@aztec/aztec 0.0.1-commit.db765a8 → 0.0.1-commit.ddcf04837

package/src/cli/cmds/start_node.ts

@@ -1,18 +1,19 @@
-import { getInitialTestAccountsData } from '@aztec/accounts/testing';
 import { type AztecNodeConfig, aztecNodeConfigMappings, getConfigEnvVars } from '@aztec/aztec-node';
 import { Fr } from '@aztec/aztec.js/fields';
-import { getSponsoredFPCAddress } from '@aztec/cli/cli-utils';
 import { getL1Config } from '@aztec/cli/config';
 import { getPublicClient } from '@aztec/ethereum/client';
-import { RegistryContract, RollupContract } from '@aztec/ethereum/contracts';
-import { SecretValue } from '@aztec/foundation/config';
-import { EthAddress } from '@aztec/foundation/eth-address';
+import { getGenesisStateConfigEnvVars } from '@aztec/ethereum/config';
+import { type NetworkNames, SecretValue } from '@aztec/foundation/config';
 import type { NamespacedApiHandlers } from '@aztec/foundation/json-rpc/server';
-import { startHttpRpcServer } from '@aztec/foundation/json-rpc/server';
 import { Agent, makeUndiciFetch } from '@aztec/foundation/json-rpc/undici';
 import type { LogFn } from '@aztec/foundation/log';
-import { sleep } from '@aztec/foundation/sleep';
-import { ProvingJobConsumerSchema, createProvingJobBrokerClient } from '@aztec/prover-client/broker';
+import { getVKTreeRoot } from '@aztec/noir-protocol-circuits-types/vk-tree';
+import { protocolContractsHash } from '@aztec/protocol-contracts';
+import {
+  ProvingJobConsumerSchema,
+  createProvingJobBrokerClient,
+  proverBrokerBackoff,
+} from '@aztec/prover-client/broker';
 import { type CliPXEOptions, type PXEConfig, allPxeConfigMappings } from '@aztec/pxe/config';
 import { AztecNodeAdminApiSchema, AztecNodeApiSchema } from '@aztec/stdlib/interfaces/client';
 import { P2PApiSchema, ProverNodeApiSchema, type ProvingJobBroker } from '@aztec/stdlib/interfaces/server';
@@ -23,92 +24,25 @@ import {
   telemetryClientConfigMappings,
 } from '@aztec/telemetry-client';
 import { EmbeddedWallet } from '@aztec/wallets/embedded';
-import { getGenesisValues } from '@aztec/world-state/testing';
-
-import Koa from 'koa';
 
 import { createAztecNode } from '../../local-network/index.js';
 import {
   extractNamespacedOptions,
   extractRelevantOptions,
   preloadCrsDataForVerifying,
-  setupUpdateMonitor,
+  setupVersionChecker,
 } from '../util.js';
 import { getVersions } from '../versioning.js';
+import { computeExpectedGenesisRoot, waitForCompatibleRollup } from './standby.js';
 import { startProverBroker } from './start_prover_broker.js';
 
