@aztec-labs/cli 6.0.0-nightly.20260829

package/dest/cmds/validator_keys/shared.js

@@ -0,0 +1,352 @@
+import { prettyPrintJSON } from '@aztec-labs/cli/utils';
+import { asyncPool } from '@aztec-labs/foundation/async-pool';
+import { deriveBlsPrivateKey } from '@aztec-labs/foundation/crypto/bls';
+import { createBn254Keystore } from '@aztec-labs/foundation/crypto/bls/bn254_keystore';
+import { computeBn254G1PublicKeyCompressed } from '@aztec-labs/foundation/crypto/bn254';
+import { EthAddress } from '@aztec-labs/foundation/eth-address';
+import { Wallet } from '@ethersproject/wallet';
+import { constants as fsConstants, mkdirSync } from 'fs';
+import { access, writeFile } from 'fs/promises';
+import { availableParallelism, homedir } from 'os';
+import { dirname, isAbsolute, join } from 'path';
+import { mnemonicToAccount } from 'viem/accounts';
+import { Worker } from 'worker_threads';
+import { defaultBlsPath } from './utils.js';
+// ethers' default scrypt parameters use substantial memory, so keep worker fan-out bounded.
+const maxEthKeystoreWorkers = Math.max(1, Math.min(4, availableParallelism()));
+function deserializeWorkerError(error) {
+    const result = new Error(error.message);
+    result.name = error.name ?? result.name;
+    result.stack = error.stack;
+    return result;
+}
+function encryptEthJsonV3InWorker(privateKeyHex, password) {
+    return new Promise((resolve, reject)=>{
+        // @dependency ./eth_json_v3_worker.ts
+        const worker = new Worker(new URL('./eth_json_v3_worker.js', import.meta.url), {
+            workerData: {
+                privateKeyHex,
+                password
+            }
+        });
+        let settled = false;
+        worker.once('message', (result)=>{
+            settled = true;
+            if ('json' in result) {
+                resolve(result.json);
+            } else {
+                reject(deserializeWorkerError(result.error));
+            }
+        });
+        worker.once('error', (error)=>{
+            settled = true;
+            reject(error);
+        });
+        worker.once('exit', (code)=>{
+            if (!settled) {
+                reject(new Error(`ETH JSON V3 worker stopped with exit code ${code}`));
+            }
+        });
+    });
+}
+async function encryptEthJsonV3(privateKeyHex, password) {
+    if (process.env.JEST_WORKER_ID !== undefined) {
+        return await new Wallet(privateKeyHex).encrypt(password);
+    }
+    return await encryptEthJsonV3InWorker(privateKeyHex, password);
+}
+export function withValidatorIndex(path, accountIndex = 0, addressIndex = 0) {
+    // NOTE: The legacy BLS CLI is to allow users who generated keys in 2.1.4 to be able to use the same command
+    // to re-generate their keys. In 2.1.5 we switched how we append addresses to the path so this is to maintain backwards compatibility.
+    const useLegacyBlsCli = [
+        'true',
+        '1',
+        'yes',
+        'y'
+    ].includes(process.env.LEGACY_BLS_CLI ?? '');
+    const defaultBlsPathParts = defaultBlsPath.split('/');
+    const parts = path.split('/');
+    if (parts.length == defaultBlsPathParts.length && parts.every((part, index)=>part === defaultBlsPathParts[index])) {
+        if (useLegacyBlsCli) {
+            // In 2.1.4, we were using address-index in parts[3] and did NOT use account-index, check lines 32 & 84
+            // https://github.com/AztecProtocol/aztec-packages/blob/v2.1.4/yarn-project/cli/src/cmds/validator_keys/shared.ts
+            parts[3] = String(addressIndex);
+        } else {
+            parts[3] = String(accountIndex);
+            parts[5] = String(addressIndex);
+        }
+        return parts.join('/');
+    }
+    return path;
+}
+/**
+ * Compute a compressed BN254 G1 public key from a private key.
+ * @param privateKeyHex - Private key as 0x-prefixed hex string
+ * @returns Compressed G1 point (32 bytes with sign bit in MSB)
+ */ export async function computeBlsPublicKeyCompressed(privateKeyHex) {
+    return await computeBn254G1PublicKeyCompressed(privateKeyHex);
+}
+export function deriveEthAttester(mnemonic, baseAccountIndex, addressIndex, remoteSigner) {
+    const acct = mnemonicToAccount(mnemonic, {
+        accountIndex: baseAccountIndex,
+        addressIndex
+    });
+    return remoteSigner ? {
+        address: acct.address,
+        remoteSignerUrl: remoteSigner
+    } : '0x' + Buffer.from(acct.getHdKey().privateKey).toString('hex');
+}
+/**
+ * Resolve a `--funding-account` value into a keystore `EthAccount`. A 66-char value is a private key
+ * (used verbatim). A 42-char value is an address: with an explicit `remoteSigner` URL it becomes an
+ * `{ address, remoteSignerUrl }` pair; without one it is stored as a bare address that falls back to
+ * the keystore-level remote signer at runtime. Callers must validate the value first (see
+ * `validateFundingAccountOptions`).
