@tangle-network/starter-foundry 0.5.4 → 0.7.0

package/registry/layers/capability/zk-browser/files/mixer-verify-panel.tsx

@@ -0,0 +1,66 @@
+import { useRef, useState } from 'react'
+import { Card, CardContent, CardHeader, CardTitle } from '@/components/ui/card'
+import { Button } from '@/components/ui/button'
+import { Upload, CheckCircle2, XCircle, Loader2 } from 'lucide-react'
+import { parseNote, verifyNote, type MixerNote } from '@/lib/mixer-note'
+
+type Result = { ok: boolean; note: MixerNote | null; reason?: string }
+
+export function MixerVerifyPanel() {
+  const [result, setResult] = useState<Result | null>(null)
+  const [busy, setBusy] = useState(false)
+  const fileRef = useRef<HTMLInputElement>(null)
+
+  const handleFile = async (file: File) => {
+    setBusy(true)
+    setResult(null)
+    const raw = await file.text()
+    const parsed = parseNote(raw)
+    if (!parsed) {
+      setResult({ ok: false, note: null, reason: 'Not a valid note file' })
+      setBusy(false)
+      return
+    }
+    const ok = await verifyNote(parsed)
+    setResult({ ok, note: parsed, reason: ok ? undefined : 'Commitment does not match nullifier+secret' })
+    setBusy(false)
+  }
+
+  return (
+    <Card className="w-full max-w-md">
+      <CardHeader>
+        <CardTitle className="text-lg">Verify Your Note</CardTitle>
+      </CardHeader>
+      <CardContent className="space-y-3">
+        <p className="text-xs text-muted-foreground">
+          Drop the JSON note you downloaded after deposit. We recompute the commitment locally to confirm the file is intact and the secret hasn't been tampered with.
+        </p>
+        <input
+          ref={fileRef}
+          type="file"
+          accept="application/json"
+          className="hidden"
+          onChange={(e) => { const f = e.target.files?.[0]; if (f) void handleFile(f) }}
+        />
+        <Button variant="outline" onClick={() => fileRef.current?.click()} className="w-full" disabled={busy}>
+          {busy ? <Loader2 className="mr-2 h-4 w-4 animate-spin" /> : <Upload className="mr-2 h-4 w-4" />}
+          Upload note to verify
+        </Button>
+        {result ? (
+          <div className={result.ok ? 'flex items-start gap-2 rounded border border-green-500/40 bg-green-500/5 p-3 text-sm' : 'flex items-start gap-2 rounded border border-destructive/40 bg-destructive/5 p-3 text-sm'}>
+            {result.ok ? <CheckCircle2 className="h-5 w-5 text-green-600" /> : <XCircle className="h-5 w-5 text-destructive" />}
+            <div>
+              <div className="font-medium">{result.ok ? 'Note verified' : 'Invalid note'}</div>
+              {result.reason ? <div className="text-xs text-muted-foreground">{result.reason}</div> : null}
+              {result.note ? (
+                <div className="mt-1 break-all font-mono text-xs text-muted-foreground">
+                  commitment {result.note.commitment.slice(0, 24)}…
+                </div>
+              ) : null}
+            </div>
+          </div>
+        ) : null}
+      </CardContent>
+    </Card>
+  )
+}

