@aztec/aztec 0.0.1-commit.c31f2472 → 0.0.1-commit.c52d6e7

package/src/cli/admin_api_key_store.ts

@@ -0,0 +1,128 @@
+import { randomBytes } from '@aztec/foundation/crypto/random';
+import { sha256Hash } from '@aztec/foundation/json-rpc/server';
+import type { Logger } from '@aztec/foundation/log';
+
+import { promises as fs } from 'fs';
+import { join } from 'path';
+
+/** Subdirectory under dataDirectory for admin API key storage. */
+const ADMIN_STORE_DIR = 'admin';
+const HASH_FILE_NAME = 'api_key_hash';
+
+/**
+ * Result of resolving the admin API key.
+ * Contains the SHA-256 hex hash of the API key to be used by the auth middleware,
+ * and optionally the raw key when newly generated (so the caller can display it).
+ */
+export interface AdminApiKeyResolution {
+  /** The SHA-256 hash of the API key. */
+  apiKeyHash: Buffer;
+  /**
+   * The raw API key, only present when a new key was generated during this call.
+   * The caller MUST display this to the operator — it will not be stored or returned again.
+   */
+  rawKey?: string;
+}
+
+export interface ResolveAdminApiKeyOptions {
+  /** SHA-256 hex hash of a pre-generated API key. When set, the node uses this hash directly. */
+  adminApiKeyHash?: string;
+  /** If true, disable admin API key auth entirely. */
+  disableAdminApiKey?: boolean;
+  /** If true, force-generate a new key even if one is already persisted. */
+  resetAdminApiKey?: boolean;
+  /** Root data directory for persistent storage. */
+  dataDirectory?: string;
+}
+
+/**
+ * Resolves the admin API key for the admin RPC endpoint.
+ *
+ * Strategy:
+ * 1. If opt-out flag is set (`disableAdminApiKey`), return undefined (no auth).
+ * 2. If a pre-generated hash is provided (`adminApiKeyHash`), use it directly.
+ * 3. If a data directory exists, look for a persisted hash file
+ *    at `<dataDirectory>/admin/api_key_hash`:
+ *    - If `resetAdminApiKey` is set, skip loading and force-generate a new key.
+ *    - Found: use the stored hash (operator already saved the key from first run).
+ *    - Not found: auto-generate a random key, display it once, persist the hash.
+ * 3. If no data directory: generate a random key
+ *    each run and display it (cannot persist).
+ *
+ * @param options - The options for resolving the admin API key.
+ * @param log - Logger for outputting the key and status messages.
+ * @returns The resolved API key hash, or undefined if auth is disabled.
+ */
+export async function resolveAdminApiKey(
+  options: ResolveAdminApiKeyOptions,
+  log: Logger,
+): Promise<AdminApiKeyResolution | undefined> {
+  // Operator explicitly opted out of admin auth
+  if (options.disableAdminApiKey) {
+    log.warn('Admin API key authentication is DISABLED (--disable-admin-api-key / AZTEC_DISABLE_ADMIN_API_KEY)');
+    return undefined;
+  }
+
+  // Operator provided a pre-generated hash (e.g. via AZTEC_ADMIN_API_KEY_HASH env var)
+  if (options.adminApiKeyHash) {
+    const hex = options.adminApiKeyHash.trim();
+    if (hex.length !== 64 || !/^[0-9a-f]{64}$/.test(hex)) {
+      throw new Error(`Invalid admin API key hash: expected 64-char hex string, got "${hex}"`);
+    }
+    log.info('Admin API key authentication enabled (using pre-configured key hash)');
+    return { apiKeyHash: Buffer.from(hex, 'hex') };
+  }
+
+  // Persistent storage available, load or generate key
+  if (options.dataDirectory) {
+    const adminDir = join(options.dataDirectory, ADMIN_STORE_DIR);
+    const hashFilePath = join(adminDir, HASH_FILE_NAME);
+
+    // Unless a reset is forced, try to load the existing hash from disk
+    if (!options.resetAdminApiKey) {
+      try {
+        const storedHash = (await fs.readFile(hashFilePath, 'utf-8')).trim();
+        if (storedHash.length === 64) {
+          log.info('Admin API key authentication enabled (loaded stored key hash from disk)');
+          return { apiKeyHash: Buffer.from(storedHash, 'hex') };
+        }
+        log.warn(`Invalid stored admin API key hash at ${hashFilePath}, regenerating...`);
+      } catch (err: any) {
+        if (err.code !== 'ENOENT') {
+          log.warn(`Failed to read admin API key hash from ${hashFilePath}: ${err.message}`);
+        }
+        // File doesn't exist — fall through to generate
+      }
+    } else {
+      log.warn('Admin API key reset requested — generating a new key');
+    }
+
+    // Generate a new key, persist the hash, and return the raw key for the caller to display
+    const { rawKey, hash } = generateApiKey();
+    await fs.mkdir(adminDir, { recursive: true });
+    await fs.writeFile(hashFilePath, hash.toString('hex'), 'utf-8');
+    // Set restrictive permissions (owner read/write only)
+    await fs.chmod(hashFilePath, 0o600);
+
+    log.info('Admin API key authentication enabled (new key generated and hash persisted to disk)');
+    return { apiKeyHash: hash, rawKey };
+  }
+
+  // No data directory, generate a temporary key per session
+  const { rawKey, hash } = generateApiKey();
+
+  log.warn('No data directory configured — admin API key cannot be persisted.');
+  log.warn('A temporary key has been generated for this session only.');
+
+  return { apiKeyHash: hash, rawKey };
+}
+
+/**
+ * Generates a cryptographically random API key and its SHA-256 hash.
+ * @returns The raw key (hex string) and its SHA-256 hash as a Buffer.
+ */
+function generateApiKey(): { rawKey: string; hash: Buffer } {
+  const rawKey = randomBytes(32).toString('hex');
+  const hash = sha256Hash(rawKey);
+  return { rawKey, hash };
+}