+ */ export function resolveFundingAccount(fundingAccount, remoteSigner) {
+    if (fundingAccount.length === 66) {
+        return fundingAccount;
+    }
+    const address = EthAddress.fromString(fundingAccount);
+    return remoteSigner ? {
+        address,
+        remoteSignerUrl: remoteSigner
+    } : address;
+}
+export async function buildValidatorEntries(input) {
+    const { validatorCount, publisherCount = 0, publishers, accountIndex, baseAddressIndex, mnemonic, ikm, blsPath, feeRecipient, coinbase, remoteSigner } = input;
+    const summaries = [];
+    const validators = await Promise.all(Array.from({
+        length: validatorCount
+    }, async (_unused, i)=>{
+        const addressIndex = baseAddressIndex + i;
+        const basePath = blsPath ?? defaultBlsPath;
+        const perValidatorPath = withValidatorIndex(basePath, accountIndex, addressIndex);
+        const blsPrivKey = ikm || mnemonic ? deriveBlsPrivateKey(mnemonic, ikm, perValidatorPath) : undefined;
+        const blsPubCompressed = blsPrivKey ? await computeBlsPublicKeyCompressed(blsPrivKey) : undefined;
+        const ethAttester = deriveEthAttester(mnemonic, accountIndex, addressIndex, remoteSigner);
+        const attester = blsPrivKey ? {
+            eth: ethAttester,
+            bls: blsPrivKey
+        } : ethAttester;
+        let publisherField;
+        const publisherAddresses = [];
+        if (publishers && publishers.length > 0) {
+            publisherAddresses.push(...publishers);
+            publisherField = publishers.length === 1 ? publishers[0] : publishers;
+        } else if (publisherCount > 0) {
+            const publishersBaseIndex = baseAddressIndex + validatorCount + i * publisherCount;
+            const publisherAccounts = Array.from({
+                length: publisherCount
+            }, (_unused2, j)=>{
+                const publisherAddressIndex = publishersBaseIndex + j;
+                const pubAcct = mnemonicToAccount(mnemonic, {
+                    accountIndex,
+                    addressIndex: publisherAddressIndex
+                });
+                publisherAddresses.push(pubAcct.address);
+                return remoteSigner ? {
+                    address: pubAcct.address,
+                    remoteSignerUrl: remoteSigner
+                } : '0x' + Buffer.from(pubAcct.getHdKey().privateKey).toString('hex');
+            });
+            publisherField = publisherCount === 1 ? publisherAccounts[0] : publisherAccounts;
+        }
+        const acct = mnemonicToAccount(mnemonic, {
+            accountIndex,
+            addressIndex
+        });
+        const attesterEthAddress = acct.address;
+        summaries.push({
+            attesterEth: attesterEthAddress,
+            attesterBls: blsPubCompressed,
+            publisherEth: publisherAddresses.length > 0 ? publisherAddresses : undefined
+        });
+        return {
+            attester,
+            ...publisherField !== undefined ? {
+                publisher: publisherField
+            } : {},
+            feeRecipient,
+            coinbase: coinbase ?? attesterEthAddress
+        };
+    }));
+    return {
+        validators,
+        summaries
+    };
+}
+export async function resolveKeystoreOutputPath(dataDir, file) {
+    const defaultDataDir = join(homedir(), '.aztec', 'keystore');
+    const resolvedDir = dataDir && dataDir.length > 0 ? dataDir : defaultDataDir;
+    let outputPath;
+    if (file && file.length > 0) {
+        outputPath = isAbsolute(file) ? file : join(resolvedDir, file);
+    } else {
+        let index = 1;
+        while(true){
+            const candidate = join(resolvedDir, `key${index}.json`);
+            try {
+                await access(candidate, fsConstants.F_OK);
+                index += 1;
+            } catch  {
+                outputPath = candidate;
+                break;
+            }
+        }
+    }
+    return {
+        resolvedDir,
+        outputPath: outputPath
+    };
+}
+export async function writeKeystoreFile(path, keystore) {
+    mkdirSync(dirname(path), {
+        recursive: true
+    });
+    await writeFile(path, JSON.stringify(keystore, null, 2), {
+        encoding: 'utf-8'
+    });
+}
+export function logValidatorSummaries(log, summaries) {
+    const lines = [];
+    for(let i = 0; i < summaries.length; i++){
+        const v = summaries[i];
+        lines.push(`acc${i + 1}:`);
+        lines.push(`  attester:`);
+        if (v.attesterEth) {
+            lines.push(`    eth: ${v.attesterEth}`);
+        }
+        if (v.attesterBls) {
+            lines.push(`    bls: ${v.attesterBls}`);
+        }
+        if (v.publisherEth && v.publisherEth.length > 0) {
+            lines.push(`  publisher:`);
+            for (const addr of v.publisherEth){
+                lines.push(`    - ${addr}`);
+            }
+        }
+    }
+    if (lines.length > 0) {
+        log(lines.join('\n'));
+    }
+}
+export function maybePrintJson(log, jsonFlag, obj) {
+    if (jsonFlag) {
+        log(prettyPrintJSON(obj));
+    }
+}
+/**
+ * Writes a BN254 keystore file for a BN254 BLS private key.
