@aztec/aztec 0.0.1-commit.fce3e4f → 0.0.1-commit.ff7989d6c

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aztec/aztec",
-  "version": "0.0.1-commit.fce3e4f",
+  "version": "0.0.1-commit.ff7989d6c",
   "type": "module",
   "exports": {
     ".": "./dest/index.js",
@@ -15,12 +15,12 @@
     "tsconfig": "./tsconfig.json"
   },
   "scripts": {
-    "build": "yarn clean && tsgo -b",
+    "build": "yarn clean && ../scripts/tsc.sh",
     "start": "node --no-warnings ./dest/bin",
     "start:debug": "node --inspect=0.0.0.0:9221 --no-warnings ./dest/bin",
     "start:local-network": "ETHEREUM_HOSTS=http://0.0.0.0:8545/ && yarn start start --local-network",
     "clean": "rm -rf ./dest .tsbuildinfo",
-    "build:dev": "tsgo -b --watch",
+    "build:dev": "../scripts/tsc.sh --watch",
     "test": "NODE_NO_WARNINGS=1 node --experimental-vm-modules ../node_modules/.bin/jest --passWithNoTests --maxWorkers=${JEST_MAX_WORKERS:-8}",
     "run:example:token": "LOG_LEVEL='verbose' node ./dest/examples/token.js"
   },
@@ -28,37 +28,39 @@
     "../package.common.json"
   ],
   "dependencies": {
-    "@aztec/accounts": "0.0.1-commit.fce3e4f",
-    "@aztec/archiver": "0.0.1-commit.fce3e4f",
-    "@aztec/aztec-faucet": "0.0.1-commit.fce3e4f",
-    "@aztec/aztec-node": "0.0.1-commit.fce3e4f",
-    "@aztec/aztec.js": "0.0.1-commit.fce3e4f",
-    "@aztec/bb-prover": "0.0.1-commit.fce3e4f",
-    "@aztec/bb.js": "0.0.1-commit.fce3e4f",
-    "@aztec/blob-sink": "0.0.1-commit.fce3e4f",
-    "@aztec/bot": "0.0.1-commit.fce3e4f",
-    "@aztec/builder": "0.0.1-commit.fce3e4f",
-    "@aztec/cli": "0.0.1-commit.fce3e4f",
-    "@aztec/constants": "0.0.1-commit.fce3e4f",
-    "@aztec/entrypoints": "0.0.1-commit.fce3e4f",
-    "@aztec/ethereum": "0.0.1-commit.fce3e4f",
-    "@aztec/foundation": "0.0.1-commit.fce3e4f",
-    "@aztec/kv-store": "0.0.1-commit.fce3e4f",
-    "@aztec/l1-artifacts": "0.0.1-commit.fce3e4f",
-    "@aztec/node-lib": "0.0.1-commit.fce3e4f",
-    "@aztec/noir-contracts.js": "0.0.1-commit.fce3e4f",
-    "@aztec/noir-protocol-circuits-types": "0.0.1-commit.fce3e4f",
-    "@aztec/p2p": "0.0.1-commit.fce3e4f",
-    "@aztec/p2p-bootstrap": "0.0.1-commit.fce3e4f",
-    "@aztec/protocol-contracts": "0.0.1-commit.fce3e4f",
-    "@aztec/prover-client": "0.0.1-commit.fce3e4f",
-    "@aztec/prover-node": "0.0.1-commit.fce3e4f",
-    "@aztec/pxe": "0.0.1-commit.fce3e4f",
