@chaindaddy/mcp 0.4.2

package/build/index.js

@@ -0,0 +1,2153 @@
+#!/usr/bin/env node
+/**
+ * Chain Daddy MCP Server
+ *
+ * Exposes Chain Daddy functionality as MCP tools for use with Claude.
+ * Lets an assistant search tickers, launch or import a token, and run its
+ * creator store.
+ */
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { z } from "zod";
+import { randomUUID } from "node:crypto";
+import { createRequire } from "node:module";
+import { SiweMessage } from "siwe";
+import nacl from "tweetnacl";
+import bs58 from "bs58";
+// Configuration
+const API_URL = process.env.CHAINDADDY_API_URL || "https://api.chaindaddy.io";
+// A recommender service you run yourself. The hosted API has none, so with
+// this unset get_recommendations says it is unavailable.
+const RECOMMENDER_URL = (process.env.CHAINDADDY_RECOMMENDER_URL || "").trim();
+// A label in chaindaddy://config only. The default API is mainnet.
+const NETWORK = process.env.CHAINDADDY_NETWORK || "mainnet";
+// Account API key (`cd_live_…`). The API answers callers outside
+// chaindaddy.io only with a key, so it is sent as `X-API-Key` on every call,
+// and as the Bearer credential when the caller passes no SIWE session_token.
+const API_KEY = (process.env.CHAINDADDY_API_KEY || "").trim();
+// Store key (`cd_iap_…`): one store, explicit scopes, for app servers. Used
+// as the Bearer credential on store-scoped creator-store tools when no
+// session_token is passed. Never accepted for opening a store, listing your
+// stores or managing store keys.
+const IAP_KEY = (process.env.CHAINDADDY_IAP_KEY || "").trim();
+// Supported chains
+const SUPPORTED_CHAINS = {
+    "eth": { id: 1, name: "Ethereum" },
+    "arbitrum": { id: 42161, name: "Arbitrum" },
+    "arbitrum-sepolia": { id: 421614, name: "Arbitrum Sepolia" },
+    "base": { id: 8453, name: "Base" },
+    "polygon": { id: 137, name: "Polygon" },
+    "bnb": { id: 56, name: "BNB Chain" },
+    "solana": { id: "solana-mainnet", name: "Solana" },
+};
+export const sessions = new Map();
+// Session guard helper - validates token and returns session data
+// Lazy cleanup: expired sessions are removed on access
+export function requireSession(session_token) {
+    const session = sessions.get(session_token);
+    if (!session) {
+        throw new Error("NO_SESSION: No session found for the provided token");
+    }
+    if (new Date(session.expires_at) <= new Date()) {
+        sessions.delete(session_token);
+        throw new Error("SESSION_EXPIRED: Session has expired, please re-authenticate");
+    }
+    return session;
+}
+// Returns the backend JWT for a session or throws. Use this from any tool
+// that hits a JWT-gated route — surfaces a single, machine-parseable error
+// instead of a 401 leak from the backend.
+export function requireSessionJWT(session_token) {
+    const session = requireSession(session_token);
+    if (!session.jwt) {
+        throw new Error("NO_JWT: Session has no backend access token. Re-run `authenticate` to exchange the signed message for a JWT.");
+    }
+    return { session, jwt: session.jwt };
+}
+const NO_API_KEY_MESSAGE = "NO_API_KEY: CHAINDADDY_API_KEY is not set, and the Chain Daddy API answers callers outside chaindaddy.io " +
+    "only with an API key. Get a free one: connect your wallet at https://chaindaddy.io/_api and click " +
+    "Generate API Key (a developer-program member can also run `chaindaddy app key create`). Then set " +
+    "CHAINDADDY_API_KEY=cd_live_… where this server starts. For read-only search, token and health lookups " +
+    "with no key, connect the remote server https://api.chaindaddy.io/mcp instead.";
+// Paths the API serves with no key (pkg/middleware/origin.go PublicPaths).
+const KEYLESS_PATHS = ["/api/v2/tokenlist", "/api/v2/iap", "/api/v2/heartbeat/oracle"];
+// Headers for a call to the API: X-API-Key when it is set. With no key, a call
+// that needs one fails here with what to do, rather than as a bare 401. A local
+// API (dev mode, localhost) needs no key.
+function apiHeaders(endpoint, baseUrl = API_URL) {
+    const headers = {};
+    if (API_KEY) {
+        headers["X-API-Key"] = API_KEY;
+        return headers;
+    }
+    const path = endpoint.split("?")[0];
+    const keyless = KEYLESS_PATHS.some((p) => path === p || path.startsWith(`${p}/`));
+    const local = /^https?:\/\/(localhost|127\.0\.0\.1|\[::1\])(:|\/|$)/.test(baseUrl);
+    if (!keyless && !local)
+        throw new Error(NO_API_KEY_MESSAGE);
+    return headers;
+}
+// The API's error body is {error, message?}; keep both.
+async function apiError(response) {
+    const body = (await response.json().catch(() => ({ error: response.statusText })));
+    const text = [body.error, body.message].filter(Boolean).join(": ");
+    return new Error(text || `API error: ${response.status}`);
+}
+// Helper to make API calls. Pass `jwt` to attach Authorization: Bearer.
+async function apiCall(endpoint, options = {}) {
+    const baseUrl = options.baseUrl ?? API_URL;
+    const url = `${baseUrl}${endpoint}`;
+    const headers = baseUrl === API_URL ? apiHeaders(endpoint) : {};
+    Object.assign(headers, options.headers);
+    if (options.jwt)
+        headers["Authorization"] = `Bearer ${options.jwt}`;
+    const response = await fetch(url, { headers });
+    if (!response.ok)
+        throw await apiError(response);
+    return response.json();
+}
+// Helper for POST requests
+async function apiPost(endpoint, body, headers = {}, options = {}) {
+    const url = `${API_URL}${endpoint}`;
+    const finalHeaders = {
+        ...apiHeaders(endpoint),
+        "Content-Type": "application/json",
+        ...headers,
+    };
+    if (options.jwt)
+        finalHeaders["Authorization"] = `Bearer ${options.jwt}`;
+    const response = await fetch(url, {
+        method: "POST",
+        headers: finalHeaders,
+        body: JSON.stringify(body),
+    });
+    if (!response.ok)
+        throw await apiError(response);
+    return response.json();
+}
+// Helper for PUT requests. JWT is required for every PUT route we hit today,
+// so it's a mandatory option rather than `optional: jwt?`.
+async function apiPut(endpoint, body, options) {
+    const url = `${API_URL}${endpoint}`;
+    const response = await fetch(url, {
+        method: "PUT",
+        headers: {
+            ...apiHeaders(endpoint),
+            "Content-Type": "application/json",
+            "Authorization": `Bearer ${options.jwt}`,
+        },
+        body: JSON.stringify(body),
+    });
+    if (!response.ok)
+        throw await apiError(response);
+    return response.json();
+}
+// Helper for DELETE requests
+async function apiDelete(endpoint, headers = {}) {
+    const url = `${API_URL}${endpoint}`;
+    const response = await fetch(url, {
+        method: "DELETE",
+        headers: {
+            ...apiHeaders(endpoint),
+            ...headers,
+        },
+    });
+    if (!response.ok)
+        throw await apiError(response);
+    return response.json();
+}
+// Creator store (/api/v2/iap) request helper.
+//
+// `auth` says which credentials a route accepts:
+//   "account" — a SIWE session JWT or CHAINDADDY_API_KEY (opening a store,
+//               listing your stores, managing store keys)
+//   "store"   — additionally a store key (CHAINDADDY_IAP_KEY)
+//   "public"  — none needed; X-API-Key is still sent when configured
+// Precedence: an explicit session_token, then the store key (store routes
+// only), then the account API key. Every POST carries an Idempotency-Key —
+// the caller's, or a fresh UUID — and it is returned so a retry can reuse it.
+class IapError extends Error {
+    code;
+    status;
+    constructor(code, message, status) {
+        super(message);
+        this.code = code;
+        this.status = status;
+    }
+}
+function iapBearer(auth, session_token) {
+    if (session_token)
+        return requireSessionJWT(session_token).jwt;
+    if (auth === "public")
+        return undefined;
+    if (auth === "store" && IAP_KEY)
+        return IAP_KEY;
+    if (API_KEY)
+        return API_KEY;
+    throw new IapError("NO_CREDENTIALS", auth === "store"
+        ? "Pass session_token, or set CHAINDADDY_IAP_KEY (a store key) or CHAINDADDY_API_KEY (a cd_live_ key)"
+        : "Pass session_token, or set CHAINDADDY_API_KEY (a cd_live_ key)", 401);
+}
+async function iapRequest(method, path, opts) {
+    const headers = { Accept: "application/json" };
+    const bearer = iapBearer(opts.auth, opts.session_token);
+    if (bearer)
+        headers["Authorization"] = `Bearer ${bearer}`;
+    // /api/v2/iap routes pass the project gate on their own: a store key goes
+    // alone. An account call keeps sending its cd_live_ key the usual way.
+    if (API_KEY.startsWith("cd_live_") && !bearer?.startsWith("cd_iap_"))
+        headers["X-API-Key"] = API_KEY;
+    let idempotencyKey;
+    if (method === "POST") {
+        idempotencyKey = opts.idempotencyKey || randomUUID();
+        headers["Idempotency-Key"] = idempotencyKey;
+    }
+    if (opts.body !== undefined)
+        headers["Content-Type"] = "application/json";
+    const response = await fetch(`${API_URL}/api/v2/iap${path}`, {
+        method,
+        headers,
+        body: opts.body === undefined ? undefined : JSON.stringify(opts.body),
+    });
+    const text = await response.text();
+    let data = null;
+    if (text) {
+        try {
+            data = JSON.parse(text);
+        }
+        catch {
+            data = text;
+        }
+    }
+    if (!response.ok) {
+        const obj = (data && typeof data === "object" ? data : {});
+        throw new IapError(obj.code || `HTTP_${response.status}`, obj.error || (typeof data === "string" && data) || `API error: ${response.status}`, response.status);
+    }
+    return { data, idempotencyKey };
+}
+function iapQuery(params) {
+    const q = new URLSearchParams();
+    for (const [k, v] of Object.entries(params)) {
+        if (v !== undefined && v !== "")
+            q.set(k, String(v));
+    }
+    const s = q.toString();
+    return s ? `?${s}` : "";
+}
+function iapOk(result) {
+    return { content: [{ type: "text", text: JSON.stringify(result) }] };
+}
+function iapFail(error, idempotencyKey) {
+    const code = error instanceof IapError ? error.code : error.message.split(":")[0] || "API_ERROR";
+    const payload = { error: code, message: error.message };
+    if (error instanceof IapError)
+        payload.status = error.status;
+    if (idempotencyKey)
+        payload.idempotency_key = idempotencyKey;
+    return { content: [{ type: "text", text: JSON.stringify(payload) }], isError: true };
+}
+// Format helpers
+function formatAddress(addr) {
+    if (!addr || addr.length < 10)
+        return addr || "-";
+    return `${addr.slice(0, 6)}...${addr.slice(-4)}`;
+}
+function formatNumber(num) {
+    if (!num)
+        return "-";
+    if (num >= 1_000_000_000)
+        return `$${(num / 1_000_000_000).toFixed(1)}B`;
+    if (num >= 1_000_000)
+        return `$${(num / 1_000_000).toFixed(1)}M`;
+    if (num >= 1_000)
+        return `$${(num / 1_000).toFixed(1)}K`;
+    return `$${num.toFixed(0)}`;
+}
+// The published package.json sits one level above build/index.js.
+const VERSION = createRequire(import.meta.url)("../package.json").version;
+// Create server
+const server = new McpServer({
+    name: "chaindaddy",
+    version: VERSION,
+});
+// ============================================================================
+// TOOLS
+// ============================================================================
+// Tool: get_auth_nonce
+//
+// Step 1 of the auth handshake. Returns a server-issued nonce the caller
+// MUST embed in the SIWE/SIWS message before signing — the backend's
+// /api/v2/auth/login/{siwe,siws} routes reject any message whose nonce
+// wasn't issued (and consumed) by this endpoint. Nonces expire quickly
+// (single-use, ~5 minute window per parseSIWSMessage freshness check in
+// pkg/handler/v2_auth_handler.go), so fetch right before signing.
+server.registerTool("get_auth_nonce", {
+    title: "Get sign-in nonce",
+    description: "Step 1 of authentication. Fetches a server-issued nonce the caller must embed in the SIWE/SIWS message before signing.\n\nParams: none\nReturns: {nonce: string}\nErrors: API_ERROR",
+    inputSchema: {},
+    annotations: { readOnlyHint: true, openWorldHint: false },
+}, async () => {
+    try {
+        const data = await apiCall("/api/v2/auth/nonce");
+        if (!data.nonce) {
+            return {
+                content: [{ type: "text", text: JSON.stringify({ error: "API_ERROR", message: "nonce missing from response" }) }],
+                isError: true,
+            };
+        }
+        return {
+            content: [{ type: "text", text: JSON.stringify({ nonce: data.nonce }) }],
+        };
+    }
+    catch (error) {
+        return {
+            content: [{ type: "text", text: JSON.stringify({ error: "API_ERROR", message: error.message }) }],
+            isError: true,
+        };
+    }
+});
+// Tool: authenticate
+//
+// Step 2 of the auth handshake. After local signature verification (fast
+// fail before consuming a server nonce), POSTs the signed message to
+// /api/v2/auth/login/{siwe,siws} to exchange for a backend JWT. The JWT
+// is stored alongside the session so JWT-gated tools (update_profile,
+// etc.) can attach it as Authorization: Bearer.
+server.registerTool("authenticate", {
+    title: "Sign in with a wallet signature",
+    description: "Step 2 of authentication. Exchanges a signed SIWE/SIWS message for a session bound to a backend JWT. Call get_auth_nonce first and embed the nonce in the message.\n\nParams: wallet_address (string), chain_type ('evm'|'solana'), signed_message (string), signature (string)\nReturns: {session_token: string, expires_at: string}\nErrors: INVALID_SIGNATURE, INVALID_ADDRESS, UNSUPPORTED_CHAIN, JWT_EXCHANGE_FAILED",
+    inputSchema: {
+        wallet_address: z.string().describe("Wallet address (0x... for EVM, base58 for Solana)"),
+        chain_type: z.enum(["evm", "solana"]).describe("Chain type: 'evm' or 'solana'"),
+        signed_message: z.string().describe("The SIWE or SIWS message that was signed. Must include the server-issued nonce from get_auth_nonce."),
+        signature: z.string().describe("The signature of the message (hex for EVM, base58 for Solana)"),
+    },
+    annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: false },
+}, async ({ wallet_address, chain_type, signed_message, signature }) => {
+    try {
+        // Local pre-flight signature check so a tampered message bails out
+        // before the backend consumes its nonce. Backend re-verifies.
