From 89dd6461f03ed9b4753cd12744826b1739fe4cfb Mon Sep 17 00:00:00 2001
From: Takis Kakalis <80459599+Takaros999@users.noreply.github.com>
Date: Fri, 16 Jan 2026 11:08:49 +0100
Subject: [PATCH 1/4] feat!: World ID 3.0 compatibility

---
 js/examples/browser/index.html               |  31 +++--
 js/packages/core/README.md                   | 119 +++++++++++--------
 js/packages/core/src/__tests__/smoke.test.ts |   9 +-
 js/packages/core/src/bridge.ts               |  69 ++++-------
 js/packages/core/src/client.ts               |  12 +-
 js/packages/core/src/index.ts                |   6 +-
 js/packages/core/src/lib/hashing.ts          |   8 +-
 js/packages/core/src/lib/utils.ts            |  39 ------
 js/packages/core/src/react/index.ts          |   3 +-
 js/packages/core/src/react/types.ts          |   2 +-
 js/packages/core/src/types/config.ts         |  33 +++--
 js/packages/core/src/types/result.ts         |   5 +-
 rust/core/src/bridge.rs                      | 114 ++++++++----------
 rust/core/src/types.rs                       | 103 ++++++++++++++++
 rust/core/src/wasm_bindings.rs               |  50 +-------
 15 files changed, 301 insertions(+), 302 deletions(-)

diff --git a/js/examples/browser/index.html b/js/examples/browser/index.html
index 2749c63..16f989e 100644
--- a/js/examples/browser/index.html
+++ b/js/examples/browser/index.html
@@ -13,6 +13,7 @@ <h1>IDKit Browser Example</h1>
         <button id="verifyOrb">Verify with Orb</button>
         <button id="verifyFace">Verify with Face</button>
         <button id="verifyDevice">Verify with Device</button>
+        <button id="verifyMultiple">Verify with Multiple (Orb + Device)</button>
     </div>
 
     <section id="qr" hidden>
@@ -38,7 +39,7 @@ <h3>Error</h3>
 
     <script type="module">
         // Import IDKit (alias resolves to local dist or npm package)
-        import { useWorldBridgeStore, VerificationLevel } from '@worldcoin/idkit';
+        import { useWorldBridgeStore } from '@worldcoin/idkit';
 
         // Demo app configuration (WASM auto-initializes on first use)
         const APP_ID = 'app_ce4cb73cb75fc3b73b71ffb4de178410'; // Replace with your actual app ID
@@ -62,8 +63,8 @@ <h3>Error</h3>
             errorDiv.hidden = true;
         };
 
-        // Function to verify with World ID
-        async function verify(verificationLevel) {
+        // Function to verify with World ID using explicit requests
+        async function verify(requests) {
             try {
                 hideAll();
 
@@ -73,12 +74,11 @@ <h3>Error</h3>
                 statusDiv.hidden = false;
                 statusText.textContent = 'Creating verification request...';
 
-                // createClient returns a client with the connectorURI
+                // createClient accepts explicit requests array
                 const client = await store.createClient({
                     app_id: APP_ID,
                     action: ACTION,
-                    verification_level: verificationLevel,
-                    signal: 'demo-signal-' + Date.now(),
+                    requests: requests,
                 });
 
                 // Use client.connectorURI (not store.connectorURI which is a stale snapshot)
@@ -111,10 +111,21 @@ <h3>Error</h3>
             }
         }
 
-        // Button event listeners
-        document.getElementById('verifyOrb').addEventListener('click', () => verify(VerificationLevel.Orb));
-        document.getElementById('verifyFace').addEventListener('click', () => verify(VerificationLevel.Face));
-        document.getElementById('verifyDevice').addEventListener('click', () => verify(VerificationLevel.Device));
+        // Helper to create a signal with timestamp
+        const makeSignal = () => 'demo-signal-' + Date.now();
+
+        //TODO: Will refactor this
+        // Button event listeners - using explicit requests pattern
+        document.getElementById('verifyOrb').addEventListener('click', () => 
+            verify([{ credential_type: 'orb', signal: makeSignal() }])
+        );
+        document.getElementById('verifyFace').addEventListener('click', () => 
+            verify([{ credential_type: 'face', signal: makeSignal() }])
+        );
+        document.getElementById('verifyDevice').addEventListener('click', () => 
+            verify([{ credential_type: 'device', signal: makeSignal() }])
+        );
+        
     </script>
 </body>
 </html>
diff --git a/js/packages/core/README.md b/js/packages/core/README.md
index a0eefe4..51eb4a3 100644
--- a/js/packages/core/README.md
+++ b/js/packages/core/README.md
@@ -13,20 +13,18 @@ pnpm add @worldcoin/idkit
 ## Quick Start
 
 ```typescript
-import {
-  useWorldBridgeStore,
-  VerificationLevel,
-} from '@worldcoin/idkit'
+import { useWorldBridgeStore } from '@worldcoin/idkit'
 
 // 1. Get store instance
 const store = useWorldBridgeStore()
 
-// 2. Create client - returns immutable client object
+// 2. Create client with explicit requests
 const client = await store.createClient({
   app_id: 'app_staging_xxxxx',
   action: 'my-action',
-  verification_level: VerificationLevel.Orb,
-  signal: 'user-id-123',
+  requests: [
+    { credential_type: 'orb', signal: 'user-id-123' },
+  ],
 })
 
 // 3. Display QR code for World App
@@ -41,38 +39,60 @@ try {
 }
 ```
 
-## V2 API
+## Multiple Credential Types
 
-```typescript
-const store = useWorldBridgeStore()
+You can request verification with multiple credential types. The user can satisfy the request with any of them:
 
-await store.createClient({
+```typescript
+const client = await store.createClient({
   app_id: 'app_staging_xxxxx',
   action: 'my-action',
-  verification_level: VerificationLevel.Orb,
-  signal: 'user-id-123',
+  requests: [
+    { credential_type: 'orb', signal: 'user-id-123' },
+    { credential_type: 'device', signal: 'user-id-123' },
+  ],
 })
+```
 
-console.log('Scan this:', store.connectorURI)
-
-await store.pollForUpdates()
+## Credential Types
 