-    "@aztec/stdlib": "0.0.1-commit.fce3e4f",
-    "@aztec/telemetry-client": "0.0.1-commit.fce3e4f",
-    "@aztec/test-wallet": "0.0.1-commit.fce3e4f",
-    "@aztec/txe": "0.0.1-commit.fce3e4f",
-    "@aztec/world-state": "0.0.1-commit.fce3e4f",
+    "@aztec/accounts": "0.0.1-commit.ff7989d6c",
+    "@aztec/archiver": "0.0.1-commit.ff7989d6c",
+    "@aztec/aztec-faucet": "0.0.1-commit.ff7989d6c",
+    "@aztec/aztec-node": "0.0.1-commit.ff7989d6c",
+    "@aztec/aztec.js": "0.0.1-commit.ff7989d6c",
+    "@aztec/bb-prover": "0.0.1-commit.ff7989d6c",
+    "@aztec/bb.js": "0.0.1-commit.ff7989d6c",
+    "@aztec/blob-client": "0.0.1-commit.ff7989d6c",
+    "@aztec/bot": "0.0.1-commit.ff7989d6c",
+    "@aztec/builder": "0.0.1-commit.ff7989d6c",
+    "@aztec/cli": "0.0.1-commit.ff7989d6c",
+    "@aztec/constants": "0.0.1-commit.ff7989d6c",
+    "@aztec/entrypoints": "0.0.1-commit.ff7989d6c",
+    "@aztec/ethereum": "0.0.1-commit.ff7989d6c",
+    "@aztec/foundation": "0.0.1-commit.ff7989d6c",
+    "@aztec/kv-store": "0.0.1-commit.ff7989d6c",
+    "@aztec/l1-artifacts": "0.0.1-commit.ff7989d6c",
+    "@aztec/node-lib": "0.0.1-commit.ff7989d6c",
+    "@aztec/noir-contracts.js": "0.0.1-commit.ff7989d6c",
+    "@aztec/noir-protocol-circuits-types": "0.0.1-commit.ff7989d6c",
+    "@aztec/p2p": "0.0.1-commit.ff7989d6c",
+    "@aztec/p2p-bootstrap": "0.0.1-commit.ff7989d6c",
+    "@aztec/protocol-contracts": "0.0.1-commit.ff7989d6c",
+    "@aztec/prover-client": "0.0.1-commit.ff7989d6c",
+    "@aztec/prover-node": "0.0.1-commit.ff7989d6c",
+    "@aztec/pxe": "0.0.1-commit.ff7989d6c",
+    "@aztec/sequencer-client": "0.0.1-commit.ff7989d6c",
+    "@aztec/stdlib": "0.0.1-commit.ff7989d6c",
+    "@aztec/telemetry-client": "0.0.1-commit.ff7989d6c",
+    "@aztec/txe": "0.0.1-commit.ff7989d6c",
+    "@aztec/validator-ha-signer": "0.0.1-commit.ff7989d6c",
+    "@aztec/wallets": "0.0.1-commit.ff7989d6c",
+    "@aztec/world-state": "0.0.1-commit.ff7989d6c",
     "@types/chalk": "^2.2.0",
     "abitype": "^0.8.11",
     "chalk": "^5.3.0",
@@ -78,7 +80,7 @@
     "@jest/globals": "^30.0.0",
     "@types/jest": "^30.0.0",
     "@types/koa": "^2.15.0",
-    "@typescript/native-preview": "7.0.0-dev.20251126.1",
+    "@typescript/native-preview": "7.0.0-dev.20260113.1",
     "jest": "^30.0.0",
     "ts-node": "^10.9.1",
     "typescript": "^5.3.3"