+        if (chain_type === "evm") {
+            const siweMessage = new SiweMessage(signed_message);
+            const result = await siweMessage.verify({ signature });
+            if (!result.success) {
+                return {
+                    content: [{ type: "text", text: JSON.stringify({ error: "INVALID_SIGNATURE", message: "EVM signature verification failed" }) }],
+                    isError: true,
+                };
+            }
+            if (siweMessage.address.toLowerCase() !== wallet_address.toLowerCase()) {
+                return {
+                    content: [{ type: "text", text: JSON.stringify({ error: "INVALID_ADDRESS", message: "Message address does not match wallet_address" }) }],
+                    isError: true,
+                };
+            }
+        }
+        else if (chain_type === "solana") {
+            const publicKeyBytes = bs58.decode(wallet_address);
+            const messageBytes = new TextEncoder().encode(signed_message);
+            const signatureBytes = bs58.decode(signature);
+            const verified = nacl.sign.detached.verify(messageBytes, signatureBytes, publicKeyBytes);
+            if (!verified) {
+                return {
+                    content: [{ type: "text", text: JSON.stringify({ error: "INVALID_SIGNATURE", message: "Solana signature verification failed" }) }],
+                    isError: true,
+                };
+            }
+        }
+        else {
+            return {
+                content: [{ type: "text", text: JSON.stringify({ error: "UNSUPPORTED_CHAIN", message: `Unsupported chain type: ${chain_type}` }) }],
+                isError: true,
+            };
+        }
+        // Exchange the signed message for a backend JWT.
+        let jwt;
+        try {
+            const loginPath = chain_type === "evm" ? "/api/v2/auth/login/siwe" : "/api/v2/auth/login/siws";
+            const loginBody = chain_type === "evm"
+                ? { message: signed_message, signature }
+                : { message: signed_message, signature, publicKey: wallet_address };
+            const loginResp = await apiPost(loginPath, loginBody);
+            if (!loginResp.accessToken) {
+                throw new Error("login response missing accessToken");
+            }
+            jwt = loginResp.accessToken;
+        }
+        catch (err) {
+            return {
+                content: [{ type: "text", text: JSON.stringify({
+                            error: "JWT_EXCHANGE_FAILED",
+                            message: `Backend rejected SIWE/SIWS login: ${err.message}. Common cause: the message's nonce was not issued by get_auth_nonce, or was consumed already.`,
+                        }) }],
+                isError: true,
+            };
+        }
+        // Create session token bound to the backend JWT.
+        const session_token = randomUUID();
+        const expires_at = new Date(Date.now() + 24 * 60 * 60 * 1000).toISOString();
+        sessions.set(session_token, {
+            wallet: wallet_address,
+            chain_type,
+            expires_at,
+            jwt,
+        });
+        return {
+            content: [{ type: "text", text: JSON.stringify({ session_token, expires_at }) }],
+        };
+    }
+    catch (error) {
+        return {
+            content: [{ type: "text", text: JSON.stringify({ error: "INVALID_SIGNATURE", message: error.message }) }],
+            isError: true,
+        };
+    }
+});
+// Tool: get_session
+server.registerTool("get_session", {
+    title: "Get session status",
+    description: "Get the current session status for a session token. Returns authentication state, wallet, chain type, and expiry.\n\nParams: session_token (string)\nReturns: {authenticated: true, wallet: string, chain_type: 'evm'|'solana', expires_at: string} or {authenticated: false}\nErrors: none (always returns a result)",
+    inputSchema: {
+        session_token: z.string().describe("Session token from authenticate"),
+    },
+    annotations: { readOnlyHint: true, openWorldHint: false },
+}, async ({ session_token }) => {
+    try {
+        const session = requireSession(session_token);
+        return {
+            content: [{ type: "text", text: JSON.stringify({ authenticated: true, wallet: session.wallet, chain_type: session.chain_type, expires_at: session.expires_at }) }],
+        };
+    }
+    catch {
+        return {
+            content: [{ type: "text", text: JSON.stringify({ authenticated: false }) }],
+        };
+    }
+});
+// Tool: search_symbol
+server.registerTool("search_symbol", {
+    title: "Search a ticker",
+    description: "Search for a crypto ticker symbol across all supported chains. Returns availability status, existing tokens, market data, and crown ownership.",
+    inputSchema: {
+        symbol: z.string().describe("The ticker symbol to search (1-20 alphanumeric chars, e.g., 'PEPE', 'DOGE')"),
+        chain: z.enum(["eth", "arbitrum", "arbitrum-sepolia", "solana", "base", "polygon", "bnb"]).optional().describe("Optional: Filter to specific chain"),
+    },
+    annotations: { readOnlyHint: true, openWorldHint: false },
+}, async ({ symbol, chain }) => {
+    try {
+        const params = new URLSearchParams({ symbol });
+        if (chain)
+            params.set("chain", chain);
+        const endpoint = `/api/v2/search?${params.toString()}`;
+        const data = await apiCall(endpoint);
+        if (!data.success || !data.results) {
+            return {
+                content: [{ type: "text", text: `No results found for "${symbol}"` }],
+            };
+        }
+        // The API filters by chain itself.
+        const results = data.results;
+        // Build output table
+        const lines = [
+            `Search Results for ${symbol.toUpperCase()}`,
+            "",
+            "| Chain            | Status       | Token Address      | Market Cap  | Crown Owner        |",
+            "|------------------|--------------|--------------------| ------------|-------------------|",
+        ];
+        for (const r of results) {
+            const status = r.crown?.status || "available";
+            const statusDisplay = status.charAt(0).toUpperCase() + status.slice(1);
+            const tokenAddr = r.token?.address ? formatAddress(r.token.address) : "-";
+            const marketCap = formatNumber(r.token?.marketCap);
+            const owner = r.crown?.owner ? formatAddress(r.crown.owner) : "-";
+            lines.push(`| ${r.chainName.padEnd(16)} | ${statusDisplay.padEnd(12)} | ${tokenAddr.padEnd(18)} | ${marketCap.padEnd(11)} | ${owner.padEnd(17)} |`);
+        }
+        lines.push("");
+        lines.push('Status Guide:');
+        lines.push('  "available" = No token exists, you can create one');
+        lines.push('  "unclaimed" = Token exists but no crown claimed');
+        lines.push('  "claimed" = Crown claimed by another owner');
+        lines.push('  "owned" = You own this crown');
+        return {
+            content: [{ type: "text", text: lines.join("\n") }],
+        };
+    }
+    catch (error) {
+        return {
+            content: [{ type: "text", text: `Search failed: ${error.message}` }],
+            isError: true,
+        };
+    }
+});
+// Tool: get_token
+server.registerTool("get_token", {
+    title: "Get token details",
+    description: "Get detailed information about a token on a specific chain including crown status, market data, and metadata.",
+    inputSchema: {
+        symbol: z.string().describe("The ticker symbol (e.g., 'PEPE')"),
+        chain: z.enum(["eth", "arbitrum", "arbitrum-sepolia", "solana", "base", "polygon", "bnb"]).describe("The chain to query"),
+    },
+    annotations: { readOnlyHint: true, openWorldHint: false },
+}, async ({ symbol, chain }) => {
+    try {
+        const endpoint = `/api/v2/token/${encodeURIComponent(symbol)}/${chain}`;
+        const raw = await apiCall(endpoint);
+        const data = { token: raw.token, crown: raw.registration };
+        const lines = [
+            `${raw.token?.symbol || symbol.toUpperCase()} on ${raw.chainName || chain}`,
+            "",
+        ];
+        if (data.token) {
+            lines.push("Token Details:");
+            lines.push(`  Address:      ${data.token.address}`);
+            lines.push(`  Name:         ${data.token.name}`);
+            lines.push(`  Symbol:       ${data.token.symbol}`);
+            if (data.token.decimals !== undefined) {
+                lines.push(`  Decimals:     ${data.token.decimals}`);
+            }
+            if (data.token.totalSupply) {
+                lines.push(`  Total Supply: ${data.token.totalSupply}`);
+            }
+            lines.push("");
+            if (data.token.marketCap || data.token.volume24h || data.token.liquidity) {
+                lines.push("Market Data:");
+                if (data.token.marketCap)
+                    lines.push(`  Market Cap:   ${formatNumber(data.token.marketCap)}`);
+                if (data.token.volume24h)
+                    lines.push(`  24h Volume:   ${formatNumber(data.token.volume24h)}`);
+                if (data.token.liquidity)
+                    lines.push(`  Liquidity:    ${formatNumber(data.token.liquidity)}`);
+                if (data.token.holders)
+                    lines.push(`  Holders:      ${data.token.holders.toLocaleString()}`);
+                lines.push("");
+            }
+        }
+        else {
+            lines.push("No token found on this chain.");
+            lines.push("");
+        }
+        if (data.crown) {
+            const status = data.crown.status.toUpperCase();
+            lines.push(`Crown Status: ${status}`);
+            if (data.crown.owner) {
+                lines.push(`  Owner:       ${data.crown.owner}`);
+                lines.push(`  Token ID:    #${data.crown.tokenId}`);
+            }
+            if (data.crown.heartbeatScore !== undefined) {
+                lines.push(`  Heartbeat:   ${data.crown.heartbeatScore}%`);
+            }
+            if (data.crown.verificationMethod) {
+                lines.push(`  Verified As: ${data.crown.verificationMethod}`);
+            }
+        }
+        else {
+            lines.push("Crown Status: AVAILABLE");
+            lines.push("  No crown has been minted for this symbol on this chain.");
+        }
+        return {
+            content: [{ type: "text", text: lines.join("\n") }],
+        };
+    }
+    catch (error) {
+        return {
+            content: [{ type: "text", text: `Failed to get token: ${error.message}` }],
+            isError: true,
+        };
+    }
+});
+// Tool: get_crown
+server.registerTool("get_crown", {
+    title: "Get a token registration",
+    description: "Get detailed information about a specific crown by ID.\n\nParams: crown_id (string)\nReturns: {symbol, chain, owner, manager, heartbeat_score, status, metadata, days_in_grace, penalty_deadline}\nErrors: CROWN_NOT_FOUND, API_ERROR",
+    inputSchema: {
+        crown_id: z.string().describe("Crown ID (token ID or identifier)"),
+    },
+    annotations: { readOnlyHint: true, openWorldHint: false },
+}, async ({ crown_id }) => {
+    try {
+        const data = await apiCall(`/api/v2/registration/${encodeURIComponent(crown_id)}`);
+        return {
+            content: [{ type: "text", text: JSON.stringify({
+                        symbol: data.symbol || "",
+                        chain: data.chain || data.chainName || (data.chainId ? String(data.chainId) : ""),
+                        owner: data.owner || "",
+                        manager: data.manager || null,
+                        heartbeat_score: data.heartbeatScore ?? null,
+                        status: data.status || "unknown",
+                        metadata: data.metadata || {},
+                        days_in_grace: data.gracePeriod?.daysRemaining ?? null,
+                        penalty_deadline: data.penalty?.deadline ?? null,
+                    }) }],
+        };
+    }
+    catch (error) {
+        const message = error.message;
+        const errorCode = message.includes("404") ? "CROWN_NOT_FOUND" : "API_ERROR";
+        return {
+            content: [{ type: "text", text: JSON.stringify({ error: errorCode, message }) }],
+            isError: true,
+        };
+    }
+});
+// Tool: list_crowns
+server.registerTool("list_crowns", {
+    title: "List token registrations",
+    description: "List crowns with optional filters. All params optional.\n\nParams: owner (string?), chain (string?), status (string?)\nReturns: {crowns: [{symbol, chain, owner, manager, heartbeat_score, status, metadata, days_in_grace, penalty_deadline}]}\nErrors: API_ERROR",
+    inputSchema: {
+        owner: z.string().optional().describe("Filter by owner wallet address"),
+        chain: z.string().optional().describe("Filter by chain (e.g., 'arb', 'sol', 'base')"),
+        status: z.string().optional().describe("Filter by status (e.g., 'claimed', 'inactive', 'grace_period')"),
+    },
+    annotations: { readOnlyHint: true, openWorldHint: false },
+}, async ({ owner, chain, status }) => {
+    try {
+        let data;
+        if (owner) {
+            // Public v3 endpoint. The v2 /crown/owned/{address} predecessor
+            // moved behind JWT auth that the MCP server doesn't issue today,
+            // and the legacy /crown/* prefix has no backing routes at all.
+            // v3 wraps results in {success, data: {crowns, total, limit, offset}}.
+            const rawData = await apiCall(`/api/v3/registration/by-owner/${encodeURIComponent(owner)}`);
+            // The v3 route names the list `tokens`.
+            const v3 = rawData.data;
+            data = { crowns: v3?.tokens || rawData.data?.crowns || [] };
+        }
+        else {
+            // No public "list every crown" endpoint exists — the prior
+            // /registrations fallback URL was never a real route. Require an
+            // owner filter so the caller doesn't get a confused empty result.
