@worldcoin/idkit-core 4.0.15 → 4.1.0

package/dist/index.js

@@ -3,9 +3,9 @@ import { keccak_256 } from '@noble/hashes/sha3';
 import { hexToBytes, bytesToHex } from '@noble/hashes/utils';
 
 var __defProp = Object.defineProperty;
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
+var __export = (target, all2) => {
+  for (var name in all2)
+    __defProp(target, name, { get: all2[name], enumerable: true });
 };
 
 // src/types/result.ts
@@ -419,10 +419,11 @@ var IDKitBuilder = class _IDKitBuilder {
    * @param {string | null} [action_description]
    * @param {string | null} [bridge_url]
    * @param {string | null} [override_connect_base_url]
+   * @param {string | null} [return_to]
    * @param {string | null} [environment]
    * @returns {IDKitBuilder}
    */
-  static forCreateSession(app_id, rp_context, action_description, bridge_url, override_connect_base_url, environment) {
+  static forCreateSession(app_id, rp_context, action_description, bridge_url, override_connect_base_url, return_to, environment) {
     const ptr0 = passStringToWasm0(app_id, wasm.__wbindgen_export, wasm.__wbindgen_export2);
     const len0 = WASM_VECTOR_LEN;
     _assertClass(rp_context, RpContextWasm);
@@ -433,9 +434,11 @@ var IDKitBuilder = class _IDKitBuilder {
     var len3 = WASM_VECTOR_LEN;
     var ptr4 = isLikeNone(override_connect_base_url) ? 0 : passStringToWasm0(override_connect_base_url, wasm.__wbindgen_export, wasm.__wbindgen_export2);
     var len4 = WASM_VECTOR_LEN;
-    var ptr5 = isLikeNone(environment) ? 0 : passStringToWasm0(environment, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+    var ptr5 = isLikeNone(return_to) ? 0 : passStringToWasm0(return_to, wasm.__wbindgen_export, wasm.__wbindgen_export2);
     var len5 = WASM_VECTOR_LEN;
-    const ret = wasm.idkitbuilder_forCreateSession(ptr0, len0, ptr1, ptr2, len2, ptr3, len3, ptr4, len4, ptr5, len5);
+    var ptr6 = isLikeNone(environment) ? 0 : passStringToWasm0(environment, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+    var len6 = WASM_VECTOR_LEN;
+    const ret = wasm.idkitbuilder_forCreateSession(ptr0, len0, ptr1, ptr2, len2, ptr3, len3, ptr4, len4, ptr5, len5, ptr6, len6);
     return _IDKitBuilder.__wrap(ret);
   }
   /**
@@ -446,10 +449,11 @@ var IDKitBuilder = class _IDKitBuilder {
    * @param {string | null} [action_description]
    * @param {string | null} [bridge_url]
    * @param {string | null} [override_connect_base_url]
+   * @param {string | null} [return_to]
    * @param {string | null} [environment]
    * @returns {IDKitBuilder}
    */
-  static forProveSession(session_id, app_id, rp_context, action_description, bridge_url, override_connect_base_url, environment) {
+  static forProveSession(session_id, app_id, rp_context, action_description, bridge_url, override_connect_base_url, return_to, environment) {
     const ptr0 = passStringToWasm0(session_id, wasm.__wbindgen_export, wasm.__wbindgen_export2);
     const len0 = WASM_VECTOR_LEN;
     const ptr1 = passStringToWasm0(app_id, wasm.__wbindgen_export, wasm.__wbindgen_export2);
@@ -462,9 +466,11 @@ var IDKitBuilder = class _IDKitBuilder {
     var len4 = WASM_VECTOR_LEN;
     var ptr5 = isLikeNone(override_connect_base_url) ? 0 : passStringToWasm0(override_connect_base_url, wasm.__wbindgen_export, wasm.__wbindgen_export2);
     var len5 = WASM_VECTOR_LEN;
-    var ptr6 = isLikeNone(environment) ? 0 : passStringToWasm0(environment, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+    var ptr6 = isLikeNone(return_to) ? 0 : passStringToWasm0(return_to, wasm.__wbindgen_export, wasm.__wbindgen_export2);
     var len6 = WASM_VECTOR_LEN;
-    const ret = wasm.idkitbuilder_forProveSession(ptr0, len0, ptr1, len1, ptr2, ptr3, len3, ptr4, len4, ptr5, len5, ptr6, len6);
+    var ptr7 = isLikeNone(environment) ? 0 : passStringToWasm0(environment, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+    var len7 = WASM_VECTOR_LEN;
+    const ret = wasm.idkitbuilder_forProveSession(ptr0, len0, ptr1, len1, ptr2, ptr3, len3, ptr4, len4, ptr5, len5, ptr6, len6, ptr7, len7);
