@aztec/cli 0.0.1-commit.a072138 → 0.0.1-commit.a4600f49

package/src/cmds/l1/deploy_new_rollup.ts

@@ -29,7 +29,7 @@ export async function deployNewRollup(
   const initialFundedAccounts = initialAccounts.map(a => a.address).concat(sponsoredFPCAddress);
   const { genesisArchiveRoot, fundingNeeded } = await getGenesisValues(initialFundedAccounts);
 
-  const { rollup, slashFactoryAddress } = await deployNewRollupContracts(
+  const { rollup } = await deployNewRollupContracts(
     registryAddress,
     rpcUrls,
     privateKey,
@@ -51,7 +51,6 @@ export async function deployNewRollup(
           initialFundedAccounts: initialFundedAccounts.map(a => a.toString()),
           initialValidators: initialValidators.map(a => a.attester.toString()),
           genesisArchiveRoot: genesisArchiveRoot.toString(),
-          slashFactoryAddress: slashFactoryAddress.toString(),
         },
         null,
         2,
@@ -62,6 +61,5 @@ export async function deployNewRollup(
     log(`Initial funded accounts: ${initialFundedAccounts.map(a => a.toString()).join(', ')}`);
     log(`Initial validators: ${initialValidators.map(a => a.attester.toString()).join(', ')}`);
     log(`Genesis archive root: ${genesisArchiveRoot.toString()}`);
-    log(`Slash Factory Address: ${slashFactoryAddress.toString()}`);
   }
 }

package/src/cmds/l1/index.ts

@@ -106,6 +106,24 @@ export function injectCommands(program: Command, log: LogFn, debugLogger: Logger
       );
     });
 
+  program
+    .command('compute-genesis-values')
+    .description('Computes genesis values (VK tree root, protocol contracts hash, genesis archive root).')
+    .addOption(
+      new Option('--test-accounts <boolean>', 'Include initial test accounts in genesis state')
+        .env('TEST_ACCOUNTS')
+        .argParser(arg => arg === 'true'),
+    )
+    .addOption(
+      new Option('--sponsored-fpc <boolean>', 'Include sponsored FPC contract in genesis state')
+        .env('SPONSORED_FPC')
+        .argParser(arg => arg === 'true'),
+    )
+    .action(async options => {
+      const { computeGenesisValuesCmd } = await import('./compute_genesis_values.js');
+      await computeGenesisValuesCmd(options.testAccounts, options.sponsoredFpc, log);
+    });
+
   program
     .command('deposit-governance-tokens')
     .description('Deposits governance tokens to the governance contract.')

package/src/cmds/l1/update_l1_validators.ts

@@ -2,7 +2,7 @@ import { createEthereumChain, isAnvilTestChain } from '@aztec/ethereum/chain';
 import { createExtendedL1Client, getPublicClient } from '@aztec/ethereum/client';
 import { getL1ContractsConfigEnvVars } from '@aztec/ethereum/config';
 import { GSEContract, RollupContract } from '@aztec/ethereum/contracts';
-import { createL1TxUtilsFromViemWallet } from '@aztec/ethereum/l1-tx-utils';
+import { createL1TxUtils } from '@aztec/ethereum/l1-tx-utils';
 import { EthCheatCodes } from '@aztec/ethereum/test';
 import type { EthAddress } from '@aztec/foundation/eth-address';
 import type { LogFn, Logger } from '@aztec/foundation/log';
@@ -38,7 +38,6 @@ export interface LoggerArgs {
 export function generateL1Account() {
   const privateKey = generatePrivateKey();
   const account = privateKeyToAccount(privateKey);
-  account.address;
   return {
     privateKey,
     address: account.address,
@@ -88,7 +87,7 @@ export async function addL1Validator({
   const gse = new GSEContract(l1Client, gseAddress);
   const registrationTuple = await gse.makeRegistrationTuple(blsSecretKey);
 
-  const l1TxUtils = createL1TxUtilsFromViemWallet(l1Client, { logger: debugLogger });
+  const l1TxUtils = createL1TxUtils(l1Client, { logger: debugLogger });
   const proofParamsObj = ZkPassportProofParams.fromBuffer(proofParams);
 
