@chaindaddy/mcp 0.6.5 → 0.6.7

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@chaindaddy/mcp",
-  "version": "0.6.5",
+  "version": "0.6.7",
   "description": "MCP server for Chain Daddy: search tickers, launch a token or verify ownership of one, and run its creator store",
   "mcpName": "io.chaindaddy/mcp",
   "homepage": "https://docs.chaindaddy.io/developer/store-and-rewards#tools-for-agents",

package/skills/sign-in-with-chain-daddy/SKILL.md

@@ -27,7 +27,7 @@ Use discovery: `https://api.chaindaddy.io/.well-known/openid-configuration`
 
 Any site can sign people in without registering anything.
 
-Replace `YOUR_SITE` with the site's https origin. Nothing is registered with Chain Daddy.
+Replace `YOUR_SITE` with the site's https origin. Nothing is registered with Chain Daddy. The origin must be public, even while you build (a tunnel or a preview deployment): Chain Daddy's server fetches `client.json`, so `localhost` cannot be a client id.
 
 1. Host this at `https://YOUR_SITE/client.json` (served 200, no redirect; `client_id` must equal its own URL):
 
@@ -47,11 +47,17 @@ Replace `YOUR_SITE` with the site's https origin. Nothing is registered with Cha
 <cd-signin-button client-id="https://YOUR_SITE/client.json"
                   redirect-uri="https://YOUR_SITE/callback.html"
                   scope="openid wallets"></cd-signin-button>
+<p id="signin-error" role="alert"></p>
 <script>
   document.querySelector('cd-signin-button').addEventListener('cd-signin', async (e) => {
     const { id_token } = await ChainDaddy.exchangeCode(e.detail);
-    await fetch('/session', { method: 'POST', headers: { 'Content-Type': 'application/json' },
+    const res = await fetch('/session', { method: 'POST', headers: { 'Content-Type': 'application/json' },
       body: JSON.stringify({ id_token }) });
+    if (!res.ok) {
+      const { message } = await res.json().catch(() => ({}));
+      document.querySelector('#signin-error').textContent = message || 'Sign-in did not work. Try again.';
+      return;
+    }
     location.reload();
   });
 </script>
@@ -61,20 +67,28 @@ Replace `YOUR_SITE` with the site's https origin. Nothing is registered with Cha
 
 ```html
 <script src="https://js.chaindaddy.io/v1/cd.js"></script>
+<p id="signin-error" role="alert"></p>
 <script>
   ChainDaddy.handleCallback().then(async (result) => {
     if (!result) return; // popup: handed back and closed
     const { id_token } = await ChainDaddy.exchangeCode(result); // popup blocked: finish here
-    await fetch('/session', { method: 'POST', headers: { 'Content-Type': 'application/json' },
+    const res = await fetch('/session', { method: 'POST', headers: { 'Content-Type': 'application/json' },
       body: JSON.stringify({ id_token }) });
+    if (!res.ok) {
+      const { message } = await res.json().catch(() => ({}));
+      document.querySelector('#signin-error').textContent = message || 'Sign-in did not work. Try again.';
+      return;
+    }
     location.replace('/');
   });
 </script>
 ```
 
-4. On the server, behind `POST /session` (never trust the token in the browser):
+4. On the server, an Express app (`npm install express jose`): verify the ID token, then start your own session (never trust the token in the browser). `POST /session` answers a refusal with a status and a `message`, which both pages show:
 
 ```ts
+import express from 'express';
+import { randomUUID } from 'node:crypto';
 import { createRemoteJWKSet, jwtVerify } from 'jose';
 const JWKS = createRemoteJWKSet(new URL('https://api.chaindaddy.io/api/v2/oauth/jwks'));
 // ID tokens already accepted, until they expire. A real deployment keeps these in its session store or Redis.
@@ -91,6 +105,36 @@ export async function verifyChainDaddy(idToken: string) {
   seen.set(payload.jti, payload.exp ?? now + 300);
   return payload; // sub: the person's id at this site; wallets[0]: the wallet they signed in with
 }
+
+// Your own sessions, by the id in the cookie. A real deployment keeps these in its session store or Redis.
+const sessions = new Map<string, { sub: string; wallet?: string }>();
+const sessionOf = (req: express.Request) =>
+  sessions.get(/(?:^|; )session=([^;]+)/.exec(req.headers.cookie ?? '')?.[1] ?? '');
+
+const app = express();
+app.use(express.json());
+
+app.post('/session', async (req, res) => {
+  let payload;
+  try {
+    payload = await verifyChainDaddy(req.body.id_token);
+  } catch {
+    return res.status(401).json({ error: 'sign_in_failed', message: 'That sign-in could not be checked. Sign in again.' });
+  }
+  const id = randomUUID();
+  sessions.set(id, { sub: payload.sub as string, wallet: (payload.wallets as string[] | undefined)?.[0] });
+  res.cookie('session', id, { httpOnly: true, secure: true, sameSite: 'lax' });
+  res.json({ ok: true });
+});
+
+// Only a signed-in visitor gets this.
+app.get('/members', (req, res) => {
+  const user = sessionOf(req);
+  if (!user) return res.status(401).json({ error: 'signed_out', message: 'Sign in first.' });
+  res.json({ sub: user.sub, wallet: user.wallet });
+});
+
+app.listen(3000);
 ```
 
