@aztec/aztec 0.0.1-commit.9593d84 → 0.0.1-commit.96dac018d

package/src/cli/aztec_start_action.ts

@@ -1,6 +1,7 @@
 import {
   type NamespacedApiHandlers,
   createNamespacedSafeJsonRpcServer,
+  getApiKeyAuthMiddleware,
   startHttpRpcServer,
 } from '@aztec/foundation/json-rpc/server';
 import type { LogFn, Logger } from '@aztec/foundation/log';
@@ -11,6 +12,7 @@ import { getOtelJsonRpcPropagationMiddleware } from '@aztec/telemetry-client';
 
 import { createLocalNetwork } from '../local-network/index.js';
 import { github, splash } from '../splash.js';
+import { resolveAdminApiKey } from './admin_api_key_store.js';
 import { getCliVersion } from './release_version.js';
 import { extractNamespacedOptions, installSignalHandlers } from './util.js';
 import { getVersions } from './versioning.js';
@@ -33,9 +35,13 @@ export async function aztecStart(options: any, userLog: LogFn, debugLogger: Logg
       {
         l1Mnemonic: localNetwork.l1Mnemonic,
         l1RpcUrls: options.l1RpcUrls,
-        deployAztecContractsSalt: localNetwork.deployAztecContractsSalt,
         testAccounts: localNetwork.testAccounts,
         realProofs: false,
+        // Setting the epoch duration to 2 by default for local network. This allows the epoch to be "proven" faster, so
+        // the users can consume out hash without having to wait for a long time.
+        // Note: We are not proving anything in the local network (realProofs == false). But in `createLocalNetwork`,
+        // the EpochTestSettler will set the out hash to the outbox when an epoch is complete.
+        aztecEpochDuration: 2,
       },
       userLog,
     );
@@ -44,18 +50,17 @@ export async function aztecStart(options: any, userLog: LogFn, debugLogger: Logg
     signalHandlers.push(stop);
     services.node = [node, AztecNodeApiSchema];
   } else {
+    // Route --prover-node through startNode
+    if (options.proverNode && !options.node) {
+      options.node = true;
+    }
+
     if (options.node) {
       const { startNode } = await import('./cmds/start_node.js');
       ({ config } = await startNode(options, signalHandlers, services, adminServices, userLog));
     } else if (options.bot) {
       const { startBot } = await import('./cmds/start_bot.js');
       await startBot(options, signalHandlers, services, userLog);
-    } else if (options.proverNode) {
-      const { startProverNode } = await import('./cmds/start_prover_node.js');
-      ({ config } = await startProverNode(options, signalHandlers, services, userLog));
-    } else if (options.blobSink) {
-      const { startBlobSink } = await import('./cmds/start_blob_sink.js');
-      await startBlobSink(options, signalHandlers, userLog);
     } else if (options.archiver) {
       const { startArchiver } = await import('./cmds/start_archiver.js');
       ({ config } = await startArchiver(options, signalHandlers, services));
@@ -98,14 +103,54 @@ export async function aztecStart(options: any, userLog: LogFn, debugLogger: Logg
 