package/src/cli/aztec_start_action.ts

@@ -1,17 +1,20 @@
+import { registerAztecNodeRpcHandlers } from '@aztec/aztec-node';
+import { getActiveNetworkName } from '@aztec/foundation/config';
 import {
   type NamespacedApiHandlers,
   createNamespacedSafeJsonRpcServer,
+  getApiKeyAuthMiddleware,
   startHttpRpcServer,
 } from '@aztec/foundation/json-rpc/server';
 import type { LogFn, Logger } from '@aztec/foundation/log';
 import type { ChainConfig } from '@aztec/stdlib/config';
-import { AztecNodeApiSchema } from '@aztec/stdlib/interfaces/client';
+import { getPackageVersion } from '@aztec/stdlib/update-checker';
 import { getVersioningMiddleware } from '@aztec/stdlib/versioning';
-import { getOtelJsonRpcPropagationMiddleware } from '@aztec/telemetry-client';
+import { getOtelJsonRpcDiagnosticsMiddleware, getOtelJsonRpcPropagationMiddleware } from '@aztec/telemetry-client';
 
 import { createLocalNetwork } from '../local-network/index.js';
 import { github, splash } from '../splash.js';
-import { getCliVersion } from './release_version.js';
+import { resolveAdminApiKey } from './admin_api_key_store.js';
 import { extractNamespacedOptions, installSignalHandlers } from './util.js';
 import { getVersions } from './versioning.js';
 