+ * Returns the absolute path to the written file.
+ *
+ * @param outDir - Directory to write the keystore file to
+ * @param fileNameBase - Base name for the keystore file (will be sanitized)
+ * @param password - Password for encrypting the private key
+ * @param privateKeyHex - Private key as 0x-prefixed hex string (32 bytes)
+ * @param pubkeyHex - Public key as hex string
+ * @param derivationPath - BIP-44 style derivation path
+ * @returns Absolute path to the written keystore file
+ */ export async function writeBn254BlsKeystore(outDir, fileNameBase, password, privateKeyHex, pubkeyHex, derivationPath) {
+    mkdirSync(outDir, {
+        recursive: true
+    });
+    const keystore = await createBn254Keystore(password, privateKeyHex, pubkeyHex, derivationPath);
+    const safeBase = fileNameBase.replace(/[^a-zA-Z0-9_-]/g, '_');
+    const outPath = join(outDir, `keystore-${safeBase}.json`);
+    await writeFile(outPath, JSON.stringify(keystore, null, 2), {
+        encoding: 'utf-8'
+    });
+    return outPath;
+}
+/** Replace plaintext BLS keys in validators with { path, password } pointing to BN254 keystore files. */ export async function writeBlsBn254ToFile(validators, options) {
+    await Promise.all(validators.map(async (v, i)=>{
+        if (!v || typeof v !== 'object' || !('attester' in v)) {
+            return;
+        }
+        const att = v.attester;
+        // Shapes: { bls: <hex> } or { eth: <ethAccount>, bls?: <hex> } or plain EthAccount
+        const blsKey = typeof att === 'object' && 'bls' in att ? att.bls : undefined;
+        if (!blsKey || typeof blsKey !== 'string') {
+            return;
+        }
+        const pub = await computeBlsPublicKeyCompressed(blsKey);
+        const path = options.blsPath ?? defaultBlsPath;
+        const fileBase = `${String(i + 1)}_${pub.slice(2, 18)}`;
+        const keystorePath = await writeBn254BlsKeystore(options.outDir, fileBase, options.password, blsKey, pub, path);
+        if (typeof att === 'object') {
+            att.bls = {
+                path: keystorePath,
+                password: options.password
+            };
+        }
+    }));
+}
+/** Writes an Ethereum JSON V3 keystore using ethers, returns absolute path */ export async function writeEthJsonV3Keystore(outDir, fileNameBase, password, privateKeyHex) {
+    const safeBase = fileNameBase.replace(/[^a-zA-Z0-9_-]/g, '_');
+    mkdirSync(outDir, {
+        recursive: true
+    });
+    const json = await encryptEthJsonV3(privateKeyHex, password);
+    const outPath = join(outDir, `keystore-eth-${safeBase}.json`);
+    await writeFile(outPath, json, {
+        encoding: 'utf-8'
+    });
+    return outPath;
+}
+/**
+ * If `account` is a plaintext ETH private key, encrypt it to a JSON V3 file and return a
+ * { path, password } reference; otherwise return it unchanged.
