@worldcoin/idkit-core 4.0.9 → 4.0.10

package/dist/index.cjs

@@ -249,40 +249,6 @@ function _assertClass(instance, klass) {
     throw new Error(`expected instance of ${klass.name}`);
   }
 }
-function createSession(app_id, rp_context, action_description, bridge_url, override_connect_base_url, environment) {
-  const ptr0 = passStringToWasm0(app_id, wasm.__wbindgen_export, wasm.__wbindgen_export2);
-  const len0 = WASM_VECTOR_LEN;
-  _assertClass(rp_context, RpContextWasm);
-  var ptr1 = rp_context.__destroy_into_raw();
-  var ptr2 = isLikeNone(action_description) ? 0 : passStringToWasm0(action_description, wasm.__wbindgen_export, wasm.__wbindgen_export2);
-  var len2 = WASM_VECTOR_LEN;
-  var ptr3 = isLikeNone(bridge_url) ? 0 : passStringToWasm0(bridge_url, wasm.__wbindgen_export, wasm.__wbindgen_export2);
-  var len3 = WASM_VECTOR_LEN;
-  var ptr4 = isLikeNone(override_connect_base_url) ? 0 : passStringToWasm0(override_connect_base_url, wasm.__wbindgen_export, wasm.__wbindgen_export2);
-  var len4 = WASM_VECTOR_LEN;
-  var ptr5 = isLikeNone(environment) ? 0 : passStringToWasm0(environment, wasm.__wbindgen_export, wasm.__wbindgen_export2);
-  var len5 = WASM_VECTOR_LEN;
-  const ret = wasm.createSession(ptr0, len0, ptr1, ptr2, len2, ptr3, len3, ptr4, len4, ptr5, len5);
-  return IDKitBuilder.__wrap(ret);
-}
-function request(app_id, action, rp_context, action_description, bridge_url, allow_legacy_proofs, override_connect_base_url, environment) {
-  const ptr0 = passStringToWasm0(app_id, wasm.__wbindgen_export, wasm.__wbindgen_export2);
-  const len0 = WASM_VECTOR_LEN;
-  const ptr1 = passStringToWasm0(action, wasm.__wbindgen_export, wasm.__wbindgen_export2);
-  const len1 = WASM_VECTOR_LEN;
-  _assertClass(rp_context, RpContextWasm);
-  var ptr2 = rp_context.__destroy_into_raw();
-  var ptr3 = isLikeNone(action_description) ? 0 : passStringToWasm0(action_description, wasm.__wbindgen_export, wasm.__wbindgen_export2);
-  var len3 = WASM_VECTOR_LEN;
-  var ptr4 = isLikeNone(bridge_url) ? 0 : passStringToWasm0(bridge_url, wasm.__wbindgen_export, wasm.__wbindgen_export2);
-  var len4 = WASM_VECTOR_LEN;
-  var ptr5 = isLikeNone(override_connect_base_url) ? 0 : passStringToWasm0(override_connect_base_url, wasm.__wbindgen_export, wasm.__wbindgen_export2);
-  var len5 = WASM_VECTOR_LEN;
-  var ptr6 = isLikeNone(environment) ? 0 : passStringToWasm0(environment, wasm.__wbindgen_export, wasm.__wbindgen_export2);
-  var len6 = WASM_VECTOR_LEN;
-  const ret = wasm.idkitbuilder_new(ptr0, len0, ptr1, len1, ptr2, ptr3, len3, ptr4, len4, allow_legacy_proofs, ptr5, len5, ptr6, len6);
-  return IDKitBuilder.__wrap(ret);
-}
 function base64Decode(data) {
   try {
     const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);
@@ -321,6 +287,22 @@ function proveSession(session_id, app_id, rp_context, action_description, bridge
   const ret = wasm.idkitbuilder_forProveSession(ptr0, len0, ptr1, len1, ptr2, ptr3, len3, ptr4, len4, ptr5, len5, ptr6, len6);
   return IDKitBuilder.__wrap(ret);
 }
+function createSession(app_id, rp_context, action_description, bridge_url, override_connect_base_url, environment) {
+  const ptr0 = passStringToWasm0(app_id, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+  const len0 = WASM_VECTOR_LEN;
+  _assertClass(rp_context, RpContextWasm);
+  var ptr1 = rp_context.__destroy_into_raw();
+  var ptr2 = isLikeNone(action_description) ? 0 : passStringToWasm0(action_description, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+  var len2 = WASM_VECTOR_LEN;
+  var ptr3 = isLikeNone(bridge_url) ? 0 : passStringToWasm0(bridge_url, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+  var len3 = WASM_VECTOR_LEN;
+  var ptr4 = isLikeNone(override_connect_base_url) ? 0 : passStringToWasm0(override_connect_base_url, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+  var len4 = WASM_VECTOR_LEN;
+  var ptr5 = isLikeNone(environment) ? 0 : passStringToWasm0(environment, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+  var len5 = WASM_VECTOR_LEN;
+  const ret = wasm.createSession(ptr0, len0, ptr1, ptr2, len2, ptr3, len3, ptr4, len4, ptr5, len5);
+  return IDKitBuilder.__wrap(ret);
+}
 function passArray8ToWasm0(arg, malloc) {
   const ptr = malloc(arg.length * 1, 1) >>> 0;
   getUint8ArrayMemory0().set(arg, ptr / 1);
@@ -345,27 +327,23 @@ function base64Encode(data) {
     wasm.__wbindgen_export4(deferred2_0, deferred2_1, 1);
   }
 }
-function init_wasm() {
-  wasm.init_wasm();
-}
-function signRequest(action, signing_key_hex, ttl_seconds) {
