@worldcoin/idkit-core 4.0.15 → 4.1.0

package/README.md

@@ -16,7 +16,10 @@ The RP signature authenticates your verification requests. Generate it server-si
 import { signRequest } from "@worldcoin/idkit-core/signing";
 
 // Never expose RP_SIGNING_KEY to clients
-const sig = signRequest("my-action", process.env.RP_SIGNING_KEY);
+const sig = signRequest({
+  action: "my-action",
+  signingKeyHex: process.env.RP_SIGNING_KEY!,
+});
 
 // Return to client
 res.json({
@@ -50,6 +53,7 @@ const request = await IDKit.request({
     signature: rpSig.sig,
   },
   allow_legacy_proofs: false,
+  return_to: "myapp://idkit/callback",
 }).preset(orbLegacy({ signal: "user-123" }));
 
 // Display QR code for World App
@@ -114,10 +118,10 @@ const { success } = await response.json();
 
 Pure JS subpath exports are available for server-side use without WASM initialization:
 
-| Subpath    | Exports                                                          |
-| ---------- | ---------------------------------------------------------------- |
-| `/signing` | `signRequest`, `computeRpSignatureMessage`, `RpSignature` (type) |
-| `/hashing` | `hashSignal`                                                     |
+| Subpath    | Exports                                                                                   |
+| ---------- | ----------------------------------------------------------------------------------------- |
+| `/signing` | `signRequest`, `computeRpSignatureMessage`, `RpSignature` and `SignRequestParams` (types) |
+| `/hashing` | `hashSignal`                                                                              |
 
 ```typescript
 import { signRequest } from "@worldcoin/idkit-core/signing";

package/dist/index.cjs

@@ -6,9 +6,9 @@ var utils = require('@noble/hashes/utils');
 
 var _documentCurrentScript = typeof document !== 'undefined' ? document.currentScript : null;
 var __defProp = Object.defineProperty;
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
+var __export = (target, all2) => {
+  for (var name in all2)
+    __defProp(target, name, { get: all2[name], enumerable: true });
 };
 
 // src/types/result.ts
@@ -422,10 +422,11 @@ var IDKitBuilder = class _IDKitBuilder {
    * @param {string | null} [action_description]
    * @param {string | null} [bridge_url]
    * @param {string | null} [override_connect_base_url]
+   * @param {string | null} [return_to]
    * @param {string | null} [environment]
    * @returns {IDKitBuilder}
    */
-  static forCreateSession(app_id, rp_context, action_description, bridge_url, override_connect_base_url, environment) {
+  static forCreateSession(app_id, rp_context, action_description, bridge_url, override_connect_base_url, return_to, environment) {
     const ptr0 = passStringToWasm0(app_id, wasm.__wbindgen_export, wasm.__wbindgen_export2);
     const len0 = WASM_VECTOR_LEN;
     _assertClass(rp_context, RpContextWasm);
@@ -436,9 +437,11 @@ var IDKitBuilder = class _IDKitBuilder {
     var len3 = WASM_VECTOR_LEN;
     var ptr4 = isLikeNone(override_connect_base_url) ? 0 : passStringToWasm0(override_connect_base_url, wasm.__wbindgen_export, wasm.__wbindgen_export2);
     var len4 = WASM_VECTOR_LEN;
-    var ptr5 = isLikeNone(environment) ? 0 : passStringToWasm0(environment, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+    var ptr5 = isLikeNone(return_to) ? 0 : passStringToWasm0(return_to, wasm.__wbindgen_export, wasm.__wbindgen_export2);
     var len5 = WASM_VECTOR_LEN;
-    const ret = wasm.idkitbuilder_forCreateSession(ptr0, len0, ptr1, ptr2, len2, ptr3, len3, ptr4, len4, ptr5, len5);
+    var ptr6 = isLikeNone(environment) ? 0 : passStringToWasm0(environment, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+    var len6 = WASM_VECTOR_LEN;
