@chaindaddy/mcp 0.6.5 → 0.6.6

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@chaindaddy/mcp",
-  "version": "0.6.5",
+  "version": "0.6.6",
   "description": "MCP server for Chain Daddy: search tickers, launch a token or verify ownership of one, and run its creator store",
   "mcpName": "io.chaindaddy/mcp",
   "homepage": "https://docs.chaindaddy.io/developer/store-and-rewards#tools-for-agents",

package/skills/sign-in-with-chain-daddy/SKILL.md

@@ -27,7 +27,7 @@ Use discovery: `https://api.chaindaddy.io/.well-known/openid-configuration`
 
 Any site can sign people in without registering anything.
 
-Replace `YOUR_SITE` with the site's https origin. Nothing is registered with Chain Daddy.
+Replace `YOUR_SITE` with the site's https origin. Nothing is registered with Chain Daddy. The origin must be public, even while you build (a tunnel or a preview deployment): Chain Daddy's server fetches `client.json`, so `localhost` cannot be a client id.
 
 1. Host this at `https://YOUR_SITE/client.json` (served 200, no redirect; `client_id` must equal its own URL):
 
@@ -136,24 +136,27 @@ With a registered client, or with your `client.json` URL as a public client id.
 ```ts
 import * as client from 'openid-client';
 
+// A client.json site: a public client. No secret; PKCE is the proof.
 const config = await client.discovery(
-  new URL('https://api.chaindaddy.io'), process.env.CD_CLIENT_ID!,
+  new URL('https://api.chaindaddy.io'), 'https://YOUR_SITE/client.json',
   { id_token_signed_response_alg: 'ES256' },
-  client.ClientSecretPost(process.env.CD_CLIENT_SECRET!), // client.None() for a public client
+  client.None(),
 );
+// A registered client with a secret, instead: pass its cdc_… id and
+// client.ClientSecretPost(process.env.CD_CLIENT_SECRET!) in place of client.None().
 
 // Sign-in: keep verifier, state and nonce in the visitor's session
 const verifier = client.randomPKCECodeVerifier();
 const state = client.randomState();
 const nonce = client.randomNonce();
 const url = client.buildAuthorizationUrl(config, {
-  redirect_uri: 'https://example.com/auth/callback', scope: 'openid wallets',
+  redirect_uri: 'https://YOUR_SITE/auth/callback', scope: 'openid wallets',
   code_challenge: await client.calculatePKCECodeChallenge(verifier), code_challenge_method: 'S256',
   state, nonce,
 });
 
 // Callback
-const tokens = await client.authorizationCodeGrant(config, new URL(req.url, 'https://example.com'), {
+const tokens = await client.authorizationCodeGrant(config, new URL(req.url, 'https://YOUR_SITE'), {
   pkceCodeVerifier: verifier, expectedState: state, expectedNonce: nonce,
 });
 const claims = tokens.claims()!;
@@ -163,8 +166,12 @@ const wallet = (claims.wallets as string[])[0]; // the wallet they signed in wit
 ```
 
 Auth.js: a provider with `type: 'oidc'`, `issuer: 'https://api.chaindaddy.io'`,
-`checks: ['pkce', 'state', 'nonce']`, `client: { id_token_signed_response_alg: 'ES256' }`, and a `profile()`
-that throws unless `typ === 'signin+v1'`.
+`checks: ['pkce', 'state', 'nonce']`, and a `profile()` that throws unless `typ === 'signin+v1'`. For a
+`client.json` site (a public client): `clientId` is the `client.json` URL, no `clientSecret`, and
+`client: { token_endpoint_auth_method: 'none', id_token_signed_response_alg: 'ES256' }`; without `none` Auth.js
+sends client authentication anyway and the token call answers `401 invalid_client`. List Auth.js's own callback
+(`https://YOUR_SITE/api/auth/callback/chaindaddy` in Next.js) in `redirect_uris`. For a registered client with a
+secret: its `cdc_…` id, `clientSecret`, and `client: { id_token_signed_response_alg: 'ES256' }`.
 
 ## Scopes and claims