feat(cli): deploy with kms (#2704)

Co-authored-by: Kevin Ingersoll <[email protected]>

.changeset/early-teachers-greet.md

@@ -0,0 +1,5 @@
+---
+"@latticexyz/cli": patch
+---
+
+Added a `--awsKmsKeyId` flag to `mud deploy` that deploys the world using an AWS KMS key as a transaction signer.

packages/cli/package.json

@@ -30,6 +30,7 @@
     "test:ci": "pnpm run test"
   },
   "dependencies": {
+    "@aws-sdk/client-kms": "^3.556.0",
     "@ethersproject/abi": "^5.7.0",
     "@ethersproject/providers": "^5.7.2",
     "@improbable-eng/grpc-web": "^0.15.0",
@@ -45,6 +46,7 @@
     "@latticexyz/utils": "workspace:*",
     "@latticexyz/world": "workspace:*",
     "@latticexyz/world-modules": "workspace:*",
+    "asn1.js": "^5.4.1",
     "chalk": "^5.0.1",
     "chokidar": "^3.5.3",
     "debug": "^4.3.4",

packages/cli/src/commands/dev-contracts.ts

@@ -92,6 +92,7 @@ const commandModule: CommandModule<typeof devOptions, InferredOptionTypes<typeof
             worldAddress,
             srcDir,
             salt: "0x",
+            awsKmsKeyId: undefined,
           });
           worldAddress = deploy.address;
           // if there were changes while we were deploying, trigger it again

packages/cli/src/runDeploy.ts

@@ -15,6 +15,7 @@ import { getChainId } from "viem/actions";
 import { postDeploy } from "./utils/postDeploy";
 import { WorldDeploy } from "./deploy/common";
 import { build } from "./build";
+import { kmsKeyToAccount } from "@latticexyz/common/kms";
 
 export const deployOptions = {
   configPath: { type: "string", desc: "Path to the MUD config file" },
@@ -42,6 +43,10 @@ export const deployOptions = {
     type: "string",
     desc: "The deployment salt to use. Defaults to a random salt.",
   },
+  awsKmsKeyId: {
+    type: "string",
+    desc: "Optional AWS KMS key ID. If set, the World is deployed using a KMS signer instead of local private key.",
+  },
 } as const satisfies Record<string, Options>;
 
 export type DeployOptions = InferredOptionTypes<typeof deployOptions>;
@@ -90,6 +95,9 @@ in your contracts directory to use the default anvil private key.`,
 
   const resolvedConfig = resolveConfig({ config, forgeSourceDir: srcDir, forgeOutDir: outDir });
 
+  const keyId = opts.awsKmsKeyId ?? process.env.AWS_KMS_KEY_ID;
+  const account = keyId ? await kmsKeyToAccount({ keyId }) : privateKeyToAccount(privateKey);
+
   const client = createWalletClient({
     transport: http(rpc, {
       batch: opts.rpcBatch
@@ -99,7 +107,7 @@ in your contracts directory to use the default anvil private key.`,
           }
         : undefined,
     }),
-    account: privateKeyToAccount(privateKey),
+    account,
   });
 
   console.log("Deploying from", client.account.address);

packages/common/src/account/kms/kmsKeyToAccount.ts

@@ -18,7 +18,6 @@ export type KmsAccount = LocalAccount<"aws-kms"> & {
  *
  * @returns A Local Account.
  */
-
 export async function kmsKeyToAccount({
   keyId,
   client = new KMSClient(),