     return _IDKitBuilder.__wrap(ret);
   }
   /**
@@ -527,8 +533,8 @@ var IDKitBuilder = class _IDKitBuilder {
    * Builds a v1 (legacy) native payload from a preset (synchronous, no bridge connection).
    *
    * Used by the native transport when the World App only supports verify v1.
-   * Only legacy presets produce valid v1 payloads (constraints always have
-   * `Deprecated` verification level and will fail).
+   * Only legacy presets produce valid v1 payloads (constraint-based requests
+   * default to `Device` level and may not carry the correct action).
    *
    * # Errors
    *
@@ -561,9 +567,10 @@ var IDKitBuilder = class _IDKitBuilder {
    * @param {string | null | undefined} bridge_url
    * @param {boolean} allow_legacy_proofs
    * @param {string | null} [override_connect_base_url]
+   * @param {string | null} [return_to]
    * @param {string | null} [environment]
    */
-  constructor(app_id, action, rp_context, action_description, bridge_url, allow_legacy_proofs, override_connect_base_url, environment) {
+  constructor(app_id, action, rp_context, action_description, bridge_url, allow_legacy_proofs, override_connect_base_url, return_to, environment) {
     const ptr0 = passStringToWasm0(app_id, wasm.__wbindgen_export, wasm.__wbindgen_export2);
     const len0 = WASM_VECTOR_LEN;
     const ptr1 = passStringToWasm0(action, wasm.__wbindgen_export, wasm.__wbindgen_export2);
@@ -576,9 +583,11 @@ var IDKitBuilder = class _IDKitBuilder {
     var len4 = WASM_VECTOR_LEN;
     var ptr5 = isLikeNone(override_connect_base_url) ? 0 : passStringToWasm0(override_connect_base_url, wasm.__wbindgen_export, wasm.__wbindgen_export2);
     var len5 = WASM_VECTOR_LEN;
-    var ptr6 = isLikeNone(environment) ? 0 : passStringToWasm0(environment, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+    var ptr6 = isLikeNone(return_to) ? 0 : passStringToWasm0(return_to, wasm.__wbindgen_export, wasm.__wbindgen_export2);
     var len6 = WASM_VECTOR_LEN;
-    const ret = wasm.idkitbuilder_new(ptr0, len0, ptr1, len1, ptr2, ptr3, len3, ptr4, len4, allow_legacy_proofs, ptr5, len5, ptr6, len6);
+    var ptr7 = isLikeNone(environment) ? 0 : passStringToWasm0(environment, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+    var len7 = WASM_VECTOR_LEN;
+    const ret = wasm.idkitbuilder_new(ptr0, len0, ptr1, len1, ptr2, ptr3, len3, ptr4, len4, allow_legacy_proofs, ptr5, len5, ptr6, len6, ptr7, len7);
     this.__wbg_ptr = ret >>> 0;
     IDKitBuilderFinalization.register(this, this.__wbg_ptr, this);
     return this;
@@ -963,12 +972,14 @@ function base64Encode(data) {
     wasm.__wbindgen_export4(deferred2_0, deferred2_1, 1);
   }
 }
-function computeRpSignatureMessage(nonce, created_at, expires_at) {
+function computeRpSignatureMessage(nonce, created_at, expires_at, action) {
   try {
     const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);
     const ptr0 = passStringToWasm0(nonce, wasm.__wbindgen_export, wasm.__wbindgen_export2);
     const len0 = WASM_VECTOR_LEN;
-    wasm.computeRpSignatureMessage(retptr, ptr0, len0, created_at, expires_at);
+    var ptr1 = isLikeNone(action) ? 0 : passStringToWasm0(action, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+    var len1 = WASM_VECTOR_LEN;
+    wasm.computeRpSignatureMessage(retptr, ptr0, len0, created_at, expires_at, ptr1, len1);
     var r0 = getDataViewMemory0().getInt32(retptr + 4 * 0, true);
     var r1 = getDataViewMemory0().getInt32(retptr + 4 * 1, true);
     var r2 = getDataViewMemory0().getInt32(retptr + 4 * 2, true);
@@ -976,14 +987,14 @@ function computeRpSignatureMessage(nonce, created_at, expires_at) {
     if (r3) {
       throw takeObject(r2);
     }
-    var v2 = getArrayU8FromWasm0(r0, r1).slice();
+    var v3 = getArrayU8FromWasm0(r0, r1).slice();
     wasm.__wbindgen_export4(r0, r1 * 1, 1);
-    return v2;
+    return v3;
   } finally {
     wasm.__wbindgen_add_to_stack_pointer(16);
   }
 }
-function createSession(app_id, rp_context, action_description, bridge_url, override_connect_base_url, environment) {