-const ROLLUP_POLL_INTERVAL_MS = 600_000;
-
-/**
- * Waits until the canonical rollup's genesis archive root matches the expected local genesis root.
- * If the rollup is not yet compatible (e.g. during L1 contract upgrades), enters standby mode:
- * starts a lightweight HTTP server for K8s liveness probes and polls until a compatible rollup appears.
- */
-async function waitForCompatibleRollup(
-  publicClient: ReturnType<typeof getPublicClient>,
-  registryAddress: EthAddress,
-  rollupVersion: number | 'canonical',
-  expectedGenesisRoot: Fr,
-  port: number | undefined,
-  userLog: LogFn,
-): Promise<void> {
-  const registry = new RegistryContract(publicClient, registryAddress);
-  const rollupAddress = await registry.getRollupAddress(rollupVersion);
-  const rollup = new RollupContract(publicClient, rollupAddress.toString());
-
-  let l1GenesisRoot: Fr;
-  try {
-    l1GenesisRoot = await rollup.getGenesisArchiveTreeRoot();
-  } catch (err: any) {
-    throw new Error(
-      `Could not retrieve genesis archive root from canonical rollup at ${rollupAddress}: ${err.message}`,
-    );
-  }
-
-  if (l1GenesisRoot.equals(expectedGenesisRoot)) {
-    return;
-  }
-
-  userLog(
-    `Genesis root mismatch: expected ${expectedGenesisRoot}, got ${l1GenesisRoot} from rollup at ${rollupAddress}. ` +
-      `Entering standby mode. Will poll every ${ROLLUP_POLL_INTERVAL_MS / 1000}s for a compatible rollup...`,
-  );
-
-  const standbyServer = await startHttpRpcServer({ getApp: () => new Koa(), isHealthy: () => true }, { port });
-  userLog(`Standby status server listening on port ${standbyServer.port}`);
-
-  try {
-    while (true) {
-      await sleep(ROLLUP_POLL_INTERVAL_MS);
-
-      const currentRollupAddress = await registry.getRollupAddress(rollupVersion);
-      const currentRollup = new RollupContract(publicClient, currentRollupAddress.toString());
-
-      try {
-        l1GenesisRoot = await currentRollup.getGenesisArchiveTreeRoot();
-      } catch {
-        userLog(`Failed to fetch genesis root from rollup at ${currentRollupAddress}. Retrying...`);
-        continue;
-      }
-
-      if (l1GenesisRoot.equals(expectedGenesisRoot)) {
-        userLog(`Compatible rollup found at ${currentRollupAddress}. Exiting standby mode.`);
-        return;
-      }
-
-      userLog(`Still waiting. Rollup at ${currentRollupAddress} has genesis root ${l1GenesisRoot}.`);
-    }
-  } finally {
-    await new Promise<void>((resolve, reject) => standbyServer.close(err => (err ? reject(err) : resolve())));
-  }
-}
-
 export async function startNode(
   options: any,
   signalHandlers: (() => Promise<void>)[],
   services: NamespacedApiHandlers,
   adminServices: NamespacedApiHandlers,
   userLog: LogFn,
+  networkName: NetworkNames,
 ): Promise<{ config: AztecNodeConfig }> {
   // All options set from environment variables
   const configFromEnvVars = getConfigEnvVars();
@@ -135,12 +69,8 @@ export async function startNode(
     if (nodeConfig.proverBrokerUrl) {
       // at 1TPS we'd enqueue ~1k chonk verifier proofs and ~1k AVM proofs immediately
       // set a lower connection limit such that we don't overload the server
-      // Keep retrying up to 30s
-      const fetch = makeTracedFetch(
-        [1, 2, 3, 3, 3, 3, 3, 3, 3, 3, 3],
-        false,
-        makeUndiciFetch(new Agent({ connections: 100 })),
-      );
+      // Retry indefinitely until the epoch proving times out and the chain reorgs
+      const fetch = makeTracedFetch(proverBrokerBackoff, false, makeUndiciFetch(new Agent({ connections: 100 })));
       broker = createProvingJobBrokerClient(nodeConfig.proverBrokerUrl, getVersions(nodeConfig), fetch);
     } else if (options.proverBroker) {
       ({ broker } = await startProverBroker(options, signalHandlers, services, userLog));
@@ -152,15 +82,8 @@ export async function startNode(
 
   await preloadCrsDataForVerifying(nodeConfig, userLog);
 
-  const testAccounts = nodeConfig.testAccounts ? (await getInitialTestAccountsData()).map(a => a.address) : [];
-  const sponsoredFPCAccounts = nodeConfig.sponsoredFPC ? [await getSponsoredFPCAddress()] : [];
-  const initialFundedAccounts = testAccounts.concat(sponsoredFPCAccounts);
-
-  userLog(`Initial funded accounts: ${initialFundedAccounts.map(a => a.toString()).join(', ')}`);
-
-  const { genesisArchiveRoot, prefilledPublicData } = await getGenesisValues(initialFundedAccounts);
-
-  userLog(`Genesis archive root: ${genesisArchiveRoot.toString()}`);
+  const genesisConfig = getGenesisStateConfigEnvVars();
+  const { genesisArchiveRoot, genesis } = await computeExpectedGenesisRoot(genesisConfig, userLog);
 
   const followsCanonicalRollup =
     typeof nodeConfig.rollupVersion !== 'number' || (nodeConfig.rollupVersion as unknown as string) === 'canonical';
@@ -171,13 +94,9 @@ export async function startNode(
 
   // Wait for a compatible rollup before proceeding with full L1 config fetch.
   // This prevents crashes when the canonical rollup hasn't been upgraded yet.
-  const publicClient = getPublicClient(nodeConfig);
-  const rollupVersion: number | 'canonical' = nodeConfig.rollupVersion ?? 'canonical';
   await waitForCompatibleRollup(
-    publicClient,
-    nodeConfig.l1Contracts.registryAddress,
-    rollupVersion,
-    genesisArchiveRoot,
+    nodeConfig,
+    { genesisArchiveRoot, vkTreeRoot: getVKTreeRoot(), protocolContractsHash },
     options.port,
     userLog,
   );
@@ -197,12 +116,10 @@ export async function startNode(
     );
   }
 