   // Step 1: Claim STK tokens from the faucet
@@ -194,7 +193,7 @@ export async function addL1ValidatorViaRollup({
 
   const registrationTuple = await gse.makeRegistrationTuple(blsSecretKey);
 
-  const l1TxUtils = createL1TxUtilsFromViemWallet(l1Client, { logger: debugLogger });
+  const l1TxUtils = createL1TxUtils(l1Client, { logger: debugLogger });
 
   const { receipt } = await l1TxUtils.sendAndMonitorTransaction({
     to: rollupAddress.toString(),
@@ -241,7 +240,7 @@ export async function removeL1Validator({
   const account = getAccount(privateKey, mnemonic);
   const chain = createEthereumChain(rpcUrls, chainId);
   const l1Client = createExtendedL1Client(rpcUrls, account, chain.chainInfo);
-  const l1TxUtils = createL1TxUtilsFromViemWallet(l1Client, { logger: debugLogger });
+  const l1TxUtils = createL1TxUtils(l1Client, { logger: debugLogger });
 
   dualLog(`Removing validator ${validatorAddress.toString()} from rollup ${rollupAddress.toString()}`);
   const { receipt } = await l1TxUtils.sendAndMonitorTransaction({
@@ -268,7 +267,7 @@ export async function pruneRollup({
   const account = getAccount(privateKey, mnemonic);
   const chain = createEthereumChain(rpcUrls, chainId);
   const l1Client = createExtendedL1Client(rpcUrls, account, chain.chainInfo);
-  const l1TxUtils = createL1TxUtilsFromViemWallet(l1Client, { logger: debugLogger });
+  const l1TxUtils = createL1TxUtils(l1Client, { logger: debugLogger });
 
   dualLog(`Trying prune`);
   const { receipt } = await l1TxUtils.sendAndMonitorTransaction({

package/src/cmds/validator_keys/eth_json_v3_worker.ts

@@ -0,0 +1,30 @@
+import { Wallet } from '@ethersproject/wallet';
+import { parentPort, workerData } from 'worker_threads';
+
+type EthJsonV3WorkerData = {
+  privateKeyHex: string;
+  password: string;
+};
+
+type SerializedError = {
+  message: string;
+  name?: string;
+  stack?: string;
+};
+
+function serializeError(error: unknown): SerializedError {
+  if (error instanceof Error) {
+    return { message: error.message, name: error.name, stack: error.stack };
+  }
+  return { message: String(error) };
+}
+
+void (async () => {
+  try {
+    const { privateKeyHex, password } = workerData as EthJsonV3WorkerData;
+    const json = await new Wallet(privateKeyHex).encrypt(password);
+    parentPort?.postMessage({ json });
+  } catch (error) {
+    parentPort?.postMessage({ error: serializeError(error) });
+  }
+})();

package/src/cmds/validator_keys/index.ts

@@ -1,6 +1,6 @@
 import type { LogFn } from '@aztec/foundation/log';
 
-import { Command } from 'commander';
+import { Command, Option } from 'commander';
 
 import { parseAztecAddress, parseEthereumAddress, parseHex, parseOptionalInteger } from '../../utils/commands.js';
 import { defaultBlsPath } from './utils.js';
@@ -38,10 +38,24 @@ export function injectCommands(program: Command, log: LogFn) {
     .option('--remote-signer <url>', 'Default remote signer URL for accounts in this file')
     .option('--ikm <hex>', 'Initial keying material for BLS (alternative to mnemonic)', value => parseHex(value, 32))
     .option('--bls-path <path>', `EIP-2334 path (default ${defaultBlsPath})`)
-    .option(
-      '--password <str>',
-      'Password for writing keystore files (ETH JSON V3 and BLS EIP-2335). Empty string allowed',
+    .addOption(
+      new Option('--password <str>', 'Shared password for writing ETH JSON V3 and BLS EIP-2335 keystore files').env(
+        'AZTEC_KEYSTORE_PASSWORD',
+      ),
+    )
+    .option('--password-file <path>', 'File containing the shared password for writing keystore files')
+    .addOption(
+      new Option('--eth-password <str>', 'Password for writing ETH JSON V3 keystore files').env(
+        'AZTEC_ETH_KEYSTORE_PASSWORD',
+      ),
+    )
+    .option('--eth-password-file <path>', 'File containing the password for writing ETH JSON V3 keystore files')
+    .addOption(
+      new Option('--bls-password <str>', 'Password for writing BLS EIP-2335 keystore files').env(
+        'AZTEC_BLS_KEYSTORE_PASSWORD',
+      ),
     )
+    .option('--bls-password-file <path>', 'File containing the password for writing BLS EIP-2335 keystore files')
     .option('--encrypted-keystore-dir <dir>', 'Output directory for encrypted keystore file(s)')
     .option('--json', 'Echo resulting JSON to stdout')
     .option('--staker-output', 'Generate a single staker output JSON file with an array of validator entries')

