@aztec-labs/cli 6.0.0-rc.3 → 6.0.0-rc.4

package/dest/cmds/validator_keys/bls_key_derivation.js

@@ -0,0 +1,122 @@
+import { estimateBlsKeyProofOfPossessionGas, minimumProofOfPossessionGas } from '@aztec-labs/ethereum/bn254';
+import { deriveBlsPrivateKey } from '@aztec-labs/foundation/crypto/bls';
+/**
+ * BLS key derivation v6. The gas model is a frozen copy of `AMSTERDAM_PROOF_OF_POSSESSION_GAS_MODEL` from
+ * `@aztec-labs/ethereum/bn254`. The budget is the 300,000 gas `proofOfPossessionGasLimit` that the v6 upgrade
+ * payload sets on the GSE, minus a 10% margin.
+ *
+ * With per-attempt probabilities 0.189030554816 of reaching the square root and 0.094515277408 of succeeding, about
+ * 5.8243e-6 of keys (1 in 171,694) estimate over the budget, so they move to a later candidate under v6.
+ *
+ * Frozen once a CLI release ships it: changing any value changes which BLS key `--bls-key-derivation-v6` selects for
+ * the same mnemonic and indices, so operators could no longer regenerate their keys. Add a new version instead.
+ */ export const BLS_KEY_DERIVATION_V6 = {
+    version: 6,
+    gasModel: {
+        fixed: 132_694,
+        perAttempt: 515,
+        perSqrtCall: 4_580,
+        memoryNumerator: 95_975,
+        memoryDenominator: 1_000_000
+    },
+    budget: 270_000
+};
+/** Version checked when no derivation flag is given. A future version gets its own flag next to `--bls-key-derivation-v6`. */ export const LATEST_BLS_KEY_DERIVATION = BLS_KEY_DERIVATION_V6;
+/** Number of candidates tried per validator before key selection gives up. */ export const MAX_BLS_KEY_CANDIDATES = 256;
+const GENERATED_MNEMONIC_HINTS = {
+    shown: ' This run generated its mnemonic, and re-running without --mnemonic generates a new one: to keep this ' + 'mnemonic, pass it back with --mnemonic.',
+    hidden: ' This run generated a mnemonic without showing it, so re-running derives new keys from a new mnemonic.'
+};
+/** Thrown when candidate 0 estimates over the budget and no flag says what to do about it. */ export class BlsKeyOverGasBudgetError extends Error {
+    path;
+    estimatedGas;
+    version;
+    maxGas;
+    constructor(path, estimatedGas, version, maxGas, generatedMnemonic){
+        const budget = maxGas === undefined ? `the ${version.budget} budget of BLS key derivation v${version.version}, so it could exceed the L1 gas cap` : `the ${maxGas} budget set by --bls-key-derivation-max-gas`;
+        const remedies = maxGas === undefined ? `Re-run with --bls-key-derivation-v${version.version} to select a cheaper key for this validator, or with ` + `--skip-bls-key-gas-check to keep this key regardless (for example, a key already registered).` : `Re-run with --bls-key-derivation-v${version.version} to select a cheaper key for this validator, or with a ` + `higher --bls-key-derivation-max-gas.`;
+        super(`The proof-of-possession check of the BLS key derived at ${path} is estimated at ${estimatedGas} gas, above ` + `${budget}. ${remedies}` + (generatedMnemonic ? GENERATED_MNEMONIC_HINTS[generatedMnemonic] : '')), this.path = path, this.estimatedGas = estimatedGas, this.version = version, this.maxGas = maxGas;
+        this.name = 'BlsKeyOverGasBudgetError';
+    }
+}
+/** Validates the BLS key derivation flags and turns them into a policy. */ export function resolveBlsKeyDerivationPolicy(options) {
+    const { blsKeyDerivationV6, blsKeyDerivationMaxGas: maxGas, skipBlsKeyGasCheck } = options;
+    const version = LATEST_BLS_KEY_DERIVATION;
+    if (skipBlsKeyGasCheck) {
+        if (blsKeyDerivationV6) {
+            throw new Error('--bls-key-derivation-v6 and --skip-bls-key-gas-check cannot be used together');
+        }
+        if (maxGas !== undefined) {
+            throw new Error('--bls-key-derivation-max-gas and --skip-bls-key-gas-check cannot be used together');
+        }
+        return {
+            mode: 'none'
+        };
+    }
+    if (maxGas !== undefined) {
+        if (!Number.isSafeInteger(maxGas)) {
+            throw new Error(`--bls-key-derivation-max-gas must be an integer, got ${maxGas}`);
+        }
+        if (maxGas > version.budget) {
+            throw new Error(`--bls-key-derivation-max-gas can only lower the budget: ${maxGas} is above the ${version.budget} gas budget ` + `of BLS key derivation v${version.version}.`);
+        }
+        const minimum = minimumProofOfPossessionGas(version.gasModel);
+        if (maxGas < minimum) {
+            throw new Error(`--bls-key-derivation-max-gas ${maxGas} is below ${minimum}, the lowest proof-of-possession gas estimate any ` + `key can have, so no key could fit.`);
+        }
+    }
+    return {
+        mode: blsKeyDerivationV6 ? 'retry' : 'check',
+        version,
+        ...maxGas !== undefined ? {
+            maxGas
+        } : {}
+    };
+}
+/** Derivation path of a candidate: candidate 0 is the per-validator path itself, others append `/<candidate>`. */ export function blsCandidatePath(perValidatorPath, candidate) {
+    return candidate === 0 ? perValidatorPath : `${perValidatorPath}/${candidate}`;
+}
+/**
+ * Derives a validator's BLS key from `perValidatorPath` under the given policy. Only the mnemonic or IKM, the path
+ * and the policy decide the result, so re-running with the same inputs regenerates the same key.
+ */ export function selectBlsKey(policy, input) {
+    const { mnemonic, ikm, perValidatorPath, generatedMnemonic, maxCandidates = MAX_BLS_KEY_CANDIDATES } = input;
+    const candidate0 = {
+        privateKey: deriveBlsPrivateKey(mnemonic, ikm, perValidatorPath),
+        path: perValidatorPath
+    };
+    if (policy.mode === 'none') {
+        return {
+            ...candidate0,
+            candidate: 0
+        };
+    }
+    const { gasModel } = policy.version;
+    const budget = policy.maxGas ?? policy.version.budget;
+    if (policy.mode === 'check') {
+        const estimatedGas = estimateBlsKeyProofOfPossessionGas(gasModel, candidate0.privateKey);
+        if (estimatedGas > budget) {
+            throw new BlsKeyOverGasBudgetError(perValidatorPath, estimatedGas, policy.version, policy.maxGas, // An IKM takes precedence over the mnemonic, so the mnemonic does not decide the BLS key.
+            ikm ? undefined : generatedMnemonic);
+        }
+        return {
+            ...candidate0,
+            candidate: 0
+        };
+    }
+    for(let candidate = 0; candidate < maxCandidates; candidate++){
+        const path = blsCandidatePath(perValidatorPath, candidate);
+        const privateKey = candidate === 0 ? candidate0.privateKey : deriveBlsPrivateKey(mnemonic, ikm, path);
+        if (estimateBlsKeyProofOfPossessionGas(gasModel, privateKey) <= budget) {
+            return {
+                privateKey,
+                path,
+                candidate,
+                ...candidate > 0 && policy.maxGas !== undefined ? {
+                    maxGas: budget
+                } : {}
+            };
+        }
+    }
+    throw new Error(`No BLS key within the ${budget} gas budget found for ` + `${perValidatorPath} after ${maxCandidates} candidates.`);
+}