package/scripts/aztec.sh

@@ -1,26 +1,32 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
+# Re-execute using correct version if we have an .aztecrc file.
+if [ "${AZTEC_VERSIONED:-0}" -eq 0 ] && [ -f .aztecrc ] && command -v aztec-up &>/dev/null; then
+  env_setup=$(aztec-up env)
+  eval "$env_setup"
+  AZTEC_VERSIONED=1 exec aztec "$@"
+fi
+
+cmd=${1:-}
+[ -n "$cmd" ] && shift
+
 script_dir="$(dirname "$(realpath "$0")")"
 
 function aztec {
+  export AZTEC_SHELL_WRAPPER=1
   exec node --no-warnings $script_dir/../dest/bin/index.js "$@"
 }
 
-cmd=${1:-}
-[ -n "$cmd" ] && shift
-
-export AZTEC_SHELL_WRAPPER=1
-
 case $cmd in
   test)
-    export LOG_LEVEL="${LOG_LEVEL:-info}"
+    export LOG_LEVEL="${LOG_LEVEL:-"error;trace:contract_log"}"
     aztec start --txe --port 8081 &
     server_pid=$!
     trap 'kill $server_pid &>/dev/null || true' EXIT
     while ! nc -z 127.0.0.1 8081 &>/dev/null; do sleep 0.2; done
     export NARGO_FOREIGN_CALL_TIMEOUT=300000
-    nargo test --silence-warnings --pedantic-solving --oracle-resolver http://127.0.0.1:8081 "$@"
+    nargo test --silence-warnings --oracle-resolver http://127.0.0.1:8081 --test-threads 16 "$@"
     ;;
   start)
     if [ "${1:-}" == "--local-network" ]; then
@@ -47,7 +53,7 @@ case $cmd in
 
     aztec start "$@"
     ;;
-  compile|new|init|flamegraph)
+  new|init|flamegraph)
     $script_dir/${cmd}.sh "$@"
     ;;
   *)

package/src/bin/index.ts

@@ -2,7 +2,8 @@
 //
 import { injectCommands as injectBuilderCommands } from '@aztec/builder';
 import { injectCommands as injectAztecNodeCommands } from '@aztec/cli/aztec_node';
-import { enrichEnvironmentWithChainName, enrichEnvironmentWithNetworkConfig } from '@aztec/cli/config';
+import { enrichEnvironmentWithChainName } from '@aztec/cli/config/chain';
+import { enrichEnvironmentWithNetworkConfig } from '@aztec/cli/config/network';
 import { injectCommands as injectContractCommands } from '@aztec/cli/contracts';
 import { injectCommands as injectInfrastructureCommands } from '@aztec/cli/infrastructure';
 import { injectCommands as injectL1Commands } from '@aztec/cli/l1';
@@ -13,10 +14,13 @@ import { createConsoleLogger, createLogger } from '@aztec/foundation/log';
 
 import { Command } from 'commander';
 
-import { NETWORK_FLAG } from '../cli/aztec_start_options.js';
+import { injectCompileCommand } from '../cli/cmds/compile.js';
+import { injectMigrateCommand } from '../cli/cmds/migrate_ha_db.js';
 import { injectAztecCommands } from '../cli/index.js';
 import { getCliVersion } from '../cli/release_version.js';
 
+const NETWORK_FLAG = 'network';
+
 const userLog = createConsoleLogger();
 const debugLogger = createLogger('cli');
 
@@ -44,7 +48,7 @@ async function main() {
 
   const cliVersion = getCliVersion();
   let program = new Command('aztec');
-  program.description('Aztec command line interface').version(cliVersion);
+  program.description('Aztec command line interface').version(cliVersion).enablePositionalOptions();
   program = injectAztecCommands(program, userLog, debugLogger);
   program = injectBuilderCommands(program);
   program = injectContractCommands(program, userLog, debugLogger);
@@ -53,6 +57,8 @@ async function main() {
   program = injectAztecNodeCommands(program, userLog, debugLogger);
   program = injectMiscCommands(program, userLog);
   program = injectValidatorKeysCommands(program, userLog);
+  program = injectCompileCommand(program, userLog);
+  program = injectMigrateCommand(program, userLog);
 