+            return {
+                content: [{ type: "text", text: JSON.stringify({
+                            error: "OWNER_REQUIRED",
+                            message: "list_crowns requires an `owner` parameter (no public endpoint lists every crown). Try search_symbols or get_crown_details with a known id instead.",
+                        }) }],
+                isError: true,
+            };
+        }
+        let crowns = data.crowns;
+        // Apply chain filter
+        if (chain) {
+            crowns = crowns.filter(c => c.chain === chain || c.chainName?.toLowerCase() === chain.toLowerCase() || String(c.chainId) === chain);
+        }
+        // Apply status filter
+        if (status) {
+            crowns = crowns.filter(c => {
+                if (c.status)
+                    return c.status === status;
+                // Infer status from isActive field if status not explicitly set
+                if (status === "inactive")
+                    return c.isActive === false;
+                if (status === "claimed")
+                    return c.isActive !== false;
+                return true;
+            });
+        }
+        const result = crowns.map(c => ({
+            symbol: c.symbol || "",
+            chain: c.chain || c.chainName || (c.chainId ? String(c.chainId) : ""),
+            owner: c.owner || "",
+            manager: c.manager || null,
+            heartbeat_score: c.heartbeatScore ?? null,
+            status: c.status || (c.isActive === false ? "inactive" : "claimed"),
+            metadata: c.metadata || {},
+            days_in_grace: c.gracePeriod?.daysRemaining ?? null,
+            penalty_deadline: c.penalty?.deadline ?? null,
+        }));
+        return {
+            content: [{ type: "text", text: JSON.stringify({ crowns: result }) }],
+        };
+    }
+    catch (error) {
+        return {
+            content: [{ type: "text", text: JSON.stringify({ error: "API_ERROR", message: error.message }) }],
+            isError: true,
+        };
+    }
+});
+// Tool: get_pricing
+server.registerTool("get_pricing", {
+    title: "Get pricing",
+    description: "Get what an order costs, as the order will charge it. mode 'create' (default): a new token on each chain, its registration included. mode 'claim': registering a token that already exists on each chain (free for an OG token when symbol and address are given). All params optional. Two or more chains take the 10% multi-chain bundle discount, already subtracted from total_usd.\n\nParams: chains (string[]?), mode ('create'|'claim'?), symbol (string?), address (string?), bundle_type (string?), wallet_address (string?)\nReturns: {items: [{chain, type, fee_usd, gas_estimate}], discounts: [{type, description, amount_usd}], total_usd: number}\nErrors: API_ERROR",
+    inputSchema: {
+        chains: z.array(z.string()).optional().describe("Chains to get pricing for (e.g., ['arb', 'sol'])"),
+        mode: z.enum(["create", "claim"]).optional().describe("'create' (default) prices a new token; 'claim' prices registering a token that already exists"),
+        address: z.string().optional().describe("With mode 'claim': the token's contract or mint address, so an OG token shows as free"),
+        symbol: z.string().optional().describe("Token symbol for pricing context"),
+        bundle_type: z.string().optional().describe("Label for the bundle discount line only; the discount itself follows the number of chains"),
+        wallet_address: z.string().optional().describe("Accepted for compatibility; pricing does not depend on the wallet"),
+    },
+    annotations: { readOnlyHint: true, openWorldHint: false },
+}, async ({ chains, mode, address, symbol, bundle_type, wallet_address }) => {
+    try {
+        const params = new URLSearchParams();
+        if (chains && chains.length > 0)
+            params.set("chains", chains.join(","));
+        if (mode)
+            params.set("mode", mode);
+        if (address)
+            params.set("address", address);
+        if (symbol)
+            params.set("symbol", symbol);
+        if (bundle_type)
+            params.set("bundle_type", bundle_type);
+        if (wallet_address)
+            params.set("wallet_address", wallet_address);
+        const queryString = params.toString();
+        const endpoint = `/api/v2/pricing${queryString ? `?${queryString}` : ""}`;
+        const data = await apiCall(endpoint);
+        return {
+            content: [{ type: "text", text: JSON.stringify({
+                        items: data.items,
+                        discounts: data.discounts,
+                        total_usd: data.total_usd,
+                    }) }],
+        };
+    }
+    catch (error) {
+        return {
+            content: [{ type: "text", text: JSON.stringify({ error: "API_ERROR", message: error.message }) }],
+            isError: true,
+        };
+    }
+});
+// Tool: get_deployments
+server.registerTool("get_deployments", {
+    title: "Find tokens a wallet can register",
+    description: "Find the tokens a wallet made on a chain (deployed, owns, or launched) that are not registered yet, and how it qualifies for each. Useful for finding tokens you can claim.",
+    inputSchema: {
+        address: z.string().describe("Wallet address (0x...)"),
+        chain: z.enum(["eth", "arbitrum", "arbitrum-sepolia", "base", "polygon", "bnb"]).describe("Chain to search"),
+    },
+    annotations: { readOnlyHint: true, openWorldHint: false },
+}, async ({ address, chain }) => {
+    try {
+        const chainConfig = SUPPORTED_CHAINS[chain];
+        if (!chainConfig) {
+            return {
+                content: [{ type: "text", text: `Invalid chain: ${chain}` }],
+                isError: true,
+            };
+        }
+        // GET /api/v2/registration/claimable answers for the wallet in
+        // X-Wallet-Address (or the session's), across every chain.
+        const data = await apiCall("/api/v2/registration/claimable", {
+            headers: { "X-Wallet-Address": address },
+        });
+        const onChain = (data.tokens || []).filter((t) => t.chainId === `eip155:${chainConfig.id}` || t.chainId === String(chainConfig.id));
+        if (onChain.length === 0) {
+            return {
+                content: [{ type: "text", text: `No unregistered tokens found for ${formatAddress(address)} on ${chainConfig.name}` }],
+            };
+        }
+        const lines = [
+            `Tokens ${formatAddress(address)} can register on ${chainConfig.name}`,
+            "",
+            "| Symbol | Name                 | Address            | Qualifies as     |",
+            "|--------|----------------------|--------------------|------------------|",
+        ];
+        for (const token of onChain) {
+            const symbol = (token.symbol || "?").padEnd(6);
+            const name = (token.name || "Unknown").slice(0, 20).padEnd(20);
+            const addr = formatAddress(token.address).padEnd(18);
+            const how = (token.qualification?.method || "-").padEnd(16);
+            lines.push(`| ${symbol} | ${name} | ${addr} | ${how} |`);
+        }
+        lines.push("");
+        lines.push(`Found ${onChain.length} token${onChain.length !== 1 ? "s" : ""}`);
+        lines.push("");
+        lines.push("Use check_eligibility to confirm the price and terms for any of these tokens.");
+        return {
+            content: [{ type: "text", text: lines.join("\n") }],
+        };
+    }
+    catch (error) {
+        return {
+            content: [{ type: "text", text: `Failed to get deployments: ${error.message}` }],
+            isError: true,
+        };
+    }
+});
+// Tool: check_eligibility
+server.registerTool("check_eligibility", {
+    title: "Check registration eligibility",
+    description: "Check if a wallet is eligible to claim a crown for a specific token. Verifies deployer, owner, admin, or majority holder status.",
+    inputSchema: {
+        token_address: z.string().describe("Token contract address"),
+        wallet_address: z.string().describe("Wallet to check eligibility for"),
+        chain: z.enum(["eth", "arbitrum", "arbitrum-sepolia", "solana", "base", "polygon", "bnb"]).describe("Chain where token exists"),
+    },
+    annotations: { readOnlyHint: true, openWorldHint: false },
+}, async ({ token_address, wallet_address, chain }) => {
+    try {
+        const chainConfig = SUPPORTED_CHAINS[chain];
+        if (!chainConfig) {
+            return {
+                content: [{ type: "text", text: `Invalid chain: ${chain}` }],
+                isError: true,
+            };
+        }
+        // Read-only: asks the same verifier that gates the claim.
+        const data = await apiPost("/api/v2/registration/check-qualify", {
+            wallet: wallet_address,
+            tokenAddress: token_address,
+            chainId: chainConfig.id,
+        });
+        const lines = [
+            "Eligibility Check",
+            "",
+            `Token:  ${formatAddress(token_address)} on ${chainConfig.name}`,
+            `Wallet: ${formatAddress(wallet_address)}`,
+            "",
+        ];
+        if (data.eligible) {
+            lines.push("ELIGIBLE");
+            lines.push("");
+            if (data.qualification?.message) {
+                lines.push(`Qualifies as: ${data.qualification.method} (${data.qualification.message})`);
+            }
+            if (typeof data.price === "number") {
+                lines.push(`Price: ${data.price === 0 ? "free" : `${data.price} ${data.currency || "USD"}`}`);
+            }
+            lines.push("");
+            lines.push("You can claim this crown. Use claim_crown to proceed.");
+        }
+        else {
+            lines.push("NOT ELIGIBLE");
+            lines.push("");
+            if (data.reason) {
+                lines.push(`Reason: ${data.reason}`);
+            }
+            if (data.claimability?.message) {
+                lines.push(data.claimability.message);
+            }
+        }
+        return {
+            content: [{ type: "text", text: lines.join("\n") }],
+        };
+    }
+    catch (error) {
+        return {
+            content: [{ type: "text", text: `Eligibility check failed: ${error.message}` }],
+            isError: true,
+        };
+    }
+});
+// Tool: check_heartbeat
+server.registerTool("check_heartbeat", {
+    title: "Check token health",
+    description: "Get heartbeat status and activity score for a crown. Score below 60% means at-risk of reclaim.",
+    inputSchema: {
+        crown_id: z.number().describe("Crown token ID"),
+    },
+    annotations: { readOnlyHint: true, openWorldHint: false },
+}, async ({ crown_id }) => {
+    try {
+        // The legacy by-id heartbeat route was retired — heartbeat is keyed
+        // by (symbol, chain) now. Resolve the crown first, then hit the
+        // symbol-keyed endpoint.
+        const crownLookup = await apiCall(`/api/v2/registration/${encodeURIComponent(String(crown_id))}`);
+        const symbol = crownLookup.symbol || "";
+        // The registration route answers with a numeric chainId; the heartbeat
+        // route takes that as readily as a chain key.
+        const chain = crownLookup.chain || crownLookup.chainName || (crownLookup.chainId ? String(crownLookup.chainId) : "");
+        if (!symbol || !chain) {
+            return {
+                content: [{ type: "text", text: JSON.stringify({ error: "CROWN_NOT_FOUND", message: `No crown resolved for id ${crown_id}` }) }],
+                isError: true,
+            };
+        }
+        const data = await apiCall(`/api/v2/heartbeat/${encodeURIComponent(symbol)}/${encodeURIComponent(chain)}`);
+        const lines = [
+            `Heartbeat Status: ${data.symbol} (#${crown_id})`,
+            "",
+            `Score: ${data.score}%`,
+            `Status: ${data.status.toUpperCase()}`,
+            "",
+        ];
+        if (data.components) {
+            lines.push("Score Breakdown:");
+            lines.push(`  Timestamp (50%): ${data.components.timestamp}%`);
+            lines.push(`  Volume (30%):    ${data.components.volume}%`);
+            lines.push(`  Holders (20%):   ${data.components.holders}%`);
+            lines.push("");
+        }
+        if (data.lastUpdated) {
+            lines.push(`Last Update: ${data.lastUpdated}`);
+        }
+        if (data.score < 60) {
+            lines.push("");
+            lines.push("WARNING: Score below 60%. Crown is at risk of becoming reclaimable.");
+            lines.push("Recommendations:");
+            lines.push("  - Update profile metadata to refresh timestamp");
+            lines.push("  - Encourage trading activity");
+            lines.push("  - Grow holder base");
+        }
+        return {
+            content: [{ type: "text", text: lines.join("\n") }],
+        };
+    }
+    catch (error) {
+        return {
+            content: [{ type: "text", text: `Heartbeat check failed: ${error.message}` }],
+            isError: true,
+        };
+    }
+});
+// Tool: export_listing
+server.registerTool("export_listing", {
+    title: "Export listing data",
+    description: "Generate listing data formatted for aggregator platforms (CMC, CoinGecko, DEX Screener, TokenList).",
+    inputSchema: {
+        crown_id: z.number().describe("Crown token ID"),
+        format: z.enum(["cmc", "coingecko", "dexscreener", "tokenlist", "all"]).describe("Export format for the listing data"),
+    },
+    annotations: { readOnlyHint: true, openWorldHint: false },
+}, async ({ crown_id, format }) => {
+    try {
+        // The by-id export route was retired in favour of /tokenlist/export
+        // which keys on (symbol, chain). Resolve the crown first.
+        const crownLookup = await apiCall(`/api/v2/registration/${encodeURIComponent(String(crown_id))}`);
+        const symbol = crownLookup.symbol || "";
+        const chain = crownLookup.chain || crownLookup.chainName || (crownLookup.chainId ? String(crownLookup.chainId) : "");
+        if (!symbol || !chain) {
+            return {
+                content: [{ type: "text", text: JSON.stringify({ error: "CROWN_NOT_FOUND", message: `No crown resolved for id ${crown_id}` }) }],
+                isError: true,
+            };
+        }
+        const data = await apiCall(`/api/v2/tokenlist/export/${encodeURIComponent(symbol)}/${encodeURIComponent(chain)}?format=${encodeURIComponent(format)}`);
+        const lines = [
+            `Listing Export: ${data.symbol} (#${crown_id})`,
+            `Format: ${data.format.toUpperCase()}`,
+            "",
+        ];
+        if (data.completeness !== undefined) {
+            lines.push(`Profile Completeness: ${data.completeness}%`);
+            lines.push("");
+        }
+        if (data.missingFields && data.missingFields.length > 0) {
+            lines.push("Missing Fields (recommended for listing):");
+            for (const field of data.missingFields) {
+                lines.push(`  - ${field}`);
+            }
+            lines.push("");
+        }
+        lines.push("Export Data:");
+        lines.push("```json");
+        lines.push(JSON.stringify(data.data, null, 2));
+        lines.push("```");
+        return {
+            content: [{ type: "text", text: lines.join("\n") }],
+        };
+    }
+    catch (error) {
+        return {
+            content: [{ type: "text", text: `Export failed: ${error.message}` }],
+            isError: true,
+        };
+    }
+});
+// Tool: get_holders
+//
+// Public read against /api/v2/registration/{id}/holders. Returns the
+// per-crown holder snapshot the heartbeat-publisher daemon refreshes
+// daily from Mobula: aggregate concentration percentages (top10/50/
+// 100/200), an interpolated "wallets needed to hold 50% of supply",
+// and adversarial-label counts (snipers, bundlers, insiders, sandwich).
+// Wallet addresses and per-rank balances are deliberately NOT exposed
+// — the underlying type system (`pkg/types/holder.go`) bans address
+// leaks even for top-holder lists, so this tool surfaces what we can
+// publish without violating that invariant.
