@lemmaoracle/seal 0.1.7 → 0.3.1

package/README.md

@@ -3,23 +3,27 @@
 ZK auth circuit for **Proof-based sign-in** to the Lemma developer dashboard.
 
 `seal` lets a developer prove they hold a valid Lemma API key **without
-revealing the key**. It is a [zero-knowledge proof](https://lemma.frame00.com)
-of the pre-image of the key's SHA-256 hash.
+revealing the key or even which key it is**. It produces a per-session
+Poseidon nullifier that is unique to the (secret, nonce) pair but reveals
+nothing about the underlying secret or its SHA-256 hash.
 
 ## How it works
 
 The dashboard's sign-in flow:
 
 1. The dashboard BFF issues a challenge `nonce`.
-2. The developer generates a `seal` proof: it proves knowledge of the
-   API key whose SHA-256 hash equals the `key_hash` stored in the
-   workers `api_keys` table, bound to that `nonce`.
-3. The BFF verifies the proof, reads the attested `key_hash`, looks it
-   up in `api_keys`, and resolves the caller's `scope_id`.
-4. The BFF issues a session token tied to the scope.
-
-The proof reveals only the `key_hash` (already public, since it is what
-the API stores) and the `nonce` — never the API key itself.
+2. The developer generates a `seal` proof: it proves knowledge of *a*
+   secret whose SHA-256 hash is registered in the workers `api_keys`
+   table, bound to that `nonce`. The public output is a **nullifier** —
+   `Poseidon(keyHash_hi, keyHash_lo, nonce)` — not the key hash itself.
+3. The BFF verifies the proof, then iterates registered `key_hash`
+   values in D1, computing the expected nullifier for each until it
+   finds a match (O(N), sub-millisecond per check).
+4. The BFF issues a session token tied to the resolved scope.
+
+The proof reveals neither the secret nor its hash — only the nullifier
+and the nonce. Because `nonce` changes every session, nullifiers cannot
+be correlated across sign-ins, even for the same secret.
 
 > Proof-based sign-in requires an existing API key. First-time users
 > onboard via GitHub OAuth, which issues their first key.
@@ -29,24 +33,20 @@ the API stores) and the `nonce` — never the API key itself.
 ```
 seal/
 ├── circuits/
-│   ├── src/seal-identity.circom   Circuit: SHA-256 pre-image proof
+│   ├── src/seal-identity.circom   Circuit: SHA-256 pre-image proof + Poseidon nullifier
 │   ├── src/seal-identity.test.ts  Circuit witness tests (needs a build)
 │   └── scripts/build.sh           Compile circom → wasm + groth16 setup
 ├── scripts/
 │   ├── register-circuit.ts        Pin artifacts to IPFS, register via SDK
 │   └── setup-toolchain.sh         Install Rust + circom
 ├── src/                           TypeScript proof helpers (published)
-│   ├── bits.ts                    API key ↔ circuit signal conversions
-│   ├── proof.ts                   generateSealProof / verifySealProof
+│   ├── bits.ts                    Secret ↔ circuit signal conversions
+│   ├── proof.ts                   prove / verify (delegates to @lemmaoracle/sdk)
+│   ├── vkey.ts                    Bundled verification key + named export
 │   └── index.ts                   Public API
 └── .env.example                   Credentials for register-circuit.ts
 ```
 
-There is no `normalize/` step: the circuit's witness input is the raw
-API key string (already canonical), so seal uses the existing
-[`passthrough-v1`](../passthrough) schema rather than a bespoke
-normalizer.
-
 `seal` is a **reference definition**. It is published to npm so
 developers can generate proofs; it is *not* imported by `workers` or the
 dashboard at runtime — the circuit reaches them through the normal
@@ -54,18 +54,21 @@ Lemma circuit-registration path.
 
 ## The circuit
 
-`seal-identity.circom` proves `SHA-256(apiKey) == keyHash`:
+`seal-identity.circom` (v2) proves knowledge of a registered secret and
+outputs a per-session nullifier:
 
-- **Private input** — `keyBits[512]`: the 64-byte ASCII API key as bits.
+- **Private input** — `keyBits[512]`: the 64-byte ASCII secret as bits.
   Lemma keys are 32 random bytes rendered as 64 hex characters (see the
   workers `generate_api_key.js`).
 - **Public input** — `nonce`: the dashboard challenge, bound into the
   constraint system for replay protection.
-- **Public output** — `keyHash[256]`: the SHA-256 digest bits.
+- **Public output** — `nullifier`: `Poseidon(keyHash_hi, keyHash_lo, nonce)`.
+  A single BN254 field element; unique per (secret, nonce) pair. Add ~300
+  constraints on top of the SHA-256 (~60k total).
 
