chore: Update WalletKit to use ZkArtifactSource trait

.github/workflows/ci.yml

@@ -100,7 +100,7 @@ jobs:
           llvm-ar-18 --version | head -n1
 
       - name: Run WASM compile check
-        run: cargo check -p walletkit --target wasm32-unknown-unknown
+        run: cargo check -p walletkit --features embed-zkeys --target wasm32-unknown-unknown
 
   swift-build:
     name: Build Swift
@@ -259,18 +259,20 @@ jobs:
           # See https://github.com/worldfnd/provekit, a specific nargo toolchain version is required
           toolchain: v1.0.0-beta.11
 
+      - uses: taiki-e/install-action@67729d5c413db75907f0ad1e39bb04b9c868ff60 # 2.85.7
+        with:
+          tool: nextest
+
       - name: Run tests
         env:
           WORLDCHAIN_SEPOLIA_RPC_URL: ${{ secrets.WORLDCHAIN_SEPOLIA_RPC_URL || 'https://worldchain-sepolia.g.alchemy.com/public' }}
           WORLDCHAIN_RPC_URL: ${{ secrets.WORLDCHAIN_RPC_URL || 'https://worldchain-mainnet.g.alchemy.com/public' }}
-        # we don't do --all-features because `compress-zkeys` is very expensive for the CI and doesn't need to be tested on every PR
-        # we add the remainder of non-default features to include them in tests
         run: |
-          cargo test --workspace --features walletkit-core/legacy-nullifiers --features walletkit-core/v3
+          cargo nextest run --workspace --all-features
 
       - name: Build non-default features
         run: |
-          cargo build --all --no-default-features
+          cargo build --workspace --no-default-features
 
   deny:
     name: Cargo deny

Cargo.toml

@@ -59,7 +59,7 @@ sha2 = "0.10"
 sqlite-wasm-rs = "0.5"
 strum = "0.27"
 subtle = "2"
-taceo-oprf = { version = "0.16", default-features = false }
+taceo-oprf = { version = "0.17", default-features = false }
 tempfile = "3"
 test-case = "3.3"
 thiserror = "2"
@@ -78,8 +78,8 @@ zeroize = "1"
 zip = { version = "2", default-features = false }
 
 # world-id-protocol crates
-world-id-core = { version = "0.12.0", default-features = false }
-world-id-proof = { version = "0.12.0", default-features = false }
+world-id-core = { version = "0.13", default-features = false }
+world-id-proof = { version = "0.13", default-features = false }
 
 # internal
 walletkit-core = { version = "0.20.4", path = "crates/walletkit-core", default-features = false }

crates/walletkit-cli/Cargo.toml

@@ -25,11 +25,15 @@ serde = { workspace = true, features = ["derive"] }
 serde_json = { workspace = true }
 tokio = { workspace = true, features = ["rt-multi-thread", "macros"] }
 tracing = { workspace = true }
-tracing-subscriber = { workspace = true, features = ["env-filter", "fmt", "registry"] }
+tracing-subscriber = { workspace = true, features = [
+  "env-filter",
+  "fmt",
+  "registry",
+] }
 walletkit-core = { workspace = true, features = ["issuers", "embed-zkeys"] }
 walletkit-testkit = { workspace = true }
 world-id-core = { workspace = true }
-world-id-proof = { workspace = true, features = ["zk-ownership-verify"] }
+world-id-proof = { workspace = true, features = ["embed-zk-artifacts"] }
 
 [dev-dependencies]
 serde_json = { workspace = true }

crates/walletkit-cli/src/commands/mod.rs

@@ -13,10 +13,11 @@ use std::sync::Arc;
 use alloy_core::primitives::Address;
 use clap::{Parser, Subcommand};
 use eyre::WrapErr as _;
+use walletkit_core::authenticator::artifacts::caching::CachingZkArtifacts;
 use world_id_core::primitives::Config;
 
-use walletkit_core::storage::{cache_embedded_groth16_material, CredentialStore};
-use walletkit_core::{Authenticator, Groth16Materials};
+use walletkit_core::storage::CredentialStore;
+use walletkit_core::Authenticator;
 
 use walletkit_testkit::env::DEFAULT_WORLDCHAIN_RPC_URL;
 use walletkit_testkit::storage::create_fs_credential_store;
@@ -313,19 +314,16 @@ pub async fn init_authenticator(
 
     let store = create_fs_credential_store(&root)?;
     let paths = store.storage_paths()?;
-    cache_embedded_groth16_material(&paths)?;
-    let materials = Arc::new(
-        Groth16Materials::from_cache(Arc::new(paths.clone()))
-            .wrap_err("failed to load cached Groth16 materials")?,
-    );
+
+    let artifacts = Arc::new(CachingZkArtifacts::new(Arc::new(paths)));
 
     let authenticator = if let Some(ref config) = config_json {
-        Authenticator::init(&seed, config, materials.clone(), store.clone())
+        Authenticator::init(&seed, config, artifacts.clone(), store.clone())
             .await
             .wrap_err("authenticator init failed")?
     } else {
         let config = resolve_built_config(cli)?;
-        Authenticator::init_with_config(&seed, config, materials.clone(), store.clone())
+        Authenticator::init_with_config(&seed, config, artifacts.clone(), store.clone())
             .await
             .wrap_err("authenticator init failed")?
     };

crates/walletkit-cli/src/commands/proof.rs

@@ -11,13 +11,15 @@ use walletkit_testkit::issuer::issue_faux_credential;
 use walletkit_testkit::proof::{
     build_test_request, verify_proof_onchain, VerifyItemResult,
 };
+use walletkit_testkit::storage::create_artifact_source;
 use walletkit_testkit::utils::now_secs;
 use world_id_core::primitives::{FieldElement, OwnershipProof, SessionId};
 use world_id_core::requests::{
     ProofRequest as CoreProofRequest, ProofResponse as CoreProofResponse, ProofType,
 };
 use world_id_proof::ownership_proof::verify_ownership_proof;
 