+ */ async function maybeEncryptEthAccount(account, label, options) {
+    if (typeof account === 'string' && account.startsWith('0x') && account.length === 66) {
+        const fileBase = `${label}_${account.slice(2, 10)}`;
+        const p = await writeEthJsonV3Keystore(options.outDir, fileBase, options.password, account);
+        return {
+            path: p,
+            password: options.password
+        };
+    }
+    return account;
+}
+/** Encrypt a plaintext funding-account key to a JSON V3 file, replacing it with a { path, password } reference. */ export async function encryptFundingAccountToFile(account, options) {
+    return await maybeEncryptEthAccount(account, 'funding', options);
+}
+/** Replace plaintext ETH keys in validators with { path, password } pointing to JSON V3 files. */ export async function writeEthJsonV3ToFile(validators, options) {
+    const tasks = [];
+    const maybeQueueEncryptEth = (account, label, setEncryptedAccount)=>{
+        if (typeof account === 'string' && account.startsWith('0x') && account.length === 66) {
+            tasks.push(async ()=>{
+                const fileBase = `${label}_${account.slice(2, 10)}`;
+                const path = await writeEthJsonV3Keystore(options.outDir, fileBase, options.password, account);
+                setEncryptedAccount({
+                    path,
+                    password: options.password
+                });
+            });
+        }
+    };
+    for(let i = 0; i < validators.length; i++){
+        const v = validators[i];
+        if (!v || typeof v !== 'object') {
+            continue;
+        }
+        // attester may be string (eth), object with eth, or remote signer
+        const att = v.attester;
+        if (typeof att === 'string') {
+            maybeQueueEncryptEth(att, `attester_${i + 1}`, (account)=>v.attester = account);
+        } else if (att && typeof att === 'object' && 'eth' in att) {
+            maybeQueueEncryptEth(att.eth, `attester_${i + 1}`, (account)=>att.eth = account);
+        }
+        // publisher can be single or array
+        if ('publisher' in v) {
+            const pub = v.publisher;
+            if (Array.isArray(pub)) {
+                for(let j = 0; j < pub.length; j++){
+                    maybeQueueEncryptEth(pub[j], `publisher_${i + 1}_${j + 1}`, (account)=>pub[j] = account);
+                }
+            } else if (pub !== undefined) {
+                maybeQueueEncryptEth(pub, `publisher_${i + 1}`, (account)=>v.publisher = account);
+            }
+        }
+    }
+    await asyncPool(maxEthKeystoreWorkers, tasks, (task)=>task());
+}

package/dest/cmds/validator_keys/staker.d.ts

@@ -0,0 +1,38 @@
+import { GSEContract } from '@aztec-labs/ethereum/contracts';
+import type { EthAddress } from '@aztec-labs/foundation/eth-address';
+import type { LogFn } from '@aztec-labs/foundation/log';
+import type { AttesterAccounts } from '@aztec-labs/node-keystore/types';
+export type StakerOptions = {
+    from: string;
+    password?: string;
+    output?: string;
+    gseAddress: EthAddress;
+    l1RpcUrls: string[];
+    l1ChainId: number;
+};
+export type StakerOutput = {
+    attester: string;
+    publicKeyG1: {
+        x: string;
+        y: string;
+    };
+    publicKeyG2: {
+        x0: string;
+        x1: string;
+        y0: string;
+        y1: string;
+    };
+    proofOfPossession: {
+        x: string;
+        y: string;
+    };
+};
+/**
+ * Process AttesterAccounts (which can be a single attester, array, or mnemonic)
+ */
+export declare function processAttesterAccounts(attesterAccounts: AttesterAccounts, gse: GSEContract, password?: string): Promise<StakerOutput[]>;
+/**
+ * Main staker command function
+ */