   await program.parseAsync(process.argv);
 }

package/src/cli/admin_api_key_store.ts

@@ -0,0 +1,128 @@
+import { randomBytes } from '@aztec/foundation/crypto/random';
+import { sha256Hash } from '@aztec/foundation/json-rpc/server';
+import type { Logger } from '@aztec/foundation/log';
+
+import { promises as fs } from 'fs';
+import { join } from 'path';
+
+/** Subdirectory under dataDirectory for admin API key storage. */
+const ADMIN_STORE_DIR = 'admin';
+const HASH_FILE_NAME = 'api_key_hash';
+
+/**
+ * Result of resolving the admin API key.
+ * Contains the SHA-256 hex hash of the API key to be used by the auth middleware,
+ * and optionally the raw key when newly generated (so the caller can display it).
+ */
+export interface AdminApiKeyResolution {
+  /** The SHA-256 hash of the API key. */
+  apiKeyHash: Buffer;
+  /**
+   * The raw API key, only present when a new key was generated during this call.
+   * The caller MUST display this to the operator — it will not be stored or returned again.
+   */
+  rawKey?: string;
+}
+
+export interface ResolveAdminApiKeyOptions {
+  /** SHA-256 hex hash of a pre-generated API key. When set, the node uses this hash directly. */
+  adminApiKeyHash?: string;
+  /** If true, disable admin API key auth entirely. */
+  disableAdminApiKey?: boolean;
+  /** If true, force-generate a new key even if one is already persisted. */
+  resetAdminApiKey?: boolean;
+  /** Root data directory for persistent storage. */
+  dataDirectory?: string;
+}
+
+/**
+ * Resolves the admin API key for the admin RPC endpoint.
+ *
+ * Strategy:
+ * 1. If opt-out flag is set (`disableAdminApiKey`), return undefined (no auth).
+ * 2. If a pre-generated hash is provided (`adminApiKeyHash`), use it directly.
+ * 3. If a data directory exists, look for a persisted hash file
+ *    at `<dataDirectory>/admin/api_key_hash`:
+ *    - If `resetAdminApiKey` is set, skip loading and force-generate a new key.
+ *    - Found: use the stored hash (operator already saved the key from first run).
+ *    - Not found: auto-generate a random key, display it once, persist the hash.
+ * 3. If no data directory: generate a random key
+ *    each run and display it (cannot persist).
+ *
+ * @param options - The options for resolving the admin API key.
+ * @param log - Logger for outputting the key and status messages.
+ * @returns The resolved API key hash, or undefined if auth is disabled.
+ */
+export async function resolveAdminApiKey(
+  options: ResolveAdminApiKeyOptions,
+  log: Logger,
+): Promise<AdminApiKeyResolution | undefined> {
+  // Operator explicitly opted out of admin auth
+  if (options.disableAdminApiKey) {
+    log.warn('Admin API key authentication is DISABLED (--disable-admin-api-key / AZTEC_DISABLE_ADMIN_API_KEY)');
+    return undefined;
+  }
+
+  // Operator provided a pre-generated hash (e.g. via AZTEC_ADMIN_API_KEY_HASH env var)
+  if (options.adminApiKeyHash) {
+    const hex = options.adminApiKeyHash.trim();
+    if (hex.length !== 64 || !/^[0-9a-f]{64}$/.test(hex)) {
+      throw new Error(`Invalid admin API key hash: expected 64-char hex string, got "${hex}"`);
+    }
+    log.info('Admin API key authentication enabled (using pre-configured key hash)');
+    return { apiKeyHash: Buffer.from(hex, 'hex') };
+  }
+
+  // Persistent storage available, load or generate key
+  if (options.dataDirectory) {
+    const adminDir = join(options.dataDirectory, ADMIN_STORE_DIR);
+    const hashFilePath = join(adminDir, HASH_FILE_NAME);
+
+    // Unless a reset is forced, try to load the existing hash from disk
+    if (!options.resetAdminApiKey) {
+      try {
+        const storedHash = (await fs.readFile(hashFilePath, 'utf-8')).trim();
+        if (storedHash.length === 64) {
+          log.info('Admin API key authentication enabled (loaded stored key hash from disk)');
+          return { apiKeyHash: Buffer.from(storedHash, 'hex') };
+        }
+        log.warn(`Invalid stored admin API key hash at ${hashFilePath}, regenerating...`);
+      } catch (err: any) {
+        if (err.code !== 'ENOENT') {
+          log.warn(`Failed to read admin API key hash from ${hashFilePath}: ${err.message}`);
+        }
+        // File doesn't exist — fall through to generate
+      }
+    } else {
+      log.warn('Admin API key reset requested — generating a new key');
+    }
+
+    // Generate a new key, persist the hash, and return the raw key for the caller to display
+    const { rawKey, hash } = generateApiKey();
+    await fs.mkdir(adminDir, { recursive: true });
+    await fs.writeFile(hashFilePath, hash.toString('hex'), 'utf-8');
+    // Set restrictive permissions (owner read/write only)
+    await fs.chmod(hashFilePath, 0o600);
+
+    log.info('Admin API key authentication enabled (new key generated and hash persisted to disk)');
+    return { apiKeyHash: hash, rawKey };
+  }
+
+  // No data directory, generate a temporary key per session
+  const { rawKey, hash } = generateApiKey();
+
+  log.warn('No data directory configured — admin API key cannot be persisted.');
+  log.warn('A temporary key has been generated for this session only.');
+
+  return { apiKeyHash: hash, rawKey };
+}
+
+/**
+ * Generates a cryptographically random API key and its SHA-256 hash.
+ * @returns The raw key (hex string) and its SHA-256 hash as a Buffer.
+ */
+function generateApiKey(): { rawKey: string; hash: Buffer } {
+  const rawKey = randomBytes(32).toString('hex');
+  const hash = sha256Hash(rawKey);
+  return { rawKey, hash };
+}

