phygital-token-mcp 0.2.2 → 0.4.0

package/dist/lib/verification.js

@@ -1,28 +1,3 @@
-export const ON_CHAIN_PATTERNS = {
-    inspect: {
-        id: "inspect",
-        name: "Pattern A — client posts verify_asset, program inspects",
-        clientTransaction: ["secp256r1_verify", "verify_asset", "your_program_ix"],
-        clientSdk: ["beginVerifyAsset", "completeVerifyAsset", "getVerifyAssetInstruction"],
-        programRust: "Scan instructions sysvar for preceding verify_asset; check message bytes",
-        reference: "programs/phygital-spend",
-    },
-    cpi: {
-        id: "cpi",
-        name: "Pattern B — client posts secp256r1_verify, program CPIs verify_asset",
-        clientTransaction: ["secp256r1_verify", "your_program_ix"],
-        clientSdk: ["beginVerifyAsset", "buildVerifyAssetArgs"],
-        programRust: "VerifyAssetCpiBuilder from phygital-token-client",
-        reference: "clients/rust/phygital-token",
-    },
-    standalone: {
-        id: "standalone",
-        name: "Standalone on-chain verify_asset (no custom program)",
-        clientTransaction: ["secp256r1_verify", "verify_asset"],
-        clientSdk: ["beginVerifyAsset", "completeVerifyAsset"],
-        programRust: "N/A",
-    },
-};
 const RECOMMENDATIONS = {
     product_page_lookup: {
         method: "identification — verifyDynamicUrl",
@@ -50,30 +25,16 @@ const RECOMMENDATIONS = {
         cautions: ["Copied links can be replayed."],
     },
     login_ui_only: {
-        method: "authentication off-chain — startAuthentication + verifyWithChallengeResponse",
+        method: "authentication off-chain — startAuthentication + verifyResponse",
         sdkExports: [
-            "startAuthenticationWithChallengeResponse",
-            "verifyWithChallengeResponse",
+            "startAuthentication",
+            "verifyResponse",
         ],
         requiresTap: true,
         onChain: false,
-        rationale: "Server issues challenge; client taps NFC via startAuthenticationWithChallengeResponse; server verifies with verifyWithChallengeResponse. No on-chain transaction.",
+        rationale: "Server issues challenge; client taps NFC via startAuthentication; server verifies with verifyResponse. No on-chain transaction.",
         docIds: ["verification:methods", "verification:overview"],
-        cautions: ["Run verifyWithChallengeResponse on your server, not in the browser."],
-    },
-    vault_gated_experience: {
-        method: "vault gate — server-verified tap + evaluateAssetGating",
-        sdkExports: [
-            "startAuthenticationWithChallengeResponse",
-            "verifyWithChallengeResponse",
-            "evaluateAssetGating",
-            "Gating",
-            "GatingTraitValue",
-        ],
-        requiresTap: true,
-        onChain: false,
-        rationale: "Prove vault holder is present (server-verified tap), then check owner wallet holdings for tiered unlock.",
-        docIds: ["verification:methods", "verification:overview", "gating:overview"],
+        cautions: ["Run verifyResponse on your server, not in the browser."],
     },
     onchain_standalone_verify: {
         method: "on-chain verify_asset only",
@@ -128,28 +89,17 @@ const RECOMMENDATIONS = {
         docIds: ["verification:overview"],
         cautions: ["Do not use verifyDynamicUrl for transfers."],
     },
-    wallet_holdings_gate: {
-        method: "gating — evaluateAssetGating",
-        sdkExports: ["evaluateAssetGating", "Gating", "GatingTraitValue"],
-        requiresTap: false,
-        onChain: false,
-        rationale: "Wallet holdings via DAS given an asset publicKey. Pair with off-chain tap auth when you need live presence.",
-        docIds: ["gating:overview"],
-        cautions: [
-            "startAuthenticationWithChallengeResponse + verifyWithChallengeResponse first, then evaluateAssetGating.",
-        ],
-    },
     native_mobile_app: {
-        method: "authentication off-chain — startAuthentication (transceive) + verifyWithChallengeResponse",
+        method: "authentication off-chain — startAuthentication (transceive) + verifyResponse",
         sdkExports: [
-            "startAuthenticationWithChallengeResponse",
-            "verifyWithChallengeResponse",
+            "startAuthentication",
+            "verifyResponse",
         ],
         requiresTap: true,
         onChain: false,
-        rationale: "Pass transceive to startAuthenticationWithChallengeResponse for native NFC readers; verify on server. Use beginVerifyAsset for on-chain proof.",
+        rationale: "Pass transceive to startAuthentication for native NFC readers; verify on server. Use beginVerifyAsset for on-chain proof.",
         docIds: ["verification:methods"],
-        cautions: ["Run verifyWithChallengeResponse on your server, not in the native client."],
+        cautions: ["Run verifyResponse on your server, not in the native client."],
     },
 };
 export function recommendVerification(useCase) {
@@ -161,7 +111,6 @@ export function listVerificationUseCases() {
         { id: "deep_link_from_prior_scan", summary: "App opens from signed deep link" },
         { id: "offline_identification", summary: "Identify asset offline (weak replay)" },
         { id: "login_ui_only", summary: "Off-chain tap-to-login (no chain tx)" },
-        { id: "vault_gated_experience", summary: "tap + wallet holdings check" },
         { id: "onchain_standalone_verify", summary: "On-chain verify_asset only" },
         {
             id: "onchain_inspect_verify_asset",
@@ -172,7 +121,6 @@ export function listVerificationUseCases() {
             summary: "Pattern B: buildVerifyAssetArgs, your program CPIs verify_asset",
         },
         { id: "transfer_ownership", summary: "Claim/transfer token to new owner" },
-        { id: "wallet_holdings_gate", summary: "Gate by wallet NFTs/tokens" },
         { id: "native_mobile_app", summary: "Native app off-chain authentication" },
     ];
 }
@@ -181,13 +129,13 @@ Identification vs Authentication
 ├── Need holder present NOW?
 │   NO → verifyDynamicUrl / verifyDynamicUrlWithoutCounterCheck
 │   YES → Need on-chain proof?
-│         NO → startAuthenticationWithChallengeResponse (client tap)
-│              → verifyWithChallengeResponse (server verify) — off-chain only
+│         NO → startAuthentication (client tap)
+│              → verifyResponse (server verify) — off-chain only
 │         YES → beginVerifyAsset composable flow:
 │               Pattern A: [secp256r1_verify, verify_asset, your_ix] — program inspects sysvar
 │               Pattern B: [secp256r1_verify, your_ix] — program CPIs verify_asset
 └── Transfer ownership? → beginTransfer → completeTransfer
 