 To require a coin, add `"chaindaddy_claims": {"id_token":{"holdings":{"tokens":[{"chain":"base","address":"0xTOKEN","min":"100"}]}}}` to `client.json`. Chain Daddy then answers that request and no other, and refuses a sign-in that asks for anything else; the button needs no `claims`. The server still never reads `payload.holdings[0].held`: it matches each answer against its own constants first.
@@ -106,6 +150,20 @@ export function holdsCoin(payload: Record<string, unknown>) {
 }
 ```
 
+In `POST /session`, refuse right after `verifyChainDaddy`, so no session is made and the page shows the `message`:
+
+```ts
+  if (!holdsCoin(payload)) {
+    // held is null when the balance could not be read: not a no, so ask them to sign in again.
+    const unread = Array.isArray(payload.holdings) && payload.holdings.some((h) => h?.held === null);
+    return unread
+      ? res.status(503).json({ error: 'balance_unreadable', message: 'We could not read your balance just now. Sign in again in a moment.' })
+      : res.status(403).json({ error: 'not_a_holder', message: 'This page is for holders of the coin.' });
+  }
+```
+
+The token address is `tokenAddress` in `GET https://api.chaindaddy.io/api/v2/public/coins/{chain}/{symbol}` (keyless; e.g. `/api/v2/public/coins/base/FLUXGP`). `holdsCoin` reads only the payload, so test it without a wallet: call it with `{ holdings: [{ chain, token, min, held }] }`. `held: true` must pass; `held: false`, another token's `held: true` and `held: null` must not.
+
 `held` is `null` when the balance could not be read: ask again, never treat it as yes. `{"id_token":{"crowns":{"all":true}}}` lists the crowns they hold.
 
 ## 1b. Or register a client (the human does this)
@@ -136,24 +194,27 @@ With a registered client, or with your `client.json` URL as a public client id.
 ```ts
 import * as client from 'openid-client';
 
+// A client.json site: a public client. No secret; PKCE is the proof.
 const config = await client.discovery(
-  new URL('https://api.chaindaddy.io'), process.env.CD_CLIENT_ID!,
+  new URL('https://api.chaindaddy.io'), 'https://YOUR_SITE/client.json',
   { id_token_signed_response_alg: 'ES256' },
-  client.ClientSecretPost(process.env.CD_CLIENT_SECRET!), // client.None() for a public client
+  client.None(),
 );
+// A registered client with a secret, instead: pass its cdc_… id and
+// client.ClientSecretPost(process.env.CD_CLIENT_SECRET!) in place of client.None().
 
 // Sign-in: keep verifier, state and nonce in the visitor's session
 const verifier = client.randomPKCECodeVerifier();
 const state = client.randomState();
 const nonce = client.randomNonce();
 const url = client.buildAuthorizationUrl(config, {
-  redirect_uri: 'https://example.com/auth/callback', scope: 'openid wallets',
+  redirect_uri: 'https://YOUR_SITE/auth/callback', scope: 'openid wallets',
   code_challenge: await client.calculatePKCECodeChallenge(verifier), code_challenge_method: 'S256',
   state, nonce,
 });
 
 // Callback
-const tokens = await client.authorizationCodeGrant(config, new URL(req.url, 'https://example.com'), {
+const tokens = await client.authorizationCodeGrant(config, new URL(req.url, 'https://YOUR_SITE'), {
   pkceCodeVerifier: verifier, expectedState: state, expectedNonce: nonce,
 });
 const claims = tokens.claims()!;
@@ -163,8 +224,12 @@ const wallet = (claims.wallets as string[])[0]; // the wallet they signed in wit
 ```
 
 Auth.js: a provider with `type: 'oidc'`, `issuer: 'https://api.chaindaddy.io'`,
-`checks: ['pkce', 'state', 'nonce']`, `client: { id_token_signed_response_alg: 'ES256' }`, and a `profile()`
-that throws unless `typ === 'signin+v1'`.
+`checks: ['pkce', 'state', 'nonce']`, and a `profile()` that throws unless `typ === 'signin+v1'`. For a
+`client.json` site (a public client): `clientId` is the `client.json` URL, no `clientSecret`, and
+`client: { token_endpoint_auth_method: 'none', id_token_signed_response_alg: 'ES256' }`; without `none` Auth.js
+sends client authentication anyway and the token call answers `401 invalid_client`. List Auth.js's own callback
+(`https://YOUR_SITE/api/auth/callback/chaindaddy` in Next.js) in `redirect_uris`. For a registered client with a
+secret: its `cdc_…` id, `clientSecret`, and `client: { id_token_signed_response_alg: 'ES256' }`.
 
 ## Scopes and claims