-if (store.result) {
-  console.log('Proof received:', store.result)
-}
-```
+- `orb` - Verified via Orb biometric scan (highest trust)
+- `face` - Verified via Face ID
+- `device` - Verified via device binding
+- `document` - Verified via document scan
+- `secure_document` - Verified via secure document scan
 
 ## API Reference
 
+### Creating a Client
+
 ```typescript
 const client = await store.createClient(config)
 ```
 
-**Properties:**
+**Config:**
+```typescript
+interface IDKitConfig {
+  app_id: `app_${string}`        // Your World ID app ID
+  action: string                  // Action identifier
+  requests: RequestConfig[]       // Required: credential type requests
+  bridge_url?: string            // Custom bridge URL (optional)
+  partner?: boolean              // Partner mode (optional)
+}
+
+interface RequestConfig {
+  credential_type: CredentialType
+  signal?: string | AbiEncodedValue  // Optional signal for this request
+}
+
+type CredentialType = 'orb' | 'face' | 'device' | 'document' | 'secure_document'
+```
+
+**Client Properties:**
 - `connectorURI: string` - QR code URL for World App
 - `requestId: string` - Unique request ID
 
-**Methods:**
+**Client Methods:**
 - `pollForUpdates(options?: WaitOptions): Promise<ISuccessResult>` - Poll for proof (auto-polls)
 - `pollOnce(): Promise<Status>` - Poll once for status (manual polling)
 
@@ -91,44 +111,24 @@ interface WaitOptions {
 const store = useWorldBridgeStore()
 ```
 
-**V3 Methods:**
+**Methods:**
 - `createClient(config: IDKitConfig): Promise<WorldBridgeClient>` - Create new client
+- `reset(): void` - Clear state and start over
 
-**V2 State (backward compat):**
+**State (for reactive frameworks):**
 - `verificationState: VerificationState` - Current verification state
 - `connectorURI: string | null` - QR code URL for World App
 - `result: ISuccessResult | null` - Proof data when verified
 - `errorCode: AppErrorCodes | null` - Error code if failed
 
-**V2 Methods (deprecated):**
-- `pollForUpdates(): Promise<void>` - Check for proof (call repeatedly) ⚠️ Use `client.pollForUpdates()` with auto-polling instead
-- `reset(): void` - Clear state and start over
-
-### Types
+### Result Types
 
 ```typescript
-interface IDKitConfig {
-  app_id: `app_${string}`
-  action: string
-  signal?: string
-  verification_level?: VerificationLevel
-  bridge_url?: string
-  partner?: boolean
-}
-
 interface ISuccessResult {
   proof: string
   merkle_root: string
   nullifier_hash: string
-  verification_level: VerificationLevel
-}
-
-enum VerificationLevel {
-  Orb = 'orb',
-  Face = 'face',
-  Device = 'device',
-  Document = 'document',
-  SecureDocument = 'secure_document',
+  verification_level: CredentialType  // The credential type used
 }
 ```
 
@@ -142,6 +142,31 @@ hashToField(input: string): HashFunctionOutput
 solidityEncode(types: string[], values: unknown[]): AbiEncodedValue
 ```
 
+## React Integration
+
+```tsx
+import { useWorldBridgeStore, IDKitWidget } from '@worldcoin/idkit'
+
+function MyComponent() {
+  const handleSuccess = (result) => {
+    console.log('Verified:', result)
+  }
+
+  return (
+    <IDKitWidget
+      app_id="app_staging_xxxxx"
+      action="my-action"
+      requests={[
+        { credential_type: 'orb', signal: 'user-123' },
+      ]}
+      onSuccess={handleSuccess}
+    >
+      {({ open }) => <button onClick={open}>Verify with World ID</button>}
+    </IDKitWidget>
+  )
+}
+```
+
 ## Examples
 
 See [examples/browser](../../examples/browser) for a complete working example.
diff --git a/js/packages/core/src/__tests__/smoke.test.ts b/js/packages/core/src/__tests__/smoke.test.ts
index 0e27e6f..49935fb 100644
--- a/js/packages/core/src/__tests__/smoke.test.ts
+++ b/js/packages/core/src/__tests__/smoke.test.ts
@@ -14,10 +14,10 @@ import {
 	buffer_decode,
 	isNode,
 	isWeb,
-	VerificationLevel,
 	AppErrorCodes,
 	VerificationState,
 } from '../index'
+import type { CredentialType } from '../index'
 
 describe('WASM Initialization', () => {
 	it('should initialize WASM via initIDKit', async () => {
@@ -175,13 +175,6 @@ describe('Bridge Store', () => {
 })
 
 describe('Enums', () => {
-	it('should export VerificationLevel enum', () => {
-		expect(VerificationLevel.Orb).toBe('orb')
-		expect(VerificationLevel.Face).toBe('face')
-		expect(VerificationLevel.Device).toBe('device')
-		expect(VerificationLevel.SecureDocument).toBe('secure_document')
-		expect(VerificationLevel.Document).toBe('document')
-	})
 
 	it('should export AppErrorCodes enum', () => {
 		expect(AppErrorCodes.ConnectionFailed).toBe('connection_failed')
diff --git a/js/packages/core/src/bridge.ts b/js/packages/core/src/bridge.ts
index 12b5291..3a2b512 100644
--- a/js/packages/core/src/bridge.ts
+++ b/js/packages/core/src/bridge.ts
@@ -4,16 +4,11 @@
  */
 
 import { create, type StateCreator } from 'zustand'
-import type { IDKitConfig, VerificationLevel } from './types/config'
+import type { IDKitConfig } from './types/config'
 import type { ISuccessResult } from './types/result'
 import { VerificationState, AppErrorCodes, ResponseStatus } from './types/bridge'
 import { validate_bridge_url } from './lib/validation'
-import { encodeAction, generateSignal } from './lib/hashing'
-import {
-	DEFAULT_VERIFICATION_LEVEL,
-	credential_type_to_verification_level,
-	verification_level_to_credential_types,
-} from './lib/utils'
+import { encodeAction } from './lib/hashing'
 import { WasmModule, initIDKit } from './lib/wasm'
 import { WorldBridgeClient } from './client'
 
