feat: merge-train/fairies (#24951)

BEGIN_COMMIT_OVERRIDE
chore(port): forward-port remaining v5-next fairies backlog to next
(#24949)
chore: remove unused l1-contracts repo mirror from release flow (#24929)
chore: merge next into merge-train/fairies (resolve conflicts, unblock
#24951) (#24965)
chore: merge next into merge-train/fairies (resolve conflicts, unblock
#24951) (#24967)
END_COMMIT_OVERRIDE

Author: AztecBot

bootstrap.sh

@@ -660,12 +660,10 @@ function private_release {
   fi
 
   # Publish @aztec/l1-artifacts to the internal registry. 13 yarn-project packages depend on it at the
-  # release version, so it must exist before yarn-project's release smoke-test installs them. We call
-  # only the npm publish, not l1-contracts' full `release` — that also git-mirrors tags to the public
-  # AztecProtocol/l1-contracts repo, which the private flow must not do. amd64 only (npm packages are
-  # platform-independent; mirrors the publish guard below).
+  # release version, so it must exist before yarn-project's release smoke-test installs them. amd64
+  # only (npm packages are platform-independent; mirrors the publish guard below).
   if [ $(arch) != arm64 ]; then
-    l1-contracts/bootstrap.sh release_l1_artifacts_npm
+    l1-contracts/bootstrap.sh release
   fi
 
   # Publish for real, in dependency order: bb.js, the noir packages, ipc-runtime, and wsdb must be on

docker-compose.yml

@@ -72,7 +72,7 @@ services:
     environment:
       AZTEC_NODE_URL: http://node:8080
       NODE_NO_WARNINGS: 1
-      SECRET_KEY:
+      SIGNING_KEY:
       ETHEREUM_HOSTS:
     profiles:
       - cli

docs/docs-developers/docs/aztec-js/how_to_create_account.md

@@ -20,14 +20,14 @@ yarn add @aztec/aztec.js@#include_version_without_prefix @aztec/wallets@#include
 
 ## Create a new account
 
-Using the [`wallet` from the connection guide](./how_to_connect_to_local_network.md), call `createSchnorrAccount` to create a new account with a random secret and salt:
+Using the [`wallet` from the connection guide](./how_to_connect_to_local_network.md), call `createSchnorrAccount` to create a new account with a random secret, salt, and signing key:
 
 #include_code create_account /docs/examples/ts/aztecjs_connection/index.ts typescript
 
-The secret is used to derive the account's encryption keys, and the salt ensures address uniqueness. The signing key is automatically derived from the secret.
+The secret derives the account's encryption keys, the signing key authenticates its transactions, and the salt ensures address uniqueness. The signing key is provided independently and is not derived from the secret: it is an ownership key, so keep it separate from the encryption secret that your PXE holds.
 
-:::warning Store your secret and salt
-Save the `secret` and `salt` values securely. You need both to recover access to your account. If you lose them, you will permanently lose access to the account and any assets it holds.
+:::warning Store your secret, salt, and signing key
+Save the `secret`, `salt`, and `signingKey` values securely. You need all three to recover access to your account. If you lose them, you will permanently lose access to the account and any assets it holds.
 :::
 
 ## Deploy the account

docs/docs-developers/docs/foundational-topics/ethereum-aztec-messaging/index.md

@@ -118,6 +118,29 @@ The following diagram shows the overall architecture, combining the earlier sect
 
 <Image img={require("@site/static/img/com-abs-7.png")} />
 
+## Using the L1 contract interfaces in your own project
+
+Portal contracts import Aztec's L1 interfaces (`IRegistry`, `IInbox`, `IOutbox`, `IRollup`, and supporting libraries). These ship in the [`@aztec/l1-artifacts`](https://www.npmjs.com/package/@aztec/l1-artifacts) npm package as a self-contained Foundry project under `l1-contracts/`, versioned to match each Aztec release:
+
+```bash
+npm install @aztec/l1-artifacts@<aztec-version>
+```
+
+In a Foundry project, add remappings so `@aztec/*` imports (and the bundled OpenZeppelin copy) resolve into the package:
+
+```toml
+# foundry.toml
+remappings = [
+  "@aztec/=node_modules/@aztec/l1-artifacts/l1-contracts/src/",
+  "@oz/=node_modules/@aztec/l1-artifacts/l1-contracts/lib/openzeppelin-contracts/contracts/",
+  "@aztec-blob-lib/=node_modules/@aztec/l1-artifacts/l1-contracts/src/core/libraries/rollup/"
+]
+```
+
+Then import interfaces as `@aztec/core/interfaces/IRollup.sol`, `@aztec/governance/interfaces/IRegistry.sol`, and so on. Note that `forge install` cannot fetch the package: it only clones whole git repositories, and the L1 contract sources include generated files that exist only in built distributions, so npm is the supported channel.
+
+In a Hardhat project, import with full package paths (`@aztec/l1-artifacts/l1-contracts/src/core/interfaces/IRollup.sol`), or configure equivalent aliases pointing at `node_modules/@aztec/l1-artifacts/l1-contracts/src`.
+
 ## See also
 