-The hashing matches the workers `middleware/auth.ts`
-(`SHA-256(utf8_bytes(apiKey))`), so a proof's `keyHash` is directly
-comparable to `api_keys.key_hash`.
+The SHA-256 hashing matches the workers `middleware/auth.ts`
+(`SHA-256(utf8_bytes(secret))`), but `keyHash` is now an intermediate
+signal — it never appears in public signals.
 
 ## Build the circuit
 
@@ -81,7 +84,8 @@ cd circuits && npm install && npm run build
 ```
 
 `build.sh` downloads the 2^17 Hermez powers-of-tau file (~290 MB) on
-first run — SHA-256 over a 512-bit pre-image is ~60k constraints.
+first run. The v2 circuit adds Poseidon (~300 constraints) to the SHA-256
+base (~60k), staying well within the 2^17 budget.
 
 ## Register the circuit
 
@@ -99,15 +103,66 @@ dashboard BFF then fetches verification params at runtime via
 ## Generate a proof (developer usage)
 
 ```ts
-import { generateSealProof } from "@lemmaoracle/seal";
+import * as seal from "@lemmaoracle/seal";
+
+const { proof, publicSignals, nullifier } = await seal.prove({
+  secret: process.env.LEMMA_API_KEY!,
+  nonce: challengeNonce,
+});
+// POST { proof, publicSignals, token } to the dashboard sign-in endpoint.
+```
+
+Circuit artifacts (wasm, zkey) are resolved automatically via the
+`@lemmaoracle/sdk` from the registered circuit metadata — no local
+artifact paths are required.
+
+## Verify a proof
+
+```ts
+import * as seal from "@lemmaoracle/seal";
 