package/registry/layers/capability/zk-browser/files/mixer-withdraw-panel.tsx

@@ -0,0 +1,105 @@
+import { useRef, useState } from 'react'
+import { Card, CardContent, CardHeader, CardTitle } from '@/components/ui/card'
+import { Button } from '@/components/ui/button'
+import { Input } from '@/components/ui/input'
+import { Upload, Loader2, CheckCircle2, XCircle } from 'lucide-react'
+import { parseNote, verifyNote, type MixerNote } from '@/lib/mixer-note'
+import { generateProof } from '@/lib/zkproof'
+
+type Status = 'idle' | 'verifying' | 'proving' | 'ready' | 'error'
+
+export function MixerWithdrawPanel({
+  wasmUrl,
+  zkeyUrl,
+  onSubmit,
+}: {
+  wasmUrl?: string
+  zkeyUrl?: string
+  onSubmit?: (args: { note: MixerNote; recipient: string; proof: string; publicSignals: string[] }) => Promise<void> | void
+}) {
+  const [note, setNote] = useState<MixerNote | null>(null)
+  const [recipient, setRecipient] = useState('')
+  const [status, setStatus] = useState<Status>('idle')
+  const [message, setMessage] = useState<string | null>(null)
+  const fileRef = useRef<HTMLInputElement>(null)
+
+  const handleFile = async (file: File) => {
+    setStatus('verifying')
+    setMessage(null)
+    const raw = await file.text()
+    const parsed = parseNote(raw)
+    if (!parsed) {
+      setStatus('error')
+      setMessage('Invalid note file')
+      return
+    }
+    const ok = await verifyNote(parsed)
+    if (!ok) {
+      setStatus('error')
+      setMessage('Note commitment does not match — file may be corrupted')
+      return
+    }
+    setNote(parsed)
+    setStatus('idle')
+    setMessage('Note verified')
+  }
+
+  const handleWithdraw = async () => {
+    if (!note || !recipient) return
+    setStatus('proving')
+    setMessage(null)
+    try {
+      if (!wasmUrl || !zkeyUrl) {
+        throw new Error('wasmUrl + zkeyUrl required — wire them from env or props')
+      }
+      const proof = await generateProof(
+        { nullifier: note.nullifier, secret: note.secret, recipient },
+        wasmUrl,
+        zkeyUrl,
+      )
+      setStatus('ready')
+      if (onSubmit) await onSubmit({ note, recipient, proof: proof.solidityCalldata, publicSignals: proof.publicSignals })
+    } catch (err) {
+      setStatus('error')
+      setMessage(err instanceof Error ? err.message : 'proof generation failed')
+    }
+  }
+
+  return (
+    <Card className="w-full max-w-md">
+      <CardHeader>
+        <CardTitle className="text-lg">Withdraw</CardTitle>
+      </CardHeader>
+      <CardContent className="space-y-4">
+        <div className="space-y-1.5">
+          <label className="text-xs text-muted-foreground">Note file</label>
+          <input
+            ref={fileRef}
+            type="file"
+            accept="application/json"
+            className="hidden"
+            onChange={(e) => { const f = e.target.files?.[0]; if (f) void handleFile(f) }}
+          />
+          <Button variant="outline" onClick={() => fileRef.current?.click()} className="w-full">
+            <Upload className="mr-2 h-4 w-4" />
+            {note ? `Note: ${note.commitment.slice(0, 10)}…` : 'Upload note'}
+          </Button>
+        </div>
+        <div className="space-y-1.5">
+          <label className="text-xs text-muted-foreground">Recipient address</label>
+          <Input value={recipient} onChange={(e) => setRecipient(e.target.value)} placeholder="0x…" />
+        </div>
+        <Button onClick={handleWithdraw} disabled={!note || !recipient || status === 'proving'} className="w-full">
+          {status === 'proving' ? <Loader2 className="mr-2 h-4 w-4 animate-spin" /> : null}
+          {status === 'proving' ? 'Generating proof…' : 'Generate proof + withdraw'}
+        </Button>
+        {message ? (
+          <p className={status === 'error' ? 'flex items-center gap-1.5 text-sm text-destructive' : 'flex items-center gap-1.5 text-sm text-green-600'}>
+            {status === 'error' ? <XCircle className="h-4 w-4" /> : <CheckCircle2 className="h-4 w-4" />}
+            {message}
+          </p>
+        ) : null}
+      </CardContent>
+    </Card>
+  )
+}