+function createSession(app_id, rp_context, action_description, bridge_url, override_connect_base_url, return_to, environment) {
   const ptr0 = passStringToWasm0(app_id, wasm.__wbindgen_export, wasm.__wbindgen_export2);
   const len0 = WASM_VECTOR_LEN;
   _assertClass(rp_context, RpContextWasm);
@@ -994,9 +1005,11 @@ function createSession(app_id, rp_context, action_description, bridge_url, overr
   var len3 = WASM_VECTOR_LEN;
   var ptr4 = isLikeNone(override_connect_base_url) ? 0 : passStringToWasm0(override_connect_base_url, wasm.__wbindgen_export, wasm.__wbindgen_export2);
   var len4 = WASM_VECTOR_LEN;
-  var ptr5 = isLikeNone(environment) ? 0 : passStringToWasm0(environment, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+  var ptr5 = isLikeNone(return_to) ? 0 : passStringToWasm0(return_to, wasm.__wbindgen_export, wasm.__wbindgen_export2);
   var len5 = WASM_VECTOR_LEN;
-  const ret = wasm.createSession(ptr0, len0, ptr1, ptr2, len2, ptr3, len3, ptr4, len4, ptr5, len5);
+  var ptr6 = isLikeNone(environment) ? 0 : passStringToWasm0(environment, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+  var len6 = WASM_VECTOR_LEN;
+  const ret = wasm.createSession(ptr0, len0, ptr1, ptr2, len2, ptr3, len3, ptr4, len4, ptr5, len5, ptr6, len6);
   return IDKitBuilder.__wrap(ret);
 }
 function hashSignal(signal) {
@@ -1027,7 +1040,7 @@ function hashSignal(signal) {
 function init_wasm() {
   wasm.init_wasm();
 }
-function proveSession(session_id, app_id, rp_context, action_description, bridge_url, override_connect_base_url, environment) {
+function proveSession(session_id, app_id, rp_context, action_description, bridge_url, override_connect_base_url, return_to, environment) {
   const ptr0 = passStringToWasm0(session_id, wasm.__wbindgen_export, wasm.__wbindgen_export2);
   const len0 = WASM_VECTOR_LEN;
   const ptr1 = passStringToWasm0(app_id, wasm.__wbindgen_export, wasm.__wbindgen_export2);
@@ -1040,12 +1053,14 @@ function proveSession(session_id, app_id, rp_context, action_description, bridge
   var len4 = WASM_VECTOR_LEN;
   var ptr5 = isLikeNone(override_connect_base_url) ? 0 : passStringToWasm0(override_connect_base_url, wasm.__wbindgen_export, wasm.__wbindgen_export2);
   var len5 = WASM_VECTOR_LEN;
-  var ptr6 = isLikeNone(environment) ? 0 : passStringToWasm0(environment, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+  var ptr6 = isLikeNone(return_to) ? 0 : passStringToWasm0(return_to, wasm.__wbindgen_export, wasm.__wbindgen_export2);
   var len6 = WASM_VECTOR_LEN;
-  const ret = wasm.proveSession(ptr0, len0, ptr1, len1, ptr2, ptr3, len3, ptr4, len4, ptr5, len5, ptr6, len6);
+  var ptr7 = isLikeNone(environment) ? 0 : passStringToWasm0(environment, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+  var len7 = WASM_VECTOR_LEN;
+  const ret = wasm.proveSession(ptr0, len0, ptr1, len1, ptr2, ptr3, len3, ptr4, len4, ptr5, len5, ptr6, len6, ptr7, len7);
   return IDKitBuilder.__wrap(ret);
 }
-function request(app_id, action, rp_context, action_description, bridge_url, allow_legacy_proofs, override_connect_base_url, environment) {
+function request(app_id, action, rp_context, action_description, bridge_url, allow_legacy_proofs, override_connect_base_url, return_to, environment) {
   const ptr0 = passStringToWasm0(app_id, wasm.__wbindgen_export, wasm.__wbindgen_export2);
   const len0 = WASM_VECTOR_LEN;
   const ptr1 = passStringToWasm0(action, wasm.__wbindgen_export, wasm.__wbindgen_export2);
@@ -1058,17 +1073,21 @@ function request(app_id, action, rp_context, action_description, bridge_url, all
   var len4 = WASM_VECTOR_LEN;
   var ptr5 = isLikeNone(override_connect_base_url) ? 0 : passStringToWasm0(override_connect_base_url, wasm.__wbindgen_export, wasm.__wbindgen_export2);
   var len5 = WASM_VECTOR_LEN;
-  var ptr6 = isLikeNone(environment) ? 0 : passStringToWasm0(environment, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+  var ptr6 = isLikeNone(return_to) ? 0 : passStringToWasm0(return_to, wasm.__wbindgen_export, wasm.__wbindgen_export2);
   var len6 = WASM_VECTOR_LEN;
