chore(next): move to aztec 6.0.0-rc.1 and target the v6 testnet

.github/actions/export-network-api-keys/action.yml

@@ -0,0 +1,26 @@
+name: Export network API keys
+description: >
+  Exposes every `<ID>_API_KEY` repo secret to later steps as `VITE_<ID>_API_KEY`, the build-time
+  env var shared/src/config/networks.ts reads each network's node API key from (`<ID>` is the
+  network id in upper snake case, e.g. `TESTNET_API_KEY` for `testnet`). Adding a network behind an
+  API gateway only needs a secret with the matching name, no workflow changes. The keys end up in
+  the client bundles by design.
+
+inputs:
+  secrets:
+    description: The caller's secrets, as `toJSON(secrets)`.
+    required: true
+
+runs:
+  using: composite
+  steps:
+    - shell: bash
+      env:
+        SECRETS_JSON: ${{ inputs.secrets }}
+      run: |
+        echo "$SECRETS_JSON" | jq -r '
+          to_entries[]
+          | select(.key | test("^[A-Z0-9_]+_API_KEY$"))
+          | "VITE_\(.key)<<__API_KEY_EOF__\n\(.value)\n__API_KEY_EOF__"
+        ' >> "$GITHUB_ENV"
+        echo "$SECRETS_JSON" | jq -r 'keys[] | select(test("^[A-Z0-9_]+_API_KEY$")) | "Exported VITE_\(.)"'

.github/workflows/build-artifacts.yml

@@ -128,6 +128,11 @@ jobs:
       - name: Install dependencies
         run: yarn install --immutable
 
+      - name: Export network API keys
+        uses: ./.github/actions/export-network-api-keys
+        with:
+          secrets: ${{ toJSON(secrets) }}
+
       - name: Build Electron app (development)
         if: ${{ !inputs.release-mode }}
         working-directory: ./app

.github/workflows/ci.yml

@@ -49,6 +49,9 @@ jobs:
     with:
       release-mode: false
       retention-days: 7
+    # Network API keys (`*_API_KEY`) for the Electron dev build. Fork PRs get no secrets, so
+    # their builds come out keyless.
+    secrets: inherit
 
   # Sentinel job. `deploy-web.yml` on `pull_request_target` waits for this
   # single stable check name before deploying a preview — avoids coupling

.github/workflows/deploy-web.yml

@@ -108,6 +108,20 @@ jobs:
       - name: Install Vercel CLI
         run: npm install --global vercel@latest
 
+      # Same as .github/actions/export-network-api-keys, inlined on purpose: under
+      # pull_request_target the checkout above is the PR head, so a local action would run the
+      # PR's copy with every secret. This step comes from the base ref's workflow file, and
+      # only the API keys (public in the bundle anyway) reach the PR code after it.
+      - name: Export network API keys
+        env:
+          SECRETS_JSON: ${{ toJSON(secrets) }}
+        run: |
+          echo "$SECRETS_JSON" | jq -r '
+            to_entries[]
+            | select(.key | test("^[A-Z0-9_]+_API_KEY$"))
+            | "VITE_\(.key)<<__API_KEY_EOF__\n\(.value)\n__API_KEY_EOF__"
+          ' >> "$GITHUB_ENV"
+
       - name: Pull Vercel environment
         working-directory: ./web
         run: vercel pull --yes --environment=production --token=${{ secrets.VERCEL_TOKEN }}

.github/workflows/release.yml

@@ -38,6 +38,7 @@ jobs:
     with:
       release-mode: true
       retention-days: 30
+    secrets: inherit
 
   create-release:
     name: Create GitHub Release
@@ -86,6 +87,11 @@ jobs:
       - name: Install Vercel CLI
         run: npm install --global vercel@latest
 
+      - name: Export network API keys
+        uses: ./.github/actions/export-network-api-keys
+        with:
+          secrets: ${{ toJSON(secrets) }}
+
       - name: Pull Vercel environment
         working-directory: ./web
         run: vercel pull --yes --environment=production --token=${{ secrets.VERCEL_TOKEN }}