@@ -20,46 +23,39 @@ export async function aztecStart(options: any, userLog: LogFn, debugLogger: Logg
   const signalHandlers: Array<() => Promise<void>> = [];
   const services: NamespacedApiHandlers = {};
   const adminServices: NamespacedApiHandlers = {};
+  const packageVersion = getPackageVersion();
   let config: ChainConfig | undefined = undefined;
 
   if (options.localNetwork) {
-    const cliVersion = getCliVersion();
-    const localNetwork = extractNamespacedOptions(options, 'local-network');
-    localNetwork.testAccounts = true;
+    const localNetwork = extractNamespacedOptions(options, 'localNetwork');
     userLog(`${splash}\n${github}\n\n`);
-    userLog(`Setting up Aztec local network ${cliVersion}, please stand by...`);
+    userLog(`Setting up Aztec local network ${packageVersion}, please stand by...`);
 
     const { node, stop } = await createLocalNetwork(
       {
         l1Mnemonic: localNetwork.l1Mnemonic,
         l1RpcUrls: options.l1RpcUrls,
         testAccounts: localNetwork.testAccounts,
-        realProofs: false,
-        // Setting the epoch duration to 4 by default for local network. This allows the epoch to be "proven" faster, so
-        // the users can consume out hash without having to wait for a long time.
-        // Note: We are not proving anything in the local network (realProofs == false). But in `createLocalNetwork`,
-        // the EpochTestSettler will set the out hash to the outbox when an epoch is complete.
-        aztecEpochDuration: 4,
       },
       userLog,
     );
 
     // Start Node and PXE JSON-RPC server
     signalHandlers.push(stop);
-    services.node = [node, AztecNodeApiSchema];
+    registerAztecNodeRpcHandlers(node, services, adminServices, { debug: true });
   } else {
+    // Route --prover-node through startNode
+    if (options.proverNode && !options.node) {
+      options.node = true;
+    }
+
     if (options.node) {
       const { startNode } = await import('./cmds/start_node.js');
-      ({ config } = await startNode(options, signalHandlers, services, adminServices, userLog));
+      const networkName = getActiveNetworkName(options.network);
+      ({ config } = await startNode(options, signalHandlers, services, adminServices, userLog, networkName));
     } else if (options.bot) {
       const { startBot } = await import('./cmds/start_bot.js');
       await startBot(options, signalHandlers, services, userLog);
-    } else if (options.proverNode) {
-      const { startProverNode } = await import('./cmds/start_prover_node.js');
-      ({ config } = await startProverNode(options, signalHandlers, services, userLog));
-    } else if (options.archiver) {
-      const { startArchiver } = await import('./cmds/start_archiver.js');
-      ({ config } = await startArchiver(options, signalHandlers, services));
     } else if (options.p2pBootstrap) {
       const { startP2PBootstrap } = await import('./cmds/start_p2p_bootstrap.js');
       ({ config } = await startP2PBootstrap(options, signalHandlers, services, userLog));
@@ -71,7 +67,7 @@ export async function aztecStart(options: any, userLog: LogFn, debugLogger: Logg
       await startProverBroker(options, signalHandlers, services, userLog);
     } else if (options.txe) {
       const { startTXE } = await import('./cmds/start_txe.js');
-      await startTXE(options, debugLogger);
+      await startTXE(options, signalHandlers, debugLogger);
     } else if (options.sequencer) {
       userLog(`Cannot run a standalone sequencer without a node`);
       process.exit(1);
@@ -83,13 +79,21 @@ export async function aztecStart(options: any, userLog: LogFn, debugLogger: Logg
 
   installSignalHandlers(debugLogger.info, signalHandlers);
   const versions = getVersions(config);
+  const versioningOpts = { packageVersion };
 
   // Start the main JSON-RPC server
   if (Object.entries(services).length > 0) {
+    if (services.aztec) {
+      const { BarretenbergSync } = await import('@aztec/bb.js');
+      // JSON-RPC schema parsing may decompress compressed Chonk proofs before the node handler runs.
+      await BarretenbergSync.initSingleton();
+    }
+
     const rpcServer = createNamespacedSafeJsonRpcServer(services, {
+      diagnostic: getOtelJsonRpcDiagnosticsMiddleware(),
       http200OnError: false,
       log: debugLogger,
-      middlewares: [getOtelJsonRpcPropagationMiddleware(), getVersioningMiddleware(versions)],
+      middlewares: [getOtelJsonRpcPropagationMiddleware(), getVersioningMiddleware(versions, versioningOpts)],
       maxBatchSize: options.rpcMaxBatchSize,
       maxBodySizeBytes: options.rpcMaxBodySize,
     });
@@ -99,14 +103,55 @@ export async function aztecStart(options: any, userLog: LogFn, debugLogger: Logg
 