-  const ret = wasm.request(ptr0, len0, ptr1, len1, ptr2, ptr3, len3, ptr4, len4, allow_legacy_proofs, ptr5, len5, ptr6, len6);
+  var ptr7 = isLikeNone(environment) ? 0 : passStringToWasm0(environment, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+  var len7 = WASM_VECTOR_LEN;
+  const ret = wasm.request(ptr0, len0, ptr1, len1, ptr2, ptr3, len3, ptr4, len4, allow_legacy_proofs, ptr5, len5, ptr6, len6, ptr7, len7);
   return IDKitBuilder.__wrap(ret);
 }
-function signRequest(signing_key_hex, ttl_seconds) {
+function signRequest(signing_key_hex, ttl_seconds, action) {
   try {
     const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);
     const ptr0 = passStringToWasm0(signing_key_hex, wasm.__wbindgen_export, wasm.__wbindgen_export2);
     const len0 = WASM_VECTOR_LEN;
-    wasm.signRequest(retptr, ptr0, len0, !isLikeNone(ttl_seconds), isLikeNone(ttl_seconds) ? BigInt(0) : ttl_seconds);
+    var ptr1 = isLikeNone(action) ? 0 : passStringToWasm0(action, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+    var len1 = WASM_VECTOR_LEN;
+    wasm.signRequest(retptr, ptr0, len0, !isLikeNone(ttl_seconds), isLikeNone(ttl_seconds) ? BigInt(0) : ttl_seconds, ptr1, len1);
     var r0 = getDataViewMemory0().getInt32(retptr + 4 * 0, true);
     var r1 = getDataViewMemory0().getInt32(retptr + 4 * 1, true);
     var r2 = getDataViewMemory0().getInt32(retptr + 4 * 2, true);
@@ -1374,7 +1393,7 @@ function __wbg_get_imports() {
           const a = state0.a;
           state0.a = 0;
           try {
-            return __wasm_bindgen_func_elem_1382(a, state0.b, arg02, arg12);
+            return __wasm_bindgen_func_elem_1423(a, state0.b, arg02, arg12);
           } finally {
             state0.a = a;
           }
@@ -1554,11 +1573,11 @@ function __wbg_get_imports() {
       return addHeapObject(ret);
     },
     __wbindgen_cast_0000000000000001: function(arg0, arg1) {
-      const ret = makeMutClosure(arg0, arg1, wasm.__wasm_bindgen_func_elem_632, __wasm_bindgen_func_elem_633);
+      const ret = makeMutClosure(arg0, arg1, wasm.__wasm_bindgen_func_elem_645, __wasm_bindgen_func_elem_646);
       return addHeapObject(ret);
     },
     __wbindgen_cast_0000000000000002: function(arg0, arg1) {
-      const ret = makeMutClosure(arg0, arg1, wasm.__wasm_bindgen_func_elem_962, __wasm_bindgen_func_elem_963);
+      const ret = makeMutClosure(arg0, arg1, wasm.__wasm_bindgen_func_elem_975, __wasm_bindgen_func_elem_976);
       return addHeapObject(ret);
     },
     __wbindgen_cast_0000000000000003: function(arg0) {
@@ -1594,13 +1613,13 @@ function __wbg_get_imports() {
     "./idkit_wasm_bg.js": import0
   };
 }
-function __wasm_bindgen_func_elem_633(arg0, arg1) {
-  wasm.__wasm_bindgen_func_elem_633(arg0, arg1);
+function __wasm_bindgen_func_elem_646(arg0, arg1) {
+  wasm.__wasm_bindgen_func_elem_646(arg0, arg1);
 }
-function __wasm_bindgen_func_elem_963(arg0, arg1, arg2) {
+function __wasm_bindgen_func_elem_976(arg0, arg1, arg2) {
   try {
     const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);
-    wasm.__wasm_bindgen_func_elem_963(retptr, arg0, arg1, addHeapObject(arg2));
+    wasm.__wasm_bindgen_func_elem_976(retptr, arg0, arg1, addHeapObject(arg2));
     var r0 = getDataViewMemory0().getInt32(retptr + 4 * 0, true);
     var r1 = getDataViewMemory0().getInt32(retptr + 4 * 1, true);
     if (r1) {
@@ -1610,8 +1629,8 @@ function __wasm_bindgen_func_elem_963(arg0, arg1, arg2) {
     wasm.__wbindgen_add_to_stack_pointer(16);
   }
 }
-function __wasm_bindgen_func_elem_1382(arg0, arg1, arg2, arg3) {
-  wasm.__wasm_bindgen_func_elem_1382(arg0, arg1, addHeapObject(arg2), addHeapObject(arg3));
+function __wasm_bindgen_func_elem_1423(arg0, arg1, arg2, arg3) {
+  wasm.__wasm_bindgen_func_elem_1423(arg0, arg1, addHeapObject(arg2), addHeapObject(arg3));
 }
 var __wbindgen_enum_RequestCache = ["default", "no-store", "reload", "no-cache", "force-cache", "only-if-cached"];
 var __wbindgen_enum_RequestCredentials = ["omit", "same-origin", "include"];
@@ -1940,6 +1959,16 @@ async function initIDKit() {
   return wasmInitPromise;
 }
 
