@aztec/aztec 0.0.1-commit.7cf39cb55 → 0.0.1-commit.7ffbba4

package/src/cli/cmds/profile_gates.ts

@@ -0,0 +1,67 @@
+import { asyncPool } from '@aztec/foundation/async-pool';
+import type { LogFn } from '@aztec/foundation/log';
+
+import { execFile as execFileCb } from 'child_process';
+import { rm } from 'fs/promises';
+import { promisify } from 'util';
+
+import { MAX_CONCURRENT, discoverArtifacts } from './profile_utils.js';
+
+const execFile = promisify(execFileCb);
+
+interface GateCountResult {
+  name: string;
+  gateCount: number;
+}
+
+/** Parses circuit_size from bb gates JSON output: { "functions": [{ "circuit_size": N }] } */
+function parseGateCount(stdout: string): number {
+  const parsed = JSON.parse(stdout);
+  const size = parsed?.functions?.[0]?.circuit_size;
+  if (typeof size !== 'number') {
+    throw new Error('Failed to parse circuit_size from bb gates output');
+  }
+  return size;
+}
+
+/** Runs bb gates on a single artifact file and returns the gate count. */
+async function getGateCount(bb: string, artifactPath: string): Promise<number> {
+  const { stdout } = await execFile(bb, ['gates', '--scheme', 'chonk', '-b', artifactPath]);
+  return parseGateCount(stdout);
+}
+
+/** Profiles all compiled artifacts in a target directory and prints gate counts. */
+export async function profileGates(targetDir: string, log: LogFn): Promise<void> {
+  const bb = process.env.BB ?? 'bb';
+  const { artifacts, tmpDir } = await discoverArtifacts(targetDir);
+
+  if (artifacts.length === 0) {
+    log('No artifacts found in target directory.');
+    return;
+  }
+
+  try {
+    const results: GateCountResult[] = await asyncPool(MAX_CONCURRENT, artifacts, async artifact => ({
+      name: artifact.name,
+      gateCount: await getGateCount(bb, artifact.filePath),
+    }));
+    results.sort((a, b) => a.name.localeCompare(b.name));
+
+    if (results.length === 0) {
+      log('No constrained circuits found.');
+      return;
+    }
+
+    const maxNameLen = Math.max(...results.map(r => r.name.length));
+    log('');
+    log('Gate counts:');
+    log('-'.repeat(maxNameLen + 16));
+    for (const { name, gateCount } of results) {
+      log(`${name.padEnd(maxNameLen)}  ${gateCount.toLocaleString().padStart(12)}`);
+    }
+    log('-'.repeat(maxNameLen + 16));
+    log(`Total: ${results.length} circuit(s)`);
+  } finally {
+    await rm(tmpDir, { recursive: true, force: true });
+  }
+}

package/src/cli/cmds/profile_utils.ts

@@ -0,0 +1,58 @@
+import { mkdtemp, writeFile } from 'fs/promises';
+import { tmpdir } from 'os';
+import { join } from 'path';
+
+import type { CompiledArtifact, ContractFunction } from './utils/artifacts.js';
+import { readArtifactFiles } from './utils/artifacts.js';
+
+export const MAX_CONCURRENT = 4;
+
+export interface DiscoveredArtifact {
+  name: string;
+  filePath: string;
+  type: 'contract-function' | 'program';
+}
+
+/**
+ * Reads a target directory and returns a list of discovered artifacts with temp files
+ * created for contract functions. Caller must clean up tmpDir when done.
+ */
+export async function discoverArtifacts(
+  targetDir: string,
+): Promise<{ artifacts: DiscoveredArtifact[]; tmpDir: string }> {
+  const files = await readArtifactFiles(targetDir);
+  const tmpDir = await mkdtemp(join(tmpdir(), 'aztec-profile-'));
+  const artifacts: DiscoveredArtifact[] = [];
+
+  for (const file of files) {
+    if (Array.isArray(file.content.functions)) {
+      for (const func of file.content.functions) {
+        if (!func.bytecode || func.is_unconstrained) {
+          continue;
+        }
+        const name = `${file.name}::${func.name}`;
+        const tmpPath = join(tmpDir, `${file.name}-${func.name}.json`);
+        await writeFile(tmpPath, makeFunctionArtifact(file.content, func));
+        artifacts.push({ name, filePath: tmpPath, type: 'contract-function' });
+      }
+    } else if (file.content.bytecode) {
+      artifacts.push({ name: file.name, filePath: file.filePath, type: 'program' });
+    }
+  }
+
+  return { artifacts, tmpDir };
+}
+
+/** Extracts a contract function as a standalone program artifact JSON string. */
+export function makeFunctionArtifact(artifact: CompiledArtifact, func: ContractFunction) {
+  /* eslint-disable camelcase */
+  return JSON.stringify({
+    noir_version: artifact.noir_version,
+    hash: 0,
+    abi: func.abi,
+    bytecode: func.bytecode,
+    debug_symbols: func.debug_symbols,
+    file_map: artifact.file_map,
+  });
+  /* eslint-enable camelcase */
+}

