@aztec/cli 0.0.0-test.0 → 0.0.1-commit.0208eb9

package/src/cmds/validator_keys/shared.ts

@@ -0,0 +1,326 @@
+import { prettyPrintJSON } from '@aztec/cli/utils';
+import { deriveBlsPrivateKey } from '@aztec/foundation/crypto/bls';
+import { createBn254Keystore } from '@aztec/foundation/crypto/bls/bn254_keystore';
+import { computeBn254G1PublicKeyCompressed } from '@aztec/foundation/crypto/bn254';
+import type { EthAddress } from '@aztec/foundation/eth-address';
+import type { LogFn } from '@aztec/foundation/log';
+import type { EthAccount, EthPrivateKey, ValidatorKeyStore } from '@aztec/node-keystore/types';
+import type { AztecAddress } from '@aztec/stdlib/aztec-address';
+
+import { Wallet } from '@ethersproject/wallet';
+import { constants as fsConstants, mkdirSync } from 'fs';
+import { access, writeFile } from 'fs/promises';
+import { homedir } from 'os';
+import { dirname, isAbsolute, join } from 'path';
+import { mnemonicToAccount } from 'viem/accounts';
+
+import { defaultBlsPath } from './utils.js';
+
+export type ValidatorSummary = { attesterEth?: string; attesterBls?: string; publisherEth?: string[] };
+
+export type BuildValidatorsInput = {
+  validatorCount: number;
+  publisherCount?: number;
+  publishers?: string[];
+  accountIndex: number;
+  baseAddressIndex: number;
+  mnemonic: string;
+  ikm?: string;
+  blsPath?: string;
+  feeRecipient: AztecAddress;
+  coinbase?: EthAddress;
+  remoteSigner?: string;
+};
+
+export function withValidatorIndex(path: string, accountIndex: number = 0, addressIndex: number = 0) {
+  // NOTE: The legacy BLS CLI is to allow users who generated keys in 2.1.4 to be able to use the same command
+  // to re-generate their keys. In 2.1.5 we switched how we append addresses to the path so this is to maintain backwards compatibility.
+  const useLegacyBlsCli = ['true', '1', 'yes', 'y'].includes(process.env.LEGACY_BLS_CLI ?? '');
+
+  const defaultBlsPathParts = defaultBlsPath.split('/');
+
+  const parts = path.split('/');
+  if (parts.length == defaultBlsPathParts.length && parts.every((part, index) => part === defaultBlsPathParts[index])) {
+    if (useLegacyBlsCli) {
+      // In 2.1.4, we were using address-index in parts[3] and did NOT use account-index, check lines 32 & 84
+      // https://github.com/AztecProtocol/aztec-packages/blob/v2.1.4/yarn-project/cli/src/cmds/validator_keys/shared.ts
+
+      parts[3] = String(addressIndex);
+    } else {
+      parts[3] = String(accountIndex);
+      parts[5] = String(addressIndex);
+    }
+    return parts.join('/');
+  }
+  return path;
+}
+
+/**
+ * Compute a compressed BN254 G1 public key from a private key.
