Poolday integration guide

POST <the URL Poolday gave you>
Content-Type: application/json
X-Poolday-Signature: sha256=<hex HMAC-SHA256 of the body, keyed with the secret>
Idempotency-Key: <your unique event id>

{ ...any JSON... }

// Node / TypeScript
import { createHmac, randomUUID } from 'node:crypto';

const HOOK_URL = process.env.POOLDAY_HOOK_URL!;       // from the one-time reveal
const HOOK_SECRET = process.env.POOLDAY_HOOK_SECRET!;

export async function sendToPoolday(event: object, eventId = randomUUID()) {
  const body = JSON.stringify(event);                  // sign exactly these bytes
  const signature = 'sha256=' + createHmac('sha256', HOOK_SECRET).update(body).digest('hex');

  for (let attempt = 1; ; attempt++) {
    const res = await fetch(HOOK_URL, {
      method: 'POST',
      headers: { 'content-type': 'application/json',
                 'x-poolday-signature': signature,
                 'idempotency-key': eventId },
      body,
    });
    if (res.status === 202 || res.status === 200) return res.json();
    if (res.status < 500) throw new Error(`Poolday rejected the webhook (${res.status}): ${await res.text()}`);
    if (attempt >= 4) throw new Error(`Poolday webhook failed (${res.status})`);
    await new Promise((r) => setTimeout(r, 500 * 2 ** attempt));
  }
}

// usage
await sendToPoolday({
  event: 'order.created', id: 'ord_84213',
  customer: { name: 'Jane Doe' },
  product: { title: 'Trail Runner 2', sku: 'TR2-BLK-42' },
  files: [{ url: 'https://cdn.yourco.com/products/tr2/hero.jpg', name: 'hero.jpg' },
          { url: 'https://cdn.yourco.com/products/tr2/side.jpg', name: 'side.jpg' }],
}, 'evt_01J9…');

# Python
import hashlib, hmac, json, os, time, uuid, requests

HOOK_URL = os.environ["POOLDAY_HOOK_URL"]
HOOK_SECRET = os.environ["POOLDAY_HOOK_SECRET"].encode()

def send_to_poolday(event: dict, event_id: str | None = None) -> dict:
    body = json.dumps(event, separators=(",", ":")).encode()      # sign exactly these bytes
    signature = "sha256=" + hmac.new(HOOK_SECRET, body, hashlib.sha256).hexdigest()
    headers = {"content-type": "application/json",
               "x-poolday-signature": signature,
               "idempotency-key": event_id or str(uuid.uuid4())}
    for attempt in range(1, 5):
        r = requests.post(HOOK_URL, data=body, headers=headers, timeout=30)
        if r.status_code in (200, 202): return r.json()
        if r.status_code < 500:
            raise RuntimeError(f"Poolday rejected the webhook ({r.status_code}): {r.text}")
        time.sleep(0.5 * 2 ** attempt)
    raise RuntimeError("Poolday webhook failed")

# curl, quick test
BODY='{"event":"order.created","id":"ord_1","product":{"title":"Trail Runner 2"}}'
SIG="sha256=$(printf '%s' "$BODY" | openssl dgst -sha256 -hmac "$POOLDAY_HOOK_SECRET" | sed 's/^.* //')"
curl -sS -X POST "$POOLDAY_HOOK_URL" -H 'content-type: application/json' \
  -H "x-poolday-signature: $SIG" -H 'idempotency-key: evt_test_1' -d "$BODY"
# prints {"accepted":1,...}

A new order needs a product video.

Order {{event.id}}: {{event.product.title}} (SKU {{event.product.sku}}) for {{event.customer.name}}.
Make a 20-second vertical (9:16) product video from the attached product images: a punchy hook,
three feature beats, and an end card with the product name. No voice-over; light background music.

When the final render is done:
1. Call the `acme-orders` connector's `deliver_video` tool with orderId "{{event.id}}",
   the rendered video URL, its duration, and a one-line description.
2. Then call `update_order_status` with orderId "{{event.id}}" and status "video_ready".
If you cannot finish (missing images, render failure), call `report_problem` with
orderId "{{event.id}}" and a short reason. Do not ask questions. Nobody is watching this chat.