package/src/cli/cmds/standby.ts

@@ -0,0 +1,111 @@
+import { getInitialTestAccountsData } from '@aztec/accounts/testing';
+import type { Fr } from '@aztec/aztec.js/fields';
+import { getSponsoredFPCAddress } from '@aztec/cli/cli-utils';
+import { getPublicClient } from '@aztec/ethereum/client';
+import type { GenesisStateConfig } from '@aztec/ethereum/config';
+import { RegistryContract, RollupContract } from '@aztec/ethereum/contracts';
+import type { EthAddress } from '@aztec/foundation/eth-address';
+import { startHttpRpcServer } from '@aztec/foundation/json-rpc/server';
+import type { LogFn } from '@aztec/foundation/log';
+import { retryUntil } from '@aztec/foundation/retry';
+import { AztecAddress } from '@aztec/stdlib/aztec-address';
+import { getGenesisValues } from '@aztec/world-state/testing';
+
+import Koa from 'koa';
+
+const ROLLUP_POLL_INTERVAL_S = 60;
+
+/**
+ * Computes the expected genesis archive root from the genesis state config.
+ * Reads test accounts and sponsored FPC addresses as specified, then computes
+ * the genesis values including the archive root and prefilled public data.
+ */
+export async function computeExpectedGenesisRoot(config: GenesisStateConfig, userLog: LogFn) {
+  const testAccounts = config.testAccounts ? (await getInitialTestAccountsData()).map(a => a.address) : [];
+  const sponsoredFPCAccounts = config.sponsoredFPC ? [await getSponsoredFPCAddress()] : [];
+  const prefundAddresses = (config.prefundAddresses ?? []).map(a => AztecAddress.fromString(a));
+  const initialFundedAccounts = testAccounts.concat(sponsoredFPCAccounts).concat(prefundAddresses);
+
+  userLog(`Initial funded accounts: ${initialFundedAccounts.map(a => a.toString()).join(', ')}`);
+
+  const { genesisArchiveRoot, prefilledPublicData } = await getGenesisValues(initialFundedAccounts);
+
+  userLog(`Genesis archive root: ${genesisArchiveRoot.toString()}`);
+
+  return { genesisArchiveRoot, prefilledPublicData };
+}
+
+/**
+ * Waits until the canonical rollup's genesis archive root matches the expected local genesis root.
+ * If the rollup is not yet compatible (e.g. during L1 contract upgrades), enters standby mode:
+ * starts a lightweight HTTP server for K8s liveness probes and polls every 60s until a compatible rollup appears.
+ */
+export async function waitForCompatibleRollup(
+  config: {
+    l1RpcUrls: string[];
+    l1ChainId: number;
+    l1Contracts: { registryAddress: EthAddress };
+    rollupVersion?: number;
+  },
+  expectedGenesisRoot: Fr,
+  port: number | undefined,
+  userLog: LogFn,
+): Promise<void> {
+  const publicClient = getPublicClient(config);
+  const rollupVersion: number | 'canonical' = config.rollupVersion ?? 'canonical';
+
+  const registry = new RegistryContract(publicClient, config.l1Contracts.registryAddress);
+  const rollupAddress = await registry.getRollupAddress(rollupVersion);
+  const rollup = new RollupContract(publicClient, rollupAddress.toString());
+
+  let l1GenesisRoot: Fr;
+  try {
+    l1GenesisRoot = await rollup.getGenesisArchiveTreeRoot();
+  } catch (err: any) {
+    throw new Error(
+      `Could not retrieve genesis archive root from canonical rollup at ${rollupAddress}: ${err.message}`,
+    );
+  }
+
+  if (l1GenesisRoot.equals(expectedGenesisRoot)) {
+    return;
+  }
+
+  userLog(
+    `Genesis root mismatch: expected ${expectedGenesisRoot}, got ${l1GenesisRoot} from rollup at ${rollupAddress}. ` +
+      `Entering standby mode. Will poll every ${ROLLUP_POLL_INTERVAL_S}s for a compatible rollup...`,
+  );
+
+  const standbyServer = await startHttpRpcServer({ getApp: () => new Koa(), isHealthy: () => true }, { port });
+  userLog(`Standby status server listening on port ${standbyServer.port}`);
+
+  try {
+    await retryUntil(
+      async () => {
+        const currentRollupAddress = await registry.getRollupAddress(rollupVersion);
+        const currentRollup = new RollupContract(publicClient, currentRollupAddress.toString());
+
+        let currentGenesisRoot: Fr;
+        try {
+          currentGenesisRoot = await currentRollup.getGenesisArchiveTreeRoot();
+        } catch {
+          userLog(`Failed to fetch genesis root from rollup at ${currentRollupAddress}. Retrying...`);
+          return undefined;
+        }
+
+        if (currentGenesisRoot.equals(expectedGenesisRoot)) {
+          userLog(`Compatible rollup found at ${currentRollupAddress}. Exiting standby mode.`);
+          return true;
+        }
+
+        userLog(`Still waiting. Rollup at ${currentRollupAddress} has genesis root ${currentGenesisRoot}.`);
+        return undefined;
+      },
+      'compatible rollup',
+      0,
+      ROLLUP_POLL_INTERVAL_S,
+    );
+  } finally {
+    await new Promise<void>((resolve, reject) => standbyServer.close(err => (err ? reject(err) : resolve())));
+  }
+}

