feat: initial JS bindings

.github/workflows/codeql.yml

@@ -0,0 +1,129 @@
+name: CodeQL Security Analysis
+
+on:
+  push:
+    branches: ['main']
+  pull_request:
+    branches: ['main']
+  schedule:
+    - cron: '0 0 * * 0'  # Weekly on Sunday
+
+permissions:
+  security-events: write
+  contents: read
+  actions: read
+
+jobs:
+  analyze-rust:
+    name: Analyze Rust
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup Rust toolchain
+        uses: actions-rust-lang/setup-rust-toolchain@v1
+        with:
+          toolchain: stable
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v3
+        with:
+          languages: rust
+          queries: security-extended
+
+      - name: Build Rust code
+        run: cargo build --release
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v3
+        with:
+          category: "/language:rust"
+
+  analyze-swift:
+    name: Analyze Swift
+    runs-on: macos-15
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup Rust toolchain
+        uses: actions-rust-lang/setup-rust-toolchain@v1
+        with:
+          toolchain: stable
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v3
+        with:
+          languages: swift
+          queries: security-extended
+
+      - name: Generate Swift bindings
+        run: bash scripts/package-swift.sh
+
+      - name: Build Swift package
+        working-directory: swift
+        run: swift build
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v3
+        with:
+          category: "/language:swift"
+
+  analyze-javascript:
+    name: Analyze JavaScript
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Check if WASM build script exists
+        id: check_script
+        run: |
+          if [ -f "scripts/build-wasm.sh" ]; then
+            echo "script_exists=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "script_exists=false" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Setup Node.js
+        if: steps.check_script.outputs.script_exists == 'true'
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+
+      - name: Setup Rust toolchain
+        if: steps.check_script.outputs.script_exists == 'true'
+        uses: actions-rust-lang/setup-rust-toolchain@v1
+        with:
+          toolchain: stable
+
+      - name: Install wasm-pack
+        if: steps.check_script.outputs.script_exists == 'true'
+        run: curl https://rustwasm.github.io/wasm-pack/installer/init.sh -sSf | sh
+
+      - name: Initialize CodeQL
+        if: steps.check_script.outputs.script_exists == 'true'
+        uses: github/codeql-action/init@v3
+        with:
+          languages: javascript-typescript
+          queries: security-extended
+
+      - name: Build WASM bindings
+        if: steps.check_script.outputs.script_exists == 'true'
+        run: bash scripts/build-wasm.sh
+
+      - name: Install dependencies
+        if: steps.check_script.outputs.script_exists == 'true'
+        run: |
+          cd js/packages/core
+          npm install
+
+      - name: Build TypeScript
+        if: steps.check_script.outputs.script_exists == 'true'
+        run: |
+          cd js/packages/core
+          npm run build
+
+      - name: Perform CodeQL Analysis
+        if: steps.check_script.outputs.script_exists == 'true'
+        uses: github/codeql-action/analyze@v3
+        with:
+          category: "/language:javascript-typescript"

js/package.json

@@ -0,0 +1,22 @@
+{
+  "name": "idkit-monorepo",
+  "version": "3.0.0",
+  "private": true,
+  "description": "World ID SDK for Relying Parties - JavaScript packages",
+  "scripts": {
+    "build": "pnpm -r build",
+    "dev": "pnpm -r dev",
+    "lint": "pnpm -r lint",
+    "test": "pnpm -r test"
+  },
+  "devDependencies": {
+    "@changesets/cli": "^2.27",
+    "prettier": "^3.3",
+    "typescript": "^5.6",
+    "turbo": "^2.2"
+  },
+  "packageManager": "pnpm@9.12.2",
+  "engines": {
+    "node": ">=18"
+  }
+}