npm i @modelcontextprotocol/sdk express zod

// mcp-server.ts: stateless Streamable HTTP, a fresh server and transport per request
import express from 'express';
import { z } from 'zod';
import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';
import { orders } from './orders.js';   // your domain layer

const text = (v: unknown) => ({ content: [{ type: 'text' as const, text: typeof v === 'string' ? v : JSON.stringify(v) }] });

function createServer() {
  const server = new McpServer({ name: 'acme-orders', version: '1.0.0' });

  server.registerTool('ping',
    { description: 'Health check. Returns "pong".', inputSchema: {}, annotations: { readOnlyHint: true } },
    async () => text('pong'));

  server.registerTool('get_order',
    { description: 'Fetch an order by id: customer, line items, product copy, brand notes, image URLs.',
      inputSchema: { orderId: z.string().describe('Order id, e.g. ord_84213') },
      annotations: { readOnlyHint: true } },
    async ({ orderId }) => {
      const order = await orders.get(orderId);
      return order ? text(order) : { ...text(`Order ${orderId} not found`), isError: true };
    });

  server.registerTool('deliver_video',
    { description: 'Attach a finished video to an order. Call exactly once per order when the final render is done. ' +
                   'videoUrl must be the rendered MP4 URL; include duration and a one-line description.',
      inputSchema: { orderId: z.string(),
                     videoUrl: z.string().url(),
                     durationSeconds: z.number().positive().optional(),
                     description: z.string().max(500).optional() },
      annotations: { idempotentHint: true } },
    async ({ orderId, videoUrl, ...meta }) => {
      // Copy the file into your own storage. Treat the Poolday URL as a download link.
      const delivery = await orders.attachVideo(orderId, { sourceUrl: videoUrl, ...meta });
      return text({ ok: true, deliveryId: delivery.id });
    });

  server.registerTool('update_order_status',
    { description: 'Move an order to a new fulfilment status.',
      inputSchema: { orderId: z.string(), status: z.enum(['video_ready', 'needs_review', 'failed']) },
      annotations: { idempotentHint: true } },
    async ({ orderId, status }) => text(await orders.setStatus(orderId, status)));

  server.registerTool('report_problem',
    { description: 'Report that the video could not be produced for an order and why. Use instead of asking a human.',
      inputSchema: { orderId: z.string(), reason: z.string().max(2000) },
      annotations: { idempotentHint: true } },
    async ({ orderId, reason }) => text(await orders.flag(orderId, reason)));

  return server;
}

const app = express();
app.use(express.json({ limit: '1mb' }));

app.post('/mcp', async (req, res) => {
  const server = createServer();
  const transport = new StreamableHTTPServerTransport({ sessionIdGenerator: undefined });
  res.on('close', () => { transport.close(); server.close(); });
  await server.connect(transport);
  await transport.handleRequest(req, res, req.body);
});
app.get('/mcp', (_req, res) => res.status(405).set('Allow', 'POST').end());
app.delete('/mcp', (_req, res) => res.status(405).set('Allow', 'POST').end());

app.listen(8080);   // put TLS in front: https://mcp.yourco.com/mcp

npx @modelcontextprotocol/inspector --cli https://mcp.yourco.com/mcp --method tools/list
npx @modelcontextprotocol/inspector --cli https://mcp.yourco.com/mcp --method tools/call --tool-name ping

import { ProxyOAuthServerProvider } from '@modelcontextprotocol/sdk/server/auth/providers/proxyProvider.js';
import { mcpAuthRouter } from '@modelcontextprotocol/sdk/server/auth/router.js';
import { requireBearerAuth } from '@modelcontextprotocol/sdk/server/auth/middleware/bearerAuth.js';

const IDP = 'https://auth.yourco.com';

const provider = new ProxyOAuthServerProvider({
  endpoints: { authorizationUrl: `${IDP}/authorize`, tokenUrl: `${IDP}/oauth/token`,
               revocationUrl: `${IDP}/oauth/revoke`,
               registrationUrl: `${IDP}/oidc/register` },        // DCR, required
  verifyAccessToken: async (token) => {
    const claims = await verifyJwt(token, { issuer: IDP, audience: 'https://mcp.yourco.com' });
    return { token, clientId: claims.azp, scopes: claims.scope?.split(' ') ?? [], expiresAt: claims.exp };
  },
  getClient: async (clientId) => ({ client_id: clientId, redirect_uris: [] }),
});

app.use(mcpAuthRouter({ provider, issuerUrl: new URL('https://mcp.yourco.com'),
                        resourceServerUrl: new URL('https://mcp.yourco.com/mcp') }));
app.post('/mcp', requireBearerAuth({ verifier: provider,
  resourceMetadataUrl: 'https://mcp.yourco.com/.well-known/oauth-protected-resource' }), /* handler above */);

{ "method": "tools/call",
  "params": { "name": "deliver_video",
              "arguments": { "orderId": "ord_84213",
                             "videoUrl": "https://media.poolday.ai/…/final.mp4",
                             "durationSeconds": 20,
                             "description": "20s vertical hero for Trail Runner 2" } } }