feat!: aztec-nargo now directly exposes nargo. aztec-postprocess-contract transpiles and generates vks

## What's done and not done?
1. ✅ Make aztec-nargo just be a direct exposure of the version of nargo in the container. To this end aztec-nargo should from the users experience, just be plain vanilla nargo, but just versioned as we need.
1. ✅ Fix the version number in aztecs nargo build to just be whatever our current noir-ref is, maybe with a -aztec suffix or something to ensure we have more context.
    - Setting the `GIT_COMMIT` env var to the current noir-ref with `-aztec` appended.
        ```
        % aztec-nargo --version
        nargo version = 1.0.0-beta.9
        noirc version = 1.0.0-beta.9+nightly-2025-08-04-aztec
        (git version hash: nightly-2025-08-04-aztec, is dirty: false)
        ```
        - **Note that we are appending `-aztec` to `GIT_COMMIT`, which does not end up in the "nargo version", but appears in the noirc version and git version hash.** I don't see a clean/simple way to append `-aztec` to the reported nargo version.
1. ✅  Put the current compile_and_postprocess script behind a command e.g. `aztec-postprocess-contract` , make it no longer run nargo, but rather just transform the artifact with the transpiler and vk generation.
1. **[TODO]** ⚠️ Ensure devrel update docs promptly to reflect the added compile step for aztec.

## An important note on caching and recompiling
1. The transpiler won't re-transpile a contract that is already transpiled. *Yay!*
3. VK caching is still used. *Yay!*
4. Buuuuut... we can no longer use automatically usee nargo's `--show-artifact-paths` to inform what contracts have actually changed and therefore must be post-processed. So, the "update the artifact sequentially with each generated vk" phase runs for every artifact no matter what. If the source hasn't changed, the result will be the same, but the files will be touched.

Author: dbanks12

avm-transpiler/bootstrap.sh

@@ -6,7 +6,7 @@ cmd=${1:-}
 
 hash=$(hash_str $(../noir/bootstrap.sh hash) $(cache_content_hash .rebuild_patterns))
 
-export GIT_COMMIT="0000000000000000000000000000000000000000"
+export GIT_COMMIT="$(cat ../noir/noir-repo-ref | head -n1)-aztec"
 export SOURCE_DATE_EPOCH=0
 export GIT_DIRTY=false
 export RUSTFLAGS="-Dwarnings"

aztec-nargo/README.md

@@ -0,0 +1,14 @@
+## `aztec-postprocess-contract`
+
+The Aztec compilation process consists of two steps:
+1. `aztec-nargo` which just forwards all arguments to Noir's `nargo` compiler at the version tied to this version of aztec.
+2. `aztec-postprocess-contract` which post-processes the compiled contracts to prepare them for use in the Aztec ecosystem.
+
+### `transpile_contract_and_gen_vks.sh`
+This script provides the core functionality behind the `aztec-postprocess-contract` command available via aztec-up. It performs postprocessing on compiled Noir contracts:
+1. Finds all contract artifacts in `target` directories
+2. Transpiles each artifact using the `avm-transpiler`
+3. Generates verification keys for each artifact using `bb` (`barretenberg`'s binary)
+4. Caches verification keys to speed up subsequent compilations
+
+Example usage: `aztec-postprocess-contract` (via aztec-up) or directly `./transpile_contract_and_gen_vks.sh`

aztec-postprocess-contract/README.md

@@ -1,32 +1,33 @@
 #!/usr/bin/env bash
-# This is a wrapper script for nargo.
-# Pass any args that you'd normally pass to nargo.
-# If the first arg is "compile",
-# run nargo and then postprocess any created artifacts.
+# This script performs postprocessing on compiled Noir contracts.
+# It expects to find compiled artifacts and transforms them via
+# transpilation and verification key generation.
 #
-# Usage: compile_then_postprocess.sh [nargo args]
+# Usage: compile-contract [artifact_path ...]
+# If no paths provided, searches for artifacts in target/ directories
 set -euo pipefail
 
 dir=$(dirname $0)
-NARGO=${NARGO:-"$dir/../noir/noir-repo/target/release/nargo"}
 TRANSPILER=${TRANSPILER:-"$dir/../avm-transpiler/target/release/avm-transpiler"}
 BB=${BB:-"$dir/../barretenberg/cpp/build/bin/bb"}
 