js/packages/core/README.md

@@ -0,0 +1,121 @@
+# @worldcoin/idkit-core
+
+Core bridge logic for IDKit (World ID SDK) powered by Rust/WASM.
+
+## Installation
+
+```bash
+npm install @worldcoin/idkit-core
+# or
+pnpm add @worldcoin/idkit-core
+```
+
+## Quick Start
+
+```typescript
+import {
+  useWorldBridgeStore,
+  VerificationLevel,
+} from '@worldcoin/idkit-core'
+
+// 1. Get store instance
+const store = useWorldBridgeStore()
+
+// 2. Create verification request (auto-initializes WASM on first call)
+await store.createClient({
+  app_id: 'app_staging_xxxxx',
+  action: 'my-action',
+  verification_level: VerificationLevel.Orb,
+  signal: 'user-id-123',
+})
+
+// 3. Get QR code URL for World App
+console.log('Scan this:', store.connectorURI)
+
+// 4. Poll for proof
+await store.pollForUpdates()
+
+// 5. Check result
+const { result, errorCode, verificationState } = store
+if (result) {
+  console.log('Proof received:', result)
+}
+```
+
+## API Reference
+
+### Store
+
+```typescript
+const store = useWorldBridgeStore()
+```
+
+**State:**
+- `verificationState: VerificationState` - Current verification state
+- `connectorURI: string | null` - QR code URL for World App
+- `result: ISuccessResult | null` - Proof data when verified
+- `errorCode: AppErrorCodes | null` - Error code if failed
+
+**Methods:**
+- `createClient(config: IDKitConfig): Promise<void>` - Start verification request
+- `pollForUpdates(): Promise<void>` - Check for proof (call repeatedly)
+- `reset(): void` - Clear state and start over
+
+### Types
+
+```typescript
+interface IDKitConfig {
+  app_id: `app_${string}`
+  action: string
+  signal?: string
+  verification_level?: VerificationLevel
+  bridge_url?: string
+  partner?: boolean
+}
+
+interface ISuccessResult {
+  proof: string
+  merkle_root: string
+  nullifier_hash: string
+  verification_level: VerificationLevel
+}
+
+enum VerificationLevel {
+  Orb = 'orb',
+  Face = 'face',
+  Device = 'device',
+  Document = 'document',
+  SecureDocument = 'secure_document',
+}
+```
+
+### Utilities
+
+```typescript
+// Signal hashing (keccak256)
+hashToField(input: string): HashFunctionOutput
+
+// ABI encoding
+solidityEncode(types: string[], values: unknown[]): AbiEncodedValue
+```
+
+## Examples
+
+See [examples/browser](./examples/browser) for a complete working example.
+
+## Building from Source
+
+```bash
+# Build WASM module
+npm run build:wasm
+
+# Build TypeScript
+npm run build:ts
+
+# Or both
+npm run build
+```
+
+## License
+
+MIT

js/packages/core/examples/browser/README.md

@@ -0,0 +1,68 @@
+# IDKit Browser Example
+
+A simple browser example demonstrating World ID verification using IDKit 3.0.
+
+## Usage
+
+#### Local Development
+
+1. Build the core package:
+```bash
+cd ../../
+pnpm build
+```
+
+2. Serve the example:
+```bash
+cd examples/browser
+python3 -m http.server 8000
+# or
+npx serve
+```
+
+3. Open http://localhost:8000 in your browser
+
+#### Production
+
+Replace the import in `index.html`:
+
+```javascript
+// From:
+import { initIDKit, Session, Credential } from '../../dist/index.js';
+
+// To:
+import { initIDKit, Session, Credential } from '@worldcoin/idkit-core';
+```
+
+## Configuration
+
+Update these values in `index.html`:
+
+```javascript
+const APP_ID = 'app_staging_123'; // Your app ID from the Developer Portal
+const ACTION = 'demo-action';     // Your action identifier from the Developer Portal
+```
+
+## API Usage
+
+```javascript
+// 1. Initialize WASM
+await initIDKit();
+
+// 2. Create session
+const session = await Session.create({
+    app_id: 'app_xxx',
+    action: 'my-action',
+    requests: [{
+        type: Credential.Orb,
+        signal: 'my-signal',
+    }],
+});
+
+// 3. Get QR code URL
+const url = session.connectUrl();
+
+// 4. Wait for proof
+const proof = await session.waitForProof();
+console.log(proof);
+```