+    const ret = wasm.idkitbuilder_forCreateSession(ptr0, len0, ptr1, ptr2, len2, ptr3, len3, ptr4, len4, ptr5, len5, ptr6, len6);
     return _IDKitBuilder.__wrap(ret);
   }
   /**
@@ -449,10 +452,11 @@ var IDKitBuilder = class _IDKitBuilder {
    * @param {string | null} [action_description]
    * @param {string | null} [bridge_url]
    * @param {string | null} [override_connect_base_url]
+   * @param {string | null} [return_to]
    * @param {string | null} [environment]
    * @returns {IDKitBuilder}
    */
-  static forProveSession(session_id, app_id, rp_context, action_description, bridge_url, override_connect_base_url, environment) {
+  static forProveSession(session_id, app_id, rp_context, action_description, bridge_url, override_connect_base_url, return_to, environment) {
     const ptr0 = passStringToWasm0(session_id, wasm.__wbindgen_export, wasm.__wbindgen_export2);
     const len0 = WASM_VECTOR_LEN;
     const ptr1 = passStringToWasm0(app_id, wasm.__wbindgen_export, wasm.__wbindgen_export2);
@@ -465,9 +469,11 @@ var IDKitBuilder = class _IDKitBuilder {
     var len4 = WASM_VECTOR_LEN;
     var ptr5 = isLikeNone(override_connect_base_url) ? 0 : passStringToWasm0(override_connect_base_url, wasm.__wbindgen_export, wasm.__wbindgen_export2);
     var len5 = WASM_VECTOR_LEN;
-    var ptr6 = isLikeNone(environment) ? 0 : passStringToWasm0(environment, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+    var ptr6 = isLikeNone(return_to) ? 0 : passStringToWasm0(return_to, wasm.__wbindgen_export, wasm.__wbindgen_export2);
     var len6 = WASM_VECTOR_LEN;
-    const ret = wasm.idkitbuilder_forProveSession(ptr0, len0, ptr1, len1, ptr2, ptr3, len3, ptr4, len4, ptr5, len5, ptr6, len6);
+    var ptr7 = isLikeNone(environment) ? 0 : passStringToWasm0(environment, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+    var len7 = WASM_VECTOR_LEN;
+    const ret = wasm.idkitbuilder_forProveSession(ptr0, len0, ptr1, len1, ptr2, ptr3, len3, ptr4, len4, ptr5, len5, ptr6, len6, ptr7, len7);
     return _IDKitBuilder.__wrap(ret);
   }
   /**
@@ -530,8 +536,8 @@ var IDKitBuilder = class _IDKitBuilder {
    * Builds a v1 (legacy) native payload from a preset (synchronous, no bridge connection).
    *
    * Used by the native transport when the World App only supports verify v1.
-   * Only legacy presets produce valid v1 payloads (constraints always have
-   * `Deprecated` verification level and will fail).
+   * Only legacy presets produce valid v1 payloads (constraint-based requests
+   * default to `Device` level and may not carry the correct action).
    *
    * # Errors
    *
@@ -564,9 +570,10 @@ var IDKitBuilder = class _IDKitBuilder {
    * @param {string | null | undefined} bridge_url
    * @param {boolean} allow_legacy_proofs
    * @param {string | null} [override_connect_base_url]
+   * @param {string | null} [return_to]
    * @param {string | null} [environment]
    */
-  constructor(app_id, action, rp_context, action_description, bridge_url, allow_legacy_proofs, override_connect_base_url, environment) {
+  constructor(app_id, action, rp_context, action_description, bridge_url, allow_legacy_proofs, override_connect_base_url, return_to, environment) {
     const ptr0 = passStringToWasm0(app_id, wasm.__wbindgen_export, wasm.__wbindgen_export2);
     const len0 = WASM_VECTOR_LEN;
     const ptr1 = passStringToWasm0(action, wasm.__wbindgen_export, wasm.__wbindgen_export2);
@@ -579,9 +586,11 @@ var IDKitBuilder = class _IDKitBuilder {
     var len4 = WASM_VECTOR_LEN;
     var ptr5 = isLikeNone(override_connect_base_url) ? 0 : passStringToWasm0(override_connect_base_url, wasm.__wbindgen_export, wasm.__wbindgen_export2);
     var len5 = WASM_VECTOR_LEN;