   // If there are any admin services, start a separate JSON-RPC server for them
   if (Object.entries(adminServices).length > 0) {
+    const adminMiddlewares = [getOtelJsonRpcPropagationMiddleware(), getVersioningMiddleware(versions, versioningOpts)];
+
+    // Resolve the admin API key (auto-generated and persisted, or opt-out)
+    const apiKeyResolution = await resolveAdminApiKey(
+      {
+        adminApiKeyHash: options.adminApiKeyHash,
+        disableAdminApiKey: options.disableAdminApiKey,
+        resetAdminApiKey: options.resetAdminApiKey,
+        dataDirectory: options.dataDirectory,
+      },
+      debugLogger,
+    );
+    if (apiKeyResolution) {
+      adminMiddlewares.unshift(getApiKeyAuthMiddleware(apiKeyResolution.apiKeyHash));
+    } else {
+      debugLogger.warn('No admin API key set — admin endpoint is unauthenticated');
+    }
+
     const rpcServer = createNamespacedSafeJsonRpcServer(adminServices, {
+      diagnostic: getOtelJsonRpcDiagnosticsMiddleware(),
       http200OnError: false,
       log: debugLogger,
-      middlewares: [getOtelJsonRpcPropagationMiddleware(), getVersioningMiddleware(versions)],
+      middlewares: adminMiddlewares,
       maxBatchSize: options.rpcMaxBatchSize,
       maxBodySizeBytes: options.rpcMaxBodySize,
     });
     const { port } = await startHttpRpcServer(rpcServer, { port: options.adminPort });
     debugLogger.info(`Aztec Server admin API listening on port ${port}`, versions);
+
+    // Display the API key after the server has started
+    // Uses userLog which is never filtered by LOG_LEVEL.
+    if (apiKeyResolution?.rawKey) {
+      const separator = '='.repeat(70);
+      userLog('');
+      userLog(separator);
+      userLog('  ADMIN API KEY (save this — it will NOT be shown again)');
+      userLog('');
+      userLog(`  ${apiKeyResolution.rawKey}`);
+      userLog('');
+      userLog(`  Use via header:  x-api-key: <key>`);
+      userLog(`  Or via header:   Authorization: Bearer <key>`);
+      if (options.dataDirectory) {
+        userLog('');
+        userLog('  The key hash has been persisted — on next restart, the same key will be used.');
+      }
+      userLog('');
+      userLog('  To disable admin auth: --disable-admin-api-key or AZTEC_DISABLE_ADMIN_API_KEY=true');
+      userLog(separator);
+      userLog('');
+    }
   }
 }

package/src/cli/aztec_start_options.ts

@@ -12,7 +12,6 @@ import {
   isBooleanConfigValue,
   omitConfigMappings,
 } from '@aztec/foundation/config';
-import { dataConfigMappings } from '@aztec/kv-store/config';
 import { sharedNodeConfigMappings } from '@aztec/node-lib/config';
 import { bootnodeConfigMappings, p2pConfigMappings } from '@aztec/p2p/config';
 import { proverAgentConfigMappings, proverBrokerConfigMappings } from '@aztec/prover-client/broker/config';
@@ -20,6 +19,7 @@ import { proverNodeConfigMappings } from '@aztec/prover-node/config';
 import { allPxeConfigMappings } from '@aztec/pxe/config';
 import { sequencerClientConfigMappings } from '@aztec/sequencer-client/config';
 import { chainConfigMappings, nodeRpcConfigMappings } from '@aztec/stdlib/config';
+import { dataConfigMappings } from '@aztec/stdlib/kv-store';
 import { telemetryClientConfigMappings } from '@aztec/telemetry-client/config';
 import { worldStateConfigMappings } from '@aztec/world-state/config';
 