+ * @param privateKeyHex - Private key as 0x-prefixed hex string
+ * @returns Compressed G1 point (32 bytes with sign bit in MSB)
+ */
+export async function computeBlsPublicKeyCompressed(privateKeyHex: string): Promise<string> {
+  return await computeBn254G1PublicKeyCompressed(privateKeyHex);
+}
+
+export function deriveEthAttester(
+  mnemonic: string,
+  baseAccountIndex: number,
+  addressIndex: number,
+  remoteSigner?: string,
+): EthAccount | EthPrivateKey {
+  const acct = mnemonicToAccount(mnemonic, { accountIndex: baseAccountIndex, addressIndex });
+  return remoteSigner
+    ? ({ address: acct.address as unknown as EthAddress, remoteSignerUrl: remoteSigner } as EthAccount)
+    : (('0x' + Buffer.from(acct.getHdKey().privateKey!).toString('hex')) as EthPrivateKey);
+}
+
+export async function buildValidatorEntries(input: BuildValidatorsInput) {
+  const {
+    validatorCount,
+    publisherCount = 0,
+    publishers,
+    accountIndex,
+    baseAddressIndex,
+    mnemonic,
+    ikm,
+    blsPath,
+    feeRecipient,
+    coinbase,
+    remoteSigner,
+  } = input;
+
+  const summaries: ValidatorSummary[] = [];
+
+  const validators = await Promise.all(
+    Array.from({ length: validatorCount }, async (_unused, i) => {
+      const addressIndex = baseAddressIndex + i;
+      const basePath = blsPath ?? defaultBlsPath;
+      const perValidatorPath = withValidatorIndex(basePath, accountIndex, addressIndex);
+
+      const blsPrivKey = ikm || mnemonic ? deriveBlsPrivateKey(mnemonic, ikm, perValidatorPath) : undefined;
+      const blsPubCompressed = blsPrivKey ? await computeBlsPublicKeyCompressed(blsPrivKey) : undefined;
+
+      const ethAttester = deriveEthAttester(mnemonic, accountIndex, addressIndex, remoteSigner);
+      const attester = blsPrivKey ? { eth: ethAttester, bls: blsPrivKey } : ethAttester;
+
+      let publisherField: EthAccount | EthPrivateKey | (EthAccount | EthPrivateKey)[] | undefined;
+      const publisherAddresses: string[] = [];
+      if (publishers && publishers.length > 0) {
+        publisherAddresses.push(...publishers);
+        publisherField = publishers.length === 1 ? (publishers[0] as EthPrivateKey) : (publishers as EthPrivateKey[]);
+      } else if (publisherCount > 0) {
+        const publishersBaseIndex = baseAddressIndex + validatorCount + i * publisherCount;
+        const publisherAccounts = Array.from({ length: publisherCount }, (_unused2, j) => {
+          const publisherAddressIndex = publishersBaseIndex + j;
+          const pubAcct = mnemonicToAccount(mnemonic, {
+            accountIndex,
+            addressIndex: publisherAddressIndex,
+          });
+          publisherAddresses.push(pubAcct.address as unknown as string);
+          return remoteSigner
+            ? ({ address: pubAcct.address as unknown as EthAddress, remoteSignerUrl: remoteSigner } as EthAccount)
+            : (('0x' + Buffer.from(pubAcct.getHdKey().privateKey!).toString('hex')) as EthPrivateKey);
+        });
+        publisherField = publisherCount === 1 ? publisherAccounts[0] : publisherAccounts;
+      }
+
+      const acct = mnemonicToAccount(mnemonic, {
+        accountIndex,
+        addressIndex,
+      });
+      const attesterEthAddress = acct.address as unknown as string;
+      summaries.push({
+        attesterEth: attesterEthAddress,
+        attesterBls: blsPubCompressed,
+        publisherEth: publisherAddresses.length > 0 ? publisherAddresses : undefined,
+      });
+
+      return {
+        attester,
+        ...(publisherField !== undefined ? { publisher: publisherField } : {}),
+        feeRecipient,
+        coinbase: coinbase ?? attesterEthAddress,
+      } as ValidatorKeyStore;
+    }),
+  );
+
+  return { validators, summaries };
+}
+
+export async function resolveKeystoreOutputPath(dataDir?: string, file?: string) {
+  const defaultDataDir = join(homedir(), '.aztec', 'keystore');
+  const resolvedDir = dataDir && dataDir.length > 0 ? dataDir : defaultDataDir;
+  let outputPath: string;
+  if (file && file.length > 0) {
+    outputPath = isAbsolute(file) ? file : join(resolvedDir, file);
+  } else {
+    let index = 1;
+    while (true) {
+      const candidate = join(resolvedDir, `key${index}.json`);
+      try {
+        await access(candidate, fsConstants.F_OK);
+        index += 1;
+      } catch {
+        outputPath = candidate;
+        break;
+      }
+    }
+  }
+  return { resolvedDir, outputPath: outputPath! };
+}
+
+export async function writeKeystoreFile(path: string, keystore: unknown) {
+  mkdirSync(dirname(path), { recursive: true });
+  await writeFile(path, JSON.stringify(keystore, null, 2), { encoding: 'utf-8' });
+}
+
+export function logValidatorSummaries(log: LogFn, summaries: ValidatorSummary[]) {
+  const lines: string[] = [];
+  for (let i = 0; i < summaries.length; i++) {
+    const v = summaries[i];
+    lines.push(`acc${i + 1}:`);
+    lines.push(`  attester:`);
+    if (v.attesterEth) {
+      lines.push(`    eth: ${v.attesterEth}`);
+    }
+    if (v.attesterBls) {
+      lines.push(`    bls: ${v.attesterBls}`);
+    }
+    if (v.publisherEth && v.publisherEth.length > 0) {
+      lines.push(`  publisher:`);
+      for (const addr of v.publisherEth) {
+        lines.push(`    - ${addr}`);
+      }
+    }
+  }
+  if (lines.length > 0) {
+    log(lines.join('\n'));
+  }
+}
+
+export function maybePrintJson(log: LogFn, jsonFlag: boolean | undefined, obj: unknown) {
+  if (jsonFlag) {
+    log(prettyPrintJSON(obj as Record<string, any>));
+  }
+}
+
+/**
+ * Writes a BN254 keystore file for a BN254 BLS private key.