+export declare function generateStakerJson(options: StakerOptions, log: LogFn): Promise<void>;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic3Rha2VyLmQudHMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi9zcmMvY21kcy92YWxpZGF0b3Jfa2V5cy9zdGFrZXIudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBRUEsT0FBTyxFQUFFLFdBQVcsRUFBRSxNQUFNLGdDQUFnQyxDQUFDO0FBSTdELE9BQU8sS0FBSyxFQUFFLFVBQVUsRUFBRSxNQUFNLG9DQUFvQyxDQUFDO0FBQ3JFLE9BQU8sS0FBSyxFQUFFLEtBQUssRUFBRSxNQUFNLDRCQUE0QixDQUFDO0FBRXhELE9BQU8sS0FBSyxFQUVWLGdCQUFnQixFQUtqQixNQUFNLGlDQUFpQyxDQUFDO0FBT3pDLE1BQU0sTUFBTSxhQUFhLEdBQUc7SUFDMUIsSUFBSSxFQUFFLE1BQU0sQ0FBQztJQUNiLFFBQVEsQ0FBQyxFQUFFLE1BQU0sQ0FBQztJQUNsQixNQUFNLENBQUMsRUFBRSxNQUFNLENBQUM7SUFDaEIsVUFBVSxFQUFFLFVBQVUsQ0FBQztJQUN2QixTQUFTLEVBQUUsTUFBTSxFQUFFLENBQUM7SUFDcEIsU0FBUyxFQUFFLE1BQU0sQ0FBQztDQUNuQixDQUFDO0FBRUYsTUFBTSxNQUFNLFlBQVksR0FBRztJQUN6QixRQUFRLEVBQUUsTUFBTSxDQUFDO0lBQ2pCLFdBQVcsRUFBRTtRQUNYLENBQUMsRUFBRSxNQUFNLENBQUM7UUFDVixDQUFDLEVBQUUsTUFBTSxDQUFDO0tBQ1gsQ0FBQztJQUNGLFdBQVcsRUFBRTtRQUNYLEVBQUUsRUFBRSxNQUFNLENBQUM7UUFDWCxFQUFFLEVBQUUsTUFBTSxDQUFDO1FBQ1gsRUFBRSxFQUFFLE1BQU0sQ0FBQztRQUNYLEVBQUUsRUFBRSxNQUFNLENBQUM7S0FDWixDQUFDO0lBQ0YsaUJBQWlCLEVBQUU7UUFDakIsQ0FBQyxFQUFFLE1BQU0sQ0FBQztRQUNWLENBQUMsRUFBRSxNQUFNLENBQUM7S0FDWCxDQUFDO0NBQ0gsQ0FBQztBQTJLRjs7R0FFRztBQUNILHdCQUFzQix1QkFBdUIsQ0FDM0MsZ0JBQWdCLEVBQUUsZ0JBQWdCLEVBQ2xDLEdBQUcsRUFBRSxXQUFXLEVBQ2hCLFFBQVEsQ0FBQyxFQUFFLE1BQU0sR0FDaEIsT0FBTyxDQUFDLFlBQVksRUFBRSxDQUFDLENBcUJ6QjtBQUVEOztHQUVHO0FBQ0gsd0JBQXNCLGtCQUFrQixDQUFDLE9BQU8sRUFBRSxhQUFhLEVBQUUsR0FBRyxFQUFFLEtBQUssR0FBRyxPQUFPLENBQUMsSUFBSSxDQUFDLENBK0MxRiJ9

package/dest/cmds/validator_keys/staker.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"staker.d.ts","sourceRoot":"","sources":["../../../src/cmds/validator_keys/staker.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,WAAW,EAAE,MAAM,gCAAgC,CAAC;AAI7D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oCAAoC,CAAC;AACrE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,4BAA4B,CAAC;AAExD,OAAO,KAAK,EAEV,gBAAgB,EAKjB,MAAM,iCAAiC,CAAC;AAOzC,MAAM,MAAM,aAAa,GAAG;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,UAAU,CAAC;IACvB,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,YAAY,GAAG;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE;QACX,CAAC,EAAE,MAAM,CAAC;QACV,CAAC,EAAE,MAAM,CAAC;KACX,CAAC;IACF,WAAW,EAAE;QACX,EAAE,EAAE,MAAM,CAAC;QACX,EAAE,EAAE,MAAM,CAAC;QACX,EAAE,EAAE,MAAM,CAAC;QACX,EAAE,EAAE,MAAM,CAAC;KACZ,CAAC;IACF,iBAAiB,EAAE;QACjB,CAAC,EAAE,MAAM,CAAC;QACV,CAAC,EAAE,MAAM,CAAC;KACX,CAAC;CACH,CAAC;AA2KF;;GAEG;AACH,wBAAsB,uBAAuB,CAC3C,gBAAgB,EAAE,gBAAgB,EAClC,GAAG,EAAE,WAAW,EAChB,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,YAAY,EAAE,CAAC,CAqBzB;AAED;;GAEG;AACH,wBAAsB,kBAAkB,CAAC,OAAO,EAAE,aAAa,EAAE,GAAG,EAAE,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CA+C1F"}

package/dest/cmds/validator_keys/staker.js

@@ -0,0 +1,210 @@
+import { prettyPrintJSON } from '@aztec-labs/cli/utils';
+import { createEthereumChain } from '@aztec-labs/ethereum/chain';
+import { GSEContract } from '@aztec-labs/ethereum/contracts';
+import { decryptBn254Keystore } from '@aztec-labs/foundation/crypto/bls/bn254_keystore';
+import { computeBn254G1PublicKey, computeBn254G2PublicKey } from '@aztec-labs/foundation/crypto/bn254';
+import { Fr } from '@aztec-labs/foundation/curves/bn254';
+import { loadKeystoreFile } from '@aztec-labs/node-keystore/loader';
+import { Wallet } from '@ethersproject/wallet';
+import { readFileSync, writeFileSync } from 'fs';
+import { basename, dirname, join } from 'path';
+import { createPublicClient, fallback, http } from 'viem';
+import { privateKeyToAddress } from 'viem/accounts';
+/**
+ * Check if an object is a MnemonicConfig
+ */ function isMnemonicConfig(obj) {
+    return typeof obj === 'object' && obj !== null && 'mnemonic' in obj;
+}
+/**
+ * Check if a value is an encrypted keystore file config
+ */ function isEncryptedKeyFileConfig(value) {
+    return typeof value === 'object' && value !== null && 'path' in value;
+}
+/**
+ * Check if a BLSAccount is a private key string (not an encrypted keystore file)
+ */ function isBlsPrivateKey(bls) {
+    return typeof bls === 'string' && bls.startsWith('0x');
+}
+/**
+ * Check if an EthAccount is a private key string (66 chars: 0x + 64 hex)
+ */ function isEthPrivateKey(eth) {
+    return typeof eth === 'string' && eth.startsWith('0x') && eth.length === 66;
+}
+/**
+ * Check if a string is an Ethereum address (42 chars: 0x + 40 hex)
+ */ function isEthAddress(value) {