   // If there are any admin services, start a separate JSON-RPC server for them
   if (Object.entries(adminServices).length > 0) {
+    const adminMiddlewares = [getOtelJsonRpcPropagationMiddleware(), getVersioningMiddleware(versions)];
+
+    // Resolve the admin API key (auto-generated and persisted, or opt-out)
+    const apiKeyResolution = await resolveAdminApiKey(
+      {
+        adminApiKeyHash: options.adminApiKeyHash,
+        disableAdminApiKey: options.disableAdminApiKey,
+        resetAdminApiKey: options.resetAdminApiKey,
+        dataDirectory: options.dataDirectory,
+      },
+      debugLogger,
+    );
+    if (apiKeyResolution) {
+      adminMiddlewares.unshift(getApiKeyAuthMiddleware(apiKeyResolution.apiKeyHash));
+    } else {
+      debugLogger.warn('No admin API key set — admin endpoint is unauthenticated');
+    }
+
     const rpcServer = createNamespacedSafeJsonRpcServer(adminServices, {
       http200OnError: false,
       log: debugLogger,
-      middlewares: [getOtelJsonRpcPropagationMiddleware(), getVersioningMiddleware(versions)],
+      middlewares: adminMiddlewares,
       maxBatchSize: options.rpcMaxBatchSize,
       maxBodySizeBytes: options.rpcMaxBodySize,
     });
     const { port } = await startHttpRpcServer(rpcServer, { port: options.adminPort });
     debugLogger.info(`Aztec Server admin API listening on port ${port}`, versions);
+
+    // Display the API key after the server has started
+    // Uses userLog which is never filtered by LOG_LEVEL.
+    if (apiKeyResolution?.rawKey) {
+      const separator = '='.repeat(70);
+      userLog('');
+      userLog(separator);
+      userLog('  ADMIN API KEY (save this — it will NOT be shown again)');
+      userLog('');
+      userLog(`  ${apiKeyResolution.rawKey}`);
+      userLog('');
+      userLog(`  Use via header:  x-api-key: <key>`);
+      userLog(`  Or via header:   Authorization: Bearer <key>`);
+      if (options.dataDirectory) {
+        userLog('');
+        userLog('  The key hash has been persisted — on next restart, the same key will be used.');
+      }
+      userLog('');
+      userLog('  To disable admin auth: --disable-admin-api-key or AZTEC_DISABLE_ADMIN_API_KEY=true');
+      userLog(separator);
+      userLog('');
+    }
   }
 }

package/src/cli/aztec_start_options.ts

@@ -1,8 +1,9 @@
 import { type ArchiverConfig, archiverConfigMappings } from '@aztec/archiver/config';
-import { sequencerClientConfigMappings } from '@aztec/aztec-node/config';
-import { blobSinkConfigMappings } from '@aztec/blob-sink/server';
+import { blobClientConfigMapping } from '@aztec/blob-client/client/config';
 import { botConfigMappings } from '@aztec/bot/config';
-import { l1ContractAddressesMapping, l1ContractsConfigMappings, l1ReaderConfigMappings } from '@aztec/ethereum';
+import { l1ContractsConfigMappings } from '@aztec/ethereum/config';
+import { l1ContractAddressesMapping } from '@aztec/ethereum/l1-contract-addresses';
+import { l1ReaderConfigMappings } from '@aztec/ethereum/l1-reader';
 import { getKeys } from '@aztec/foundation/collection';
 import {
   type ConfigMapping,
@@ -14,12 +15,13 @@ import {
 import { dataConfigMappings } from '@aztec/kv-store/config';
 import { sharedNodeConfigMappings } from '@aztec/node-lib/config';
 import { bootnodeConfigMappings, p2pConfigMappings } from '@aztec/p2p/config';
-import { proverAgentConfigMappings, proverBrokerConfigMappings } from '@aztec/prover-client/broker';
+import { proverAgentConfigMappings, proverBrokerConfigMappings } from '@aztec/prover-client/broker/config';
 import { proverNodeConfigMappings } from '@aztec/prover-node/config';
 import { allPxeConfigMappings } from '@aztec/pxe/config';
-import { chainConfigMappings } from '@aztec/stdlib/config';
-import { telemetryClientConfigMappings } from '@aztec/telemetry-client';
-import { worldStateConfigMappings } from '@aztec/world-state';
+import { sequencerClientConfigMappings } from '@aztec/sequencer-client/config';
+import { chainConfigMappings, nodeRpcConfigMappings } from '@aztec/stdlib/config';
+import { telemetryClientConfigMappings } from '@aztec/telemetry-client/config';
+import { worldStateConfigMappings } from '@aztec/world-state/config';
 
 import { DefaultMnemonic } from '../mnemonic.js';
 
