@chaindaddy/mcp 0.6.3 → 0.6.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@chaindaddy/mcp",
-  "version": "0.6.3",
+  "version": "0.6.4",
   "description": "MCP server for Chain Daddy: search tickers, launch a token or verify ownership of one, and run its creator store",
   "mcpName": "io.chaindaddy/mcp",
   "homepage": "https://docs.chaindaddy.io/developer/store-and-rewards#tools-for-agents",

package/skills/sign-in-with-chain-daddy/SKILL.md

@@ -51,7 +51,7 @@ Replace `YOUR_SITE` with the site's https origin. Nothing is registered with Cha
   document.querySelector('cd-signin-button').addEventListener('cd-signin', async (e) => {
     const { id_token } = await ChainDaddy.exchangeCode(e.detail);
     await fetch('/session', { method: 'POST', headers: { 'Content-Type': 'application/json' },
-      body: JSON.stringify({ id_token, nonce: e.detail.nonce }) });
+      body: JSON.stringify({ id_token }) });
     location.reload();
   });
 </script>
@@ -66,7 +66,7 @@ Replace `YOUR_SITE` with the site's https origin. Nothing is registered with Cha
     if (!result) return; // popup: handed back and closed
     const { id_token } = await ChainDaddy.exchangeCode(result); // popup blocked: finish here
     await fetch('/session', { method: 'POST', headers: { 'Content-Type': 'application/json' },
-      body: JSON.stringify({ id_token, nonce: result.nonce }) });
+      body: JSON.stringify({ id_token }) });
     location.replace('/');
   });
 </script>
@@ -77,18 +77,36 @@ Replace `YOUR_SITE` with the site's https origin. Nothing is registered with Cha
 ```ts
 import { createRemoteJWKSet, jwtVerify } from 'jose';
 const JWKS = createRemoteJWKSet(new URL('https://api.chaindaddy.io/api/v2/oauth/jwks'));
+// ID tokens already accepted, until they expire. A real deployment keeps these in its session store or Redis.
+const seen = new Map<string, number>();
 
-export async function verifyChainDaddy(idToken: string, nonce: string) {
+export async function verifyChainDaddy(idToken: string) {
   const { payload } = await jwtVerify(idToken, JWKS, {
     issuer: 'https://api.chaindaddy.io', audience: 'https://YOUR_SITE/client.json', algorithms: ['ES256'],
   });
   if (payload.typ !== 'signin+v1') throw new Error('not a Chain Daddy sign-in');
-  if (payload.nonce !== nonce) throw new Error('replayed sign-in');
+  const now = Date.now() / 1000;
+  seen.forEach((exp, jti) => { if (exp < now) seen.delete(jti); });
+  if (!payload.jti || seen.has(payload.jti)) throw new Error('replayed sign-in');
+  seen.set(payload.jti, payload.exp ?? now + 300);
   return payload; // sub: the person's id at this site; wallets[0]: the wallet they signed in with
 }
 ```
 
-To require a coin, add `claims='{"id_token":{"holdings":{"tokens":[{"chain":"base","address":"0xTOKEN","min":"100"}]}}}'` to the button and check `payload.holdings[0].held === true` on the server (`null` means the balance could not be read: ask again, never treat it as yes). `{"id_token":{"crowns":{"all":true}}}` lists the crowns they hold.
+To require a coin, add `claims='{"id_token":{"holdings":{"tokens":[{"chain":"base","address":"0xTOKEN","min":"100"}]}}}'` to the button. That request passes through the visitor's browser, which can change the coin or the minimum, and the ID token answers whatever was asked. So the server never reads `payload.holdings[0].held`: it matches each answer against its own constants first.
+
+```ts
+// What this site gates on, as the ID token writes it: token lowercase for an EVM address, min "0" if none was asked.
+const GATE = [{ chain: 'base', token: '0xtoken', min: '100' }];
+
+export function holdsCoin(payload: Record<string, unknown>) {
+  const holdings = Array.isArray(payload.holdings) ? payload.holdings : [];
+  return GATE.some((want) => holdings.some((h) =>
+    h?.chain === want.chain && h?.token === want.token && h?.min === want.min && h?.held === true));
+}
+```
+
+`held` is `null` when the balance could not be read: ask again, never treat it as yes. `{"id_token":{"crowns":{"all":true}}}` lists the crowns they hold.
 
 ## 1b. Or register a client (the human does this)
 
@@ -157,9 +175,11 @@ that throws unless `typ === 'signin+v1'`.
 | `profile` | `identity`: the handle they chose to publish |
 
 With the `claims` request (section 1): `holdings` (`held` true, false, or `null` when unreadable) and `crowns`.
+Match a `holdings` entry against your own coin and minimum before reading `held` (section 1).
 
 Check on every ID token: signature (ES256, keys above), `iss` = `https://api.chaindaddy.io`, `aud` = your
-client id, `typ` = `signin+v1`, `nonce` = the one you sent, `exp` (5 minutes).
+client id, `typ` = `signin+v1`, `exp` (5 minutes), and `nonce` = the one your server sent. With the button the
+browser makes the nonce, so comparing it proves nothing: refuse a `jti` you have already accepted (section 1).
 
 ## After sign-in