.gitignore

@@ -2,4 +2,5 @@
 node_modules
 .vercel
 .yarn/install-state.gz
-.turbo
+.turbo
+.env*.local

CLAUDE.MD

@@ -86,7 +86,7 @@ The wallet implements a **capability-based authorization model** where dApps req
 
 ### Capability Types
 
-Six capability types from `@aztec/aztec.js/wallet`:
+Six capability types from `@aztec-labs/aztec.js/wallet`:
 
 #### 1. Accounts Capability
 ```typescript
@@ -193,7 +193,7 @@ Authorization manager supports progressive wildcard matching:
 
 ### WalletDB (`wallet-db.ts`)
 
-Uses LMDB (via `@aztec/kv-store/lmdb-v2`) for persistent storage:
+Uses LMDB (via `@aztec-labs/kv-store/lmdb-v2`) for persistent storage:
 
 | Store | Purpose |
 |-------|---------|

README.md

@@ -26,7 +26,7 @@ node scripts/update.js --skip-install                               # skip yarn
 node scripts/update.js --skip-aztec-up                              # skip Aztec CLI install
 ```
 
-Updates `@aztec/*` deps across every workspace (`app/`, `shared/`, `web/`, `extension/`), runs `yarn install`, and refreshes the rollup version for every non-local network in `shared/src/config/networks.ts` by calling `node_getNodeInfo` against each network's configured `nodeUrl`.
+Updates `@aztec-labs/*` deps across every workspace (`app/`, `shared/`, `web/`, `extension/`), runs `yarn install`, and refreshes the rollup version for every non-local network in `shared/src/config/networks.ts` by calling `node_getNodeInfo` against each network's configured `nodeUrl`.
 
 ## Development Setup
 
@@ -36,6 +36,18 @@ Updates `@aztec/*` deps across every workspace (`app/`, `shared/`, `web/`, `exte
 - yarn
 - A running Aztec local node (or access to a remote node)
 
+### Network API keys
+
+Networks behind an API gateway (e.g. `testnet`, `https://testnet-v6.rpc2.aztec-labs.com`, Sepolia L1) need a key, sent as the `x-api-key` header on every node request. Each network's key is baked in at build time from `VITE_<ID>_API_KEY`, where `<ID>` is the network id from `shared/src/config/networks.ts` in upper snake case (`testnet` → `VITE_TESTNET_API_KEY`). Networks without a key are called unauthenticated.
+
+Locally, export it before starting/building, or put it in a gitignored `.env.local` next to the Vite config you're running (`app/` or `web/`):
+
+```bash
+echo 'VITE_TESTNET_API_KEY=<your key>' > app/.env.local
+```
+
+In CI, add a repo secret named `<ID>_API_KEY` (e.g. `TESTNET_API_KEY`). The web deploys and the Electron release build export every `*_API_KEY` secret as `VITE_*_API_KEY` before building (`.github/actions/export-network-api-keys`), so a new network only needs its secret, no workflow changes. The keys end up in the client bundles.
+
 ### Running in Development Mode
 
 Follow these steps to run the wallet in development mode:
@@ -220,11 +232,11 @@ Replace:
 The system-wide native messaging dir is **browser-specific**. Install the manifest in the
 dir for the browser WXT actually launches:
 
-| Browser       | System-wide dir                              |
-| ------------- | -------------------------------------------- |
-| Google Chrome | `/etc/opt/chrome/native-messaging-hosts/`    |
-| Chromium      | `/etc/chromium/native-messaging-hosts/`      |
-| Brave         | `/etc/brave/native-messaging-hosts/`         |
+| Browser       | System-wide dir                           |
+| ------------- | ----------------------------------------- |
+| Google Chrome | `/etc/opt/chrome/native-messaging-hosts/` |
+| Chromium      | `/etc/chromium/native-messaging-hosts/`   |
+| Brave         | `/etc/brave/native-messaging-hosts/`      |
 