-verifyWithChallengeResponse never submits verify_asset. Run it on your server. On-chain proof always uses beginVerifyAsset.
+verifyResponse never submits verify_asset. Returns { isVerified, asset } (owner is asset.owner). Run it on your server. On-chain proof always uses beginVerifyAsset.
 `.trim();
 //# sourceMappingURL=verification.js.map

package/dist/lib/verification.js.map

@@ -1 +1 @@
-{"version":3,"file":"verification.js","sourceRoot":"","sources":["../../src/lib/verification.ts"],"names":[],"mappings":"AA0BA,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,OAAO,EAAE;QACP,EAAE,EAAE,SAAkB;QACtB,IAAI,EAAE,yDAAyD;QAC/D,iBAAiB,EAAE,CAAC,kBAAkB,EAAE,cAAc,EAAE,iBAAiB,CAAC;QAC1E,SAAS,EAAE,CAAC,kBAAkB,EAAE,qBAAqB,EAAE,2BAA2B,CAAC;QACnF,WAAW,EAAE,0EAA0E;QACvF,SAAS,EAAE,yBAAyB;KACrC;IACD,GAAG,EAAE;QACH,EAAE,EAAE,KAAc;QAClB,IAAI,EAAE,sEAAsE;QAC5E,iBAAiB,EAAE,CAAC,kBAAkB,EAAE,iBAAiB,CAAC;QAC1D,SAAS,EAAE,CAAC,kBAAkB,EAAE,sBAAsB,CAAC;QACvD,WAAW,EAAE,kDAAkD;QAC/D,SAAS,EAAE,6BAA6B;KACzC;IACD,UAAU,EAAE;QACV,EAAE,EAAE,YAAqB;QACzB,IAAI,EAAE,sDAAsD;QAC5D,iBAAiB,EAAE,CAAC,kBAAkB,EAAE,cAAc,CAAC;QACvD,SAAS,EAAE,CAAC,kBAAkB,EAAE,qBAAqB,CAAC;QACtD,WAAW,EAAE,KAAK;KACnB;CACO,CAAC;AAEX,MAAM,eAAe,GAA4D;IAC/E,mBAAmB,EAAE;QACnB,MAAM,EAAE,mCAAmC;QAC3C,UAAU,EAAE,CAAC,kBAAkB,CAAC;QAChC,WAAW,EAAE,KAAK;QAClB,OAAO,EAAE,KAAK;QACd,SAAS,EACP,kFAAkF;QACpF,MAAM,EAAE,CAAC,sBAAsB,EAAE,uBAAuB,CAAC;KAC1D;IACD,yBAAyB,EAAE;QACzB,MAAM,EAAE,mCAAmC;QAC3C,UAAU,EAAE,CAAC,kBAAkB,CAAC;QAChC,WAAW,EAAE,KAAK;QAClB,OAAO,EAAE,KAAK;QACd,SAAS,EAAE,8CAA8C;QACzD,MAAM,EAAE,CAAC,sBAAsB,CAAC;KACjC;IACD,sBAAsB,EAAE;QACtB,MAAM,EAAE,sDAAsD;QAC9D,UAAU,EAAE,CAAC,qCAAqC,CAAC;QACnD,WAAW,EAAE,KAAK;QAClB,OAAO,EAAE,KAAK;QACd,SAAS,EAAE,oDAAoD;QAC/D,MAAM,EAAE,CAAC,sBAAsB,CAAC;QAChC,QAAQ,EAAE,CAAC,+BAA+B,CAAC;KAC5C;IACD,aAAa,EAAE;QACb,MAAM,EAAE,8EAA8E;QACtF,UAAU,EAAE;YACV,0CAA0C;YAC1C,6BAA6B;SAC9B;QACD,WAAW,EAAE,IAAI;QACjB,OAAO,EAAE,KAAK;QACd,SAAS,EACP,mKAAmK;QACrK,MAAM,EAAE,CAAC,sBAAsB,EAAE,uBAAuB,CAAC;QACzD,QAAQ,EAAE,CAAC,qEAAqE,CAAC;KAClF;IACD,sBAAsB,EAAE;QACtB,MAAM,EAAE,wDAAwD;QAChE,UAAU,EAAE;YACV,0CAA0C;YAC1C,6BAA6B;YAC7B,qBAAqB;YACrB,QAAQ;YACR,kBAAkB;SACnB;QACD,WAAW,EAAE,IAAI;QACjB,OAAO,EAAE,KAAK;QACd,SAAS,EACP,0GAA0G;QAC5G,MAAM,EAAE,CAAC,sBAAsB,EAAE,uBAAuB,EAAE,iBAAiB,CAAC;KAC7E;IACD,yBAAyB,EAAE;QACzB,MAAM,EAAE,4BAA4B;QACpC,UAAU,EAAE,CAAC,kBAAkB,EAAE,mCAAmC,EAAE,qBAAqB,CAAC;QAC5F,WAAW,EAAE,IAAI;QACjB,OAAO,EAAE,IAAI;QACb,cAAc,EAAE,YAAY;QAC5B,SAAS,EAAE,yDAAyD;QACpE,MAAM,EAAE,CAAC,sCAAsC,CAAC;KACjD;IACD,4BAA4B,EAAE;QAC5B,MAAM,EAAE,sEAAsE;QAC9E,UAAU,EAAE;YACV,kBAAkB;YAClB,mCAAmC;YACnC,qBAAqB;YACrB,2BAA2B;SAC5B;QACD,WAAW,EAAE,IAAI;QACjB,OAAO,EAAE,IAAI;QACb,cAAc,EAAE,SAAS;QACzB,SAAS,EACP,mIAAmI;QACrI,MAAM,EAAE;YACN,sCAAsC;YACtC,+BAA+B;YAC/B,+BAA+B;SAChC;KACF;IACD,wBAAwB,EAAE;QACxB,MAAM,EAAE,kEAAkE;QAC1E,UAAU,EAAE;YACV,kBAAkB;YAClB,mCAAmC;YACnC,sBAAsB;SACvB;QACD,WAAW,EAAE,IAAI;QACjB,OAAO,EAAE,IAAI;QACb,cAAc,EAAE,KAAK;QACrB,SAAS,EACP,uHAAuH;QACzH,MAAM,EAAE;YACN,sCAAsC;YACtC,+BAA+B;YAC/B,+BAA+B;SAChC;KACF;IACD,kBAAkB,EAAE;QAClB,MAAM,EAAE,6CAA6C;QACrD,UAAU,EAAE,CAAC,eAAe,EAAE,gCAAgC,EAAE,kBAAkB,CAAC;QACnF,WAAW,EAAE,IAAI;QACjB,OAAO,EAAE,IAAI;QACb,SAAS,EAAE,sDAAsD;QACjE,MAAM,EAAE,CAAC,uBAAuB,CAAC;QACjC,QAAQ,EAAE,CAAC,4CAA4C,CAAC;KACzD;IACD,oBAAoB,EAAE;QACpB,MAAM,EAAE,8BAA8B;QACtC,UAAU,EAAE,CAAC,qBAAqB,EAAE,QAAQ,EAAE,kBAAkB,CAAC;QACjE,WAAW,EAAE,KAAK;QAClB,OAAO,EAAE,KAAK;QACd,SAAS,EAAE,6GAA6G;QACxH,MAAM,EAAE,CAAC,iBAAiB,CAAC;QAC3B,QAAQ,EAAE;YACR,yGAAyG;SAC1G;KACF;IACD,iBAAiB,EAAE;QACjB,MAAM,EAAE,2FAA2F;QACnG,UAAU,EAAE;YACV,0CAA0C;YAC1C,6BAA6B;SAC9B;QACD,WAAW,EAAE,IAAI;QACjB,OAAO,EAAE,KAAK;QACd,SAAS,EACP,gJAAgJ;QAClJ,MAAM,EAAE,CAAC,sBAAsB,CAAC;QAChC,QAAQ,EAAE,CAAC,2EAA2E,CAAC;KACxF;CACF,CAAC;AAEF,MAAM,UAAU,qBAAqB,CACnC,OAA4B;IAE5B,OAAO,eAAe,CAAC,OAAO,CAAC,CAAC;AAClC,CAAC;AAED,MAAM,UAAU,wBAAwB;IAItC,OAAO;QACL,EAAE,EAAE,EAAE,qBAAqB,EAAE,OAAO,EAAE,kCAAkC,EAAE;QAC1E,EAAE,EAAE,EAAE,2BAA2B,EAAE,OAAO,EAAE,iCAAiC,EAAE;QAC/E,EAAE,EAAE,EAAE,wBAAwB,EAAE,OAAO,EAAE,sCAAsC,EAAE;QACjF,EAAE,EAAE,EAAE,eAAe,EAAE,OAAO,EAAE,sCAAsC,EAAE;QACxE,EAAE,EAAE,EAAE,wBAAwB,EAAE,OAAO,EAAE,6BAA6B,EAAE;QACxE,EAAE,EAAE,EAAE,2BAA2B,EAAE,OAAO,EAAE,4BAA4B,EAAE;QAC1E;YACE,EAAE,EAAE,8BAA8B;YAClC,OAAO,EAAE,qEAAqE;SAC/E;QACD;YACE,EAAE,EAAE,0BAA0B;YAC9B,OAAO,EAAE,iEAAiE;SAC3E;QACD,EAAE,EAAE,EAAE,oBAAoB,EAAE,OAAO,EAAE,mCAAmC,EAAE;QAC1E,EAAE,EAAE,EAAE,sBAAsB,EAAE,OAAO,EAAE,4BAA4B,EAAE;QACrE,EAAE,EAAE,EAAE,mBAAmB,EAAE,OAAO,EAAE,qCAAqC,EAAE;KAC5E,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,0BAA0B,GAAG;;;;;;;;;;;;;CAazC,CAAC,IAAI,EAAE,CAAC"}
+{"version":3,"file":"verification.js","sourceRoot":"","sources":["../../src/lib/verification.ts"],"names":[],"mappings":"AAwBA,MAAM,eAAe,GAA4D;IAC/E,mBAAmB,EAAE;QACnB,MAAM,EAAE,mCAAmC;QAC3C,UAAU,EAAE,CAAC,kBAAkB,CAAC;QAChC,WAAW,EAAE,KAAK;QAClB,OAAO,EAAE,KAAK;QACd,SAAS,EACP,kFAAkF;QACpF,MAAM,EAAE,CAAC,sBAAsB,EAAE,uBAAuB,CAAC;KAC1D;IACD,yBAAyB,EAAE;QACzB,MAAM,EAAE,mCAAmC;QAC3C,UAAU,EAAE,CAAC,kBAAkB,CAAC