 - [Communicating Cross-Chain](../../aztec-nr/framework-description/ethereum_aztec_messaging.md) - Practical guide with code examples for L1-L2 messaging

docs/docs-developers/docs/tutorials/js_tutorials/aave_bridge.md

@@ -110,12 +110,14 @@ Start with the Hardhat + Aztec template. This provides a pre-configured Hardhat
 
 This template is a community-maintained starter. If the repository is unavailable, you can set up a Hardhat project manually and add the `@aztec/*` Solidity remappings from the [cross-chain messaging docs](../../foundational-topics/ethereum-aztec-messaging/index.md).
 
-You may need to update the `@aztec/l1-contracts` tag in the template's `package.json` to match your Aztec version, e.g.:
+You may need to replace the `@aztec/l1-contracts` dependency in `package.json` with the `@aztec/l1-artifacts` npm package at the version matching your Aztec version, e.g.:
 
 ```json
-"@aztec/l1-contracts": "git+https://github.com/AztecProtocol/l1-contracts.git#v5.0.1"
+"@aztec/l1-artifacts": "5.0.1"
 ```
 
+The package ships the L1 contract sources under `@aztec/l1-artifacts/l1-contracts/src`; update any `@aztec/*` Solidity remappings or aliases in the project to point at `node_modules/@aztec/l1-artifacts/l1-contracts/src`.
+
 :::
 
 ```bash
@@ -312,13 +314,13 @@ The portal is where the magic happens. It bridges Aztec's cross-chain messages w
 import {IERC20} from "@openzeppelin/contracts/token/ERC20/IERC20.sol";
 import {SafeERC20} from "@openzeppelin/contracts/token/ERC20/utils/SafeERC20.sol";
 
-import {IRegistry} from "@aztec/l1-contracts/src/governance/interfaces/IRegistry.sol";
-import {IInbox} from "@aztec/l1-contracts/src/core/interfaces/messagebridge/IInbox.sol";
-import {IOutbox} from "@aztec/l1-contracts/src/core/interfaces/messagebridge/IOutbox.sol";
-import {IRollup} from "@aztec/l1-contracts/src/core/interfaces/IRollup.sol";
-import {DataStructures} from "@aztec/l1-contracts/src/core/libraries/DataStructures.sol";
-import {Hash} from "@aztec/l1-contracts/src/core/libraries/crypto/Hash.sol";
-import {Epoch} from "@aztec/l1-contracts/src/core/libraries/TimeLib.sol";
+import {IRegistry} from "@aztec/l1-artifacts/l1-contracts/src/governance/interfaces/IRegistry.sol";
+import {IInbox} from "@aztec/l1-artifacts/l1-contracts/src/core/interfaces/messagebridge/IInbox.sol";
+import {IOutbox} from "@aztec/l1-artifacts/l1-contracts/src/core/interfaces/messagebridge/IOutbox.sol";
+import {IRollup} from "@aztec/l1-artifacts/l1-contracts/src/core/interfaces/IRollup.sol";
+import {DataStructures} from "@aztec/l1-artifacts/l1-contracts/src/core/libraries/DataStructures.sol";
+import {Hash} from "@aztec/l1-artifacts/l1-contracts/src/core/libraries/crypto/Hash.sol";
+import {Epoch} from "@aztec/l1-artifacts/l1-contracts/src/core/libraries/TimeLib.sol";
 
 #include_code portal_setup /docs/examples/solidity/aave_bridge/AavePortal.sol raw
 }

docs/docs-developers/docs/tutorials/js_tutorials/token_bridge.md

@@ -39,14 +39,14 @@ cd hardhat-aztec-example
 yarn add @aztec/aztec.js@#include_version_without_prefix @aztec/accounts@#include_version_without_prefix @aztec/stdlib@#include_version_without_prefix @aztec/wallets@#include_version_without_prefix @aztec/viem@2.38.2 tsx
 ```
 