-    var ptr6 = isLikeNone(environment) ? 0 : passStringToWasm0(environment, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+    var ptr6 = isLikeNone(return_to) ? 0 : passStringToWasm0(return_to, wasm.__wbindgen_export, wasm.__wbindgen_export2);
     var len6 = WASM_VECTOR_LEN;
-    const ret = wasm.idkitbuilder_new(ptr0, len0, ptr1, len1, ptr2, ptr3, len3, ptr4, len4, allow_legacy_proofs, ptr5, len5, ptr6, len6);
+    var ptr7 = isLikeNone(environment) ? 0 : passStringToWasm0(environment, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+    var len7 = WASM_VECTOR_LEN;
+    const ret = wasm.idkitbuilder_new(ptr0, len0, ptr1, len1, ptr2, ptr3, len3, ptr4, len4, allow_legacy_proofs, ptr5, len5, ptr6, len6, ptr7, len7);
     this.__wbg_ptr = ret >>> 0;
     IDKitBuilderFinalization.register(this, this.__wbg_ptr, this);
     return this;
@@ -966,12 +975,14 @@ function base64Encode(data) {
     wasm.__wbindgen_export4(deferred2_0, deferred2_1, 1);
   }
 }
-function computeRpSignatureMessage(nonce, created_at, expires_at) {
+function computeRpSignatureMessage(nonce, created_at, expires_at, action) {
   try {
     const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);
     const ptr0 = passStringToWasm0(nonce, wasm.__wbindgen_export, wasm.__wbindgen_export2);
     const len0 = WASM_VECTOR_LEN;
-    wasm.computeRpSignatureMessage(retptr, ptr0, len0, created_at, expires_at);
+    var ptr1 = isLikeNone(action) ? 0 : passStringToWasm0(action, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+    var len1 = WASM_VECTOR_LEN;
+    wasm.computeRpSignatureMessage(retptr, ptr0, len0, created_at, expires_at, ptr1, len1);
     var r0 = getDataViewMemory0().getInt32(retptr + 4 * 0, true);
     var r1 = getDataViewMemory0().getInt32(retptr + 4 * 1, true);
     var r2 = getDataViewMemory0().getInt32(retptr + 4 * 2, true);
@@ -979,14 +990,14 @@ function computeRpSignatureMessage(nonce, created_at, expires_at) {
     if (r3) {
       throw takeObject(r2);
     }
-    var v2 = getArrayU8FromWasm0(r0, r1).slice();
+    var v3 = getArrayU8FromWasm0(r0, r1).slice();
     wasm.__wbindgen_export4(r0, r1 * 1, 1);
-    return v2;
+    return v3;
   } finally {
     wasm.__wbindgen_add_to_stack_pointer(16);
   }
 }
-function createSession(app_id, rp_context, action_description, bridge_url, override_connect_base_url, environment) {
+function createSession(app_id, rp_context, action_description, bridge_url, override_connect_base_url, return_to, environment) {
   const ptr0 = passStringToWasm0(app_id, wasm.__wbindgen_export, wasm.__wbindgen_export2);
   const len0 = WASM_VECTOR_LEN;
   _assertClass(rp_context, RpContextWasm);
@@ -997,9 +1008,11 @@ function createSession(app_id, rp_context, action_description, bridge_url, overr
   var len3 = WASM_VECTOR_LEN;
   var ptr4 = isLikeNone(override_connect_base_url) ? 0 : passStringToWasm0(override_connect_base_url, wasm.__wbindgen_export, wasm.__wbindgen_export2);
   var len4 = WASM_VECTOR_LEN;
-  var ptr5 = isLikeNone(environment) ? 0 : passStringToWasm0(environment, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+  var ptr5 = isLikeNone(return_to) ? 0 : passStringToWasm0(return_to, wasm.__wbindgen_export, wasm.__wbindgen_export2);
   var len5 = WASM_VECTOR_LEN;
-  const ret = wasm.createSession(ptr0, len0, ptr1, ptr2, len2, ptr3, len3, ptr4, len4, ptr5, len5);
+  var ptr6 = isLikeNone(environment) ? 0 : passStringToWasm0(environment, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+  var len6 = WASM_VECTOR_LEN;
+  const ret = wasm.createSession(ptr0, len0, ptr1, ptr2, len2, ptr3, len3, ptr4, len4, ptr5, len5, ptr6, len6);
   return IDKitBuilder.__wrap(ret);
 }
 function hashSignal(signal) {