+// src/lib/debug.ts
+var _debug = false;
+function isDebug() {
+  if (_debug) return true;
+  return typeof window !== "undefined" && Boolean(window.IDKIT_DEBUG);
+}
+function setDebug(enabled) {
+  _debug = enabled;
+}
+
 // src/transports/native.ts
 var MINIAPP_VERIFY_ACTION = "miniapp-verify-action";
 function isInWorldApp() {
@@ -1955,9 +1984,10 @@ var _requestCounter = 0;
 var _activeNativeRequest = null;
 function createNativeRequest(wasmPayload, config, signalHashes = {}, legacySignalHash, version = 2) {
   if (_activeNativeRequest?.isPending()) {
-    console.warn(
-      "IDKit native request already in flight. Reusing active request."
-    );
+    if (isDebug())
+      console.warn(
+        "[IDKit] Native: request already in flight, reusing active request"
+      );
     return _activeNativeRequest;
   }
   const request2 = new NativeIDKitRequest(
@@ -1984,6 +2014,11 @@ var NativeIDKitRequest = class {
       const handleIncomingPayload = (responsePayload) => {
         if (this.completionResult) return;
         if (responsePayload?.status === "error") {
+          if (isDebug())
+            console.warn(
+              "[IDKit] Native: received error response",
+              responsePayload.error_code
+            );
           this.complete({
             success: false,
             error: responsePayload.error_code ?? "generic_error" /* GenericError */
@@ -2017,7 +2052,9 @@ var NativeIDKitRequest = class {
           this.miniKitHandler = miniKitHandler;
           miniKit.subscribe(MINIAPP_VERIFY_ACTION, miniKitHandler);
         }
-      } catch {
+      } catch (err) {
+        if (isDebug())
+          console.warn("[IDKit] Native: MiniKit subscribe failed", err);
       }
       const sendPayload = {
         command: "verify",
@@ -2027,16 +2064,29 @@ var NativeIDKitRequest = class {
       try {
         const w = window;
         if (w.webkit?.messageHandlers?.minikit) {
+          if (isDebug())
+            console.debug(
+              `[IDKit] Native: sending verify command (version=${version}, platform=ios)`
+            );
           w.webkit.messageHandlers.minikit.postMessage(sendPayload);
         } else if (w.Android) {
+          if (isDebug())
+            console.debug(
+              `[IDKit] Native: sending verify command (version=${version}, platform=android)`
+            );
           w.Android.postMessage(JSON.stringify(sendPayload));
         } else {
+          if (isDebug())
+            console.warn(
+              "[IDKit] Native: no native bridge found (no webkit/Android)"
+            );
           this.complete({
             success: false,
             error: "generic_error" /* GenericError */
           });
         }
-      } catch {
+      } catch (err) {
+        if (isDebug()) console.warn("[IDKit] Native: postMessage failed", err);
         this.complete({
           success: false,
           error: "generic_error" /* GenericError */
@@ -2047,6 +2097,11 @@ var NativeIDKitRequest = class {
   // Single entry point for finishing the request. Idempotent — first caller wins.
   complete(result) {
     if (this.completionResult) return;
+    if (isDebug())
+      console.debug(
+        "[IDKit] Native: request completed",
+        result.success ? "success" : `error=${result.error}`
+      );
     this.completionResult = result;
     this.cleanup();
     this.resolveFn?.(result);
@@ -2066,7 +2121,9 @@ var NativeIDKitRequest = class {
       try {
         const miniKit = window.MiniKit;
         miniKit?.unsubscribe?.(MINIAPP_VERIFY_ACTION);
-      } catch {
+      } catch (err) {
+        if (isDebug())
+          console.warn("[IDKit] Native: MiniKit unsubscribe failed", err);
       }
       this.miniKitHandler = null;
     }
@@ -2084,7 +2141,7 @@ var NativeIDKitRequest = class {
     return { type: "failed", error: this.completionResult.error };
   }
   async pollUntilCompletion(options) {
-    const timeout = options?.timeout ?? 3e5;
+    const timeout = options?.timeout ?? 9e5;
     const timeoutId = setTimeout(() => {
       this.complete({ success: false, error: "timeout" /* Timeout */ });
     }, timeout);
@@ -2117,14 +2174,15 @@ var NativeIDKitRequest = class {
 function nativeResultToIDKitResult(payload, config, signalHashes, legacySignalHash) {
   const p = payload;
   const rpNonce = config.rp_context?.nonce ?? "";
-  if ("responses" in p && Array.isArray(p.responses)) {
-    const items = p.responses;
-    if (p.session_id) {
+  if ("proof_response" in p && p.proof_response != null) {
+    const proof_response = p.proof_response;
+    const items = proof_response.responses ?? [];
+    if (proof_response.session_id) {
       return {
         protocol_version: "4.0",
-        nonce: p.nonce ?? rpNonce,
-        action_description: p.action_description,
-        session_id: p.session_id,
+        nonce: proof_response.nonce ?? rpNonce,
+        action_description: proof_response.action_description,
+        session_id: proof_response.session_id,
         responses: items.map((item) => ({
           identifier: item.identifier,
           signal_hash: signalHashes[item.identifier],
@@ -2138,9 +2196,9 @@ function nativeResultToIDKitResult(payload, config, signalHashes, legacySignalHa
     }
     return {
       protocol_version: "4.0",
-      nonce: p.nonce ?? rpNonce,
-      action: p.action ?? config.action ?? "",
-      action_description: p.action_description,
+      nonce: proof_response.nonce ?? rpNonce,
+      action: proof_response.action ?? config.action ?? "",
+      action_description: proof_response.action_description,
       responses: items.map((item) => ({
         identifier: item.identifier,
         signal_hash: signalHashes[item.identifier],
@@ -2186,6 +2244,7 @@ function nativeResultToIDKitResult(payload, config, signalHashes, legacySignalHa
 }
 
