@chaindaddy/mcp 0.6.9 → 0.6.11

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@chaindaddy/mcp",
-  "version": "0.6.9",
+  "version": "0.6.11",
   "description": "MCP server for Chain Daddy: search tickers, launch a token or verify ownership of one, and run its creator store",
   "mcpName": "io.chaindaddy/mcp",
   "homepage": "https://docs.chaindaddy.io/developer/store-and-rewards#tools-for-agents",

package/skills/sign-in-with-chain-daddy/SKILL.md

@@ -27,7 +27,7 @@ Use discovery: `https://api.chaindaddy.io/.well-known/openid-configuration`
 
 Any site can sign people in without registering anything.
 
-Replace `YOUR_SITE` with the site's https origin. Nothing is registered with Chain Daddy. The origin must be public, even while you build (a tunnel such as `cloudflared tunnel --url http://localhost:3000`, which needs no account, or a preview deployment): Chain Daddy's server fetches `client.json`, so `localhost` cannot be a client id.
+Replace `YOUR_SITE` with the site's host, such as `example.com`. Nothing is registered with Chain Daddy. The site must be public, on https: Chain Daddy's server fetches `client.json`, so `localhost` cannot be your own client id. To build on `http://localhost` first with nothing hosted, use the built-in development client: skip `client.json`, set the button's `client-id` to `chaindaddy-dev` and its `redirect-uri` to `http://localhost:3000/callback.html`, and set the server's `audience` to `'chaindaddy-dev'`. It asks every time, its `sub` matches no real site's, and it answers nothing about holdings or crowns, so put your own values back before you ship. To try your real `client.json` or a coin gate before the site is live, use a tunnel such as `cloudflared tunnel --url http://localhost:3000`, which needs no account, or a preview deployment.
 
 1. Host this at `https://YOUR_SITE/client.json` (served 200, no redirect; `client_id` must equal its own URL):
 
@@ -111,9 +111,15 @@ async function verifyChainDaddy(idToken) {
   return payload; // sub: the person's id at this site; wallets[0]: the wallet they signed in with
 }
 
-// Your own sessions, by the id in the cookie. A real deployment keeps these in its session store or Redis.
+// Your own sessions, by the id in the cookie, for a day. A real deployment keeps these in its session store or Redis.
 const sessions = new Map();
-const sessionOf = (req) => sessions.get(/(?:^|; )session=([^;]+)/.exec(req.headers.cookie ?? '')?.[1] ?? '');
+const DAY = 24 * 60 * 60 * 1000;
+const sessionId = (req) => /(?:^|; )session=([^;]+)/.exec(req.headers.cookie ?? '')?.[1] ?? '';
+const sessionOf = (req) => {
+  const user = sessions.get(sessionId(req));
+  if (user && user.expires > Date.now()) return user;
+  sessions.delete(sessionId(req));
+};
 
 const app = express();
 app.use(express.json());
@@ -127,8 +133,8 @@ app.post('/session', async (req, res) => {
     return res.status(401).json({ error: 'sign_in_failed', message: 'That sign-in could not be checked. Sign in again.' });
   }
   const id = randomUUID();
-  sessions.set(id, { sub: payload.sub, wallet: payload.wallets?.[0] });
-  res.cookie('session', id, { httpOnly: true, secure: true, sameSite: 'lax' });
+  sessions.set(id, { sub: payload.sub, wallet: payload.wallets?.[0], expires: Date.now() + DAY });
+  res.cookie('session', id, { httpOnly: true, secure: req.hostname !== 'localhost', sameSite: 'lax', maxAge: DAY });
   res.json({ ok: true });
 });
 
@@ -158,7 +164,7 @@ export function holdsCoin(payload) {
 }
 ```
 
-In `POST /session`, keep the answer in the session: `sessions.set(id, { sub: payload.sub, wallet: payload.wallets?.[0], holder: holdsCoin(payload) });`. Then add the holders' route:
+In `POST /session`, keep the answer in the session: `sessions.set(id, { sub: payload.sub, wallet: payload.wallets?.[0], holder: holdsCoin(payload), expires: Date.now() + DAY });`. Then add the holders' route:
 
 ```js
 // Only a holder gets this. Everyone else stays signed in and is told why not.