+ * Returns the absolute path to the written file.
+ *
+ * @param outDir - Directory to write the keystore file to
+ * @param fileNameBase - Base name for the keystore file (will be sanitized)
+ * @param password - Password for encrypting the private key
+ * @param privateKeyHex - Private key as 0x-prefixed hex string (32 bytes)
+ * @param pubkeyHex - Public key as hex string
+ * @param derivationPath - BIP-44 style derivation path
+ * @returns Absolute path to the written keystore file
+ */
+export async function writeBn254BlsKeystore(
+  outDir: string,
+  fileNameBase: string,
+  password: string,
+  privateKeyHex: string,
+  pubkeyHex: string,
+  derivationPath: string,
+): Promise<string> {
+  mkdirSync(outDir, { recursive: true });
+
+  const keystore = createBn254Keystore(password, privateKeyHex, pubkeyHex, derivationPath);
+
+  const safeBase = fileNameBase.replace(/[^a-zA-Z0-9_-]/g, '_');
+  const outPath = join(outDir, `keystore-${safeBase}.json`);
+  await writeFile(outPath, JSON.stringify(keystore, null, 2), { encoding: 'utf-8' });
+  return outPath;
+}
+
+/** Replace plaintext BLS keys in validators with { path, password } pointing to BN254 keystore files. */
+export async function writeBlsBn254ToFile(
+  validators: ValidatorKeyStore[],
+  options: { outDir: string; password: string; blsPath?: string },
+): Promise<void> {
+  for (let i = 0; i < validators.length; i++) {
+    const v = validators[i];
+    if (!v || typeof v !== 'object' || !('attester' in v)) {
+      continue;
+    }
+    const att = (v as any).attester;
+
+    // Shapes: { bls: <hex> } or { eth: <ethAccount>, bls?: <hex> } or plain EthAccount
+    const blsKey: string | undefined = typeof att === 'object' && 'bls' in att ? (att as any).bls : undefined;
+    if (!blsKey || typeof blsKey !== 'string') {
+      continue;
+    }
+
+    const pub = await computeBlsPublicKeyCompressed(blsKey);
+    const path = options.blsPath ?? defaultBlsPath;
+    const fileBase = `${String(i + 1)}_${pub.slice(2, 18)}`;
+    const keystorePath = await writeBn254BlsKeystore(options.outDir, fileBase, options.password, blsKey, pub, path);
+
+    if (typeof att === 'object') {
+      (att as any).bls = { path: keystorePath, password: options.password };
+    }
+  }
+}
+
+/** Writes an Ethereum JSON V3 keystore using ethers, returns absolute path */
+export async function writeEthJsonV3Keystore(
+  outDir: string,
+  fileNameBase: string,
+  password: string,
+  privateKeyHex: string,
+): Promise<string> {
+  const safeBase = fileNameBase.replace(/[^a-zA-Z0-9_-]/g, '_');
+  mkdirSync(outDir, { recursive: true });
+  const wallet = new Wallet(privateKeyHex);
+  const json = await wallet.encrypt(password);
+  const outPath = join(outDir, `keystore-eth-${safeBase}.json`);
+  await writeFile(outPath, json, { encoding: 'utf-8' });
+  return outPath;
+}
+
+/** Replace plaintext ETH keys in validators with { path, password } pointing to JSON V3 files. */
+export async function writeEthJsonV3ToFile(
+  validators: ValidatorKeyStore[],
+  options: { outDir: string; password: string },
+): Promise<void> {
+  const maybeEncryptEth = async (account: any, label: string) => {
+    if (typeof account === 'string' && account.startsWith('0x') && account.length === 66) {
+      const fileBase = `${label}_${account.slice(2, 10)}`;
+      const p = await writeEthJsonV3Keystore(options.outDir, fileBase, options.password, account);
+      return { path: p, password: options.password };