-  try {
-    const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);
-    const ptr0 = passStringToWasm0(action, wasm.__wbindgen_export, wasm.__wbindgen_export2);
-    const len0 = WASM_VECTOR_LEN;
-    const ptr1 = passStringToWasm0(signing_key_hex, wasm.__wbindgen_export, wasm.__wbindgen_export2);
-    const len1 = WASM_VECTOR_LEN;
-    wasm.signRequest(retptr, ptr0, len0, ptr1, len1, !isLikeNone(ttl_seconds), isLikeNone(ttl_seconds) ? BigInt(0) : ttl_seconds);
-    var r0 = getDataViewMemory0().getInt32(retptr + 4 * 0, true);
-    var r1 = getDataViewMemory0().getInt32(retptr + 4 * 1, true);
-    var r2 = getDataViewMemory0().getInt32(retptr + 4 * 2, true);
-    if (r2) {
-      throw takeObject(r1);
-    }
-    return RpSignature.__wrap(r0);
-  } finally {
-    wasm.__wbindgen_add_to_stack_pointer(16);
-  }
+function request(app_id, action, rp_context, action_description, bridge_url, allow_legacy_proofs, override_connect_base_url, environment) {
+  const ptr0 = passStringToWasm0(app_id, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+  const len0 = WASM_VECTOR_LEN;
+  const ptr1 = passStringToWasm0(action, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+  const len1 = WASM_VECTOR_LEN;
+  _assertClass(rp_context, RpContextWasm);
+  var ptr2 = rp_context.__destroy_into_raw();
+  var ptr3 = isLikeNone(action_description) ? 0 : passStringToWasm0(action_description, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+  var len3 = WASM_VECTOR_LEN;
+  var ptr4 = isLikeNone(bridge_url) ? 0 : passStringToWasm0(bridge_url, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+  var len4 = WASM_VECTOR_LEN;
+  var ptr5 = isLikeNone(override_connect_base_url) ? 0 : passStringToWasm0(override_connect_base_url, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+  var len5 = WASM_VECTOR_LEN;
+  var ptr6 = isLikeNone(environment) ? 0 : passStringToWasm0(environment, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+  var len6 = WASM_VECTOR_LEN;
+  const ret = wasm.idkitbuilder_new(ptr0, len0, ptr1, len1, ptr2, ptr3, len3, ptr4, len4, allow_legacy_proofs, ptr5, len5, ptr6, len6);
+  return IDKitBuilder.__wrap(ret);
 }
 function hashSignal(signal) {
   let deferred2_0;
@@ -392,14 +370,36 @@ function hashSignal(signal) {
     wasm.__wbindgen_export4(deferred2_0, deferred2_1, 1);
   }
 }
-function __wasm_bindgen_func_elem_968(arg0, arg1, arg2) {
-  wasm.__wasm_bindgen_func_elem_968(arg0, arg1, addHeapObject(arg2));
+function init_wasm() {
+  wasm.init_wasm();
+}
+function signRequest(action, signing_key_hex, ttl_seconds) {
+  try {
+    const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);
+    const ptr0 = passStringToWasm0(action, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+    const len0 = WASM_VECTOR_LEN;
+    const ptr1 = passStringToWasm0(signing_key_hex, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+    const len1 = WASM_VECTOR_LEN;
+    wasm.signRequest(retptr, ptr0, len0, ptr1, len1, !isLikeNone(ttl_seconds), isLikeNone(ttl_seconds) ? BigInt(0) : ttl_seconds);
+    var r0 = getDataViewMemory0().getInt32(retptr + 4 * 0, true);
+    var r1 = getDataViewMemory0().getInt32(retptr + 4 * 1, true);
+    var r2 = getDataViewMemory0().getInt32(retptr + 4 * 2, true);
+    if (r2) {
+      throw takeObject(r1);
+    }
+    return RpSignature.__wrap(r0);
+  } finally {
+    wasm.__wbindgen_add_to_stack_pointer(16);
+  }
+}
+function __wasm_bindgen_func_elem_975(arg0, arg1, arg2) {
+  wasm.__wasm_bindgen_func_elem_975(arg0, arg1, addHeapObject(arg2));
 }
-function __wasm_bindgen_func_elem_605(arg0, arg1) {
-  wasm.__wasm_bindgen_func_elem_605(arg0, arg1);
+function __wasm_bindgen_func_elem_612(arg0, arg1) {
+  wasm.__wasm_bindgen_func_elem_612(arg0, arg1);
 }
-function __wasm_bindgen_func_elem_1353(arg0, arg1, arg2, arg3) {
-  wasm.__wasm_bindgen_func_elem_1353(arg0, arg1, addHeapObject(arg2), addHeapObject(arg3));
+function __wasm_bindgen_func_elem_1360(arg0, arg1, arg2, arg3) {
+  wasm.__wasm_bindgen_func_elem_1360(arg0, arg1, addHeapObject(arg2), addHeapObject(arg3));
 }
 var __wbindgen_enum_RequestCache = ["default", "no-store", "reload", "no-cache", "force-cache", "only-if-cached"];
 var __wbindgen_enum_RequestCredentials = ["omit", "same-origin", "include"];
@@ -887,6 +887,35 @@ var IDKitBuilder = class _IDKitBuilder {
       wasm.__wbindgen_add_to_stack_pointer(16);
     }
   }
+  /**
+   * Builds a v1 (legacy) native payload from a preset (synchronous, no bridge connection).