-  // TODO(#12272): will clean this up.
   nodeConfig = {
     ...nodeConfig,
     l1Contracts: {
       ...addresses,
-      slashFactoryAddress: nodeConfig.l1Contracts.slashFactoryAddress,
     },
     ...config,
   };
@@ -239,7 +156,7 @@ export async function startNode(
   const telemetry = await initTelemetryClient(telemetryConfig);
 
   // Create and start Aztec Node
-  const node = await createAztecNode(nodeConfig, { telemetry, proverBroker: broker }, { prefilledPublicData });
+  const node = await createAztecNode(nodeConfig, { telemetry, proverBroker: broker }, { genesis });
 
   // Add node and p2p to services list
   services.node = [node, AztecNodeApiSchema];
@@ -268,16 +185,19 @@ export async function startNode(
     await addBot(options, signalHandlers, services, wallet, node, telemetry, undefined);
   }
 
-  if (nodeConfig.autoUpdate !== 'disabled' && nodeConfig.autoUpdateUrl) {
-    await setupUpdateMonitor(
-      nodeConfig.autoUpdate,
-      new URL(nodeConfig.autoUpdateUrl),
-      followsCanonicalRollup,
-      getPublicClient(nodeConfig!),
-      nodeConfig.l1Contracts.registryAddress,
-      signalHandlers,
-      async config => node.setConfig((await AztecNodeAdminApiSchema.setConfig.parameters().parseAsync([config]))[0]),
-    );
+  if (nodeConfig.enableVersionCheck && networkName !== 'local') {
+    const cacheDir = process.env.DATA_DIRECTORY ? `${process.env.DATA_DIRECTORY}/cache` : undefined;
+    try {
+      await setupVersionChecker(
+        networkName,
+        followsCanonicalRollup,
+        getPublicClient(nodeConfig!),
+        signalHandlers,
+        cacheDir,
+      );
+    } catch {
+      /* no-op */
+    }
   }
 
   return { config: nodeConfig };

package/src/cli/cmds/start_prover_agent.ts

@@ -9,6 +9,7 @@ import {
   createProofStore,
   createProvingJobBrokerClient,
   proverAgentConfigMappings,
+  proverBrokerBackoff,
 } from '@aztec/prover-client/broker';
 import { getProverNodeAgentConfigFromEnv } from '@aztec/prover-node';
 import { ProverAgentApiSchema } from '@aztec/stdlib/interfaces/server';
@@ -45,12 +46,8 @@ export async function startProverAgent(
 
   await preloadCrsDataForServerSideProving(config, userLog);
 
-  const fetch = makeTracedFetch(
-    // retry connections every 3s, up to 30s before giving up
-    [1, 2, 3, 3, 3, 3, 3, 3, 3, 3, 3],
-    false,
-    makeUndiciFetch(new Agent({ connections: 10 })),
-  );
+  // Retry indefinitely until the epoch proving times out and the chain reorgs
+  const fetch = makeTracedFetch(proverBrokerBackoff, false, makeUndiciFetch(new Agent({ connections: 10 })));
   const broker = createProvingJobBrokerClient(config.proverBrokerUrl, getVersions(), fetch);
 
   const telemetry = await initTelemetryClient(extractRelevantOptions(options, telemetryClientConfigMappings, 'tel'));

package/src/cli/cmds/start_prover_broker.ts

@@ -1,7 +1,9 @@
 import { getL1Config } from '@aztec/cli/config';
-import { getPublicClient } from '@aztec/ethereum/client';
+import { getGenesisStateConfigEnvVars } from '@aztec/ethereum/config';
 import type { NamespacedApiHandlers } from '@aztec/foundation/json-rpc/server';
 import type { LogFn } from '@aztec/foundation/log';
+import { getVKTreeRoot } from '@aztec/noir-protocol-circuits-types/vk-tree';
+import { protocolContractsHash } from '@aztec/protocol-contracts';
 import {
   type ProverBrokerConfig,
   ProvingJobBrokerSchema,
@@ -13,7 +15,8 @@ import { getProverNodeBrokerConfigFromEnv } from '@aztec/prover-node';
 import type { ProvingJobBroker } from '@aztec/stdlib/interfaces/server';
 import { getConfigEnvVars as getTelemetryClientConfig, initTelemetryClient } from '@aztec/telemetry-client';
 