@@ -1030,7 +1043,7 @@ function hashSignal(signal) {
 function init_wasm() {
   wasm.init_wasm();
 }
-function proveSession(session_id, app_id, rp_context, action_description, bridge_url, override_connect_base_url, environment) {
+function proveSession(session_id, app_id, rp_context, action_description, bridge_url, override_connect_base_url, return_to, environment) {
   const ptr0 = passStringToWasm0(session_id, wasm.__wbindgen_export, wasm.__wbindgen_export2);
   const len0 = WASM_VECTOR_LEN;
   const ptr1 = passStringToWasm0(app_id, wasm.__wbindgen_export, wasm.__wbindgen_export2);
@@ -1043,12 +1056,14 @@ function proveSession(session_id, app_id, rp_context, action_description, bridge
   var len4 = WASM_VECTOR_LEN;
   var ptr5 = isLikeNone(override_connect_base_url) ? 0 : passStringToWasm0(override_connect_base_url, wasm.__wbindgen_export, wasm.__wbindgen_export2);
   var len5 = WASM_VECTOR_LEN;
-  var ptr6 = isLikeNone(environment) ? 0 : passStringToWasm0(environment, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+  var ptr6 = isLikeNone(return_to) ? 0 : passStringToWasm0(return_to, wasm.__wbindgen_export, wasm.__wbindgen_export2);
   var len6 = WASM_VECTOR_LEN;
-  const ret = wasm.proveSession(ptr0, len0, ptr1, len1, ptr2, ptr3, len3, ptr4, len4, ptr5, len5, ptr6, len6);
+  var ptr7 = isLikeNone(environment) ? 0 : passStringToWasm0(environment, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+  var len7 = WASM_VECTOR_LEN;
+  const ret = wasm.proveSession(ptr0, len0, ptr1, len1, ptr2, ptr3, len3, ptr4, len4, ptr5, len5, ptr6, len6, ptr7, len7);
   return IDKitBuilder.__wrap(ret);
 }
-function request(app_id, action, rp_context, action_description, bridge_url, allow_legacy_proofs, override_connect_base_url, environment) {
+function request(app_id, action, rp_context, action_description, bridge_url, allow_legacy_proofs, override_connect_base_url, return_to, environment) {
   const ptr0 = passStringToWasm0(app_id, wasm.__wbindgen_export, wasm.__wbindgen_export2);
   const len0 = WASM_VECTOR_LEN;
   const ptr1 = passStringToWasm0(action, wasm.__wbindgen_export, wasm.__wbindgen_export2);
@@ -1061,17 +1076,21 @@ function request(app_id, action, rp_context, action_description, bridge_url, all
   var len4 = WASM_VECTOR_LEN;
   var ptr5 = isLikeNone(override_connect_base_url) ? 0 : passStringToWasm0(override_connect_base_url, wasm.__wbindgen_export, wasm.__wbindgen_export2);
   var len5 = WASM_VECTOR_LEN;
-  var ptr6 = isLikeNone(environment) ? 0 : passStringToWasm0(environment, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+  var ptr6 = isLikeNone(return_to) ? 0 : passStringToWasm0(return_to, wasm.__wbindgen_export, wasm.__wbindgen_export2);
   var len6 = WASM_VECTOR_LEN;
-  const ret = wasm.request(ptr0, len0, ptr1, len1, ptr2, ptr3, len3, ptr4, len4, allow_legacy_proofs, ptr5, len5, ptr6, len6);
+  var ptr7 = isLikeNone(environment) ? 0 : passStringToWasm0(environment, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+  var len7 = WASM_VECTOR_LEN;
+  const ret = wasm.request(ptr0, len0, ptr1, len1, ptr2, ptr3, len3, ptr4, len4, allow_legacy_proofs, ptr5, len5, ptr6, len6, ptr7, len7);
   return IDKitBuilder.__wrap(ret);
 }
-function signRequest(signing_key_hex, ttl_seconds) {
+function signRequest(signing_key_hex, ttl_seconds, action) {
   try {
     const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);
     const ptr0 = passStringToWasm0(signing_key_hex, wasm.__wbindgen_export, wasm.__wbindgen_export2);
     const len0 = WASM_VECTOR_LEN;
-    wasm.signRequest(retptr, ptr0, len0, !isLikeNone(ttl_seconds), isLikeNone(ttl_seconds) ? BigInt(0) : ttl_seconds);
+    var ptr1 = isLikeNone(action) ? 0 : passStringToWasm0(action, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+    var len1 = WASM_VECTOR_LEN;