+server.registerTool("get_holders", {
+    title: "Get holder stats",
+    description: "Get holder concentration and adversarial-label stats for a crown. Sourced from /api/v2/registration/{id}/holders; data refreshes daily.\n\nParams: crown_id (number)\nReturns: text report with totalHolders, top10/50/100/200 concentration, walletsForHalf, and Mobula label counts (snipers/bundlers/insiders/sandwich) plus suspiciousRatio.\nErrors: CROWN_NOT_FOUND, NO_DATA, API_ERROR",
+    inputSchema: {
+        crown_id: z.number().describe("Crown token ID"),
+    },
+    annotations: { readOnlyHint: true, openWorldHint: false },
+}, async ({ crown_id }) => {
+    try {
+        const data = await apiCall(`/api/v2/registration/${crown_id}/holders`);
+        const sym = data.symbol || `#${crown_id}`;
+        const total = data.totalHolders ?? 0;
+        const lines = [
+            `Holder Snapshot: ${sym}`,
+            "",
+            `Total Holders: ${total.toLocaleString()}`,
+        ];
+        const c = data.concentration;
+        if (c) {
+            lines.push("");
+            lines.push("Concentration (% of supply):");
+            if (c.top10Pct !== undefined)
+                lines.push(`  Top 10:   ${c.top10Pct.toFixed(2)}%`);
+            if (c.top50Pct !== undefined)
+                lines.push(`  Top 50:   ${c.top50Pct.toFixed(2)}%`);
+            if (c.top100Pct !== undefined)
+                lines.push(`  Top 100:  ${c.top100Pct.toFixed(2)}%`);
+            if (c.top200Pct !== undefined)
+                lines.push(`  Top 200:  ${c.top200Pct.toFixed(2)}%`);
+            if (c.walletsForHalf !== undefined && c.walletsForHalf > 0) {
+                lines.push(`  Wallets to hold 50%: ${c.walletsForHalf}`);
+            }
+        }
+        const q = data.quality;
+        if (q) {
+            lines.push("");
+            lines.push("Adversarial Labels (Mobula):");
+            if (q.snipersCount !== undefined)
+                lines.push(`  Snipers:  ${q.snipersCount}`);
+            if (q.bundlersCount !== undefined)
+                lines.push(`  Bundlers: ${q.bundlersCount}`);
+            if (q.insidersCount !== undefined)
+                lines.push(`  Insiders: ${q.insidersCount}`);
+            if (q.sandwichCount !== undefined)
+                lines.push(`  Sandwich: ${q.sandwichCount}`);
+            if (q.suspiciousRatio !== undefined) {
+                lines.push(`  Suspicious Ratio: ${(q.suspiciousRatio * 100).toFixed(2)}%`);
+            }
+        }
+        if (data.source || data.fetchedAt) {
+            lines.push("");
+            lines.push(`Source: ${data.source ?? "unknown"}${data.fetchedAt ? ` (fetched ${data.fetchedAt})` : ""}`);
+        }
+        lines.push("");
+        lines.push("Note: per-rank wallet addresses are intentionally not exposed.");
+        return {
+            content: [{ type: "text", text: lines.join("\n") }],
+        };
+    }
+    catch (error) {
+        const message = error.message;
+        const errorCode = message.includes("404")
+            ? (message.toLowerCase().includes("crown not found") ? "CROWN_NOT_FOUND" : "NO_DATA")
+            : "API_ERROR";
+        return {
+            content: [{ type: "text", text: JSON.stringify({ error: errorCode, message }) }],
+            isError: true,
+        };
+    }
+});
+// Tool: get_recommendations
+server.registerTool("get_recommendations", {
+    title: "Get page recommendations",
+    description: "Get AI-powered recommendations for optimizing crown profile, heartbeat, and listing readiness.",
+    inputSchema: {
+        crown_id: z.number().describe("Crown token ID"),
+        focus: z.enum(["heartbeat", "listing", "engagement", "all"]).optional().describe("Optional: Focus area for recommendations"),
+    },
+    annotations: { readOnlyHint: true, openWorldHint: false },
+}, async ({ crown_id, focus }) => {
+    if (!RECOMMENDER_URL) {
+        return {
+            content: [{
+                    type: "text",
+                    text: "Recommendations are unavailable: they come from a recommender service, and the Chain Daddy API does not host one. Set CHAINDADDY_RECOMMENDER_URL to a recommender you run to use this tool.",
+                }],
+            isError: true,
+        };
+    }
+    try {
+        const focusParam = focus ? `?focus=${focus}` : "";
+        const endpoint = `/recommendations/${crown_id}${focusParam}`;
+        const data = await apiCall(endpoint, { baseUrl: RECOMMENDER_URL });
+        const lines = [
+            `Recommendations: ${data.symbol} (#${data.crownId})`,
+            "",
+        ];
+        if (data.scores) {
+            lines.push("Current Scores:");
+            lines.push(`  Overall:    ${data.scores.overall}%`);
+            lines.push(`  Heartbeat:  ${data.scores.heartbeat}%`);
+            lines.push(`  Listing:    ${data.scores.listing}%`);
+            lines.push(`  Engagement: ${data.scores.engagement}%`);
+            lines.push("");
+        }
+        if (data.recommendations.length === 0) {
+            lines.push("No recommendations at this time. Your crown is in good health!");
+        }
+        else {
+            lines.push("Action Items:");
+            lines.push("");
+            for (const rec of data.recommendations) {
+                const priorityIcon = rec.priority === "high" ? "[!]" : rec.priority === "medium" ? "[*]" : "[-]";
+                lines.push(`${priorityIcon} ${rec.title}`);
+                lines.push(`    Category: ${rec.category}`);
+                lines.push(`    ${rec.description}`);
+                if (rec.impact) {
+                    lines.push(`    Impact: ${rec.impact}`);
+                }
+                lines.push("");
+            }
+        }
+        return {
+            content: [{ type: "text", text: lines.join("\n") }],
+        };
+    }
+    catch (error) {
+        return {
+            content: [{ type: "text", text: `Recommendations failed: ${error.message}` }],
+            isError: true,
+        };
+    }
+});
+// Tool: update_profile
+//
+// Backend route: PUT /api/v2/registration/{id}/profile (crown_profile.go).
+// JWT-gated; the session JWT must belong to the crown owner or a manager.
+// `category` is intentionally NOT forwarded — the profile endpoint does
+// not expose it. Tools that need to set category should target the
+// extensions/metadata blob via a future tool once a backend route lands.
+//
+// Field mapping: socials.twitter → xdotcom (the X.com handle field in
+// crown_display); other socials pass through; logo_url → logoUrl. Pointer
+// semantics in the Go struct mean an omitted field keeps its existing
+// value, so we only include keys the caller actually passed.
+server.registerTool("update_profile", {
+    title: "Update token page profile",
+    description: "Update crown profile metadata via PUT /api/v2/registration/{id}/profile. Requires a session bound to a backend JWT (run authenticate first) and the session wallet must own or manage the crown.\n\nParams: crown_id (string), description (string?), tags (string[]?), category ('meme'|'gaming'|'defi'|'nft'|'social'|'utility'?) [NOT FORWARDED — no backend route exposes category on the profile endpoint], website (string?), socials ({twitter?, telegram?, discord?}?), logo_url (string?), session_token (string)\nReturns: {updated_fields: string[]}\nErrors: NO_SESSION, SESSION_EXPIRED, NO_JWT, NOT_OWNER, NO_FIELDS, API_ERROR",
+    inputSchema: {
+        crown_id: z.string().describe("Crown ID (token ID)"),
+        description: z.string().optional().describe("Token/project description"),
+        tags: z.array(z.string()).optional().describe("Descriptive tags (e.g., ['meme', 'dog', 'community'])"),
+        category: z.enum(["meme", "gaming", "defi", "nft", "social", "utility"]).optional().describe("Project category. ACCEPTED but NOT forwarded — the profile endpoint does not expose this field today; the input is preserved here for API stability."),
+        website: z.string().optional().describe("Project website URL"),
+        socials: z.object({
+            twitter: z.string().optional(),
+            telegram: z.string().optional(),
+            discord: z.string().optional(),
+        }).optional().describe("Social links: {twitter, telegram, discord}. twitter maps to the backend `xdotcom` field."),
+        logo_url: z.string().optional().describe("Logo image URL"),
+        session_token: z.string().describe("Session token from authenticate (must have been issued post-JWT-bridge, i.e. after fix/mcp-siwe-jwt-bridge)"),
+    },
+    annotations: { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: true },
+}, async ({ crown_id, description, tags, category, website, socials, logo_url, session_token }) => {
+    void category;
+    try {
+        const { jwt } = requireSessionJWT(session_token);
+        // Map MCP-friendly inputs to the backend's updateCrownProfileRequest
+        // shape. Only include keys the caller actually passed so the backend's
+        // "nil → keep" pointer semantics are preserved.
+        const payload = {};
+        if (description !== undefined)
+            payload.description = description;
+        if (tags !== undefined)
+            payload.tags = tags;
+        if (website !== undefined)
+            payload.website = website;
+        if (logo_url !== undefined)
+            payload.logoUrl = logo_url;
+        if (socials !== undefined) {
+            if (socials.twitter !== undefined)
+                payload.xdotcom = socials.twitter;
+            if (socials.telegram !== undefined)
+                payload.telegram = socials.telegram;
+            if (socials.discord !== undefined)
+                payload.discord = socials.discord;
+        }
+        if (Object.keys(payload).length === 0) {
+            return {
+                content: [{ type: "text", text: JSON.stringify({ error: "NO_FIELDS", message: "No fields provided to update" }) }],
+                isError: true,
+            };
+        }
+        await apiPut(`/api/v2/registration/${encodeURIComponent(crown_id)}/profile`, payload, { jwt });
+        return {
+            content: [{ type: "text", text: JSON.stringify({
+                        updated_fields: Object.keys(payload),
+                    }) }],
+        };
+    }
+    catch (error) {
+        const message = error.message;
+        const errorCode = message.startsWith("NO_SESSION") ? "NO_SESSION"
+            : message.startsWith("SESSION_EXPIRED") ? "SESSION_EXPIRED"
+                : message.startsWith("NO_JWT") ? "NO_JWT"
+                    : message.includes("403") ? "NOT_OWNER"
+                        : "API_ERROR";
+        return {
+            content: [{ type: "text", text: JSON.stringify({ error: errorCode, message }) }],
+            isError: true,
+        };
+    }
+});
+// Tool: create_order
+server.registerTool("create_order", {
+    title: "Create an order",
+    description: "Create a pending order with one or more actions. Returns order details with pricing and gas estimates. Order expires after 5 minutes.\n\nParams: actions (array of {type, params}), session_token (string)\nReturns: {order_id, summary, total_cost, gas_estimates, expires_at}\nErrors: NO_SESSION, SESSION_EXPIRED, INVALID_ACTIONS, VALIDATION_ERROR",
+    inputSchema: {
+        actions: z.array(z.object({
+            type: z.string().describe("Action type (e.g., 'deploy_token_evm', 'deploy_token_solana', 'claim_crown')"),
+            params: z.record(z.string(), z.unknown()).describe("Action-specific parameters"),
+        })).min(1).describe("Array of order actions to execute"),
+        session_token: z.string().describe("Session token from authenticate"),
+    },
+    annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: false },
+}, async ({ actions, session_token }) => {
+    try {
+        const session = requireSession(session_token);
+        const data = await apiPost("/api/v2/orders", {
+            actions,
+            wallet: session.wallet,
+        });
+        return {
+            content: [{ type: "text", text: JSON.stringify({
+                        order_id: data.order_id,
+                        summary: data.summary,
+                        total_cost: data.total_cost_usd,
+                        gas_estimates: data.gas_estimates,
+                        expires_at: data.expires_at,
+                    }) }],
+        };
+    }
+    catch (error) {
+        const message = error.message;
+        const errorCode = message.startsWith("NO_SESSION") ? "NO_SESSION"
+            : message.startsWith("SESSION_EXPIRED") ? "SESSION_EXPIRED"
+                : "ORDER_ERROR";
+        return {
+            content: [{ type: "text", text: JSON.stringify({ error: errorCode, message }) }],
+            isError: true,
+        };
+    }
+});
+// Tool: confirm_order
+server.registerTool("confirm_order", {
+    title: "Confirm and execute an order",
+    description: "Confirm and execute a pending order. Triggers all actions in the order. Cannot be undone.\n\nParams: order_id (string), session_token (string)\nReturns: {results: [{action, status, tx_hash?, error?}]}\nErrors: NO_SESSION, SESSION_EXPIRED, ORDER_NOT_FOUND, ORDER_EXPIRED, ORDER_ALREADY_CONFIRMED",
+    inputSchema: {
+        order_id: z.string().describe("Order ID from create_order"),
+        session_token: z.string().describe("Session token from authenticate"),
+    },
+    annotations: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: true },
+}, async ({ order_id, session_token }) => {
+    try {
+        requireSession(session_token);
+        const data = await apiPost(`/api/v2/orders/${order_id}/confirm`, {});
+        return {
+            content: [{ type: "text", text: JSON.stringify({
+                        results: data.results,
+                    }) }],
+        };
+    }
+    catch (error) {
+        const message = error.message;
+        const errorCode = message.startsWith("NO_SESSION") ? "NO_SESSION"
+            : message.startsWith("SESSION_EXPIRED") ? "SESSION_EXPIRED"
+                : message.includes("410") ? "ORDER_EXPIRED"
+                    : message.includes("409") ? "ORDER_ALREADY_CONFIRMED"
+                        : message.includes("404") ? "ORDER_NOT_FOUND"
+                            : "CONFIRM_ERROR";
+        return {
+            content: [{ type: "text", text: JSON.stringify({ error: errorCode, message }) }],
+            isError: true,
+        };
+    }
+});
+// Tool: cancel_order
+server.registerTool("cancel_order", {
+    title: "Cancel an order",
+    description: "Cancel a pending order. Only works on orders that have not been confirmed.\n\nParams: order_id (string), session_token (string)\nReturns: {cancelled: true}\nErrors: NO_SESSION, SESSION_EXPIRED, ORDER_NOT_FOUND, ORDER_EXPIRED, ORDER_ALREADY_CONFIRMED",
+    inputSchema: {
+        order_id: z.string().describe("Order ID from create_order"),
+        session_token: z.string().describe("Session token from authenticate"),
+    },
+    annotations: { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: false },
+}, async ({ order_id, session_token }) => {
+    try {
+        requireSession(session_token);
+        await apiDelete(`/api/v2/orders/${order_id}`);
+        return {
+            content: [{ type: "text", text: JSON.stringify({ cancelled: true }) }],
+        };
+    }
+    catch (error) {
+        const message = error.message;
+        const errorCode = message.startsWith("NO_SESSION") ? "NO_SESSION"
+            : message.startsWith("SESSION_EXPIRED") ? "SESSION_EXPIRED"
+                : message.includes("410") ? "ORDER_EXPIRED"
+                    : message.includes("409") ? "ORDER_ALREADY_CONFIRMED"
+                        : message.includes("404") ? "ORDER_NOT_FOUND"
+                            : "CANCEL_ERROR";
+        return {
+            content: [{ type: "text", text: JSON.stringify({ error: errorCode, message }) }],
+            isError: true,
+        };
+    }
+});
+// Tool: deploy_token
+server.registerTool("deploy_token", {
+    title: "Build a token creation action",
+    description: "Deploy a single token on a single chain. Validates parameters and returns an order action spec for inclusion in create_order.\n\nParams: name (string), symbol (string), chain (string), supply (number), decimals (number), mintable (boolean), burnable (boolean), session_token (string)\nReturns: {order_action_spec: {type, params}}\nErrors: NO_SESSION, SESSION_EXPIRED, VALIDATION_ERROR, RATE_LIMITED",
+    inputSchema: {
+        name: z.string().describe("Token display name"),
+        symbol: z.string().describe("Token symbol (1-10 uppercase alphanumeric)"),
+        chain: z.string().describe("Target chain (e.g., 'arb', 'sol', 'base', 'polygon', 'bsc', 'eth')"),
+        supply: z.number().describe("Total token supply"),
+        decimals: z.number().describe("Token decimals (0-18)"),
+        mintable: z.boolean().describe("Whether additional tokens can be minted"),
+        burnable: z.boolean().describe("Whether tokens can be burned"),
+        session_token: z.string().describe("Session token from authenticate"),
+    },
+    annotations: { readOnlyHint: true, openWorldHint: false },
+}, async ({ name, symbol, chain, supply, decimals, mintable, burnable, session_token }) => {
+    try {
+        const session = requireSession(session_token);
+        const data = await apiPost("/api/v2/tokens/deploy", {
+            name,
+            symbol,
+            chain,
+            supply,
+            decimals,
+            mintable,
+            burnable,
+            wallet_address: session.wallet,
+        });
+        if (!data.valid || !data.action) {
+            return {
+                content: [{ type: "text", text: JSON.stringify({
+                            error: "VALIDATION_ERROR",
+                            message: data.errors?.join(", ") || "Token deployment validation failed",
+                        }) }],
+                isError: true,
+            };
+        }
+        return {
+            content: [{ type: "text", text: JSON.stringify({
+                        order_action_spec: data.action,
+                    }) }],
+        };
+    }
+    catch (error) {
+        const message = error.message;
+        const errorCode = message.startsWith("NO_SESSION") ? "NO_SESSION"
+            : message.startsWith("SESSION_EXPIRED") ? "SESSION_EXPIRED"
+                : message.includes("429") ? "RATE_LIMITED"
+                    : "DEPLOY_ERROR";
+        return {
+            content: [{ type: "text", text: JSON.stringify({ error: errorCode, message }) }],
+            isError: true,
+        };
+    }
+});
+// Tool: list_launch_venues
+//
+// Every contract a token can be launched through, with what a trade pays and
+// where it goes, per $100 traded. Rows with freeCrown=true launch through Chain
+// Daddy and come with a free crown; the others are comparison only. Present BOTH
+// numbers for every venue (trader fee and creator share) — ranking on the
+// creator's share alone favours the launchpad that charges traders most — and do
+// not call any venue "best" or "recommended".