-:::note Match the `@aztec/l1-contracts` version
-The starter repo pins its `@aztec/l1-contracts` dependency to an older release. In `package.json`, update the tag to match the network version used in this tutorial, then run `yarn install` again:
+:::note Use `@aztec/l1-artifacts` for the L1 interfaces
+The starter repo may still pin `@aztec/l1-contracts` as a git dependency; that repository is no longer updated. In `package.json`, replace it with the `@aztec/l1-artifacts` npm package at the version used in this tutorial, then run `yarn install` again:
 
 ```json
-"@aztec/l1-contracts": "git+https://github.com/AztecProtocol/l1-contracts.git##include_aztec_version"
+"@aztec/l1-artifacts": "#include_version_without_prefix"
 ```
 
-The L1 interfaces the portal imports later in this tutorial must match the contracts deployed by your running network.
+The package ships the L1 contract sources under `@aztec/l1-artifacts/l1-contracts/src`. If the project resolves `@aztec/*` Solidity imports through remappings or aliases, point them at `node_modules/@aztec/l1-artifacts/l1-contracts/src`. The interfaces the portal imports later in this tutorial must match the contracts deployed by your running network.
 :::
 
 Now start the local network in another terminal:

docs/docs-developers/docs/tutorials/js_tutorials/wallet-extension/04-accounts.md

@@ -24,28 +24,27 @@ An Aztec account has:
 
 ## Key Derivation
 
-The wallet uses the standard derivation from `@aztec/stdlib/keys`:
+The wallet generates a random signing key as the account's root and derives the privacy secret from it:
 
 ```typescript
-import { deriveSigningKey } from '@aztec/stdlib/keys';
+import { GrumpkinScalar } from '@aztec/aztec.js/fields';
+import { deriveSecretKeyFromSigningKey } from '@aztec/accounts/utils';
 
-// Generate a random secret
-const secret = Fr.random();
-
-// Derive the signing key
-const signingKey = deriveSigningKey(secret);
+// The signing key is the account's root; the privacy secret is derived from it
+const signingKey = GrumpkinScalar.random();
+const secret = await deriveSecretKeyFromSigningKey(signingKey);
 ```
 
-The derivation uses SHA-512 with domain separators to derive different keys:
+The nullifier, viewing, and tagging keys are then derived from that secret with SHA-512 and domain separators, while the signing key is supplied to the account contract directly:
 
 ```typescript
 // From stdlib/src/keys/derivation.ts
-export function deriveSigningKey(secretKey: Fr): GrumpkinScalar {
-  return sha512ToGrumpkinScalar([secretKey, GeneratorIndex.IVSK_M]);
+export function deriveMasterIncomingViewingSecretKey(secretKey: Fr): GrumpkinScalar {
+  return sha512ToGrumpkinScalar([secretKey, DomainSeparator.IVSK_M]);
 }
 
 export function deriveMasterNullifierHidingSecretKey(secretKey: Fr): GrumpkinScalar {
-  return sha512ToGrumpkinScalar([secretKey, GeneratorIndex.NHK_M]);
+  return sha512ToGrumpkinScalar([secretKey, DomainSeparator.NHK_M]);
 }
 ```
 

docs/docs-developers/docs/tutorials/testing_governance_rollup_upgrade.md

@@ -50,40 +50,22 @@ Note the `registryAddress` from the output.
 
 ---
 
-## Step 2: Clone and Set Up l1-contracts
+## Step 2: Download the l1-contracts bundle
 
-Clone the l1-contracts repo and checkout the version matching your Aztec installation. Run `aztec --version` to find your version:
+The [`@aztec/l1-artifacts`](https://www.npmjs.com/package/@aztec/l1-artifacts) npm package bundles a self-contained Foundry project with the L1 contract sources, prebuilt artifacts, deploy scripts, and governance payload contracts. Download the version matching your Aztec installation (run `aztec --version` to find it):
 
 ```bash
-git clone https://github.com/AztecProtocol/l1-contracts.git
+npm pack @aztec/l1-artifacts@#release_version
+mkdir l1-contracts
+tar xzf aztec-l1-artifacts-#release_version.tgz --strip-components=2 -C l1-contracts package/l1-contracts
 cd l1-contracts
-git checkout #release_version
 ```
 
-Install dependencies and set up the build environment:
+No further setup is needed: the bundle includes the library dependencies and the generated verifier, and forge downloads the matching solc version automatically on first use.
 