package/dest/cmds/validator_keys/generate_bls_keypair.d.ts

@@ -1,4 +1,5 @@
 import type { LogFn } from '@aztec-labs/foundation/log';
+import { type BlsKeyDerivationOptions } from './bls_key_derivation.js';
 export type GenerateBlsKeypairOptions = {
     mnemonic?: string;
     ikm?: string;
@@ -7,6 +8,6 @@ export type GenerateBlsKeypairOptions = {
     compressed?: boolean;
     json?: boolean;
     out?: string;
-};
+} & BlsKeyDerivationOptions;
 export declare function generateBlsKeypair(options: GenerateBlsKeypairOptions, log: LogFn): Promise<void>;
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZ2VuZXJhdGVfYmxzX2tleXBhaXIuZC50cyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uLy4uL3NyYy9jbWRzL3ZhbGlkYXRvcl9rZXlzL2dlbmVyYXRlX2Jsc19rZXlwYWlyLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUNBLE9BQU8sS0FBSyxFQUFFLEtBQUssRUFBRSxNQUFNLDRCQUE0QixDQUFDO0FBTXhELE1BQU0sTUFBTSx5QkFBeUIsR0FBRztJQUN0QyxRQUFRLENBQUMsRUFBRSxNQUFNLENBQUM7SUFDbEIsR0FBRyxDQUFDLEVBQUUsTUFBTSxDQUFDO0lBQ2IsT0FBTyxDQUFDLEVBQUUsTUFBTSxDQUFDO0lBQ2pCLEVBQUUsQ0FBQyxFQUFFLE9BQU8sQ0FBQztJQUNiLFVBQVUsQ0FBQyxFQUFFLE9BQU8sQ0FBQztJQUNyQixJQUFJLENBQUMsRUFBRSxPQUFPLENBQUM7SUFDZixHQUFHLENBQUMsRUFBRSxNQUFNLENBQUM7Q0FDZCxDQUFDO0FBRUYsd0JBQXNCLGtCQUFrQixDQUFDLE9BQU8sRUFBRSx5QkFBeUIsRUFBRSxHQUFHLEVBQUUsS0FBSyxpQkFldEYifQ==
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZ2VuZXJhdGVfYmxzX2tleXBhaXIuZC50cyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uLy4uL3NyYy9jbWRzL3ZhbGlkYXRvcl9rZXlzL2dlbmVyYXRlX2Jsc19rZXlwYWlyLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLE9BQU8sS0FBSyxFQUFFLEtBQUssRUFBRSxNQUFNLDRCQUE0QixDQUFDO0FBR3hELE9BQU8sRUFBRSxLQUFLLHVCQUF1QixFQUErQyxNQUFNLHlCQUF5QixDQUFDO0FBSXBILE1BQU0sTUFBTSx5QkFBeUIsR0FBRztJQUN0QyxRQUFRLENBQUMsRUFBRSxNQUFNLENBQUM7SUFDbEIsR0FBRyxDQUFDLEVBQUUsTUFBTSxDQUFDO0lBQ2IsT0FBTyxDQUFDLEVBQUUsTUFBTSxDQUFDO0lBQ2pCLEVBQUUsQ0FBQyxFQUFFLE9BQU8sQ0FBQztJQUNiLFVBQVUsQ0FBQyxFQUFFLE9BQU8sQ0FBQztJQUNyQixJQUFJLENBQUMsRUFBRSxPQUFPLENBQUM7SUFDZixHQUFHLENBQUMsRUFBRSxNQUFNLENBQUM7Q0FDZCxHQUFHLHVCQUF1QixDQUFDO0FBRTVCLHdCQUFzQixrQkFBa0IsQ0FBQyxPQUFPLEVBQUUseUJBQXlCLEVBQUUsR0FBRyxFQUFFLEtBQUssaUJBb0N0RiJ9

package/dest/cmds/validator_keys/generate_bls_keypair.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"generate_bls_keypair.d.ts","sourceRoot":"","sources":["../../../src/cmds/validator_keys/generate_bls_keypair.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,4BAA4B,CAAC;AAMxD,MAAM,MAAM,yBAAyB,GAAG;IACtC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,EAAE,CAAC,EAAE,OAAO,CAAC;IACb,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,wBAAsB,kBAAkB,CAAC,OAAO,EAAE,yBAAyB,EAAE,GAAG,EAAE,KAAK,iBAetF"}
+{"version":3,"file":"generate_bls_keypair.d.ts","sourceRoot":"","sources":["../../../src/cmds/validator_keys/generate_bls_keypair.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,4BAA4B,CAAC;AAGxD,OAAO,EAAE,KAAK,uBAAuB,EAA+C,MAAM,yBAAyB,CAAC;AAIpH,MAAM,MAAM,yBAAyB,GAAG;IACtC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,EAAE,CAAC,EAAE,OAAO,CAAC;IACb,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,GAAG,uBAAuB,CAAC;AAE5B,wBAAsB,kBAAkB,CAAC,OAAO,EAAE,yBAAyB,EAAE,GAAG,EAAE,KAAK,iBAoCtF"}

package/dest/cmds/validator_keys/generate_bls_keypair.js

@@ -1,14 +1,24 @@
-import { deriveBlsPrivateKey } from '@aztec-labs/foundation/crypto/bls';
 import { writeFile } from 'fs/promises';
+import { resolveBlsKeyDerivationPolicy, selectBlsKey } from './bls_key_derivation.js';
 import { computeBlsPublicKeyCompressed, withValidatorIndex } from './shared.js';
 import { defaultBlsPath } from './utils.js';
 export async function generateBlsKeypair(options, log) {
     const { mnemonic, ikm, blsPath, compressed = true, json, out } = options;
-    const path = withValidatorIndex(blsPath ?? defaultBlsPath, 0);
-    const priv = deriveBlsPrivateKey(mnemonic, ikm, path);
+    const blsKeyDerivation = resolveBlsKeyDerivationPolicy(options);
+    const { path, privateKey: priv, candidate, maxGas } = selectBlsKey(blsKeyDerivation, {
+        mnemonic,
+        ikm,
+        perValidatorPath: withValidatorIndex(blsPath ?? defaultBlsPath, 0)
+    });
     const pub = await computeBlsPublicKeyCompressed(priv);
     const result = {
         path,
+        ...candidate > 0 ? {
+            candidate
+        } : {},
+        ...maxGas !== undefined ? {
+            maxGas
+        } : {},
         privateKey: priv,
         publicKey: pub,
         format: compressed ? 'compressed' : 'uncompressed'
@@ -19,6 +29,9 @@ export async function generateBlsKeypair(options, log) {
         });
         if (!json) {
             log(`Wrote BLS keypair to ${out}`);
+            if (candidate > 0) {
+                log(`BLS key derived from candidate ${candidate} at ${path}${maxGas !== undefined ? ` (max gas ${maxGas})` : ''}`);
+            }
         }
     }
     if (json || !out) {

package/dest/cmds/validator_keys/index.d.ts

@@ -1,4 +1,4 @@
 import type { LogFn } from '@aztec-labs/foundation/log';
 import { Command } from 'commander';
 export declare function injectCommands(program: Command, log: LogFn): Command;
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguZC50cyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uLy4uL3NyYy9jbWRzL3ZhbGlkYXRvcl9rZXlzL2luZGV4LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLE9BQU8sS0FBSyxFQUFFLEtBQUssRUFBRSxNQUFNLDRCQUE0QixDQUFDO0FBQ3hELE9BQU8sRUFBRSxPQUFPLEVBQVUsTUFBTSxXQUFXLENBQUM7QUFLNUMsd0JBQWdCLGNBQWMsQ0FBQyxPQUFPLEVBQUUsT0FBTyxFQUFFLEdBQUcsRUFBRSxLQUFLLFdBOEsxRCJ9
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguZC50cyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uLy4uL3NyYy9jbWRzL3ZhbGlkYXRvcl9rZXlzL2luZGV4LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUNBLE9BQU8sS0FBSyxFQUFFLEtBQUssRUFBRSxNQUFNLDRCQUE0QixDQUFDO0FBQ3hELE9BQU8sRUFBRSxPQUFPLEVBQVUsTUFBTSxXQUFXLENBQUM7QUEyQjVDLHdCQUFnQixjQUFjLENBQUMsT0FBTyxFQUFFLE9BQU8sRUFBRSxHQUFHLEVBQUUsS0FBSyxXQXVMMUQifQ==

package/dest/cmds/validator_keys/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/cmds/validator_keys/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,4BAA4B,CAAC;AACxD,OAAO,EAAE,OAAO,EAAU,MAAM,WAAW,CAAC;AAK5C,wBAAgB,cAAc,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,WA8K1D"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/cmds/validator_keys/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,4BAA4B,CAAC;AACxD,OAAO,EAAE,OAAO,EAAU,MAAM,WAAW,CAAC;AA2B5C,wBAAgB,cAAc,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,WAuL1D"}