;QAChC,WAAW,EAAE,KAAK;QAClB,OAAO,EAAE,KAAK;QACd,SAAS,EAAE,8CAA8C;QACzD,MAAM,EAAE,CAAC,sBAAsB,CAAC;KACjC;IACD,sBAAsB,EAAE;QACtB,MAAM,EAAE,sDAAsD;QAC9D,UAAU,EAAE,CAAC,qCAAqC,CAAC;QACnD,WAAW,EAAE,KAAK;QAClB,OAAO,EAAE,KAAK;QACd,SAAS,EAAE,oDAAoD;QAC/D,MAAM,EAAE,CAAC,sBAAsB,CAAC;QAChC,QAAQ,EAAE,CAAC,+BAA+B,CAAC;KAC5C;IACD,aAAa,EAAE;QACb,MAAM,EAAE,iEAAiE;QACzE,UAAU,EAAE;YACV,qBAAqB;YACrB,gBAAgB;SACjB;QACD,WAAW,EAAE,IAAI;QACjB,OAAO,EAAE,KAAK;QACd,SAAS,EACP,iIAAiI;QACnI,MAAM,EAAE,CAAC,sBAAsB,EAAE,uBAAuB,CAAC;QACzD,QAAQ,EAAE,CAAC,wDAAwD,CAAC;KACrE;IACD,yBAAyB,EAAE;QACzB,MAAM,EAAE,4BAA4B;QACpC,UAAU,EAAE,CAAC,kBAAkB,EAAE,mCAAmC,EAAE,qBAAqB,CAAC;QAC5F,WAAW,EAAE,IAAI;QACjB,OAAO,EAAE,IAAI;QACb,cAAc,EAAE,YAAY;QAC5B,SAAS,EAAE,yDAAyD;QACpE,MAAM,EAAE,CAAC,sCAAsC,CAAC;KACjD;IACD,4BAA4B,EAAE;QAC5B,MAAM,EAAE,sEAAsE;QAC9E,UAAU,EAAE;YACV,kBAAkB;YAClB,mCAAmC;YACnC,qBAAqB;YACrB,2BAA2B;SAC5B;QACD,WAAW,EAAE,IAAI;QACjB,OAAO,EAAE,IAAI;QACb,cAAc,EAAE,SAAS;QACzB,SAAS,EACP,mIAAmI;QACrI,MAAM,EAAE;YACN,sCAAsC;YACtC,+BAA+B;YAC/B,+BAA+B;SAChC;KACF;IACD,wBAAwB,EAAE;QACxB,MAAM,EAAE,kEAAkE;QAC1E,UAAU,EAAE;YACV,kBAAkB;YAClB,mCAAmC;YACnC,sBAAsB;SACvB;QACD,WAAW,EAAE,IAAI;QACjB,OAAO,EAAE,IAAI;QACb,cAAc,EAAE,KAAK;QACrB,SAAS,EACP,uHAAuH;QACzH,MAAM,EAAE;YACN,sCAAsC;YACtC,+BAA+B;YAC/B,+BAA+B;SAChC;KACF;IACD,kBAAkB,EAAE;QAClB,MAAM,EAAE,6CAA6C;QACrD,UAAU,EAAE,CAAC,eAAe,EAAE,gCAAgC,EAAE,kBAAkB,CAAC;QACnF,WAAW,EAAE,IAAI;QACjB,OAAO,EAAE,IAAI;QACb,SAAS,EAAE,sDAAsD;QACjE,MAAM,EAAE,CAAC,uBAAuB,CAAC;QACjC,QAAQ,EAAE,CAAC,4CAA4C,CAAC;KACzD;IACD,iBAAiB,EAAE;QACjB,MAAM,EAAE,8EAA8E;QACtF,UAAU,EAAE;YACV,qBAAqB;YACrB,gBAAgB;SACjB;QACD,WAAW,EAAE,IAAI;QACjB,OAAO,EAAE,KAAK;QACd,SAAS,EACP,2HAA2H;QAC7H,MAAM,EAAE,CAAC,sBAAsB,CAAC;QAChC,QAAQ,EAAE,CAAC,8DAA8D,CAAC;KAC3E;CACF,CAAC;AAEF,MAAM,UAAU,qBAAqB,CACnC,OAA4B;IAE5B,OAAO,eAAe,CAAC,OAAO,CAAC,CAAC;AAClC,CAAC;AAED,MAAM,UAAU,wBAAwB;IAItC,OAAO;QACL,EAAE,EAAE,EAAE,qBAAqB,EAAE,OAAO,EAAE,kCAAkC,EAAE;QAC1E,EAAE,EAAE,EAAE,2BAA2B,EAAE,OAAO,EAAE,iCAAiC,EAAE;QAC/E,EAAE,EAAE,EAAE,wBAAwB,EAAE,OAAO,EAAE,sCAAsC,EAAE;QACjF,EAAE,EAAE,EAAE,eAAe,EAAE,OAAO,EAAE,sCAAsC,EAAE;QACxE,EAAE,EAAE,EAAE,2BAA2B,EAAE,OAAO,EAAE,4BAA4B,EAAE;QAC1E;YACE,EAAE,EAAE,8BAA8B;YAClC,OAAO,EAAE,qEAAqE;SAC/E;QACD;YACE,EAAE,EAAE,0BAA0B;YAC9B,OAAO,EAAE,iEAAiE;SAC3E;QACD,EAAE,EAAE,EAAE,oBAAoB,EAAE,OAAO,EAAE,mCAAmC,EAAE;QAC1E,EAAE,EAAE,EAAE,mBAAmB,EAAE,OAAO,EAAE,qCAAqC,EAAE;KAC5E,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,0BAA0B,GAAG;;;;;;;;;;;;;CAazC,CAAC,IAAI,EAAE,CAAC"}