 > On Arch-based distros (e.g. CachyOS) the default browser is usually **Chromium**, which
 > uses `/etc/chromium/native-messaging-hosts/` — not Chrome's `/etc/opt/chrome/...`.

app/forge.config.ts

@@ -21,7 +21,7 @@ type CustomWalker = CopyClass<Walker> & {
   walkDependenciesForModule: (moduleRoot: string, depType: DepType) => Promise<void>;
 };
 
-const externalDependencies = ["@aztec/kv-store", "@aztec/bb.js"];
+const externalDependencies = ["@aztec-labs/kv-store", "@aztec-foundation/bb.js"];
 
 // Map to swap dependency names: key = dependency name to copy, value = source package name
 const dependencyMap: Record<string, string> = {

app/package.json

@@ -51,21 +51,21 @@
     "vite-plugin-static-copy": "^3.1.2"
   },
   "dependencies": {
-    "@aztec/accounts": "5.0.0-nightly.20260618",
-    "@aztec/aztec.js": "5.0.0-nightly.20260618",
-    "@aztec/bb.js": "5.0.0-nightly.20260618",
-    "@aztec/blob-lib": "5.0.0-nightly.20260618",
-    "@aztec/constants": "5.0.0-nightly.20260618",
-    "@aztec/entrypoints": "5.0.0-nightly.20260618",
-    "@aztec/ethereum": "5.0.0-nightly.20260618",
-    "@aztec/foundation": "5.0.0-nightly.20260618",
-    "@aztec/kv-store": "5.0.0-nightly.20260618",
-    "@aztec/noir-contracts.js": "5.0.0-nightly.20260618",
-    "@aztec/noir-noirc_abi": "5.0.0-nightly.20260618",
-    "@aztec/protocol-contracts": "5.0.0-nightly.20260618",
-    "@aztec/pxe": "5.0.0-nightly.20260618",
-    "@aztec/stdlib": "5.0.0-nightly.20260618",
-    "@aztec/wallet-sdk": "5.0.0-nightly.20260618",
+    "@aztec-foundation/bb.js": "6.0.0-rc.1",
+    "@aztec-foundation/noir-noirc_abi": "6.0.0-rc.1",
+    "@aztec-labs/accounts": "6.0.0-rc.1",
+    "@aztec-labs/aztec.js": "6.0.0-rc.1",
+    "@aztec-labs/blob-lib": "6.0.0-rc.1",
+    "@aztec-labs/constants": "6.0.0-rc.1",
+    "@aztec-labs/entrypoints": "6.0.0-rc.1",
+    "@aztec-labs/ethereum": "6.0.0-rc.1",
+    "@aztec-labs/foundation": "6.0.0-rc.1",
+    "@aztec-labs/kv-store": "6.0.0-rc.1",
+    "@aztec-labs/noir-contracts.js": "6.0.0-rc.1",
+    "@aztec-labs/protocol-contracts": "6.0.0-rc.1",
+    "@aztec-labs/pxe": "6.0.0-rc.1",
+    "@aztec-labs/stdlib": "6.0.0-rc.1",
+    "@aztec-labs/wallet-sdk": "6.0.0-rc.1",
     "@demo-wallet/shared": "workspace:*",
     "@emotion/react": "^11.14.0",
     "@emotion/styled": "^11.14.0",

app/scripts/copyBB.cjs

@@ -5,10 +5,10 @@ const { execSync } = require("child_process");
 // Read package.json to get bb.js version
 const packageJsonPath = path.join(__dirname, "../package.json");
 const packageJson = JSON.parse(fs.readFileSync(packageJsonPath, "utf8"));
-const bbJsVersion = packageJson.dependencies["@aztec/bb.js"];
+const bbJsVersion = packageJson.dependencies["@aztec-foundation/bb.js"];
 
 if (!bbJsVersion) {
-  console.error("✗ @aztec/bb.js version not found in package.json");
+  console.error("✗ @aztec-foundation/bb.js version not found in package.json");
   process.exit(1);
 }
 
