Add browser global CDN build to idkit-core by kchaw2005 · Pull Request #288 · worldcoin/idkit

kchaw2005 · 2026-06-20T04:46:26Z

The Issue

Currently Razer uses a drop in CDN script-tag to implement a deprecated version of @worldcoin/idkit-js (also now deprecated). The src for the exact unpkg endpoint they use can be found here. We needed a drop in way for them to implement new IDKit 4.0 sessions and features without reviving @worldcoin/idkit-standalone or creating another package.

The Fix

Create a browser entrypoint at browser.ts and build it as a CDN-friendly IIFE artifact from the existing @worldcoin/idkit-core.
The new script-tag build exposes the existing core client namespace as window.IDKit.

This keeps the existing npm import API unchanged while adding a browser-global artifact at:

dist/idkit.global.js

The build also copies the WASM artifact into dist/ so the CDN script can automatically load:

dist/idkit_wasm_bg.wasm

Release Note

This requires publishing a new @worldcoin/idkit-core package version before the npm CDN URL
works. After publish, partners can load:

<script src="https://unpkg.com/@worldcoin/idkit-core@<version>/dist/idkit.global.js"></script>

Note

Low Risk
Additive packaging and documentation; client npm exports unchanged and signing is not exposed on the browser global.

Overview
Adds a script-tag / CDN path for @worldcoin/idkit-core so partners can load IDKit 4.x via unpkg/jsdelivr without a separate standalone package.

A new src/browser.ts entry assigns the existing client IDKit namespace to window.IDKit and deliberately omits RP signing (still /signing on the server). tsup now runs a second minified IIFE build to dist/idkit.global.js, with unpkg / jsdelivr in package.json pointing at that file; WASM copy to dist/idkit_wasm_bg.wasm is shared with the ESM/CJS build via a refactored copyWasmToDist.

js/packages/core/README.md documents CDN usage and a minimal window.IDKit example. The browser example gains a Use CDN version toggle that dynamically loads the unpkg package root and runs the same verification flow through window.IDKit (presets resolved by name on the loaded namespace).

^{Reviewed by Cursor Bugbot for commit 741b5d5. Bugbot is set up for automated code reviews on this repo. Configure here.}

…azer to drop in new IDKit configs

…ed atest file to stress test concurrent requests and more

vercel · 2026-06-20T04:46:32Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
idkit-js-example	Ready	Preview, Comment	Jun 22, 2026 11:26pm

kchaw2005 · 2026-06-20T04:58:39Z

reminder to remove dist/idkit.global.js and dist/idkit_wasm_bg.wasm from the branch entirely before we merge this

Takaros999 · 2026-06-20T17:11:00Z

@codex review

Takaros999

high level:

instead of adding 2 examples, feel free to edit the existing browser/index.html we have
in order to test this e2e, you can publish the package with a different name (from your computer) and try to use it in a real example
remove the new dist entries

Takaros999 · 2026-06-20T19:18:09Z

we don't need another example here

Takaros999 · 2026-06-20T19:18:19Z

same, we should remove this

Takaros999 · 2026-06-20T19:18:30Z

why are we commiting this?

Takaros999 · 2026-06-20T19:19:55Z

WASM context right now there is a script that builds wasm file into js/packages/core/wasm/... then the typescript copies that into js/packages/core/dist to include in the final npm package. this seems redundant and we shouldn't commit it

Takaros999 · 2026-06-20T19:20:06Z

what is the purpose of this test?

Takaros999 · 2026-06-20T19:24:20Z

+    "./idkit.global.js": "./dist/idkit.global.js",
+    "./idkit_wasm_bg.wasm": "./dist/idkit_wasm_bg.wasm"


do we really need this? what's the purpose?

Takaros999 · 2026-06-20T19:48:53Z

+ * it from document.currentScript because classic scripts do not have
+ * import.meta.url.
+ */
+export function setWasmInput(


can we try without this first? it might not be needed

…instead read only expose connected unpkg url

…an retry instead of reusing a stale rejected promise.

…build because of possible race condition

cursor

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 097d3d2. Configure here.}

cursor · 2026-06-22T21:43:04Z

+    clean: moduleCleanPaths,
+    treeshake: true,
+    outDir: "dist",
+    onSuccess: copyWasmToDist,


Partial clean keeps stale WASM

Medium Severity

The module build switched from wiping all of dist to selective globs that never remove idkit_wasm_bg.wasm. When copyWasmToDist skips because wasm/idkit_wasm_bg.wasm is missing, an older binary can remain alongside freshly built JS, including idkit.global.js, so CDN and npm consumers may load mismatched WASM.

^{Reviewed by Cursor Bugbot for commit 097d3d2. Configure here.}

Takaros999 · 2026-06-22T22:04:01Z

@codex review

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 097d3d27b6

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-06-22T22:08:26Z

+  },
+  {
+    entry: { idkit: "src/browser.ts" },
+    format: ["iife"],


Preserve WASM URL resolution in the global build

When this entrypoint is emitted as an IIFE, it still bundles src/lib/wasm.ts; every IDKit.request(...).preset/constraints path calls initIDKit(), which invokes the wasm-pack loader without an explicit URL. That loader resolves idkit_wasm_bg.wasm from import.meta.url, but an IIFE/classic script has no module URL, so CDN consumers will fail during WASM initialization instead of loading the sibling .wasm file. Capture/pass a script-relative WASM URL for the global build or avoid bundling the wasm glue into an IIFE.