package/src/cmds/validator_keys/new.ts

@@ -6,7 +6,7 @@ import type { LogFn } from '@aztec/foundation/log';
 import type { AztecAddress } from '@aztec/stdlib/aztec-address';
 
 import { wordlist } from '@scure/bip39/wordlists/english.js';
-import { writeFile } from 'fs/promises';
+import { readFile, writeFile } from 'fs/promises';
 import { basename, dirname, join } from 'path';
 import { createPublicClient, fallback, http } from 'viem';
 import { generateMnemonic, mnemonicToAccount } from 'viem/accounts';
@@ -42,6 +42,11 @@ export type NewValidatorKeystoreOptions = {
   ikm?: string;
   blsPath?: string;
   password?: string;
+  passwordFile?: string;
+  ethPassword?: string;
+  ethPasswordFile?: string;
+  blsPassword?: string;
+  blsPasswordFile?: string;
   encryptedKeystoreDir?: string;
   json?: boolean;
   feeRecipient: AztecAddress;
@@ -53,6 +58,86 @@ export type NewValidatorKeystoreOptions = {
   l1ChainId?: number;
 };
 
+type PasswordSourceOptions = Pick<
+  NewValidatorKeystoreOptions,
+  'password' | 'passwordFile' | 'ethPassword' | 'ethPasswordFile' | 'blsPassword' | 'blsPasswordFile'
+>;
+
+type PasswordSource = {
+  password?: string;
+  passwordFile?: string;
+  passwordOption: string;
+  passwordFileOption: string;
+};
+
+function validatePassword(password: string, source: string): string {
+  if (password.length === 0) {
+    throw new Error(`${source} cannot be empty`);
+  }
+  return password;
+}
+
+function stripOneTrailingNewline(password: string): string {
+  if (password.endsWith('\n')) {
+    password = password.slice(0, -1);
+  }
+  if (password.endsWith('\r')) {
+    password = password.slice(0, -1);
+  }
+  return password;
+}
+
+async function resolvePasswordSource(source: PasswordSource): Promise<string | undefined> {
+  if (source.password !== undefined && source.passwordFile !== undefined) {
+    throw new Error(`${source.passwordOption} and ${source.passwordFileOption} cannot be used together`);
+  }
+  if (source.password !== undefined) {
+    return validatePassword(source.password, source.passwordOption);
+  }
+  if (source.passwordFile !== undefined) {
+    if (source.passwordFile.length === 0) {
+      throw new Error(`${source.passwordFileOption} cannot be empty`);
+    }
+    const password = stripOneTrailingNewline(await readFile(source.passwordFile, 'utf-8'));
+    return validatePassword(password, source.passwordFileOption);
+  }
+
+  return undefined;
+}
+
+async function resolvePasswords(options: PasswordSourceOptions) {
+  const sharedPassword = await resolvePasswordSource({
+    password: options.password,
+    passwordFile: options.passwordFile,
+    passwordOption: '--password',
+    passwordFileOption: '--password-file',
+  });
+  const ethPassword =
+    (await resolvePasswordSource({
+      password: options.ethPassword,
+      passwordFile: options.ethPasswordFile,
+      passwordOption: '--eth-password',
+      passwordFileOption: '--eth-password-file',
+    })) ?? sharedPassword;
+  const blsPassword =
+    (await resolvePasswordSource({
+      password: options.blsPassword,
+      passwordFile: options.blsPasswordFile,
+      passwordOption: '--bls-password',
+      passwordFileOption: '--bls-password-file',
+    })) ?? sharedPassword;
+
+  if (ethPassword === undefined && blsPassword === undefined) {
+    return {};
+  }
+  if (ethPassword === undefined || blsPassword === undefined) {
+    throw new Error(
+      'Both ETH and BLS passwords are required when writing encrypted keystores. Provide --password to use one password for both, or provide both --eth-password and --bls-password.',
+    );
+  }
+  return { ethPassword, blsPassword };
+}
+
 export async function newValidatorKeystore(options: NewValidatorKeystoreOptions, log: LogFn) {
   // validate bls-path inputs before proceeding with key generation
   validateBlsPathOptions(options);
@@ -78,7 +163,12 @@ export async function newValidatorKeystore(options: NewValidatorKeystoreOptions,
     blsPath,
     ikm,
     mnemonic: _mnemonic,
-    password,
+    password: passwordOption,
+    passwordFile,
+    ethPassword: ethPasswordOption,
+    ethPasswordFile,
+    blsPassword: blsPasswordOption,
+    blsPasswordFile,
     encryptedKeystoreDir,
     stakerOutput,
     gseAddress,
@@ -86,9 +176,18 @@ export async function newValidatorKeystore(options: NewValidatorKeystoreOptions,
     l1ChainId,
   } = options;
 
