `breakpoint`, `onAction`, and
+  `subscribeStore` (with `iap:purchase`).
+- Everything sensitive goes through `onAction({ type, … })`, which resolves `{ ok, data }` or `{ ok: false, error }`.
+
+## Permissions (`capp.json` → `permissions`)
+
+Declare only what you use; the owner sees each one before installing and the scan checks the bundle matches.
+
+| Permission | Lets the app |
+|---|---|
+| `iap:purchase` | Sell from this token's store: `onAction({ type: 'iap-purchase', sku, quantity })`. The page shows its own sheet and the viewer's wallet pays; your app never sees a wallet or names an amount |
+| `net:connect` | Reach your own servers listed in `network.origins` (exact `https://` / `wss://` hosts), and ask for a `session-token` |
+| `fetch:self-api` | Call the platform API (`/api/...`) with no cookies |
+| `storage:local` | Keep `localStorage` between visits (512K characters) |
+| `notify:user` | Send the signed-in user a notification (5 a day per user) |
+| `wallet:trade` | Open the token's Buy sheet |
+| `wallet:transaction`, `wallet:sign` | Propose a transaction or an EIP-712 signature, limited to your token and contracts declared in `wallet`; the viewer sees it decoded and confirms |
+| `clipboard:write`, `navigate:internal`, `ui:fullscreen` | Clipboard, move to another page, fullscreen - each on a tap |
+
+Data scopes go in `requiredData` (`profile:basic`, `market:price`, `market:holders`, …).
+
+## Selling inside the app
+
+```ts
+const res = await onAction({ type: 'iap-purchase', sku: 'credits.100', quantity: 1, appAccountToken: user.id });
+// res.data.status: 'confirmed' | 'paid' | 'cancelled' | 'failed'; 'paid' settles later
+props.subscribeStore?.((e) => {
+  if (e.type === 'store:order' && e.status === 'confirmed') unlock(e.sku, e.receipt);
+  if (e.type === 'store:entitlements') refreshInventory();
+});
+```
+
+Read the catalog and the viewer's items with `api-call` (`/api/v2/iap/public/…`, `/api/v2/iap/me/…`). An app
+sells from the store of the token page it is on. The store itself: `sell-items-in-your-app`.
+
+## Your own server
+
+Declare `net:connect` with your origins. Get `onAction({ type: 'session-token' })` → `{ token, expiresAt }`, send
+it to your server, and verify it there (`verify-receipts-and-sessions`). To sign a visitor in, send
+`onAction({ type: 'sign-in' })` from a button they tap - don't ask their wallet to sign a login of your own.
+
+## Runners
+
+A runner receives signed events (`runner.events` in the manifest) at `runner.endpointUrl`. Verify
+`X-App-Signature` (hex HMAC-SHA256 of the raw body, secret hex-decoded) before processing, dedupe by
+`eventId`, and answer quickly. Per-token data goes through the Action API (`apps:storage:write`).
+
+## Paid apps
+
+Every app is free to install. Charging for an app itself, with a revenue share for its developer, is in
+development and not live: the beta agreement includes no payment to developers. What works today is selling
+items for the token from inside the app (above), at 2.5% or 0% on a Chain Daddy launchpad token. Check
+https://docs.chaindaddy.io/developer/paid-apps for the current state before promising anything.
+
+## Mistakes to avoid
+
+- `eval`, `new Function` or `document.cookie`: the frame refuses them and the scan fails the build.
+- Fetching anything not declared: images and calls to other hosts are blocked and reported as violations;
+  enough reports disable the app on every page.
+- Setting `location` or following a link in the frame: it takes your app off the page. Use `navigate`.
+- Keying signed-in state on `connectedAddress`; use the `signedIn` prop.
+- Putting a store key, API key or secret in the bundle. The bundle is public.
+- Declaring permissions you don't use: review refuses them, and owners see them.
+- An app name another developer uses: names are unique.