+   *
+   * Used by the native transport when the World App only supports verify v1.
+   * Only legacy presets produce valid v1 payloads (constraints always have
+   * `Deprecated` verification level and will fail).
+   *
+   * # Errors
+   *
+   * Returns an error if the preset is invalid or v1 payload construction fails.
+   * @param {any} preset_json
+   * @returns {any}
+   */
+  nativePayloadV1FromPreset(preset_json) {
+    try {
+      const ptr = this.__destroy_into_raw();
+      const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);
+      wasm.idkitbuilder_nativePayloadV1FromPreset(retptr, ptr, addHeapObject(preset_json));
+      var r0 = getDataViewMemory0().getInt32(retptr + 4 * 0, true);
+      var r1 = getDataViewMemory0().getInt32(retptr + 4 * 1, true);
+      var r2 = getDataViewMemory0().getInt32(retptr + 4 * 2, true);
+      if (r2) {
+        throw takeObject(r1);
+      }
+      return takeObject(r0);
+    } finally {
+      wasm.__wbindgen_add_to_stack_pointer(16);
+    }
+  }
   /**
    * Creates a new builder for uniqueness requests
    * @param {string} app_id
@@ -1562,7 +1591,7 @@ function __wbg_get_imports() {
         const a = state0.a;
         state0.a = 0;
         try {
-          return __wasm_bindgen_func_elem_1353(a, state0.b, arg02, arg12);
+          return __wasm_bindgen_func_elem_1360(a, state0.b, arg02, arg12);
         } finally {
           state0.a = a;
         }
@@ -1772,7 +1801,7 @@ function __wbg_get_imports() {
     return addHeapObject(ret);
   };
   imports.wbg.__wbindgen_cast_02740531cfdb05fe = function(arg0, arg1) {
-    const ret = makeMutClosure(arg0, arg1, wasm.__wasm_bindgen_func_elem_604, __wasm_bindgen_func_elem_605);
+    const ret = makeMutClosure(arg0, arg1, wasm.__wasm_bindgen_func_elem_611, __wasm_bindgen_func_elem_612);
     return addHeapObject(ret);
   };
   imports.wbg.__wbindgen_cast_2241b6af4c4b2941 = function(arg0, arg1) {
@@ -1796,7 +1825,7 @@ function __wbg_get_imports() {
     return addHeapObject(ret);
   };
   imports.wbg.__wbindgen_cast_f23235b6472d5cf3 = function(arg0, arg1) {
-    const ret = makeMutClosure(arg0, arg1, wasm.__wasm_bindgen_func_elem_967, __wasm_bindgen_func_elem_968);
+    const ret = makeMutClosure(arg0, arg1, wasm.__wasm_bindgen_func_elem_974, __wasm_bindgen_func_elem_975);
     return addHeapObject(ret);
   };
   imports.wbg.__wbindgen_object_clone_ref = function(arg0) {
@@ -1880,21 +1909,32 @@ var MINIAPP_VERIFY_ACTION = "miniapp-verify-action";
 function isInWorldApp() {
   return typeof window !== "undefined" && Boolean(window.WorldApp);
 }
+function getWorldAppVerifyVersion() {
+  const cmds = window.WorldApp?.supported_commands;
+  if (!Array.isArray(cmds)) return 1;
+  const verify = cmds.find((c) => c.name === "verify");
+  return verify?.supported_versions?.includes(2) ? 2 : 1;
+}
 var _requestCounter = 0;
 var _activeNativeRequest = null;
-function createNativeRequest(wasmPayload, config, signalHashes = {}) {
+function createNativeRequest(wasmPayload, config, signalHashes = {}, version) {
   if (_activeNativeRequest?.isPending()) {
     console.warn(
       "IDKit native request already in flight. Reusing active request."
     );
     return _activeNativeRequest;
   }
-  const request2 = new NativeIDKitRequest(wasmPayload, config, signalHashes);
+  const request2 = new NativeIDKitRequest(
+    wasmPayload,
+    config,
+    signalHashes,
+    version
+  );
   _activeNativeRequest = request2;
   return request2;
 }
 var NativeIDKitRequest = class {
-  constructor(wasmPayload, config, signalHashes = {}) {
+  constructor(wasmPayload, config, signalHashes = {}, version) {
     this.connectorURI = "";
     this.resolved = false;
     this.cancelled = false;
@@ -1948,7 +1988,7 @@ var NativeIDKitRequest = class {
       }
       const sendPayload = {
         command: "verify",
-        version: 2,
+        version,
         payload: wasmPayload
       };
       const w = window;
@@ -2244,15 +2284,23 @@ var IDKitBuilder2 = class {
    */
   async constraints(constraints) {
     await initIDKit();
-    const wasmBuilder = createWasmBuilderFromConfig(this.config);
     if (isInWorldApp()) {
-      const wasmResult = wasmBuilder.nativePayload(constraints);
+      const verifyVersion = getWorldAppVerifyVersion();
+      if (verifyVersion < 2) {
+        throw new Error(
+          "verify v2 is not supported by this World App version. Use a legacy preset (e.g. orbLegacy()) or update the World App."