+    }
+    return account;
+  };
+
+  for (let i = 0; i < validators.length; i++) {
+    const v = validators[i];
+    if (!v || typeof v !== 'object') {
+      continue;
+    }
+
+    // attester may be string (eth), object with eth, or remote signer
+    const att = (v as any).attester;
+    if (typeof att === 'string') {
+      (v as any).attester = await maybeEncryptEth(att, `attester_${i + 1}`);
+    } else if (att && typeof att === 'object' && 'eth' in att) {
+      (att as any).eth = await maybeEncryptEth((att as any).eth, `attester_${i + 1}`);
+    }
+
+    // publisher can be single or array
+    if ('publisher' in v) {
+      const pub = (v as any).publisher;
+      if (Array.isArray(pub)) {
+        const out: any[] = [];
+        for (let j = 0; j < pub.length; j++) {
+          out.push(await maybeEncryptEth(pub[j], `publisher_${i + 1}_${j + 1}`));
+        }
+        (v as any).publisher = out;
+      } else if (pub !== undefined) {
+        (v as any).publisher = await maybeEncryptEth(pub, `publisher_${i + 1}`);
+      }
+    }
+  }
+}

package/src/cmds/validator_keys/staker.ts

@@ -0,0 +1,301 @@
+import { prettyPrintJSON } from '@aztec/cli/utils';
+import { createEthereumChain } from '@aztec/ethereum/chain';
+import { GSEContract } from '@aztec/ethereum/contracts';
+import { decryptBn254Keystore } from '@aztec/foundation/crypto/bls/bn254_keystore';
+import { computeBn254G1PublicKey, computeBn254G2PublicKey } from '@aztec/foundation/crypto/bn254';
+import { Fr } from '@aztec/foundation/curves/bn254';
+import type { EthAddress } from '@aztec/foundation/eth-address';
+import type { LogFn } from '@aztec/foundation/log';
+import { loadKeystoreFile } from '@aztec/node-keystore/loader';
+import type {
+  AttesterAccount,
+  AttesterAccounts,
+  BLSAccount,
+  EncryptedKeyFileConfig,
+  EthAccount,
+  MnemonicConfig,
+} from '@aztec/node-keystore/types';
+
+import { Wallet } from '@ethersproject/wallet';
+import { readFileSync, writeFileSync } from 'fs';
+import { basename, dirname, join } from 'path';
+import { createPublicClient, fallback, http } from 'viem';
+import { privateKeyToAddress } from 'viem/accounts';
+
+export type StakerOptions = {
+  from: string;
+  password?: string;
+  output?: string;
+  gseAddress: EthAddress;
+  l1RpcUrls: string[];
+  l1ChainId: number;
+};
+
+export type StakerOutput = {
+  attester: string;
+  publicKeyG1: {
+    x: string;
+    y: string;
+  };
+  publicKeyG2: {
+    x0: string;
+    x1: string;
+    y0: string;
+    y1: string;
+  };
+  proofOfPossession: {
+    x: string;
+    y: string;
+  };
+};
+
+/**
+ * Check if an object is a MnemonicConfig
+ */
+function isMnemonicConfig(obj: unknown): obj is MnemonicConfig {
+  return typeof obj === 'object' && obj !== null && 'mnemonic' in obj;
+}
+
+/**
+ * Check if a value is an encrypted keystore file config
+ */
+function isEncryptedKeyFileConfig(value: unknown): value is EncryptedKeyFileConfig {
+  return typeof value === 'object' && value !== null && 'path' in value;
+}
+
+/**
+ * Check if a BLSAccount is a private key string (not an encrypted keystore file)
+ */
+function isBlsPrivateKey(bls: unknown): bls is string {
+  return typeof bls === 'string' && bls.startsWith('0x');
+}
+
+/**
+ * Check if an EthAccount is a private key string (66 chars: 0x + 64 hex)
+ */
+function isEthPrivateKey(eth: unknown): eth is string {
+  return typeof eth === 'string' && eth.startsWith('0x') && eth.length === 66;