-
-if [ "${1:-}" != "compile" ]; then
-  # if not compiling, just pass through to nargo verbatim
-  $NARGO $@
-  exit $?
-fi
-shift # remove the compile arg so we can inject --show-artifact-paths
-
 # bb --version returns 00000000.00000000.00000000, so we compute
 # the binary hash to ensure we invalidate vk cache artifacts when bb changes
 bb_hash=$(sha256sum "$BB" | cut -d' ' -f1)
 
-# Forward all arguments to nargo, tee output to console.
-# Nargo should be outputting errors to stderr, but it doesn't. Use tee to duplicate stdout to stderr to display errors.
-artifacts_to_process=$($NARGO compile --pedantic-solving --inliner-aggressiveness 0 --show-artifact-paths $@ | tee >(cat >&2) | grep -oP 'Saved contract artifact to: \K.*')
+# If artifact paths are provided as arguments, use those
+# Otherwise, search for contract artifacts in target directories
+if [ $# -gt 0 ]; then
+  artifacts_to_process="$@"
+else
+  # Find all contract artifacts in target directories
+  artifacts_to_process=$(find . -name "*.json" -path "*/target/*" | grep -v "/cache/" | grep -v ".function_artifact_" || true)
+  
+  if [ -z "$artifacts_to_process" ]; then
+    echo "No contract artifacts found. Please compile your contracts first with 'nargo compile'."
+    exit 1
+  fi
+fi
 
 # Postprocess each artifact
 # `$artifacts_to_process` needs to be unquoted here, otherwise it will break if there are multiple artifacts
@@ -82,3 +83,5 @@ for artifact in $artifacts_to_process; do
     mv "$artifact.tmp" "$artifact"
   done
 done
+
+echo "Contract postprocessing complete!"

aztec-nargo/compile_then_postprocess.sh …ntract/transpile_contract_and_gen_vks.shaztec-nargo/compile_then_postprocess.sh renamed to aztec-postprocess-contract/transpile_contract_and_gen_vks.sh aztec-nargo/compile_then_postprocess.sh renamed to aztec-postprocess-contract/transpile_contract_and_gen_vks.sh

@@ -11,7 +11,8 @@ the user's `PATH` variable in their shell startup script so they can be found.
 
 - `aztec` - The infrastructure container.
 - `aztec-cli` - A command-line tool for interacting with infrastructure.
-- `aztec-nargo` - A build of `nargo` from `noir` that is guaranteed to be version-aligned. Provides compiler, lsp and more. On `aztec-nargo compile <...>`, automatically transpiles artifacts using `avm-transpiler` and generates verification keys using `bb`.
+- `aztec-nargo` - A build of `nargo` from `noir` that is guaranteed to be version-aligned. Provides compiler, lsp and more.
+- `aztec-postprocess-contract` - Postprocessing tool for Aztec contracts that transpiles artifacts using `avm-transpiler` and generates verification keys using `bb`.
 - `aztec-sandbox` - A wrapper around docker-compose that launches services needed for sandbox testing.
 - `aztec-up` - A tool to upgrade the aztec toolchain to the latest, or specific versions.
 - `aztec-builder` - A useful tool for projects to generate ABIs and update their dependencies.