-import { extractRelevantOptions, setupUpdateMonitor } from '../util.js';
+import { extractRelevantOptions } from '../util.js';
+import { computeExpectedGenesisRoot, waitForCompatibleRollup } from './standby.js';
 
 export async function startProverBroker(
   options: any,
@@ -35,7 +38,15 @@ export async function startProverBroker(
     throw new Error('L1 registry address is required to start Aztec Node without --deploy-aztec-contracts option');
   }
 
-  const followsCanonicalRollup = typeof config.rollupVersion !== 'number';
+  const genesisConfig = getGenesisStateConfigEnvVars();
+  const { genesisArchiveRoot } = await computeExpectedGenesisRoot(genesisConfig, userLog);
+  await waitForCompatibleRollup(
+    config,
+    { genesisArchiveRoot, vkTreeRoot: getVKTreeRoot(), protocolContractsHash },
+    options.port,
+    userLog,
+  );
+
   const { addresses, config: rollupConfig } = await getL1Config(
     config.l1Contracts.registryAddress,
     config.l1RpcUrls,
@@ -49,17 +60,6 @@ export async function startProverBroker(
   const client = await initTelemetryClient(getTelemetryClientConfig());
   const broker = await createAndStartProvingBroker(config, client);
 
-  if (options.autoUpdate !== 'disabled' && options.autoUpdateUrl) {
-    await setupUpdateMonitor(
-      options.autoUpdate,
-      new URL(options.autoUpdateUrl),
-      followsCanonicalRollup,
-      getPublicClient(config),
-      config.l1Contracts.registryAddress,
-      signalHandlers,
-    );
-  }
-
   services.proverBroker = [
     broker,
     config.proverBrokerDebugReplayEnabled ? ProvingJobBrokerSchemaWithDebug : ProvingJobBrokerSchema,