package/src/cli/cmds/start_archiver.ts

@@ -3,8 +3,8 @@ import { createLogger } from '@aztec/aztec.js/log';
 import { type BlobClientConfig, blobClientConfigMapping, createBlobClient } from '@aztec/blob-client/client';
 import { getL1Config } from '@aztec/cli/config';
 import type { NamespacedApiHandlers } from '@aztec/foundation/json-rpc/server';
-import { type DataStoreConfig, dataConfigMappings } from '@aztec/kv-store/config';
 import { ArchiverApiSchema } from '@aztec/stdlib/interfaces/server';
+import { type DataStoreConfig, dataConfigMappings } from '@aztec/stdlib/kv-store';
 import { getConfigEnvVars as getTelemetryClientConfig, initTelemetryClient } from '@aztec/telemetry-client';
 
 import { extractRelevantOptions } from '../util.js';

package/src/cli/cmds/start_node.ts

@@ -1,30 +1,34 @@
-import { getInitialTestAccountsData } from '@aztec/accounts/testing';
 import { type AztecNodeConfig, aztecNodeConfigMappings, getConfigEnvVars } from '@aztec/aztec-node';
 import { Fr } from '@aztec/aztec.js/fields';
-import { getSponsoredFPCAddress } from '@aztec/cli/cli-utils';
 import { getL1Config } from '@aztec/cli/config';
 import { getPublicClient } from '@aztec/ethereum/client';
-import { SecretValue } from '@aztec/foundation/config';
+import { getGenesisStateConfigEnvVars } from '@aztec/ethereum/config';
+import { type NetworkNames, SecretValue } from '@aztec/foundation/config';
 import type { NamespacedApiHandlers } from '@aztec/foundation/json-rpc/server';
+import { Agent, makeUndiciFetch } from '@aztec/foundation/json-rpc/undici';
 import type { LogFn } from '@aztec/foundation/log';
+import { ProvingJobConsumerSchema, createProvingJobBrokerClient } from '@aztec/prover-client/broker';
 import { type CliPXEOptions, type PXEConfig, allPxeConfigMappings } from '@aztec/pxe/config';
 import { AztecNodeAdminApiSchema, AztecNodeApiSchema } from '@aztec/stdlib/interfaces/client';
-import { P2PApiSchema } from '@aztec/stdlib/interfaces/server';
+import { P2PApiSchema, ProverNodeApiSchema, type ProvingJobBroker } from '@aztec/stdlib/interfaces/server';
 import {
   type TelemetryClientConfig,
   initTelemetryClient,
+  makeTracedFetch,
   telemetryClientConfigMappings,
 } from '@aztec/telemetry-client';
 import { EmbeddedWallet } from '@aztec/wallets/embedded';
-import { getGenesisValues } from '@aztec/world-state/testing';
 