@@ -124,14 +126,6 @@ export const aztecStartOptions: { [key: string]: AztecStartOption[] } = {
       defaultValue: DefaultMnemonic,
       env: 'MNEMONIC',
     },
-    {
-      flag: '--local-network.deployAztecContractsSalt <value>',
-      description:
-        'Numeric salt for deploying L1 Aztec contracts before starting the local network. Needs mnemonic or private key to be set.',
-      env: 'DEPLOY_AZTEC_CONTRACTS_SALT',
-      defaultValue: undefined,
-      parseVal: (val: string) => (val ? parseInt(val) : undefined),
-    },
   ],
   API: [
     {
@@ -148,20 +142,46 @@ export const aztecStartOptions: { [key: string]: AztecStartOption[] } = {
       env: 'AZTEC_ADMIN_PORT',
       parseVal: val => parseInt(val, 10),
     },
+    {
+      flag: '--admin-api-key-hash <value>',
+      description:
+        'SHA-256 hex hash of a pre-generated admin API key. When set, the node uses this hash for authentication instead of auto-generating a key.',
+      defaultValue: undefined,
+      env: 'AZTEC_ADMIN_API_KEY_HASH',
+    },
+    {
+      flag: '--disable-admin-api-key',
+      description:
+        'Disable API key authentication on the admin RPC endpoint. By default, a key is auto-generated, displayed once, and its hash is persisted.',
+      defaultValue: false,
+      env: 'AZTEC_DISABLE_ADMIN_API_KEY',
+      // undefined means the flag was passed without a value (boolean toggle), treat as true.
+      parseVal: val => val === undefined || val === 'true' || val === '1',
+    },
+    {
+      flag: '--reset-admin-api-key',
+      description:
+        'Force-generate a new admin API key, replacing any previously persisted key hash. The new key is displayed once at startup.',
+      defaultValue: false,
+      env: 'AZTEC_RESET_ADMIN_API_KEY',
+      parseVal: val => val === 'true' || val === '1',
+    },
     {
       flag: '--api-prefix <value>',
       description: 'Prefix for API routes on any service that is started',
       defaultValue: '',
       env: 'API_PREFIX',
     },
+    configToFlag('--rpcMaxBatchSize', nodeRpcConfigMappings.rpcMaxBatchSize),
+    configToFlag('--rpcMaxBodySize', nodeRpcConfigMappings.rpcMaxBodySize),
   ],
   ETHEREUM: [
     configToFlag('--l1-chain-id', l1ReaderConfigMappings.l1ChainId),
     // Do not set default for CLI: keep undefined unless provided via flag or env
     configToFlag('--l1-rpc-urls', { ...l1ReaderConfigMappings.l1RpcUrls, defaultValue: undefined }),
-    configToFlag('--l1-consensus-host-urls', blobSinkConfigMappings.l1ConsensusHostUrls),
-    configToFlag('--l1-consensus-host-api-keys', blobSinkConfigMappings.l1ConsensusHostApiKeys),
-    configToFlag('--l1-consensus-host-api-key-headers', blobSinkConfigMappings.l1ConsensusHostApiKeyHeaders),
+    configToFlag('--l1-consensus-host-urls', blobClientConfigMapping.l1ConsensusHostUrls),
+    configToFlag('--l1-consensus-host-api-keys', blobClientConfigMapping.l1ConsensusHostApiKeys),
+    configToFlag('--l1-consensus-host-api-key-headers', blobClientConfigMapping.l1ConsensusHostApiKeyHeaders),
   ],
   'L1 CONTRACTS': [
     configToFlag('--registry-address', l1ContractAddressesMapping.registryAddress),
@@ -174,7 +194,7 @@ export const aztecStartOptions: { [key: string]: AztecStartOption[] } = {
   'WORLD STATE': [
     configToFlag('--world-state-data-directory', worldStateConfigMappings.worldStateDataDirectory),
     configToFlag('--world-state-db-map-size-kb', worldStateConfigMappings.worldStateDbMapSizeKb),
-    configToFlag('--world-state-block-history', worldStateConfigMappings.worldStateBlockHistory),
+    configToFlag('--world-state-checkpoint-history', worldStateConfigMappings.worldStateCheckpointHistory),
   ],
   // We can't easily auto-generate node options as they're parts of modules defined below
   'AZTEC NODE': [
@@ -208,21 +228,13 @@ export const aztecStartOptions: { [key: string]: AztecStartOption[] } = {
       'sequencer',
       omitConfigMappings(sequencerClientConfigMappings, [
         'fakeProcessingDelayPerTxMs',
+        'fakeThrowAfterProcessingTxCount',
         'skipCollectingAttestations',
         'skipInvalidateBlockAsProposer',
         'blobSinkMapSizeKb',
       ]),
     ),
   ],
-  'BLOB SINK': [
-    {
-      flag: '--blob-sink',
-      description: 'Starts Aztec Blob Sink with options',
-      defaultValue: undefined,
-      env: undefined,
-    },
-    ...getOptions('blobSink', blobSinkConfigMappings),
-  ],
   'PROVER NODE': [
     {
       flag: '--prover-node',
@@ -234,12 +246,8 @@ export const aztecStartOptions: { [key: string]: AztecStartOption[] } = {
       'proverNode',
       omitConfigMappings(proverNodeConfigMappings, [
         // filter out options passed separately
-        ...getKeys(archiverConfigMappings),
         ...getKeys(proverBrokerConfigMappings),
         ...getKeys(proverAgentConfigMappings),
-        ...getKeys(p2pConfigMappings),
-        ...getKeys(worldStateConfigMappings),
-        ...getKeys(sharedNodeConfigMappings),
       ]),
     ),
   ],