+    return typeof value === 'string' && /^0x[0-9a-fA-F]{40}$/.test(value);
+}
+/**
+ * Decrypt a BLS private key from an encrypted keystore file
+ */ function decryptBlsKey(bls, password) {
+    if (isBlsPrivateKey(bls)) {
+        return bls;
+    }
+    if (isEncryptedKeyFileConfig(bls)) {
+        if (!password && !bls.password) {
+            return undefined; // Can't decrypt without password
+        }
+        const pwd = password ?? bls.password;
+        return decryptBn254Keystore(bls.path, pwd);
+    }
+    return undefined;
+}
+/**
+ * Decrypt an Ethereum private key from an encrypted keystore file
+ */ async function decryptEthKey(eth, password) {
+    if (isEthPrivateKey(eth)) {
+        return eth;
+    }
+    if (isEncryptedKeyFileConfig(eth)) {
+        if (!password && !eth.password) {
+            return undefined; // Can't decrypt without password
+        }
+        const pwd = password ?? eth.password;
+        const json = readFileSync(eth.path, 'utf-8');
+        const wallet = await Wallet.fromEncryptedJson(json, pwd);
+        return wallet.privateKey;
+    }
+    return undefined;
+}
+/**
+ * Extract Ethereum address from an EthAccount (or private key)
+ */ async function getEthAddress(eth, password) {
+    // Case 1: It's a private key string - derive the address
+    if (isEthPrivateKey(eth)) {
+        return privateKeyToAddress(eth);
+    }
+    // Case 2: It's just an address string directly (EthRemoteSignerAccount can be just EthAddress)
+    if (isEthAddress(eth)) {
+        return eth;
+    }
+    // Case 3: It's an object with an address property (remote signer config)
+    if (typeof eth === 'object' && eth !== null && 'address' in eth) {
+        return eth.address;
+    }
+    // Case 4: It's an encrypted keystore file - decrypt and derive address
+    if (isEncryptedKeyFileConfig(eth)) {
+        const privateKey = await decryptEthKey(eth, password);
+        if (privateKey) {
+            return privateKeyToAddress(privateKey);
+        }
+        return undefined;
+    }
+    return undefined;
+}
+/**
+ * Extract BLS private key and Ethereum address from an AttesterAccount
+ */ async function extractAttesterInfo(attester, password) {
+    // Case 1: attester is { eth: EthAccount, bls?: BLSAccount }
+    if (typeof attester === 'object' && attester !== null && 'eth' in attester) {
+        const ethAddress = await getEthAddress(attester.eth, password);
+        const blsPrivateKey = attester.bls ? decryptBlsKey(attester.bls, password) : undefined;
+        return {
+            blsPrivateKey,
+            ethAddress
+        };
+    }
+    // Case 2: attester is just an EthAccount directly (no BLS key)
+    return {
+        blsPrivateKey: undefined,
+        ethAddress: await getEthAddress(attester, password)
+    };
+}
+/**
+ * Process a single attester entry and output staking JSON
+ */ async function processAttester(attester, gse, password) {
+    const { blsPrivateKey, ethAddress } = await extractAttesterInfo(attester, password);
+    // Skip if no BLS private key or no Ethereum address
+    if (!blsPrivateKey || !ethAddress) {
+        return undefined;
+    }
+    // Derive G1 and G2 public keys
+    const g1PublicKey = await computeBn254G1PublicKey(blsPrivateKey);
+    const g2PublicKey = await computeBn254G2PublicKey(blsPrivateKey);
+    // Generate proof of possession
+    const bn254SecretKeyFieldElement = Fr.fromString(blsPrivateKey);
+    const registrationTuple = await gse.makeRegistrationTuple(bn254SecretKeyFieldElement.toBigInt());
+    return {
+        attester: String(ethAddress),
+        publicKeyG1: {
+            x: '0x' + g1PublicKey.x.toString(16).padStart(64, '0'),
+            y: '0x' + g1PublicKey.y.toString(16).padStart(64, '0')
+        },
+        publicKeyG2: {
+            x0: '0x' + g2PublicKey.x.c0.toString(16).padStart(64, '0'),
+            x1: '0x' + g2PublicKey.x.c1.toString(16).padStart(64, '0'),
+            y0: '0x' + g2PublicKey.y.c0.toString(16).padStart(64, '0'),
+            y1: '0x' + g2PublicKey.y.c1.toString(16).padStart(64, '0')
+        },