package/registry/layers/capability/zk-browser/files/zk-circuits.md

@@ -0,0 +1,73 @@
+# ZK circuits — browser-side proof generation
+
+This scaffold ships with `snarkjs` + `circomlibjs` + `circomlib` installed.
+Proofs are generated client-side (in the browser), not on a dedicated prover
+service. Use this for:
+
+- Mixers (deposit commitment / withdraw with nullifier-preimage)
+- Anonymous credentials / private voting
+- Zero-knowledge set-membership proofs
+- Any product where the user generates a proof about their own private data
+
+**Not this:** if you need to prove arbitrary RISC-V or Rust programs, use
+`framework:zk-prover-service` (sp1 / risc0) instead. That runs on a server;
+this runs in the user's browser.
+
+## Writing a circuit
+
+1. Create `circuits/<name>.circom`. Start from circomlib primitives:
+
+   ```circom
+   pragma circom 2.1.5;
+   include "../node_modules/circomlib/circuits/poseidon.circom";
+   include "../node_modules/circomlib/circuits/merkletree.circom";
+
+   template Mixer(levels) {
+     // ...
+   }
+
+   component main { public [ root, nullifierHash ] } = Mixer(20);
+   ```
+
+2. Compile: `circom circuits/mixer.circom --r1cs --wasm --sym -o build/`
+
+3. Trusted setup (one-time per circuit):
+   ```bash
+   snarkjs groth16 setup build/mixer.r1cs powersOfTau28_hez_final_15.ptau mixer_0000.zkey
+   snarkjs zkey contribute mixer_0000.zkey mixer_final.zkey --name="your-org"
+   snarkjs zkey export verificationkey mixer_final.zkey public/verification_key.json
+   ```
+
+4. Host the proving artifacts:
+   - `public/proving-keys/mixer.wasm` — the circuit wasm
+   - `public/proving-keys/mixer.zkey` — the proving key (multi-MB — use a CDN)
+   - `public/verification_key.json` — the verification key (for client-side verify)
+
+## Generating a proof in the app
+
+```ts
+import { generateProof } from '@/lib/zkproof'
+
+const { proof, publicSignals, solidityCalldata } = await generateProof(
+  {
+    secret: secretNullifier,
+    pathElements: merklePath,
+    pathIndices: pathDirection,
+    root: merkleRoot,
+    nullifierHash: poseidonHash([nullifier]),
+  },
+  '/proving-keys/mixer.wasm',
+  '/proving-keys/mixer.zkey',
+)
+
+// Submit to your on-chain verifier:
+await mixerContract.withdraw(solidityCalldata)
+```
+
+## Performance notes
+
+- Browser proof generation takes 1-5 seconds depending on circuit size — show
+  a loading state. Consider a Web Worker so the main thread stays responsive.
+- Proving keys are typically 1-20 MB per circuit. Put them behind a CDN.
+- `circomlibjs` is CommonJS; if you hit ESM interop errors, add
+  `optimizeDeps.include: ['circomlibjs']` to your `vite.config.ts`.

package/registry/layers/capability/zk-browser/files/zkproof.ts

@@ -0,0 +1,94 @@
+// ZK proof helper — client-side Groth16 proof generation via snarkjs.
+//
+// Host the circuit's wasm + zkey under public/proving-keys/ and call
+// generateProof with the public URLs. The returned proof is ready to submit
+// to your verifier (on-chain Solidity verifier generated by snarkjs, or any
+// Groth16-compatible verifier).
+
+// snarkjs is published as an untyped CJS module — declare a minimal surface
+// here so downstream TS code gets type safety on the calls we actually use.
+declare module 'snarkjs' {
+  export const groth16: {
+    fullProve(
+      input: Record<string, string | number | bigint | string[]>,
+      wasmUrl: string,
+      zkeyUrl: string,
+    ): Promise<{ proof: Groth16Proof; publicSignals: string[] }>
+    verify(
+      verificationKey: unknown,
+      publicSignals: string[],
+      proof: Groth16Proof,
+    ): Promise<boolean>
+  }
+}
+
+export interface Groth16Proof {
+  pi_a: [string, string, string]
+  pi_b: [[string, string], [string, string], [string, string]]
+  pi_c: [string, string, string]
+  protocol: 'groth16'
+  curve: string
+}
+
+export interface GeneratedProof {
+  proof: Groth16Proof
+  publicSignals: string[]
+  /** Solidity-ABI-encoded calldata for the on-chain verifier contract. */
+  solidityCalldata: string
+}
+
+/**
+ * Generate a Groth16 proof in the browser.
+ *
+ * @param inputs - Circuit inputs keyed by signal name. Large numbers must be
+ *   passed as strings or bigints; snarkjs rejects plain number >2^53.
+ * @param wasmUrl - Public URL to the compiled circuit wasm.
+ * @param zkeyUrl - Public URL to the proving key (.zkey).
+ */
+export async function generateProof(
+  inputs: Record<string, string | number | bigint | string[]>,
+  wasmUrl: string,
+  zkeyUrl: string,
+): Promise<GeneratedProof> {
+  const { groth16 } = await import('snarkjs')
+  const { proof, publicSignals } = await groth16.fullProve(inputs, wasmUrl, zkeyUrl)
+  const solidityCalldata = buildSolidityCalldata(proof, publicSignals)
+  return { proof, publicSignals, solidityCalldata }
+}
+
+/**
+ * Verify a Groth16 proof client-side. Useful for "verify your note" UX —
+ * confirm a downloadable proof is well-formed before the user submits it
+ * on-chain.
+ */
+export async function verifyProof(
+  verificationKey: unknown,
+  publicSignals: string[],
+  proof: Groth16Proof,
+): Promise<boolean> {
+  const { groth16 } = await import('snarkjs')
+  return groth16.verify(verificationKey, publicSignals, proof)
+}
+
+/**
+ * Poseidon hash via circomlibjs. Use for merkle tree commitments — most
+ * circom circuits use Poseidon because it's ZK-friendly (cheap in
+ * constraints).
+ */
+export async function poseidonHash(inputs: bigint[]): Promise<bigint> {
+  const { buildPoseidon } = await import('circomlibjs')
+  const poseidon = await buildPoseidon()
+  const hash = poseidon(inputs)
+  return BigInt(poseidon.F.toString(hash))
+}
+
+function buildSolidityCalldata(proof: Groth16Proof, publicSignals: string[]): string {
+  // Encodes a snarkjs Groth16 proof in the shape the snarkjs-generated
+  // Verifier.sol expects: [a, b, c, input]. Inline here so callers don't
+  // need a second snarkjs import chain for pure-formatting work.
+  const pA = `[${proof.pi_a[0]}, ${proof.pi_a[1]}]`
+  const pB = `[[${proof.pi_b[0][1]}, ${proof.pi_b[0][0]}], [${proof.pi_b[1][1]}, ${proof.pi_b[1][0]}]]`
+  const pC = `[${proof.pi_c[0]}, ${proof.pi_c[1]}]`
+  const inputs = `[${publicSignals.join(', ')}]`
+  return `${pA}, ${pB}, ${pC}, ${inputs}`
+}