package/src/cli/cli.ts

@@ -35,44 +35,11 @@ export function injectAztecCommands(program: Command, userLog: LogFn, debugLogge
     program.addHelpText(
       'after',
       `
+Additional commands:
 
-  Additional commands:
-
-    init [folder] [options]: creates a new Noir project
-      Options:
-        --name <name>       Name of the package
-        --contract          Use a contract template (default)
-        --lib               Use a library template
-        --bin               Use a binary template
-      Examples:
-        $ aztec init                    # creates a contract project in current directory
-        $ aztec init --lib              # creates a library project
-
-    new <path> [options]: creates a new Noir project in a new directory
-      Options:
-        --name <name>       Name of the package
-        --contract          Use a contract template (default)
-        --lib               Use a library template
-        --bin               Use a binary template
-      Examples:
-        $ aztec new my-project          # creates a contract project in ./my-project
-        $ aztec new my-lib --lib        # creates a library project in ./my-lib
-
-    compile [options]: compiles Aztec Noir contracts
-      Compiles contracts with nargo compile and then postprocesses them to generate Aztec-specific artifacts including:
-        - Transpiled contract artifacts
-        - Verification keys
-      The compiled contracts will be placed in the target/ directory by default.
-      Supports standard nargo compile options.
-
-    test [options]: starts a dockerized TXE node via
-      $ aztec start --txe
-    then runs
-      $ aztec test --silence-warnings --oracle-resolver=<TXE_ADDRESS> [options]
-
-    preload-crs: Downloads and caches the Common Reference String (CRS) data required for zero-knowledge proofs.
-      Example:
-        $ aztec preload-crs             # preloads CRS data
+  init [folder] [options]  creates a new Aztec Noir project.
+  new <path> [options]     creates a new Aztec Noir project in a new directory.
+  test [options]           starts a TXE and runs "nargo test" using it as the oracle resolver.
     `,
     );
   }