+        proofOfPossession: {
+            x: '0x' + registrationTuple.proofOfPossession.x.toString(16),
+            y: '0x' + registrationTuple.proofOfPossession.y.toString(16)
+        }
+    };
+}
+/**
+ * Process AttesterAccounts (which can be a single attester, array, or mnemonic)
+ */ export async function processAttesterAccounts(attesterAccounts, gse, password) {
+    // Skip mnemonic configs
+    if (isMnemonicConfig(attesterAccounts)) {
+        return [];
+    }
+    // Handle array of attesters
+    if (Array.isArray(attesterAccounts)) {
+        const results = [];
+        for (const attester of attesterAccounts){
+            const result = await processAttester(attester, gse, password);
+            if (result) {
+                results.push(result);
+            }
+        }
+        return results;
+    }
+    // Handle single attester
+    const result = await processAttester(attesterAccounts, gse, password);
+    return result ? [
+        result
+    ] : [];
+}
+/**
+ * Main staker command function
+ */ export async function generateStakerJson(options, log) {
+    const { from, password, gseAddress, l1RpcUrls, l1ChainId, output } = options;
+    // Load the keystore file
+    const keystore = loadKeystoreFile(from);
+    if (!gseAddress) {
+        throw new Error('GSE contract address is required');
+    }
+    log(`Calling GSE contract ${gseAddress} on chain ${l1ChainId}, using ${l1RpcUrls.join(', ')} to get staker outputs`);
+    if (!keystore.validators || keystore.validators.length === 0) {
+        log('No validators found in keystore');
+        return;
+    }
+    const allOutputs = [];
+    // L1 client for proof of possession
+    const chain = createEthereumChain(l1RpcUrls, l1ChainId);
+    const publicClient = createPublicClient({
+        chain: chain.chainInfo,
+        transport: fallback(l1RpcUrls.map((url)=>http(url, {
+                batch: false
+            })))
+    });
+    const gse = new GSEContract(publicClient, gseAddress);
+    const keystoreBaseName = basename(from, '.json');
+    const outputDir = output ? output : dirname(from);
+    for(let i = 0; i < keystore.validators.length; i++){
+        const validator = keystore.validators[i];
+        const outputs = await processAttesterAccounts(validator.attester, gse, password);
+        for(let j = 0; j < outputs.length; j++){
+            allOutputs.push(outputs[j]);
+        }
+    }
+    if (allOutputs.length === 0) {
+        log('No attesters with BLS keys found (skipping mnemonics and encrypted keystores without password)');
+        return;
+    }
+    // Write a single JSON file with all staker outputs
+    const stakerOutputPath = join(outputDir, `${keystoreBaseName}_staker_output.json`);
+    writeFileSync(stakerOutputPath, prettyPrintJSON(allOutputs), 'utf-8');
+    log(`Wrote staker output for ${allOutputs.length} validator(s) to ${stakerOutputPath}`);
+}

package/dest/cmds/validator_keys/utils.d.ts

@@ -0,0 +1,35 @@
+import { EthAddress } from '@aztec-labs/foundation/eth-address';
+export declare const defaultBlsPath = "m/12381/3600/0/0/0";
+export declare function validateBlsPathOptions(options: {
+    count?: number;
+    publisherCount?: number;
+    accountIndex?: number;
+    addressIndex?: number;
+    blsPath?: string;
+    ikm?: string;
+}): void;
+export declare function validateStakerOutputOptions(options: {
+    stakerOutput?: boolean;
+    gseAddress?: EthAddress;
+    l1RpcUrls?: string[];
+    l1ChainId?: number;
+}): void;
+export declare function validateRemoteSignerOptions(options: {
+    remoteSigner?: string;
+    mnemonic?: string;
+}): void;
+export declare function validatePublisherOptions(options: {
+    publishers?: string[];
+    publisherCount?: number;
+}): void;
+/**
+ * Validates and normalizes the `--funding-account` option in place. The value may be a private key
+ * (used as a local signer) or an ETH address. An address needs a remote signer to sign funding txs:
+ * either `--remote-signer`, or a keystore that already defines one (pass `hasKeystoreRemoteSigner`),
+ * which a bare address inherits at runtime.