 import { createAztecNode } from '../../local-network/index.js';
 import {
   extractNamespacedOptions,
   extractRelevantOptions,
   preloadCrsDataForVerifying,
-  setupUpdateMonitor,
+  setupVersionChecker,
 } from '../util.js';
+import { getVersions } from '../versioning.js';
+import { computeExpectedGenesisRoot, waitForCompatibleRollup } from './standby.js';
+import { startProverBroker } from './start_prover_broker.js';
 
 export async function startNode(
   options: any,
@@ -32,6 +36,7 @@ export async function startNode(
   services: NamespacedApiHandlers,
   adminServices: NamespacedApiHandlers,
   userLog: LogFn,
+  networkName: NetworkNames,
 ): Promise<{ config: AztecNodeConfig }> {
   // All options set from environment variables
   const configFromEnvVars = getConfigEnvVars();
@@ -45,22 +50,38 @@ export async function startNode(
     ...relevantOptions,
   };
 
+  // Prover node configuration and broker setup
+  // REFACTOR: Move the broker setup out of here and into the prover-node factory
+  let broker: ProvingJobBroker | undefined = undefined;
   if (options.proverNode) {
-    userLog(`Running a Prover Node within a Node is not yet supported`);
-    process.exit(1);
+    nodeConfig.enableProverNode = true;
+    if (nodeConfig.proverAgentCount === 0) {
+      userLog(
+        `Running prover node without local prover agent. Connect prover agents or pass --proverAgent.proverAgentCount`,
+      );
+    }
+    if (nodeConfig.proverBrokerUrl) {
+      // at 1TPS we'd enqueue ~1k chonk verifier proofs and ~1k AVM proofs immediately
+      // set a lower connection limit such that we don't overload the server
+      // Keep retrying up to 30s
+      const fetch = makeTracedFetch(
+        [1, 2, 3, 3, 3, 3, 3, 3, 3, 3, 3],
+        false,
+        makeUndiciFetch(new Agent({ connections: 100 })),
+      );
+      broker = createProvingJobBrokerClient(nodeConfig.proverBrokerUrl, getVersions(nodeConfig), fetch);
+    } else if (options.proverBroker) {
+      ({ broker } = await startProverBroker(options, signalHandlers, services, userLog));
+    } else {
+      userLog(`--prover-broker-url or --prover-broker is required to start a Prover Node`);
+      process.exit(1);
+    }
   }
 
   await preloadCrsDataForVerifying(nodeConfig, userLog);
 
-  const testAccounts = nodeConfig.testAccounts ? (await getInitialTestAccountsData()).map(a => a.address) : [];
-  const sponsoredFPCAccounts = nodeConfig.sponsoredFPC ? [await getSponsoredFPCAddress()] : [];
-  const initialFundedAccounts = testAccounts.concat(sponsoredFPCAccounts);
-
-  userLog(`Initial funded accounts: ${initialFundedAccounts.map(a => a.toString()).join(', ')}`);
-
-  const { genesisArchiveRoot, prefilledPublicData } = await getGenesisValues(initialFundedAccounts);
-
-  userLog(`Genesis archive root: ${genesisArchiveRoot.toString()}`);
+  const genesisConfig = getGenesisStateConfigEnvVars();
+  const { genesisArchiveRoot, prefilledPublicData } = await computeExpectedGenesisRoot(genesisConfig, userLog);
 