Useful? React with 👍 / 👎.

Takaros999

lgtm can you check the last comment from codex to see if it's valid

Takaros999 · 2026-06-22T22:10:16Z

+      import { IDKit } from "@worldcoin/idkit-core";
+
+      const CDN_IDKIT_SCRIPT_URL =
+        "https://unpkg.com/@worldcoin/idkit-core/dist/idkit.global.js";


Suggested change

"https://unpkg.com/@worldcoin/idkit-core/dist/idkit.global.js";

"https://unpkg.com/@worldcoin/idkit-core";

because you added the unpckg field in package.json it will default to that and we can skip the dist/idkit.global.js part

…ts there once published)

Takaros999

LGTM, tbh I would change the browser index.html to only use the CDN script you can

kchaw2005 added 3 commits June 19, 2026 20:43

built a CDN script-tag entrypoint and package build config to allow r…

dda38b6

…azer to drop in new IDKit configs

have to add wasm and global package builds to test cdn delivery

119e657

renamed example html pages to match the right capabilities and includ…

17ab45a

…ed atest file to stress test concurrent requests and more

kchaw2005 requested review from Gr1dlock, Guardiola31337, SeanROlszewski, Takaros999, andy-t-wang, chipp, murph and paolodamico as code owners June 20, 2026 04:46

Takaros999 reviewed Jun 20, 2026

View reviewed changes

remove generated dist artfacts

5614574

vercel Bot deployed to Preview June 21, 2026 01:16 View deployment

kchaw2005 added 3 commits June 22, 2026 09:14

"removed unnecessary distribution files from package.json

b2bec55

delete unnecessary test file

8b4ad78

combine html examples into the one existing index.html

d50a6a2

github-advanced-security AI found potential problems Jun 22, 2026

View reviewed changes

Comment thread js/examples/browser/index.html Fixed

cursor Bot reviewed Jun 22, 2026

View reviewed changes

Comment thread js/examples/browser/index.html Outdated

vercel Bot deployed to Preview June 22, 2026 17:37 View deployment

revamped index.html to not expoose any possible URL input fields and …

4fad093

…instead read only expose connected unpkg url

cursor Bot reviewed Jun 22, 2026

View reviewed changes

Comment thread js/examples/browser/index.html Outdated

Comment thread js/examples/browser/index.html

vercel Bot deployed to Preview June 22, 2026 18:15 View deployment

kchaw2005 added 2 commits June 22, 2026 11:21

fix clippy formatting errors

446a42f

Reset cached CDN load promise on failed script load so the CDN flow c…

c5fbf07

…an retry instead of reusing a stale rejected promise.

vercel Bot deployed to Preview June 22, 2026 18:37 View deployment

remove generated webassembly

0628858

cursor Bot reviewed Jun 22, 2026

View reviewed changes

Comment thread js/packages/core/tsup.config.ts Outdated

vercel Bot deployed to Preview June 22, 2026 20:21 View deployment

make sure default package build doesn' delete idkit.global.js in cdn …

aeef577

…build because of possible race condition

vercel Bot deployed to Preview June 22, 2026 21:14 View deployment

clippy

097d3d2

cursor Bot reviewed Jun 22, 2026

View reviewed changes

vercel Bot deployed to Preview June 22, 2026 21:44 View deployment

chatgpt-codex-connector Bot reviewed Jun 22, 2026

View reviewed changes

Takaros999 previously approved these changes Jun 22, 2026

View reviewed changes

remove unnecessary /dist/idkit.global.js path inclusion (unpkg defaul…

ff4f7dc

…ts there once published)

kchaw2005 dismissed Takaros999’s stale review via ff4f7dc June 22, 2026 23:17

vercel Bot deployed to Preview June 22, 2026 23:20 View deployment

clip

741b5d5

vercel Bot deployed to Preview June 22, 2026 23:26 View deployment

Takaros999 approved these changes Jun 22, 2026

View reviewed changes

Takaros999 merged commit 83e2878 into main Jun 23, 2026
19 checks passed

Takaros999 deleted the kartike/add-cdn-idkit branch June 23, 2026 00:02

		"./idkit.global.js": "./dist/idkit.global.js",
		"./idkit_wasm_bg.wasm": "./dist/idkit_wasm_bg.wasm"

	"https://unpkg.com/@worldcoin/idkit-core/dist/idkit.global.js";
	"https://unpkg.com/@worldcoin/idkit-core";

Conversation

kchaw2005 commented Jun 20, 2026 • edited by cursor Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

The Issue

The Fix

Release Note

Uh oh!

vercel Bot commented Jun 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

kchaw2005 commented Jun 20, 2026

Uh oh!

Takaros999 commented Jun 20, 2026

Uh oh!

Takaros999 left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

cursor Bot Jun 22, 2026

Choose a reason for hiding this comment

Partial clean keeps stale WASM

Uh oh!

Takaros999 commented Jun 22, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot Jun 22, 2026

Choose a reason for hiding this comment

Uh oh!

Takaros999 left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Takaros999 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

kchaw2005 commented Jun 20, 2026 •

edited by cursor Bot

Loading

vercel Bot commented Jun 20, 2026 •

edited

Loading