package/src/cli/aztec_start_action.ts

@@ -1,6 +1,7 @@
 import {
   type NamespacedApiHandlers,
   createNamespacedSafeJsonRpcServer,
+  getApiKeyAuthMiddleware,
   startHttpRpcServer,
 } from '@aztec/foundation/json-rpc/server';
 import type { LogFn, Logger } from '@aztec/foundation/log';
@@ -11,6 +12,7 @@ import { getOtelJsonRpcPropagationMiddleware } from '@aztec/telemetry-client';
 
 import { createLocalNetwork } from '../local-network/index.js';
 import { github, splash } from '../splash.js';
+import { resolveAdminApiKey } from './admin_api_key_store.js';
 import { getCliVersion } from './release_version.js';
 import { extractNamespacedOptions, installSignalHandlers } from './util.js';
 import { getVersions } from './versioning.js';
@@ -33,9 +35,13 @@ export async function aztecStart(options: any, userLog: LogFn, debugLogger: Logg
       {
         l1Mnemonic: localNetwork.l1Mnemonic,
         l1RpcUrls: options.l1RpcUrls,
-        deployAztecContractsSalt: localNetwork.deployAztecContractsSalt,
         testAccounts: localNetwork.testAccounts,
         realProofs: false,
+        // Setting the epoch duration to 2 by default for local network. This allows the epoch to be "proven" faster, so
+        // the users can consume out hash without having to wait for a long time.
+        // Note: We are not proving anything in the local network (realProofs == false). But in `createLocalNetwork`,
+        // the EpochTestSettler will set the out hash to the outbox when an epoch is complete.
+        aztecEpochDuration: 2,
       },
       userLog,
     );
@@ -44,18 +50,17 @@ export async function aztecStart(options: any, userLog: LogFn, debugLogger: Logg
     signalHandlers.push(stop);
     services.node = [node, AztecNodeApiSchema];
   } else {
+    // Route --prover-node through startNode
+    if (options.proverNode && !options.node) {
+      options.node = true;
+    }
+
     if (options.node) {
       const { startNode } = await import('./cmds/start_node.js');
       ({ config } = await startNode(options, signalHandlers, services, adminServices, userLog));
     } else if (options.bot) {
       const { startBot } = await import('./cmds/start_bot.js');
       await startBot(options, signalHandlers, services, userLog);
-    } else if (options.proverNode) {
-      const { startProverNode } = await import('./cmds/start_prover_node.js');
-      ({ config } = await startProverNode(options, signalHandlers, services, userLog));
-    } else if (options.blobSink) {
-      const { startBlobSink } = await import('./cmds/start_blob_sink.js');
-      await startBlobSink(options, signalHandlers, userLog);
     } else if (options.archiver) {
       const { startArchiver } = await import('./cmds/start_archiver.js');
       ({ config } = await startArchiver(options, signalHandlers, services));
@@ -98,14 +103,54 @@ export async function aztecStart(options: any, userLog: LogFn, debugLogger: Logg
 