   const followsCanonicalRollup =
     typeof nodeConfig.rollupVersion !== 'number' || (nodeConfig.rollupVersion as unknown as string) === 'canonical';
@@ -68,6 +89,11 @@ export async function startNode(
   if (!nodeConfig.l1Contracts.registryAddress || nodeConfig.l1Contracts.registryAddress.isZero()) {
     throw new Error('L1 registry address is required to start Aztec Node');
   }
+
+  // Wait for a compatible rollup before proceeding with full L1 config fetch.
+  // This prevents crashes when the canonical rollup hasn't been upgraded yet.
+  await waitForCompatibleRollup(nodeConfig, genesisArchiveRoot, options.port, userLog);
+
   const { addresses, config } = await getL1Config(
     nodeConfig.l1Contracts.registryAddress,
     nodeConfig.l1RpcUrls,
@@ -101,12 +127,17 @@ export async function startNode(
       ...extractNamespacedOptions(options, 'sequencer'),
     };
     // If no publisher private keys have been given, use the first validator key
-    if (sequencerConfig.publisherPrivateKeys === undefined || !sequencerConfig.publisherPrivateKeys.length) {
+    if (
+      sequencerConfig.sequencerPublisherPrivateKeys === undefined ||
+      !sequencerConfig.sequencerPublisherPrivateKeys.length
+    ) {
       if (sequencerConfig.validatorPrivateKeys?.getValue().length) {
-        sequencerConfig.publisherPrivateKeys = [new SecretValue(sequencerConfig.validatorPrivateKeys.getValue()[0])];
+        sequencerConfig.sequencerPublisherPrivateKeys = [
+          new SecretValue(sequencerConfig.validatorPrivateKeys.getValue()[0]),
+        ];
       }
     }
-    nodeConfig.publisherPrivateKeys = sequencerConfig.publisherPrivateKeys;
+    nodeConfig.sequencerPublisherPrivateKeys = sequencerConfig.sequencerPublisherPrivateKeys;
   }
 
   if (nodeConfig.p2pEnabled) {
@@ -120,13 +151,22 @@ export async function startNode(
   const telemetry = await initTelemetryClient(telemetryConfig);
 
   // Create and start Aztec Node
-  const node = await createAztecNode(nodeConfig, { telemetry }, { prefilledPublicData });
+  const node = await createAztecNode(nodeConfig, { telemetry, proverBroker: broker }, { prefilledPublicData });
 
   // Add node and p2p to services list
   services.node = [node, AztecNodeApiSchema];
   services.p2p = [node.getP2P(), P2PApiSchema];
   adminServices.nodeAdmin = [node, AztecNodeAdminApiSchema];
 
+  // Register prover-node services if the prover node subsystem is running
+  const proverNode = node.getProverNode();
+  if (proverNode) {
+    services.prover = [proverNode, ProverNodeApiSchema];
+    if (!nodeConfig.proverBrokerUrl) {
+      services.provingJobSource = [proverNode.getProver().getProvingJobSource(), ProvingJobConsumerSchema];
+    }
+  }
+
   // Add node stop function to signal handlers
   signalHandlers.push(node.stop.bind(node));
 
@@ -140,16 +180,19 @@ export async function startNode(
     await addBot(options, signalHandlers, services, wallet, node, telemetry, undefined);
   }
 
-  if (nodeConfig.autoUpdate !== 'disabled' && nodeConfig.autoUpdateUrl) {
-    await setupUpdateMonitor(
-      nodeConfig.autoUpdate,
-      new URL(nodeConfig.autoUpdateUrl),
-      followsCanonicalRollup,
-      getPublicClient(nodeConfig!),
-      nodeConfig.l1Contracts.registryAddress,
-      signalHandlers,
-      async config => node.setConfig((await AztecNodeAdminApiSchema.setConfig.parameters().parseAsync([config]))[0]),
-    );
+  if (nodeConfig.enableVersionCheck && networkName !== 'local') {
+    const cacheDir = process.env.DATA_DIRECTORY ? `${process.env.DATA_DIRECTORY}/cache` : undefined;
+    try {
+      await setupVersionChecker(
+        networkName,
+        followsCanonicalRollup,
+        getPublicClient(nodeConfig!),
+        signalHandlers,
+        cacheDir,
+      );
+    } catch {
+      /* no-op */
+    }
   }
 
   return { config: nodeConfig };

package/src/cli/cmds/start_prover_broker.ts

@@ -1,5 +1,5 @@
 import { getL1Config } from '@aztec/cli/config';
-import { getPublicClient } from '@aztec/ethereum/client';
+import { getGenesisStateConfigEnvVars } from '@aztec/ethereum/config';
 import type { NamespacedApiHandlers } from '@aztec/foundation/json-rpc/server';
 import type { LogFn } from '@aztec/foundation/log';
 import {
@@ -13,7 +13,8 @@ import { getProverNodeBrokerConfigFromEnv } from '@aztec/prover-node';
 import type { ProvingJobBroker } from '@aztec/stdlib/interfaces/server';
 import { getConfigEnvVars as getTelemetryClientConfig, initTelemetryClient } from '@aztec/telemetry-client';
 