package/registry/layers/capability/zk-browser/manifest.json

@@ -0,0 +1,112 @@
+{
+  "id": "zk-browser",
+  "description": "Client-side ZK proof generation — snarkjs + circomlibjs + circomlib, a zkProof helper, and notes on hosting the proving key. For browser-native mixers, private voting, anonymous credentials, and any product where proofs are generated in the browser instead of on a Rust prover service.",
+  "appliesTo": [
+    "react-vite-ts",
+    "nextjs-ts",
+    "fullstack-ts",
+    "remix-ts",
+    "sveltekit-ts",
+    "vue-ts"
+  ],
+  "files": [
+    {
+      "source": "files/zkproof.ts",
+      "target": "src/lib/zkproof.ts"
+    },
+    {
+      "source": "files/mixer-note.ts",
+      "target": "src/lib/mixer-note.ts"
+    },
+    {
+      "source": "files/mixer-deposit-panel.tsx",
+      "target": "src/components/zk/mixer-deposit-panel.tsx"
+    },
+    {
+      "source": "files/mixer-withdraw-panel.tsx",
+      "target": "src/components/zk/mixer-withdraw-panel.tsx"
+    },
+    {
+      "source": "files/mixer-merkle-panel.tsx",
+      "target": "src/components/zk/mixer-merkle-panel.tsx"
+    },
+    {
+      "source": "files/mixer-verify-panel.tsx",
+      "target": "src/components/zk/mixer-verify-panel.tsx"
+    },
+    {
+      "source": "files/zk-circuits.md",
+      "target": "docs/zk-circuits.md"
+    }
+  ],
+  "capabilityRequires": ["shadcn"],
+  "packageDeps": {
+    "dependencies": {
+      "snarkjs": "^0.7.5",
+      "circomlibjs": "^0.1.7",
+      "circomlib": "^2.0.5",
+      "@zk-kit/incremental-merkle-tree": "^1.1.0",
+      "ethers": "^6.13.0"
+    }
+  },
+  "keywords": [
+    "mixer",
+    "privacy-preserving",
+    "commitment",
+    "nullifier",
+    "merkle tree",
+    "merkle root",
+    "zk proof",
+    "zk-snark",
+    "zero-knowledge",
+    "circom",
+    "snarkjs",
+    "anonymous credentials",
+    "private voting",
+    "anonymous voting",
+    "zk mixer"
+  ],
+  "contextHints": {
+    "extensionPoints": [
+      "src/lib/zkproof.ts",
+      "circuits/*.circom",
+      "public/proving-keys/"
+    ]
+  },
+  "buildHints": {
+    "whenToUse": "Attach for products that generate ZK proofs client-side (browser): mixers, private voting, anonymous credentials, commitment-nullifier flows. NOT for server-side provers (use framework:zk-prover-service with sp1/risc0 instead).",
+    "firstSteps": [
+      "Compile your circuit with circom: circom mixer.circom --r1cs --wasm --sym -o build/",
+      "Generate proving + verification keys (trusted setup): snarkjs groth16 setup ...",
+      "Host the proving key + wasm under public/proving-keys/ so the browser can fetch them at proof time",
+      "Use src/lib/zkproof.ts as the entry point: await generateProof(circuitInputs, wasmUrl, zkeyUrl)"
+    ],
+    "gotchas": [
+      "Proving keys are multi-MB — host them as static files (CDN recommended), not bundled into JS.",
+      "Browser proof generation takes 1-5s depending on circuit size — show a loading UI.",
+      "circomlibjs is CommonJS — may need Vite/webpack interop config for ESM consumers."
+    ]
+  },
+  "tieredKeywords": {
+    "archetypes": [
+      "mixer",
+      "privacy-preserving mixer",
+      "private voting",
+      "anonymous voting",
+      "anonymous credential",
+      "nullifier",
+      "commitment preimage",
+      "merkle root display",
+      "zk proof",
+      "zk-snark",
+      "zero-knowledge proof",
+      "circom",
+      "zk mixer",
+      "verify your note",
+      "downloadable note",
+      "stealth address",
+      "private deposit",
+      "private withdraw"
+    ]
+  }
+}