   // If there are any admin services, start a separate JSON-RPC server for them
   if (Object.entries(adminServices).length > 0) {
+    const adminMiddlewares = [getOtelJsonRpcPropagationMiddleware(), getVersioningMiddleware(versions)];
+
+    // Resolve the admin API key (auto-generated and persisted, or opt-out)
+    const apiKeyResolution = await resolveAdminApiKey(
+      {
+        adminApiKeyHash: options.adminApiKeyHash,
+        disableAdminApiKey: options.disableAdminApiKey,
+        resetAdminApiKey: options.resetAdminApiKey,
+        dataDirectory: options.dataDirectory,
+      },
+      debugLogger,
+    );
+    if (apiKeyResolution) {
+      adminMiddlewares.unshift(getApiKeyAuthMiddleware(apiKeyResolution.apiKeyHash));
+    } else {
+      debugLogger.warn('No admin API key set — admin endpoint is unauthenticated');
+    }
+
     const rpcServer = createNamespacedSafeJsonRpcServer(adminServices, {
       http200OnError: false,
       log: debugLogger,
-      middlewares: [getOtelJsonRpcPropagationMiddleware(), getVersioningMiddleware(versions)],
+      middlewares: adminMiddlewares,
       maxBatchSize: options.rpcMaxBatchSize,
       maxBodySizeBytes: options.rpcMaxBodySize,
     });
     const { port } = await startHttpRpcServer(rpcServer, { port: options.adminPort });
     debugLogger.info(`Aztec Server admin API listening on port ${port}`, versions);
+
+    // Display the API key after the server has started
+    // Uses userLog which is never filtered by LOG_LEVEL.
+    if (apiKeyResolution?.rawKey) {
+      const separator = '='.repeat(70);
+      userLog('');
+      userLog(separator);
+      userLog('  ADMIN API KEY (save this — it will NOT be shown again)');
+      userLog('');
+      userLog(`  ${apiKeyResolution.rawKey}`);
+      userLog('');
+      userLog(`  Use via header:  x-api-key: <key>`);
+      userLog(`  Or via header:   Authorization: Bearer <key>`);
+      if (options.dataDirectory) {
+        userLog('');
+        userLog('  The key hash has been persisted — on next restart, the same key will be used.');
+      }
+      userLog('');
+      userLog('  To disable admin auth: --disable-admin-api-key or AZTEC_DISABLE_ADMIN_API_KEY=true');
+      userLog(separator);
+      userLog('');
+    }
   }
 }

package/src/cli/aztec_start_options.ts

@@ -1,8 +1,9 @@
 import { type ArchiverConfig, archiverConfigMappings } from '@aztec/archiver/config';
-import { sequencerClientConfigMappings } from '@aztec/aztec-node/config';
-import { blobSinkConfigMappings } from '@aztec/blob-sink/server';
+import { blobClientConfigMapping } from '@aztec/blob-client/client/config';
 import { botConfigMappings } from '@aztec/bot/config';
-import { l1ContractAddressesMapping, l1ContractsConfigMappings, l1ReaderConfigMappings } from '@aztec/ethereum';
+import { l1ContractsConfigMappings } from '@aztec/ethereum/config';
+import { l1ContractAddressesMapping } from '@aztec/ethereum/l1-contract-addresses';
+import { l1ReaderConfigMappings } from '@aztec/ethereum/l1-reader';
 import { getKeys } from '@aztec/foundation/collection';
 import {
   type ConfigMapping,
@@ -14,12 +15,13 @@ import {
 import { dataConfigMappings } from '@aztec/kv-store/config';
 import { sharedNodeConfigMappings } from '@aztec/node-lib/config';
 import { bootnodeConfigMappings, p2pConfigMappings } from '@aztec/p2p/config';
-import { proverAgentConfigMappings, proverBrokerConfigMappings } from '@aztec/prover-client/broker';
+import { proverAgentConfigMappings, proverBrokerConfigMappings } from '@aztec/prover-client/broker/config';
 import { proverNodeConfigMappings } from '@aztec/prover-node/config';
 import { allPxeConfigMappings } from '@aztec/pxe/config';
-import { chainConfigMappings } from '@aztec/stdlib/config';
-import { telemetryClientConfigMappings } from '@aztec/telemetry-client';
-import { worldStateConfigMappings } from '@aztec/world-state';
+import { sequencerClientConfigMappings } from '@aztec/sequencer-client/config';
+import { chainConfigMappings, nodeRpcConfigMappings } from '@aztec/stdlib/config';
+import { telemetryClientConfigMappings } from '@aztec/telemetry-client/config';
+import { worldStateConfigMappings } from '@aztec/world-state/config';
 
 import { DefaultMnemonic } from '../mnemonic.js';
 