+    wasm.signRequest(retptr, ptr0, len0, !isLikeNone(ttl_seconds), isLikeNone(ttl_seconds) ? BigInt(0) : ttl_seconds, ptr1, len1);
     var r0 = getDataViewMemory0().getInt32(retptr + 4 * 0, true);
     var r1 = getDataViewMemory0().getInt32(retptr + 4 * 1, true);
     var r2 = getDataViewMemory0().getInt32(retptr + 4 * 2, true);
@@ -1377,7 +1396,7 @@ function __wbg_get_imports() {
           const a = state0.a;
           state0.a = 0;
           try {
-            return __wasm_bindgen_func_elem_1382(a, state0.b, arg02, arg12);
+            return __wasm_bindgen_func_elem_1423(a, state0.b, arg02, arg12);
           } finally {
             state0.a = a;
           }
@@ -1557,11 +1576,11 @@ function __wbg_get_imports() {
       return addHeapObject(ret);
     },
     __wbindgen_cast_0000000000000001: function(arg0, arg1) {
-      const ret = makeMutClosure(arg0, arg1, wasm.__wasm_bindgen_func_elem_632, __wasm_bindgen_func_elem_633);
+      const ret = makeMutClosure(arg0, arg1, wasm.__wasm_bindgen_func_elem_645, __wasm_bindgen_func_elem_646);
       return addHeapObject(ret);
     },
     __wbindgen_cast_0000000000000002: function(arg0, arg1) {
-      const ret = makeMutClosure(arg0, arg1, wasm.__wasm_bindgen_func_elem_962, __wasm_bindgen_func_elem_963);
+      const ret = makeMutClosure(arg0, arg1, wasm.__wasm_bindgen_func_elem_975, __wasm_bindgen_func_elem_976);
       return addHeapObject(ret);
     },
     __wbindgen_cast_0000000000000003: function(arg0) {
@@ -1597,13 +1616,13 @@ function __wbg_get_imports() {
     "./idkit_wasm_bg.js": import0
   };
 }
-function __wasm_bindgen_func_elem_633(arg0, arg1) {
-  wasm.__wasm_bindgen_func_elem_633(arg0, arg1);
+function __wasm_bindgen_func_elem_646(arg0, arg1) {
+  wasm.__wasm_bindgen_func_elem_646(arg0, arg1);
 }
-function __wasm_bindgen_func_elem_963(arg0, arg1, arg2) {
+function __wasm_bindgen_func_elem_976(arg0, arg1, arg2) {
   try {
     const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);
-    wasm.__wasm_bindgen_func_elem_963(retptr, arg0, arg1, addHeapObject(arg2));
+    wasm.__wasm_bindgen_func_elem_976(retptr, arg0, arg1, addHeapObject(arg2));
     var r0 = getDataViewMemory0().getInt32(retptr + 4 * 0, true);
     var r1 = getDataViewMemory0().getInt32(retptr + 4 * 1, true);
     if (r1) {
@@ -1613,8 +1632,8 @@ function __wasm_bindgen_func_elem_963(arg0, arg1, arg2) {
     wasm.__wbindgen_add_to_stack_pointer(16);
   }
 }
-function __wasm_bindgen_func_elem_1382(arg0, arg1, arg2, arg3) {
-  wasm.__wasm_bindgen_func_elem_1382(arg0, arg1, addHeapObject(arg2), addHeapObject(arg3));
+function __wasm_bindgen_func_elem_1423(arg0, arg1, arg2, arg3) {
+  wasm.__wasm_bindgen_func_elem_1423(arg0, arg1, addHeapObject(arg2), addHeapObject(arg3));
 }
 var __wbindgen_enum_RequestCache = ["default", "no-store", "reload", "no-cache", "force-cache", "only-if-cached"];
 var __wbindgen_enum_RequestCredentials = ["omit", "same-origin", "include"];
@@ -1943,6 +1962,16 @@ async function initIDKit() {
   return wasmInitPromise;
 }
 
+// src/lib/debug.ts
+var _debug = false;
+function isDebug() {
+  if (_debug) return true;
+  return typeof window !== "undefined" && Boolean(window.IDKIT_DEBUG);
+}
+function setDebug(enabled) {
+  _debug = enabled;
+}
+
 // src/transports/native.ts
 var MINIAPP_VERIFY_ACTION = "miniapp-verify-action";
 function isInWorldApp() {
@@ -1958,9 +1987,10 @@ var _requestCounter = 0;
 var _activeNativeRequest = null;
 function createNativeRequest(wasmPayload, config, signalHashes = {}, legacySignalHash, version = 2) {
   if (_activeNativeRequest?.isPending()) {
-    console.warn(
-      "IDKit native request already in flight. Reusing active request."