package/docs/building-on-phygital/overview.md

@@ -2,7 +2,7 @@
 
 Third-party developers can:
 
-- **Gate off-chain** by wallet holdings → `evaluateAssetGating`
+- **Authenticate off-chain** with a live NFC tap → `startAuthentication` + `verifyResponse`
 - **Require live passkey presence on-chain** → composable `verify_asset` (two patterns below)
 
 ## Two on-chain composition patterns
@@ -31,10 +31,10 @@ Best when your program orchestrates verification as part of its own instruction.
 
 Off-chain tap auth is split:
 
-1. **Client:** `startAuthenticationWithChallengeResponse(expectedMessage)` — NFC tap.
-2. **Server:** `verifyWithChallengeResponse({ expectedMessage, response, rpc })` — signature check → `publicKey`.
+1. **Client:** `startAuthentication(expectedMessage)` — NFC tap.
+2. **Server:** `verifyResponse({ expectedMessage, response, rpc })` — signature check → `{ isVerified, asset }` (`asset.owner` is the wallet).
 
-Does **not** write to chain. Use for UI login, vault gates, and `evaluateAssetGating` when no program needs to inspect `verify_asset`.
+Does **not** write to chain. Use for UI login and vault presence checks when no program needs to inspect `verify_asset`.
 
 ## Message design checklist
 

package/docs/building-on-phygital/rust-cpi.md

@@ -42,13 +42,14 @@ The client obtains `secp256r1_verify_args` from TypeScript `buildVerifyAssetArgs
 
 ```rust
 pub struct Secp256r1VerifyArgs {
+    pub verify_args_relative_index: i64,
     pub signed_message_index: u8,
     pub slot_number: u64,
     pub client_data_json: Vec<u8>,
 }
 ```
 
-Mirrors `buildVerifyAssetArgs` output in TypeScript.
+`verify_args_relative_index` is the index of the secp256r1 verify instruction relative to the phygital instruction (typically `-1` when secp immediately precedes verify/transfer).
 