-```bash
-# Install forge dependencies
-mkdir -p lib
-cd lib
-git clone --depth 1 https://github.com/foundry-rs/forge-std forge-std
-git clone --depth 1 https://github.com/OpenZeppelin/openzeppelin-contracts openzeppelin-contracts
-cd ..
-
-# Install solc (uses forge's built-in svm). The Aztec installer ships
-# Foundry as `aztec-forge`/`aztec-cast`/`aztec-anvil` -- substitute your
-# own `forge` install if you have one.
-aztec-forge build --use 0.8.30 src/core/libraries/ConstantsGen.sol
-cp ~/.svm/0.8.30/solc-0.8.30 ./solc-0.8.30
-
-# Copy the HonkVerifier to the generated directory (required for build)
-mkdir -p generated
-cp src/HonkVerifier.sol generated/HonkVerifier.sol
-
-# Remove zkpassport-dependent files (not needed for rollup deployment)
-rm -f src/mock/StakingAssetHandler.sol
-rm -rf src/mock/staking_asset_handler/
-```
+:::note
+The Aztec installer ships Foundry as `aztec-forge`, `aztec-cast`, and `aztec-anvil`. Substitute your own `forge` and `cast` installs in the commands below if you have them.
+:::
 
 ---
 
@@ -119,7 +101,7 @@ export AZTEC_SLASHING_VETOER=0x0000000000000000000000000000000000000000
 export AZTEC_SLASHING_DISABLE_DURATION=0
 export AZTEC_MANA_TARGET=100000000
 export AZTEC_EXIT_DELAY_SECONDS=0
-export AZTEC_PROVING_COST_PER_MANA=0
+export AZTEC_PROVING_COST_PER_MANA=100
 export AZTEC_SLASH_AMOUNT_SMALL=0
 export AZTEC_SLASH_AMOUNT_MEDIUM=0
 export AZTEC_SLASH_AMOUNT_LARGE=0
@@ -147,6 +129,10 @@ export NEW_ROLLUP_ADDRESS=0x...
 
 ## Step 5: Deploy Governance Payload
 
+:::tip
+The deploy script in Step 4 also deploys this payload and prints it as `payloadAddress` in its JSON output. You can export that address as `PAYLOAD_ADDRESS` and skip this step.
+:::
+
 **Important:** Place flags before the contract path to avoid argument parsing issues.
 
 ```bash
@@ -156,7 +142,7 @@ aztec-forge create \
   --rpc-url $L1_RPC_URL \
   --private-key $PRIVATE_KEY \
   --broadcast \
-  test/governance/scenario/RegisterNewRollupVersionPayload.sol:RegisterNewRollupVersionPayload \
+  src/periphery/RegisterNewRollupVersionPayload.sol:RegisterNewRollupVersionPayload \
   --constructor-args $REGISTRY_ADDRESS $NEW_ROLLUP_ADDRESS
 ```
 

docs/examples/ts/aztecjs_connection/index.ts

@@ -45,11 +45,12 @@ console.log(`Alice's fee juice balance: ${aliceBalance}`);
 // docs:end:check_fee_juice
 
 // docs:start:create_account
-import { Fr } from "@aztec/aztec.js/fields";
+import { Fr, GrumpkinScalar } from "@aztec/aztec.js/fields";
 
 const secret = Fr.random();
 const salt = Fr.random();
-const newAccount = await wallet.createSchnorrAccount(secret, salt);
+const signingKey = GrumpkinScalar.random();
+const newAccount = await wallet.createSchnorrAccount(secret, salt, signingKey);
 console.log("New account address:", newAccount.address.toString());
 // docs:end:create_account
 
@@ -87,9 +88,11 @@ await deployMethod.send({
 // can coexist in one example; in your own code, pick whichever name fits.
 const feeJuiceSecret = Fr.random();
 const feeJuiceSalt = Fr.random();
+const feeJuiceSigningKey = GrumpkinScalar.random();
 const feeJuiceAccount = await wallet.createSchnorrAccount(
   feeJuiceSecret,
   feeJuiceSalt,
+  feeJuiceSigningKey,
 );
 // docs:end:create_fee_juice_account
 

docs/examples/ts/aztecjs_getting_started/index.ts

@@ -6,8 +6,16 @@ const nodeUrl = process.env.AZTEC_NODE_URL ?? "http://localhost:8080";
 const wallet = await EmbeddedWallet.create(nodeUrl, { ephemeral: true });
 
 const [alice, bob] = await getInitialTestAccountsData();
-await wallet.createSchnorrInitializerlessAccount(alice.secret, alice.salt);
-await wallet.createSchnorrInitializerlessAccount(bob.secret, bob.salt);
+await wallet.createSchnorrInitializerlessAccount(
+  alice.secret,
+  alice.salt,
+  alice.signingKey,
+);
+await wallet.createSchnorrInitializerlessAccount(
+  bob.secret,
+  bob.salt,
+  bob.signingKey,
+);
 // docs:end:setup
 
 // docs:start:deploy