package/dest/cmds/validator_keys/index.js

@@ -1,16 +1,27 @@
+import { minimumProofOfPossessionGas } from '@aztec-labs/ethereum/bn254';
 import { Option } from 'commander';
 import { parseAztecAddress, parseEthereumAddress, parseHex, parseOptionalInteger } from '../../utils/commands.js';
+import { BLS_KEY_DERIVATION_V6 } from './bls_key_derivation.js';
 import { defaultBlsPath } from './utils.js';
+function blsKeyDerivationV6Option() {
+    return new Option('--bls-key-derivation-v6', `Replace any BLS key whose estimated proof-of-possession gas exceeds the budget with the next deterministic candidate from the same mnemonic (BLS key derivation v6, budget ${BLS_KEY_DERIVATION_V6.budget} gas). ETH keys never change. Pass it again to regenerate the same keys.`);
+}
+function blsKeyDerivationMaxGasOption() {
+    return new Option('--bls-key-derivation-max-gas <gas>', `Stricter budget for the estimated proof-of-possession verification gas of each BLS key. The L1 limit (GSE proofOfPossessionGasLimit) is 300,000 gas from the v6 upgrade, and governance may change it; the default budget is ${BLS_KEY_DERIVATION_V6.budget}, that cap minus a 10% margin. Must be between ${minimumProofOfPossessionGas(BLS_KEY_DERIVATION_V6.gasModel)} and ${BLS_KEY_DERIVATION_V6.budget}. Without --bls-key-derivation-v6, an over-budget key is an error. Pass the same value again to regenerate the same keys.`).argParser((value)=>parseOptionalInteger(value));
+}
+function skipBlsKeyGasCheckOption() {
+    return new Option('--skip-bls-key-gas-check', 'Keep the first derived BLS key even if its proof-of-possession check could exceed the L1 gas cap (for example, a key already registered).');
+}
 export function injectCommands(program, log) {
     const group = program.command('validator-keys').aliases([
         'valKeys',
         'valkeys'
     ]).description('Manage validator keystores for node operators');
-    group.command('new').summary('Generate a new validator keystore JSON').description('Generates a new validator keystore with ETH secp256k1 accounts and optional BLS accounts').option('--data-dir <path>', 'Directory to store keystore(s). Defaults to ~/.aztec/keystore').option('--file <name>', 'Keystore file name. Defaults to key1.json (or keyN.json if key1.json exists)').option('--count <N>', 'Number of validators to generate', parseOptionalInteger).option('--publisher-count <N>', 'Number of publisher accounts per validator (default 0)', (value)=>parseOptionalInteger(value, 0)).option('--publishers <privateKeys>', 'Comma-separated list of publisher private keys for all validators.', (value)=>value.split(',').map((key)=>key.trim())).option('--mnemonic <mnemonic>', 'Mnemonic for ETH/BLS derivation').option('--passphrase <str>', 'Optional passphrase for mnemonic').option('--account-index <N>', 'Base account index for ETH/BLS derivation', parseOptionalInteger).option('--address-index <N>', 'Base address index for ETH/BLS derivation', parseOptionalInteger).option('--coinbase <address>', 'Coinbase ETH address to use when proposing. Defaults to attester address.', parseEthereumAddress).option('--funding-account <privateKey|address>', 'ETH funding account used to top up publisher EOAs. Provide a private key, or an address together with --remote-signer.').option('--remote-signer <url>', 'Default remote signer URL for accounts in this file').option('--ikm <hex>', 'Initial keying material for BLS (alternative to mnemonic)', (value)=>parseHex(value, 32)).option('--bls-path <path>', `EIP-2334 path (default ${defaultBlsPath})`).addOption(new Option('--password <str>', 'Shared password for writing ETH JSON V3 and BLS EIP-2335 keystore files').env('AZTEC_KEYSTORE_PASSWORD')).option('--password-file <path>', 'File containing the shared password for writing keystore files').addOption(new Option('--eth-password <str>', 'Password for writing ETH JSON V3 keystore files').env('AZTEC_ETH_KEYSTORE_PASSWORD')).option('--eth-password-file <path>', 'File containing the password for writing ETH JSON V3 keystore files').addOption(new Option('--bls-password <str>', 'Password for writing BLS EIP-2335 keystore files').env('AZTEC_BLS_KEYSTORE_PASSWORD')).option('--bls-password-file <path>', 'File containing the password for writing BLS EIP-2335 keystore files').option('--encrypted-keystore-dir <dir>', 'Output directory for encrypted keystore file(s)').option('--json', 'Echo resulting JSON to stdout').option('--staker-output', 'Generate a single staker output JSON file with an array of validator entries').option('--gse-address <address>', 'GSE contract address (required with --staker-output)', parseEthereumAddress).option('--l1-rpc-urls <urls>', 'L1 RPC URLs (comma-separated, required with --staker-output)', (value)=>value.split(',')).option('-c, --l1-chain-id <number>', 'L1 chain ID (required with --staker-output)', (value)=>parseInt(value), 31337).requiredOption('--fee-recipient <address>', 'Aztec address that will receive fees', parseAztecAddress).action(async (options)=>{
+    group.command('new').summary('Generate a new validator keystore JSON').description('Generates a new validator keystore with ETH secp256k1 accounts and optional BLS accounts').option('--data-dir <path>', 'Directory to store keystore(s). Defaults to ~/.aztec/keystore').option('--file <name>', 'Keystore file name. Defaults to key1.json (or keyN.json if key1.json exists)').option('--count <N>', 'Number of validators to generate', parseOptionalInteger).option('--publisher-count <N>', 'Number of publisher accounts per validator (default 0)', (value)=>parseOptionalInteger(value, 0)).option('--publishers <privateKeys>', 'Comma-separated list of publisher private keys for all validators.', (value)=>value.split(',').map((key)=>key.trim())).option('--mnemonic <mnemonic>', 'Mnemonic for ETH/BLS derivation').option('--passphrase <str>', 'Optional passphrase for mnemonic').option('--account-index <N>', 'Base account index for ETH/BLS derivation', parseOptionalInteger).option('--address-index <N>', 'Base address index for ETH/BLS derivation', parseOptionalInteger).option('--coinbase <address>', 'Coinbase ETH address to use when proposing. Defaults to attester address.', parseEthereumAddress).option('--funding-account <privateKey|address>', 'ETH funding account used to top up publisher EOAs. Provide a private key, or an address together with --remote-signer.').option('--remote-signer <url>', 'Default remote signer URL for accounts in this file').option('--ikm <hex>', 'Initial keying material for BLS (alternative to mnemonic)', (value)=>parseHex(value, 32)).option('--bls-path <path>', `EIP-2334 path (default ${defaultBlsPath})`).addOption(blsKeyDerivationV6Option()).addOption(blsKeyDerivationMaxGasOption()).addOption(skipBlsKeyGasCheckOption()).addOption(new Option('--password <str>', 'Shared password for writing ETH JSON V3 and BLS EIP-2335 keystore files').env('AZTEC_KEYSTORE_PASSWORD')).option('--password-file <path>', 'File containing the shared password for writing keystore files').addOption(new Option('--eth-password <str>', 'Password for writing ETH JSON V3 keystore files').env('AZTEC_ETH_KEYSTORE_PASSWORD')).option('--eth-password-file <path>', 'File containing the password for writing ETH JSON V3 keystore files').addOption(new Option('--bls-password <str>', 'Password for writing BLS EIP-2335 keystore files').env('AZTEC_BLS_KEYSTORE_PASSWORD')).option('--bls-password-file <path>', 'File containing the password for writing BLS EIP-2335 keystore files').option('--encrypted-keystore-dir <dir>', 'Output directory for encrypted keystore file(s)').option('--json', 'Echo resulting JSON to stdout').option('--staker-output', 'Generate a single staker output JSON file with an array of validator entries').option('--gse-address <address>', 'GSE contract address (required with --staker-output)', parseEthereumAddress).option('--l1-rpc-urls <urls>', 'L1 RPC URLs (comma-separated, required with --staker-output)', (value)=>value.split(',')).option('-c, --l1-chain-id <number>', 'L1 chain ID (required with --staker-output)', (value)=>parseInt(value), 31337).requiredOption('--fee-recipient <address>', 'Aztec address that will receive fees', parseAztecAddress).action(async (options)=>{
         const { newValidatorKeystore } = await import('./new.js');
         await newValidatorKeystore(options, log);
     });
-    group.command('add').summary('Augment an existing validator keystore JSON').description('Adds attester/publisher/BLS entries to an existing keystore using the same flags as new').argument('<existing>', 'Path to existing keystore JSON').option('--data-dir <path>', 'Directory where keystore(s) live. (default: ~/.aztec/keystore)').option('--file <name>', 'Override output file name. (default: key<N>.json)').option('--count <N>', 'Number of validators to add. (default: 1)', parseOptionalInteger).option('--publisher-count <N>', 'Number of publisher accounts per validator (default 0)', (value)=>parseOptionalInteger(value, 0)).option('--publishers <privateKeys>', 'Comma-separated list of publisher private keys for all validators.', (value)=>value.split(',').map((key)=>key.trim())).option('--mnemonic <mnemonic>', 'Mnemonic for ETH/BLS derivation').option('--passphrase <str>', 'Optional passphrase for mnemonic').option('--account-index <N>', 'Base account index for ETH/BLS derivation', parseOptionalInteger).option('--address-index <N>', 'Base address index for ETH/BLS derivation', parseOptionalInteger).option('--coinbase <address>', 'Coinbase ETH address to use when proposing. Defaults to attester address.', parseEthereumAddress).option('--remote-signer <url>', 'Default remote signer URL for accounts in this file').option('--ikm <hex>', 'Initial keying material for BLS (alternative to mnemonic)', (value)=>parseHex(value, 32)).option('--bls-path <path>', `EIP-2334 path (default ${defaultBlsPath})`).option('--empty', 'Generate an empty skeleton without keys').option('--password <str>', 'Password for writing keystore files (ETH JSON V3 and BLS EIP-2335). Empty string allowed').option('--encrypted-keystore-dir <dir>', 'Output directory for encrypted keystore file(s)').option('--json', 'Echo resulting JSON to stdout').requiredOption('--fee-recipient <address>', 'Aztec address that will receive fees', parseAztecAddress).action(async (existing, options)=>{
+    group.command('add').summary('Augment an existing validator keystore JSON').description('Adds attester/publisher/BLS entries to an existing keystore using the same flags as new').argument('<existing>', 'Path to existing keystore JSON').option('--data-dir <path>', 'Directory where keystore(s) live. (default: ~/.aztec/keystore)').option('--file <name>', 'Override output file name. (default: key<N>.json)').option('--count <N>', 'Number of validators to add. (default: 1)', parseOptionalInteger).option('--publisher-count <N>', 'Number of publisher accounts per validator (default 0)', (value)=>parseOptionalInteger(value, 0)).option('--publishers <privateKeys>', 'Comma-separated list of publisher private keys for all validators.', (value)=>value.split(',').map((key)=>key.trim())).option('--mnemonic <mnemonic>', 'Mnemonic for ETH/BLS derivation').option('--passphrase <str>', 'Optional passphrase for mnemonic').option('--account-index <N>', 'Base account index for ETH/BLS derivation', parseOptionalInteger).option('--address-index <N>', 'Base address index for ETH/BLS derivation', parseOptionalInteger).option('--coinbase <address>', 'Coinbase ETH address to use when proposing. Defaults to attester address.', parseEthereumAddress).option('--remote-signer <url>', 'Default remote signer URL for accounts in this file').option('--ikm <hex>', 'Initial keying material for BLS (alternative to mnemonic)', (value)=>parseHex(value, 32)).option('--bls-path <path>', `EIP-2334 path (default ${defaultBlsPath})`).addOption(blsKeyDerivationV6Option()).addOption(blsKeyDerivationMaxGasOption()).addOption(skipBlsKeyGasCheckOption()).option('--empty', 'Generate an empty skeleton without keys').option('--password <str>', 'Password for writing keystore files (ETH JSON V3 and BLS EIP-2335). Empty string allowed').option('--encrypted-keystore-dir <dir>', 'Output directory for encrypted keystore file(s)').option('--json', 'Echo resulting JSON to stdout').requiredOption('--fee-recipient <address>', 'Aztec address that will receive fees', parseAztecAddress).action(async (existing, options)=>{
         const { addValidatorKeys } = await import('./add.js');
         await addValidatorKeys(existing, options, log);
     });
@@ -25,7 +36,7 @@ export function injectCommands(program, log) {
         await generateStakerJson(options, log);
     });
     // top-level convenience: aztec generate-bls-keypair
-    program.command('generate-bls-keypair').description('Generate a BLS keypair with convenience flags').option('--mnemonic <mnemonic>', 'Mnemonic for BLS derivation').option('--ikm <hex>', 'Initial keying material for BLS (alternative to mnemonic)', (value)=>parseHex(value, 32)).option('--bls-path <path>', `EIP-2334 path (default ${defaultBlsPath})`).option('--g2', 'Derive on G2 subgroup').option('--compressed', 'Output compressed public key').option('--json', 'Print JSON output to stdout').option('--out <file>', 'Write output to file').action(async (options)=>{
+    program.command('generate-bls-keypair').description('Generate a BLS keypair with convenience flags').option('--mnemonic <mnemonic>', 'Mnemonic for BLS derivation').option('--ikm <hex>', 'Initial keying material for BLS (alternative to mnemonic)', (value)=>parseHex(value, 32)).option('--bls-path <path>', `EIP-2334 path (default ${defaultBlsPath})`).addOption(blsKeyDerivationV6Option()).addOption(blsKeyDerivationMaxGasOption()).addOption(skipBlsKeyGasCheckOption()).option('--g2', 'Derive on G2 subgroup').option('--compressed', 'Output compressed public key').option('--json', 'Print JSON output to stdout').option('--out <file>', 'Write output to file').action(async (options)=>{
         const { generateBlsKeypair } = await import('./generate_bls_keypair.js');
         await generateBlsKeypair(options, log);
     });