@@ -36,7 +36,7 @@ export interface AztecStartOption {
   parseVal?: (val: string) => any;
 }
 
-export const getOptions = (namespace: string, configMappings: Record<string, ConfigMapping>) => {
+export const getOptions = (namespace: string, configMappings: Record<string, ConfigMapping<unknown>>) => {
   const options: AztecStartOption[] = [];
   for (const [key, { env, defaultValue: def, parseEnv, description, printDefault, fallback }] of Object.entries(
     configMappings,
@@ -58,7 +58,11 @@ export const getOptions = (namespace: string, configMappings: Record<string, Con
   return options;
 };
 
-const configToFlag = (flag: string, configMapping: ConfigMapping, overrideDefaultValue?: any): AztecStartOption => {
+const configToFlag = (
+  flag: string,
+  configMapping: ConfigMapping<unknown>,
+  overrideDefaultValue?: any,
+): AztecStartOption => {
   if (!configMapping.isBoolean) {
     flag += ' <value>';
   }
@@ -105,8 +109,7 @@ export const aztecStartOptions: { [key: string]: AztecStartOption[] } = {
       env: 'NETWORK',
     },
 
-    configToFlag('--auto-update', sharedNodeConfigMappings.autoUpdate),
-    configToFlag('--auto-update-url', sharedNodeConfigMappings.autoUpdateUrl),
+    configToFlag('--enable-auto-shutdown', sharedNodeConfigMappings.enableAutoShutdown),
 
