@chaindaddy/mcp 0.6.6 → 0.6.7

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@chaindaddy/mcp",
-  "version": "0.6.6",
+  "version": "0.6.7",
   "description": "MCP server for Chain Daddy: search tickers, launch a token or verify ownership of one, and run its creator store",
   "mcpName": "io.chaindaddy/mcp",
   "homepage": "https://docs.chaindaddy.io/developer/store-and-rewards#tools-for-agents",

package/skills/sign-in-with-chain-daddy/SKILL.md

@@ -47,11 +47,17 @@ Replace `YOUR_SITE` with the site's https origin. Nothing is registered with Cha
 <cd-signin-button client-id="https://YOUR_SITE/client.json"
                   redirect-uri="https://YOUR_SITE/callback.html"
                   scope="openid wallets"></cd-signin-button>
+<p id="signin-error" role="alert"></p>
 <script>
   document.querySelector('cd-signin-button').addEventListener('cd-signin', async (e) => {
     const { id_token } = await ChainDaddy.exchangeCode(e.detail);
-    await fetch('/session', { method: 'POST', headers: { 'Content-Type': 'application/json' },
+    const res = await fetch('/session', { method: 'POST', headers: { 'Content-Type': 'application/json' },
       body: JSON.stringify({ id_token }) });
+    if (!res.ok) {
+      const { message } = await res.json().catch(() => ({}));
+      document.querySelector('#signin-error').textContent = message || 'Sign-in did not work. Try again.';
+      return;
+    }
     location.reload();
   });
 </script>
@@ -61,20 +67,28 @@ Replace `YOUR_SITE` with the site's https origin. Nothing is registered with Cha
 
 ```html
 <script src="https://js.chaindaddy.io/v1/cd.js"></script>
+<p id="signin-error" role="alert"></p>
 <script>
   ChainDaddy.handleCallback().then(async (result) => {
     if (!result) return; // popup: handed back and closed
     const { id_token } = await ChainDaddy.exchangeCode(result); // popup blocked: finish here
-    await fetch('/session', { method: 'POST', headers: { 'Content-Type': 'application/json' },
+    const res = await fetch('/session', { method: 'POST', headers: { 'Content-Type': 'application/json' },
       body: JSON.stringify({ id_token }) });
+    if (!res.ok) {
+      const { message } = await res.json().catch(() => ({}));
+      document.querySelector('#signin-error').textContent = message || 'Sign-in did not work. Try again.';
+      return;
+    }
     location.replace('/');
   });
 </script>
 ```
 
-4. On the server, behind `POST /session` (never trust the token in the browser):
+4. On the server, an Express app (`npm install express jose`): verify the ID token, then start your own session (never trust the token in the browser). `POST /session` answers a refusal with a status and a `message`, which both pages show:
 
 ```ts
+import express from 'express';
+import { randomUUID } from 'node:crypto';
 import { createRemoteJWKSet, jwtVerify } from 'jose';
 const JWKS = createRemoteJWKSet(new URL('https://api.chaindaddy.io/api/v2/oauth/jwks'));
 // ID tokens already accepted, until they expire. A real deployment keeps these in its session store or Redis.
@@ -91,6 +105,36 @@ export async function verifyChainDaddy(idToken: string) {
   seen.set(payload.jti, payload.exp ?? now + 300);
   return payload; // sub: the person's id at this site; wallets[0]: the wallet they signed in with
 }
+
+// Your own sessions, by the id in the cookie. A real deployment keeps these in its session store or Redis.
+const sessions = new Map<string, { sub: string; wallet?: string }>();
+const sessionOf = (req: express.Request) =>
+  sessions.get(/(?:^|; )session=([^;]+)/.exec(req.headers.cookie ?? '')?.[1] ?? '');
+
+const app = express();
+app.use(express.json());
+
+app.post('/session', async (req, res) => {
+  let payload;
+  try {
+    payload = await verifyChainDaddy(req.body.id_token);
+  } catch {
+    return res.status(401).json({ error: 'sign_in_failed', message: 'That sign-in could not be checked. Sign in again.' });
+  }
+  const id = randomUUID();
+  sessions.set(id, { sub: payload.sub as string, wallet: (payload.wallets as string[] | undefined)?.[0] });
+  res.cookie('session', id, { httpOnly: true, secure: true, sameSite: 'lax' });
+  res.json({ ok: true });
+});
+
+// Only a signed-in visitor gets this.
+app.get('/members', (req, res) => {
+  const user = sessionOf(req);
+  if (!user) return res.status(401).json({ error: 'signed_out', message: 'Sign in first.' });
+  res.json({ sub: user.sub, wallet: user.wallet });
+});
+
+app.listen(3000);
 ```
 
 To require a coin, add `"chaindaddy_claims": {"id_token":{"holdings":{"tokens":[{"chain":"base","address":"0xTOKEN","min":"100"}]}}}` to `client.json`. Chain Daddy then answers that request and no other, and refuses a sign-in that asks for anything else; the button needs no `claims`. The server still never reads `payload.holdings[0].held`: it matches each answer against its own constants first.
@@ -106,6 +150,20 @@ export function holdsCoin(payload: Record<string, unknown>) {
 }
 ```
 
+In `POST /session`, refuse right after `verifyChainDaddy`, so no session is made and the page shows the `message`:
+
+```ts
+  if (!holdsCoin(payload)) {
+    // held is null when the balance could not be read: not a no, so ask them to sign in again.
+    const unread = Array.isArray(payload.holdings) && payload.holdings.some((h) => h?.held === null);
+    return unread
+      ? res.status(503).json({ error: 'balance_unreadable', message: 'We could not read your balance just now. Sign in again in a moment.' })
+      : res.status(403).json({ error: 'not_a_holder', message: 'This page is for holders of the coin.' });
+  }
+```
+
+The token address is `tokenAddress` in `GET https://api.chaindaddy.io/api/v2/public/coins/{chain}/{symbol}` (keyless; e.g. `/api/v2/public/coins/base/FLUXGP`). `holdsCoin` reads only the payload, so test it without a wallet: call it with `{ holdings: [{ chain, token, min, held }] }`. `held: true` must pass; `held: false`, another token's `held: true` and `held: null` must not.
+
 `held` is `null` when the balance could not be read: ask again, never treat it as yes. `{"id_token":{"crowns":{"all":true}}}` lists the crowns they hold.
 
 ## 1b. Or register a client (the human does this)