+}
+
+/**
+ * Check if a string is an Ethereum address (42 chars: 0x + 40 hex)
+ */
+function isEthAddress(value: unknown): value is string {
+  return typeof value === 'string' && /^0x[0-9a-fA-F]{40}$/.test(value);
+}
+
+/**
+ * Decrypt a BLS private key from an encrypted keystore file
+ */
+function decryptBlsKey(bls: BLSAccount, password?: string): string | undefined {
+  if (isBlsPrivateKey(bls)) {
+    return bls;
+  }
+
+  if (isEncryptedKeyFileConfig(bls)) {
+    if (!password && !bls.password) {
+      return undefined; // Can't decrypt without password
+    }
+    const pwd = password ?? bls.password!;
+    return decryptBn254Keystore(bls.path, pwd);
+  }
+
+  return undefined;
+}
+
+/**
+ * Decrypt an Ethereum private key from an encrypted keystore file
+ */
+async function decryptEthKey(eth: EthAccount, password?: string): Promise<string | undefined> {
+  if (isEthPrivateKey(eth)) {
+    return eth;
+  }
+
+  if (isEncryptedKeyFileConfig(eth)) {
+    if (!password && !eth.password) {
+      return undefined; // Can't decrypt without password
+    }
+    const pwd = password ?? eth.password!;
+    const json = readFileSync(eth.path, 'utf-8');
+    const wallet = await Wallet.fromEncryptedJson(json, pwd);
+    return wallet.privateKey as string;
+  }
+
+  return undefined;
+}
+
+/**
+ * Extract Ethereum address from an EthAccount (or private key)
+ */
+async function getEthAddress(eth: EthAccount | string, password?: string): Promise<EthAddress | undefined> {
+  // Case 1: It's a private key string - derive the address
+  if (isEthPrivateKey(eth)) {
+    return privateKeyToAddress(eth as `0x${string}`) as unknown as EthAddress;
+  }
+
+  // Case 2: It's just an address string directly (EthRemoteSignerAccount can be just EthAddress)
+  if (isEthAddress(eth)) {
+    return eth as unknown as EthAddress;
+  }
+
+  // Case 3: It's an object with an address property (remote signer config)
+  if (typeof eth === 'object' && eth !== null && 'address' in eth) {
+    return (eth as any).address as EthAddress;
+  }
+
+  // Case 4: It's an encrypted keystore file - decrypt and derive address
+  if (isEncryptedKeyFileConfig(eth)) {
+    const privateKey = await decryptEthKey(eth, password);
+    if (privateKey) {
+      return privateKeyToAddress(privateKey as `0x${string}`) as unknown as EthAddress;
+    }
+    return undefined;
+  }
+
+  return undefined;
+}
+
+/**
+ * Extract BLS private key and Ethereum address from an AttesterAccount
+ */
+async function extractAttesterInfo(
+  attester: AttesterAccount,
+  password?: string,
+): Promise<{ blsPrivateKey?: string; ethAddress?: EthAddress }> {
+  // Case 1: attester is { eth: EthAccount, bls?: BLSAccount }
+  if (typeof attester === 'object' && attester !== null && 'eth' in attester) {
+    const ethAddress = await getEthAddress(attester.eth, password);
+    const blsPrivateKey = attester.bls ? decryptBlsKey(attester.bls, password) : undefined;
+    return { blsPrivateKey, ethAddress };
+  }
+
+  // Case 2: attester is just an EthAccount directly (no BLS key)
+  return {
+    blsPrivateKey: undefined,
+    ethAddress: await getEthAddress(attester as EthAccount, password),
+  };
+}
+
+/**
+ * Process a single attester entry and output staking JSON
+ */
+async function processAttester(
+  attester: AttesterAccount,
+  gse: GSEContract,
+  password?: string,
+): Promise<StakerOutput | undefined> {
+  const { blsPrivateKey, ethAddress } = await extractAttesterInfo(attester, password);