package/registry/layers/capability/zk-gnark/files/circuit.go

@@ -0,0 +1,28 @@
+// Gnark circuit. Witness fields (private + public) live on a struct that
+// implements frontend.Circuit.Define. The constraint system is built at
+// Define() time by calling api.* methods.
+
+package main
+
+import (
+	"github.com/consensys/gnark/frontend"
+)
+
+// SumCircuit proves the prover knows (A, B) such that A + B == ExpectedSum.
+// - A, B: private inputs (default visibility)
+// - ExpectedSum: public input (must match in verifier's public witness)
+type SumCircuit struct {
+	A           frontend.Variable `gnark:",secret"`
+	B           frontend.Variable `gnark:",secret"`
+	ExpectedSum frontend.Variable `gnark:",public"`
+}
+
+// Define is called by gnark during circuit compilation. Every call to
+// api.AssertIsEqual (or other assertion/constraint APIs) adds a constraint
+// the prover must satisfy. Bare Go comparisons (==, !=) DO NOT constrain —
+// use api.* exclusively.
+func (c *SumCircuit) Define(api frontend.API) error {
+	sum := api.Add(c.A, c.B)
+	api.AssertIsEqual(sum, c.ExpectedSum)
+	return nil
+}

package/registry/layers/capability/zk-gnark/files/gnark-notes.md

@@ -0,0 +1,80 @@
+# ConsenSys gnark
+
+Go-native ZK framework. Circuits are Go structs; prover + verifier run in
+regular Go code. Strongest fit for backend services where the prover IS the
+service (ZK-rollup sequencer, aggregator, verifier oracle).
+
+## Layout
+
+```
+circuit.go    # struct implementing frontend.Circuit with public + private fields
+prover.go     # Setup() / Prove() / Verify() — wire into your HTTP or worker layer
+```
+
+## Visibility
+
+```go
+type MyCircuit struct {
+    Secret      frontend.Variable `gnark:",secret"`  // private
+    PublicValue frontend.Variable `gnark:",public"`  // public
+    Default     frontend.Variable                    // defaults to secret
+}
+```
+
+Public fields show up in the `publicWitness` used by the verifier; private
+ones do not.
+
+## Constraint APIs
+
+Use `api.*` — bare Go ops don't constrain:
+
+| API | What it does |
+|---|---|
+| `api.Add(a, b)` | addition constraint |
+| `api.Mul(a, b)` | multiplication |
+| `api.AssertIsEqual(a, b)` | fails proof if a != b |
+| `api.AssertIsBoolean(v)` | fails if v ∉ {0,1} |
+| `api.Select(cond, ifTrue, ifFalse)` | constant-time conditional |
+| `api.IsZero(v)` | returns 1 if v==0, 0 otherwise |
+| `api.ToBinary(v, n)` | n-bit decomposition |
+
+## Proof systems
+
+| System | Proof size | Setup | Use case |
+|---|---|---|---|
+| Groth16 | ~200 bytes | per-circuit trusted | on-chain verification, smallest footprint |
+| Plonk | ~5-10 KB | universal trusted (or KZG-SRS) | circuit changes without re-ceremony |
+| Plonk + KZG | ~5 KB | universal SRS | EIP-4844 alignment, cheaper on EVM |
+
+## Ceremony discipline
+
+For Groth16 in production:
+
+1. Run the trusted setup ONCE. Generate `pk.bin` + `vk.bin`.
+2. Distribute pk.bin to prover nodes, vk.bin to verifier / smart-contract.
+3. Never regenerate in production. Regenerating invalidates all prior proofs.
+
+For dev:
+
+```go
+cs, pk, vk, err := Setup()  // re-ceremony every restart — dev only
+```
+
+## EVM verification
+
+Gnark ships Solidity verifier codegen:
+
+```bash
+go run github.com/consensys/gnark/gnarksolidity -vk vk.bin -out Verifier.sol
+```
+
+Drop the resulting Verifier.sol into foundry/hardhat, call `Verifier.verifyProof(...)`
+from your application contract.
+
+## Gotchas
+
+- **Witness field matching is by name**, not order. Rename the circuit struct
+  field, you MUST rename the assignment struct field — else silent mismatch.
+- **Big int handling**: `frontend.Variable` accepts Go ints, big.Int, strings.
+  For values > 2^63, pass big.Int — ints overflow silently.
+- **Proof serialization**: `proof.WriteTo(buf)` is canonical. Don't JSON-serialize the proof object; the binary format is 10× more compact.