+        );
+      }
+      const wasmBuilder2 = createWasmBuilderFromConfig(this.config);
+      const wasmResult = wasmBuilder2.nativePayload(constraints);
       return createNativeRequest(
         wasmResult.payload,
         this.config,
-        wasmResult.signal_hashes ?? {}
+        wasmResult.signal_hashes ?? {},
+        2
       );
     }
+    const wasmBuilder = createWasmBuilderFromConfig(this.config);
     const wasmRequest = await wasmBuilder.constraints(
       constraints
     );
@@ -2275,15 +2323,37 @@ var IDKitBuilder2 = class {
    */
   async preset(preset) {
     await initIDKit();
-    const wasmBuilder = createWasmBuilderFromConfig(this.config);
     if (isInWorldApp()) {
-      const wasmResult = wasmBuilder.nativePayloadFromPreset(preset);
-      return createNativeRequest(
-        wasmResult.payload,
-        this.config,
-        wasmResult.signal_hashes ?? {}
-      );
+      const verifyVersion = getWorldAppVerifyVersion();
+      if (verifyVersion === 2) {
+        const wasmBuilder2 = createWasmBuilderFromConfig(this.config);
+        const wasmResult = wasmBuilder2.nativePayloadFromPreset(preset);
+        return createNativeRequest(
+          wasmResult.payload,
+          this.config,
+          wasmResult.signal_hashes ?? {},
+          2
+        );
+      }
+      try {
+        const wasmBuilder2 = createWasmBuilderFromConfig(this.config);
+        const wasmResult = wasmBuilder2.nativePayloadV1FromPreset(preset);
+        return createNativeRequest(
+          wasmResult.payload,
+          this.config,
+          wasmResult.signal_hashes ?? {},
+          1
+        );
+      } catch (err) {
+        if (err instanceof Error && String(err.message).includes("v1 payload")) {
+          throw new Error(
+            "verify v2 is not supported by this World App version. Use a legacy preset (e.g. orbLegacy()) or update the World App."
+          );
+        }
+        throw err;
+      }
     }
+    const wasmBuilder = createWasmBuilderFromConfig(this.config);
     const wasmRequest = await wasmBuilder.preset(
       preset
     );

package/dist/index.d.cts

@@ -83,35 +83,6 @@ type IDKitSessionConfig = {
     environment?: "production" | "staging";
 };
 
-interface OrbLegacyPreset {
-    /** This preset only returns World ID 3.0 proofs. Use it for compatibility with older IDKit versions. */
-    type: "OrbLegacy";
-    signal?: string;
-}
-
-interface SecureDocumentLegacyPreset {
-    /** This preset only returns World ID 3.0 proofs. Use it for compatibility with older IDKit versions. */
-    type: "SecureDocumentLegacy";
-    signal?: string;
-}
-
-interface DocumentLegacyPreset {
-    /** This preset only returns World ID 3.0 proofs. Use it for compatibility with older IDKit versions. */
-    type: "DocumentLegacy";
-    signal?: string;
-}
-
-interface SelfieCheckLegacyPreset {
-    /** This preset only returns World ID 3.0 proofs. Use it for compatibility with older IDKit versions. */
-    /** Preview: Selfie Check is currently in preview. Contact us if you need it enabled. */
-    type: "SelfieCheckLegacy";
-    signal?: string;
-}
-
-type Preset = OrbLegacyPreset | SecureDocumentLegacyPreset | DocumentLegacyPreset | SelfieCheckLegacyPreset;
-
-
-
 /** V4 response item for World ID v4 uniqueness proofs */
 interface ResponseItemV4 {
     /** Credential identifier (e.g., "orb", "face", "document") */
@@ -254,6 +225,35 @@ type ConstraintNode =
     | { all: ConstraintNode[] }
     | { enumerate: ConstraintNode[] };
 
+
+
+interface OrbLegacyPreset {
+    /** This preset only returns World ID 3.0 proofs. Use it for compatibility with older IDKit versions. */
+    type: "OrbLegacy";
+    signal?: string;
+}
+
+interface SecureDocumentLegacyPreset {
+    /** This preset only returns World ID 3.0 proofs. Use it for compatibility with older IDKit versions. */
+    type: "SecureDocumentLegacy";
+    signal?: string;
+}
+
+interface DocumentLegacyPreset {
+    /** This preset only returns World ID 3.0 proofs. Use it for compatibility with older IDKit versions. */
+    type: "DocumentLegacy";
+    signal?: string;
+}
+
+interface SelfieCheckLegacyPreset {
+    /** This preset only returns World ID 3.0 proofs. Use it for compatibility with older IDKit versions. */
+    /** Preview: Selfie Check is currently in preview. Contact us if you need it enabled. */
+    type: "SelfieCheckLegacy";
+    signal?: string;
+}
+
+type Preset = OrbLegacyPreset | SecureDocumentLegacyPreset | DocumentLegacyPreset | SelfieCheckLegacyPreset;
+
 /**
  * Result types - re-exported from WASM bindings
  *

package/dist/index.d.ts

@@ -83,35 +83,6 @@ type IDKitSessionConfig = {
     environment?: "production" | "staging";
 };
 
-interface OrbLegacyPreset {
-    /** This preset only returns World ID 3.0 proofs. Use it for compatibility with older IDKit versions. */