+
+## Docs
+
+https://docs.chaindaddy.io/developer/quickstart · widgets · manifest · actions · security · runners ·
+submission · build-a-game · engine-apps (Godot and Unity web exports) - all under
+https://docs.chaindaddy.io/developer/

package/skills/check-token-health/SKILL.md

@@ -0,0 +1,67 @@
+---
+name: check-token-health
+description: Read the health of the tokens a wallet has registered on Chain Daddy - the 0-100 score, which registrations are at risk or counting down to expiry, why, and what the owner can do. Read-only. Use when someone asks how their tokens are doing, whether they could lose a ticker, or what their health score means.
+license: MIT
+---
+
+# Check token health
+
+Every registered token has a health score from 0 to 100, updated daily. If it stays **below 60 for 30 days
+in a row**, the registration expires and anyone who can prove ownership of the token can register the ticker,
+first come, first served. Read-only: this skill changes nothing.
+
+## Tools
+
+| Need | MCP | CLI | HTTP |
+|---|---|---|---|
+| Every registration a wallet owns | `list_crowns` (`owner`) | `chaindaddy status --wallet <addr> --json` | - |
+| One token's score | `check_heartbeat` | `chaindaddy status --symbol S --chain base` | `GET /api/v2/heartbeat/{symbol}/{chain}` (EVM) |
+| Score history | - | - | `GET /api/v2/heartbeat/{symbol}/{chain}/history` |
+| Holder spread | `get_holders` | - | `GET /api/v2/registration/{id}/holders` |
+
+HTTP calls from your own code need `X-API-Key: cd_live_…`. The remote MCP server's read tools need no key.
+
+## Steps
+
+1. List the wallet's registrations. Ask for the wallet address; never for a key or a signature.
+2. Read each one's score and classify it:
+
+   | Score | Status | Meaning |
+   |---|---|---|
+   | 80-100 | Healthy | In good standing |
+   | 65-79 | Moderate | In good standing, worth a look |
+   | 60-64 | At risk | The owner gets a "Token at risk" alert |
+   | below 60 | Inactive | The 30-day countdown is running |
+   | below 60 for 30 days | Expired | The ticker is open to register again |
+
+   A registration in its first 30 days is in its **grace period**: tracked, but it can't be reclaimed
+   whatever the score. Releasing and registering again doesn't reset it.
+3. Show a short table, worst first: symbol, chain, score, status, and days left where a countdown runs.
+4. For each token at risk, explain the score's parts:
+   - **Age, 50%:** full marks for 30 days, then steps down over two years (90, 80, 70, 60, then 50). An older
+     token needs real trading and holders to stay above 60.
+   - **Trading volume, 30%:** smoothed (last 24 h 70%, 7-day average 30%) and capped at 100x the pool's
+     liquidity, so wash trading doesn't help.
+   - **Holder spread, 20%:** concentration in the top 10 and top 50 wallets, flagged wallets (snipers,
+     bundlers, insiders, sandwich traders), how many wallets hold half the supply, and the raw count.
+     Splitting a balance across new wallets lowers it.
+5. Say what helps: real trading, supply spread across real holders, health alerts on, and registering from a
+   multisig so a teammate can act. Point to the token manager's **Health** tab.
+
+## If it expired
+
+Search shows it as **Inactive**. The original owner has no special claim: whoever registers first, at the
+normal price, keeps it, and the page's details and manager roles are cleared. Tell the owner plainly and
+point them to https://docs.chaindaddy.io/getting-started/import-an-existing-token. Don't register it for them.
+
+## Mistakes to avoid
+
+- Suggesting trades with yourself, splitting wallets or other ways to game the score. They are filtered out
+  or lower it.
+- Promising support can recover an expired ticker someone else registered. It can't.
+- Reading the score as a rating of the token's quality or safety. It measures activity.
+
+## Docs
+
+- https://docs.chaindaddy.io/platform/heartbeat
+- https://docs.chaindaddy.io/alerts/