-const { proof, publicSignals, keyHash } = await generateSealProof(
-  { apiKey: process.env.LEMMA_API_KEY!, nonce: challengeNonce },
-  { wasm: "seal-identity.wasm", zkey: "seal-identity_final.zkey" },
-);
-// POST { proof, publicSignals } to the dashboard sign-in endpoint.
+const result = await seal.verify({ proof, publicSignals, nullifier });
+// result: { nullifier, nonce } | null
 ```
 
+The verification key is bundled internally — no additional arguments are
+needed. Verification delegates to `@lemmaoracle/sdk` verifier.
+
+## Access the verification key
+
+```ts
+import { sealVkey } from "@lemmaoracle/seal";
+// Or via the dedicated sub-export:
+import vkey from "@lemmaoracle/seal/vkey";
+```
+
+## v2 migration notes
+
+v1 exposed `keyHash[256]` as a public output, making the key hash
+readable by any observer of the proof transcript. v2 replaces this with
+a Poseidon nullifier that is uncorrelatable across sessions.
+
+Breaking changes:
+- `SEAL_CIRCUIT_ID` is now `"seal-identity-v1"` (requires re-registration).
+- `SealProof.keyHash` removed; replaced by `SealProof.nullifier`.
+- Server-side: `scopeIdForKeyHash()` replaced by `scopeIdForNullifier()`
+  (full D1 scan + `poseidon-lite` computation).
+- Circuit artifacts (wasm, zkey, vkey) must be regenerated.
+
+v3 migration notes:
+- `generateSealProof` renamed to `prove`; `verifySealProof` renamed to `verify`.
+- `SealProofInput.apiKey` renamed to `SealProofInput.secret`.
+- `apiKeyToBits` renamed to `secretToBits`; `SEAL_KEY_BYTES`/`SEAL_KEY_BITS`
+  renamed to `SEAL_SECRET_BYTES`/`SEAL_SECRET_BITS`.
+- `SealArtifacts` type removed — circuit artifacts are resolved
+  automatically via `@lemmaoracle/sdk`.
+- `prove` no longer requires a second `artifacts` argument.
+- `verify` no longer requires a `verificationKey` argument — the vkey is
+  bundled internally.
+- `sealVkey` named export added for direct vkey access.
+- `snarkjs` is no longer a direct dependency — it is used via
+  `@lemmaoracle/sdk`.
+
 ## Scripts
 
 | Command                   | Description                                |

package/circuits/src/seal-identity.circom

@@ -1,20 +1,36 @@
 pragma circom 2.1.0;
 
 include "circomlib/circuits/sha256/sha256.circom";
+include "circomlib/circuits/poseidon.circom";
+include "circomlib/circuits/bitify.circom";
 
 /**
  * SealIdentity — Proof-based sign-in for the Lemma developer dashboard.
  *
- * Proves knowledge of the pre-image of an API key hash without revealing
- * the key. The pre-image is the raw API key string; the hash is the
- * SHA-256 `key_hash` stored in the workers `api_keys` D1 table.
+ * **v2 (nullifier)** — Replaces the v1 `keyHash` public output with a
+ * per-session Poseidon nullifier. The `keyHash` is now an intermediate
+ * signal that never appears in public signals, so neither the verifier
+ * nor any network observer can link proofs to a specific API key or
+ * correlate a user across sessions.
  *
- * This matches the hashing in workers `middleware/auth.ts`:
- *   key_hash = SHA-256( utf8_bytes(apiKey) )
+ * Proves: "I hold the API key whose SHA-256 hash is registered in
+ * `api_keys`," without revealing which key.
+ *
+ * The nullifier is derived as:
+ *   nullifier = Poseidon(keyHash_hi, keyHash_lo, nonce)
+ *
+ * where `keyHash_hi` and `keyHash_lo` are the upper and lower 128 bits
+ * of the SHA-256 digest, interpreted as BN254 field elements. Because
+ * `nonce` is unique per session, the nullifier is unique per session —
+ * even if the same API key generates two proofs in a row, the nullifiers
+ * are unrelated.
+ *
+ * The dashboard BFF verifies the proof, then iterates over registered
+ * `key_hash` values in D1, computing the expected nullifier for each
+ * until it finds a match (O(N), Poseidon is ~300 constraints but
+ * sub-millisecond in JS). This preserves the "key holder proves
+ * identity" invariant while removing `keyHash` from the wire entirely.
  *
- * Lemma API keys are 32 random bytes rendered as a 64-character
- * lowercase hex string (see workers `generate_api_key.js`), so the
- * SHA-256 pre-image is exactly 64 ASCII bytes = 512 bits.
  *
  * Private input:
  *   keyBits[512]   Bit decomposition of the 64-byte ASCII API key,
@@ -26,16 +42,16 @@ include "circomlib/circuits/sha256/sha256.circom";
  *                  against a different challenge.
  *
  * Public output:
- *   keyHash[256]   SHA-256 digest bits. The dashboard BFF reassembles
- *                  these into the hex `key_hash` and looks it up in