package/src/cli/cmds/compile.ts

@@ -0,0 +1,184 @@
+import type { LogFn } from '@aztec/foundation/log';
+
+import { execFileSync } from 'child_process';
+import type { Command } from 'commander';
+import { readFile, writeFile } from 'fs/promises';
+import { join } from 'path';
+
+import { readArtifactFiles } from './utils/artifacts.js';
+import { run } from './utils/spawn.js';
+
+/** Returns paths to contract artifacts in the target directory. */
+async function collectContractArtifacts(): Promise<string[]> {
+  let files;
+  try {
+    files = await readArtifactFiles('target');
+  } catch (err: any) {
+    if (err?.message?.includes('does not exist')) {
+      return [];
+    }
+    throw err;
+  }
+  return files.filter(f => Array.isArray(f.content.functions)).map(f => f.filePath);
+}
+
+/** Strips the `__aztec_nr_internals__` prefix from function names in contract artifacts. */
+async function stripInternalPrefixes(artifactPaths: string[]): Promise<void> {
+  for (const path of artifactPaths) {
+    const artifact = JSON.parse(await readFile(path, 'utf-8'));
+    for (const fn of artifact.functions) {
+      if (typeof fn.name === 'string') {
+        fn.name = fn.name.replace(/^__aztec_nr_internals__/, '');
+      }
+    }
+    await writeFile(path, JSON.stringify(artifact, null, 2) + '\n');
+  }
+}
+
+/** Returns the set of package names that are contract crates in the current workspace. */
+async function getContractPackageNames(): Promise<Set<string>> {
+  const contractNames = new Set<string>();
+
+  let rootToml: string;
+  try {
+    rootToml = await readFile('Nargo.toml', 'utf-8');
+  } catch {
+    return contractNames;
+  }
+
+  const membersMatch = rootToml.match(/members\s*=\s*\[([^\]]*)\]/);
+  if (membersMatch) {
+    const members = membersMatch[1]
+      .split(',')
+      .map(m => m.trim().replace(/^"|"$/g, ''))
+      .filter(m => m.length > 0);
+
+    for (const member of members) {
+      try {
+        const memberToml = await readFile(join(member, 'Nargo.toml'), 'utf-8');
+        if (/type\s*=\s*"contract"/.test(memberToml)) {
+          const nameMatch = memberToml.match(/name\s*=\s*"([^"]+)"/);
+          if (nameMatch) {
+            contractNames.add(nameMatch[1]);
+          }
+        }
+      } catch {
+        // Member directory might not exist or have no Nargo.toml; skip.
+      }
+    }
+  } else {
+    // Single-crate project (no workspace): check if the root Nargo.toml itself is a contract.
+    if (/type\s*=\s*"contract"/.test(rootToml)) {
+      const nameMatch = rootToml.match(/name\s*=\s*"([^"]+)"/);
+      if (nameMatch) {
+        contractNames.add(nameMatch[1]);
+      }
+    }
+  }
+
+  return contractNames;
+}
+
+/** Checks that no tests exist in contract crates and fails with a helpful message if they do. */
+async function checkNoTestsInContracts(nargo: string, log: LogFn): Promise<void> {
+  const contractPackages = await getContractPackageNames();
+  if (contractPackages.size === 0) {
+    return;
+  }
+
+  let output: string;
+  try {
+    // We list tests for all the crates in the workspace
+    output = execFileSync(nargo, ['test', '--list-tests', '--silence-warnings'], {
+      encoding: 'utf-8',
+      stdio: ['pipe', 'pipe', 'inherit'],
+    });
+  } catch {
+    // If listing tests fails (e.g. test crate has compile errors), skip the check.
+    return;
+  }
+
+  // The output of the `nargo test --list-tests` command is as follows:
+  // ```
+  // crate_name_1 test_name_1
+  // crate_name_2 test_name_2
+  // ...
+  // crate_name_n test_name_n
+  // ```
+  //
+  // We parse the individual lines and then we check if any contract crate appeared in the parsed output.
+  const lines = output
+    .trim()
+    .split('\n')
+    .filter(line => line.length > 0);
+  const testsInContracts: { packageName: string; testName: string }[] = [];
+
+  for (const line of lines) {
+    const spaceIndex = line.indexOf(' ');
+    if (spaceIndex === -1) {
+      continue;
+    }
+    const packageName = line.substring(0, spaceIndex);
+    const testName = line.substring(spaceIndex + 1);
+    if (contractPackages.has(packageName)) {
+      testsInContracts.push({ packageName, testName });
+    }
+  }
+
+  if (testsInContracts.length > 0) {
+    const details = testsInContracts.map(t => `  ${t.packageName}::${t.testName}`).join('\n');
+    log(
+      `WARNING: Found tests in contract crate(s):\n${details}\n\n` +
+        `Tests should be in a dedicated test crate, not in the contract crate.\n` +
+        `Learn more: https://docs.aztec.network/errors/1`,
+    );
+  }
+}
+
+/** Compiles Aztec Noir contracts and postprocesses artifacts. */
+async function compileAztecContract(nargoArgs: string[], log: LogFn): Promise<void> {
+  const nargo = process.env.NARGO ?? 'nargo';
+  const bb = process.env.BB ?? 'bb';
+
+  await run(nargo, ['compile', ...nargoArgs]);
+
+  // Ensure contract crates contain no tests (tests belong in the test crate).
+  await checkNoTestsInContracts(nargo, log);
+
+  const artifacts = await collectContractArtifacts();
+
+  if (artifacts.length > 0) {
+    log('Postprocessing contracts...');
+    const bbArgs = artifacts.flatMap(a => ['-i', a]);
+    await run(bb, ['aztec_process', ...bbArgs]);
+
+    // TODO: This should be part of bb aztec_process!
+    await stripInternalPrefixes(artifacts);
+  }
+
+  log('Compilation complete!');
+}
+
+export function injectCompileCommand(program: Command, log: LogFn): Command {
+  program
+    .command('compile')
+    .argument('[nargo-args...]')
+    .passThroughOptions()
+    .allowUnknownOption()
+    .description(
+      'Compile Aztec Noir contracts using nargo and postprocess them to generate transpiled artifacts and verification keys. All options are forwarded to nargo compile.',
+    )
+    .addHelpText('after', () => {
+      // Show nargo's own compile options so users see all available flags in one place.
+      const nargo = process.env.NARGO ?? 'nargo';
+      try {
+        const output = execFileSync(nargo, ['compile', '--help'], { encoding: 'utf-8' });
+        return `\nUnderlying nargo compile options:\n\n${output}`;
+      } catch {
+        return '\n(Run "nargo compile --help" to see available nargo options)';
+      }
+    })
+    .action((nargoArgs: string[]) => compileAztecContract(nargoArgs, log));
+
+  return program;
+}