 ## Testing
 

package/docs/sdk/surface-area.md

@@ -41,10 +41,10 @@ TypeScript package: `phygital-token-sdk` (`clients/js/phygital-token`).
 |--------|---------|
 | `verifyDynamicUrl` | Identification via signed URL (server) |
 | `verifyDynamicUrlWithoutCounterCheck` | Identification offline |
-| `startAuthenticationWithChallengeResponse` | Client: NFC tap trigger; returns WebAuthn response |
-| `verifyWithChallengeResponse` | Server: verify tap signature; returns `publicKey` |
+| `startAuthentication` | Client: NFC tap trigger; returns WebAuthn response |
+| `verifyResponse` | Server: verify tap signature; returns `{ isVerified, asset }` |
 
-Pair `startAuthenticationWithChallengeResponse` (client) with `verifyWithChallengeResponse` (server). Pass optional `transceive` for kiosk / native NFC readers.
+Pair `startAuthentication` (client) with `verifyResponse` (server). Pass optional `transceive` for kiosk / native NFC readers. Optional `fetchAssetFromCredentialIdCallback` must return an `Asset`. Owner wallet is `asset.owner`.
 
 On-chain proof always uses `beginVerifyAsset` / `buildVerifyAssetArgs` / `completeVerifyAsset`.
 
@@ -55,18 +55,11 @@ On-chain proof always uses `beginVerifyAsset` / `buildVerifyAssetArgs` / `comple
 | `findAssetPda` | Derive asset PDA from secp256r1 pubkey |
 | `fetchAssetFromCredentialId` | Resolve asset + pubkey from credential |
 | `fetchAllAssetsFromOwner` | List assets by wallet owner |
-| `fetchAssetDisplayInfo` | Rich display metadata |
+| `fetchAssetDisplayInfoFromPublicKey` | Rich display metadata from base64url pubkey |
+| `fetchAssetDisplayInfo` | Rich display metadata from a decoded `Asset` account |
+| `fetchShortcutsFromExternalUrl` | Load Phantom Shortcuts schema v2 from `{external_url}/shortcuts.json` |
 | `resolveMedia` | Resolve media URLs from token metadata |
 
-## Gating
-
-| Export | Purpose |
-|--------|---------|
-| `evaluateAssetGating` | Full tier evaluation for asset owner wallet |
-| `evaluateGatingTiers` / `evaluateGatingFilter` | Lower-level evaluators |
-| `Gating` / `GatingTraitValue` | Filter builders |
-| `summarizeGatingEvaluationFailure` | Human-readable failure reasons |
-
 ## Generated (Codama)
 
 Re-exported from `./generated/index.js`:

package/docs/verification/methods.md

@@ -16,7 +16,7 @@ All exports from `clients/js/phygital-token/src/utils/verify.ts`.
 
 Off-chain authentication is **split**: NFC tap on the client, signature verification on your server.
 
-### `startAuthenticationWithChallengeResponse(message, transceive?)`
+### `startAuthentication(message, transceive?)`
 
 **Client — trigger the tap.**
 
@@ -24,35 +24,41 @@ Opens the system NFC modal (browser) or talks to an NFC reader via `transceive`
 
 ```ts
 // Browser
-const response = await startAuthenticationWithChallengeResponse(message);
+const response = await startAuthentication(message);
 
 // Kiosk / native reader
-const response = await startAuthenticationWithChallengeResponse(message, transceive);
+const response = await startAuthentication(message, transceive);
 ```
 
 `message` must be the same string your server issued as the challenge (store server-side with a short TTL).
 
-### `verifyWithChallengeResponse({ rpc, expectedMessage, response, ... })`
+### `verifyResponse({ rpc, expectedMessage, response, ... })`
 
 **Server — verify the tap.**
 
-Checks the WebAuthn signature against `expectedMessage`, resolves the vault `publicKey` via RPC (or `fetchPublicKeyFromCredentialIdCallback`). Returns `{ publicKey, isVerified }`. Does **not** submit `verify_asset`.
+Checks the WebAuthn signature against `expectedMessage`, resolves the vault via RPC (or `fetchAssetFromCredentialIdCallback`). Returns `{ isVerified, asset }`. Owner wallet is `asset.owner`. Challenge mismatch throws (`Message mismatch.`); a bad signature returns `isVerified: false`. Does **not** submit `verify_asset`.
+
+`fetchAssetFromCredentialIdCallback` must return a decoded on-chain `Asset`.
 
 ```ts
 // API route after client POSTs { message, response }
-const { publicKey, isVerified } = await verifyWithChallengeResponse({
+const { isVerified, asset } = await verifyResponse({
   rpc,
   expectedMessage: message,
   response,
 });
+
+if (isVerified) {
+  // use asset.owner / asset fields
+}
 ```
 
 Typical flow:
 
 1. Server issues `message` (e.g. `randomUUID()`), stores it for the session.
-2. Client calls `startAuthenticationWithChallengeResponse(message)` → user taps vault.
+2. Client calls `startAuthentication(message)` → user taps vault.
 3. Client POSTs `{ message, response }` to your verify API.
-4. Server calls `verifyWithChallengeResponse`, then runs your business logic (e.g. `evaluateAssetGating`).
+4. Server calls `verifyResponse`, then runs your business logic.
 