- *                  `api_keys` to resolve the caller's `scope_id`.
+ *   nullifier      Poseidon-keyed session nullifier. Unique per
+ *                  (key, nonce) pair, reveals nothing about the key
+ *                  or its hash.
  */
 template SealIdentity(keyBytes) {
     var keyBitLen = keyBytes * 8;
 
     signal input keyBits[keyBitLen];
     signal input nonce;
-    signal output keyHash[256];
+    signal output nullifier;
 
     // Constrain every pre-image bit to be boolean. Without this a
     // malicious prover could feed non-binary field values into the
@@ -50,10 +66,32 @@ template SealIdentity(keyBytes) {
     for (var i = 0; i < keyBitLen; i++) {
         sha.in[i] <== keyBits[i];
     }
+
+    // keyHash is an intermediate signal — never exposed publicly.
+    signal keyHash[256];
     for (var i = 0; i < 256; i++) {
         keyHash[i] <== sha.out[i];
     }
 
+    // Split the 256-bit keyHash into two 128-bit field elements.
+    // Bits2Num expects LSB-first input; keyHash is MSB-first (SHA-256
+    // convention), so we reverse the bit order on connection.
+    component hiBits = Bits2Num(128);
+    component loBits = Bits2Num(128);
+    for (var i = 0; i < 128; i++) {
+        hiBits.in[i] <== keyHash[127 - i];
+        loBits.in[i] <== keyHash[255 - i];
+    }
+
+    // Per-session nullifier: Poseidon(keyHash_hi, keyHash_lo, nonce).
+    // Adds ~300 constraints (vs ~30,000 for an extra SHA-256).
+    component hash = Poseidon(3);
+    hash.inputs[0] <== hiBits.out;
+    hash.inputs[1] <== loBits.out;
+    hash.inputs[2] <== nonce;
+
+    nullifier <== hash.out;
+
     // Bind the challenge nonce into the constraint system. The squaring
     // is otherwise meaningless — its only purpose is to make `nonce` a
     // constrained public signal, so the verifier knows the proof was

package/dist/bits.d.ts

@@ -1,20 +1,20 @@
 /**
- * Bit-level conversions between API key strings, circuit witness
+ * Bit-level conversions between secret strings, circuit witness
  * signals, and SHA-256 hashes. Pure and dependency-free.
  */
 import type { Bit } from "./types.js";
-/** The seal circuit's fixed pre-image length: a 64-byte ASCII API key. */
-export declare const SEAL_KEY_BYTES = 64;
+/** The seal circuit's fixed pre-image length: a 64-byte ASCII secret. */
+export declare const SEAL_SECRET_BYTES = 64;
 /** The seal circuit's pre-image bit length (512). */
-export declare const SEAL_KEY_BITS: number;
+export declare const SEAL_SECRET_BITS: number;
 /**
- * Convert a raw API key string into the `keyBits` witness signal — the
- * UTF-8 bytes of the key, MSB-first per byte.
+ * Convert a raw secret string into the `keyBits` witness signal — the
+ * UTF-8 bytes of the secret, MSB-first per byte.
  *
- * Throws if the key is not exactly {@link SEAL_KEY_BYTES} ASCII bytes,
+ * Throws if the secret is not exactly {@link SEAL_SECRET_BYTES} ASCII bytes,
  * since the circuit's pre-image length is fixed.
  */
-export declare const apiKeyToBits: (apiKey: string) => ReadonlyArray<Bit>;
+export declare const secretToBits: (secret: string) => ReadonlyArray<Bit>;
 /**
  * Reassemble the circuit's 256-bit `keyHash` public output into the
  * lowercase hex `key_hash` string stored in the `api_keys` table.

package/dist/bits.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bits.d.ts","sourceRoot":"","sources":["../src/bits.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,YAAY,CAAC;AAEtC,0EAA0E;AAC1E,eAAO,MAAM,cAAc,KAAK,CAAC;AAEjC,qDAAqD;AACrD,eAAO,MAAM,aAAa,QAAqB,CAAC;AAShD;;;;;;GAMG;AACH,eAAO,MAAM,YAAY,GAAI,QAAQ,MAAM,KAAG,aAAa,CAAC,GAAG,CAS9D,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,aAAa,GACxB,MAAM,aAAa,CAAC,MAAM,GAAG,MAAM,CAAC,KACnC,MAKO,CAAC"}
+{"version":3,"file":"bits.d.ts","sourceRoot":"","sources":["../src/bits.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,YAAY,CAAC;AAEtC,yEAAyE;AACzE,eAAO,MAAM,iBAAiB,KAAK,CAAC;AAEpC,qDAAqD;AACrD,eAAO,MAAM,gBAAgB,QAAwB,CAAC;AAStD;;;;;;GAMG;AACH,eAAO,MAAM,YAAY,GAAI,QAAQ,MAAM,KAAG,aAAa,CAAC,GAAG,CAS9D,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,aAAa,GACxB,MAAM,aAAa,CAAC,MAAM,GAAG,MAAM,CAAC,KACnC,MAKO,CAAC"}

package/dist/bits.js

@@ -1,29 +1,29 @@
 /**
- * Bit-level conversions between API key strings, circuit witness
+ * Bit-level conversions between secret strings, circuit witness
  * signals, and SHA-256 hashes. Pure and dependency-free.
  */
-/** The seal circuit's fixed pre-image length: a 64-byte ASCII API key. */