-    type: "OrbLegacy";
-    signal?: string;
-}
-
-interface SecureDocumentLegacyPreset {
-    /** This preset only returns World ID 3.0 proofs. Use it for compatibility with older IDKit versions. */
-    type: "SecureDocumentLegacy";
-    signal?: string;
-}
-
-interface DocumentLegacyPreset {
-    /** This preset only returns World ID 3.0 proofs. Use it for compatibility with older IDKit versions. */
-    type: "DocumentLegacy";
-    signal?: string;
-}
-
-interface SelfieCheckLegacyPreset {
-    /** This preset only returns World ID 3.0 proofs. Use it for compatibility with older IDKit versions. */
-    /** Preview: Selfie Check is currently in preview. Contact us if you need it enabled. */
-    type: "SelfieCheckLegacy";
-    signal?: string;
-}
-
-type Preset = OrbLegacyPreset | SecureDocumentLegacyPreset | DocumentLegacyPreset | SelfieCheckLegacyPreset;
-
-
-
 /** V4 response item for World ID v4 uniqueness proofs */
 interface ResponseItemV4 {
     /** Credential identifier (e.g., "orb", "face", "document") */
@@ -254,6 +225,35 @@ type ConstraintNode =
     | { all: ConstraintNode[] }
     | { enumerate: ConstraintNode[] };
 
+
+
+interface OrbLegacyPreset {
+    /** This preset only returns World ID 3.0 proofs. Use it for compatibility with older IDKit versions. */
+    type: "OrbLegacy";
+    signal?: string;
+}
+
+interface SecureDocumentLegacyPreset {
+    /** This preset only returns World ID 3.0 proofs. Use it for compatibility with older IDKit versions. */
+    type: "SecureDocumentLegacy";
+    signal?: string;
+}
+
+interface DocumentLegacyPreset {
+    /** This preset only returns World ID 3.0 proofs. Use it for compatibility with older IDKit versions. */
+    type: "DocumentLegacy";
+    signal?: string;
+}
+
+interface SelfieCheckLegacyPreset {
+    /** This preset only returns World ID 3.0 proofs. Use it for compatibility with older IDKit versions. */
+    /** Preview: Selfie Check is currently in preview. Contact us if you need it enabled. */
+    type: "SelfieCheckLegacy";
+    signal?: string;
+}
+
+type Preset = OrbLegacyPreset | SecureDocumentLegacyPreset | DocumentLegacyPreset | SelfieCheckLegacyPreset;
+
 /**
  * Result types - re-exported from WASM bindings
  *

package/dist/index.js

@@ -246,40 +246,6 @@ function _assertClass(instance, klass) {
     throw new Error(`expected instance of ${klass.name}`);
   }
 }
-function createSession(app_id, rp_context, action_description, bridge_url, override_connect_base_url, environment) {
-  const ptr0 = passStringToWasm0(app_id, wasm.__wbindgen_export, wasm.__wbindgen_export2);
-  const len0 = WASM_VECTOR_LEN;
-  _assertClass(rp_context, RpContextWasm);
-  var ptr1 = rp_context.__destroy_into_raw();
-  var ptr2 = isLikeNone(action_description) ? 0 : passStringToWasm0(action_description, wasm.__wbindgen_export, wasm.__wbindgen_export2);
-  var len2 = WASM_VECTOR_LEN;
-  var ptr3 = isLikeNone(bridge_url) ? 0 : passStringToWasm0(bridge_url, wasm.__wbindgen_export, wasm.__wbindgen_export2);
-  var len3 = WASM_VECTOR_LEN;
-  var ptr4 = isLikeNone(override_connect_base_url) ? 0 : passStringToWasm0(override_connect_base_url, wasm.__wbindgen_export, wasm.__wbindgen_export2);
-  var len4 = WASM_VECTOR_LEN;
-  var ptr5 = isLikeNone(environment) ? 0 : passStringToWasm0(environment, wasm.__wbindgen_export, wasm.__wbindgen_export2);
-  var len5 = WASM_VECTOR_LEN;
-  const ret = wasm.createSession(ptr0, len0, ptr1, ptr2, len2, ptr3, len3, ptr4, len4, ptr5, len5);
-  return IDKitBuilder.__wrap(ret);
-}
-function request(app_id, action, rp_context, action_description, bridge_url, allow_legacy_proofs, override_connect_base_url, environment) {
-  const ptr0 = passStringToWasm0(app_id, wasm.__wbindgen_export, wasm.__wbindgen_export2);
-  const len0 = WASM_VECTOR_LEN;
-  const ptr1 = passStringToWasm0(action, wasm.__wbindgen_export, wasm.__wbindgen_export2);
-  const len1 = WASM_VECTOR_LEN;
-  _assertClass(rp_context, RpContextWasm);
-  var ptr2 = rp_context.__destroy_into_raw();
-  var ptr3 = isLikeNone(action_description) ? 0 : passStringToWasm0(action_description, wasm.__wbindgen_export, wasm.__wbindgen_export2);
-  var len3 = WASM_VECTOR_LEN;
-  var ptr4 = isLikeNone(bridge_url) ? 0 : passStringToWasm0(bridge_url, wasm.__wbindgen_export, wasm.__wbindgen_export2);
-  var len4 = WASM_VECTOR_LEN;
-  var ptr5 = isLikeNone(override_connect_base_url) ? 0 : passStringToWasm0(override_connect_base_url, wasm.__wbindgen_export, wasm.__wbindgen_export2);
-  var len5 = WASM_VECTOR_LEN;
-  var ptr6 = isLikeNone(environment) ? 0 : passStringToWasm0(environment, wasm.__wbindgen_export, wasm.__wbindgen_export2);
-  var len6 = WASM_VECTOR_LEN;
-  const ret = wasm.idkitbuilder_new(ptr0, len0, ptr1, len1, ptr2, ptr3, len3, ptr4, len4, allow_legacy_proofs, ptr5, len5, ptr6, len6);