     configToFlag('--sync-mode', sharedNodeConfigMappings.syncMode),
     configToFlag('--snapshots-urls', sharedNodeConfigMappings.snapshotsUrls),
@@ -126,6 +129,12 @@ export const aztecStartOptions: { [key: string]: AztecStartOption[] } = {
       defaultValue: DefaultMnemonic,
       env: 'MNEMONIC',
     },
+    {
+      flag: '--local-network.testAccounts',
+      description: 'Deploy test accounts on local network start',
+      env: 'TEST_ACCOUNTS',
+      ...booleanConfigHelper(true),
+    },
   ],
   API: [
     {
@@ -142,6 +151,37 @@ export const aztecStartOptions: { [key: string]: AztecStartOption[] } = {
       env: 'AZTEC_ADMIN_PORT',
       parseVal: val => parseInt(val, 10),
     },
+    {
+      flag: '--admin-api-key-hash <value>',
+      description:
+        'SHA-256 hex hash of a pre-generated admin API key. When set, the node uses this hash for authentication instead of auto-generating a key.',
+      defaultValue: undefined,
+      env: 'AZTEC_ADMIN_API_KEY_HASH',
+    },
+    {
+      flag: '--disable-admin-api-key',
+      description:
+        'Disable API key authentication on the admin RPC endpoint. By default, a key is auto-generated, displayed once, and its hash is persisted.',
+      defaultValue: false,
+      env: 'AZTEC_DISABLE_ADMIN_API_KEY',
+      // undefined means the flag was passed without a value (boolean toggle), treat as true.
+      parseVal: val => val === undefined || val === 'true' || val === '1',
+    },
+    {
+      flag: '--reset-admin-api-key',
+      description:
+        'Force-generate a new admin API key, replacing any previously persisted key hash. The new key is displayed once at startup.',
+      defaultValue: false,
+      env: 'AZTEC_RESET_ADMIN_API_KEY',
+      parseVal: val => val === 'true' || val === '1',
+    },
+    {
+      flag: '--node-debug',
+      description: 'Expose debug endpoints (e.g. mineBlock) on the main RPC port',
+      defaultValue: false,
+      env: 'AZTEC_NODE_DEBUG',
+      parseVal: val => val === undefined || val === 'true' || val === '1',
+    },
     {
       flag: '--api-prefix <value>',
       description: 'Prefix for API routes on any service that is started',
@@ -170,7 +210,7 @@ export const aztecStartOptions: { [key: string]: AztecStartOption[] } = {
   'WORLD STATE': [
     configToFlag('--world-state-data-directory', worldStateConfigMappings.worldStateDataDirectory),
     configToFlag('--world-state-db-map-size-kb', worldStateConfigMappings.worldStateDbMapSizeKb),
-    configToFlag('--world-state-block-history', worldStateConfigMappings.worldStateBlockHistory),
+    configToFlag('--world-state-checkpoint-history', worldStateConfigMappings.worldStateCheckpointHistory),
   ],
   // We can't easily auto-generate node options as they're parts of modules defined below
   'AZTEC NODE': [
@@ -182,12 +222,6 @@ export const aztecStartOptions: { [key: string]: AztecStartOption[] } = {
     },
   ],
   ARCHIVER: [
-    {
-      flag: '--archiver',
-      description: 'Starts Aztec Archiver with options',
-      defaultValue: undefined,
-      env: undefined,
-    },
     ...getOptions(
       'archiver',
       omitConfigMappings(archiverConfigMappings, Object.keys(l1ContractsConfigMappings) as (keyof ArchiverConfig)[]),
@@ -222,12 +256,8 @@ export const aztecStartOptions: { [key: string]: AztecStartOption[] } = {
       'proverNode',
       omitConfigMappings(proverNodeConfigMappings, [
         // filter out options passed separately
-        ...getKeys(archiverConfigMappings),
         ...getKeys(proverBrokerConfigMappings),
         ...getKeys(proverAgentConfigMappings),
-        ...getKeys(p2pConfigMappings),
-        ...getKeys(worldStateConfigMappings),
-        ...getKeys(sharedNodeConfigMappings),
       ]),
     ),
   ],
@@ -238,11 +268,7 @@ export const aztecStartOptions: { [key: string]: AztecStartOption[] } = {
       defaultValue: undefined,
       env: undefined,
     },
-    ...getOptions(
-      'proverBroker',
-      // filter out archiver options from prover node options as they're passed separately in --archiver
-      proverBrokerConfigMappings,
-    ),
+    ...getOptions('proverBroker', proverBrokerConfigMappings),
   ],
   'PROVER AGENT': [
     {
@@ -290,15 +316,7 @@ export const aztecStartOptions: { [key: string]: AztecStartOption[] } = {
     },
     ...getOptions('bot', botConfigMappings),
   ],
-  PXE: [
-    {
-      flag: '--pxe',
-      description: 'Starts Aztec PXE with options',
-      defaultValue: undefined,
-      env: undefined,
-    },
-    ...getOptions('pxe', allPxeConfigMappings),
-  ],
+  PXE: [...getOptions('pxe', allPxeConfigMappings)],
   TXE: [
     {
       flag: '--txe',

package/src/cli/cli.ts

@@ -37,10 +37,9 @@ export function injectAztecCommands(program: Command, userLog: LogFn, debugLogge
       `
 Additional commands:
 
-  init [folder] [options]  creates a new Aztec Noir project.
-  new <path> [options]     creates a new Aztec Noir project in a new directory.
-  compile [options]        compiles Aztec Noir contracts.
-  test [options]           starts a TXE and runs "nargo test" using it as the oracle resolver.
+  init               creates a new Aztec Noir workspace in the current directory.
+  new <name>         creates a new Aztec Noir workspace in its own directory (or creates a new contract-test crates pair and adds it to the current workspace if run in workspace).
+  test [options]     starts a TXE and runs "nargo test" using it as the oracle resolver.
     `,
     );
   }