+  const { ethPassword, blsPassword } = await resolvePasswords({
+    password: passwordOption,
+    passwordFile,
+    ethPassword: ethPasswordOption,
+    ethPasswordFile,
+    blsPassword: blsPasswordOption,
+    blsPasswordFile,
+  });
+  const shouldEncryptKeystores = ethPassword !== undefined && blsPassword !== undefined;
   const mnemonic = _mnemonic ?? generateMnemonic(wordlist);
 
-  if (!_mnemonic && !json) {
+  if (!_mnemonic && !json && !shouldEncryptKeystores) {
     log('No mnemonic provided, generating new one...');
     log(`Using new mnemonic:`);
     log('');
@@ -115,11 +214,11 @@ export async function newValidatorKeystore(options: NewValidatorKeystoreOptions,
   });
 
   // If password provided, write ETH JSON V3 and BLS BN254 keystores and replace plaintext
-  if (password !== undefined) {
+  if (shouldEncryptKeystores) {
     const encryptedKeystoreOutDir =
       encryptedKeystoreDir && encryptedKeystoreDir.length > 0 ? encryptedKeystoreDir : keystoreOutDir;
-    await writeEthJsonV3ToFile(validators, { outDir: encryptedKeystoreOutDir, password });
-    await writeBlsBn254ToFile(validators, { outDir: encryptedKeystoreOutDir, password });
+    await writeEthJsonV3ToFile(validators, { outDir: encryptedKeystoreOutDir, password: ethPassword });
+    await writeBlsBn254ToFile(validators, { outDir: encryptedKeystoreOutDir, password: blsPassword });
   }
 
   const keystore = {
@@ -145,7 +244,7 @@ export async function newValidatorKeystore(options: NewValidatorKeystoreOptions,
     // Process each validator
     for (let i = 0; i < validators.length; i++) {
       const validator = validators[i];
-      const outputs = await processAttesterAccounts(validator.attester, gse, password);
+      const outputs = await processAttesterAccounts(validator.attester, gse);
 
       // Collect all staker outputs
       for (let j = 0; j < outputs.length; j++) {
@@ -160,7 +259,7 @@ export async function newValidatorKeystore(options: NewValidatorKeystoreOptions,
     }
   }
 
-  const outputData = !_mnemonic ? { ...keystore, generatedMnemonic: mnemonic } : keystore;
+  const outputData = !_mnemonic && !shouldEncryptKeystores ? { ...keystore, generatedMnemonic: mnemonic } : keystore;
 
   // Handle JSON output
   if (json) {

package/src/cmds/validator_keys/shared.ts

@@ -1,4 +1,5 @@
 import { prettyPrintJSON } from '@aztec/cli/utils';
+import { asyncPool } from '@aztec/foundation/async-pool';
 import { deriveBlsPrivateKey } from '@aztec/foundation/crypto/bls';
 import { createBn254Keystore } from '@aztec/foundation/crypto/bls/bn254_keystore';
 import { computeBn254G1PublicKeyCompressed } from '@aztec/foundation/crypto/bn254';
@@ -10,12 +11,60 @@ import type { AztecAddress } from '@aztec/stdlib/aztec-address';
 import { Wallet } from '@ethersproject/wallet';
 import { constants as fsConstants, mkdirSync } from 'fs';
 import { access, writeFile } from 'fs/promises';
-import { homedir } from 'os';
+import { availableParallelism, homedir } from 'os';
 import { dirname, isAbsolute, join } from 'path';
 import { mnemonicToAccount } from 'viem/accounts';
+import { Worker } from 'worker_threads';
 
 import { defaultBlsPath } from './utils.js';
 