 For on-chain proof with a bound message, use `beginVerifyAsset({ message: Uint8Array })` instead.
 
@@ -60,7 +66,7 @@ For on-chain proof with a bound message, use `beginVerifyAsset({ message: Uint8A
 
 | Need | Use |
 |------|-----|
-| UI login / vault gate, no tx | `startAuthenticationWithChallengeResponse` + `verifyWithChallengeResponse` |
+| UI login / vault gate, no tx | `startAuthentication` + `verifyResponse` |
 | On-chain proof — Pattern A | `completeVerifyAsset` + your ix |
 | On-chain proof — Pattern B | `buildVerifyAssetArgs` + your ix |
 | Transfer ownership | `beginTransfer` → `completeTransfer` |
@@ -69,7 +75,7 @@ For on-chain proof with a bound message, use `beginVerifyAsset({ message: Uint8A
 
 | Context | `message` type | Effect |
 |---------|----------------|--------|
-| `startAuthenticationWithChallengeResponse` / `verifyWithChallengeResponse` | `string` (`expectedMessage`) | WebAuthn challenge bytes (UTF-8); must match on client and server |
+| `startAuthentication` / `verifyResponse` | `string` (`expectedMessage`) | WebAuthn challenge bytes (UTF-8); must match on client and server |
 | `beginVerifyAsset` | `Uint8Array` | Hashed into slot-bound on-chain challenge |
 
 An off-chain `expectedMessage` does **not** produce an on-chain `verify_asset` record. Use the composable flow when your program must inspect or CPI `verify_asset`.