package/src/cli/cmds/compile.ts

@@ -0,0 +1,205 @@
+import { findBbBinary } from '@aztec/bb.js';
+import type { LogFn } from '@aztec/foundation/log';
+import { getPackageVersion } from '@aztec/stdlib/update-checker';
+
+import { execFileSync } from 'child_process';
+import type { Command } from 'commander';
+import { readFile, writeFile } from 'fs/promises';
+import { join } from 'path';
+
+import { readArtifactFiles } from './utils/artifacts.js';
+import { needsRecompile } from './utils/needs_recompile.js';
+import { run } from './utils/spawn.js';
+import { warnIfAztecVersionMismatch } from './utils/warn_if_aztec_version_mismatch.js';
+
+/** Returns contract artifacts in the target directory along with whether each has already been postprocessed. */
+async function collectContractArtifacts(): Promise<ContractArtifactInfo[]> {
+  let files;
+  try {
+    files = await readArtifactFiles('target');
+  } catch (err: any) {
+    if (err?.message?.includes('does not exist')) {
+      return [];
+    }
+    throw err;
+  }
+  return files
+    .filter(f => Array.isArray(f.content.functions))
+    .map(f => ({ filePath: f.filePath, transpiled: f.content.transpiled === true }));
+}
+
+/** Stamps the Aztec stack version into the contract artifacts. */
+async function stampAztecVersion(artifactPaths: string[]): Promise<void> {
+  const version = getPackageVersion();
+  for (const path of artifactPaths) {
+    const artifact = JSON.parse(await readFile(path, 'utf-8'));
+    // eslint-disable-next-line camelcase
+    artifact.aztec_version = version;
+    await writeFile(path, JSON.stringify(artifact, null, 2) + '\n');
+  }
+}
+
+/** Returns the set of package names that are contract crates in the current workspace. */
+async function getContractPackageNames(): Promise<Set<string>> {
+  const contractNames = new Set<string>();
+
+  let rootToml: string;
+  try {
+    rootToml = await readFile('Nargo.toml', 'utf-8');
+  } catch {
+    return contractNames;
+  }
+
+  const membersMatch = rootToml.match(/members\s*=\s*\[([^\]]*)\]/);
+  if (membersMatch) {
+    const members = membersMatch[1]
+      .split(',')
+      .map(m => m.trim().replace(/^"|"$/g, ''))
+      .filter(m => m.length > 0);
+
+    for (const member of members) {
+      try {
+        const memberToml = await readFile(join(member, 'Nargo.toml'), 'utf-8');
+        if (/type\s*=\s*"contract"/.test(memberToml)) {
+          const nameMatch = memberToml.match(/name\s*=\s*"([^"]+)"/);
+          if (nameMatch) {
+            contractNames.add(nameMatch[1]);
+          }
+        }
+      } catch {
+        // Member directory might not exist or have no Nargo.toml; skip.
+      }
+    }
+  } else {
+    // Single-crate project (no workspace): check if the root Nargo.toml itself is a contract.
+    if (/type\s*=\s*"contract"/.test(rootToml)) {
+      const nameMatch = rootToml.match(/name\s*=\s*"([^"]+)"/);
+      if (nameMatch) {
+        contractNames.add(nameMatch[1]);
+      }
+    }
+  }
+
+  return contractNames;
+}
+
+/** Checks that no tests exist in contract crates and fails with a helpful message if they do. */
+async function checkNoTestsInContracts(nargo: string, log: LogFn): Promise<void> {
+  const contractPackages = await getContractPackageNames();
+  if (contractPackages.size === 0) {
+    return;
+  }
+
+  let output: string;
+  try {
+    // We list tests for all the crates in the workspace
+    output = execFileSync(nargo, ['test', '--list-tests', '--silence-warnings'], {
+      encoding: 'utf-8',
+      stdio: ['pipe', 'pipe', 'inherit'],
+    });
+  } catch {
+    // If listing tests fails (e.g. test crate has compile errors), skip the check.