-export const SEAL_KEY_BYTES = 64;
+/** The seal circuit's fixed pre-image length: a 64-byte ASCII secret. */
+export const SEAL_SECRET_BYTES = 64;
 /** The seal circuit's pre-image bit length (512). */
-export const SEAL_KEY_BITS = SEAL_KEY_BYTES * 8;
+export const SEAL_SECRET_BITS = SEAL_SECRET_BYTES * 8;
 /**
  * Decompose a byte into 8 bits, most-significant-bit first — the bit
  * order circomlib's SHA-256 gadget expects.
  */
 const byteToBits = (byte) => Array.from({ length: 8 }, (_, i) => ((byte >> (7 - i)) & 1));
 /**
- * Convert a raw API key string into the `keyBits` witness signal — the
- * UTF-8 bytes of the key, MSB-first per byte.
+ * Convert a raw secret string into the `keyBits` witness signal — the
+ * UTF-8 bytes of the secret, MSB-first per byte.
  *
- * Throws if the key is not exactly {@link SEAL_KEY_BYTES} ASCII bytes,
+ * Throws if the secret is not exactly {@link SEAL_SECRET_BYTES} ASCII bytes,
  * since the circuit's pre-image length is fixed.
  */
-export const apiKeyToBits = (apiKey) => {
-    const bytes = new TextEncoder().encode(apiKey);
-    return bytes.length === SEAL_KEY_BYTES
+export const secretToBits = (secret) => {
+    const bytes = new TextEncoder().encode(secret);
+    return bytes.length === SEAL_SECRET_BYTES
         ? [...bytes].flatMap(byteToBits)
         : (() => {
-            throw new Error(`seal: API key must be ${SEAL_KEY_BYTES} bytes, got ${bytes.length}`);
+            throw new Error(`seal: secret must be ${SEAL_SECRET_BYTES} bytes, got ${bytes.length}`);
         })();
 };
 /**

package/dist/bits.js.map

@@ -1 +1 @@
-{"version":3,"file":"bits.js","sourceRoot":"","sources":["../src/bits.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH,0EAA0E;AAC1E,MAAM,CAAC,MAAM,cAAc,GAAG,EAAE,CAAC;AAEjC,qDAAqD;AACrD,MAAM,CAAC,MAAM,aAAa,GAAG,cAAc,GAAG,CAAC,CAAC;AAEhD;;;GAGG;AACH,MAAM,UAAU,GAAG,CAAC,IAAY,EAAsB,EAAE,CACtD,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,EAAO,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAQ,CAAC,CAAC;AAE3E;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,MAAc,EAAsB,EAAE;IACjE,MAAM,KAAK,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC/C,OAAO,KAAK,CAAC,MAAM,KAAK,cAAc;QACpC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC;QAChC,CAAC,CAAC,CAAC,GAAG,EAAE;YACJ,MAAM,IAAI,KAAK,CACb,yBAAyB,cAAc,eAAe,KAAK,CAAC,MAAM,EAAE,CACrE,CAAC;QACJ,CAAC,CAAC,EAAE,CAAC;AACX,CAAC,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAC3B,IAAoC,EAC5B,EAAE,CACV,IAAI,CAAC,MAAM,KAAK,GAAG;IACjB,CAAC,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAC;IACzE,CAAC,CAAC,CAAC,GAAG,EAAE;QACJ,MAAM,IAAI,KAAK,CAAC,uCAAuC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IACxE,CAAC,CAAC,EAAE,CAAC"}
+{"version":3,"file":"bits.js","sourceRoot":"","sources":["../src/bits.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH,yEAAyE;AACzE,MAAM,CAAC,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAEpC,qDAAqD;AACrD,MAAM,CAAC,MAAM,gBAAgB,GAAG,iBAAiB,GAAG,CAAC,CAAC;AAEtD;;;GAGG;AACH,MAAM,UAAU,GAAG,CAAC,IAAY,EAAsB,EAAE,CACtD,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,EAAO,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAQ,CAAC,CAAC;AAE3E;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,MAAc,EAAsB,EAAE;IACjE,MAAM,KAAK,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC/C,OAAO,KAAK,CAAC,MAAM,KAAK,iBAAiB;QACvC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC;QAChC,CAAC,CAAC,CAAC,GAAG,EAAE;YACJ,MAAM,IAAI,KAAK,CACb,wBAAwB,iBAAiB,eAAe,KAAK,CAAC,MAAM,EAAE,CACvE,CAAC;QACJ,CAAC,CAAC,EAAE,CAAC;AACX,CAAC,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAC3B,IAAoC,EAC5B,EAAE,CACV,IAAI,CAAC,MAAM,KAAK,GAAG;IACjB,CAAC,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAC;IACzE,CAAC,CAAC,CAAC,GAAG,EAAE;QACJ,MAAM,IAAI,KAAK,CAAC,uCAAuC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IACxE,CAAC,CAAC,EAAE,CAAC"}

package/dist/index.d.ts

@@ -1,21 +1,26 @@
 /**
  * @lemmaoracle/seal — ZK auth circuit for Lemma dashboard sign-in.
  *
- * `seal` lets a developer prove knowledge of their Lemma API key
- * without revealing it. The dashboard BFF issues a challenge nonce, the
- * developer generates a proof, and the BFF resolves the attested
- * SHA-256 `key_hash` to a `scope_id`.
+ * `seal` lets a developer prove they hold a valid Lemma API key
+ * without revealing it — or even *which* key. The dashboard BFF issues
+ * a challenge nonce; the developer generates a proof whose public
+ * output is a per-session Poseidon nullifier. The nullifier is unique