+ */
+export declare function validateFundingAccountOptions(options: {
+    fundingAccount?: string;
+    remoteSigner?: string;
+}, hasKeystoreRemoteSigner?: boolean): void;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoidXRpbHMuZC50cyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uLy4uL3NyYy9jbWRzL3ZhbGlkYXRvcl9rZXlzL3V0aWxzLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLE9BQU8sRUFBRSxVQUFVLEVBQUUsTUFBTSxvQ0FBb0MsQ0FBQztBQUloRSxlQUFPLE1BQU0sY0FBYyx1QkFBdUIsQ0FBQztBQUVuRCx3QkFBZ0Isc0JBQXNCLENBQUMsT0FBTyxFQUFFO0lBQzlDLEtBQUssQ0FBQyxFQUFFLE1BQU0sQ0FBQztJQUNmLGNBQWMsQ0FBQyxFQUFFLE1BQU0sQ0FBQztJQUN4QixZQUFZLENBQUMsRUFBRSxNQUFNLENBQUM7SUFDdEIsWUFBWSxDQUFDLEVBQUUsTUFBTSxDQUFDO0lBQ3RCLE9BQU8sQ0FBQyxFQUFFLE1BQU0sQ0FBQztJQUNqQixHQUFHLENBQUMsRUFBRSxNQUFNLENBQUM7Q0FDZCxRQVdBO0FBRUQsd0JBQWdCLDJCQUEyQixDQUFDLE9BQU8sRUFBRTtJQUNuRCxZQUFZLENBQUMsRUFBRSxPQUFPLENBQUM7SUFDdkIsVUFBVSxDQUFDLEVBQUUsVUFBVSxDQUFDO0lBQ3hCLFNBQVMsQ0FBQyxFQUFFLE1BQU0sRUFBRSxDQUFDO0lBQ3JCLFNBQVMsQ0FBQyxFQUFFLE1BQU0sQ0FBQztDQUNwQixRQWVBO0FBRUQsd0JBQWdCLDJCQUEyQixDQUFDLE9BQU8sRUFBRTtJQUFFLFlBQVksQ0FBQyxFQUFFLE1BQU0sQ0FBQztJQUFDLFFBQVEsQ0FBQyxFQUFFLE1BQU0sQ0FBQTtDQUFFLFFBTWhHO0FBRUQsd0JBQWdCLHdCQUF3QixDQUFDLE9BQU8sRUFBRTtJQUFFLFVBQVUsQ0FBQyxFQUFFLE1BQU0sRUFBRSxDQUFDO0lBQUMsY0FBYyxDQUFDLEVBQUUsTUFBTSxDQUFBO0NBQUUsUUF3Qm5HO0FBRUQ7Ozs7O0dBS0c7QUFDSCx3QkFBZ0IsNkJBQTZCLENBQzNDLE9BQU8sRUFBRTtJQUFFLGNBQWMsQ0FBQyxFQUFFLE1BQU0sQ0FBQztJQUFDLFlBQVksQ0FBQyxFQUFFLE1BQU0sQ0FBQTtDQUFFLEVBQzNELHVCQUF1QixVQUFRLFFBaUNoQyJ9

package/dest/cmds/validator_keys/utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../../../src/cmds/validator_keys/utils.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,oCAAoC,CAAC;AAIhE,eAAO,MAAM,cAAc,uBAAuB,CAAC;AAEnD,wBAAgB,sBAAsB,CAAC,OAAO,EAAE;IAC9C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,QAWA;AAED,wBAAgB,2BAA2B,CAAC,OAAO,EAAE;IACnD,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,QAeA;AAED,wBAAgB,2BAA2B,CAAC,OAAO,EAAE;IAAE,YAAY,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,QAMhG;AAED,wBAAgB,wBAAwB,CAAC,OAAO,EAAE;IAAE,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IAAC,cAAc,CAAC,EAAE,MAAM,CAAA;CAAE,QAwBnG;AAED;;;;;GAKG;AACH,wBAAgB,6BAA6B,CAC3C,OAAO,EAAE;IAAE,cAAc,CAAC,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CAAE,EAC3D,uBAAuB,UAAQ,QAiChC"}