-  return IDKitBuilder.__wrap(ret);
-}
 function base64Decode(data) {
   try {
     const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);
@@ -318,6 +284,22 @@ function proveSession(session_id, app_id, rp_context, action_description, bridge
   const ret = wasm.idkitbuilder_forProveSession(ptr0, len0, ptr1, len1, ptr2, ptr3, len3, ptr4, len4, ptr5, len5, ptr6, len6);
   return IDKitBuilder.__wrap(ret);
 }
+function createSession(app_id, rp_context, action_description, bridge_url, override_connect_base_url, environment) {
+  const ptr0 = passStringToWasm0(app_id, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+  const len0 = WASM_VECTOR_LEN;
+  _assertClass(rp_context, RpContextWasm);
+  var ptr1 = rp_context.__destroy_into_raw();
+  var ptr2 = isLikeNone(action_description) ? 0 : passStringToWasm0(action_description, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+  var len2 = WASM_VECTOR_LEN;
+  var ptr3 = isLikeNone(bridge_url) ? 0 : passStringToWasm0(bridge_url, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+  var len3 = WASM_VECTOR_LEN;
+  var ptr4 = isLikeNone(override_connect_base_url) ? 0 : passStringToWasm0(override_connect_base_url, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+  var len4 = WASM_VECTOR_LEN;
+  var ptr5 = isLikeNone(environment) ? 0 : passStringToWasm0(environment, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+  var len5 = WASM_VECTOR_LEN;
+  const ret = wasm.createSession(ptr0, len0, ptr1, ptr2, len2, ptr3, len3, ptr4, len4, ptr5, len5);
+  return IDKitBuilder.__wrap(ret);
+}
 function passArray8ToWasm0(arg, malloc) {
   const ptr = malloc(arg.length * 1, 1) >>> 0;
   getUint8ArrayMemory0().set(arg, ptr / 1);
@@ -342,27 +324,23 @@ function base64Encode(data) {
     wasm.__wbindgen_export4(deferred2_0, deferred2_1, 1);
   }
 }
-function init_wasm() {
-  wasm.init_wasm();
-}
-function signRequest(action, signing_key_hex, ttl_seconds) {
-  try {
-    const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);
-    const ptr0 = passStringToWasm0(action, wasm.__wbindgen_export, wasm.__wbindgen_export2);
-    const len0 = WASM_VECTOR_LEN;
-    const ptr1 = passStringToWasm0(signing_key_hex, wasm.__wbindgen_export, wasm.__wbindgen_export2);
-    const len1 = WASM_VECTOR_LEN;
-    wasm.signRequest(retptr, ptr0, len0, ptr1, len1, !isLikeNone(ttl_seconds), isLikeNone(ttl_seconds) ? BigInt(0) : ttl_seconds);
-    var r0 = getDataViewMemory0().getInt32(retptr + 4 * 0, true);
-    var r1 = getDataViewMemory0().getInt32(retptr + 4 * 1, true);
-    var r2 = getDataViewMemory0().getInt32(retptr + 4 * 2, true);
-    if (r2) {
-      throw takeObject(r1);
-    }
-    return RpSignature.__wrap(r0);
-  } finally {
-    wasm.__wbindgen_add_to_stack_pointer(16);
-  }
+function request(app_id, action, rp_context, action_description, bridge_url, allow_legacy_proofs, override_connect_base_url, environment) {
+  const ptr0 = passStringToWasm0(app_id, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+  const len0 = WASM_VECTOR_LEN;
+  const ptr1 = passStringToWasm0(action, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+  const len1 = WASM_VECTOR_LEN;
+  _assertClass(rp_context, RpContextWasm);
+  var ptr2 = rp_context.__destroy_into_raw();
+  var ptr3 = isLikeNone(action_description) ? 0 : passStringToWasm0(action_description, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+  var len3 = WASM_VECTOR_LEN;
+  var ptr4 = isLikeNone(bridge_url) ? 0 : passStringToWasm0(bridge_url, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+  var len4 = WASM_VECTOR_LEN;
+  var ptr5 = isLikeNone(override_connect_base_url) ? 0 : passStringToWasm0(override_connect_base_url, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+  var len5 = WASM_VECTOR_LEN;
+  var ptr6 = isLikeNone(environment) ? 0 : passStringToWasm0(environment, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+  var len6 = WASM_VECTOR_LEN;
+  const ret = wasm.idkitbuilder_new(ptr0, len0, ptr1, len1, ptr2, ptr3, len3, ptr4, len4, allow_legacy_proofs, ptr5, len5, ptr6, len6);
+  return IDKitBuilder.__wrap(ret);
 }
 function hashSignal(signal) {
   let deferred2_0;
@@ -389,14 +367,36 @@ function hashSignal(signal) {
     wasm.__wbindgen_export4(deferred2_0, deferred2_1, 1);
   }
 }
-function __wasm_bindgen_func_elem_968(arg0, arg1, arg2) {
-  wasm.__wasm_bindgen_func_elem_968(arg0, arg1, addHeapObject(arg2));
+function init_wasm() {
+  wasm.init_wasm();
+}
+function signRequest(action, signing_key_hex, ttl_seconds) {
+  try {
+    const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);
+    const ptr0 = passStringToWasm0(action, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+    const len0 = WASM_VECTOR_LEN;
+    const ptr1 = passStringToWasm0(signing_key_hex, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+    const len1 = WASM_VECTOR_LEN;