@@ -53,7 +53,7 @@ function getPlatformArch() {
 // Main function
 async function main() {
   // Source paths
-  const BB_FOLDER = path.resolve(__dirname, "../../node_modules/@aztec/bb.js");
+  const BB_FOLDER = path.resolve(__dirname, "../../node_modules/@aztec-foundation/bb.js");
 
   const BB_WASM_SOURCE = path.join(
     BB_FOLDER,

app/src/ipc/preload.ts

@@ -1,7 +1,7 @@
-import type { Aliased } from "@aztec/aztec.js/wallet";
-import type { AztecAddress } from "@aztec/aztec.js/addresses";
+import type { Aliased } from "@aztec-labs/aztec.js/wallet";
+import type { AztecAddress } from "@aztec-labs/aztec.js/addresses";
 import { contextBridge, ipcRenderer } from "electron";
-import type { TxHash, TxReceipt } from "@aztec/stdlib/tx";
+import type { TxHash, TxReceipt } from "@aztec-labs/stdlib/tx";
 import type { WalletInteraction, WalletInteractionType } from "@demo-wallet/shared/core";
 
 contextBridge.exposeInMainWorld("walletAPI", {
@@ -32,14 +32,14 @@
   clearInteractions(stringifiedArgs: string): Promise<void> {
     return ipcRenderer.invoke("clearInteractions", stringifiedArgs);
   },
   getExecutionTrace(stringifiedArgs: string): Promise<any> {
     return ipcRenderer.invoke("getExecutionTrace", stringifiedArgs);
   },
   // App authorization management
   listAuthorizedApps(stringifiedArgs: string): Promise<string[]> {
     return ipcRenderer.invoke("listAuthorizedApps", stringifiedArgs);
   },
   getAppCapabilities(stringifiedArgs: string): Promise<any> {
     return ipcRenderer.invoke("getAppCapabilities", stringifiedArgs);
   },
   resolveContractNames(stringifiedArgs: string): Promise<Record<string, string>> {

app/src/ipc/wallet-internal-proxy.ts

@@ -1,5 +1,5 @@
-import { promiseWithResolvers, type PromiseWithResolvers } from "@aztec/foundation/promise";
-import { schemaHasMethod } from "@aztec/foundation/schemas";
+import { promiseWithResolvers, type PromiseWithResolvers } from "@aztec-labs/foundation/promise";
+import { schemaHasMethod } from "@aztec-labs/foundation/schemas";
 import type { MessagePortMain } from "electron/main";
 import {
   type InternalWalletInterface,
@@ -14,7 +14,7 @@
 };
 
 export class WalletInternalProxy {
   private inFlight = new Map<string, PromiseWithResolvers<any>>();
   private internalEventCallback!: OnWalletUpdateListener;
   private authRequestCallback!: OnAuthorizationRequestListener;
   private proofDebugExportCallback!: OnProofDebugExportRequestListener;
@@ -73,7 +73,7 @@
     return new Proxy(wallet, {
       get: (target, prop) => {
         if (schemaHasMethod(InternalWalletInterfaceSchema, prop.toString())) {
           return async (...args: any[]) => {
             return target.postMessage({
               type: prop.toString() as keyof FunctionsOf<InternalWalletInterface>,
               args,
@@ -91,7 +91,7 @@
     args,
   }: {
     type: keyof FunctionsOf<InternalWalletInterface>;
     args: any[];
   }) {
     const messageId = globalThis.crypto.randomUUID();
     const appId = "this";
@@ -104,7 +104,7 @@
       chainInfo: { chainId, version },
     };
     this.internalPort.postMessage(message);
     const { promise, resolve, reject } = promiseWithResolvers<any>();
     this.inFlight.set(messageId, { promise, resolve, reject });
     return promise;
   }