+server.registerTool("list_launch_venues", {
+    title: "List launch venues",
+    description: "List the contracts a token can be launched through (ours and third parties'), ranked by what reaches the creator per $100 traded. Name each one by chains[].contract where present, else by the venue's name — a creator picks a contract, not a product tier. Every economics field is basis points of trade volume (100 = $1 per $100 traded). Show both traderFeeBps and creatorBps for each venue. Venues with freeCrown=true launch through Chain Daddy with a free crown; others are comparison-only.\n\nParams: chain_id (number?) — narrow to one chain (EVM chain id; Solana mainnet 900900), session_token (string?) — a signed-in session sees its own plan's rates\nReturns: {venues: [...], sort, generatedAt}\nErrors: API_ERROR",
+    inputSchema: {
+        chain_id: z.number().optional().describe("Only venues that launch on this chain"),
+        session_token: z.string().optional().describe("Optional session token from authenticate"),
+    },
+    annotations: { readOnlyHint: true, openWorldHint: false },
+}, async ({ chain_id, session_token }) => {
+    try {
+        const jwt = session_token ? sessions.get(session_token)?.jwt : undefined;
+        const q = chain_id ? `?chainId=${chain_id}` : "";
+        const data = await apiCall(`/api/v2/launch/venues${q}`, { jwt });
+        return { content: [{ type: "text", text: JSON.stringify(data) }] };
+    }
+    catch (error) {
+        return {
+            content: [{ type: "text", text: JSON.stringify({ error: "API_ERROR", message: error.message }) }],
+            isError: true,
+        };
+    }
+});
+// Tool: build_venue_launch
+server.registerTool("build_venue_launch", {
+    title: "Build a third-party launch",
+    description: "Build a token launch on a third-party contract (e.g. 'clanker') through Chain Daddy. Returns an unsigned transaction: the caller's OWN wallet — the session wallet — must sign and send transactions[0] on its chainId, then call submit_venue_launch with the hash. Chain Daddy never sends it. Once proven, the token's crown is free.\n\nParams: venue (string), chain_id (number), name (string), symbol (string), image (string?) — ipfs:// or https:// URL, description (string?), session_token (string)\nReturns: {intent: {id, status, ...}, transactions: [{chainId, to, data, value}]}\nErrors: NO_SESSION, SESSION_EXPIRED, NO_JWT, VENUE_UNAVAILABLE, API_ERROR",
+    inputSchema: {
+        venue: z.string().describe("Venue id from list_launch_venues with freeCrown=true (not chaindaddy-launchpad or chaindaddy-classic)"),
+        chain_id: z.number().describe("Chain to launch on — one the venue lists as launchable"),
+        name: z.string().describe("Token name"),
+        symbol: z.string().describe("Ticker"),
+        image: z.string().optional().describe("Token image URL"),
+        description: z.string().optional().describe("Token description"),
+        session_token: z.string().describe("Session token from authenticate"),
+    },
+    annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: false },
+}, async ({ venue, chain_id, name, symbol, image, description, session_token }) => {
+    try {
+        const { session, jwt } = requireSessionJWT(session_token);
+        const data = await apiPost(`/api/v2/launch/venues/${encodeURIComponent(venue)}/build`, {
+            chainId: chain_id,
+            wallet: session.wallet,
+            name,
+            symbol,
+            ...(image ? { image } : {}),
+            ...(description ? { description } : {}),
+        }, {}, { jwt });
+        return { content: [{ type: "text", text: JSON.stringify(data) }] };
+    }
+    catch (error) {
+        const message = error.message;
+        const code = message.startsWith("NO_SESSION") ? "NO_SESSION"
+            : message.startsWith("SESSION_EXPIRED") ? "SESSION_EXPIRED"
+                : message.startsWith("NO_JWT") ? "NO_JWT"
+                    : /not available|does not launch/.test(message) ? "VENUE_UNAVAILABLE"
+                        : "API_ERROR";
+        return { content: [{ type: "text", text: JSON.stringify({ error: code, message }) }], isError: true };
+    }
+});
+// Tool: submit_venue_launch
+server.registerTool("submit_venue_launch", {
+    title: "Report a launch transaction",
+    description: "Report the transaction hash of a launch built by build_venue_launch, after the session wallet sent it. The server proves the launch from the launchpad's own on-chain record; poll get_venue_launch until status is 'confirmed' (freeCrown=true, tokenAddress set) or 'failed' (failureReason says why).\n\nParams: intent_id (string), tx_hash (string), session_token (string)\nReturns: {id, status, tokenAddress?, freeCrown, failureReason?}\nErrors: NO_SESSION, SESSION_EXPIRED, NO_JWT, API_ERROR",
+    inputSchema: {
+        intent_id: z.string().describe("intent.id from build_venue_launch"),
+        tx_hash: z.string().describe("Hash of the sent launch transaction"),
+        session_token: z.string().describe("Session token from authenticate"),
+    },
+    annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: true, openWorldHint: false },
+}, async ({ intent_id, tx_hash, session_token }) => {
+    try {
+        const { jwt } = requireSessionJWT(session_token);
+        const data = await apiPost(`/api/v2/launch/intents/${encodeURIComponent(intent_id)}/submit`, { txHash: tx_hash }, {}, { jwt });
+        return { content: [{ type: "text", text: JSON.stringify(data) }] };
+    }
+    catch (error) {
+        const message = error.message;
+        const code = message.startsWith("NO_SESSION") ? "NO_SESSION"
+            : message.startsWith("SESSION_EXPIRED") ? "SESSION_EXPIRED"
+                : message.startsWith("NO_JWT") ? "NO_JWT"
+                    : "API_ERROR";
+        return { content: [{ type: "text", text: JSON.stringify({ error: code, message }) }], isError: true };
+    }
+});
+// Tool: get_venue_launch
+server.registerTool("get_venue_launch", {
+    title: "Get a third-party launch",
+    description: "Read a third-party launch's state. A submitted launch is re-proven on each read.\n\nParams: intent_id (string), session_token (string)\nReturns: {id, status, tokenAddress?, freeCrown, failureReason?}\nErrors: NO_SESSION, SESSION_EXPIRED, NO_JWT, API_ERROR",
+    inputSchema: {
+        intent_id: z.string().describe("intent.id from build_venue_launch"),
+        session_token: z.string().describe("Session token from authenticate"),
+    },
+    annotations: { readOnlyHint: true, openWorldHint: false },
+}, async ({ intent_id, session_token }) => {
+    try {
+        const { jwt } = requireSessionJWT(session_token);
+        const data = await apiCall(`/api/v2/launch/intents/${encodeURIComponent(intent_id)}`, { jwt });
+        return { content: [{ type: "text", text: JSON.stringify(data) }] };
+    }
+    catch (error) {
+        const message = error.message;
+        const code = message.startsWith("NO_SESSION") ? "NO_SESSION"
+            : message.startsWith("SESSION_EXPIRED") ? "SESSION_EXPIRED"
+                : message.startsWith("NO_JWT") ? "NO_JWT"
+                    : "API_ERROR";
+        return { content: [{ type: "text", text: JSON.stringify({ error: code, message }) }], isError: true };
+    }
+});
+// Tool: claim_crown
+server.registerTool("claim_crown", {
+    title: "Build a registration claim action",
+    description: "Claim a crown for a specific token on a specific chain. Requires verified ownership. Returns an order action spec for inclusion in create_order.\n\nParams: symbol (string), chain (string), token_address (string), verification_method ('deployer'|'mint_authority'|'owner'|'majority_holder'), session_token (string)\nReturns: {order_action_spec: {type: 'claim_crown', params: {symbol, chain, token_address, verification_method, wallet}}}\nErrors: NO_SESSION, SESSION_EXPIRED, INVALID_CHAIN, INVALID_VERIFICATION_METHOD",
+    inputSchema: {
+        symbol: z.string().describe("Token symbol to claim crown for (e.g., 'PEPE')"),
+        chain: z.string().describe("Chain where the token exists (e.g., 'arb', 'sol', 'base', 'polygon', 'bsc', 'eth')"),
+        token_address: z.string().describe("Token contract/mint address on the specified chain"),
+        verification_method: z.enum(["deployer", "mint_authority", "owner", "majority_holder"]).describe("Method used to verify ownership: 'deployer', 'mint_authority', 'owner', or 'majority_holder'"),
+        session_token: z.string().describe("Session token from authenticate"),
+    },
+    annotations: { readOnlyHint: true, openWorldHint: false },
+}, async ({ symbol, chain, token_address, verification_method, session_token }) => {
+    try {
+        const session = requireSession(session_token);
+        // Validate chain is supported
+        if (!(chain in SUPPORTED_CHAINS)) {
+            return {
+                content: [{ type: "text", text: JSON.stringify({
+                            error: "INVALID_CHAIN",
+                            message: `Unsupported chain: ${chain}. Supported: ${Object.keys(SUPPORTED_CHAINS).join(", ")}`,
+                        }) }],
+                isError: true,
+            };
+        }
+        // Return order action spec for inclusion in create_order
+        return {
+            content: [{ type: "text", text: JSON.stringify({
+                        order_action_spec: {
+                            type: "claim_crown",
+                            params: {
+                                symbol,
+                                chain,
+                                token_address,
+                                verification_method,
+                                wallet: session.wallet,
+                            },
+                        },
+                    }) }],
+        };
+    }
+    catch (error) {
+        const message = error.message;
+        const errorCode = message.startsWith("NO_SESSION") ? "NO_SESSION"
+            : message.startsWith("SESSION_EXPIRED") ? "SESSION_EXPIRED"
+                : "CLAIM_ERROR";
+        return {
+            content: [{ type: "text", text: JSON.stringify({ error: errorCode, message }) }],
+            isError: true,
+        };
+    }
+});
+// Tool: generate_listing
+server.registerTool("generate_listing", {
+    title: "Generate an aggregator listing",
+    description: "Generate a listing for one aggregator format using crown data.\n\nParams: crown_id (string), format ('coingecko'|'coinmarketcap'|'dexscreener'|'tokenlist')\nReturns: {listing_data: object, missing_fields?: string[]}\nErrors: CROWN_NOT_FOUND, INVALID_FORMAT, API_ERROR",
+    inputSchema: {
+        crown_id: z.string().describe("Crown ID to generate listing for"),
+        format: z.enum(["coingecko", "coinmarketcap", "dexscreener", "tokenlist"]).describe("Listing format: 'coingecko', 'coinmarketcap', 'dexscreener', or 'tokenlist'"),
+    },
+    annotations: { readOnlyHint: true, openWorldHint: false },
+}, async ({ crown_id, format }) => {
+    try {
+        // First get crown data to know symbol and chain
+        const crownData = await apiCall(`/api/v2/registration/${encodeURIComponent(crown_id)}`);
+        const symbol = crownData.symbol || "";
+        const chain = crownData.chain || crownData.chainName || "";
+        if (!symbol) {
+            return {
+                content: [{ type: "text", text: JSON.stringify({
+                            error: "CROWN_NOT_FOUND",
+                            message: "Crown data missing symbol",
+                        }) }],
+                isError: true,
+            };
+        }
+        let listingData;
+        let missingFields = [];
+        if (format === "tokenlist") {
+            // Uniswap Token List format
+            const params = new URLSearchParams();
+            params.set("symbol", symbol);
+            listingData = await apiCall(`/api/v2/tokenlist?${params.toString()}`);
+            // Check for missing fields in token list
+            const tokenList = listingData;
+            if (!tokenList.tokens || tokenList.tokens.length === 0) {
+                missingFields.push("tokens (no tokens in list)");
+            }
+            else {
+                const firstToken = tokenList.tokens[0];
+                if (!firstToken.address)
+                    missingFields.push("address");
+                if (!firstToken.name)
+                    missingFields.push("name");
+                if (!firstToken.logoURI)
+                    missingFields.push("logoURI");
+            }
+        }
+        else if (format === "coinmarketcap") {
+            const encodedSymbol = encodeURIComponent(symbol);
+            const encodedChain = encodeURIComponent(chain || "arb");
+            listingData = await apiCall(`/api/v2/tokenlist/cmc/${encodedSymbol}/${encodedChain}`);
+            // Check required CoinMarketCap fields
+            const cmc = listingData;
+            if (!cmc.description)
+                missingFields.push("description");
+            if (!cmc.logo)
+                missingFields.push("logo");