 // src/request.ts
+var SESSION_ID_PATTERN = /^session_[0-9a-fA-F]{128}$/;
 var IDKitRequestImpl = class {
   constructor(wasmRequest) {
     this.wasmRequest = wasmRequest;
@@ -2203,7 +2262,7 @@ var IDKitRequestImpl = class {
   }
   async pollUntilCompletion(options) {
     const pollInterval = options?.pollInterval ?? 1e3;
-    const timeout = options?.timeout ?? 3e5;
+    const timeout = options?.timeout ?? 9e5;
     const startTime = Date.now();
     while (true) {
       if (options?.signal?.aborted) {
@@ -2226,6 +2285,23 @@ var IDKitRequestImpl = class {
     }
   }
 };
+function CredentialRequest(credential_type, options) {
+  return {
+    type: credential_type,
+    signal: options?.signal,
+    genesis_issued_at_min: options?.genesis_issued_at_min,
+    expires_at_min: options?.expires_at_min
+  };
+}
+function any(...nodes) {
+  return { any: nodes };
+}
+function all(...nodes) {
+  return { all: nodes };
+}
+function enumerate(...nodes) {
+  return { enumerate: nodes };
+}
 function orbLegacy(opts = {}) {
   return { type: "OrbLegacy", signal: opts.signal };
 }
@@ -2261,6 +2337,7 @@ function createWasmBuilderFromConfig(config) {
       config.bridge_url ?? null,
       config.allow_legacy_proofs ?? false,
       config.override_connect_base_url ?? null,
+      config.return_to ?? null,
       config.environment ?? null
     );
   }
@@ -2272,6 +2349,7 @@ function createWasmBuilderFromConfig(config) {
       config.action_description ?? null,
       config.bridge_url ?? null,
       config.override_connect_base_url ?? null,
+      config.return_to ?? null,
       config.environment ?? null
     );
   }
@@ -2281,6 +2359,7 @@ function createWasmBuilderFromConfig(config) {
     config.action_description ?? null,
     config.bridge_url ?? null,
     config.override_connect_base_url ?? null,
+    config.return_to ?? null,
     config.environment ?? null
   );
 }
@@ -2315,7 +2394,7 @@ var IDKitBuilder2 = class {
         wasmResult.payload,
         this.config,
         wasmResult.signal_hashes ?? {},
-        wasmResult.legacy_signal_hash ?? void 0,
+        wasmResult.legacy_signal_hash,
         2
       );
     }
@@ -2341,6 +2420,11 @@ var IDKitBuilder2 = class {
    * ```
    */
   async preset(preset) {
+    if (this.config.type === "createSession" || this.config.type === "proveSession") {
+      throw new Error(
+        "Presets are not supported for session flows. Use .constraints() instead."
+      );
+    }
     await initIDKit();
     if (isInWorldApp()) {
       const verifyVersion = getWorldAppVerifyVersion();
@@ -2351,7 +2435,7 @@ var IDKitBuilder2 = class {
           wasmResult.payload,
           this.config,
           wasmResult.signal_hashes ?? {},
-          wasmResult.legacy_signal_hash ?? void 0,
+          wasmResult.legacy_signal_hash,
           2
         );
       }
@@ -2362,7 +2446,7 @@ var IDKitBuilder2 = class {
           wasmResult.payload,
           this.config,
           wasmResult.signal_hashes ?? {},
-          wasmResult.legacy_signal_hash ?? void 0,
+          wasmResult.legacy_signal_hash,
           1
         );
       } catch (err) {
@@ -2405,27 +2489,76 @@ function createRequest(config) {
     rp_context: config.rp_context,