app/src/ui/utils/wallet-api.ts

@@ -1,9 +1,9 @@
-import { getSchemaReturnType, schemaHasMethod, type Fr } from "@aztec/foundation/schemas";
+import { getSchemaReturnType, schemaHasMethod, type Fr } from "@aztec-labs/foundation/schemas";
 import {
   type InternalWalletInterface,
   InternalWalletInterfaceSchema,
 } from "@demo-wallet/shared/core";
-import { jsonStringify } from "@aztec/foundation/json-rpc";
+import { jsonStringify } from "@aztec-labs/foundation/json-rpc";
 
 export class WalletApi {
   private constructor(chainId: Fr, version: Fr) {

app/src/utils/logger.ts

@@ -1,6 +1,6 @@
-import { createLogger, type Logger } from "@aztec/aztec.js/log";
+import { createLogger, type Logger } from "@aztec-labs/aztec.js/log";
 import type { MessagePortMain } from "electron";
-import { jsonStringify } from "@aztec/foundation/json-rpc";
+import { jsonStringify } from "@aztec-labs/foundation/json-rpc";
 
 const logLevel = ["silent", "fatal", "error", "warn", "info", "verbose", "debug", "trace"] as const;
 type LogLevel = (typeof logLevel)[number];

app/src/workers/wallet-worker.ts

@@ -1,35 +1,35 @@
-import { createAztecNodeClient } from "@aztec/aztec.js/node";
-import { type ChainInfo } from "@aztec/aztec.js/account";
-import { WalletSchema } from "@aztec/aztec.js/wallet";
-import { Fr } from "@aztec/aztec.js/fields";
-import { getSchemaParameters, parseWithOptionals, schemaHasMethod } from "@aztec/foundation/schemas";
-import { jsonStringify } from "@aztec/foundation/json-rpc";
+import { type ChainInfo } from "@aztec-labs/aztec.js/account";
+import { WalletSchema } from "@aztec-labs/aztec.js/wallet";
+import { Fr } from "@aztec-labs/aztec.js/fields";
+import { getSchemaParameters, parseWithOptionals, schemaHasMethod } from "@aztec-labs/foundation/schemas";
+import { jsonStringify } from "@aztec-labs/foundation/json-rpc";
 import type { MessagePortMain } from "electron";
 import {
   ExternalWallet,
   InternalWallet,
   WalletDB,
   InternalWalletInterfaceSchema,
   getNetworkByChainId,
+  createNodeClient,
 } from "@demo-wallet/shared/core";
 import { createProxyLogger } from "../utils/logger.ts";
-import type { Logger } from "@aztec/foundation/log";
+import type { Logger } from "@aztec-labs/foundation/log";
 import type { AuthorizationRequest, AuthorizationResponse } from "@demo-wallet/shared/core";
 import {
   createPXE,
   getPXEConfig,
   type PXEConfig,
   type PXECreationOptions,
-} from "@aztec/pxe/server";
-import { schemas } from "@aztec/stdlib/schemas";
+} from "@aztec-labs/pxe/server";
+import { schemas } from "@aztec-labs/stdlib/schemas";
 
-import { createStore } from "@aztec/kv-store/lmdb-v2";
+import { createStore } from "@aztec-labs/kv-store/lmdb-v2";
 import { resolve, join } from "node:path";
 import { z } from "zod";
 import { homedir } from "node:os";
 import { inspect } from "node:util";
-import type { PromiseWithResolvers } from "@aztec/foundation/promise";
-import { BackendType } from "@aztec/bb.js";
+import type { PromiseWithResolvers } from "@aztec-labs/foundation/promise";
+import { BackendType } from "@aztec-foundation/bb.js";
 
 const ChainInfoSchema = z.object({
   chainId: schemas.Fr,
@@ -62,7 +62,7 @@ async function init(
       `Unknown network: chainId=${chainInfo.chainId.toNumber()}, version=${chainInfo.version.toNumber()}`,
     );
   }
-  const node = createAztecNodeClient(network.nodeUrl!);
+  const node = createNodeClient(network);
   if (chainInfo.version.equals(new Fr(0))) {
     const { rollupVersion } = await node.getNodeInfo();
     chainInfo.version = new Fr(rollupVersion);