package/src/cli/cmds/migrate_ha_db.ts

@@ -0,0 +1,43 @@
+import { runMigrations } from '@aztec/validator-ha-signer/migrations';
+
+import type { Command } from 'commander';
+
+export function injectMigrateCommand(program: Command, log: (msg: string) => void): Command {
+  const migrateCommand = program.command('migrate-ha-db').description('Run validator-ha-signer database migrations');
+
+  migrateCommand
+    .command('up')
+    .description('Apply pending migrations')
+    .requiredOption('--database-url <string>', 'PostgreSQL connection string', process.env.DATABASE_URL)
+    .option('--verbose', 'Enable verbose output', false)
+    .action(async options => {
+      const migrations = await runMigrations(options.databaseUrl, {
+        direction: 'up',
+        verbose: options.verbose,
+      });
+      if (migrations.length > 0) {
+        log(`Applied migrations: ${migrations.join(', ')}`);
+      } else {
+        log('No migrations to apply - schema is up to date');
+      }
+    });
+
+  migrateCommand
+    .command('down')
+    .description('Rollback the last migration')
+    .requiredOption('--database-url <string>', 'PostgreSQL connection string', process.env.DATABASE_URL)
+    .option('--verbose', 'Enable verbose output', false)
+    .action(async options => {
+      const migrations = await runMigrations(options.databaseUrl, {
+        direction: 'down',
+        verbose: options.verbose,
+      });
+      if (migrations.length > 0) {
+        log(`Rolled back migrations: ${migrations.join(', ')}`);
+      } else {
+        log('No migrations to rollback');
+      }
+    });
+
+  return program;
+}