package/dest/cmds/validator_keys/new.d.ts

@@ -1,6 +1,7 @@
 import type { EthAddress } from '@aztec-labs/foundation/eth-address';
 import type { LogFn } from '@aztec-labs/foundation/log';
 import type { AztecAddress } from '@aztec-labs/stdlib/aztec-address';
+import { type BlsKeyDerivationOptions } from './bls_key_derivation.js';
 export type NewValidatorKeystoreOptions = {
     dataDir?: string;
     file?: string;
@@ -30,6 +31,6 @@ export type NewValidatorKeystoreOptions = {
     gseAddress?: EthAddress;
     l1RpcUrls?: string[];
     l1ChainId?: number;
-};
+} & BlsKeyDerivationOptions;
 export declare function newValidatorKeystore(options: NewValidatorKeystoreOptions, log: LogFn): Promise<void>;
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoibmV3LmQudHMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi9zcmMvY21kcy92YWxpZGF0b3Jfa2V5cy9uZXcudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBR0EsT0FBTyxLQUFLLEVBQUUsVUFBVSxFQUFFLE1BQU0sb0NBQW9DLENBQUM7QUFDckUsT0FBTyxLQUFLLEVBQUUsS0FBSyxFQUFFLE1BQU0sNEJBQTRCLENBQUM7QUFDeEQsT0FBTyxLQUFLLEVBQUUsWUFBWSxFQUFFLE1BQU0sa0NBQWtDLENBQUM7QUEyQnJFLE1BQU0sTUFBTSwyQkFBMkIsR0FBRztJQUN4QyxPQUFPLENBQUMsRUFBRSxNQUFNLENBQUM7SUFDakIsSUFBSSxDQUFDLEVBQUUsTUFBTSxDQUFDO0lBQ2QsS0FBSyxDQUFDLEVBQUUsTUFBTSxDQUFDO0lBQ2YsY0FBYyxDQUFDLEVBQUUsTUFBTSxDQUFDO0lBQ3hCLFVBQVUsQ0FBQyxFQUFFLE1BQU0sRUFBRSxDQUFDO0lBQ3RCLFFBQVEsQ0FBQyxFQUFFLE1BQU0sQ0FBQztJQUNsQixVQUFVLENBQUMsRUFBRSxNQUFNLENBQUM7SUFDcEIsWUFBWSxDQUFDLEVBQUUsTUFBTSxDQUFDO0lBQ3RCLFlBQVksQ0FBQyxFQUFFLE1BQU0sQ0FBQztJQUN0QixpQkFBaUIsQ0FBQyxFQUFFLE9BQU8sQ0FBQztJQUM1QixHQUFHLENBQUMsRUFBRSxNQUFNLENBQUM7SUFDYixPQUFPLENBQUMsRUFBRSxNQUFNLENBQUM7SUFDakIsUUFBUSxDQUFDLEVBQUUsTUFBTSxDQUFDO0lBQ2xCLFlBQVksQ0FBQyxFQUFFLE1BQU0sQ0FBQztJQUN0QixXQUFXLENBQUMsRUFBRSxNQUFNLENBQUM7SUFDckIsZUFBZSxDQUFDLEVBQUUsTUFBTSxDQUFDO0lBQ3pCLFdBQVcsQ0FBQyxFQUFFLE1BQU0sQ0FBQztJQUNyQixlQUFlLENBQUMsRUFBRSxNQUFNLENBQUM7SUFDekIsb0JBQW9CLENBQUMsRUFBRSxNQUFNLENBQUM7SUFDOUIsSUFBSSxDQUFDLEVBQUUsT0FBTyxDQUFDO0lBQ2YsWUFBWSxFQUFFLFlBQVksQ0FBQztJQUMzQixRQUFRLENBQUMsRUFBRSxVQUFVLENBQUM7SUFDdEIsY0FBYyxDQUFDLEVBQUUsTUFBTSxDQUFDO0lBQ3hCLFlBQVksQ0FBQyxFQUFFLE1BQU0sQ0FBQztJQUN0QixZQUFZLENBQUMsRUFBRSxPQUFPLENBQUM7SUFDdkIsVUFBVSxDQUFDLEVBQUUsVUFBVSxDQUFDO0lBQ3hCLFNBQVMsQ0FBQyxFQUFFLE1BQU0sRUFBRSxDQUFDO0lBQ3JCLFNBQVMsQ0FBQyxFQUFFLE1BQU0sQ0FBQztDQUNwQixDQUFDO0FBa0ZGLHdCQUFzQixvQkFBb0IsQ0FBQyxPQUFPLEVBQUUsMkJBQTJCLEVBQUUsR0FBRyxFQUFFLEtBQUssaUJBc0wxRiJ9
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoibmV3LmQudHMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi9zcmMvY21kcy92YWxpZGF0b3Jfa2V5cy9uZXcudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBR0EsT0FBTyxLQUFLLEVBQUUsVUFBVSxFQUFFLE1BQU0sb0NBQW9DLENBQUM7QUFDckUsT0FBTyxLQUFLLEVBQUUsS0FBSyxFQUFFLE1BQU0sNEJBQTRCLENBQUM7QUFDeEQsT0FBTyxLQUFLLEVBQUUsWUFBWSxFQUFFLE1BQU0sa0NBQWtDLENBQUM7QUFPckUsT0FBTyxFQUFFLEtBQUssdUJBQXVCLEVBQWlDLE1BQU0seUJBQXlCLENBQUM7QUF1QnRHLE1BQU0sTUFBTSwyQkFBMkIsR0FBRztJQUN4QyxPQUFPLENBQUMsRUFBRSxNQUFNLENBQUM7SUFDakIsSUFBSSxDQUFDLEVBQUUsTUFBTSxDQUFDO0lBQ2QsS0FBSyxDQUFDLEVBQUUsTUFBTSxDQUFDO0lBQ2YsY0FBYyxDQUFDLEVBQUUsTUFBTSxDQUFDO0lBQ3hCLFVBQVUsQ0FBQyxFQUFFLE1BQU0sRUFBRSxDQUFDO0lBQ3RCLFFBQVEsQ0FBQyxFQUFFLE1BQU0sQ0FBQztJQUNsQixVQUFVLENBQUMsRUFBRSxNQUFNLENBQUM7SUFDcEIsWUFBWSxDQUFDLEVBQUUsTUFBTSxDQUFDO0lBQ3RCLFlBQVksQ0FBQyxFQUFFLE1BQU0sQ0FBQztJQUN0QixpQkFBaUIsQ0FBQyxFQUFFLE9BQU8sQ0FBQztJQUM1QixHQUFHLENBQUMsRUFBRSxNQUFNLENBQUM7SUFDYixPQUFPLENBQUMsRUFBRSxNQUFNLENBQUM7SUFDakIsUUFBUSxDQUFDLEVBQUUsTUFBTSxDQUFDO0lBQ2xCLFlBQVksQ0FBQyxFQUFFLE1BQU0sQ0FBQztJQUN0QixXQUFXLENBQUMsRUFBRSxNQUFNLENBQUM7SUFDckIsZUFBZSxDQUFDLEVBQUUsTUFBTSxDQUFDO0lBQ3pCLFdBQVcsQ0FBQyxFQUFFLE1BQU0sQ0FBQztJQUNyQixlQUFlLENBQUMsRUFBRSxNQUFNLENBQUM7SUFDekIsb0JBQW9CLENBQUMsRUFBRSxNQUFNLENBQUM7SUFDOUIsSUFBSSxDQUFDLEVBQUUsT0FBTyxDQUFDO0lBQ2YsWUFBWSxFQUFFLFlBQVksQ0FBQztJQUMzQixRQUFRLENBQUMsRUFBRSxVQUFVLENBQUM7SUFDdEIsY0FBYyxDQUFDLEVBQUUsTUFBTSxDQUFDO0lBQ3hCLFlBQVksQ0FBQyxFQUFFLE1BQU0sQ0FBQztJQUN0QixZQUFZLENBQUMsRUFBRSxPQUFPLENBQUM7SUFDdkIsVUFBVSxDQUFDLEVBQUUsVUFBVSxDQUFDO0lBQ3hCLFNBQVMsQ0FBQyxFQUFFLE1BQU0sRUFBRSxDQUFDO0lBQ3JCLFNBQVMsQ0FBQyxFQUFFLE1BQU0sQ0FBQztDQUNwQixHQUFHLHVCQUF1QixDQUFDO0FBa0Y1Qix3QkFBc0Isb0JBQW9CLENBQUMsT0FBTyxFQUFFLDJCQUEyQixFQUFFLEdBQUcsRUFBRSxLQUFLLGlCQXFNMUYifQ==