+ * to the (secret, nonce) pair but reveals nothing about the secret or
+ * its SHA-256 hash, so proofs cannot be correlated across sessions.
  *
- * The circuit (`circuits/src/seal-identity.circom`) is registered with
- * the Lemma workers API as a normal circuit resource. This package is a
- * reference definition: it is published for developers to generate
- * proofs and is not imported by workers or the dashboard at runtime.
+ * The dashboard resolves identity by iterating registered `key_hash`
+ * values and computing the expected nullifier until a match is found.
+ *
+ * The circuit (`circuits/src/seal-identity.circom`, v2) is registered
+ * with the Lemma workers API as a normal circuit resource. This
+ * package is a reference definition: it is published for developers
+ * to generate proofs and is not imported by workers or the dashboard
+ * at runtime.
  */
-export type { Bit, SealArtifacts, SealProof, SealProofInput, } from "./types.js";
-export { SEAL_KEY_BYTES, SEAL_KEY_BITS, apiKeyToBits, hashBitsToHex, } from "./bits.js";
-export { generateSealProof, verifySealProof } from "./proof.js";
-/** The circuit id under which seal is registered with the Lemma API. */
-export declare const SEAL_CIRCUIT_ID = "seal-identity-v1";
+export type { Bit, SealProof, SealProofInput } from "./types.js";
+export { SEAL_SECRET_BYTES, SEAL_SECRET_BITS, secretToBits, hashBitsToHex, } from "./bits.js";
+export { prove, verify, SEAL_CIRCUIT_ID } from "./proof.js";
+export { sealVkey } from "./vkey.js";
 /** The schema the seal circuit is registered against. */
 export declare const SEAL_SCHEMA = "passthrough-v1";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,YAAY,EACV,GAAG,EACH,aAAa,EACb,SAAS,EACT,cAAc,GACf,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,cAAc,EACd,aAAa,EACb,YAAY,EACZ,aAAa,GACd,MAAM,WAAW,CAAC;AAEnB,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAEhE,wEAAwE;AACxE,eAAO,MAAM,eAAe,qBAAqB,CAAC;AAElD,yDAAyD;AACzD,eAAO,MAAM,WAAW,mBAAmB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,YAAY,EAAE,GAAG,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEjE,OAAO,EACL,iBAAiB,EACjB,gBAAgB,EAChB,YAAY,EACZ,aAAa,GACd,MAAM,WAAW,CAAC;AAEnB,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAE5D,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAErC,yDAAyD;AACzD,eAAO,MAAM,WAAW,mBAAmB,CAAC"}

package/dist/index.js

@@ -1,20 +1,25 @@
 /**
  * @lemmaoracle/seal — ZK auth circuit for Lemma dashboard sign-in.
  *
- * `seal` lets a developer prove knowledge of their Lemma API key
- * without revealing it. The dashboard BFF issues a challenge nonce, the
- * developer generates a proof, and the BFF resolves the attested
- * SHA-256 `key_hash` to a `scope_id`.
+ * `seal` lets a developer prove they hold a valid Lemma API key
+ * without revealing it — or even *which* key. The dashboard BFF issues
+ * a challenge nonce; the developer generates a proof whose public
+ * output is a per-session Poseidon nullifier. The nullifier is unique
+ * to the (secret, nonce) pair but reveals nothing about the secret or
+ * its SHA-256 hash, so proofs cannot be correlated across sessions.
  *
- * The circuit (`circuits/src/seal-identity.circom`) is registered with
- * the Lemma workers API as a normal circuit resource. This package is a
- * reference definition: it is published for developers to generate
- * proofs and is not imported by workers or the dashboard at runtime.
+ * The dashboard resolves identity by iterating registered `key_hash`
+ * values and computing the expected nullifier until a match is found.
+ *
+ * The circuit (`circuits/src/seal-identity.circom`, v2) is registered
+ * with the Lemma workers API as a normal circuit resource. This
+ * package is a reference definition: it is published for developers
+ * to generate proofs and is not imported by workers or the dashboard
+ * at runtime.
  */
-export { SEAL_KEY_BYTES, SEAL_KEY_BITS, apiKeyToBits, hashBitsToHex, } from "./bits.js";
-export { generateSealProof, verifySealProof } from "./proof.js";
-/** The circuit id under which seal is registered with the Lemma API. */
-export const SEAL_CIRCUIT_ID = "seal-identity-v1";
+export { SEAL_SECRET_BYTES, SEAL_SECRET_BITS, secretToBits, hashBitsToHex, } from "./bits.js";
+export { prove, verify, SEAL_CIRCUIT_ID } from "./proof.js";
+export { sealVkey } from "./vkey.js";
 /** The schema the seal circuit is registered against. */
 export const SEAL_SCHEMA = "passthrough-v1";