@@ -29,11 +24,6 @@ type BridgeResponse =
 			response: { iv: string; payload: string }
 	  }
 
-type BridgeResult =
-	| ISuccessResult
-	| (Omit<ISuccessResult, 'verification_level'> & { credential_type: VerificationLevel })
-	| { error_code: AppErrorCodes }
-
 export type WorldBridgeStore = {
 	bridge_url: string
 	encryption: typeof WasmModule.BridgeEncryption.prototype | null
@@ -60,10 +50,15 @@ const createStoreImplementation: StateCreator<WorldBridgeStore> = (set, get) =>
 	bridge_url: DEFAULT_BRIDGE_URL,
 	verificationState: VerificationState.PreparingClient,
 
-	createClient: async ({ bridge_url, app_id, verification_level, action, signal, requests, constraints, action_description }) => {
+	createClient: async ({ bridge_url, app_id, action, requests, constraints, action_description }) => {
 		// Ensure WASM is initialized
 		await initIDKit()
 
+		// Validate requests
+		if (!requests || requests.length === 0) {
+			throw new Error('At least one request is required')
+		}
+
 		// Validate bridge URL
 		if (bridge_url) {
 			const validation = validate_bridge_url(bridge_url, app_id.includes('staging'))
@@ -74,38 +69,22 @@ const createStoreImplementation: StateCreator<WorldBridgeStore> = (set, get) =>
 			}
 		}
 
-		let session: WasmModule.Session
-
-		if (requests && requests.length > 0) {
-			if (verification_level) {
-				console.warn('`verification_level` is ignored when `requests` are provided. Use one or the other.')
-			}
-			const reqs = (requests as any[]).map((req) => ({
-				credential_type: req.credential_type ?? req.credentialType ?? req.credential,
-				signal: typeof req.signal === 'string' ? req.signal : undefined,
-				signal_bytes: req.signal_bytes ?? req.signalBytes,
-				face_auth: req.face_auth ?? req.faceAuth,
-			}))
-
-			const constraintsPayload = constraints ? constraints : undefined
-
-			session = (await WasmModule.Session.createWithRequests(
-				app_id,
-				encodeAction(action),
-				reqs,
-				constraintsPayload ?? undefined,
-				action_description ?? null,
-				bridge_url ?? null
-			)) as unknown as WasmModule.Session
-		} else {
-			// Create WASM Session from verification level
-			session = (await new WasmModule.Session(
-				app_id,
-				encodeAction(action),
-				verification_level ?? DEFAULT_VERIFICATION_LEVEL,
-				signal ? generateSignal(signal).digest : null
-			)) as WasmModule.Session
-		}
+		// Map requests to WASM format
+		const reqs = requests.map((req) => ({
+			credential_type: req.credential_type,
+			signal: typeof req.signal === 'string' ? req.signal : undefined,
+			signal_bytes: req.signal_bytes,
+			face_auth: req.face_auth,
+		}))
+
+		const session = (await WasmModule.Session.createWithRequests(
+			app_id,
+			encodeAction(action),
+			reqs,
+			constraints ?? undefined,
+			action_description ?? null,
+			bridge_url ?? null
+		)) as unknown as WasmModule.Session
 
 		const client = new WorldBridgeClient(session)
 
diff --git a/js/packages/core/src/client.ts b/js/packages/core/src/client.ts
index a638a91..d5ca4c8 100644
--- a/js/packages/core/src/client.ts
+++ b/js/packages/core/src/client.ts
@@ -10,8 +10,10 @@
  * const client = await store.createClient({
  *   app_id: 'app_staging_xxxxx',
  *   action: 'my-action',
- *   verification_level: VerificationLevel.Orb,
- *   signal: 'user-id-123',
+ *   requests: [
+ *     { credential_type: 'orb', signal: 'user-id-123' },
+ *     { credential_type: 'device', signal: 'user-id-123' },
+ *   ],
  * })
  *
  * // Display QR code
@@ -19,7 +21,7 @@
  *
  * // Wait for proof
  * try {
- *   const proof = await client.waitForProof()
+ *   const proof = await client.pollForUpdates()
  *   console.log('Success:', proof)
  * } catch (error) {
  *   console.error('Failed:', error)
@@ -55,7 +57,7 @@ export interface Status {
  * Clients are immutable - all properties are read-only.
  */
 export class WorldBridgeClient {
-	private session: InstanceType<typeof WasmModule.Session>
+	private session: WasmModule.Session
 	private _connectorURI: string
 	private _requestId: string
 
@@ -63,7 +65,7 @@ export class WorldBridgeClient {
 	 * @internal
 	 * Creates a new client (called by store.createClient())
 	 */
-	constructor(session: InstanceType<typeof WasmModule.Session>) {
+	constructor(session: WasmModule.Session) {
 		this.session = session
 		this._connectorURI = session.connectUrl()
 		this._requestId = session.requestId()
diff --git a/js/packages/core/src/index.ts b/js/packages/core/src/index.ts
index 40d7085..66cbf7a 100644
--- a/js/packages/core/src/index.ts
+++ b/js/packages/core/src/index.ts
@@ -7,17 +7,15 @@ export { WorldBridgeClient, type WaitOptions, type Status } from './client'
 export { useWorldBridgeStore, createWorldBridgeStore, type WorldBridgeStore } from './bridge'
 
 // Types
-export type { IDKitConfig, AbiEncodedValue } from './types/config'
+export type { IDKitConfig, AbiEncodedValue, RequestConfig, CredentialType } from './types/config'
 export type { ISuccessResult, IErrorState } from './types/result'
-export { VerificationLevel } from './types/config'
-export type { CredentialType } from './types/config'
 export { AppErrorCodes, VerificationState, ResponseStatus } from './types/bridge'
 
 // Backend verification
 export { verifyCloudProof, type IVerifyResponse } from './lib/backend'
 