+type EthJsonV3WorkerResult = { json: string } | { error: { message: string; name?: string; stack?: string } };
+
+// ethers' default scrypt parameters use substantial memory, so keep worker fan-out bounded.
+const maxEthKeystoreWorkers = Math.max(1, Math.min(4, availableParallelism()));
+
+function deserializeWorkerError(error: { message: string; name?: string; stack?: string }) {
+  const result = new Error(error.message);
+  result.name = error.name ?? result.name;
+  result.stack = error.stack;
+  return result;
+}
+
+function encryptEthJsonV3InWorker(privateKeyHex: string, password: string): Promise<string> {
+  return new Promise<string>((resolve, reject) => {
+    const worker = new Worker(new URL('./eth_json_v3_worker.js', import.meta.url), {
+      workerData: { privateKeyHex, password },
+    });
+    let settled = false;
+
+    worker.once('message', (result: EthJsonV3WorkerResult) => {
+      settled = true;
+
+      if ('json' in result) {
+        resolve(result.json);
+      } else {
+        reject(deserializeWorkerError(result.error));
+      }
+    });
+    worker.once('error', error => {
+      settled = true;
+      reject(error);
+    });
+    worker.once('exit', code => {
+      if (!settled) {
+        reject(new Error(`ETH JSON V3 worker stopped with exit code ${code}`));
+      }
+    });
+  });
+}
+
+async function encryptEthJsonV3(privateKeyHex: string, password: string): Promise<string> {
+  if (process.env.JEST_WORKER_ID !== undefined) {
+    return await new Wallet(privateKeyHex).encrypt(password);
+  }
+  return await encryptEthJsonV3InWorker(privateKeyHex, password);
+}
+
 export type ValidatorSummary = { attesterEth?: string; attesterBls?: string; publisherEth?: string[] };
 
 export type BuildValidatorsInput = {
@@ -228,7 +277,7 @@ export async function writeBn254BlsKeystore(
 ): Promise<string> {
   mkdirSync(outDir, { recursive: true });
 
-  const keystore = createBn254Keystore(password, privateKeyHex, pubkeyHex, derivationPath);
+  const keystore = await createBn254Keystore(password, privateKeyHex, pubkeyHex, derivationPath);
 
   const safeBase = fileNameBase.replace(/[^a-zA-Z0-9_-]/g, '_');
   const outPath = join(outDir, `keystore-${safeBase}.json`);
@@ -241,28 +290,29 @@ export async function writeBlsBn254ToFile(
   validators: ValidatorKeyStore[],
   options: { outDir: string; password: string; blsPath?: string },
 ): Promise<void> {
-  for (let i = 0; i < validators.length; i++) {
-    const v = validators[i];
-    if (!v || typeof v !== 'object' || !('attester' in v)) {
-      continue;
-    }
-    const att = (v as any).attester;
+  await Promise.all(
+    validators.map(async (v, i) => {
+      if (!v || typeof v !== 'object' || !('attester' in v)) {
+        return;
+      }
+      const att = (v as any).attester;
 
-    // Shapes: { bls: <hex> } or { eth: <ethAccount>, bls?: <hex> } or plain EthAccount
-    const blsKey: string | undefined = typeof att === 'object' && 'bls' in att ? (att as any).bls : undefined;
-    if (!blsKey || typeof blsKey !== 'string') {
-      continue;
-    }
+      // Shapes: { bls: <hex> } or { eth: <ethAccount>, bls?: <hex> } or plain EthAccount
+      const blsKey: string | undefined = typeof att === 'object' && 'bls' in att ? (att as any).bls : undefined;
+      if (!blsKey || typeof blsKey !== 'string') {
+        return;
+      }
 