+    wasm.signRequest(retptr, ptr0, len0, ptr1, len1, !isLikeNone(ttl_seconds), isLikeNone(ttl_seconds) ? BigInt(0) : ttl_seconds);
+    var r0 = getDataViewMemory0().getInt32(retptr + 4 * 0, true);
+    var r1 = getDataViewMemory0().getInt32(retptr + 4 * 1, true);
+    var r2 = getDataViewMemory0().getInt32(retptr + 4 * 2, true);
+    if (r2) {
+      throw takeObject(r1);
+    }
+    return RpSignature.__wrap(r0);
+  } finally {
+    wasm.__wbindgen_add_to_stack_pointer(16);
+  }
+}
+function __wasm_bindgen_func_elem_975(arg0, arg1, arg2) {
+  wasm.__wasm_bindgen_func_elem_975(arg0, arg1, addHeapObject(arg2));
 }
-function __wasm_bindgen_func_elem_605(arg0, arg1) {
-  wasm.__wasm_bindgen_func_elem_605(arg0, arg1);
+function __wasm_bindgen_func_elem_612(arg0, arg1) {
+  wasm.__wasm_bindgen_func_elem_612(arg0, arg1);
 }
-function __wasm_bindgen_func_elem_1353(arg0, arg1, arg2, arg3) {
-  wasm.__wasm_bindgen_func_elem_1353(arg0, arg1, addHeapObject(arg2), addHeapObject(arg3));
+function __wasm_bindgen_func_elem_1360(arg0, arg1, arg2, arg3) {
+  wasm.__wasm_bindgen_func_elem_1360(arg0, arg1, addHeapObject(arg2), addHeapObject(arg3));
 }
 var __wbindgen_enum_RequestCache = ["default", "no-store", "reload", "no-cache", "force-cache", "only-if-cached"];
 var __wbindgen_enum_RequestCredentials = ["omit", "same-origin", "include"];
@@ -884,6 +884,35 @@ var IDKitBuilder = class _IDKitBuilder {
       wasm.__wbindgen_add_to_stack_pointer(16);
     }
   }
+  /**
+   * Builds a v1 (legacy) native payload from a preset (synchronous, no bridge connection).
+   *
+   * Used by the native transport when the World App only supports verify v1.
+   * Only legacy presets produce valid v1 payloads (constraints always have
+   * `Deprecated` verification level and will fail).
+   *
+   * # Errors
+   *
+   * Returns an error if the preset is invalid or v1 payload construction fails.
+   * @param {any} preset_json
+   * @returns {any}
+   */
+  nativePayloadV1FromPreset(preset_json) {
+    try {
+      const ptr = this.__destroy_into_raw();
+      const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);
+      wasm.idkitbuilder_nativePayloadV1FromPreset(retptr, ptr, addHeapObject(preset_json));
+      var r0 = getDataViewMemory0().getInt32(retptr + 4 * 0, true);
+      var r1 = getDataViewMemory0().getInt32(retptr + 4 * 1, true);
+      var r2 = getDataViewMemory0().getInt32(retptr + 4 * 2, true);
+      if (r2) {
+        throw takeObject(r1);
+      }
+      return takeObject(r0);
+    } finally {
+      wasm.__wbindgen_add_to_stack_pointer(16);
+    }
+  }
   /**
    * Creates a new builder for uniqueness requests
    * @param {string} app_id
@@ -1559,7 +1588,7 @@ function __wbg_get_imports() {
         const a = state0.a;
         state0.a = 0;
         try {
-          return __wasm_bindgen_func_elem_1353(a, state0.b, arg02, arg12);
+          return __wasm_bindgen_func_elem_1360(a, state0.b, arg02, arg12);
         } finally {
           state0.a = a;
         }
@@ -1769,7 +1798,7 @@ function __wbg_get_imports() {
     return addHeapObject(ret);
   };
   imports.wbg.__wbindgen_cast_02740531cfdb05fe = function(arg0, arg1) {
-    const ret = makeMutClosure(arg0, arg1, wasm.__wasm_bindgen_func_elem_604, __wasm_bindgen_func_elem_605);
+    const ret = makeMutClosure(arg0, arg1, wasm.__wasm_bindgen_func_elem_611, __wasm_bindgen_func_elem_612);
     return addHeapObject(ret);
   };
   imports.wbg.__wbindgen_cast_2241b6af4c4b2941 = function(arg0, arg1) {
@@ -1793,7 +1822,7 @@ function __wbg_get_imports() {
     return addHeapObject(ret);
   };
   imports.wbg.__wbindgen_cast_f23235b6472d5cf3 = function(arg0, arg1) {
-    const ret = makeMutClosure(arg0, arg1, wasm.__wasm_bindgen_func_elem_967, __wasm_bindgen_func_elem_968);
+    const ret = makeMutClosure(arg0, arg1, wasm.__wasm_bindgen_func_elem_974, __wasm_bindgen_func_elem_975);
     return addHeapObject(ret);
   };
   imports.wbg.__wbindgen_object_clone_ref = function(arg0) {
@@ -1877,21 +1906,32 @@ var MINIAPP_VERIFY_ACTION = "miniapp-verify-action";
 function isInWorldApp() {
   return typeof window !== "undefined" && Boolean(window.WorldApp);
 }
+function getWorldAppVerifyVersion() {
+  const cmds = window.WorldApp?.supported_commands;
+  if (!Array.isArray(cmds)) return 1;
+  const verify = cmds.find((c) => c.name === "verify");
+  return verify?.supported_versions?.includes(2) ? 2 : 1;
+}
 var _requestCounter = 0;
 var _activeNativeRequest = null;
-function createNativeRequest(wasmPayload, config, signalHashes = {}) {
+function createNativeRequest(wasmPayload, config, signalHashes = {}, version) {
   if (_activeNativeRequest?.isPending()) {
     console.warn(
       "IDKit native request already in flight. Reusing active request."