aztec-up/README.md

@@ -58,10 +58,11 @@ function title() {
     echo -e "${r}"
   fi
   echo -e "This will install the following scripts and update your PATH if necessary:"
-  echo -e "  ${bold}${g}aztec${r}         - a collection of tools to launch subsystems and interact with the aztec network."
-  echo -e "  ${bold}${g}aztec-nargo${r}   - aztec's build of nargo, the noir compiler toolchain."
-  echo -e "  ${bold}${g}aztec-up${r}      - a tool to upgrade the aztec toolchain to the latest, or specific versions."
-  echo -e "  ${bold}${g}aztec-wallet${r}  - our minimalistic CLI wallet"
+  echo -e "  ${bold}${g}aztec${r}                      - a collection of tools to launch subsystems and interact with the aztec network."
+  echo -e "  ${bold}${g}aztec-nargo${r}                - aztec's build of nargo, the noir compiler toolchain."
+  echo -e "  ${bold}${g}aztec-postprocess-contract${r} - postprocessing tool for Aztec contracts (transpilation and VK generation)."
+  echo -e "  ${bold}${g}aztec-up${r}                   - a tool to upgrade the aztec toolchain to the latest, or specific versions."
+  echo -e "  ${bold}${g}aztec-wallet${r}               - our minimalistic CLI wallet"
   echo
   read -p "Do you wish to continue? (y/n)" -n 1 -r
   echo
@@ -162,6 +163,7 @@ install_bin .aztec-run
 install_bin aztec
 install_bin aztec-up
 install_bin aztec-nargo
+install_bin aztec-postprocess-contract
 install_bin aztec-wallet
 
 update_path_env_var $BIN_PATH

aztec-up/bin/aztec-install

@@ -6,6 +6,10 @@ if [[ $PWD != ${HOME}* ]]; then
   exit 1
 fi
 
+# Special-case nargo's LSP command:
+# 1. include --rm for cleanup
+# 2. don't specify a user (run as root)
+# 3. don't specify a workdir
 if [ "${1:-}" == "lsp" ]; then
   docker run --rm -i \
     --name aztec-nargo-lsp \
@@ -16,6 +20,7 @@ if [ "${1:-}" == "lsp" ]; then
   exit
 fi
 
+# Determine if we need interactive/tty flags
 if [ -t 0 ]; then
   if [ -t 1 ]; then
     args="-ti"
@@ -24,10 +29,11 @@ if [ -t 0 ]; then
   fi
 fi
 
+# Pass through directly to vanilla nargo
 docker run ${args:-} \
   --user $(id -u):$(id -g) \
   -v $HOME:$HOME \
   -e HOME=$HOME \
   --workdir="$PWD" \
-  --entrypoint /usr/src/aztec-nargo/compile_then_postprocess.sh \
+  --entrypoint=/usr/src/noir/noir-repo/target/release/nargo \
   aztecprotocol/aztec "$@"

aztec-up/bin/aztec-nargo

@@ -0,0 +1,25 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+if [[ $PWD != ${HOME}* ]]; then
+  >&2 echo "Due to how we containerize our applications, we require your working directory to be somewhere within $HOME."
+  exit 1
+fi
+
+# Determine if we need interactive/tty flags
+if [ -t 0 ]; then
+  if [ -t 1 ]; then
+    args="-ti"
+  else
+    args="-i"
+  fi
+fi
+
+# Run the aztec-postprocess-contract script from within the container
+docker run ${args:-} \
+  --user $(id -u):$(id -g) \
+  -v $HOME:$HOME \
+  -e HOME=$HOME \
+  --workdir="$PWD" \
+  --entrypoint=/usr/src/aztec-postprocess-contract/transpile_contract_and_gen_vks.sh \
+  aztecprotocol/aztec "$@"

aztec-up/bin/aztec-postprocess-contract

@@ -55,8 +55,11 @@ cp -Rf ./aztec-packages/noir-projects/noir-contracts/contracts/test/counter_cont
 cd counter_contract
 sed -i 's|\.\./\.\./\.\./\.\./|/home/ubuntu/aztec-packages/noir-projects/|g' Nargo.toml
 
-# Compile and codegen.
+# Compile the contract.
 aztec-nargo compile
+# Post-process the contract.
+aztec-postprocess-contract
+# Codegen
 aztec codegen -o src/artifacts target
 if [ ! -d src/artifacts ]; then
   echo "Failed to codegen TypeScript."

aztec-up/test/counter_contract.sh

@@ -229,13 +229,13 @@ function build {
     noir-projects
     l1-contracts
     yarn-project
+    release-image
   )
   # These projects can be built in parallel.
   parallel_cmds=(
     boxes/bootstrap.sh
     playground/bootstrap.sh
     docs/bootstrap.sh
-    release-image/bootstrap.sh
     spartan/bootstrap.sh
     aztec-up/bootstrap.sh
   )