 // Utilities
-export { DEFAULT_VERIFICATION_LEVEL, buffer_encode, buffer_decode } from './lib/utils'
+export { buffer_encode, buffer_decode } from './lib/utils'
 export { solidityEncode, hashToField, generateSignal, encodeAction } from './lib/hashing'
 export { initIDKit, isInitialized } from './lib/wasm'
 export { isReactNative, isWeb, isNode } from './lib/platform'
diff --git a/js/packages/core/src/lib/hashing.ts b/js/packages/core/src/lib/hashing.ts
index 2c7b391..a857d1c 100644
--- a/js/packages/core/src/lib/hashing.ts
+++ b/js/packages/core/src/lib/hashing.ts
@@ -242,17 +242,17 @@ export const solidityEncode = (types: string[], values: unknown[]): AbiEncodedVa
 }
 
 /**
- * Generates a signal hash from IDKitConfig signal
+ * Generates a signal hash from a signal value
  * Handles both string signals and ABI-encoded signals
- * @param signal Signal from IDKitConfig
+ * @param signal Signal string or ABI-encoded value
  * @returns Hash output
  */
-export const generateSignal = (signal: IDKitConfig['signal']): HashFunctionOutput => {
+export const generateSignal = (signal: AbiEncodedValue | string | undefined): HashFunctionOutput => {
 	if (!signal || typeof signal === 'string') {
 		return hashToField(signal ?? '')
 	}
 
-	return packAndEncode(signal.types.map((type, index) => [type, signal.values[index]]))
+	return packAndEncode(signal.types.map((type: string, index: number) => [type, signal.values[index]]))
 }
 
 /**
diff --git a/js/packages/core/src/lib/utils.ts b/js/packages/core/src/lib/utils.ts
index 7bf74a0..6f61e94 100644
--- a/js/packages/core/src/lib/utils.ts
+++ b/js/packages/core/src/lib/utils.ts
@@ -1,44 +1,5 @@
-import { VerificationLevel } from '../types/config'
 import { WasmModule } from './wasm'
 
-export const DEFAULT_VERIFICATION_LEVEL = VerificationLevel.Orb
-
-/**
- * Converts verification level to accepted credential types for proof request
- * @param verification_level
- * @returns Array of credential types
- */
-export const verification_level_to_credential_types = (verification_level: VerificationLevel): string[] => {
-	switch (verification_level) {
-		case VerificationLevel.Device:
-			// Intentionally exclude document and secure document for backwards compatibility with older app versions
-			return [VerificationLevel.Orb, VerificationLevel.Device]
-		case VerificationLevel.Document:
-			return [VerificationLevel.Document, VerificationLevel.SecureDocument, VerificationLevel.Orb]
-		case VerificationLevel.SecureDocument:
-			return [VerificationLevel.SecureDocument, VerificationLevel.Orb]
-		case VerificationLevel.Orb:
-			return [VerificationLevel.Orb]
-		case VerificationLevel.Face:
-			return [VerificationLevel.Face, VerificationLevel.Orb]
-		default:
-			throw new Error(`Unknown verification level: ${verification_level}`)
-	}
-}
-
-/**
- * Converts credential type string to verification level upon proof response
- * @param credential_type
- * @returns VerificationLevel
- */
-export const credential_type_to_verification_level = (credential_type: VerificationLevel | string): VerificationLevel => {
-	if (!Object.values(VerificationLevel).includes(credential_type as VerificationLevel)) {
-		throw new Error(`Unknown credential_type: ${credential_type}`)
-	}
-
-	return credential_type as VerificationLevel
-}
-
 /**
  * Encodes an ArrayBuffer to base64 string
  * @param buffer - ArrayBuffer to encode
diff --git a/js/packages/core/src/react/index.ts b/js/packages/core/src/react/index.ts
index c8b5393..cb10eb0 100644
--- a/js/packages/core/src/react/index.ts
+++ b/js/packages/core/src/react/index.ts
@@ -7,6 +7,5 @@ export { IDKitWidget } from './IDKitWidget'
 export type { WidgetProps, WidgetConfig, WidgetStatus } from './types'
 
 // Re-export commonly used types from core for convenience
-export { VerificationLevel } from '../types/config'
 export type { ISuccessResult, IErrorState } from '../types/result'
-export type { CredentialType } from '../types/config'
+export type { CredentialType, RequestConfig } from '../types/config'
diff --git a/js/packages/core/src/react/types.ts b/js/packages/core/src/react/types.ts
index 5214be6..3d135a1 100644
--- a/js/packages/core/src/react/types.ts
+++ b/js/packages/core/src/react/types.ts
@@ -1,6 +1,6 @@
 import type { IDKitConfig, ISuccessResult, IErrorState } from '../'
 
-export type WidgetConfig = Pick<IDKitConfig, 'app_id' | 'action' | 'signal' | 'requests' | 'constraints' | 'bridge_url' | 'partner' | 'action_description'> & {
+export type WidgetConfig = Pick<IDKitConfig, 'app_id' | 'action' | 'requests' | 'constraints' | 'bridge_url' | 'action_description'> & {
   /** Called when a proof is received and optionally validated by handleVerify */
   onSuccess: (result: ISuccessResult) => void | Promise<void>
   /** Called after proof is received but before success is shown; throw to surface an error to the user */
diff --git a/js/packages/core/src/types/config.ts b/js/packages/core/src/types/config.ts
index 89b9141..2b737c5 100644
--- a/js/packages/core/src/types/config.ts
+++ b/js/packages/core/src/types/config.ts
@@ -5,12 +5,18 @@ export type AbiEncodedValue = Brand<{ types: string[]; values: unknown[] }, 'Abi
 
 export type CredentialType = 'orb' | 'face' | 'secure_document' | 'document' | 'device'
 
