@chaindaddy/mcp 0.6.7 → 0.6.9

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@chaindaddy/mcp",
-  "version": "0.6.7",
+  "version": "0.6.9",
   "description": "MCP server for Chain Daddy: search tickers, launch a token or verify ownership of one, and run its creator store",
   "mcpName": "io.chaindaddy/mcp",
   "homepage": "https://docs.chaindaddy.io/developer/store-and-rewards#tools-for-agents",

package/skills/sign-in-with-chain-daddy/SKILL.md

@@ -27,7 +27,7 @@ Use discovery: `https://api.chaindaddy.io/.well-known/openid-configuration`
 
 Any site can sign people in without registering anything.
 
-Replace `YOUR_SITE` with the site's https origin. Nothing is registered with Chain Daddy. The origin must be public, even while you build (a tunnel or a preview deployment): Chain Daddy's server fetches `client.json`, so `localhost` cannot be a client id.
+Replace `YOUR_SITE` with the site's https origin. Nothing is registered with Chain Daddy. The origin must be public, even while you build (a tunnel such as `cloudflared tunnel --url http://localhost:3000`, which needs no account, or a preview deployment): Chain Daddy's server fetches `client.json`, so `localhost` cannot be a client id.
 
 1. Host this at `https://YOUR_SITE/client.json` (served 200, no redirect; `client_id` must equal its own URL):
 
@@ -47,8 +47,13 @@ Replace `YOUR_SITE` with the site's https origin. Nothing is registered with Cha
 <cd-signin-button client-id="https://YOUR_SITE/client.json"
                   redirect-uri="https://YOUR_SITE/callback.html"
                   scope="openid wallets"></cd-signin-button>
+<p id="signed-in"></p>
 <p id="signin-error" role="alert"></p>
 <script>
+  // Show who your server says is signed in.
+  fetch('/me').then((r) => (r.ok ? r.json() : null)).then((me) => {
+    if (me) document.querySelector('#signed-in').textContent = 'Signed in as ' + me.wallet;
+  });
   document.querySelector('cd-signin-button').addEventListener('cd-signin', async (e) => {
     const { id_token } = await ChainDaddy.exchangeCode(e.detail);
     const res = await fetch('/session', { method: 'POST', headers: { 'Content-Type': 'application/json' },
@@ -84,17 +89,17 @@ Replace `YOUR_SITE` with the site's https origin. Nothing is registered with Cha
 </script>
 ```
 
-4. On the server, an Express app (`npm install express jose`): verify the ID token, then start your own session (never trust the token in the browser). `POST /session` answers a refusal with a status and a `message`, which both pages show:
+4. On the server, an Express app in plain JavaScript: verify the ID token, then start your own session (never trust the token in the browser). Save it as `server.mjs` with the three files above in `public/` (the sign-in page as `index.html`), then `npm install express jose` and `node server.mjs`. After sign-in the page shows "Signed in as" and the wallet, from `GET /me`. `POST /session` answers a refusal with a status and a `message`, which both pages show:
 
-```ts
+```js
 import express from 'express';
 import { randomUUID } from 'node:crypto';
 import { createRemoteJWKSet, jwtVerify } from 'jose';
 const JWKS = createRemoteJWKSet(new URL('https://api.chaindaddy.io/api/v2/oauth/jwks'));
 // ID tokens already accepted, until they expire. A real deployment keeps these in its session store or Redis.
-const seen = new Map<string, number>();
+const seen = new Map();
 
-export async function verifyChainDaddy(idToken: string) {
+async function verifyChainDaddy(idToken) {
   const { payload } = await jwtVerify(idToken, JWKS, {
     issuer: 'https://api.chaindaddy.io', audience: 'https://YOUR_SITE/client.json', algorithms: ['ES256'],
   });
@@ -107,12 +112,12 @@ export async function verifyChainDaddy(idToken: string) {
 }
 
 // Your own sessions, by the id in the cookie. A real deployment keeps these in its session store or Redis.
-const sessions = new Map<string, { sub: string; wallet?: string }>();
-const sessionOf = (req: express.Request) =>
-  sessions.get(/(?:^|; )session=([^;]+)/.exec(req.headers.cookie ?? '')?.[1] ?? '');
+const sessions = new Map();
+const sessionOf = (req) => sessions.get(/(?:^|; )session=([^;]+)/.exec(req.headers.cookie ?? '')?.[1] ?? '');
 
 const app = express();
 app.use(express.json());
+app.use(express.static('public')); // client.json, the sign-in page (index.html) and callback.html
 
 app.post('/session', async (req, res) => {
   let payload;
@@ -122,13 +127,13 @@ app.post('/session', async (req, res) => {
     return res.status(401).json({ error: 'sign_in_failed', message: 'That sign-in could not be checked. Sign in again.' });
   }
   const id = randomUUID();
-  sessions.set(id, { sub: payload.sub as string, wallet: (payload.wallets as string[] | undefined)?.[0] });
+  sessions.set(id, { sub: payload.sub, wallet: payload.wallets?.[0] });
   res.cookie('session', id, { httpOnly: true, secure: true, sameSite: 'lax' });
   res.json({ ok: true });
 });
 
-// Only a signed-in visitor gets this.
-app.get('/members', (req, res) => {
+// Who is signed in. The sign-in page shows it.
+app.get('/me', (req, res) => {
   const user = sessionOf(req);
   if (!user) return res.status(401).json({ error: 'signed_out', message: 'Sign in first.' });
   res.json({ sub: user.sub, wallet: user.wallet });
@@ -137,40 +142,47 @@ app.get('/members', (req, res) => {
 app.listen(3000);
 ```
 
