refactor(common,cli): kms deployer gets keyId from environment

.changeset/quick-lions-rest.md

@@ -0,0 +1,6 @@
+---
+"@latticexyz/common": patch
+"@latticexyz/cli": patch
+---
+
+The key ID for deploying via KMS signer is now set in the AWS_KMS_KEY_ID environment variable, instead of with a CLI flag. Correspondingly, the flag to enable KMS signing is now a `boolean` `--kms` instead of `--awsKmsKeyId`.

packages/cli/src/commands/dev-contracts.ts

@@ -92,7 +92,7 @@ const commandModule: CommandModule<typeof devOptions, InferredOptionTypes<typeof
             worldAddress,
             srcDir,
             salt: "0x",
-            awsKmsKeyId: undefined,
+            kms: undefined,
           });
           worldAddress = deploy.address;
           // if there were changes while we were deploying, trigger it again

packages/cli/src/runDeploy.ts

@@ -43,9 +43,9 @@ export const deployOptions = {
     type: "string",
     desc: "The deployment salt to use. Defaults to a random salt.",
   },
-  awsKmsKeyId: {
-    type: "string",
-    desc: "Optional AWS KMS key ID. If set, the World is deployed using a KMS signer instead of local private key.",
+  kms: {
+    type: "boolean",
+    desc: "Deploy the World with an AWS KMS key instead of local private key.",
   },
 } as const satisfies Record<string, Options>;
 
@@ -87,9 +87,8 @@ export async function runDeploy(opts: DeployOptions): Promise<WorldDeploy> {
   const resolvedConfig = resolveConfig({ config, forgeSourceDir: srcDir, forgeOutDir: outDir });
 
   const account = await (async () => {
-    if (opts.awsKmsKeyId) {
-      const keyId = opts.awsKmsKeyId ?? process.env.AWS_KMS_KEY_ID;
-      return await kmsKeyToAccount({ keyId });
+    if (opts.kms) {
+      return await kmsKeyToAccount();
     } else {
       const privateKey = process.env.PRIVATE_KEY;
       if (!privateKey) {

packages/common/src/account/kms/getAddressFromKms.ts

@@ -1,6 +1,6 @@
 import { Address, toHex } from "viem";
 import { publicKeyToAddress } from "viem/utils";
-import { KMSClient, SignCommandInput } from "@aws-sdk/client-kms";
+import { GetPublicKeyCommandInput, KMSClient } from "@aws-sdk/client-kms";
 import { getPublicKey } from "./getPublicKey";
 // @ts-expect-error Could not find a declaration file for module 'asn1.js'.
 import asn1 from "asn1.js";
@@ -25,7 +25,7 @@ export async function getAddressFromKms({
   keyId,
   client,
 }: {
-  keyId: SignCommandInput["KeyId"];
+  keyId: GetPublicKeyCommandInput["KeyId"];
   client: KMSClient;
 }): Promise<Address> {
   const KMSKey = await getPublicKey({ keyId, client });

packages/common/src/account/kms/kmsKeyToAccount.ts

@@ -3,9 +3,10 @@ import { LocalAccount, hashMessage, hashTypedData, keccak256, serializeTransacti
 import { toAccount } from "viem/accounts";
 import { signWithKms } from "./signWithKms";
 import { getAddressFromKms } from "./getAddressFromKms";
+import { MUDError } from "../../errors";
 
 export type KmsKeyToAccountOptions = {
-  keyId: string;
+  keyId?: string;
   client?: KMSClient;
 };
 
@@ -19,11 +20,15 @@ export type KmsAccount = LocalAccount<"aws-kms"> & {
  * @returns A Local Account.
  */
 export async function kmsKeyToAccount({
-  keyId,
+  keyId = process.env.AWS_KMS_KEY_ID,
   client = new KMSClient(),
-}: KmsKeyToAccountOptions): Promise<KmsAccount> {
+}: KmsKeyToAccountOptions = {}): Promise<KmsAccount> {
   const address = await getAddressFromKms({ keyId, client });
 
+  if (!keyId) {
+    throw new MUDError("Missing AWS KMS Key ID");
+  }
+
   const account = toAccount({
     address,
     async signMessage({ message }) {