     action_description: config.action_description,
     bridge_url: config.bridge_url,
+    return_to: config.return_to,
     allow_legacy_proofs: config.allow_legacy_proofs,
     override_connect_base_url: config.override_connect_base_url,
     environment: config.environment
   });
 }
+function createSession2(config) {
+  if (!config.app_id) {
+    throw new Error("app_id is required");
+  }
+  if (!config.rp_context) {
+    throw new Error(
+      "rp_context is required. Generate it on your backend using signRequest()."
+    );
+  }
+  return new IDKitBuilder2({
+    type: "createSession",
+    app_id: config.app_id,
+    rp_context: config.rp_context,
+    action_description: config.action_description,
+    bridge_url: config.bridge_url,
+    return_to: config.return_to,
+    override_connect_base_url: config.override_connect_base_url,
+    environment: config.environment
+  });
+}
+function proveSession2(sessionId, config) {
+  if (!sessionId) {
+    throw new Error("session_id is required");
+  }
+  if (!SESSION_ID_PATTERN.test(sessionId)) {
+    throw new Error(
+      "session_id must be in the format session_<128 hex characters>"
+    );
+  }
+  if (!config.app_id) {
+    throw new Error("app_id is required");
+  }
+  if (!config.rp_context) {
+    throw new Error(
+      "rp_context is required. Generate it on your backend using signRequest()."
+    );
+  }
+  return new IDKitBuilder2({
+    type: "proveSession",
+    session_id: sessionId,
+    app_id: config.app_id,
+    rp_context: config.rp_context,
+    action_description: config.action_description,
+    bridge_url: config.bridge_url,
+    return_to: config.return_to,
+    override_connect_base_url: config.override_connect_base_url,
+    environment: config.environment
+  });
+}
 var IDKit = {
   /** Create a new verification request */
   request: createRequest,
-  // TODO: Re-enable when World ID 4.0 is live
-  // /** Create a new session (no action, no existing session_id) */
-  // createSession,
-  // /** Prove an existing session (no action, has session_id) */
-  // proveSession,
-  // /** Create a CredentialRequest for a credential type */
-  // CredentialRequest,
-  // /** Create an OR constraint - at least one child must be satisfied */
-  // any,
-  // /** Create an AND constraint - all children must be satisfied */
-  // all,
-  // /** Create an enumerate constraint - all satisfiable children should be selected */
-  // enumerate,
+  /** Create a new session (no action, no existing session_id) */
+  createSession: createSession2,
+  /** Prove an existing session (no action, has session_id) */
+  proveSession: proveSession2,
+  /** Create a CredentialRequest for a credential type */
+  CredentialRequest,
+  /** Create an OR constraint - at least one child must be satisfied */
+  any,
+  /** Create an AND constraint - all children must be satisfied */
+  all,
+  /** Create an enumerate constraint - all satisfiable children should be selected */
+  enumerate,
   /** Create an OrbLegacy preset for World ID 3.0 legacy support */
   orbLegacy,
   /** Create a SecureDocumentLegacy preset for World ID 3.0 legacy support */
@@ -2469,4 +2602,4 @@ function isValidHex(s) {
   return /^[0-9a-fA-F]+$/.test(s);
 }
 