app/tsconfig.json

@@ -23,5 +23,5 @@
     "allowArbitraryExtensions": true,
     "allowSyntheticDefaultImports": true
   },
-  "include": ["src/**/*", "wallet-api.d.ts", "forge.env.d.ts"]
+  "include": ["src/**/*", "wallet-api.d.ts", "forge.env.d.ts", "../shared/src/env.d.ts"]
 }

app/vite.main.config.ts

@@ -78,7 +78,7 @@ export default defineConfig({
       // Our pino logger gets confused by electron, and tries to use the
       // default nodejs transports in a web worker. This breaks everything since
       // this app runs with nodeIntegration: false,
-      // so for the time being I'm using the escape hatch of making @aztec/foundation pino
+      // so for the time being I'm using the escape hatch of making @aztec-labs/foundation pino
       // logger think we're in a jest test. Hehe.
       JEST_WORKER_ID: "1",
       LOG_LEVEL: "verbose",

app/vite.renderer.config.ts

@@ -1,8 +1,17 @@
 import { defineConfig, type Plugin } from "vite";
 import { resolve } from "node:path";
+import { readFileSync } from "node:fs";
 import react from "@vitejs/plugin-react-swc";
 import { PolyfillOptions, nodePolyfills } from "vite-plugin-node-polyfills";
 
+// The Aztec SDK version the wallet is built against, read from this workspace's pinned
+// @aztec-labs/aztec.js dependency and exposed to the UI via the `__AZTEC_SDK_VERSION__` define.
+const aztecSdkVersion = (
+  JSON.parse(readFileSync(resolve(import.meta.dirname, "package.json"), "utf-8")).dependencies?.[
+    "@aztec-labs/aztec.js"
+  ] ?? "unknown"
+).replace(/^[\^~]/, "");
+
 const nodePolyfillsFix = (options?: PolyfillOptions | undefined): Plugin => {
   return {
     ...nodePolyfills(options),
@@ -35,4 +44,7 @@ export default defineConfig({
     react({ jsxImportSource: "@emotion/react" }),
     nodePolyfillsFix({ include: ["buffer", "path"] }),
   ],
+  define: {
+    __AZTEC_SDK_VERSION__: JSON.stringify(aztecSdkVersion),
+  },
 });

app/vite.worker.config.ts

@@ -4,7 +4,7 @@ export default defineConfig({
   build: {
     rollupOptions: {
       // This is required due to unfortunate electron-forge weirdness
-      external: ["@aztec/kv-store/lmdb-v2", "@aztec/bb.js"],
+      external: ["@aztec-labs/kv-store/lmdb-v2", "@aztec-foundation/bb.js"],
     },
   },
 });

extension/entrypoints/background.ts

@@ -1,5 +1,5 @@
-import { BackgroundConnectionHandler } from "@aztec/wallet-sdk/extension/handlers";
-import { WalletMessageType, type WalletResponse } from "@aztec/wallet-sdk/types";
+import { BackgroundConnectionHandler } from "@aztec-labs/wallet-sdk/extension/handlers";
+import { WalletMessageType, type WalletResponse } from "@aztec-labs/wallet-sdk/types";
 import { ChunkReassembler } from "../utils/chunk_reassembler";
 
 // Wallet configuration

extension/entrypoints/content.ts

@@ -1,4 +1,4 @@
-import { ContentScriptConnectionHandler } from "@aztec/wallet-sdk/extension/handlers";
+import { ContentScriptConnectionHandler } from "@aztec-labs/wallet-sdk/extension/handlers";
 
 /**
  * Content script that acts as a pure message relay between the web page and the background script.

extension/entrypoints/popup/App.tsx

@@ -1,5 +1,5 @@
 import { useEffect, useState } from "react";
-import { hashToEmoji } from "@aztec/wallet-sdk/crypto";
+import { hashToEmoji } from "@aztec-labs/wallet-sdk/crypto";
 import "./App.css";
 
 type Tab = "activity" | "settings";