-export enum VerificationLevel {
-	Orb = 'orb',
-	Face = 'face',
-	SecureDocument = 'secure_document',
-	Document = 'document',
-	Device = 'device',
+/**
+ * A single credential request
+ */
+export type RequestConfig = {
+	/** The type of credential being requested */
+	credential_type: CredentialType
+	/** Optional signal string for cryptographic binding */
+	signal?: AbiEncodedValue | string
+	/** Optional ABI-encoded signal bytes (for on-chain use cases) */
+	signal_bytes?: Uint8Array
+	/** Whether face authentication is required (only valid for orb and face credentials) */
+	face_auth?: boolean
 }
 
 export type IDKitConfig = {
@@ -20,21 +26,10 @@ export type IDKitConfig = {
 	action: AbiEncodedValue | string
 	/** The description of the specific action (shown to users in World App). Only recommended for actions created on-the-fly. */
 	action_description?: string
-	/** Encodes data into a proof that must match when validating. Read more on the [On-chain section](https://docs.world.org/advanced/on-chain). */
-	signal?: AbiEncodedValue | string
 	/** URL to a third-party bridge to use when connecting to the World App. Optional. */
 	bridge_url?: string
-	/** The minimum required level of verification. Defaults to "orb". */
-	verification_level?: VerificationLevel
-	/** Optional explicit requests (takes precedence over verification_level) */
-	requests?: Array<{
-		credential_type: CredentialType
-		signal?: AbiEncodedValue | string
-		signal_bytes?: Uint8Array
-		face_auth?: boolean
-	}>
+	/** Credential requests - at least one required */
+	requests: RequestConfig[]
 	/** Optional constraints JSON (matches Rust Constraints any/all structure) */
 	constraints?: unknown
-	/** Whether the app is a partner app and should allow deferred verification. Defaults to false. */
-	partner?: boolean
 }
diff --git a/js/packages/core/src/types/result.ts b/js/packages/core/src/types/result.ts
index 7bf9d6f..864e418 100644
--- a/js/packages/core/src/types/result.ts
+++ b/js/packages/core/src/types/result.ts
@@ -1,11 +1,12 @@
 import type { AppErrorCodes } from './bridge'
-import type { VerificationLevel } from './config'
+import type { CredentialType } from './config'
 
 export interface ISuccessResult {
 	proof: string
 	merkle_root: string
 	nullifier_hash: string
-	verification_level: VerificationLevel
+	/** The credential type used to generate the proof */
+	verification_level: CredentialType
 }
 
 export interface IErrorState {
diff --git a/rust/core/src/bridge.rs b/rust/core/src/bridge.rs
index 2d4d45c..cfec983 100644
--- a/rust/core/src/bridge.rs
+++ b/rust/core/src/bridge.rs
@@ -4,7 +4,7 @@ use crate::{
     crypto::{base64_decode, base64_encode, decrypt, encrypt},
     error::{AppError, Error, Result},
     types::{AppId, BridgeUrl, Proof, Request, Signal, VerificationLevel},
-    ConstraintNode, Constraints,
+    Constraints,
 };
 use serde::{Deserialize, Serialize};
 use uuid::Uuid;
@@ -28,12 +28,43 @@ struct BridgeRequestPayload {
     #[serde(skip_serializing_if = "Option::is_none")]
     action_description: Option<String>,
 
-    /// Set of requests
+    /// Set of requests (World App 4.0+ format - signals are unhashed)
     requests: Vec<Request>,
 
-    /// Optional constraints
+    /// Optional constraints (World App 4.0+ format)
     #[serde(skip_serializing_if = "Option::is_none")]
     constraints: Option<Constraints>,
+
+    /// Hashed signal for legacy compatibility (World App 3.0)
+    /// Derived from the request with the max verification level credential type
+    signal: String,
+
+    /// Max verification level derived from requests (World App 3.0 compatibility)
+    verification_level: VerificationLevel,
+}
+
+/// Derives legacy bridge fields (verification_level, hashed signal) from requests.
+///
+/// This enables backwards compatibility with World App 3.0 which expects:
+/// - `verification_level`: The maximum (least restrictive) level from all credential types
+/// - `signal`: The hashed signal from the request with the max credential type
+///
+/// Priority (most → least restrictive): orb > secure_document > document > face > device
+//TODO: This is not 100% accurate, will refine this in a followup PR, but for now it "works".
+fn derive_legacy_fields(requests: &[Request]) -> (VerificationLevel, String) {
+    let cred_types: Vec<_> = requests.iter().map(|r| r.credential_type).collect();
+    let verification_level = VerificationLevel::from_credential_types(&cred_types);
+
+    let target_cred = verification_level.primary_credential();
+
+    let signal = requests
+        .iter()
+        .find(|r| r.credential_type == target_cred)
+        .and_then(|r| r.signal.as_ref())
+        .map(crate::crypto::encode_signal)
+        .unwrap_or_else(|| crate::crypto::encode_signal(&Signal::from_string("")));
+
+    (verification_level, signal)
 }
 
 /// Encrypted payload sent to/from the bridge
@@ -166,6 +197,9 @@ impl Session {
         #[cfg(not(feature = "native-crypto"))]
         let (key_bytes, nonce_bytes) = crate::crypto::generate_key()?;
 
+        // Derive legacy fields for World App 3.0 compatibility
+        let (verification_level, signal) = derive_legacy_fields(&requests);
+
         // Prepare the payload
         let payload = BridgeRequestPayload {
             app_id: app_id.as_str().to_string(),
@@ -173,6 +207,8 @@ impl Session {
             action_description,
             requests: requests.clone(),
             constraints,
+            signal,
+            verification_level,
         };
 
         let payload_json = serde_json::to_vec(&payload)?;
@@ -226,38 +262,6 @@ impl Session {
         })
     }
 
-    /// Creates a session from a verification level
-    ///
-    /// This is a convenience method that maps a verification level (like "device" or "orb")
-    /// to the appropriate set of credential requests and constraints.
-    ///
-    /// # Errors
-    ///
-    /// Returns an error if the session cannot be created or the request fails
-    pub async fn from_verification_level(
-        app_id: AppId,
-        action: impl Into<String>,
-        verification_level: VerificationLevel,
-        signal: impl Into<String>,
-    ) -> Result<Self> {
-        let signal_str = signal.into();
-        let credentials = verification_level.to_credentials();
-
-        let requests = credentials
-            .iter()
-            .map(|cred| Request::new(*cred, Some(Signal::from_string(signal_str.clone()))))
-            .collect();
-
-        let constraints = Constraints::new(ConstraintNode::any(
-            credentials
-                .into_iter()
-                .map(ConstraintNode::credential)
-                .collect(),
-        ));
-
-        Self::create_with_options(app_id, action, requests, None, Some(constraints), None).await
-    }
-
     /// Returns the connect URL for World App
     #[must_use]
     pub fn connect_url(&self) -> String {
@@ -436,37 +440,6 @@ impl SessionWrapper {
         Ok(Self { runtime, inner })
     }
 