+    return;
+  }
+
+  // The output of the `nargo test --list-tests` command is as follows:
+  // ```
+  // crate_name_1 test_name_1
+  // crate_name_2 test_name_2
+  // ...
+  // crate_name_n test_name_n
+  // ```
+  //
+  // We parse the individual lines and then we check if any contract crate appeared in the parsed output.
+  const lines = output
+    .trim()
+    .split('\n')
+    .filter(line => line.length > 0);
+  const testsInContracts: { packageName: string; testName: string }[] = [];
+
+  for (const line of lines) {
+    const spaceIndex = line.indexOf(' ');
+    if (spaceIndex === -1) {
+      continue;
+    }
+    const packageName = line.substring(0, spaceIndex);
+    const testName = line.substring(spaceIndex + 1);
+    if (contractPackages.has(packageName)) {
+      testsInContracts.push({ packageName, testName });
+    }
+  }
+
+  if (testsInContracts.length > 0) {
+    const details = testsInContracts.map(t => `  ${t.packageName}::${t.testName}`).join('\n');
+    log(
+      `WARNING: Found tests in contract crate(s):\n${details}\n\n` +
+        `Tests should be in a dedicated test crate, not in the contract crate.\n` +
+        `Learn more: https://docs.aztec.network/errors/1`,
+    );
+  }
+}
+
+/** Compiles Aztec Noir contracts and postprocesses artifacts. */
+async function compileAztecContract(nargoArgs: string[], log: LogFn): Promise<void> {
+  await warnIfAztecVersionMismatch(log);
+
+  const nargo = process.env.NARGO ?? 'nargo';
+  const bb = process.env.BB ?? findBbBinary() ?? 'bb';
+
+  const shouldRecompile = await needsRecompile();
+  if (shouldRecompile) {
+    await run(nargo, ['compile', ...nargoArgs]);
+
+    // Ensure contract crates contain no tests (tests belong in the test crate).
+    await checkNoTestsInContracts(nargo, log);
+  }
+
+  // Postprocess any untranspiled artifacts: those just produced by nargo above, and any left behind by a bare
+  // `nargo compile` run outside `aztec compile`.
+  const unprocessed = (await collectContractArtifacts()).filter(a => !a.transpiled).map(a => a.filePath);
+
+  if (unprocessed.length > 0) {
+    log('Postprocessing contracts...');
+    const bbArgs = unprocessed.flatMap(a => ['-i', a]);
+    await run(bb, ['aztec_process', ...bbArgs]);
+
+    await stampAztecVersion(unprocessed);
+  }
+
+  if (shouldRecompile || unprocessed.length > 0) {
+    log('Compilation complete!');
+  } else {
+    log('No source changes detected, skipping compilation.');
+  }
+}
+
+export function injectCompileCommand(program: Command, log: LogFn): Command {
+  program
+    .command('compile')
+    .argument('[nargo-args...]')
+    .passThroughOptions()
+    .allowUnknownOption()
+    .description(
+      'Compile Aztec Noir contracts using nargo and postprocess them to generate transpiled artifacts and verification keys. All options are forwarded to nargo compile.',
+    )
+    .addHelpText('after', () => {
+      // Show nargo's own compile options so users see all available flags in one place.
+      const nargo = process.env.NARGO ?? 'nargo';
+      try {
+        const output = execFileSync(nargo, ['compile', '--help'], { encoding: 'utf-8' });
+        return `\nUnderlying nargo compile options:\n\n${output}`;
+      } catch {
+        return '\n(Run "nargo compile --help" to see available nargo options)';
+      }
+    })
+    .action((nargoArgs: string[]) => compileAztecContract(nargoArgs, log));
+
+  return program;
+}
+
+interface ContractArtifactInfo {
+  /** Path to the artifact JSON in the target directory. */
+  filePath: string;
+  /** Whether the artifact has already been transpiled and had its verification keys generated. */
+  transpiled: boolean;
+}