-import { extractRelevantOptions, setupUpdateMonitor } from '../util.js';
+import { extractRelevantOptions } from '../util.js';
+import { computeExpectedGenesisRoot, waitForCompatibleRollup } from './standby.js';
 
 export async function startProverBroker(
   options: any,
@@ -35,7 +36,10 @@ export async function startProverBroker(
     throw new Error('L1 registry address is required to start Aztec Node without --deploy-aztec-contracts option');
   }
 
-  const followsCanonicalRollup = typeof config.rollupVersion !== 'number';
+  const genesisConfig = getGenesisStateConfigEnvVars();
+  const { genesisArchiveRoot } = await computeExpectedGenesisRoot(genesisConfig, userLog);
+  await waitForCompatibleRollup(config, genesisArchiveRoot, options.port, userLog);
+
   const { addresses, config: rollupConfig } = await getL1Config(
     config.l1Contracts.registryAddress,
     config.l1RpcUrls,
@@ -49,17 +53,6 @@ export async function startProverBroker(
   const client = await initTelemetryClient(getTelemetryClientConfig());
   const broker = await createAndStartProvingBroker(config, client);
 
-  if (options.autoUpdate !== 'disabled' && options.autoUpdateUrl) {
-    await setupUpdateMonitor(
-      options.autoUpdate,
-      new URL(options.autoUpdateUrl),
-      followsCanonicalRollup,
-      getPublicClient(config),
-      config.l1Contracts.registryAddress,
-      signalHandlers,
-    );
-  }
-
   services.proverBroker = [
     broker,
     config.proverBrokerDebugReplayEnabled ? ProvingJobBrokerSchemaWithDebug : ProvingJobBrokerSchema,

package/src/cli/cmds/utils/artifacts.ts

@@ -0,0 +1,44 @@
+import { readFile, readdir } from 'fs/promises';
+import { join } from 'path';
+
+export interface CompiledArtifact {
+  noir_version: string;
+  file_map: unknown;
+  functions: ContractFunction[];
+  bytecode?: string;
+}
+
+export interface ContractFunction {
+  name: string;
+  abi: unknown;
+  bytecode: string;
+  debug_symbols: unknown;
+  is_unconstrained?: boolean;
+}
+
+export interface ArtifactFile {
+  name: string;
+  filePath: string;
+  content: CompiledArtifact;
+}
+
+/** Reads all JSON artifact files from a target directory and returns their parsed contents. */
+export async function readArtifactFiles(targetDir: string): Promise<ArtifactFile[]> {
+  let entries: string[];
+  try {
+    entries = (await readdir(targetDir)).filter(f => f.endsWith('.json'));
+  } catch (err: any) {
+    if (err?.code === 'ENOENT') {
+      throw new Error(`Target directory '${targetDir}' does not exist. Compile first with 'aztec compile'.`);
+    }
+    throw err;
+  }
+
+  const artifacts: ArtifactFile[] = [];
+  for (const file of entries) {
+    const filePath = join(targetDir, file);
+    const content = JSON.parse(await readFile(filePath, 'utf-8')) as CompiledArtifact;
+    artifacts.push({ name: file.replace('.json', ''), filePath, content });
+  }
+  return artifacts;
+}