package/src/cli/cmds/utils/collect_crate_dirs.ts

@@ -0,0 +1,118 @@
+import TOML from '@iarna/toml';
+import { existsSync } from 'fs';
+import { mkdir, readFile, stat } from 'fs/promises';
+import { homedir } from 'os';
+import { dirname, join, resolve } from 'path';
+
+import { run } from './spawn.js';
+
+/**
+ * Recursively collects crate directories starting from startCrateDir by following dependencies declared in Nargo.toml
+ * files.
+ *
+ * When `skipGitDeps` is false (default), git-based deps are followed and fetched into the nargo cache
+ * (`$HOME/nargo/<domain>/<repo-path>/<tag>`) if not already present.
+ *
+ * When `skipGitDeps` is true, git-based deps are ignored entirely.
+ */
+export async function collectCrateDirs(startCrateDir: string, opts?: { skipGitDeps?: boolean }): Promise<string[]> {
+  const { skipGitDeps = false } = opts ?? {};
+  const visited = new Set<string>();
+
+  async function visit(crateDir: string): Promise<void> {
+    const absDir = resolve(crateDir);
+    if (visited.has(absDir)) {
+      return;
+    }
+    visited.add(absDir);
+
+    const tomlPath = join(absDir, 'Nargo.toml');
+    const content = await readFile(tomlPath, 'utf-8').catch(() => {
+      throw new Error(`Incorrectly defined dependency. Nargo.toml not found in ${absDir}`);
+    });
+
+    const parsed = TOML.parse(content) as Record<string, any>;
+    const members = (parsed.workspace as Record<string, any>)?.members as string[] | undefined;
+
+    // A Nargo.toml is either a workspace root (has workspace.members) or a single crate (has dependencies).
+    if (Array.isArray(members)) {
+      // The crate is a workspace root and has members defined so we visit the members
+      for (const member of members) {
+        await visit(resolve(absDir, member));
+      }
+    } else {
+      // Single crate — follow its deps
+      const deps = (parsed.dependencies as Record<string, any>) ?? {};
+      for (const dep of Object.values(deps)) {
+        if (!dep || typeof dep !== 'object') {
+          continue;
+        }
+        if (typeof dep.path === 'string') {
+          // Dependency contains "path" hence it's a local dependency. We just check it's a real directory and then we
+          // recursively search through it
+          const depPath = resolve(absDir, dep.path);
+          const s = await stat(depPath);
+          if (!s.isDirectory()) {
+            throw new Error(
+              `Dependency path "${dep.path}" in ${tomlPath} resolves to ${depPath} which is not a directory`,
+            );
+          }
+          await visit(depPath);
+        } else if (!skipGitDeps && typeof dep.git === 'string' && typeof dep.tag === 'string') {
+          // Dependency contains "git" hence it's a git dependency. We ensure it has been fetched and fetch it if
+          // it's not the case and then we recursively search through it.
+          await fetchAndVisit(dep.git, dep.tag, dep.directory);
+        }
+      }
+    }
+  }
+
+  async function fetchAndVisit(gitUrl: string, tag: string, directory?: string): Promise<void> {
+    // `directory` is set when the dep lives in a subdirectory of a repository, e.g.:
+    //   aztec = { git = "https://github.com/AztecProtocol/aztec-packages", tag = "v0.82.0",
+    //             directory = "noir-projects/aztec-nr/aztec" }
+    // In that case nargo clones the whole repo and the crate root is <cachePath>/<directory>.
+    const cachePath = nargoGitDepPath(gitUrl, tag);
+    const crateDir = directory ? join(cachePath, directory) : cachePath;
+    await ensureGitDepCached(gitUrl, tag, cachePath);
+    await visit(crateDir);
+  }
+
+  await visit(startCrateDir);
+  return [...visited];
+}
+
+/**
+ * Computes the local nargo cache path for a git dependency, mirroring nargo's own `git_dep_location` function.
+ * Path format: `$HOME/nargo/<domain>/<repo-path>/<tag>`
+ * e.g. `~/nargo/github.com/AztecProtocol/aztec-packages/v0.82.0`
+ *
+ * Source: noir/noir-repo/tooling/nargo_toml/src/git.rs
+ */
+export function nargoGitDepPath(gitUrl: string, tag: string): string {
+  const url = new URL(gitUrl);
+  const domain = url.hostname;
+  const repoPath = url.pathname.replace(/^\//, '');
+  return join(process.env.HOME ?? homedir(), 'nargo', domain, repoPath, tag);
+}
+
+/**
+ * Ensures a git dep is present in the nargo cache, cloning it if it isn't. Mirrors nargo's `clone_git_repo`.
+ * If cloning fails (e.g. no network), throws with a message suggesting `nargo check` to prime the cache.
+ *
+ * Source: noir/noir-repo/tooling/nargo_toml/src/git.rs
+ */
+async function ensureGitDepCached(gitUrl: string, tag: string, cachePath: string): Promise<void> {
+  if (existsSync(cachePath)) {
+    return;
+  }
+  await mkdir(dirname(cachePath), { recursive: true });
+  try {
+    await run('git', ['-c', 'advice.detachedHead=false', 'clone', '--depth', '1', '--branch', tag, gitUrl, cachePath]);
+  } catch (err: any) {
+    throw new Error(
+      `Failed to fetch git dependency ${gitUrl}@${tag}: ${err?.message ?? err}.\n` +
+        `Try running \`nargo check\` first to prime the dependency cache.`,
+    );
+  }
+}