-    /// Creates a session from a verification level
-    ///
-    /// # Errors
-    ///
-    /// Returns an error if the session cannot be created or the request fails
-    #[uniffi::constructor]
-    pub fn from_verification_level(
-        app_id: String,
-        action: String,
-        verification_level: VerificationLevel,
-        signal: String,
-    ) -> std::result::Result<Self, crate::error::IdkitError> {
-        let runtime =
-            tokio::runtime::Runtime::new().map_err(|e| crate::error::IdkitError::BridgeError {
-                details: format!("Failed to create runtime: {e}"),
-            })?;
-
-        let app_id_parsed = AppId::new(&app_id)?;
-
-        let inner = runtime
-            .block_on(Session::from_verification_level(
-                app_id_parsed,
-                action,
-                verification_level,
-                signal,
-            ))
-            .map_err(crate::error::IdkitError::from)?;
-
-        Ok(Self { runtime, inner })
-    }
-
     /// Returns the connect URL for World App
     #[must_use]
     pub fn connect_url(&self) -> String {
@@ -531,17 +504,24 @@ mod tests {
     #[test]
     fn test_bridge_request_payload_serialization() {
         let request = Request::new(CredentialType::Orb, Some(Signal::from_string("test")));
+        let requests = vec![request];
+        let (verification_level, signal) = derive_legacy_fields(&requests);
+
         let payload = BridgeRequestPayload {
             app_id: "app_test".to_string(),
             action: "test_action".to_string(),
             action_description: Some("Test description".to_string()),
-            requests: vec![request],
+            requests,
             constraints: None,
+            signal,
+            verification_level,
         };
 
         let json = serde_json::to_string(&payload).unwrap();
         assert!(json.contains("app_test"));
         assert!(json.contains("test_action"));
+        assert!(json.contains("verification_level"));
+        assert!(json.contains("\"signal\":\"0x"));
     }
 
     #[test]
diff --git a/rust/core/src/types.rs b/rust/core/src/types.rs
index 0bdc04c..a56ac9e 100644
--- a/rust/core/src/types.rs
+++ b/rust/core/src/types.rs
@@ -470,6 +470,39 @@ impl VerificationLevel {
             ],
         }
     }
+
+    /// Derives the maximum (least restrictive) verification level from credential types.
+    ///
+    /// Priority (most → least restrictive): orb > secure_document > document > face > device
+    #[must_use]
+    pub fn from_credential_types(types: &[CredentialType]) -> Self {
+        // Check in reverse priority order (least restrictive first)
+        if types.contains(&CredentialType::Device) {
+            Self::Device
+        } else if types.contains(&CredentialType::Face) {
+            Self::Face
+        } else if types.contains(&CredentialType::Document) {
+            Self::Document
+        } else if types.contains(&CredentialType::SecureDocument) {
+            Self::SecureDocument
+        } else {
+            Self::Orb
+        }
+    }
+
+    /// Returns the primary credential type for this verification level.
+    ///
+    /// This is the credential type that determines the level (the least restrictive one).
+    #[must_use]
+    pub const fn primary_credential(&self) -> CredentialType {
+        match self {
+            Self::Orb => CredentialType::Orb,
+            Self::Face => CredentialType::Face,
+            Self::Device => CredentialType::Device,
+            Self::SecureDocument => CredentialType::SecureDocument,
+            Self::Document => CredentialType::Document,
+        }
+    }
 }
 
 // UniFFI helper function for CredentialType
@@ -620,4 +653,74 @@ mod tests {
             ]
         );
     }
+
+    #[test]
+    fn test_verification_level_from_credential_types() {
+        // Priority (most → least restrictive): orb > secure_document > document > face > device
+
+        // Single credentials
+        assert_eq!(
+            VerificationLevel::from_credential_types(&[CredentialType::Orb]),
+            VerificationLevel::Orb
+        );
+        assert_eq!(
+            VerificationLevel::from_credential_types(&[CredentialType::Device]),
+            VerificationLevel::Device
+        );
+        assert_eq!(
+            VerificationLevel::from_credential_types(&[CredentialType::Face]),
+            VerificationLevel::Face
+        );
+
+        // Multiple credentials - should return least restrictive
+        assert_eq!(
+            VerificationLevel::from_credential_types(&[
+                CredentialType::Orb,
+                CredentialType::Device
+            ]),
+            VerificationLevel::Device
+        );
+        assert_eq!(
+            VerificationLevel::from_credential_types(&[CredentialType::Orb, CredentialType::Face]),
+            VerificationLevel::Face
+        );
+        assert_eq!(
+            VerificationLevel::from_credential_types(&[
+                CredentialType::Orb,
+                CredentialType::SecureDocument,
+                CredentialType::Document
+            ]),
+            VerificationLevel::Document
+        );
+
+        // Empty defaults to Orb
+        assert_eq!(
+            VerificationLevel::from_credential_types(&[]),
+            VerificationLevel::Orb
+        );
+    }
+
+    #[test]
+    fn test_verification_level_primary_credential() {
+        assert_eq!(
+            VerificationLevel::Orb.primary_credential(),
+            CredentialType::Orb
+        );
+        assert_eq!(
+            VerificationLevel::Device.primary_credential(),
+            CredentialType::Device
+        );
+        assert_eq!(
+            VerificationLevel::Face.primary_credential(),
+            CredentialType::Face
+        );
+        assert_eq!(
+            VerificationLevel::SecureDocument.primary_credential(),
+            CredentialType::SecureDocument
+        );
+        assert_eq!(
+            VerificationLevel::Document.primary_credential(),
+            CredentialType::Document
+        );
+    }
 }
diff --git a/rust/core/src/wasm_bindings.rs b/rust/core/src/wasm_bindings.rs
index d204e36..a769662 100644
--- a/rust/core/src/wasm_bindings.rs
+++ b/rust/core/src/wasm_bindings.rs
@@ -7,7 +7,7 @@
 #![allow(clippy::missing_panics_doc)]
 #![allow(clippy::future_not_send)]
 