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AASH,OAAO,EACL,cAAc,EACd,aAAa,EACb,YAAY,EACZ,aAAa,GACd,MAAM,WAAW,CAAC;AAEnB,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAEhE,wEAAwE;AACxE,MAAM,CAAC,MAAM,eAAe,GAAG,kBAAkB,CAAC;AAElD,yDAAyD;AACzD,MAAM,CAAC,MAAM,WAAW,GAAG,gBAAgB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAIH,OAAO,EACL,iBAAiB,EACjB,gBAAgB,EAChB,YAAY,EACZ,aAAa,GACd,MAAM,WAAW,CAAC;AAEnB,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAE5D,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAErC,yDAAyD;AACzD,MAAM,CAAC,MAAM,WAAW,GAAG,gBAAgB,CAAC"}

package/dist/proof.d.ts

@@ -1,30 +1,43 @@
 /**
- * Seal proof generation and verification.
+ * Seal proof generation and verification (v2: nullifier-based).
  *
  * Dashboard sign-in flow:
  *   1. The BFF issues a challenge `nonce`.
- *   2. The developer runs {@link generateSealProof} with their API key.
- *   3. The BFF runs {@link verifySealProof} and reads the attested
- *      `keyHash` to resolve the caller's scope.
+ *   2. The developer runs {@link prove} with their secret.
+ *   3. The BFF verifies the proof, reads the `nullifier`, and resolves
+ *      the caller's scope by matching it against registered key hashes.
  *
- * snarkjs is imported lazily so that consumers who only need the pure
- * bit helpers ({@link apiKeyToBits} etc.) do not pay for it.
+ * Both prove and verify delegate to `@lemmaoracle/sdk`, which handles
+ * circuit artifact resolution and snarkjs orchestration. The vkey for
+ * verification is resolved internally from the bundled JSON.
  */
-import type { SealArtifacts, SealProof, SealProofInput } from "./types.js";
+import type { SealProof, SealProofInput } from "./types.js";
+/** The circuit id under which seal v2 is registered with the Lemma API. */
+export declare const SEAL_CIRCUIT_ID = "seal-identity-v1";
+type VerifyResult = Readonly<{
+    nullifier: string;
+    nonce: string;
+}>;
 /**
- * Generate a groth16 proof that the caller knows the API key whose
- * SHA-256 hash is `keyHash`, bound to the given challenge `nonce`.
+ * Generate a groth16 proof that the caller holds the secret behind a
+ * registered `key_hash`, bound to the given challenge `nonce`.
+ *
+ * The returned `nullifier` is a per-session Poseidon fingerprint that
+ * reveals neither the secret nor its SHA-256 hash. The server resolves
+ * identity by iterating registered key hashes and computing the
+ * expected nullifier until a match is found.
  *
- * Requires the compiled circuit artifacts — build them with
- * `npm run build` in `packages/seal/circuits` (see the package README).
+ * Circuit artifacts (wasm, zkey) are resolved automatically via the
+ * Lemma SDK from `circuitId: "seal-identity-v1"`. No local artifact
+ * paths are required.
  */
-export declare const generateSealProof: (input: SealProofInput, artifacts: SealArtifacts) => Promise<SealProof>;
+export declare const prove: (input: SealProofInput) => Promise<SealProof>;
 /**
- * Verify a seal proof against the circuit verification key. Resolves to
- * the attested `keyHash` and `nonce` on success, or `null` if invalid.
+ * Verify a seal proof against the bundled circuit verification key.
+ *
+ * Resolves to the attested `nullifier` and `nonce` on success, or
+ * `null` if invalid. Delegates to `@lemmaoracle/sdk` verifier.
  */
-export declare const verifySealProof: (proof: SealProof, verificationKey: Readonly<Record<string, unknown>>) => Promise<Readonly<{
-    keyHash: string;
-    nonce: string;
-}> | null>;
+export declare const verify: (proof: SealProof) => Promise<VerifyResult | null>;
+export {};
 //# sourceMappingURL=proof.d.ts.map

package/dist/proof.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"proof.d.ts","sourceRoot":"","sources":["../src/proof.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAIH,OAAO,KAAK,EAAE,aAAa,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAK3E;;;;;;GAMG;AACH,eAAO,MAAM,iBAAiB,GAC5B,OAAO,cAAc,EACrB,WAAW,aAAa,KACvB,OAAO,CAAC,SAAS,CAgBnB,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,eAAe,GAC1B,OAAO,SAAS,EAChB,iBAAiB,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,KACjD,OAAO,CAAC,QAAQ,CAAC;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,GAAG,IAAI,CAa7D,CAAC"}
+{"version":3,"file":"proof.d.ts","sourceRoot":"","sources":["../src/proof.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAKH,OAAO,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAE5D,2EAA2E;AAC3E,eAAO,MAAM,eAAe,qBAAqB,CAAC;AAElD,KAAK,YAAY,GAAG,QAAQ,CAAC;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAEnE;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,KAAK,GAAU,OAAO,cAAc,KAAG,OAAO,CAAC,SAAS,CAepE,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,MAAM,GACjB,OAAO,SAAS,KACf,OAAO,CAAC,YAAY,GAAG,IAAI,CAe7B,CAAC"}