-    );
+    if (isDebug())
+      console.warn(
+        "[IDKit] Native: request already in flight, reusing active request"
+      );
     return _activeNativeRequest;
   }
   const request2 = new NativeIDKitRequest(
@@ -1987,6 +2017,11 @@ var NativeIDKitRequest = class {
       const handleIncomingPayload = (responsePayload) => {
         if (this.completionResult) return;
         if (responsePayload?.status === "error") {
+          if (isDebug())
+            console.warn(
+              "[IDKit] Native: received error response",
+              responsePayload.error_code
+            );
           this.complete({
             success: false,
             error: responsePayload.error_code ?? "generic_error" /* GenericError */
@@ -2020,7 +2055,9 @@ var NativeIDKitRequest = class {
           this.miniKitHandler = miniKitHandler;
           miniKit.subscribe(MINIAPP_VERIFY_ACTION, miniKitHandler);
         }
-      } catch {
+      } catch (err) {
+        if (isDebug())
+          console.warn("[IDKit] Native: MiniKit subscribe failed", err);
       }
       const sendPayload = {
         command: "verify",
@@ -2030,16 +2067,29 @@ var NativeIDKitRequest = class {
       try {
         const w = window;
         if (w.webkit?.messageHandlers?.minikit) {
+          if (isDebug())
+            console.debug(
+              `[IDKit] Native: sending verify command (version=${version}, platform=ios)`
+            );
           w.webkit.messageHandlers.minikit.postMessage(sendPayload);
         } else if (w.Android) {
+          if (isDebug())
+            console.debug(
+              `[IDKit] Native: sending verify command (version=${version}, platform=android)`
+            );
           w.Android.postMessage(JSON.stringify(sendPayload));
         } else {
+          if (isDebug())
+            console.warn(
+              "[IDKit] Native: no native bridge found (no webkit/Android)"
+            );
           this.complete({
             success: false,
             error: "generic_error" /* GenericError */
           });
         }
-      } catch {
+      } catch (err) {
+        if (isDebug()) console.warn("[IDKit] Native: postMessage failed", err);
         this.complete({
           success: false,
           error: "generic_error" /* GenericError */
@@ -2050,6 +2100,11 @@ var NativeIDKitRequest = class {
   // Single entry point for finishing the request. Idempotent — first caller wins.
   complete(result) {
     if (this.completionResult) return;
+    if (isDebug())
+      console.debug(
+        "[IDKit] Native: request completed",
+        result.success ? "success" : `error=${result.error}`
+      );
     this.completionResult = result;
     this.cleanup();
     this.resolveFn?.(result);
@@ -2069,7 +2124,9 @@ var NativeIDKitRequest = class {
       try {
         const miniKit = window.MiniKit;
         miniKit?.unsubscribe?.(MINIAPP_VERIFY_ACTION);
-      } catch {
+      } catch (err) {
+        if (isDebug())
+          console.warn("[IDKit] Native: MiniKit unsubscribe failed", err);
       }
       this.miniKitHandler = null;
     }
@@ -2087,7 +2144,7 @@ var NativeIDKitRequest = class {
     return { type: "failed", error: this.completionResult.error };
   }
   async pollUntilCompletion(options) {
-    const timeout = options?.timeout ?? 3e5;
+    const timeout = options?.timeout ?? 9e5;
     const timeoutId = setTimeout(() => {
       this.complete({ success: false, error: "timeout" /* Timeout */ });
     }, timeout);
@@ -2120,14 +2177,15 @@ var NativeIDKitRequest = class {
 function nativeResultToIDKitResult(payload, config, signalHashes, legacySignalHash) {
   const p = payload;
   const rpNonce = config.rp_context?.nonce ?? "";
-  if ("responses" in p && Array.isArray(p.responses)) {
-    const items = p.responses;
-    if (p.session_id) {