+
+  // Skip if no BLS private key or no Ethereum address
+  if (!blsPrivateKey || !ethAddress) {
+    return undefined;
+  }
+
+  // Derive G1 and G2 public keys
+  const g1PublicKey = await computeBn254G1PublicKey(blsPrivateKey);
+  const g2PublicKey = await computeBn254G2PublicKey(blsPrivateKey);
+
+  // Generate proof of possession
+  const bn254SecretKeyFieldElement = Fr.fromString(blsPrivateKey);
+  const registrationTuple = await gse.makeRegistrationTuple(bn254SecretKeyFieldElement.toBigInt());
+
+  return {
+    attester: String(ethAddress),
+    publicKeyG1: {
+      x: '0x' + g1PublicKey.x.toString(16).padStart(64, '0'),
+      y: '0x' + g1PublicKey.y.toString(16).padStart(64, '0'),
+    },
+    publicKeyG2: {
+      x0: '0x' + g2PublicKey.x.c0.toString(16).padStart(64, '0'),
+      x1: '0x' + g2PublicKey.x.c1.toString(16).padStart(64, '0'),
+      y0: '0x' + g2PublicKey.y.c0.toString(16).padStart(64, '0'),
+      y1: '0x' + g2PublicKey.y.c1.toString(16).padStart(64, '0'),
+    },
+    proofOfPossession: {
+      x: '0x' + registrationTuple.proofOfPossession.x.toString(16),
+      y: '0x' + registrationTuple.proofOfPossession.y.toString(16),
+    },
+  };
+}
+
+/**
+ * Process AttesterAccounts (which can be a single attester, array, or mnemonic)
+ */
+export async function processAttesterAccounts(
+  attesterAccounts: AttesterAccounts,
+  gse: GSEContract,
+  password?: string,
+): Promise<StakerOutput[]> {
+  // Skip mnemonic configs
+  if (isMnemonicConfig(attesterAccounts)) {
+    return [];
+  }
+
+  // Handle array of attesters
+  if (Array.isArray(attesterAccounts)) {
+    const results: StakerOutput[] = [];
+    for (const attester of attesterAccounts) {
+      const result = await processAttester(attester, gse, password);
+      if (result) {
+        results.push(result);
+      }
+    }
+    return results;
+  }
+
+  // Handle single attester
+  const result = await processAttester(attesterAccounts, gse, password);
+  return result ? [result] : [];
+}
+
+/**
+ * Main staker command function
+ */
+export async function generateStakerJson(options: StakerOptions, log: LogFn): Promise<void> {
+  const { from, password, gseAddress, l1RpcUrls, l1ChainId, output } = options;
+
+  // Load the keystore file
+  const keystore = loadKeystoreFile(from);
+
+  if (!gseAddress) {
+    throw new Error('GSE contract address is required');
+  }
+  log(`Calling GSE contract ${gseAddress} on chain ${l1ChainId}, using ${l1RpcUrls.join(', ')} to get staker outputs`);
+
+  if (!keystore.validators || keystore.validators.length === 0) {
+    log('No validators found in keystore');
+    return;
+  }
+
+  const allOutputs: StakerOutput[] = [];
+
+  // L1 client for proof of possession
+  const chain = createEthereumChain(l1RpcUrls, l1ChainId);
+  const publicClient = createPublicClient({
+    chain: chain.chainInfo,
+    transport: fallback(l1RpcUrls.map(url => http(url, { batch: false }))),
+  });
+  const gse = new GSEContract(publicClient, gseAddress);
+
+  const keystoreBaseName = basename(from, '.json');
+  const outputDir = output ? output : dirname(from);
+
+  for (let i = 0; i < keystore.validators.length; i++) {
+    const validator = keystore.validators[i];
+    const outputs = await processAttesterAccounts(validator.attester, gse, password);
+
+    for (let j = 0; j < outputs.length; j++) {
+      allOutputs.push(outputs[j]);
+    }
+  }
+
+  if (allOutputs.length === 0) {