package/docs/verification/overview.md

@@ -20,8 +20,8 @@ Do you need the holder physically present right now?
 │   └─ Offline / no backend → verifyDynamicUrlWithoutCounterCheck (weaker)
 └─ YES → Authentication
     ├─ Off-chain only (UI login, vault gate, no chain tx)
-    │     Server issues challenge → startAuthenticationWithChallengeResponse (client tap)
-    │     → verifyWithChallengeResponse (server verify) → your logic (e.g. evaluateAssetGating)
+    │     Server issues challenge → startAuthentication (client tap)
+    │     → verifyResponse (server verify) → your logic
     ├─ On-chain proof for your program → beginVerifyAsset composable flow (see below)
     └─ Transfer ownership → beginTransfer → completeTransfer (NOT verify_asset)
 ```
@@ -30,8 +30,8 @@ Do you need the holder physically present right now?
 
 Off-chain authentication uses two SDK functions:
 
-- **`startAuthenticationWithChallengeResponse`** — client only; opens NFC and returns a WebAuthn response.
-- **`verifyWithChallengeResponse`** — server only; checks the signature and resolves `publicKey`.
+- **`startAuthentication`** — client only; opens NFC and returns a WebAuthn response.
+- **`verifyResponse`** — server only; checks the signature and returns `{ isVerified, asset }` (`asset.owner` is the wallet).
 
 Neither submits a transaction. Verification should run on your backend so the client cannot fake a successful tap.
 

package/docs/verification/verify-asset-composable.md

@@ -1,6 +1,6 @@
 # Composable `verify_asset` (TypeScript)
 
-On-chain passkey authentication for custom programs. **Not** the same as off-chain `startAuthenticationWithChallengeResponse` + `verifyWithChallengeResponse`.
+On-chain passkey authentication for custom programs. **Not** the same as off-chain `startAuthentication` + `verifyResponse`.
 
 ## Session flow
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "phygital-token-mcp",
-  "version": "0.2.2",
+  "version": "0.4.0",
   "description": "MCP server for the phygital-token Solana program, TypeScript SDK, and Rust client",
   "license": "ISC",
   "repository": {
@@ -33,9 +33,9 @@
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.29.0",
     "@noble/hashes": "^2.0.1",
-    "@solana/kit": "^6.4.0",
-    "phygital-token-sdk": "^0.7.2",
-    "zod": "^3.25.76"
+    "@solana/kit": "^7.0.0",
+    "zod": "^3.25.76",
+    "phygital-token-sdk": "0.11.0"
   },
   "devDependencies": {
     "@types/node": "^22.15.21",

package/dist/lib/graphify.d.ts

@@ -1,2 +0,0 @@
-export type GraphifyMode = "query" | "explain" | "path";
-export declare function runGraphify(mode: GraphifyMode, args: string[]): Promise<string>;

package/dist/lib/graphify.js

@@ -1,35 +0,0 @@
-import { execFile } from "node:child_process";
-import { promisify } from "node:util";
-import { pathExists, resolveGraphifyGraphPath, resolveRepoRoot } from "./paths.js";
-const execFileAsync = promisify(execFile);
-export async function runGraphify(mode, args) {
-    const repoRoot = resolveRepoRoot();
-    const graphPath = resolveGraphifyGraphPath();
-    const graphExists = await pathExists(graphPath);
-    if (!graphExists) {
-        throw new Error(`Graphify graph not found at ${graphPath}. Clone the phygital-token repo, run "graphify update .", and set PHYGITAL_TOKEN_REPO_ROOT to the repo root — or use search_docs / read_doc instead.`);
-    }
-    const commandArgs = [mode, ...args];
-    try {
-        const { stdout, stderr } = await execFileAsync("graphify", commandArgs, {
-            cwd: repoRoot,
-            maxBuffer: 10 * 1024 * 1024,
-            env: process.env,
-        });
-        const output = [stdout.trim(), stderr.trim()].filter(Boolean).join("\n");
-        return output || "(no output)";
-    }
-    catch (error) {
-        if (error && typeof error === "object" && "stdout" in error) {
-            const execError = error;
-            const output = [execError.stdout?.trim(), execError.stderr?.trim()]
-                .filter(Boolean)
-                .join("\n");
-            if (output) {
-                return output;
-            }
-        }
-        throw error;
-    }
-}
-//# sourceMappingURL=graphify.js.map

package/dist/lib/graphify.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"graphify.js","sourceRoot":"","sources":["../../src/lib/graphify.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,UAAU,EAAE,wBAAwB,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAEnF,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAI1C,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,IAAkB,EAClB,IAAc;IAEd,MAAM,QAAQ,GAAG,eAAe,EAAE,CAAC;IACnC,MAAM,SAAS,GAAG,wBAAwB,EAAE,CAAC;IAC7C,MAAM,WAAW,GAAG,MAAM,UAAU,CAAC,SAAS,CAAC,CAAC;IAEhD,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CACb,+BAA+B,SAAS,sJAAsJ,CAC/L,CAAC;IACJ,CAAC;IAED,MAAM,WAAW,GAAG,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,CAAC;IAEpC,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,UAAU,EAAE,WAAW,EAAE;YACtE,GAAG,EAAE,QAAQ;YACb,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI;YAC3B,GAAG,EAAE,OAAO,CAAC,GAAG;SACjB,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACzE,OAAO,MAAM,IAAI,aAAa,CAAC;IACjC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,QAAQ,IAAI,KAAK,EAAE,CAAC;YAC5D,MAAM,SAAS,GAAG,KAA+D,CAAC;YAClF,MAAM,MAAM,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC;iBAChE,MAAM,CAAC,OAAO,CAAC;iBACf,IAAI,CAAC,IAAI,CAAC,CAAC;YACd,IAAI,MAAM,EAAE,CAAC;gBACX,OAAO,MAAM,CAAC;YAChB,CAAC;QACH,CAAC;QAED,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/lib/rpc.d.ts

@@ -1,3 +0,0 @@
-import { type Rpc, type SolanaRpcApi } from "@solana/kit";
-export declare function getRpcUrl(override?: string): string;
-export declare function createRpc(override?: string): Rpc<SolanaRpcApi>;

package/dist/lib/rpc.js

@@ -1,22 +0,0 @@
-import { createSolanaRpc } from "@solana/kit";
-let cachedRpc = null;
-let cachedRpcUrl = null;
-export function getRpcUrl(override) {
-    const url = override?.trim() ||
-        process.env.PHYGITAL_TOKEN_RPC_URL?.trim() ||
-        process.env.HELIUS_RPC_URL?.trim();
-    if (!url) {
-        throw new Error("RPC URL required. Pass rpcUrl to the tool or set PHYGITAL_TOKEN_RPC_URL (or HELIUS_RPC_URL).");
-    }
-    return url;
-}
-export function createRpc(override) {
-    const url = getRpcUrl(override);
-    if (cachedRpc && cachedRpcUrl === url) {
-        return cachedRpc;
-    }
-    cachedRpc = createSolanaRpc(url);
-    cachedRpcUrl = url;
-    return cachedRpc;
-}
-//# sourceMappingURL=rpc.js.map

package/dist/lib/rpc.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"rpc.js","sourceRoot":"","sources":["../../src/lib/rpc.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAA+B,MAAM,aAAa,CAAC;AAE3E,IAAI,SAAS,GAA6B,IAAI,CAAC;AAC/C,IAAI,YAAY,GAAkB,IAAI,CAAC;AAEvC,MAAM,UAAU,SAAS,CAAC,QAAiB;IACzC,MAAM,GAAG,GACP,QAAQ,EAAE,IAAI,EAAE;QAChB,OAAO,CAAC,GAAG,CAAC,sBAAsB,EAAE,IAAI,EAAE;QAC1C,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,EAAE,CAAC;IAErC,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CACb,8FAA8F,CAC/F,CAAC;IACJ,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,QAAiB;IACzC,MAAM,GAAG,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;IAEhC,IAAI,SAAS,IAAI,YAAY,KAAK,GAAG,EAAE,CAAC;QACtC,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,SAAS,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IACjC,YAAY,GAAG,GAAG,CAAC;IACnB,OAAO,SAAS,CAAC;AACnB,CAAC"}