package/dist/proof.js

@@ -1,49 +1,69 @@
 /**
- * Seal proof generation and verification.
+ * Seal proof generation and verification (v2: nullifier-based).
  *
  * Dashboard sign-in flow:
  *   1. The BFF issues a challenge `nonce`.
- *   2. The developer runs {@link generateSealProof} with their API key.
- *   3. The BFF runs {@link verifySealProof} and reads the attested
- *      `keyHash` to resolve the caller's scope.
+ *   2. The developer runs {@link prove} with their secret.
+ *   3. The BFF verifies the proof, reads the `nullifier`, and resolves
+ *      the caller's scope by matching it against registered key hashes.
  *
- * snarkjs is imported lazily so that consumers who only need the pure
- * bit helpers ({@link apiKeyToBits} etc.) do not pay for it.
+ * Both prove and verify delegate to `@lemmaoracle/sdk`, which handles
+ * circuit artifact resolution and snarkjs orchestration. The vkey for
+ * verification is resolved internally from the bundled JSON.
  */
-import { apiKeyToBits, hashBitsToHex } from "./bits.js";
-/** Number of `keyHash` bits at the head of the public signal vector. */
-const KEY_HASH_BITS = 256;
+import { create, prover, verifier } from "@lemmaoracle/sdk";
+import { secretToBits } from "./bits.js";
+import vkey from "./vkey.js";
+/** The circuit id under which seal v2 is registered with the Lemma API. */
+export const SEAL_CIRCUIT_ID = "seal-identity-v1";
 /**
- * Generate a groth16 proof that the caller knows the API key whose
- * SHA-256 hash is `keyHash`, bound to the given challenge `nonce`.
+ * Generate a groth16 proof that the caller holds the secret behind a
+ * registered `key_hash`, bound to the given challenge `nonce`.
  *
- * Requires the compiled circuit artifacts — build them with
- * `npm run build` in `packages/seal/circuits` (see the package README).
+ * The returned `nullifier` is a per-session Poseidon fingerprint that
+ * reveals neither the secret nor its SHA-256 hash. The server resolves
+ * identity by iterating registered key hashes and computing the
+ * expected nullifier until a match is found.
+ *
+ * Circuit artifacts (wasm, zkey) are resolved automatically via the
+ * Lemma SDK from `circuitId: "seal-identity-v1"`. No local artifact
+ * paths are required.
  */
-export const generateSealProof = async (input, artifacts) => {
-    const { groth16 } = await import("snarkjs");
+export const prove = async (input) => {
+    const client = create({});
     const witness = {
-        keyBits: apiKeyToBits(input.apiKey).map(Number),
+        keyBits: secretToBits(input.secret).map(Number),
         nonce: input.nonce,
     };
-    const { proof, publicSignals } = await groth16.fullProve(witness, artifacts.wasm, artifacts.zkey);
+    const { proof, inputs } = await prover.prove(client, {
+        circuitId: SEAL_CIRCUIT_ID,
+        witness,
+    });
     return {
-        proof,
-        publicSignals,
-        keyHash: hashBitsToHex(publicSignals.slice(0, KEY_HASH_BITS)),
+        proof: JSON.parse(atob(proof)),
+        publicSignals: inputs,
+        nullifier: inputs[0] ?? "",
     };
 };
 /**
- * Verify a seal proof against the circuit verification key. Resolves to
- * the attested `keyHash` and `nonce` on success, or `null` if invalid.
+ * Verify a seal proof against the bundled circuit verification key.
+ *
+ * Resolves to the attested `nullifier` and `nonce` on success, or
+ * `null` if invalid. Delegates to `@lemmaoracle/sdk` verifier.
  */
-export const verifySealProof = async (proof, verificationKey) => {
-    const { groth16 } = await import("snarkjs");
-    const ok = await groth16.verify(verificationKey, [...proof.publicSignals], proof.proof);
+export const verify = async (proof) => {
+    const { ok } = await verifier.verify({
+        alg: "groth16-bn254-snarkjs",
+        inputs: {
+            vkey,
+            proof: proof.proof,
+            publicSignals: proof.publicSignals,
+        },
+    });
     return ok
         ? {
-            keyHash: hashBitsToHex(proof.publicSignals.slice(0, KEY_HASH_BITS)),
-            nonce: proof.publicSignals[KEY_HASH_BITS] ?? "",
+            nullifier: proof.publicSignals[0] ?? "",
+            nonce: proof.publicSignals[1] ?? "",
         }
         : null;
 };