-use crate::{CredentialType, Signal, VerificationLevel};
+use crate::{CredentialType, Signal};
 use serde::Serialize;
 use std::cell::RefCell;
 use std::rc::Rc;
@@ -251,54 +251,6 @@ pub struct Session {
 
 #[wasm_bindgen]
 impl Session {
-    /// Creates a new session from a verification level
-    ///
-    /// This is a convenience method that maps a verification level (like `"device"` or `"orb"`)
-    /// to the appropriate set of credential requests and constraints.
-    ///
-    /// # Errors
-    ///
-    /// Returns an error if the session cannot be created or the request fails
-    ///
-    /// # Arguments
-    ///
-    /// * `app_id` - Application ID from the Developer Portal (e.g., `"app_staging_xxxxx"`)
-    /// * `action` - Action identifier
-    /// * `verification_level` - Verification level as string (`"orb"`, `"device"`, etc.)
-    /// * `signal` - Optional signal string for cryptographic binding
-    #[wasm_bindgen(constructor)]
-    #[allow(clippy::new_ret_no_self)] // WASM async constructors return Promise
-    pub fn new(
-        app_id: String,
-        action: String,
-        verification_level: JsValue,
-        signal: Option<String>,
-    ) -> js_sys::Promise {
-        future_to_promise(async move {
-            // Parse app_id
-            let app_id = crate::AppId::new(app_id)
-                .map_err(|e| JsValue::from_str(&format!("Invalid app_id: {e}")))?;
-
-            // Parse verification level
-            let vl: VerificationLevel = serde_wasm_bindgen::from_value(verification_level)
-                .map_err(|e| JsValue::from_str(&format!("Invalid verification_level: {e}")))?;
-
-            // Create session
-            let session = crate::Session::from_verification_level(
-                app_id,
-                action,
-                vl,
-                signal.unwrap_or_default(),
-            )
-            .await
-            .map_err(|e| JsValue::from_str(&format!("Failed to create session: {e}")))?;
-
-            Ok(JsValue::from(Self {
-                inner: Rc::new(RefCell::new(Some(session))),
-            }))
-        })
-    }
-
     /// Creates a new session from explicit requests and optional constraints
     ///
     /// # Arguments

From e3da0407514e06e93475ddbbbecab90425819cbf Mon Sep 17 00:00:00 2001
From: Takis Kakalis <80459599+Takaros999@users.noreply.github.com>
Date: Fri, 16 Jan 2026 11:13:40 +0100
Subject: [PATCH 2/4] native packages

---
 kotlin/README.md                                  |  1 -
 .../src/main/kotlin/com/worldcoin/idkit/IdKit.kt  | 14 +-------------
 swift/Examples/BasicVerification.swift            | 15 +++++++++------
 swift/README.md                                   | 14 +-------------
 swift/Tests/IDKitTests/IDKitTests.swift           |  7 -------
 5 files changed, 11 insertions(+), 40 deletions(-)

diff --git a/kotlin/README.md b/kotlin/README.md
index eba45e2..7be0dcc 100644
--- a/kotlin/README.md
+++ b/kotlin/README.md
@@ -26,4 +26,3 @@ Set `SKIP_ANDROID=1` to skip Android builds (useful on local Macs without Docker
 - `IdKit.request(...)` / `requestAbi(...)` – build requests with optional faceAuth
 - `IdKit.anyOf(...)` / `allOf(...)` – quick constraints
 - `IdKit.session(...)` – create sessions with optional description/constraints/bridge URL
-- `IdKit.sessionFromVerificationLevel(...)` – verification-level shortcut
diff --git a/kotlin/bindings/src/main/kotlin/com/worldcoin/idkit/IdKit.kt b/kotlin/bindings/src/main/kotlin/com/worldcoin/idkit/IdKit.kt
index 96227e9..2be7df8 100644
--- a/kotlin/bindings/src/main/kotlin/com/worldcoin/idkit/IdKit.kt
+++ b/kotlin/bindings/src/main/kotlin/com/worldcoin/idkit/IdKit.kt
@@ -6,11 +6,10 @@ import uniffi.idkit.Request
 import uniffi.idkit.Session
 import uniffi.idkit.Signal
 import uniffi.idkit_core.CredentialType
-import uniffi.idkit_core.VerificationLevel
 
 /**
  * Lightweight Kotlin conveniences mirroring the Swift helpers and adding
- * simple factories for common flows (multiple requests, verification level).
+ * simple factories for common flows.
  *
  * These wrap the UniFFI-generated types but keep everything in Kotlin land.
  */
@@ -69,15 +68,4 @@ object IdKit {
             )
         else -> Session.create(appId, action, requests)
     }
-
-    /**
-     * Convenience to map a verification level into the appropriate requests/constraints.
-     * Equivalent to the Swift `fromVerificationLevel` convenience.
-     */
-    fun sessionFromVerificationLevel(
-        appId: String,
-        action: String,
-        verificationLevel: VerificationLevel,
-        signal: String = "",
-    ): Session = Session.fromVerificationLevel(appId, action, verificationLevel, signal)
 }
diff --git a/swift/Examples/BasicVerification.swift b/swift/Examples/BasicVerification.swift
index 17a1167..570a4ed 100644
--- a/swift/Examples/BasicVerification.swift
+++ b/swift/Examples/BasicVerification.swift
@@ -73,14 +73,17 @@ func verificationWithStatusUpdates() async throws {
     }
 }
 
-/// Example: Using verification level (Rust convenience method)
+/// Example: Simple Orb verification (convenience pattern)
 @available(macOS 12.0, iOS 15.0, *)
-func verificationWithLevel() async throws {
-    let session = try Session.fromVerificationLevel(
+func verificationSimple() async throws {
+    // Simple helper: create Orb request with signal
+    let signal = Signal.fromString(s: "session_token_abc123")
+    let request = Request(credentialType: .orb, signal: signal)
+
+    let session = try Session.create(
         appId: "app_staging_1234567890abcdef",
         action: "login",
-        verificationLevel: .orb,
-        signal: "session_token_abc123"
+        requests: [request]
     )
 
     print("📱 QR Code: \(session.connectUrl())\n")
@@ -221,7 +224,7 @@ struct ExamplesRunner {
 