@@ -124,14 +126,6 @@ export const aztecStartOptions: { [key: string]: AztecStartOption[] } = {
       defaultValue: DefaultMnemonic,
       env: 'MNEMONIC',
     },
-    {
-      flag: '--local-network.deployAztecContractsSalt <value>',
-      description:
-        'Numeric salt for deploying L1 Aztec contracts before starting the local network. Needs mnemonic or private key to be set.',
-      env: 'DEPLOY_AZTEC_CONTRACTS_SALT',
-      defaultValue: undefined,
-      parseVal: (val: string) => (val ? parseInt(val) : undefined),
-    },
   ],
   API: [
     {
@@ -148,20 +142,46 @@ export const aztecStartOptions: { [key: string]: AztecStartOption[] } = {
       env: 'AZTEC_ADMIN_PORT',
       parseVal: val => parseInt(val, 10),
     },
+    {
+      flag: '--admin-api-key-hash <value>',
+      description:
+        'SHA-256 hex hash of a pre-generated admin API key. When set, the node uses this hash for authentication instead of auto-generating a key.',
+      defaultValue: undefined,
+      env: 'AZTEC_ADMIN_API_KEY_HASH',
+    },
+    {
+      flag: '--disable-admin-api-key',
+      description:
+        'Disable API key authentication on the admin RPC endpoint. By default, a key is auto-generated, displayed once, and its hash is persisted.',
+      defaultValue: false,
+      env: 'AZTEC_DISABLE_ADMIN_API_KEY',
+      // undefined means the flag was passed without a value (boolean toggle), treat as true.
+      parseVal: val => val === undefined || val === 'true' || val === '1',
+    },
+    {
+      flag: '--reset-admin-api-key',
+      description:
+        'Force-generate a new admin API key, replacing any previously persisted key hash. The new key is displayed once at startup.',
+      defaultValue: false,
+      env: 'AZTEC_RESET_ADMIN_API_KEY',
+      parseVal: val => val === 'true' || val === '1',
+    },
     {
       flag: '--api-prefix <value>',
       description: 'Prefix for API routes on any service that is started',
       defaultValue: '',
       env: 'API_PREFIX',
     },
+    configToFlag('--rpcMaxBatchSize', nodeRpcConfigMappings.rpcMaxBatchSize),
+    configToFlag('--rpcMaxBodySize', nodeRpcConfigMappings.rpcMaxBodySize),
   ],
   ETHEREUM: [
     configToFlag('--l1-chain-id', l1ReaderConfigMappings.l1ChainId),
     // Do not set default for CLI: keep undefined unless provided via flag or env
     configToFlag('--l1-rpc-urls', { ...l1ReaderConfigMappings.l1RpcUrls, defaultValue: undefined }),
-    configToFlag('--l1-consensus-host-urls', blobSinkConfigMappings.l1ConsensusHostUrls),
-    configToFlag('--l1-consensus-host-api-keys', blobSinkConfigMappings.l1ConsensusHostApiKeys),
-    configToFlag('--l1-consensus-host-api-key-headers', blobSinkConfigMappings.l1ConsensusHostApiKeyHeaders),
+    configToFlag('--l1-consensus-host-urls', blobClientConfigMapping.l1ConsensusHostUrls),
+    configToFlag('--l1-consensus-host-api-keys', blobClientConfigMapping.l1ConsensusHostApiKeys),
+    configToFlag('--l1-consensus-host-api-key-headers', blobClientConfigMapping.l1ConsensusHostApiKeyHeaders),
   ],
   'L1 CONTRACTS': [
     configToFlag('--registry-address', l1ContractAddressesMapping.registryAddress),
@@ -174,7 +194,7 @@ export const aztecStartOptions: { [key: string]: AztecStartOption[] } = {
   'WORLD STATE': [
     configToFlag('--world-state-data-directory', worldStateConfigMappings.worldStateDataDirectory),
     configToFlag('--world-state-db-map-size-kb', worldStateConfigMappings.worldStateDbMapSizeKb),
-    configToFlag('--world-state-block-history', worldStateConfigMappings.worldStateBlockHistory),
+    configToFlag('--world-state-checkpoint-history', worldStateConfigMappings.worldStateCheckpointHistory),
   ],
   // We can't easily auto-generate node options as they're parts of modules defined below
   'AZTEC NODE': [
@@ -208,21 +228,13 @@ export const aztecStartOptions: { [key: string]: AztecStartOption[] } = {
       'sequencer',
       omitConfigMappings(sequencerClientConfigMappings, [
         'fakeProcessingDelayPerTxMs',
+        'fakeThrowAfterProcessingTxCount',
         'skipCollectingAttestations',
         'skipInvalidateBlockAsProposer',
         'blobSinkMapSizeKb',
       ]),
     ),
   ],
-  'BLOB SINK': [
-    {
-      flag: '--blob-sink',
-      description: 'Starts Aztec Blob Sink with options',
-      defaultValue: undefined,
-      env: undefined,
-    },
-    ...getOptions('blobSink', blobSinkConfigMappings),
-  ],
   'PROVER NODE': [
     {
       flag: '--prover-node',
@@ -234,12 +246,8 @@ export const aztecStartOptions: { [key: string]: AztecStartOption[] } = {
       'proverNode',
       omitConfigMappings(proverNodeConfigMappings, [
         // filter out options passed separately
-        ...getKeys(archiverConfigMappings),
         ...getKeys(proverBrokerConfigMappings),
         ...getKeys(proverAgentConfigMappings),
-        ...getKeys(p2pConfigMappings),
-        ...getKeys(worldStateConfigMappings),
-        ...getKeys(sharedNodeConfigMappings),
       ]),
     ),
   ],