-To require a coin, add `"chaindaddy_claims": {"id_token":{"holdings":{"tokens":[{"chain":"base","address":"0xTOKEN","min":"100"}]}}}` to `client.json`. Chain Daddy then answers that request and no other, and refuses a sign-in that asks for anything else; the button needs no `claims`. The server still never reads `payload.holdings[0].held`: it matches each answer against its own constants first.
+To ask about a coin, add `"chaindaddy_claims": {"id_token":{"holdings":{"tokens":[{"chain":"base","address":"0xTOKEN","min":"100"}]}}}` to `client.json`. Chain Daddy then answers that request and no other, and refuses a sign-in that asks for anything else; the button needs no `claims`. Everyone still signs in, and one route is for holders. The server never reads `payload.holdings[0].held`: it matches each answer against its own constants first.
 
-```ts
+```js
 // What this site gates on, as the ID token writes it: token lowercase for an EVM address, min "0" if none was asked.
 const GATE = [{ chain: 'base', token: '0xtoken', min: '100' }];
 
-export function holdsCoin(payload: Record<string, unknown>) {
+// true or false, or null when the balance could not be read: not a no, so ask them to sign in again.
+export function holdsCoin(payload) {
   const holdings = Array.isArray(payload.holdings) ? payload.holdings : [];
-  return GATE.some((want) => holdings.some((h) =>
-    h?.chain === want.chain && h?.token === want.token && h?.min === want.min && h?.held === true));
+  const asked = holdings.filter((h) => GATE.some((want) =>
+    h?.chain === want.chain && h?.token === want.token && h?.min === want.min));
+  if (asked.some((h) => h.held === true)) return true;
+  return asked.some((h) => h.held === null) ? null : false;
 }
 ```
 
-In `POST /session`, refuse right after `verifyChainDaddy`, so no session is made and the page shows the `message`:
+In `POST /session`, keep the answer in the session: `sessions.set(id, { sub: payload.sub, wallet: payload.wallets?.[0], holder: holdsCoin(payload) });`. Then add the holders' route:
 
-```ts
-  if (!holdsCoin(payload)) {
-    // held is null when the balance could not be read: not a no, so ask them to sign in again.
-    const unread = Array.isArray(payload.holdings) && payload.holdings.some((h) => h?.held === null);
-    return unread
-      ? res.status(503).json({ error: 'balance_unreadable', message: 'We could not read your balance just now. Sign in again in a moment.' })
-      : res.status(403).json({ error: 'not_a_holder', message: 'This page is for holders of the coin.' });
-  }
+```js
+// Only a holder gets this. Everyone else stays signed in and is told why not.
+app.get('/members', (req, res) => {
+  const user = sessionOf(req);
+  if (!user) return res.status(401).json({ error: 'signed_out', message: 'Sign in first.' });
+  if (user.holder === null) return res.status(503).json({ error: 'balance_unreadable', message: 'We could not read your balance just now. Sign in again in a moment.' });
+  if (!user.holder) return res.status(403).json({ error: 'not_a_holder', message: 'This page is for holders of the coin.' });
+  res.json({ ok: true }); // your holders-only page
+});
 ```
 