     );
     return _activeNativeRequest;
   }
-  const request2 = new NativeIDKitRequest(wasmPayload, config, signalHashes);
+  const request2 = new NativeIDKitRequest(
+    wasmPayload,
+    config,
+    signalHashes,
+    version
+  );
   _activeNativeRequest = request2;
   return request2;
 }
 var NativeIDKitRequest = class {
-  constructor(wasmPayload, config, signalHashes = {}) {
+  constructor(wasmPayload, config, signalHashes = {}, version) {
     this.connectorURI = "";
     this.resolved = false;
     this.cancelled = false;
@@ -1945,7 +1985,7 @@ var NativeIDKitRequest = class {
       }
       const sendPayload = {
         command: "verify",
-        version: 2,
+        version,
         payload: wasmPayload
       };
       const w = window;
@@ -2241,15 +2281,23 @@ var IDKitBuilder2 = class {
    */
   async constraints(constraints) {
     await initIDKit();
-    const wasmBuilder = createWasmBuilderFromConfig(this.config);
     if (isInWorldApp()) {
-      const wasmResult = wasmBuilder.nativePayload(constraints);
+      const verifyVersion = getWorldAppVerifyVersion();
+      if (verifyVersion < 2) {
+        throw new Error(
+          "verify v2 is not supported by this World App version. Use a legacy preset (e.g. orbLegacy()) or update the World App."
+        );
+      }
+      const wasmBuilder2 = createWasmBuilderFromConfig(this.config);
+      const wasmResult = wasmBuilder2.nativePayload(constraints);
       return createNativeRequest(
         wasmResult.payload,
         this.config,
-        wasmResult.signal_hashes ?? {}
+        wasmResult.signal_hashes ?? {},
+        2
       );
     }
+    const wasmBuilder = createWasmBuilderFromConfig(this.config);
     const wasmRequest = await wasmBuilder.constraints(
       constraints
     );
@@ -2272,15 +2320,37 @@ var IDKitBuilder2 = class {
    */
   async preset(preset) {
     await initIDKit();
-    const wasmBuilder = createWasmBuilderFromConfig(this.config);
     if (isInWorldApp()) {
-      const wasmResult = wasmBuilder.nativePayloadFromPreset(preset);
-      return createNativeRequest(
-        wasmResult.payload,
-        this.config,
-        wasmResult.signal_hashes ?? {}
-      );
+      const verifyVersion = getWorldAppVerifyVersion();
+      if (verifyVersion === 2) {
+        const wasmBuilder2 = createWasmBuilderFromConfig(this.config);
+        const wasmResult = wasmBuilder2.nativePayloadFromPreset(preset);
+        return createNativeRequest(
+          wasmResult.payload,
+          this.config,
+          wasmResult.signal_hashes ?? {},
+          2
+        );
+      }
+      try {
+        const wasmBuilder2 = createWasmBuilderFromConfig(this.config);
+        const wasmResult = wasmBuilder2.nativePayloadV1FromPreset(preset);
+        return createNativeRequest(
+          wasmResult.payload,
+          this.config,
+          wasmResult.signal_hashes ?? {},
+          1
+        );
+      } catch (err) {
+        if (err instanceof Error && String(err.message).includes("v1 payload")) {
+          throw new Error(
+            "verify v2 is not supported by this World App version. Use a legacy preset (e.g. orbLegacy()) or update the World App."
+          );
+        }
+        throw err;
+      }
     }
+    const wasmBuilder = createWasmBuilderFromConfig(this.config);
     const wasmRequest = await wasmBuilder.preset(
       preset
     );

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@worldcoin/idkit-core",
-  "version": "4.0.9",
+  "version": "4.0.10",
   "description": "Core IDKit SDK for World ID - Pure TypeScript, no dependencies",
   "type": "module",
   "main": "./dist/index.cjs",