package/dest/cmds/validator_keys/new.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"new.d.ts","sourceRoot":"","sources":["../../../src/cmds/validator_keys/new.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oCAAoC,CAAC;AACrE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,4BAA4B,CAAC;AACxD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kCAAkC,CAAC;AA2BrE,MAAM,MAAM,2BAA2B,GAAG;IACxC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,YAAY,EAAE,YAAY,CAAC;IAC3B,QAAQ,CAAC,EAAE,UAAU,CAAC;IACtB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAkFF,wBAAsB,oBAAoB,CAAC,OAAO,EAAE,2BAA2B,EAAE,GAAG,EAAE,KAAK,iBAsL1F"}
+{"version":3,"file":"new.d.ts","sourceRoot":"","sources":["../../../src/cmds/validator_keys/new.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oCAAoC,CAAC;AACrE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,4BAA4B,CAAC;AACxD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kCAAkC,CAAC;AAOrE,OAAO,EAAE,KAAK,uBAAuB,EAAiC,MAAM,yBAAyB,CAAC;AAuBtG,MAAM,MAAM,2BAA2B,GAAG;IACxC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,YAAY,EAAE,YAAY,CAAC;IAC3B,QAAQ,CAAC,EAAE,UAAU,CAAC;IACtB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,GAAG,uBAAuB,CAAC;AAkF5B,wBAAsB,oBAAoB,CAAC,OAAO,EAAE,2BAA2B,EAAE,GAAG,EAAE,KAAK,iBAqM1F"}

package/dest/cmds/validator_keys/new.js

@@ -6,8 +6,9 @@ import { readFile, writeFile } from 'fs/promises';
 import { basename, dirname, join } from 'path';
 import { createPublicClient, fallback, http } from 'viem';
 import { generateMnemonic, mnemonicToAccount, privateKeyToAccount } from 'viem/accounts';
-import { buildValidatorEntries, encryptFundingAccountToFile, logValidatorSummaries, maybePrintJson, resolveFundingAccount, resolveKeystoreOutputPath, writeBlsBn254ToFile, writeEthJsonV3ToFile, writeKeystoreFile } from './shared.js';
-import { processAttesterAccounts } from './staker.js';
+import { resolveBlsKeyDerivationPolicy } from './bls_key_derivation.js';
+import { buildValidatorEntries, encryptFundingAccountToFile, getBlsDerivationPaths, getBlsKeyCandidates, logValidatorSummaries, maybePrintJson, resolveFundingAccount, resolveKeystoreOutputPath, writeBlsBn254ToFile, writeEthJsonV3ToFile, writeKeystoreFile } from './shared.js';
+import { assertWithinProofOfPossessionGasLimit, processAttesterAccounts } from './staker.js';
 import { validateBlsPathOptions, validateFundingAccountOptions, validatePublisherOptions, validateRemoteSignerOptions, validateStakerOutputOptions } from './utils.js';
 function validatePassword(password, source) {
     if (password.length === 0) {
@@ -81,6 +82,7 @@ export async function newValidatorKeystore(options, log) {
     validateRemoteSignerOptions(options);
     // validate funding account option
     validateFundingAccountOptions(options);
+    const blsKeyDerivation = resolveBlsKeyDerivationPolicy(options);
     const { dataDir, file, count, publisherCount = 0, publishers, json, coinbase, fundingAccount, accountIndex = 0, addressIndex = 0, feeRecipient, remoteSigner, blsPath, ikm, mnemonic: _mnemonic, password: passwordOption, passwordFile, ethPassword: ethPasswordOption, ethPasswordFile, blsPassword: blsPasswordOption, blsPasswordFile, encryptedKeystoreDir, stakerOutput, gseAddress, l1RpcUrls, l1ChainId } = options;
     const { ethPassword, blsPassword } = await resolvePasswords({
         password: passwordOption,
@@ -92,7 +94,8 @@ export async function newValidatorKeystore(options, log) {
     });
     const shouldEncryptKeystores = ethPassword !== undefined && blsPassword !== undefined;
     const mnemonic = _mnemonic ?? generateMnemonic(wordlist);
-    if (!_mnemonic && !json && !shouldEncryptKeystores) {
+    const showGeneratedMnemonic = !_mnemonic && !json && !shouldEncryptKeystores;
+    if (showGeneratedMnemonic) {
         log('No mnemonic provided, generating new one...');
         log(`Using new mnemonic:`);
         log('');
@@ -113,8 +116,33 @@ export async function newValidatorKeystore(options, log) {
         blsPath,
         feeRecipient,
         coinbase,
-        remoteSigner
+        remoteSigner,
+        blsKeyDerivation,
+        generatedMnemonic: _mnemonic ? undefined : showGeneratedMnemonic ? 'shown' : 'hidden'
     });
+    // Generate staker outputs if requested, from the plaintext keys and before writing anything, so that keys the GSE
+    // would reject leave no files behind.
+    const allStakerOutputs = [];
+    if (stakerOutput && gseAddress && l1RpcUrls && l1ChainId !== undefined) {
+        const chain = createEthereumChain(l1RpcUrls, l1ChainId);
+        const publicClient = createPublicClient({
+            chain: chain.chainInfo,
+            transport: fallback(l1RpcUrls.map((url)=>http(url, {
+                    batch: false
+                })))
+        });
+        const gse = new GSEContract(publicClient, gseAddress);
+        // Process each validator
+        for(let i = 0; i < validators.length; i++){
+            const validator = validators[i];
+            const outputs = await processAttesterAccounts(validator.attester, gse);
+            // Collect all staker outputs
+            for(let j = 0; j < outputs.length; j++){
+                allStakerOutputs.push(outputs[j]);
+            }
+        }
+        await assertWithinProofOfPossessionGasLimit(gse, allStakerOutputs);
+    }
     let resolvedFundingAccount = fundingAccount ? resolveFundingAccount(fundingAccount, remoteSigner) : undefined;
     // If password provided, write ETH JSON V3 and BLS BN254 keystores and replace plaintext
     if (shouldEncryptKeystores) {
@@ -125,7 +153,8 @@ export async function newValidatorKeystore(options, log) {
         });
         await writeBlsBn254ToFile(validators, {
             outDir: encryptedKeystoreOutDir,
-            password: blsPassword
+            password: blsPassword,
+            derivationPaths: getBlsDerivationPaths(summaries)
         });
         if (resolvedFundingAccount) {
             resolvedFundingAccount = await encryptFundingAccountToFile(resolvedFundingAccount, {
@@ -142,38 +171,23 @@ export async function newValidatorKeystore(options, log) {
         } : {}
     };
     await writeKeystoreFile(outputPath, keystore);
-    // Generate staker outputs if requested
-    const allStakerOutputs = [];
-    if (stakerOutput && gseAddress && l1RpcUrls && l1ChainId !== undefined) {
-        const chain = createEthereumChain(l1RpcUrls, l1ChainId);
-        const publicClient = createPublicClient({
-            chain: chain.chainInfo,
-            transport: fallback(l1RpcUrls.map((url)=>http(url, {
-                    batch: false
-                })))
-        });
-        const gse = new GSEContract(publicClient, gseAddress);
+    // Write a single JSON file with all staker outputs
+    if (allStakerOutputs.length > 0) {
         // Extract keystore base name without extension for unique staker output filenames
         const keystoreBaseName = basename(outputPath, '.json');
-        // Process each validator
-        for(let i = 0; i < validators.length; i++){
-            const validator = validators[i];
-            const outputs = await processAttesterAccounts(validator.attester, gse);
-            // Collect all staker outputs
-            for(let j = 0; j < outputs.length; j++){
-                allStakerOutputs.push(outputs[j]);
-            }
-        }
-        // Write a single JSON file with all staker outputs
-        if (allStakerOutputs.length > 0) {
-            const stakerOutputPath = join(keystoreOutDir, `${keystoreBaseName}_staker_output.json`);
-            await writeFile(stakerOutputPath, prettyPrintJSON(allStakerOutputs), 'utf-8');
-        }
+        const stakerOutputPath = join(keystoreOutDir, `${keystoreBaseName}_staker_output.json`);
+        await writeFile(stakerOutputPath, prettyPrintJSON(allStakerOutputs), 'utf-8');
     }
-    const outputData = !_mnemonic && !shouldEncryptKeystores ? {
+    const blsKeyCandidates = getBlsKeyCandidates(summaries);
+    const outputData = {
         ...keystore,
-        generatedMnemonic: mnemonic
-    } : keystore;
+        ...!_mnemonic && !shouldEncryptKeystores ? {
+            generatedMnemonic: mnemonic
+        } : {},
+        ...blsKeyCandidates.length > 0 ? {
+            blsKeyCandidates
+        } : {}
+    };
     // Handle JSON output
     if (json) {
         if (stakerOutput && allStakerOutputs.length > 0) {