package/src/cli/cmds/utils/needs_recompile.ts

@@ -0,0 +1,139 @@
+import TOML from '@iarna/toml';
+import { readFile, readdir, stat } from 'fs/promises';
+import { join, resolve } from 'path';
+
+/**
+ * Returns true if recompilation is needed: either no artifacts exist in target/ or any .nr or Nargo.toml source file
+ * (including path-based dependencies) is newer than the oldest artifact. We compare against the oldest artifact so
+ * that a source change between the oldest and newest compilation (e.g. in a multi-contract workspace) still triggers
+ * a recompile.
+ *
+ * Note: The above implies that if there is a random json file in the target dir we would be always recompiling.
+ */
+export async function needsRecompile(): Promise<boolean> {
+  const oldestArtifactMs = await getOldestArtifactModificationTime('target');
+  if (oldestArtifactMs === undefined) {
+    return true;
+  }
+
+  const crateDirs = await collectCrateDirs('.');
+  return hasNewerSourceFile(crateDirs, oldestArtifactMs);
+}
+
+/**
+ * Returns the last modification time (timestamp in ms) of the oldest .json artifact in targetDir, or undefined if
+ * none exist.
+ */
+async function getOldestArtifactModificationTime(targetDir: string): Promise<number | undefined> {
+  let entries: string[];
+  try {
+    entries = (await readdir(targetDir)).filter(f => f.endsWith('.json'));
+  } catch (err: any) {
+    if (err?.code === 'ENOENT') {
+      return undefined;
+    }
+    throw err;
+  }
+
+  if (entries.length === 0) {
+    return undefined;
+  }
+
+  let oldest = Infinity;
+  for (const entry of entries) {
+    const s = await stat(join(targetDir, entry));
+    if (s.mtimeMs < oldest) {
+      oldest = s.mtimeMs;
+    }
+  }
+  return oldest;
+}
+
+/**
+ * Recursively collects crate directories starting from startCrateDir by following path-based dependencies declared in
+ * Nargo.toml files. Git-based deps are ignored (they only change when Nargo.toml itself is modified since the deps are
+ * tagged).
+ */
+async function collectCrateDirs(startCrateDir: string): Promise<string[]> {
+  // We have a set of visited dirs we check against when entering a new dir because we could stumble upon a directory
+  // multiple times in case multiple deps shared a dep (e.g. dep A and dep B both sharing dep C).
+  const visited = new Set<string>();
+
+  async function visit(crateDir: string): Promise<void> {
+    const absDir = resolve(crateDir);
+    if (visited.has(absDir)) {
+      return;
+    }
+    visited.add(absDir);
+
+    // Every dep is its own crate and every crate needs to have Nargo.toml defined in the root so we try to load it and
+    // error out if it's not the case.
+    const tomlPath = join(absDir, 'Nargo.toml');
+    const content = await readFile(tomlPath, 'utf-8').catch(() => {
+      throw new Error(`Incorrectly defined dependency. Nargo.toml not found in ${absDir}`);
+    });
+
+    // We parse and iterate over the dependencies
+    const parsed = TOML.parse(content) as Record<string, any>;
+    const deps = (parsed.dependencies as Record<string, any>) ?? {};
+    for (const dep of Object.values(deps)) {
+      if (dep && typeof dep === 'object' && typeof dep.path === 'string') {
+        const depPath = resolve(absDir, dep.path);
+        const s = await stat(depPath);
+        if (!s.isDirectory()) {
+          throw new Error(
+            `Dependency path "${dep.path}" in ${tomlPath} resolves to ${depPath} which is not a directory`,
+          );
+        }
+        await visit(depPath);
+      }
+    }
+  }
+
+  await visit(startCrateDir);
+  return [...visited];
+}
+
+/**
+ * Walks crate dirs looking for .nr and Nargo.toml files newer than thresholdMs. Short-circuits on the first match.
+ */
+async function hasNewerSourceFile(crateDirs: string[], thresholdMs: number): Promise<boolean> {
+  // Returns true if it find a new file than thresholdMs, false otherwise
+  async function walkForNewer(dir: string): Promise<boolean> {
+    let entries;
+    try {
+      entries = await readdir(dir, { withFileTypes: true });
+    } catch {
+      return false;
+    }
+
+    // We iterate over the entries in the dir
+    for (const entry of entries) {
+      const fullPath = join(dir, entry.name);
+      if (entry.isDirectory()) {
+        // If the entry is a dir and it's not called `target` we recursively enter it
+        if (entry.name === 'target') {
+          continue;
+        }
+        if (await walkForNewer(fullPath)) {
+          return true;
+        }
+      } else if (entry.name === 'Nargo.toml' || entry.name.endsWith('.nr')) {
+        // The entry is a Nargo.toml file or *.nr file so we check the timestamp
+        const s = await stat(fullPath);
+        if (s.mtimeMs > thresholdMs) {
+          return true;
+        }
+      }
+    }
+    return false;
+  }
+
+  // We search through the crate dirs
+  for (const dir of crateDirs) {
+    if (await walkForNewer(dir)) {
+      return true;
+    }
+  }
+  return false;
+}

package/src/cli/cmds/utils/spawn.ts

@@ -0,0 +1,16 @@
+import { spawn } from 'child_process';
+
+/** Spawns a command with inherited stdio and rejects on non-zero exit. */
+export function run(cmd: string, args: string[]): Promise<void> {
+  return new Promise((resolve, reject) => {
+    const child = spawn(cmd, args, { stdio: 'inherit' });
+    child.on('error', reject);
+    child.on('close', code => {
+      if (code !== 0) {
+        reject(new Error(`${cmd} exited with code ${code}`));
+      } else {
+        resolve();
+      }
+    });
+  });
+}