+    log('No attesters with BLS keys found (skipping mnemonics and encrypted keystores without password)');
+    return;
+  }
+
+  // Write a single JSON file with all staker outputs
+  const stakerOutputPath = join(outputDir, `${keystoreBaseName}_staker_output.json`);
+  writeFileSync(stakerOutputPath, prettyPrintJSON(allOutputs), 'utf-8');
+  log(`Wrote staker output for ${allOutputs.length} validator(s) to ${stakerOutputPath}`);
+}

package/src/cmds/validator_keys/utils.ts

@@ -0,0 +1,81 @@
+import type { EthAddress } from '@aztec/foundation/eth-address';
+import { ethPrivateKeySchema } from '@aztec/node-keystore/schemas';
+import type { EthPrivateKey } from '@aztec/node-keystore/types';
+
+export const defaultBlsPath = 'm/12381/3600/0/0/0';
+
+export function validateBlsPathOptions(options: {
+  count?: number;
+  publisherCount?: number;
+  accountIndex?: number;
+  addressIndex?: number;
+  blsPath?: string;
+  ikm?: string;
+}) {
+  if (options.blsPath && options.blsPath !== defaultBlsPath) {
+    if (
+      (options.count && options.count !== 1) ||
+      (options.publisherCount && options.publisherCount > 0) ||
+      (options.accountIndex && options.accountIndex !== 0) ||
+      (options.addressIndex && options.addressIndex !== 0)
+    ) {
+      throw new Error('--bls-path cannot be used with --count, --publisher-count, --account-index, or --address-index');
+    }
+  }
+}
+
+export function validateStakerOutputOptions(options: {
+  stakerOutput?: boolean;
+  gseAddress?: EthAddress;
+  l1RpcUrls?: string[];
+  l1ChainId?: number;
+}) {
+  if (!options.stakerOutput) {
+    return;
+  }
+  // Required options for staker output
+  if (!options.gseAddress) {
+    throw new Error('--gse-address is required when using --staker-output');
+  }
+  if (!options.l1RpcUrls || options.l1RpcUrls.length === 0) {
+    throw new Error('--l1-rpc-urls is required when using --staker-output');
+  }
+
+  if (options.l1ChainId === undefined) {
+    throw new Error('--l1-chain-id is required when using --staker-output');
+  }
+}
+
+export function validateRemoteSignerOptions(options: { remoteSigner?: string; mnemonic?: string }) {
+  if (options.remoteSigner && !options.mnemonic) {
+    throw new Error(
+      'Using --remote-signer requires a deterministic key source. Provide --mnemonic to derive keys, or omit --remote-signer to write new private keys to keystore.',
+    );
+  }
+}
+
+export function validatePublisherOptions(options: { publishers?: string[]; publisherCount?: number }) {
+  if (options.publisherCount && options.publisherCount > 0 && options.publishers && options.publishers.length > 0) {
+    throw new Error('--publishers and --publisher-count cannot be used together');
+  }
+
+  if (options.publishers && options.publishers.length > 0) {
+    // Normalize each private key by adding 0x prefix if missing
+    const normalizedKeys: string[] = [];
+    for (const key of options.publishers) {
+      let privateKey = key.trim();
+      if (!privateKey.startsWith('0x')) {
+        privateKey = '0x' + privateKey;
+      }
+
+      try {
+        ethPrivateKeySchema.parse(privateKey);
+        normalizedKeys.push(privateKey);
+      } catch (error) {
+        throw new Error(`Invalid publisher private key: ${error instanceof Error ? error.message : String(error)}`);
+      }
+    }
+    // Update the options with the normalized keys
+    options.publishers = normalizedKeys as EthPrivateKey[];
+  }
+}