package/dest/cmds/validator_keys/shared.d.ts

@@ -2,9 +2,16 @@ import { EthAddress } from '@aztec-labs/foundation/eth-address';
 import type { LogFn } from '@aztec-labs/foundation/log';
 import type { EthAccount, EthPrivateKey, ValidatorKeyStore } from '@aztec-labs/node-keystore/types';
 import type { AztecAddress } from '@aztec-labs/stdlib/aztec-address';
+import { type BlsKeyDerivationPolicy, type GeneratedMnemonic } from './bls_key_derivation.js';
 export type ValidatorSummary = {
     attesterEth?: string;
     attesterBls?: string;
+    /** Derivation path of the BLS key, including the candidate component when the candidate is not 0. */
+    blsPath?: string;
+    /** Candidate selected by the BLS key derivation policy; 0 unless a retry picked another one. */
+    blsCandidate?: number;
+    /** The `--bls-key-derivation-max-gas` budget, when it took part in selecting a candidate other than 0. */
+    blsMaxGas?: number;
     publisherEth?: string[];
 };
 export type BuildValidatorsInput = {
@@ -19,6 +26,10 @@ export type BuildValidatorsInput = {
     feeRecipient: AztecAddress;
     coinbase?: EthAddress;
     remoteSigner?: string;
+    /** Defaults to the policy used when no BLS key derivation flag is given. */
+    blsKeyDerivation?: BlsKeyDerivationPolicy;
+    /** Set when the CLI generated `mnemonic` in this run. */
+    generatedMnemonic?: GeneratedMnemonic;
 };
 export declare function withValidatorIndex(path: string, accountIndex?: number, addressIndex?: number): string;
 /**
@@ -46,6 +57,16 @@ export declare function resolveKeystoreOutputPath(dataDir?: string, file?: strin
 }>;
 export declare function writeKeystoreFile(path: string, keystore: unknown): Promise<void>;
 export declare function logValidatorSummaries(log: LogFn, summaries: ValidatorSummary[]): void;
+/** BLS keys in `summaries` that came from a retry candidate, for reporting alongside JSON output. */
+export declare function getBlsKeyCandidates(summaries: ValidatorSummary[]): {
+    attesterEth: string | undefined;
+    bls: string | undefined;
+    path: string | undefined;
+    candidate: number | undefined;
+    maxGas?: number | undefined;
+}[];
+/** Derivation path of each BLS key in `summaries`, keyed by its compressed public key. */
+export declare function getBlsDerivationPaths(summaries: ValidatorSummary[]): Map<string, string>;
 export declare function maybePrintJson(log: LogFn, jsonFlag: boolean | undefined, obj: unknown): void;
 /**
  * Writes a BN254 keystore file for a BN254 BLS private key.
@@ -60,11 +81,15 @@ export declare function maybePrintJson(log: LogFn, jsonFlag: boolean | undefined
  * @returns Absolute path to the written keystore file
  */
 export declare function writeBn254BlsKeystore(outDir: string, fileNameBase: string, password: string, privateKeyHex: string, pubkeyHex: string, derivationPath: string): Promise<string>;
-/** Replace plaintext BLS keys in validators with { path, password } pointing to BN254 keystore files. */
+/**
+ * Replace plaintext BLS keys in validators with { path, password } pointing to BN254 keystore files. Each file records
+ * the key's derivation path from `derivationPaths` (keyed by compressed public key), or an empty path for keys missing
+ * from it, such as keys that were already in a keystore file, whose origin is unknown.
+ */
 export declare function writeBlsBn254ToFile(validators: ValidatorKeyStore[], options: {
     outDir: string;
     password: string;
-    blsPath?: string;
+    derivationPaths?: Map<string, string>;
 }): Promise<void>;
 /** Writes an Ethereum JSON V3 keystore using ethers, returns absolute path */
 export declare function writeEthJsonV3Keystore(outDir: string, fileNameBase: string, password: string, privateKeyHex: string): Promise<string>;
@@ -78,4 +103,4 @@ export declare function writeEthJsonV3ToFile(validators: ValidatorKeyStore[], op
     outDir: string;
     password: string;
 }): Promise<void>;
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic2hhcmVkLmQudHMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi9zcmMvY21kcy92YWxpZGF0b3Jfa2V5cy9zaGFyZWQudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBS0EsT0FBTyxFQUFFLFVBQVUsRUFBRSxNQUFNLG9DQUFvQyxDQUFDO0FBQ2hFLE9BQU8sS0FBSyxFQUFFLEtBQUssRUFBRSxNQUFNLDRCQUE0QixDQUFDO0FBQ3hELE9BQU8sS0FBSyxFQUFFLFVBQVUsRUFBRSxhQUFhLEVBQUUsaUJBQWlCLEVBQUUsTUFBTSxpQ0FBaUMsQ0FBQztBQUNwRyxPQUFPLEtBQUssRUFBRSxZQUFZLEVBQUUsTUFBTSxrQ0FBa0MsQ0FBQztBQTJEckUsTUFBTSxNQUFNLGdCQUFnQixHQUFHO0lBQUUsV0FBVyxDQUFDLEVBQUUsTUFBTSxDQUFDO0lBQUMsV0FBVyxDQUFDLEVBQUUsTUFBTSxDQUFDO0lBQUMsWUFBWSxDQUFDLEVBQUUsTUFBTSxFQUFFLENBQUE7Q0FBRSxDQUFDO0FBRXZHLE1BQU0sTUFBTSxvQkFBb0IsR0FBRztJQUNqQyxjQUFjLEVBQUUsTUFBTSxDQUFDO0lBQ3ZCLGNBQWMsQ0FBQyxFQUFFLE1BQU0sQ0FBQztJQUN4QixVQUFVLENBQUMsRUFBRSxNQUFNLEVBQUUsQ0FBQztJQUN0QixZQUFZLEVBQUUsTUFBTSxDQUFDO0lBQ3JCLGdCQUFnQixFQUFFLE1BQU0sQ0FBQztJQUN6QixRQUFRLEVBQUUsTUFBTSxDQUFDO0lBQ2pCLEdBQUcsQ0FBQyxFQUFFLE1BQU0sQ0FBQztJQUNiLE9BQU8sQ0FBQyxFQUFFLE1BQU0sQ0FBQztJQUNqQixZQUFZLEVBQUUsWUFBWSxDQUFDO0lBQzNCLFFBQVEsQ0FBQyxFQUFFLFVBQVUsQ0FBQztJQUN0QixZQUFZLENBQUMsRUFBRSxNQUFNLENBQUM7Q0FDdkIsQ0FBQztBQUVGLHdCQUFnQixrQkFBa0IsQ0FBQyxJQUFJLEVBQUUsTUFBTSxFQUFFLFlBQVksR0FBRSxNQUFVLEVBQUUsWUFBWSxHQUFFLE1BQVUsVUFxQmxHO0FBRUQ7Ozs7R0FJRztBQUNILHdCQUFzQiw2QkFBNkIsQ0FBQyxhQUFhLEVBQUUsTUFBTSxHQUFHLE9BQU8sQ0FBQyxNQUFNLENBQUMsQ0FFMUY7QUFFRCx3QkFBZ0IsaUJBQWlCLENBQy9CLFFBQVEsRUFBRSxNQUFNLEVBQ2hCLGdCQUFnQixFQUFFLE1BQU0sRUFDeEIsWUFBWSxFQUFFLE1BQU0sRUFDcEIsWUFBWSxDQUFDLEVBQUUsTUFBTSxHQUNwQixVQUFVLEdBQUcsYUFBYSxDQUs1QjtBQUVEOzs7Ozs7R0FNRztBQUNILHdCQUFnQixxQkFBcUIsQ0FBQyxjQUFjLEVBQUUsTUFBTSxFQUFFLFlBQVksQ0FBQyxFQUFFLE1BQU0sR0FBRyxVQUFVLENBTS9GO0FBRUQsd0JBQXNCLHFCQUFxQixDQUFDLEtBQUssRUFBRSxvQkFBb0I7OztHQXVFdEU7QUFFRCx3QkFBc0IseUJBQXlCLENBQUMsT0FBTyxDQUFDLEVBQUUsTUFBTSxFQUFFLElBQUksQ0FBQyxFQUFFLE1BQU07OztHQW9COUU7QUFFRCx3QkFBc0IsaUJBQWlCLENBQUMsSUFBSSxFQUFFLE1BQU0sRUFBRSxRQUFRLEVBQUUsT0FBTyxpQkFHdEU7QUFFRCx3QkFBZ0IscUJBQXFCLENBQUMsR0FBRyxFQUFFLEtBQUssRUFBRSxTQUFTLEVBQUUsZ0JBQWdCLEVBQUUsUUFzQjlFO0FBRUQsd0JBQWdCLGNBQWMsQ0FBQyxHQUFHLEVBQUUsS0FBSyxFQUFFLFFBQVEsRUFBRSxPQUFPLEdBQUcsU0FBUyxFQUFFLEdBQUcsRUFBRSxPQUFPLFFBSXJGO0FBRUQ7Ozs7Ozs7Ozs7O0dBV0c7QUFDSCx3QkFBc0IscUJBQXFCLENBQ3pDLE1BQU0sRUFBRSxNQUFNLEVBQ2QsWUFBWSxFQUFFLE1BQU0sRUFDcEIsUUFBUSxFQUFFLE1BQU0sRUFDaEIsYUFBYSxFQUFFLE1BQU0sRUFDckIsU0FBUyxFQUFFLE1BQU0sRUFDakIsY0FBYyxFQUFFLE1BQU0sR0FDckIsT0FBTyxDQUFDLE1BQU0sQ0FBQyxDQVNqQjtBQUVELHlHQUF5RztBQUN6Ryx3QkFBc0IsbUJBQW1CLENBQ3ZDLFVBQVUsRUFBRSxpQkFBaUIsRUFBRSxFQUMvQixPQUFPLEVBQUU7SUFBRSxNQUFNLEVBQUUsTUFBTSxDQUFDO0lBQUMsUUFBUSxFQUFFLE1BQU0sQ0FBQztJQUFDLE9BQU8sQ0FBQyxFQUFFLE1BQU0sQ0FBQTtDQUFFLEdBQzlELE9BQU8sQ0FBQyxJQUFJLENBQUMsQ0F3QmY7QUFFRCw4RUFBOEU7QUFDOUUsd0JBQXNCLHNCQUFzQixDQUMxQyxNQUFNLEVBQUUsTUFBTSxFQUNkLFlBQVksRUFBRSxNQUFNLEVBQ3BCLFFBQVEsRUFBRSxNQUFNLEVBQ2hCLGFBQWEsRUFBRSxNQUFNLEdBQ3BCLE9BQU8sQ0FBQyxNQUFNLENBQUMsQ0FPakI7QUFlRCxtSEFBbUg7QUFDbkgsd0JBQXNCLDJCQUEyQixDQUMvQyxPQUFPLEVBQUUsVUFBVSxFQUNuQixPQUFPLEVBQUU7SUFBRSxNQUFNLEVBQUUsTUFBTSxDQUFDO0lBQUMsUUFBUSxFQUFFLE1BQU0sQ0FBQTtDQUFFLEdBQzVDLE9BQU8sQ0FBQyxVQUFVLENBQUMsQ0FFckI7QUFFRCxrR0FBa0c7QUFDbEcsd0JBQXNCLG9CQUFvQixDQUN4QyxVQUFVLEVBQUUsaUJBQWlCLEVBQUUsRUFDL0IsT0FBTyxFQUFFO0lBQUUsTUFBTSxFQUFFLE1BQU0sQ0FBQztJQUFDLFFBQVEsRUFBRSxNQUFNLENBQUE7Q0FBRSxHQUM1QyxPQUFPLENBQUMsSUFBSSxDQUFDLENBeUNmIn0=
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic2hhcmVkLmQudHMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi9zcmMvY21kcy92YWxpZGF0b3Jfa2V5cy9zaGFyZWQudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBS0EsT0FBTyxFQUFFLFVBQVUsRUFBRSxNQUFNLG9DQUFvQyxDQUFDO0FBQ2hFLE9BQU8sS0FBSyxFQUFFLEtBQUssRUFBRSxNQUFNLDRCQUE0QixDQUFDO0FBQ3hELE9BQU8sS0FBSyxFQUFFLFVBQVUsRUFBRSxhQUFhLEVBQUUsaUJBQWlCLEVBQUUsTUFBTSxpQ0FBaUMsQ0FBQztBQUNwRyxPQUFPLEtBQUssRUFBRSxZQUFZLEVBQUUsTUFBTSxrQ0FBa0MsQ0FBQztBQVVyRSxPQUFPLEVBQ0wsS0FBSyxzQkFBc0IsRUFDM0IsS0FBSyxpQkFBaUIsRUFHdkIsTUFBTSx5QkFBeUIsQ0FBQztBQW1EakMsTUFBTSxNQUFNLGdCQUFnQixHQUFHO0lBQzdCLFdBQVcsQ0FBQyxFQUFFLE1BQU0sQ0FBQztJQUNyQixXQUFXLENBQUMsRUFBRSxNQUFNLENBQUM7SUFDckIscUdBQXFHO0lBQ3JHLE9BQU8sQ0FBQyxFQUFFLE1BQU0sQ0FBQztJQUNqQixnR0FBZ0c7SUFDaEcsWUFBWSxDQUFDLEVBQUUsTUFBTSxDQUFDO0lBQ3RCLDBHQUEwRztJQUMxRyxTQUFTLENBQUMsRUFBRSxNQUFNLENBQUM7SUFDbkIsWUFBWSxDQUFDLEVBQUUsTUFBTSxFQUFFLENBQUM7Q0FDekIsQ0FBQztBQUVGLE1BQU0sTUFBTSxvQkFBb0IsR0FBRztJQUNqQyxjQUFjLEVBQUUsTUFBTSxDQUFDO0lBQ3ZCLGNBQWMsQ0FBQyxFQUFFLE1BQU0sQ0FBQztJQUN4QixVQUFVLENBQUMsRUFBRSxNQUFNLEVBQUUsQ0FBQztJQUN0QixZQUFZLEVBQUUsTUFBTSxDQUFDO0lBQ3JCLGdCQUFnQixFQUFFLE1BQU0sQ0FBQztJQUN6QixRQUFRLEVBQUUsTUFBTSxDQUFDO0lBQ2pCLEdBQUcsQ0FBQyxFQUFFLE1BQU0sQ0FBQztJQUNiLE9BQU8sQ0FBQyxFQUFFLE1BQU0sQ0FBQztJQUNqQixZQUFZLEVBQUUsWUFBWSxDQUFDO0lBQzNCLFFBQVEsQ0FBQyxFQUFFLFVBQVUsQ0FBQztJQUN0QixZQUFZLENBQUMsRUFBRSxNQUFNLENBQUM7SUFDdEIsNEVBQTRFO0lBQzVFLGdCQUFnQixDQUFDLEVBQUUsc0JBQXNCLENBQUM7SUFDMUMseURBQXlEO0lBQ3pELGlCQUFpQixDQUFDLEVBQUUsaUJBQWlCLENBQUM7Q0FDdkMsQ0FBQztBQUVGLHdCQUFnQixrQkFBa0IsQ0FBQyxJQUFJLEVBQUUsTUFBTSxFQUFFLFlBQVksR0FBRSxNQUFVLEVBQUUsWUFBWSxHQUFFLE1BQVUsVUFxQmxHO0FBRUQ7Ozs7R0FJRztBQUNILHdCQUFzQiw2QkFBNkIsQ0FBQyxhQUFhLEVBQUUsTUFBTSxHQUFHLE9BQU8sQ0FBQyxNQUFNLENBQUMsQ0FFMUY7QUFFRCx3QkFBZ0IsaUJBQWlCLENBQy9CLFFBQVEsRUFBRSxNQUFNLEVBQ2hCLGdCQUFnQixFQUFFLE1BQU0sRUFDeEIsWUFBWSxFQUFFLE1BQU0sRUFDcEIsWUFBWSxDQUFDLEVBQUUsTUFBTSxHQUNwQixVQUFVLEdBQUcsYUFBYSxDQUs1QjtBQUVEOzs7Ozs7R0FNRztBQUNILHdCQUFnQixxQkFBcUIsQ0FBQyxjQUFjLEVBQUUsTUFBTSxFQUFFLFlBQVksQ0FBQyxFQUFFLE1BQU0sR0FBRyxVQUFVLENBTS9GO0FBRUQsd0JBQXNCLHFCQUFxQixDQUFDLEtBQUssRUFBRSxvQkFBb0I7OztHQWdGdEU7QUFFRCx3QkFBc0IseUJBQXlCLENBQUMsT0FBTyxDQUFDLEVBQUUsTUFBTSxFQUFFLElBQUksQ0FBQyxFQUFFLE1BQU07OztHQW9COUU7QUFFRCx3QkFBc0IsaUJBQWlCLENBQUMsSUFBSSxFQUFFLE1BQU0sRUFBRSxRQUFRLEVBQUUsT0FBTyxpQkFHdEU7QUFFRCx3QkFBZ0IscUJBQXFCLENBQUMsR0FBRyxFQUFFLEtBQUssRUFBRSxTQUFTLEVBQUUsZ0JBQWdCLEVBQUUsUUFnQzlFO0FBRUQscUdBQXFHO0FBQ3JHLHdCQUFnQixtQkFBbUIsQ0FBQyxTQUFTLEVBQUUsZ0JBQWdCLEVBQUU7Ozs7OztJQVVoRTtBQUVELDBGQUEwRjtBQUMxRix3QkFBZ0IscUJBQXFCLENBQUMsU0FBUyxFQUFFLGdCQUFnQixFQUFFLEdBQUcsR0FBRyxDQUFDLE1BQU0sRUFBRSxNQUFNLENBQUMsQ0FFeEY7QUFFRCx3QkFBZ0IsY0FBYyxDQUFDLEdBQUcsRUFBRSxLQUFLLEVBQUUsUUFBUSxFQUFFLE9BQU8sR0FBRyxTQUFTLEVBQUUsR0FBRyxFQUFFLE9BQU8sUUFJckY7QUFFRDs7Ozs7Ozs7Ozs7R0FXRztBQUNILHdCQUFzQixxQkFBcUIsQ0FDekMsTUFBTSxFQUFFLE1BQU0sRUFDZCxZQUFZLEVBQUUsTUFBTSxFQUNwQixRQUFRLEVBQUUsTUFBTSxFQUNoQixhQUFhLEVBQUUsTUFBTSxFQUNyQixTQUFTLEVBQUUsTUFBTSxFQUNqQixjQUFjLEVBQUUsTUFBTSxHQUNyQixPQUFPLENBQUMsTUFBTSxDQUFDLENBU2pCO0FBRUQ7Ozs7R0FJRztBQUNILHdCQUFzQixtQkFBbUIsQ0FDdkMsVUFBVSxFQUFFLGlCQUFpQixFQUFFLEVBQy9CLE9BQU8sRUFBRTtJQUFFLE1BQU0sRUFBRSxNQUFNLENBQUM7SUFBQyxRQUFRLEVBQUUsTUFBTSxDQUFDO0lBQUMsZUFBZSxDQUFDLEVBQUUsR0FBRyxDQUFDLE1BQU0sRUFBRSxNQUFNLENBQUMsQ0FBQTtDQUFFLEdBQ25GLE9BQU8sQ0FBQyxJQUFJLENBQUMsQ0F3QmY7QUFFRCw4RUFBOEU7QUFDOUUsd0JBQXNCLHNCQUFzQixDQUMxQyxNQUFNLEVBQUUsTUFBTSxFQUNkLFlBQVksRUFBRSxNQUFNLEVBQ3BCLFFBQVEsRUFBRSxNQUFNLEVBQ2hCLGFBQWEsRUFBRSxNQUFNLEdBQ3BCLE9BQU8sQ0FBQyxNQUFNLENBQUMsQ0FPakI7QUFlRCxtSEFBbUg7QUFDbkgsd0JBQXNCLDJCQUEyQixDQUMvQyxPQUFPLEVBQUUsVUFBVSxFQUNuQixPQUFPLEVBQUU7SUFBRSxNQUFNLEVBQUUsTUFBTSxDQUFDO0lBQUMsUUFBUSxFQUFFLE1BQU0sQ0FBQTtDQUFFLEdBQzVDLE9BQU8sQ0FBQyxVQUFVLENBQUMsQ0FFckI7QUFFRCxrR0FBa0c7QUFDbEcsd0JBQXNCLG9CQUFvQixDQUN4QyxVQUFVLEVBQUUsaUJBQWlCLEVBQUUsRUFDL0IsT0FBTyxFQUFFO0lBQUUsTUFBTSxFQUFFLE1BQU0sQ0FBQztJQUFDLFFBQVEsRUFBRSxNQUFNLENBQUE7Q0FBRSxHQUM1QyxPQUFPLENBQUMsSUFBSSxDQUFDLENBeUNmIn0=