+            if (!cmc.urls?.website?.length)
+                missingFields.push("website");
+            if (!cmc.urls?.twitter?.length)
+                missingFields.push("twitter");
+            if (!cmc.urls?.explorer?.length)
+                missingFields.push("explorer");
+            if (!cmc.platform?.contractAddress)
+                missingFields.push("contractAddress");
+        }
+        else if (format === "coingecko") {
+            const encodedSymbol = encodeURIComponent(symbol);
+            const encodedChain = encodeURIComponent(chain || "arb");
+            listingData = await apiCall(`/api/v2/tokenlist/gecko/${encodedSymbol}/${encodedChain}`);
+            // Check required CoinGecko fields
+            const gecko = listingData;
+            if (!gecko.id)
+                missingFields.push("id");
+            if (!gecko.name || gecko.name === symbol + " Token")
+                missingFields.push("name (using default)");
+            if (!gecko.platforms || Object.keys(gecko.platforms).length === 0)
+                missingFields.push("platforms");
+            if (!gecko.links?.homepage?.length)
+                missingFields.push("homepage");
+            if (!gecko.links?.twitter_screen_name)
+                missingFields.push("twitter_screen_name");
+        }
+        else {
+            // dexscreener
+            const encodedSymbol = encodeURIComponent(symbol);
+            const encodedChain = encodeURIComponent(chain || "arb");
+            listingData = await apiCall(`/api/v2/tokenlist/dexscreener/${encodedSymbol}/${encodedChain}`);
+            // Check required DEX Screener fields
+            const dex = listingData;
+            if (!dex.tokenAddress)
+                missingFields.push("tokenAddress");
+            if (!dex.icon)
+                missingFields.push("icon");
+            if (!dex.description)
+                missingFields.push("description");
+            if (!dex.links || dex.links.length === 0)
+                missingFields.push("links");
+        }
+        const result = {
+            listing_data: listingData,
+        };
+        if (missingFields.length > 0) {
+            result.missing_fields = missingFields;
+        }
+        return {
+            content: [{ type: "text", text: JSON.stringify(result) }],
+        };
+    }
+    catch (error) {
+        const message = error.message;
+        const errorCode = message.includes("404") ? "CROWN_NOT_FOUND" : "API_ERROR";
+        return {
+            content: [{ type: "text", text: JSON.stringify({ error: errorCode, message }) }],
+            isError: true,
+        };
+    }
+});
+// Tool: find_inactive
+server.registerTool("find_inactive", {
+    title: "Find inactive registrations",
+    description: "Find inactive crowns that are eligible for reclaim. All params optional.\n\nParams: symbol (string?), chain (string?), min_market_cap (number?)\nReturns: {inactive_crowns: [{symbol, chain, owner_address, last_activity, heartbeat_score, reclaim_cost}]}\nErrors: API_ERROR",
+    inputSchema: {
+        symbol: z.string().optional().describe("Filter by symbol (e.g., 'DOGE')"),
+        chain: z.string().optional().describe("Filter by chain (e.g., 'arb', 'sol', 'base')"),
+        min_market_cap: z.number().optional().describe("Minimum market cap filter in USD"),
+    },
+    annotations: { readOnlyHint: true, openWorldHint: false },
+}, async ({ symbol, chain, min_market_cap }) => {
+    try {
+        const params = new URLSearchParams();
+        if (symbol)
+            params.set("symbol", symbol);
+        if (chain)
+            params.set("chain", chain);
+        if (min_market_cap !== undefined)
+            params.set("min_market_cap", min_market_cap.toString());
+        const queryString = params.toString();
+        const endpoint = `/api/v2/registration/inactive${queryString ? `?${queryString}` : ""}`;
+        const data = await apiCall(endpoint);
+        return {
+            content: [{ type: "text", text: JSON.stringify({
+                        inactive_crowns: data.crowns || [],
+                    }) }],
+        };
+    }
+    catch (error) {
+        return {
+            content: [{ type: "text", text: JSON.stringify({ error: "API_ERROR", message: error.message }) }],
+            isError: true,
+        };
+    }
+});
+// Tool: search_symbols
+server.registerTool("search_symbols", {
+    title: "Search tickers with filters",
+    description: "Search for symbols across all supported chains. Returns availability, market data, and crown status.\n\nParams: query (string), chain (string?), status (string?)\nReturns: {results: [{symbol, chain, chain_name, status, token_address, market_cap, volume_24h, liquidity, crown_owner}]}\nErrors: API_ERROR",
+    inputSchema: {
+        query: z.string().describe("Search query (symbol or partial match, e.g., 'DOGE', 'PEP')"),
+        chain: z.string().optional().describe("Filter by chain (e.g., 'arb', 'sol', 'base')"),
+        status: z.string().optional().describe("Filter by status (e.g., 'available', 'unclaimed', 'claimed', 'inactive')"),
+    },
+    annotations: { readOnlyHint: true, openWorldHint: false },
+}, async ({ query, chain, status }) => {
+    try {
+        const params = new URLSearchParams();
+        params.set("symbol", query);
+        if (chain)
+            params.set("chain", chain);
+        if (status)
+            params.set("status", status);
+        const endpoint = `/api/v2/search?${params.toString()}`;
+        const data = await apiCall(endpoint);
+        const results = (data.results || []).map(r => ({
+            symbol: r.token?.symbol || query.toUpperCase(),
+            chain: r.chainKey || "",
+            chain_name: r.chainName || "",
+            status: r.crown?.status || "available",
+            token_address: r.token?.address || null,
+            market_cap: r.token?.marketCap ?? null,
+            volume_24h: r.token?.volume24h ?? null,
+            liquidity: r.token?.liquidity ?? null,
+            crown_owner: r.crown?.owner || null,
+        }));
+        return {
+            content: [{ type: "text", text: JSON.stringify({ results }) }],
+        };
+    }
+    catch (error) {
+        return {
+            content: [{ type: "text", text: JSON.stringify({ error: "API_ERROR", message: error.message }) }],
+            isError: true,
+        };
+    }
+});
+// ============================================================================
+// CREATOR STORE (in-app items sold for the creator's own token, rewards, unlocks)
+// ============================================================================
+//
+// Every tool calls /api/v2/iap exactly as the website does. Creator routes need
+// a Developer plan (or Developer Beta program membership) on the wallet that
+// opened the store; otherwise they answer 403 IAP_PLAN_REQUIRED. Writes are
+// idempotent: each returns the idempotency_key it sent, and a retry with the
+// same key never grants or sells twice.
+const iapSessionToken = z
+    .string()
+    .optional()
+    .describe("Session token from authenticate. Optional when CHAINDADDY_API_KEY is set (or, for store-scoped tools, CHAINDADDY_IAP_KEY)");
+const iapIdempotencyKey = z
+    .string()
+    .max(255)
+    .optional()
+    .describe("Idempotency-Key for this write. Omit to generate one; reuse the returned idempotency_key to retry safely");
+const iapStoreId = z.string().describe("Store id (from iap_open_store or iap_list_stores)");
+const iapRule = z
+    .record(z.string(), z.unknown())
+    .describe("Rule: {all:[…]}|{any:[…]}|{not:…}|{hold:{min, token?, chainId?}}|{owns:{sku, min?}}. `min` for hold is base units");
+const iapGrant = z.object({ sku: z.string(), quantity: z.number().int().positive() });
+const iapSkuFields = {
+    type: z.enum(["consumable", "non_consumable", "timed", "unlock"]),
+    name: z.string(),
+    description: z.string(),
+    imageUrl: z.string(),
+    metadata: z.record(z.string(), z.unknown()).describe("Free-form JSON your app reads"),
+    currency: z
+        .enum(["token", "native", "usdc"])
+        .describe("What the buyer pays in. 'token' (the default, and the recommended choice): the store's own token, so every sale is demand for it; pair it with priceUsdMicros for a steady dollar price. 'native': the chain's coin (ETH, BNB, POL, SOL…). 'usdc': the chain's dollar stable (USDC; USDG on Robinhood Chain; not on Gnosis). The buyer pays the creator directly in every case. price/minPrice/maxPrice are base units of this currency; an update that changes it must set price or priceUsdMicros in the same patch (the bounds clear). Unlocks take no currency"),
+    price: z.string().nullable().describe("Price in base units of the SKU's currency (decimal string); null = not for sale"),
+    priceUsdMicros: z
+        .number()
+        .int()
+        .positive()
+        .nullable()
+        .describe("Price in US micro-dollars per unit instead of `price` ($5 = 5000000). Recommended with currency 'token'. Each order converts it to an exact amount of the SKU's currency and locks it: at the token's or coin's live price (the mean of the last 2 minutes of 15-second readings, rounded up to 4 significant figures), or exactly with currency 'usdc'. Set price OR priceUsdMicros, not both"),
+    minPrice: z.string().nullable().describe("With priceUsdMicros in 'token' or 'native': never charge less than this per unit, in base units (decimal string). Refused with 'usdc', where the price is exact"),
+    maxPrice: z.string().nullable().describe("With priceUsdMicros in 'token' or 'native': never charge more than this per unit, in base units (decimal string). Refused with 'usdc'"),
+    grants: z.array(iapGrant).nullable().describe("Bundle: buying grants these items instead of itself"),
+    splits: z
+        .array(z.object({ address: z.string().describe("Wallet on the store's chain"), bps: z.number().int().min(1).max(9999) }))
+        .max(3)
+        .nullable()
+        .describe("Revenue splits: each sale also pays these wallets bps (1/100 of a percent) of the creator's share, the price after any platform fee, straight from the buyer's one payment. At most 2 (3 on a launchpad token, which pays no fee: one payment carries 4 payees), together at most 9999 so the store payout keeps a part. Not the payout, the fee recipient or the checkout. null clears"),
+    durationSeconds: z.number().int().positive().nullable().describe("timed SKUs: seconds added per unit"),
+    rule: iapRule.nullable(),
+    maxSupply: z.number().int().positive().nullable(),
+    maxPerWallet: z.number().int().positive().nullable(),
+    saleStartsAt: z.string().nullable(),
+    saleEndsAt: z.string().nullable(),
+    status: z.enum(["draft", "active", "archived"]),
+    sortOrder: z.number().int(),
+};
+const iapSkuInput = z
+    .object({
+    sku: z.string().regex(/^[a-z0-9][a-z0-9._-]{0,63}$/).describe("SKU key, unique per store"),
+    ...iapSkuFields,
+})
+    .partial()
+    .required({ sku: true, type: true, name: true });
+const iapSkuPatch = z.object(iapSkuFields).partial();
+const iapDropInput = z.object({
+    name: z.string(),
+    mode: z.enum(["claim", "push", "award"]).describe("claim = a claim link; push = delivered to a recipient list; award = your server awards it"),
+    items: z.array(iapGrant).min(1),
+    description: z.string().optional(),
+    imageUrl: z.string().optional(),
+    audience: iapRule.nullable().optional(),
+    allowlistOnly: z.boolean().optional(),
+    maxClaims: z.number().int().positive().nullable().optional(),
+    perWalletLimit: z.number().int().positive().optional(),
+    startsAt: z.string().nullable().optional(),
+    endsAt: z.string().nullable().optional(),
+    status: z.enum(["draft", "active", "paused", "ended"]).optional(),
+});
+const iapScopes = z.enum([
+    "catalog:write",
+    "orders:read",
+    "orders:write",
+    "entitlements:read",
+    "entitlements:write",
+    "drops:write",
+    "rewards:award",
+    "events:read",
+    "messages:send",
+]);
+const iapWebhookEvents = z.enum([
+    "iap.order.created",
+    "iap.order.paid",
+    "iap.order.confirmed",
+    "iap.order.expired",
+    "iap.order.reverted",
+    "iap.order.refunded",
+    "iap.order.mismatch",
+    "iap.order.duplicate_payment",
+    "iap.entitlement.granted",
+    "iap.entitlement.consumed",
+    "iap.entitlement.revoked",
+    "iap.entitlement.expiring",
+    "iap.entitlement.expired",
+    "iap.drop.claimed",
+    "iap.drop.awarded",
+    "iap.drop.exhausted",
+    "iap.sku.sold_out",
+    "iap.store.not_live",
+    "iap.store.live",
+]);
+const enc = encodeURIComponent;
+async function iapRead(path, auth, session_token) {
+    try {
+        const { data } = await iapRequest("GET", path, { auth, session_token });
+        return iapOk(data);
+    }
+    catch (error) {
+        return iapFail(error);
+    }
+}
+// A write. POSTs carry an Idempotency-Key, echoed back in the result (and in an
+// error) so the caller can retry with it. `noun` names the returned object; with
+// null the response's own fields are spread into the result.