             // try await basicVerification()
             // try await verificationWithStatusUpdates()
-            // try await verificationWithLevel()
+            // try await verificationSimple()
             // try await verificationWithConstraints()
             // try await verificationWithFaceAuth()
             // try await verificationWithAbiSignal()
diff --git a/swift/README.md b/swift/README.md
index 363d681..057c33c 100644
--- a/swift/README.md
+++ b/swift/README.md
@@ -88,17 +88,6 @@ for try await status in session.status() {
 }
 ```
 
-### Using Verification Level
-
-```swift
-let session = try Session.fromVerificationLevel(
-    appId: "app_staging_123abc",
-    action: "login",
-    verificationLevel: .orb,
-    signal: "session_token"
-)
-```
-
 ### Multiple Requests with Constraints
 
 ```swift
@@ -153,9 +142,8 @@ All core types are generated by UniFFI from the Rust implementation. This ensure
 **Static Methods:**
 - `create(appId:action:requests:)` - Create session
 - `createWithOptions(appId:action:requests:actionDescription:constraints:bridgeUrl:)` - Full options
-- `fromVerificationLevel(appId:action:verificationLevel:signal:)` - Convenience method
 
-- **Instance Methods:**
+**Instance Methods:**
 - `pollForStatus() -> Status` - Poll for status (blocking)
 - `connectUrl() -> String` - Get connection URL
 - `requestId() -> String` - Get request ID
diff --git a/swift/Tests/IDKitTests/IDKitTests.swift b/swift/Tests/IDKitTests/IDKitTests.swift
index 81cedfc..dcd5e81 100644
--- a/swift/Tests/IDKitTests/IDKitTests.swift
+++ b/swift/Tests/IDKitTests/IDKitTests.swift
@@ -157,13 +157,6 @@ func sessionCreationAPIShape() {
         bridgeUrl: nil
     )
 
-    _ = try? Session.fromVerificationLevel(
-        appId: "app_test_invalid",
-        action: "test",
-        verificationLevel: .orb,
-        signal: "test"
-    )
-
     // If we reach here without crashing, the APIs exist
     #expect(Bool(true))
 }

From 01af092d1be7579639f737588755463f3f15bac6 Mon Sep 17 00:00:00 2001
From: Takis Kakalis <80459599+Takaros999@users.noreply.github.com>
Date: Fri, 16 Jan 2026 11:14:54 +0100
Subject: [PATCH 3/4] remove ghost button

---
 js/examples/browser/index.html | 1 -
 1 file changed, 1 deletion(-)

diff --git a/js/examples/browser/index.html b/js/examples/browser/index.html
index 16f989e..b574ed2 100644
--- a/js/examples/browser/index.html
+++ b/js/examples/browser/index.html
@@ -13,7 +13,6 @@ <h1>IDKit Browser Example</h1>
         <button id="verifyOrb">Verify with Orb</button>
         <button id="verifyFace">Verify with Face</button>
         <button id="verifyDevice">Verify with Device</button>
-        <button id="verifyMultiple">Verify with Multiple (Orb + Device)</button>
     </div>
 
     <section id="qr" hidden>

From 082ca9dc9b9b99b886e684e270a4392843ac2b58 Mon Sep 17 00:00:00 2001
From: Takis Kakalis <80459599+Takaros999@users.noreply.github.com>
Date: Fri, 16 Jan 2026 11:17:52 +0100
Subject: [PATCH 4/4] clippy

---
 rust/core/src/bridge.rs | 10 ++++++----
 rust/core/src/types.rs  |  2 +-
 2 files changed, 7 insertions(+), 5 deletions(-)

diff --git a/rust/core/src/bridge.rs b/rust/core/src/bridge.rs
index cfec983..27d4e56 100644
--- a/rust/core/src/bridge.rs
+++ b/rust/core/src/bridge.rs
@@ -43,13 +43,13 @@ struct BridgeRequestPayload {
     verification_level: VerificationLevel,
 }
 
-/// Derives legacy bridge fields (verification_level, hashed signal) from requests.
+/// Derives legacy bridge fields (`verification_level`, hashed signal) from requests.
 ///
 /// This enables backwards compatibility with World App 3.0 which expects:
 /// - `verification_level`: The maximum (least restrictive) level from all credential types
 /// - `signal`: The hashed signal from the request with the max credential type
 ///
-/// Priority (most → least restrictive): orb > secure_document > document > face > device
+/// Priority (most to least restrictive): orb > `secure_document` > document > face > device
 //TODO: This is not 100% accurate, will refine this in a followup PR, but for now it "works".
 fn derive_legacy_fields(requests: &[Request]) -> (VerificationLevel, String) {
     let cred_types: Vec<_> = requests.iter().map(|r| r.credential_type).collect();
@@ -61,8 +61,10 @@ fn derive_legacy_fields(requests: &[Request]) -> (VerificationLevel, String) {
         .iter()
         .find(|r| r.credential_type == target_cred)
         .and_then(|r| r.signal.as_ref())
-        .map(crate::crypto::encode_signal)
-        .unwrap_or_else(|| crate::crypto::encode_signal(&Signal::from_string("")));
+        .map_or_else(
+            || crate::crypto::encode_signal(&Signal::from_string("")),
+            crate::crypto::encode_signal,
+        );
 
     (verification_level, signal)
 }
diff --git a/rust/core/src/types.rs b/rust/core/src/types.rs
index a56ac9e..139c3a1 100644
--- a/rust/core/src/types.rs
+++ b/rust/core/src/types.rs
@@ -473,7 +473,7 @@ impl VerificationLevel {
 
     /// Derives the maximum (least restrictive) verification level from credential types.
     ///
-    /// Priority (most → least restrictive): orb > secure_document > document > face > device
+    /// Priority (most to least restrictive): orb > `secure_document` > document > face > device
     #[must_use]
     pub fn from_credential_types(types: &[CredentialType]) -> Self {
         // Check in reverse priority order (least restrictive first)