@neus/sdk 1.1.2 → 1.1.4

package/README.md

@@ -21,7 +21,7 @@ npx -y -p @neus/sdk neus setup
 npx -y -p @neus/sdk neus doctor --live
 ```
 
-Call `neus_context` in your MCP client. For agent workflows, call `neus_agent_link` before assuming identity or delegation is ready.
+Open your MCP client and ask the assistant to use NEUS Trust.
 
 ## MCP docs
 
@@ -30,7 +30,7 @@ Call `neus_context` in your MCP client. For agent workflows, call `neus_agent_li
 | Setup, JSON snippets, and headers | [MCP setup](https://docs.neus.network/mcp/setup)                              |
 | Tools and session order           | [MCP overview](https://docs.neus.network/mcp/overview)                        |
 | Discovery URLs                    | [Discovery and endpoints](https://docs.neus.network/mcp/endpoints)            |
-| NEUS for AI assistants          | [NEUS for AI assistants](https://docs.neus.network/mcp/ide-plugin)          |
+| Install NEUS Trust                | [Install NEUS Trust](https://docs.neus.network/install)                         |
 
 Prefer `neus setup` over hand-editing config files so every host stays on **`https://mcp.neus.network/mcp`**.
 
@@ -50,7 +50,7 @@ Use Hosted Verify when you want NEUS to handle the signing/verification flow out
 import { getHostedCheckoutUrl } from '@neus/sdk';
 
 const url = getHostedCheckoutUrl({
-  gateId: 'gate_abc123',
+  gateId: 'gate_your-app-name',
   returnUrl: 'https://yourapp.com/auth/callback'
 });
 
@@ -103,7 +103,7 @@ import { VerifyGate } from '@neus/sdk/widgets';
 export function Page() {
   return (
     <VerifyGate
-      gateId="gate_abc123"
+      gateId="gate_your-app-name"
       onVerified={result => {
         console.log(result.qHash || result.qHashes);
       }}
@@ -124,7 +124,7 @@ import { NeusClient } from '@neus/sdk';
 const client = new NeusClient();
 
 const result = await client.gateCheck({
-  gateId: 'gate_abc123',
+  gateId: 'gate_your-app-name',
   address: '0x...'
 });
 
@@ -172,7 +172,14 @@ Codex owns its local MCP OAuth session. Use `npx -y -p @neus/sdk neus setup --cl
 
 Integrators embedding install UX in apps should import **`@neus/sdk/mcp-hosts`** (setup commands, deeplinks, host labels) instead of duplicating strings.
 
-Editors with plugin marketplaces can install **`neus-trust@neus`** for the bundled session workflow. In Claude Code, run `/plugin marketplace add https://github.com/neus/network` and `/plugin install neus-trust@neus` inside chat. Other hosts: [NEUS for AI assistants](https://docs.neus.network/mcp/ide-plugin).
+Claude Code users can install **`neus-trust@neus`** for the bundled session workflow:
+
+```text
+/plugin marketplace add https://github.com/neus/network
+/plugin install neus-trust@neus
+```
+
+Other hosts: [Install NEUS Trust](https://docs.neus.network/install).
 
 ## Docs
 

package/SECURITY.md

@@ -1,38 +1,38 @@
-# NEUS SDK security notes
-
-Treat **wallet signatures** and **API keys** as secrets. Do not log them, expose them to clients, or store them in analytics.
-
-## Authentication model
-
-- **Verification requests** are authenticated with a wallet signature over the **CAIP-380 Portable Proof** six-line signing string. Never roll your own message format in production—use the SDK or the hosted preparation step documented for HTTP integrations.
-- **Proof lookups by `qHash`** are safe for public proofs. Private proofs return a minimal payload unless the caller proves ownership (authenticated owner or signed request).
-- **Owner-only reads** of private proof payloads require an extra owner-signed request. The SDK attaches the required signed headers for you.
-
-## Do not
-
-- Do not treat proof signatures as bearer tokens (they are request-bound).
-- Do not embed API keys in browser apps. Keep API keys server-side only.
-- Do not log or persist proof signatures, API keys, or third-party auth credentials (if your integration uses them).
-
-## Privacy defaults
-
-**`client.verify()`** defaults to **private**.
-
-**`VerifyGate`** create mode also defaults to **private**.
-
-Use public visibility only when you need proof reuse without owner-authenticated access:
-
-- unlisted public: `privacyLevel: 'public'`, `publicDisplay: false`
-- listed public: `privacyLevel: 'public'`, `publicDisplay: true`
-
-Do not treat unlisted public proofs as secret.
-
-`storeOriginalContent` is an advanced storage control. Most integrations should leave the default as-is.
-
-Controls:
-
-- `privacyLevel` - private by default; switch to public only for intentional public reuse
-- `publicDisplay` - discovery vs unlisted
-- `storeOriginalContent` - advanced content-storage control
-
-Discoverable listings require **`privacyLevel: 'public'`** and **`publicDisplay: true`**.
+# NEUS SDK security notes
+
+Treat **wallet signatures** and **API keys** as secrets. Do not log them, expose them to clients, or store them in analytics.
+
+## Authentication model
+
+- **Verification requests** are authenticated with a wallet signature over the **CAIP-380 Portable Proof** six-line signing string. Never roll your own message format in production—use the SDK or the hosted preparation step documented for HTTP integrations.
+- **Proof lookups by `qHash`** are safe for public proofs. Private proofs return a minimal payload unless the caller proves ownership (authenticated owner or signed request).
+- **Owner-only reads** of private proof payloads require an extra owner-signed request. The SDK attaches the required signed headers for you.
+
+## Do not
+
+- Do not treat proof signatures as bearer tokens (they are request-bound).
+- Do not embed API keys in browser apps. Keep API keys server-side only.
+- Do not log or persist proof signatures, API keys, or third-party auth credentials (if your integration uses them).
+
+## Privacy defaults
+
+**`client.verify()`** defaults to **private**.
+
+**`VerifyGate`** create mode also defaults to **private**.
+
+Use public visibility only when you need proof reuse without owner-authenticated access:
+
+- unlisted public: `privacyLevel: 'public'`, `publicDisplay: false`
+- listed public: `privacyLevel: 'public'`, `publicDisplay: true`
+
+Do not treat unlisted public proofs as secret.
+
+`storeOriginalContent` is an advanced storage control. Most integrations should leave the default as-is.
+
+Controls:
+
+- `privacyLevel` - private by default; switch to public only for intentional public reuse
+- `publicDisplay` - discovery vs unlisted
+- `storeOriginalContent` - advanced content-storage control
+
+Discoverable listings require **`privacyLevel: 'public'`** and **`publicDisplay: true`**.