+async function iapWrite(noun, method, path, body, auth, session_token, idempotency_key) {
+    const key = method === "POST" ? idempotency_key || randomUUID() : undefined;
+    try {
+        const { data } = await iapRequest(method, path, { body, idempotencyKey: key, auth, session_token });
+        const head = { ok: true };
+        if (key)
+            head.idempotency_key = key;
+        return iapOk(noun ? { ...head, [noun]: data } : { ...head, ...(data ?? {}) });
+    }
+    catch (error) {
+        return iapFail(error, key);
+    }
+}
+server.registerTool("iap_open_store", {
+    title: "Open a creator store",
+    description: "Open (or re-open) the creator store for a token page. Idempotent per token page. Needs a Developer plan or Developer Beta membership, and the manager role on the token page.\n\nParams: chain_key (string, e.g. 'base'), crown_id (number, the token page's registration id), session_token?, idempotency_key?\nReturns: {ok, idempotency_key, store: {id, chainId, chainKey, crownId, symbol, tokenAddress, tokenDecimals, tokenOrigin, feeBps, payoutAddress, status, live, …}}\nErrors: NO_CREDENTIALS, NO_SESSION, NO_JWT, IAP_PLAN_REQUIRED, HTTP_403, HTTP_404",
+    inputSchema: {
+        chain_key: z.string().describe("Chain key of the token page, e.g. 'base', 'solana'"),
+        crown_id: z.number().int().nonnegative().describe("Registration id of the token page"),
+        session_token: iapSessionToken,
+        idempotency_key: iapIdempotencyKey,
+    },
+    annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: true, openWorldHint: false },
+}, async ({ chain_key, crown_id, session_token, idempotency_key }) => iapWrite("store", "POST", "/stores", { chainKey: chain_key, crownId: crown_id }, "account", session_token, idempotency_key));
+server.registerTool("iap_list_stores", {
+    title: "List creator stores",
+    description: "List the creator stores you manage, optionally filtered to one token page.\n\nParams: chain_key?, crown_id?, session_token?\nReturns: {entries: Store[]}\nErrors: NO_CREDENTIALS, IAP_PLAN_REQUIRED",
+    inputSchema: {
+        chain_key: z.string().optional(),
+        crown_id: z.number().int().nonnegative().optional(),
+        session_token: iapSessionToken,
+    },
+    annotations: { readOnlyHint: true, openWorldHint: false },
+}, async ({ chain_key, crown_id, session_token }) => iapRead(`/stores${iapQuery({ chainKey: chain_key, crownId: crown_id })}`, "account", session_token));
+server.registerTool("iap_list_skus", {
+    title: "List store items",
+    description: "List a store's SKUs, including drafts and archived ones.\n\nParams: store_id, session_token?\nReturns: {entries: Sku[]} (price is base units of the SKU's currency — currency, currencyAddress, currencySymbol, currencyDecimals; null = not for sale)\nErrors: NO_CREDENTIALS, IAP_PLAN_REQUIRED, HTTP_404",
+    inputSchema: { store_id: iapStoreId, session_token: iapSessionToken },
+    annotations: { readOnlyHint: true, openWorldHint: false },
+}, async ({ store_id, session_token }) => iapRead(`/stores/${enc(store_id)}/skus`, "store", session_token));
+server.registerTool("iap_create_sku", {
+    title: "Create a store item",
+    description: "Create a SKU. Types: consumable (a balance: coins, boosts), non_consumable (owned once: skins, cars), timed (expiry extended by durationSeconds × quantity: season pass), unlock (never sold; held while `rule` holds). No price = reward-only. Price in base units (`price`) or in dollars (`priceUsdMicros`, with optional per-unit `minPrice`/`maxPrice` bounds in base units), never both. `currency` is what the buyer pays in: 'token' (default; recommended with priceUsdMicros — a steady dollar price, paid in the creator's token), 'native' or 'usdc'. GET /api/v2/iap/config lists each chain's currencies. `grants` makes a bundle. `splits` pays up to 2 more wallets (3 on a launchpad token) a share of each sale. New SKUs are drafts unless status is 'active'. Store key scope: catalog:write.\n\nParams: store_id, sku ({sku, type, name, currency?, price?, priceUsdMicros?, minPrice?, maxPrice?, grants?, splits?, durationSeconds?, rule?, maxSupply?, maxPerWallet?, saleStartsAt?, saleEndsAt?, status?, metadata?, description?, imageUrl?, sortOrder?}), session_token?, idempotency_key?\nReturns: {ok, idempotency_key, sku: Sku}\nErrors: NO_CREDENTIALS, IAP_PLAN_REQUIRED, HTTP_400 (validation), HTTP_409 (sku key taken)",
+    inputSchema: { store_id: iapStoreId, sku: iapSkuInput, session_token: iapSessionToken, idempotency_key: iapIdempotencyKey },
+    annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: false },
+}, async ({ store_id, sku, session_token, idempotency_key }) => iapWrite("sku", "POST", `/stores/${enc(store_id)}/skus`, sku, "store", session_token, idempotency_key));
+server.registerTool("iap_update_sku", {
+    title: "Update a store item",
+    description: "Update a SKU's fields (partial). Set status 'active' to put a draft on sale, 'archived' to take it off. Setting `price` clears a dollar price (and its bounds); setting `priceUsdMicros` clears a fixed price. Changing `currency` needs `price` or `priceUsdMicros` in the same patch when the SKU has a fixed price, and clears the bounds. Store key scope: catalog:write.\n\nParams: store_id, sku_key, patch (any SKU fields except the key), session_token?\nReturns: {ok, sku: Sku}\nErrors: NO_CREDENTIALS, IAP_PLAN_REQUIRED, HTTP_400, HTTP_404",
+    inputSchema: { store_id: iapStoreId, sku_key: z.string(), patch: iapSkuPatch, session_token: iapSessionToken },
+    annotations: { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: false },
+}, async ({ store_id, sku_key, patch, session_token }) => iapWrite("sku", "PATCH", `/stores/${enc(store_id)}/skus/${enc(sku_key)}`, patch, "store", session_token));
+server.registerTool("iap_list_orders", {
+    title: "List store orders",
+    description: "List a store's orders, newest first. Statuses: pending (awaiting payment), paid (seen on chain, confirming), confirmed (items granted, receipt issued), expired, refunded. A stray or duplicate payment never changes an order; it shows up as an order.mismatch / order.duplicate_payment event (iap_list_events). Store key scope: orders:read.\n\nParams: store_id, status?, wallet?, cursor?, limit?, session_token?\nReturns: {entries: Order[], nextCursor}\nErrors: NO_CREDENTIALS, IAP_PLAN_REQUIRED",
+    inputSchema: {
+        store_id: iapStoreId,
+        status: z.enum(["pending", "paid", "confirmed", "expired", "refunded", "mismatch"]).optional(),
+        wallet: z.string().optional(),
+        cursor: z.string().optional(),
+        limit: z.number().int().positive().max(200).optional(),
+        session_token: iapSessionToken,
+    },
+    annotations: { readOnlyHint: true, openWorldHint: false },
+}, async ({ store_id, status, wallet, cursor, limit, session_token }) => iapRead(`/stores/${enc(store_id)}/orders${iapQuery({ status, wallet, cursor, limit })}`, "store", session_token));
+server.registerTool("iap_create_order", {
+    title: "Create a store order",
+    description: "Create an order for a user — the white-label path: your server sells from your app's own store with a store key (scope orders:write). The order locks the price, payees and a deadline (about 20 minutes) and carries `payment`: EVM {kind:'evm', chainId, checkout, order:{orderId, token, payees, amounts, deadline}, total, permit, calls?: [{to, data, value}] to send in order, permitTypedData?} or Solana {kind:'solana', cluster, transaction (base64 unsigned), reference, staticKey, memo}. The user's wallet pays; your client then posts the tx hash to /api/v2/iap/orders/{id}/submit, and the order turns confirmed at confirmation depth (poll iap_get_order or take the iap.order.confirmed webhook).\n\nParams: store_id, sku, quantity?, wallet (the user's wallet; required with a store key), app_account_token? (your own account id, echoed in the receipt), session_token?, idempotency_key?\nReturns: {ok, idempotency_key, order: Order}\nErrors: NO_CREDENTIALS, IAP_PLAN_REQUIRED (store not live), HTTP_400, HTTP_404 (sku), HTTP_409 (sold out / per-wallet cap / rule not met), PRICE_UNAVAILABLE (a dollar-priced SKU paid in the token or the coin whose live price cannot be read reliably right now — stale, still warming up, or moving more than 15%; retry in a minute). The order carries currency (address), currencyKind ('token'|'native'|'usdc'), currencySymbol and currencyDecimals; `amount` is the exact locked amount in that currency. Paid in the chain's coin, `calls` holds only the pay call with value = total, and permit is null. A dollar-priced order also carries priceUsdMicros and usdPerToken (the dollar price of one whole unit of the currency; 1 for usdc).",
+    inputSchema: {
+        store_id: iapStoreId,
+        sku: z.string(),
+        quantity: z.number().int().positive().optional(),
+        wallet: z.string().optional().describe("User wallet that receives the items; required with a store key"),
+        app_account_token: z.string().optional().describe("Your app's account id for the user; echoed in the receipt"),
+        session_token: iapSessionToken,
+        idempotency_key: iapIdempotencyKey,
+    },
+    annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: false },
+}, async ({ store_id, sku, quantity, wallet, app_account_token, session_token, idempotency_key }) => iapWrite("order", "POST", "/orders", { storeId: store_id, sku, quantity, wallet, appAccountToken: app_account_token }, "store", session_token, idempotency_key));
+server.registerTool("iap_get_order", {
+    title: "Get a store order",
+    description: "Get one order: its locked quote, status, on-chain payment (txHash, payer, confirmations) and the signed receipt once confirmed. With store_id it reads the store's admin view (store key scope orders:read); without it, GET /api/v2/iap/orders/{id} (the buyer's own order, or any order of the store key's store) — what an app polls until status is 'confirmed'.\n\nParams: order_id (0x + 64 hex), store_id?, session_token?\nReturns: Order\nErrors: NO_CREDENTIALS, IAP_PLAN_REQUIRED, HTTP_404",
+    inputSchema: { order_id: z.string(), store_id: iapStoreId.optional(), session_token: iapSessionToken },
+    annotations: { readOnlyHint: true, openWorldHint: false },
+}, async ({ store_id, order_id, session_token }) => iapRead(store_id ? `/stores/${enc(store_id)}/orders/${enc(order_id)}` : `/orders/${enc(order_id)}`, "store", session_token));
+server.registerTool("iap_open_test_store", {
+    title: "Open a test store",
+    description: "Get or create the TEST store behind one of your live stores: same token page, a copy of its catalog at creation, and orders that are paid with iap_test_pay instead of on chain (no money, no fee). Mint its keys with iap_create_store_key on the returned store id; they start cd_iap_test_. Needs account credentials (a session or CHAINDADDY_API_KEY) with manager role on the token page. Available where test mode is on (GET /api/v2/iap/config → testMode).\n\nParams: store_id (the live store), session_token?\nReturns: {ok, store: Store} with mode 'test'\nErrors: NO_CREDENTIALS, IAP_PLAN_REQUIRED, HTTP_404 (TEST_MODE_DISABLED where test mode is off)",
+    inputSchema: { store_id: iapStoreId, session_token: iapSessionToken },
+    annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: true, openWorldHint: false },
+}, async ({ store_id, session_token }) => {
+    try {
+        const { data } = await iapRequest("POST", `/stores/${enc(store_id)}/test-store`, { body: {}, auth: "account", session_token });
+        return iapOk({ ok: true, store: data });
+    }
+    catch (error) {
+        return iapFail(error);
+    }
+});
+server.registerTool("iap_test_pay", {
+    title: "Pay a test order",
+    description: "Pay a TEST store's pending order with no chain and no money: it confirms at once through the same path a real payment takes, so the items are granted, the receipt is issued (claim livemode: false, the test store's storeId) and the iap.order.confirmed webhook goes to the test store's own webhook with livemode false. Repeating it returns the confirmed order. Use a test store key (cd_iap_test_…, scope orders:write, via CHAINDADDY_IAP_KEY) or a session that manages the store.\n\nParams: order_id (0x + 64 hex), session_token?\nReturns: {ok, order: Order} with status 'confirmed'\nErrors: NO_CREDENTIALS, HTTP_403 (scope), HTTP_404 (unknown order, or TEST_MODE_DISABLED), HTTP_409 (LIVE_ORDER: a live order is paid on chain; ORDER_EXPIRED)",
+    inputSchema: { order_id: z.string(), session_token: iapSessionToken },
+    annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: true, openWorldHint: false },
+}, async ({ order_id, session_token }) => {
+    try {
+        const { data } = await iapRequest("POST", `/orders/${enc(order_id)}/test-pay`, { body: {}, auth: "store", session_token });
+        return iapOk({ ok: true, order: data });
+    }
+    catch (error) {
+        return iapFail(error);
+    }
+});
+server.registerTool("iap_refund_order", {
+    title: "Record a refund",
+    description: "Record a refund for a confirmed order: marks it refunded, revokes its items and its receipt. Chain Daddy never holds the buyer's tokens — send the refund yourself from the payout wallet, then pass its transaction hash here.\n\nParams: store_id, order_id, refund_tx_hash?, note?, session_token?, idempotency_key?\nReturns: {ok, idempotency_key, order: Order}\nErrors: NO_CREDENTIALS, IAP_PLAN_REQUIRED, HTTP_404, HTTP_409 (not refundable in its status)",
+    inputSchema: {
+        store_id: iapStoreId,
+        order_id: z.string(),
+        refund_tx_hash: z.string().optional().describe("Your refund transfer's transaction hash / signature"),
+        note: z.string().optional(),
+        session_token: iapSessionToken,
+        idempotency_key: iapIdempotencyKey,
+    },
+    annotations: { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: false },
+}, async ({ store_id, order_id, refund_tx_hash, note, session_token, idempotency_key }) => iapWrite("order", "POST", `/stores/${enc(store_id)}/orders/${enc(order_id)}/refund`, { refundTxHash: refund_tx_hash, note }, "store", session_token, idempotency_key));
+server.registerTool("iap_get_entitlements", {
+    title: "Get item holdings",
+    description: "What a wallet holds in a store (owned items plus live unlocks), or — with sku — who owns a SKU. Pass exactly one of wallet or sku. Store key scope: entitlements:read.\n\nParams: store_id, wallet?, sku?, cursor? (owners list only), session_token?\nReturns: {storeId, wallet, entitlements: [{sku, type, name, quantity, expiresAt, source: 'ledger'|'unlock', firstGrantedAt}]} or {entries: [{wallet, quantity, expiresAt}], nextCursor}\nErrors: INVALID_PARAMS, NO_CREDENTIALS, IAP_PLAN_REQUIRED",
+    inputSchema: {
+        store_id: iapStoreId,
+        wallet: z.string().optional(),
+        sku: z.string().optional(),
+        cursor: z.string().optional(),
+        session_token: iapSessionToken,
+    },
+    annotations: { readOnlyHint: true, openWorldHint: false },
+}, async ({ store_id, wallet, sku, cursor, session_token }) => {
+    if (!wallet === !sku) {
+        return iapFail(new IapError("INVALID_PARAMS", "Pass exactly one of wallet or sku", 400));
+    }
+    return iapRead(`/stores/${enc(store_id)}/entitlements${iapQuery(wallet ? { wallet } : { sku, cursor })}`, "store", session_token);
+});
+server.registerTool("iap_grant", {
+    title: "Grant items",
+    description: "Grant items to a wallet (a reward, a make-good, a server-side award). Items are off-chain and non-transferable. Store key scope: entitlements:write.\n\nParams: store_id, wallet, sku, quantity, reason?, session_token?, idempotency_key?\nReturns: {ok, idempotency_key, entitlement: Entitlement}\nErrors: NO_CREDENTIALS, IAP_PLAN_REQUIRED, HTTP_400, HTTP_404 (unknown sku)",
+    inputSchema: {
+        store_id: iapStoreId,
+        wallet: z.string(),
+        sku: z.string(),
+        quantity: z.number().int().positive(),
+        reason: z.string().optional(),
+        session_token: iapSessionToken,
+        idempotency_key: iapIdempotencyKey,
+    },
+    annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: false },