-    const pub = await computeBlsPublicKeyCompressed(blsKey);
-    const path = options.blsPath ?? defaultBlsPath;
-    const fileBase = `${String(i + 1)}_${pub.slice(2, 18)}`;
-    const keystorePath = await writeBn254BlsKeystore(options.outDir, fileBase, options.password, blsKey, pub, path);
+      const pub = await computeBlsPublicKeyCompressed(blsKey);
+      const path = options.blsPath ?? defaultBlsPath;
+      const fileBase = `${String(i + 1)}_${pub.slice(2, 18)}`;
+      const keystorePath = await writeBn254BlsKeystore(options.outDir, fileBase, options.password, blsKey, pub, path);
 
-    if (typeof att === 'object') {
-      (att as any).bls = { path: keystorePath, password: options.password };
-    }
-  }
+      if (typeof att === 'object') {
+        (att as any).bls = { path: keystorePath, password: options.password };
+      }
+    }),
+  );
 }
 
 /** Writes an Ethereum JSON V3 keystore using ethers, returns absolute path */
@@ -274,8 +324,7 @@ export async function writeEthJsonV3Keystore(
 ): Promise<string> {
   const safeBase = fileNameBase.replace(/[^a-zA-Z0-9_-]/g, '_');
   mkdirSync(outDir, { recursive: true });
-  const wallet = new Wallet(privateKeyHex);
-  const json = await wallet.encrypt(password);
+  const json = await encryptEthJsonV3(privateKeyHex, password);
   const outPath = join(outDir, `keystore-eth-${safeBase}.json`);
   await writeFile(outPath, json, { encoding: 'utf-8' });
   return outPath;
@@ -286,13 +335,16 @@ export async function writeEthJsonV3ToFile(
   validators: ValidatorKeyStore[],
   options: { outDir: string; password: string },
 ): Promise<void> {
-  const maybeEncryptEth = async (account: any, label: string) => {
+  const tasks: (() => Promise<void>)[] = [];
+
+  const maybeQueueEncryptEth = (account: any, label: string, setEncryptedAccount: (account: any) => void) => {
     if (typeof account === 'string' && account.startsWith('0x') && account.length === 66) {
-      const fileBase = `${label}_${account.slice(2, 10)}`;
-      const p = await writeEthJsonV3Keystore(options.outDir, fileBase, options.password, account);
-      return { path: p, password: options.password };
+      tasks.push(async () => {
+        const fileBase = `${label}_${account.slice(2, 10)}`;
+        const path = await writeEthJsonV3Keystore(options.outDir, fileBase, options.password, account);
+        setEncryptedAccount({ path, password: options.password });
+      });
     }
-    return account;
   };
 
   for (let i = 0; i < validators.length; i++) {
@@ -304,23 +356,23 @@ export async function writeEthJsonV3ToFile(
     // attester may be string (eth), object with eth, or remote signer
     const att = (v as any).attester;
     if (typeof att === 'string') {
-      (v as any).attester = await maybeEncryptEth(att, `attester_${i + 1}`);
+      maybeQueueEncryptEth(att, `attester_${i + 1}`, account => ((v as any).attester = account));
     } else if (att && typeof att === 'object' && 'eth' in att) {
-      (att as any).eth = await maybeEncryptEth((att as any).eth, `attester_${i + 1}`);
+      maybeQueueEncryptEth((att as any).eth, `attester_${i + 1}`, account => ((att as any).eth = account));
     }
 
     // publisher can be single or array
     if ('publisher' in v) {
       const pub = (v as any).publisher;
       if (Array.isArray(pub)) {
-        const out: any[] = [];
         for (let j = 0; j < pub.length; j++) {
-          out.push(await maybeEncryptEth(pub[j], `publisher_${i + 1}_${j + 1}`));
+          maybeQueueEncryptEth(pub[j], `publisher_${i + 1}_${j + 1}`, account => (pub[j] = account));
         }
-        (v as any).publisher = out;
       } else if (pub !== undefined) {
-        (v as any).publisher = await maybeEncryptEth(pub, `publisher_${i + 1}`);
+        maybeQueueEncryptEth(pub, `publisher_${i + 1}`, account => ((v as any).publisher = account));
       }
     }
   }
+
+  await asyncPool(maxEthKeystoreWorkers, tasks, task => task());
 }