+  if ("proof_response" in p && p.proof_response != null) {
+    const proof_response = p.proof_response;
+    const items = proof_response.responses ?? [];
+    if (proof_response.session_id) {
       return {
         protocol_version: "4.0",
-        nonce: p.nonce ?? rpNonce,
-        action_description: p.action_description,
-        session_id: p.session_id,
+        nonce: proof_response.nonce ?? rpNonce,
+        action_description: proof_response.action_description,
+        session_id: proof_response.session_id,
         responses: items.map((item) => ({
           identifier: item.identifier,
           signal_hash: signalHashes[item.identifier],
@@ -2141,9 +2199,9 @@ function nativeResultToIDKitResult(payload, config, signalHashes, legacySignalHa
     }
     return {
       protocol_version: "4.0",
-      nonce: p.nonce ?? rpNonce,
-      action: p.action ?? config.action ?? "",
-      action_description: p.action_description,
+      nonce: proof_response.nonce ?? rpNonce,
+      action: proof_response.action ?? config.action ?? "",
+      action_description: proof_response.action_description,
       responses: items.map((item) => ({
         identifier: item.identifier,
         signal_hash: signalHashes[item.identifier],
@@ -2189,6 +2247,7 @@ function nativeResultToIDKitResult(payload, config, signalHashes, legacySignalHa
 }
 
 // src/request.ts
+var SESSION_ID_PATTERN = /^session_[0-9a-fA-F]{128}$/;
 var IDKitRequestImpl = class {
   constructor(wasmRequest) {
     this.wasmRequest = wasmRequest;
@@ -2206,7 +2265,7 @@ var IDKitRequestImpl = class {
   }
   async pollUntilCompletion(options) {
     const pollInterval = options?.pollInterval ?? 1e3;
-    const timeout = options?.timeout ?? 3e5;
+    const timeout = options?.timeout ?? 9e5;
     const startTime = Date.now();
     while (true) {
       if (options?.signal?.aborted) {
@@ -2229,6 +2288,23 @@ var IDKitRequestImpl = class {
     }
   }
 };
+function CredentialRequest(credential_type, options) {
+  return {
+    type: credential_type,
+    signal: options?.signal,
+    genesis_issued_at_min: options?.genesis_issued_at_min,
+    expires_at_min: options?.expires_at_min
+  };
+}
+function any(...nodes) {
+  return { any: nodes };
+}
+function all(...nodes) {
+  return { all: nodes };
+}
+function enumerate(...nodes) {
+  return { enumerate: nodes };
+}
 function orbLegacy(opts = {}) {
   return { type: "OrbLegacy", signal: opts.signal };
 }
@@ -2264,6 +2340,7 @@ function createWasmBuilderFromConfig(config) {
       config.bridge_url ?? null,
       config.allow_legacy_proofs ?? false,
       config.override_connect_base_url ?? null,
+      config.return_to ?? null,
       config.environment ?? null
     );
   }
@@ -2275,6 +2352,7 @@ function createWasmBuilderFromConfig(config) {
       config.action_description ?? null,
       config.bridge_url ?? null,
       config.override_connect_base_url ?? null,
+      config.return_to ?? null,
       config.environment ?? null
     );
   }
@@ -2284,6 +2362,7 @@ function createWasmBuilderFromConfig(config) {
     config.action_description ?? null,
     config.bridge_url ?? null,
     config.override_connect_base_url ?? null,
+    config.return_to ?? null,
     config.environment ?? null
   );
 }
@@ -2318,7 +2397,7 @@ var IDKitBuilder2 = class {
         wasmResult.payload,
         this.config,
         wasmResult.signal_hashes ?? {},
-        wasmResult.legacy_signal_hash ?? void 0,
+        wasmResult.legacy_signal_hash,
         2
       );
     }
@@ -2344,6 +2423,11 @@ var IDKitBuilder2 = class {
    * ```
    */
   async preset(preset) {
+    if (this.config.type === "createSession" || this.config.type === "proveSession") {
+      throw new Error(
+        "Presets are not supported for session flows. Use .constraints() instead."