+}, async ({ store_id, wallet, sku, quantity, reason, session_token, idempotency_key }) => iapWrite("entitlement", "POST", `/stores/${enc(store_id)}/grants`, { wallet, sku, quantity, reason }, "store", session_token, idempotency_key));
+server.registerTool("iap_consume", {
+    title: "Consume items",
+    description: "Consume units of a consumable a wallet holds (the user spent a credit). Atomic: fails without change when the wallet holds fewer. Store key scope: entitlements:write.\n\nParams: store_id, wallet, sku, quantity, session_token?, idempotency_key?\nReturns: {ok, idempotency_key, entitlement: Entitlement}\nErrors: INSUFFICIENT_QUANTITY (409), NO_CREDENTIALS, IAP_PLAN_REQUIRED, HTTP_404",
+    inputSchema: {
+        store_id: iapStoreId,
+        wallet: z.string(),
+        sku: z.string(),
+        quantity: z.number().int().positive(),
+        session_token: iapSessionToken,
+        idempotency_key: iapIdempotencyKey,
+    },
+    annotations: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: false },
+}, async ({ store_id, wallet, sku, quantity, session_token, idempotency_key }) => iapWrite("entitlement", "POST", `/stores/${enc(store_id)}/consume`, { wallet, sku, quantity }, "store", session_token, idempotency_key));
+server.registerTool("iap_revoke", {
+    title: "Revoke items",
+    description: "Take items back from a wallet. Omit quantity to revoke all of that SKU. Store key scope: entitlements:write.\n\nParams: store_id, wallet, sku, quantity?, reason?, session_token?, idempotency_key?\nReturns: {ok, idempotency_key, entitlement: Entitlement}\nErrors: NO_CREDENTIALS, IAP_PLAN_REQUIRED, HTTP_404",
+    inputSchema: {
+        store_id: iapStoreId,
+        wallet: z.string(),
+        sku: z.string(),
+        quantity: z.number().int().positive().optional(),
+        reason: z.string().optional(),
+        session_token: iapSessionToken,
+        idempotency_key: iapIdempotencyKey,
+    },
+    annotations: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: false },
+}, async ({ store_id, wallet, sku, quantity, reason, session_token, idempotency_key }) => iapWrite("entitlement", "POST", `/stores/${enc(store_id)}/revoke`, { wallet, sku, quantity, reason }, "store", session_token, idempotency_key));
+server.registerTool("iap_create_drop", {
+    title: "Create a drop",
+    description: "Create a drop (a reward of items). Modes: claim (a link holders claim from), push (delivered to a recipient list when activated), award (your server awards it with iap_award, caps enforced). Audience is a rule (e.g. holders of at least X tokens). Drops start as drafts; activate with iap_set_drop_status. Store key scope: drops:write.\n\nParams: store_id, drop ({name, mode, items: [{sku, quantity}], audience?, allowlistOnly?, maxClaims?, perWalletLimit?, startsAt?, endsAt?, description?, imageUrl?}), session_token?, idempotency_key?\nReturns: {ok, idempotency_key, drop: Drop} (drop.slug is the claim link id)\nErrors: NO_CREDENTIALS, IAP_PLAN_REQUIRED, HTTP_400",
+    inputSchema: { store_id: iapStoreId, drop: iapDropInput, session_token: iapSessionToken, idempotency_key: iapIdempotencyKey },
+    annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: false },
+}, async ({ store_id, drop, session_token, idempotency_key }) => iapWrite("drop", "POST", `/stores/${enc(store_id)}/drops`, drop, "store", session_token, idempotency_key));
+server.registerTool("iap_set_drop_status", {
+    title: "Set drop status",
+    description: "Set a drop's status. Activating a push drop starts delivery to its recipients.\n\nParams: store_id, drop_id, status ('draft'|'active'|'paused'|'ended'), session_token?, idempotency_key?\nReturns: {ok, idempotency_key, drop: Drop}\nErrors: NO_CREDENTIALS, IAP_PLAN_REQUIRED, HTTP_404, HTTP_409",
+    inputSchema: {
+        store_id: iapStoreId,
+        drop_id: z.string(),
+        status: z.enum(["draft", "active", "paused", "ended"]),
+        session_token: iapSessionToken,
+        idempotency_key: iapIdempotencyKey,
+    },
+    annotations: { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: false },
+}, async ({ store_id, drop_id, status, session_token, idempotency_key }) => iapWrite("drop", "POST", `/stores/${enc(store_id)}/drops/${enc(drop_id)}/status`, { status }, "store", session_token, idempotency_key));
+server.registerTool("iap_add_drop_recipients", {
+    title: "Add drop recipients",
+    description: "Add wallets to a drop's recipient list (push drops, or an allowlist). Pass wallets, or csv text with one wallet per line.\n\nParams: store_id, drop_id, wallets?, csv?, session_token?, idempotency_key?\nReturns: {ok, idempotency_key, added: number, invalid: string[]}\nErrors: INVALID_PARAMS, NO_CREDENTIALS, IAP_PLAN_REQUIRED, HTTP_404",
+    inputSchema: {
+        store_id: iapStoreId,
+        drop_id: z.string(),
+        wallets: z.array(z.string()).optional(),
+        csv: z.string().optional(),
+        session_token: iapSessionToken,
+        idempotency_key: iapIdempotencyKey,
+    },
+    annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: false },
+}, async ({ store_id, drop_id, wallets, csv, session_token, idempotency_key }) => {
+    if (!wallets?.length && !csv) {
+        return iapFail(new IapError("INVALID_PARAMS", "Pass wallets or csv", 400));
+    }
+    return iapWrite(null, "POST", `/stores/${enc(store_id)}/drops/${enc(drop_id)}/recipients`, wallets?.length ? { wallets } : { csv }, "store", session_token, idempotency_key);
+});
+server.registerTool("iap_award", {
+    title: "Award a drop",
+    description: "Award an award-mode drop to a wallet (the user reached a milestone). The drop's caps and window are enforced. Store key scope: rewards:award.\n\nParams: store_id, drop_id, wallet, session_token?, idempotency_key? (use one per milestone so a retry never awards twice)\nReturns: {ok, idempotency_key, …award result}\nErrors: NO_CREDENTIALS, IAP_PLAN_REQUIRED, HTTP_404, HTTP_409 (cap reached / drop not active)",
+    inputSchema: {
+        store_id: iapStoreId,
+        drop_id: z.string(),
+        wallet: z.string(),
+        session_token: iapSessionToken,
+        idempotency_key: iapIdempotencyKey,
+    },
+    annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: false },
+}, async ({ store_id, drop_id, wallet, session_token, idempotency_key }) => iapWrite(null, "POST", `/stores/${enc(store_id)}/drops/${enc(drop_id)}/award`, { wallet }, "store", session_token, idempotency_key));
+server.registerTool("iap_create_store_key", {
+    title: "Create a store key",
+    description: "Create a store key (cd_iap_…) for your server: one store, only the scopes you list. The secret is returned ONCE — store it in the server's secrets, never in a client. Needs account credentials (a session or CHAINDADDY_API_KEY), never a store key.\n\nParams: store_id, name, scopes (catalog:write|orders:read|orders:write|entitlements:read|entitlements:write|drops:write|rewards:award|events:read|messages:send), session_token?, idempotency_key?\nReturns: {ok, idempotency_key, key: {id, name, prefix, scopes, createdAt, secret}}\nErrors: NO_CREDENTIALS, IAP_PLAN_REQUIRED, HTTP_400",
+    inputSchema: {
+        store_id: iapStoreId,
+        name: z.string().describe("A label, e.g. 'server-prod'"),
+        scopes: z.array(iapScopes).min(1),
+        session_token: iapSessionToken,
+        idempotency_key: iapIdempotencyKey,
+    },
+    annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: false },
+}, async ({ store_id, name, scopes, session_token, idempotency_key }) => iapWrite("key", "POST", `/stores/${enc(store_id)}/keys`, { name, scopes }, "account", session_token, idempotency_key));
+server.registerTool("iap_list_events", {
+    title: "List store events",
+    description: "Read a store's event feed after a cursor: order.created/paid/confirmed/expired/refunded, order.mismatch (a payment named the order id but not its quote; the order is unchanged), order.duplicate_payment (the order was paid twice; the creator refunds the second), order.reverted (a paid order undone by a chain reorg), entitlement.granted/consumed/revoked, entitlement.expiring (a timed item is about to run out) / entitlement.expired, drop.claimed/awarded, drop.exhausted (a drop gave out its last item), sku.sold_out (an item reached its max supply), store.not_live (the store stopped selling because its plan lapsed) / store.live (selling again). Keep `last` and pass it as `after` next time; the same events arrive as iap.<type> webhooks, and this feed is how you catch up on any you missed. Store key scope: events:read.\n\nParams: store_id, after? (event id), limit?, session_token?\nReturns: {entries: [{id, type, wallet, orderId, payload, createdAt}], last}\nErrors: NO_CREDENTIALS, IAP_PLAN_REQUIRED",
+    inputSchema: {
+        store_id: iapStoreId,
+        after: z.number().int().nonnegative().optional(),
+        limit: z.number().int().positive().max(500).optional(),
+        session_token: iapSessionToken,
+    },
+    annotations: { readOnlyHint: true, openWorldHint: false },
+}, async ({ store_id, after, limit, session_token }) => iapRead(`/stores/${enc(store_id)}/events${iapQuery({ after, limit })}`, "store", session_token));
+server.registerTool("iap_set_webhook", {
+    title: "Set store webhook",
+    description: "Create or replace the store's webhook: one HTTPS endpoint that receives the store's events as they happen. Each delivery is POST {id, type, created_at, data} with header X-Webhook-Signature = hex HMAC-SHA256 of the raw body keyed with the webhook's whsec_ secret. Creating returns the secret ONCE — store it where the endpoint verifies signatures. Replacing keeps the secret (no secret in the result) and turns back on a webhook that was disabled after repeated failures. Needs account credentials (a session or CHAINDADDY_API_KEY), never a store key.\n\nParams: store_id, url (https://…), events? (subset of iap.order.created|paid|confirmed|expired|reverted|refunded|mismatch|duplicate_payment, iap.entitlement.granted|consumed|revoked|expiring|expired, iap.drop.claimed|awarded|exhausted, iap.sku.sold_out, iap.store.not_live|live; omit for all), session_token?\nReturns: {ok, webhook: {id, url, events, active, createdAt, lastTriggeredAt, secret?}} (secret only when created)\nErrors: NO_CREDENTIALS, IAP_PLAN_REQUIRED, SESSION_REQUIRED (a store key), HTTP_400 (bad url or event), HTTP_404",
+    inputSchema: {
+        store_id: iapStoreId,
+        url: z.string().startsWith("https://").describe("Your endpoint, https://…"),
+        events: z.array(iapWebhookEvents).min(1).optional().describe("Only these events; omit for all"),
+        session_token: iapSessionToken,
+    },
+    annotations: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: true },
+}, async ({ store_id, url, events, session_token }) => iapWrite("webhook", "PUT", `/stores/${enc(store_id)}/webhook`, events ? { url, events } : { url }, "account", session_token));
+server.registerTool("iap_get_webhook", {
+    title: "Get store webhook",
+    description: "Get the store's webhook and its last 20 deliveries, newest first. A delivery's status is pending, delivered, failed or exhausted (no more retries); anything missed can be caught up from iap_list_events. Store key scope: events:read.\n\nParams: store_id, session_token?\nReturns: {webhook: {id, url, events, active, createdAt, lastTriggeredAt} | null, deliveries: [{id, eventId, eventType, status, attempt, statusCode, error, createdAt, deliveredAt}]}\nErrors: NO_CREDENTIALS, IAP_PLAN_REQUIRED, HTTP_404",
+    inputSchema: { store_id: iapStoreId, session_token: iapSessionToken },
+    annotations: { readOnlyHint: true, openWorldHint: false },
+}, async ({ store_id, session_token }) => iapRead(`/stores/${enc(store_id)}/webhook`, "store", session_token));
+server.registerTool("iap_test_webhook", {
+    title: "Send a test webhook",
+    description: "Queue an iap.test event to the store's webhook, to check the endpoint receives and verifies deliveries. See the result with iap_get_webhook. Store key scope: events:read.\n\nParams: store_id, session_token?, idempotency_key?\nReturns: {ok, idempotency_key, queued: true, event: {id, type: 'iap.test', createdAt, data}}\nErrors: NO_CREDENTIALS, IAP_PLAN_REQUIRED, NOT_FOUND (no webhook set)",
+    inputSchema: { store_id: iapStoreId, session_token: iapSessionToken, idempotency_key: iapIdempotencyKey },
+    annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: true },
+}, async ({ store_id, session_token, idempotency_key }) => iapWrite(null, "POST", `/stores/${enc(store_id)}/webhook/test`, undefined, "store", session_token, idempotency_key));
+// ============================================================================
+// RESOURCES
+// ============================================================================
+server.resource("chaindaddy://config", "Current Chain Daddy MCP configuration", async () => ({
+    contents: [{
+            uri: "chaindaddy://config",
+            mimeType: "application/json",
+            text: JSON.stringify({
+                apiUrl: API_URL,
+                network: NETWORK,
+                version: VERSION,
+            }, null, 2),
+        }],
+}));
+server.resource("chaindaddy://chains", "List of all blockchain networks supported by Chain Daddy", async () => ({
+    contents: [{
+            uri: "chaindaddy://chains",
+            mimeType: "application/json",
+            text: JSON.stringify(SUPPORTED_CHAINS, null, 2),
+        }],
+}));
+server.resource("chaindaddy://tools", "How the tools fit together: sign-in, crown lookup and the creator store flows", async () => ({
+    contents: [{
+            uri: "chaindaddy://tools",
+            mimeType: "application/json",
+            text: JSON.stringify({
+                // The tool catalog is tools/list, which clients already read; a second
+                // hand-kept copy here drifted from it, so this resource carries only the
+                // flows that tie the tools together.
+                tools: "Call tools/list: every tool has a title, a description and readOnlyHint/destructiveHint annotations",
+                usage: {
+                    crown_lookup: "Use search_symbol with symbol and chain to find crown details",
+                    heartbeat_check: "Use check_heartbeat with crown_id to monitor activity score",
+                    profile_update: "Use update_profile with wallet signature to modify metadata",
+                    creator_store_auth: "Set CHAINDADDY_API_KEY (cd_live_) for account calls, CHAINDADDY_IAP_KEY (cd_iap_) for your server's store-scoped calls, or pass session_token. Needs a Developer plan or Developer Beta membership (else 403 IAP_PLAN_REQUIRED)",
+                    creator_store_setup: "iap_open_store → iap_create_sku (status 'active') → iap_create_store_key for your server",
+                    creator_store_sale: "iap_create_order (wallet = the user) → user pays payment.calls or the permit → POST /api/v2/iap/orders/{id}/submit → iap_get_order until 'confirmed' → verify the receipt → iap_get_entitlements / iap_consume",
+                    creator_store_writes: "Every write returns idempotency_key; retry with the same key and it never applies twice",
+                    creator_store_events: "Keep `last` from iap_list_events and pass it as `after`; webhooks arrive as iap.<type>",
+                    creator_store_test_mode: "iap_open_test_store → iap_create_store_key on the test store (cd_iap_test_…) → iap_create_order → iap_test_pay → iap_get_entitlements / iap_consume; receipts and webhooks carry livemode: false. Go live by switching to the live store's key and id",
+                    creator_store_webhooks: "iap_set_webhook (store the returned secret) → iap_test_webhook → iap_get_webhook for delivery status; verify X-Webhook-Signature = hex HMAC-SHA256(raw body, secret)",
+                },
+            }, null, 2),
+        }],
+}));
+// ============================================================================
+// START SERVER
+// ============================================================================
+async function main() {
+    const transport = new StdioServerTransport();
+    await server.connect(transport);
+    console.error("Chain Daddy MCP server running on stdio");
+}
+main().catch((error) => {
+    console.error("Failed to start server:", error);
+    process.exit(1);
+});
+//# sourceMappingURL=index.js.map