package/dest/cmds/validator_keys/shared.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"shared.d.ts","sourceRoot":"","sources":["../../../src/cmds/validator_keys/shared.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,UAAU,EAAE,MAAM,oCAAoC,CAAC;AAChE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,4BAA4B,CAAC;AACxD,OAAO,KAAK,EAAE,UAAU,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AACpG,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kCAAkC,CAAC;AA2DrE,MAAM,MAAM,gBAAgB,GAAG;IAAE,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC;AAEvG,MAAM,MAAM,oBAAoB,GAAG;IACjC,cAAc,EAAE,MAAM,CAAC;IACvB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,gBAAgB,EAAE,MAAM,CAAC;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,YAAY,CAAC;IAC3B,QAAQ,CAAC,EAAE,UAAU,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,GAAE,MAAU,EAAE,YAAY,GAAE,MAAU,UAqBlG;AAED;;;;GAIG;AACH,wBAAsB,6BAA6B,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAE1F;AAED,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,MAAM,EAChB,gBAAgB,EAAE,MAAM,EACxB,YAAY,EAAE,MAAM,EACpB,YAAY,CAAC,EAAE,MAAM,GACpB,UAAU,GAAG,aAAa,CAK5B;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,cAAc,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,GAAG,UAAU,CAM/F;AAED,wBAAsB,qBAAqB,CAAC,KAAK,EAAE,oBAAoB;;;GAuEtE;AAED,wBAAsB,yBAAyB,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM;;;GAoB9E;AAED,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,iBAGtE;AAED,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,KAAK,EAAE,SAAS,EAAE,gBAAgB,EAAE,QAsB9E;AAED,wBAAgB,cAAc,CAAC,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,GAAG,SAAS,EAAE,GAAG,EAAE,OAAO,QAIrF;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,qBAAqB,CACzC,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,EAChB,aAAa,EAAE,MAAM,EACrB,SAAS,EAAE,MAAM,EACjB,cAAc,EAAE,MAAM,GACrB,OAAO,CAAC,MAAM,CAAC,CASjB;AAED,yGAAyG;AACzG,wBAAsB,mBAAmB,CACvC,UAAU,EAAE,iBAAiB,EAAE,EAC/B,OAAO,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,GAC9D,OAAO,CAAC,IAAI,CAAC,CAwBf;AAED,8EAA8E;AAC9E,wBAAsB,sBAAsB,CAC1C,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,EAChB,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,MAAM,CAAC,CAOjB;AAeD,mHAAmH;AACnH,wBAAsB,2BAA2B,CAC/C,OAAO,EAAE,UAAU,EACnB,OAAO,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAC5C,OAAO,CAAC,UAAU,CAAC,CAErB;AAED,kGAAkG;AAClG,wBAAsB,oBAAoB,CACxC,UAAU,EAAE,iBAAiB,EAAE,EAC/B,OAAO,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAC5C,OAAO,CAAC,IAAI,CAAC,CAyCf"}
+{"version":3,"file":"shared.d.ts","sourceRoot":"","sources":["../../../src/cmds/validator_keys/shared.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,UAAU,EAAE,MAAM,oCAAoC,CAAC;AAChE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,4BAA4B,CAAC;AACxD,OAAO,KAAK,EAAE,UAAU,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AACpG,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kCAAkC,CAAC;AAUrE,OAAO,EACL,KAAK,sBAAsB,EAC3B,KAAK,iBAAiB,EAGvB,MAAM,yBAAyB,CAAC;AAmDjC,MAAM,MAAM,gBAAgB,GAAG;IAC7B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,qGAAqG;IACrG,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,gGAAgG;IAChG,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,0GAA0G;IAC1G,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IACjC,cAAc,EAAE,MAAM,CAAC;IACvB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,gBAAgB,EAAE,MAAM,CAAC;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,YAAY,CAAC;IAC3B,QAAQ,CAAC,EAAE,UAAU,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,4EAA4E;IAC5E,gBAAgB,CAAC,EAAE,sBAAsB,CAAC;IAC1C,yDAAyD;IACzD,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;CACvC,CAAC;AAEF,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,GAAE,MAAU,EAAE,YAAY,GAAE,MAAU,UAqBlG;AAED;;;;GAIG;AACH,wBAAsB,6BAA6B,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAE1F;AAED,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,MAAM,EAChB,gBAAgB,EAAE,MAAM,EACxB,YAAY,EAAE,MAAM,EACpB,YAAY,CAAC,EAAE,MAAM,GACpB,UAAU,GAAG,aAAa,CAK5B;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,cAAc,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,GAAG,UAAU,CAM/F;AAED,wBAAsB,qBAAqB,CAAC,KAAK,EAAE,oBAAoB;;;GAgFtE;AAED,wBAAsB,yBAAyB,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM;;;GAoB9E;AAED,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,iBAGtE;AAED,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,KAAK,EAAE,SAAS,EAAE,gBAAgB,EAAE,QAgC9E;AAED,qGAAqG;AACrG,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,gBAAgB,EAAE;;;;;;IAUhE;AAED,0FAA0F;AAC1F,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,gBAAgB,EAAE,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAExF;AAED,wBAAgB,cAAc,CAAC,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,GAAG,SAAS,EAAE,GAAG,EAAE,OAAO,QAIrF;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,qBAAqB,CACzC,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,EAChB,aAAa,EAAE,MAAM,EACrB,SAAS,EAAE,MAAM,EACjB,cAAc,EAAE,MAAM,GACrB,OAAO,CAAC,MAAM,CAAC,CASjB;AAED;;;;GAIG;AACH,wBAAsB,mBAAmB,CACvC,UAAU,EAAE,iBAAiB,EAAE,EAC/B,OAAO,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,eAAe,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,GACnF,OAAO,CAAC,IAAI,CAAC,CAwBf;AAED,8EAA8E;AAC9E,wBAAsB,sBAAsB,CAC1C,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,EAChB,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,MAAM,CAAC,CAOjB;AAeD,mHAAmH;AACnH,wBAAsB,2BAA2B,CAC/C,OAAO,EAAE,UAAU,EACnB,OAAO,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAC5C,OAAO,CAAC,UAAU,CAAC,CAErB;AAED,kGAAkG;AAClG,wBAAsB,oBAAoB,CACxC,UAAU,EAAE,iBAAiB,EAAE,EAC/B,OAAO,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAC5C,OAAO,CAAC,IAAI,CAAC,CAyCf"}