+use crate::commands::resolve_root;
 use crate::output;
 
 use super::{
@@ -370,7 +372,10 @@ fn run_verify_ownership(
     let nonce_fe = parse_field_element(nonce, "--nonce")?;
     let sub_fe = parse_field_element(sub, "--sub")?;
 
-    let result = verify_ownership_proof(&proof, nonce_fe, sub_fe);
+    let root = resolve_root(cli)?;
+    let artifacts = create_artifact_source(&root);
+
+    let result = verify_ownership_proof(&proof, nonce_fe, sub_fe, artifacts.as_ref());
     let merkle_root = proof.merkle_root.to_string();
 
     if cli.json {

crates/walletkit-cli/src/commands/setup.rs

@@ -1,9 +1,7 @@
 //! `walletkit setup` — one-shot wallet initialization and account registration.
 
-use walletkit_core::storage::cache_embedded_groth16_material;
-
 use crate::output;
-use walletkit_testkit::storage::create_fs_credential_store;
+use walletkit_testkit::storage::create_artifact_source;
 
 use super::auth::{register_and_poll, RegisterOutcome};
 use super::{resolve_root, Cli};
@@ -21,9 +19,8 @@ pub async fn run(cli: &Cli, poll_interval: u64) -> eyre::Result<()> {
 
     // --- wallet init ---
     std::fs::create_dir_all(&root)?;
-    let store = create_fs_credential_store(&root)?;
-    let paths = store.storage_paths()?;
-    cache_embedded_groth16_material(&paths)?;
+
+    create_artifact_source(&root).preload()?;
 
     // Generate and persist a 32-byte seed.
     let mut seed = vec![0u8; 32];

crates/walletkit-cli/src/commands/wallet.rs

@@ -1,11 +1,13 @@
 //! `walletkit wallet` subcommands — local setup and inspection.
 
+use std::sync::Arc;
+
 use clap::Subcommand;
 use eyre::WrapErr as _;
-use walletkit_core::storage::{cache_embedded_groth16_material, StoragePaths};
+use walletkit_core::storage::StoragePaths;
 
 use crate::output;
-use walletkit_testkit::storage::create_fs_credential_store;
+use walletkit_testkit::storage::{create_artifact_source, create_fs_credential_store};
 
 use super::{init_authenticator, resolve_root, Cli};
 
@@ -41,8 +43,10 @@ fn run_init(cli: &Cli) -> eyre::Result<()> {
     let root = resolve_root(cli)?;
     std::fs::create_dir_all(&root)?;
     let store = create_fs_credential_store(&root)?;
-    let paths = store.storage_paths()?;
-    cache_embedded_groth16_material(&paths)?;
+    let artifacts = create_artifact_source(&root);
+    let paths = Arc::new(store.paths()?);
+
+    artifacts.preload()?;
 
     // Generate and persist a 32-byte seed if one doesn't exist yet.
     let seed_path = root.join("seed");

crates/walletkit-core/Cargo.toml

@@ -64,6 +64,8 @@ rustls = { workspace = true, features = ["ring"] }
 sha2 = { workspace = true, features = ["force-soft"] }
 
 [dev-dependencies]
+world-id-proof = { workspace = true, features = ["embed-zk-artifacts"] }
+
 alloy = { workspace = true, features = [
   "getrandom",
   "json",
@@ -89,18 +91,30 @@ walletkit-testkit = { workspace = true }
 
 
 [features]
-default = ["issuers"]
+default = [
+  "issuers",
+  # embed-zkeys is a default feature because none of the current implementations
+  # provide any other way of loading the artifacts.
+  #
+  # Once we add a method of e.g. downloading the artifacts at runtime
+  # we can make this feature non-default
+  "embed-zkeys",
+]
 
 # Enables point-compression on all verifying keys. This results in ~2x smaller bundle size, but decompression is very expensive,
 # using it requires proper handling to ensure decompression is done once and cached. By default walletkit-swift and walletkit-android
 # ship with compressed keys. But this is disabled for tests.
-compress-zkeys = ["world-id-core/compress-zkeys"]
+compress-zkeys = [
+  "world-id-proof/compress-zkeys",
+  "world-id-proof/zstd-compress-zkeys",
+]
+
 issuers = []
 
-# Embeds compiled zkeys into the binary at compile time, enabling `Groth16Materials::from_embedded`.
-# Also activates `cache_embedded_groth16_material` on native targets.
+# Embeds compiled zkeys into the binary at compile time for `EmbeddedZkArtifacts`.
+# On native targets, `CachingZkArtifacts` can cache the embedded material on disk.
 # Disable this feature for environments where binary size matters (e.g. WASM).
-embed-zkeys = ["world-id-core/embed-zkeys", "world-id-core/zstd-compress-zkeys"]
+embed-zkeys = ["world-id-proof/embed-zk-artifacts"]
 
 # SECTION: V3 Feature Flags
 # Before conventions were introduced for external nullifiers with `app_id` & `action`, raw field elements were used.