-The token address is `tokenAddress` in `GET https://api.chaindaddy.io/api/v2/public/coins/{chain}/{symbol}` (keyless; e.g. `/api/v2/public/coins/base/FLUXGP`). `holdsCoin` reads only the payload, so test it without a wallet: call it with `{ holdings: [{ chain, token, min, held }] }`. `held: true` must pass; `held: false`, another token's `held: true` and `held: null` must not.
+To refuse the whole sign-in instead, answer the same way from `POST /session` when `holdsCoin(payload)` is not `true`, before the session is made.
+
+The token address is `tokenAddress` in `GET https://api.chaindaddy.io/api/v2/public/coins/{chain}/{symbol}` (keyless; e.g. `/api/v2/public/coins/base/FLUXGP`). `holdsCoin` reads only the payload, so test it without a wallet: call it with `{ holdings: [{ chain, token, min, held }] }`. `held: true` must give `true`, `held: false` and another token's `held: true` must give `false`, and `held: null` must give `null`.
 
 `held` is `null` when the balance could not be read: ask again, never treat it as yes. `{"id_token":{"crowns":{"all":true}}}` lists the crowns they hold.
 
 ## 1b. Or register a client (the human does this)
 
 Only needed for a **server client with a secret**, the consent screen's **Verified** mark for a coin's own
-site, or `http://localhost` redirects during development. Needs Developer Beta Program membership (free to
-register). Easiest: the developer portal, https://chaindaddy.io/_developer → **Sign-in** → **New client**. Or:
+site, or `http://localhost` redirects during development. Needs Developer Beta Program membership (any paid
+plan and the signed agreement; a client costs nothing more). Easiest: the developer portal,
+https://chaindaddy.io/_developer → **Sign-in** → **New client**. Or:
 
 ```bash
 chaindaddy oauth client create --name "My Game" \
@@ -248,8 +260,9 @@ browser makes the nonce, so comparing it proves nothing: refuse a `jti` you have
 
 ## After sign-in
 
-Gate on what the wallet owns live, on your server: your store's
-`GET /api/v2/iap/stores/{id}/entitlements?wallet=<wallets[0]>` (holder unlocks included). Never put a balance in
+The `holder` answer in your session is as of sign-in: sign the visitor in again to refresh it (no click while
+your request is unchanged). For what a wallet owns right now, ask on your server: your store's
+`GET /api/v2/iap/stores/{id}/entitlements?wallet=<wallets[0]>` (holder unlocks included). Never keep a balance in
 your session: it goes stale in minutes.
 
 ## Crown Apps use something else
@@ -267,6 +280,10 @@ wallet: the app token's `sub`, the sign-in token's `wallets[0]`. See `verify-rec
 - Redirect URIs that differ by a slash or a port: they must match exactly, or chaindaddy.io refuses.
 - Putting the client secret in a browser, game client or repo.
 - Asking the visitor to sign a second login message in their wallet. This is the sign-in.
+- Calling the token endpoint or the keys on every page view. Exchange the code once, keep your own session,
+  and cache the keys. The limits a normal site never meets: 120 token requests a minute for one person at one
+  site, 300 a minute per calling address, 30 approvals a minute per person. Past one the answer is `429` with
+  `Retry-After: 60` and `{"error":"temporarily_unavailable"}`: wait and retry, never loop.
 
 ## Docs