package/src/cli/cmds/profile.ts

@@ -0,0 +1,25 @@
+import type { LogFn } from '@aztec/foundation/log';
+
+import type { Command } from 'commander';
+
+import { profileFlamegraph } from './profile_flamegraph.js';
+import { profileGates } from './profile_gates.js';
+
+export function injectProfileCommand(program: Command, log: LogFn): Command {
+  const profile = program.command('profile').description('Profile compiled Aztec artifacts.');
+
+  profile
+    .command('gates')
+    .argument('[target-dir]', 'Path to the compiled artifacts directory', './target')
+    .description('Display gate counts for all compiled Aztec artifacts in a target directory.')
+    .action((targetDir: string) => profileGates(targetDir, log));
+
+  profile
+    .command('flamegraph')
+    .argument('<contract-artifact>', 'Path to the compiled contract artifact JSON')
+    .argument('<function>', 'Name of the contract function to profile')
+    .description('Generate a gate count flamegraph SVG for a contract function.')
+    .action((artifactPath: string, functionName: string) => profileFlamegraph(artifactPath, functionName, log));
+
+  return program;
+}

package/src/cli/cmds/profile_flamegraph.ts

@@ -0,0 +1,63 @@
+import type { LogFn } from '@aztec/foundation/log';
+
+import { readFile, rename, rm, writeFile } from 'fs/promises';
+import { basename, dirname, join } from 'path';
+
+import { makeFunctionArtifact } from './profile_utils.js';
+import type { CompiledArtifact } from './utils/artifacts.js';
+import { run } from './utils/spawn.js';
+
+/** Generates a gate count flamegraph SVG for a single contract function. */
+export async function profileFlamegraph(artifactPath: string, functionName: string, log: LogFn): Promise<void> {
+  const raw = await readFile(artifactPath, 'utf-8');
+  const artifact: CompiledArtifact = JSON.parse(raw);
+
+  if (!Array.isArray(artifact.functions)) {
+    throw new Error(`${artifactPath} does not appear to be a contract artifact (no functions array)`);
+  }
+
+  const func = artifact.functions.find(f => f.name === functionName);
+  if (!func) {
+    const available = artifact.functions.map(f => f.name).join(', ');
+    throw new Error(`Function "${functionName}" not found in artifact. Available: ${available}`);
+  }
+  if (func.is_unconstrained) {
+    throw new Error(`Function "${functionName}" is unconstrained and cannot be profiled`);
+  }
+
+  const outputDir = dirname(artifactPath);
+  const contractName = basename(artifactPath, '.json');
+  const functionArtifact = join(outputDir, `${contractName}-${functionName}.json`);
+
+  try {
+    await writeFile(functionArtifact, makeFunctionArtifact(artifact, func));
+
+    const profiler = process.env.PROFILER_PATH ?? 'noir-profiler';
+    const bb = process.env.BB ?? 'bb';
+
+    await run(profiler, [
+      'gates',
+      '--artifact-path',
+      functionArtifact,
+      '--backend-path',
+      bb,
+      '--backend-gates-command',
+      'gates',
+      '--output',
+      outputDir,
+      '--scheme',
+      'chonk',
+      '--include_gates_per_opcode',
+    ]);
+
+    // noir-profiler names the SVG using the internal function name which
+    // retains the __aztec_nr_internals__ prefix in the bytecode metadata.
+    const srcSvg = join(outputDir, `__aztec_nr_internals__${functionName}_gates.svg`);
+    const destSvg = join(outputDir, `${contractName}-${functionName}-flamegraph.svg`);
+    await rename(srcSvg, destSvg);
+
+    log(`Flamegraph written to ${destSvg}`);
+  } finally {
+    await rm(functionArtifact, { force: true });
+  }
+}