package/registry/layers/capability/zk-gnark/files/prover.go

@@ -0,0 +1,70 @@
+// Gnark prover. Compiles the circuit into an R1CS, runs Groth16 trusted
+// setup (keep the trusted-setup artifacts out of source control for
+// production — generate once, load thereafter), then exposes Prove / Verify
+// functions suitable for wrapping in an HTTP handler or worker job.
+
+package main
+
+import (
+	"bytes"
+	"fmt"
+
+	"github.com/consensys/gnark-crypto/ecc"
+	"github.com/consensys/gnark/backend/groth16"
+	"github.com/consensys/gnark/frontend"
+	"github.com/consensys/gnark/frontend/cs/r1cs"
+)
+
+// Setup compiles the circuit and produces the proving+verifying keys.
+// In production, do this once (a trusted-setup ceremony) and persist the
+// keys to disk/secret store; NEVER regenerate per request.
+func Setup() (constraintSystem frontend.CompiledConstraintSystem, pk groth16.ProvingKey, vk groth16.VerifyingKey, err error) {
+	var circuit SumCircuit
+	constraintSystem, err = frontend.Compile(ecc.BN254.ScalarField(), r1cs.NewBuilder, &circuit)
+	if err != nil {
+		return nil, nil, nil, fmt.Errorf("compile: %w", err)
+	}
+	pk, vk, err = groth16.Setup(constraintSystem)
+	if err != nil {
+		return nil, nil, nil, fmt.Errorf("setup: %w", err)
+	}
+	return constraintSystem, pk, vk, nil
+}
+
+// Prove produces a Groth16 proof for the given (A, B, ExpectedSum) witness.
+// Returns serialized proof bytes suitable for transport / on-chain submission.
+func Prove(cs frontend.CompiledConstraintSystem, pk groth16.ProvingKey, a, b, expectedSum int64) ([]byte, error) {
+	assignment := &SumCircuit{
+		A:           a,
+		B:           b,
+		ExpectedSum: expectedSum,
+	}
+	witness, err := frontend.NewWitness(assignment, ecc.BN254.ScalarField())
+	if err != nil {
+		return nil, fmt.Errorf("witness: %w", err)
+	}
+	proof, err := groth16.Prove(cs, pk, witness)
+	if err != nil {
+		return nil, fmt.Errorf("prove: %w", err)
+	}
+	var buf bytes.Buffer
+	if _, err := proof.WriteTo(&buf); err != nil {
+		return nil, fmt.Errorf("serialize proof: %w", err)
+	}
+	return buf.Bytes(), nil
+}
+
+// Verify checks a Groth16 proof against the public witness (only
+// ExpectedSum is public in this circuit).
+func Verify(proofBytes []byte, vk groth16.VerifyingKey, expectedSum int64) error {
+	proof := groth16.NewProof(ecc.BN254)
+	if _, err := proof.ReadFrom(bytes.NewReader(proofBytes)); err != nil {
+		return fmt.Errorf("deserialize proof: %w", err)
+	}
+	public := &SumCircuit{ExpectedSum: expectedSum}
+	publicWitness, err := frontend.NewWitness(public, ecc.BN254.ScalarField(), frontend.PublicOnly())
+	if err != nil {
+		return fmt.Errorf("public witness: %w", err)
+	}
+	return groth16.Verify(proof, vk, publicWitness)
+}