package/src/cli/cli.ts

@@ -35,44 +35,11 @@ export function injectAztecCommands(program: Command, userLog: LogFn, debugLogge
     program.addHelpText(
       'after',
       `
+Additional commands:
 
-  Additional commands:
-
-    init [folder] [options]: creates a new Noir project
-      Options:
-        --name <name>       Name of the package
-        --contract          Use a contract template (default)
-        --lib               Use a library template
-        --bin               Use a binary template
-      Examples:
-        $ aztec init                    # creates a contract project in current directory
-        $ aztec init --lib              # creates a library project
-
-    new <path> [options]: creates a new Noir project in a new directory
-      Options:
-        --name <name>       Name of the package
-        --contract          Use a contract template (default)
-        --lib               Use a library template
-        --bin               Use a binary template
-      Examples:
-        $ aztec new my-project          # creates a contract project in ./my-project
-        $ aztec new my-lib --lib        # creates a library project in ./my-lib
-
-    compile [options]: compiles Aztec Noir contracts
-      Compiles contracts with nargo compile and then postprocesses them to generate Aztec-specific artifacts including:
-        - Transpiled contract artifacts
-        - Verification keys
-      The compiled contracts will be placed in the target/ directory by default.
-      Supports standard nargo compile options.
-
-    test [options]: starts a dockerized TXE node via
-      $ aztec start --txe
-    then runs
-      $ aztec test --silence-warnings --oracle-resolver=<TXE_ADDRESS> [options]
-
-    preload-crs: Downloads and caches the Common Reference String (CRS) data required for zero-knowledge proofs.
-      Example:
-        $ aztec preload-crs             # preloads CRS data
+  init [folder] [options]  creates a new Aztec Noir project.
+  new <path> [options]     creates a new Aztec Noir project in a new directory.
+  test [options]           starts a TXE and runs "nargo test" using it as the oracle resolver.
     `,
     );
   }