package/src/cli/cmds/utils/needs_recompile.ts

@@ -0,0 +1,98 @@
+import { readdir, stat } from 'fs/promises';
+import { join } from 'path';
+
+import { collectCrateDirs } from './collect_crate_dirs.js';
+
+/**
+ * Returns true if recompilation is needed: either no artifacts exist in target/ or any .nr or Nargo.toml source file
+ * (including path-based dependencies) is newer than the oldest artifact. We compare against the oldest artifact so
+ * that a source change between the oldest and newest compilation (e.g. in a multi-contract workspace) still triggers
+ * a recompile.
+ *
+ * Note: The above implies that if there is a random json file in the target dir we would be always recompiling.
+ */
+export async function needsRecompile(): Promise<boolean> {
+  const oldestArtifactMs = await getOldestArtifactModificationTime('target');
+  if (oldestArtifactMs === undefined) {
+    return true;
+  }
+
+  // Git deps are pinned to a specific tag in Nargo.toml and nargo always fetches an exact tag, so their contents never
+  // change without Nargo.toml itself changing — and Nargo.toml is already tracked as a source file. Hence we can
+  // safely ignore checking source files of git deps.
+  const crateDirs = await collectCrateDirs('.', { skipGitDeps: true });
+  return hasNewerSourceFile(crateDirs, oldestArtifactMs);
+}
+
+/**
+ * Returns the last modification time (timestamp in ms) of the oldest .json artifact in targetDir, or undefined if
+ * none exist.
+ */
+async function getOldestArtifactModificationTime(targetDir: string): Promise<number | undefined> {
+  let entries: string[];
+  try {
+    entries = (await readdir(targetDir)).filter(f => f.endsWith('.json'));
+  } catch (err: any) {
+    if (err?.code === 'ENOENT') {
+      return undefined;
+    }
+    throw err;
+  }
+
+  if (entries.length === 0) {
+    return undefined;
+  }
+
+  let oldest = Infinity;
+  for (const entry of entries) {
+    const s = await stat(join(targetDir, entry));
+    if (s.mtimeMs < oldest) {
+      oldest = s.mtimeMs;
+    }
+  }
+  return oldest;
+}
+
+/**
+ * Walks crate dirs looking for .nr and Nargo.toml files newer than thresholdMs. Short-circuits on the first match.
+ */
+async function hasNewerSourceFile(crateDirs: string[], thresholdMs: number): Promise<boolean> {
+  // Returns true if it find a new file than thresholdMs, false otherwise
+  async function walkForNewer(dir: string): Promise<boolean> {
+    let entries;
+    try {
+      entries = await readdir(dir, { withFileTypes: true });
+    } catch {
+      return false;
+    }
+
+    // We iterate over the entries in the dir
+    for (const entry of entries) {
+      const fullPath = join(dir, entry.name);
+      if (entry.isDirectory()) {
+        // If the entry is a dir and it's not called `target` we recursively enter it
+        if (entry.name === 'target') {
+          continue;
+        }
+        if (await walkForNewer(fullPath)) {
+          return true;
+        }
+      } else if (entry.name === 'Nargo.toml' || entry.name.endsWith('.nr')) {
+        // The entry is a Nargo.toml file or *.nr file so we check the timestamp
+        const s = await stat(fullPath);
+        if (s.mtimeMs > thresholdMs) {
+          return true;
+        }
+      }
+    }
+    return false;
+  }
+
+  // We search through the crate dirs
+  for (const dir of crateDirs) {
+    if (await walkForNewer(dir)) {
+      return true;
+    }
+  }
+  return false;
+}

package/src/cli/cmds/utils/warn_if_aztec_version_mismatch.ts

@@ -0,0 +1,54 @@
+import type { LogFn } from '@aztec/foundation/log';
+import { getPackageVersion } from '@aztec/stdlib/update-checker';
+
+import TOML from '@iarna/toml';
+import { readFile } from 'fs/promises';
+import { join } from 'path';
+
+import { collectCrateDirs } from './collect_crate_dirs.js';
+
+/** Warns if the `aztec` dependency tag in any crate's Nargo.toml doesn't match the CLI version. */
+export async function warnIfAztecVersionMismatch(log: LogFn, cliVersion?: string): Promise<void> {
+  const version = cliVersion ?? getPackageVersion();
+  if (!version) {
+    log(`WARNING: aztec CLI version not found. Skipping dependency compatibility check.`);
+    return;
+  }
+
+  const expectedTag = `v${version}`;
+  const mismatches: { file: string; tag: string }[] = [];
+
+  const crateDirs = await collectCrateDirs('.', { skipGitDeps: true });
+
+  for (const dir of crateDirs) {
+    const tomlPath = join(dir, 'Nargo.toml');
+    let content: string;
+    try {
+      content = await readFile(tomlPath, 'utf-8');
+    } catch {
+      continue;
+    }
+
+    const parsed = TOML.parse(content) as Record<string, any>;
+    const aztecDep = (parsed.dependencies as Record<string, any>)?.aztec;
+    if (!aztecDep || typeof aztecDep !== 'object' || typeof aztecDep.tag !== 'string') {
+      // If a dep called "aztec" doesn't exist or it does not get parsed to an object or it doesn't have a tag defined
+      // we skip the check.
+      continue;
+    }
+
+    if (aztecDep.tag !== expectedTag) {
+      mismatches.push({ file: tomlPath, tag: aztecDep.tag });
+    }
+  }
+
+  if (mismatches.length > 0) {
+    const details = mismatches.map(m => `  ${m.file} (${m.tag})`).join('\n');
+    log(
+      `WARNING: Aztec dependency version mismatch detected.\n` +
+        `The following crates have an aztec dependency that does not match the CLI version (${expectedTag}):\n` +
+        `${details}\n\n` +
+        `See https://docs.aztec.network/errors/9 for how to update your dependencies.`,
+    );
+  }
+}