-export { IDKit, IDKitErrorCodes, deviceLegacy, documentLegacy, hashSignal2 as hashSignal, isInWorldApp, isNode, isReactNative, isWeb, orbLegacy, secureDocumentLegacy, selfieCheckLegacy };
+export { CredentialRequest, IDKit, IDKitErrorCodes, all, any, deviceLegacy, documentLegacy, enumerate, hashSignal2 as hashSignal, isDebug, isInWorldApp, isNode, isReactNative, isWeb, orbLegacy, secureDocumentLegacy, selfieCheckLegacy, setDebug };

package/dist/session.cjs

@@ -0,0 +1,10 @@
+'use strict';
+
+var idkitServer = require('@worldcoin/idkit-server');
+
+
+
+Object.defineProperty(exports, "getSessionCommitment", {
+  enumerable: true,
+  get: function () { return idkitServer.getSessionCommitment; }
+});

package/dist/session.d.cts

@@ -0,0 +1 @@
+export { getSessionCommitment } from '@worldcoin/idkit-server';

package/dist/session.d.ts

@@ -0,0 +1 @@
+export { getSessionCommitment } from '@worldcoin/idkit-server';

package/dist/session.js

@@ -0,0 +1 @@
+export { getSessionCommitment } from '@worldcoin/idkit-server';

package/dist/signing.d.cts

@@ -1 +1 @@
-export { RpSignature, computeRpSignatureMessage, signRequest } from '@worldcoin/idkit-server';
+export { RpSignature, SignRequestParams, computeRpSignatureMessage, signRequest } from '@worldcoin/idkit-server';

package/dist/signing.d.ts

@@ -1 +1 @@
-export { RpSignature, computeRpSignatureMessage, signRequest } from '@worldcoin/idkit-server';
+export { RpSignature, SignRequestParams, computeRpSignatureMessage, signRequest } from '@worldcoin/idkit-server';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@worldcoin/idkit-core",
-  "version": "4.0.15",
+  "version": "4.1.0",
   "description": "Core IDKit SDK for World ID - Pure TypeScript, no dependencies",
   "type": "module",
   "main": "./dist/index.cjs",
@@ -21,6 +21,11 @@
       "types": "./dist/hashing.d.ts",
       "import": "./dist/hashing.js",
       "require": "./dist/hashing.cjs"
+    },
+    "./session": {
+      "types": "./dist/session.d.ts",
+      "import": "./dist/session.js",
+      "require": "./dist/session.cjs"
     }
   },
   "files": [
@@ -52,7 +57,7 @@
   },
   "dependencies": {
     "@noble/hashes": "^1.7.2",
-    "@worldcoin/idkit-server": "1.0.0"
+    "@worldcoin/idkit-server": "1.1.0"
   },
   "devDependencies": {
     "@types/node": "^20.19.30",