+      );
+    }
     await initIDKit();
     if (isInWorldApp()) {
       const verifyVersion = getWorldAppVerifyVersion();
@@ -2354,7 +2438,7 @@ var IDKitBuilder2 = class {
           wasmResult.payload,
           this.config,
           wasmResult.signal_hashes ?? {},
-          wasmResult.legacy_signal_hash ?? void 0,
+          wasmResult.legacy_signal_hash,
           2
         );
       }
@@ -2365,7 +2449,7 @@ var IDKitBuilder2 = class {
           wasmResult.payload,
           this.config,
           wasmResult.signal_hashes ?? {},
-          wasmResult.legacy_signal_hash ?? void 0,
+          wasmResult.legacy_signal_hash,
           1
         );
       } catch (err) {
@@ -2408,27 +2492,76 @@ function createRequest(config) {
     rp_context: config.rp_context,
     action_description: config.action_description,
     bridge_url: config.bridge_url,
+    return_to: config.return_to,
     allow_legacy_proofs: config.allow_legacy_proofs,
     override_connect_base_url: config.override_connect_base_url,
     environment: config.environment
   });
 }
+function createSession2(config) {
+  if (!config.app_id) {
+    throw new Error("app_id is required");
+  }
+  if (!config.rp_context) {
+    throw new Error(
+      "rp_context is required. Generate it on your backend using signRequest()."
+    );
+  }
+  return new IDKitBuilder2({
+    type: "createSession",
+    app_id: config.app_id,
+    rp_context: config.rp_context,
+    action_description: config.action_description,
+    bridge_url: config.bridge_url,
+    return_to: config.return_to,
+    override_connect_base_url: config.override_connect_base_url,
+    environment: config.environment
+  });
+}
+function proveSession2(sessionId, config) {
+  if (!sessionId) {
+    throw new Error("session_id is required");
+  }
+  if (!SESSION_ID_PATTERN.test(sessionId)) {
+    throw new Error(
+      "session_id must be in the format session_<128 hex characters>"
+    );
+  }
+  if (!config.app_id) {
+    throw new Error("app_id is required");
+  }
+  if (!config.rp_context) {
+    throw new Error(
+      "rp_context is required. Generate it on your backend using signRequest()."
+    );
+  }
+  return new IDKitBuilder2({
+    type: "proveSession",
+    session_id: sessionId,
+    app_id: config.app_id,
+    rp_context: config.rp_context,
+    action_description: config.action_description,
+    bridge_url: config.bridge_url,
+    return_to: config.return_to,
+    override_connect_base_url: config.override_connect_base_url,
+    environment: config.environment
+  });
+}
 var IDKit = {
   /** Create a new verification request */
   request: createRequest,
-  // TODO: Re-enable when World ID 4.0 is live
-  // /** Create a new session (no action, no existing session_id) */
-  // createSession,
-  // /** Prove an existing session (no action, has session_id) */
-  // proveSession,
-  // /** Create a CredentialRequest for a credential type */
-  // CredentialRequest,
-  // /** Create an OR constraint - at least one child must be satisfied */
-  // any,
-  // /** Create an AND constraint - all children must be satisfied */
-  // all,
-  // /** Create an enumerate constraint - all satisfiable children should be selected */
-  // enumerate,
+  /** Create a new session (no action, no existing session_id) */
+  createSession: createSession2,
+  /** Prove an existing session (no action, has session_id) */
+  proveSession: proveSession2,
+  /** Create a CredentialRequest for a credential type */
+  CredentialRequest,
+  /** Create an OR constraint - at least one child must be satisfied */
+  any,
+  /** Create an AND constraint - all children must be satisfied */
+  all,
+  /** Create an enumerate constraint - all satisfiable children should be selected */
+  enumerate,
   /** Create an OrbLegacy preset for World ID 3.0 legacy support */
   orbLegacy,
   /** Create a SecureDocumentLegacy preset for World ID 3.0 legacy support */
@@ -2476,11 +2609,16 @@ Object.defineProperty(exports, "signRequest", {
   enumerable: true,
   get: function () { return idkitServer.signRequest; }
 });
+exports.CredentialRequest = CredentialRequest;
 exports.IDKit = IDKit;
 exports.IDKitErrorCodes = IDKitErrorCodes;
+exports.all = all;
+exports.any = any;
 exports.deviceLegacy = deviceLegacy;
 exports.documentLegacy = documentLegacy;
+exports.enumerate = enumerate;
 exports.hashSignal = hashSignal2;
+exports.isDebug = isDebug;
 exports.isInWorldApp = isInWorldApp;
 exports.isNode = isNode;
 exports.isReactNative = isReactNative;
@@ -2488,3 +2626,4 @@ exports.isWeb = isWeb;
 exports.orbLegacy = orbLegacy;
 exports.secureDocumentLegacy = secureDocumentLegacy;
 exports.selfieCheckLegacy = selfieCheckLegacy;
+exports.setDebug = setDebug;