@aztec/cli 0.0.1-commit.b655e406 → 0.0.1-commit.b8a057fa

package/dest/cmds/validator_keys/new.js

@@ -1,39 +1,128 @@
+import { prettyPrintJSON } from '@aztec/cli/utils';
+import { createEthereumChain } from '@aztec/ethereum/chain';
+import { GSEContract } from '@aztec/ethereum/contracts';
 import { wordlist } from '@scure/bip39/wordlists/english.js';
-import { dirname } from 'path';
+import { readFile, writeFile } from 'fs/promises';
+import { basename, dirname, join } from 'path';
+import { createPublicClient, fallback, http } from 'viem';
 import { generateMnemonic, mnemonicToAccount } from 'viem/accounts';
 import { buildValidatorEntries, logValidatorSummaries, maybePrintJson, resolveKeystoreOutputPath, writeBlsBn254ToFile, writeEthJsonV3ToFile, writeKeystoreFile } from './shared.js';
-export async function newValidatorKeystore(options, log) {
-    const { dataDir, file, count, publisherCount = 0, json, coinbase, accountIndex = 0, addressIndex = 0, feeRecipient, remoteSigner, fundingAccount, blsOnly, blsPath, ikm, mnemonic: _mnemonic, password, outDir } = options;
-    if (remoteSigner && !_mnemonic) {
-        throw new Error('Using --remote-signer requires a deterministic key source. Provide --mnemonic to derive keys, or omit --remote-signer to write new private keys to keystore.');
+import { processAttesterAccounts } from './staker.js';
+import { validateBlsPathOptions, validatePublisherOptions, validateRemoteSignerOptions, validateStakerOutputOptions } from './utils.js';
+function validatePassword(password, source) {
+    if (password.length === 0) {
+        throw new Error(`${source} cannot be empty`);
+    }
+    return password;
+}
+function stripOneTrailingNewline(password) {
+    if (password.endsWith('\n')) {
+        password = password.slice(0, -1);
+    }
+    if (password.endsWith('\r')) {
+        password = password.slice(0, -1);
+    }
+    return password;
+}
+async function resolvePasswordSource(source) {
+    if (source.password !== undefined && source.passwordFile !== undefined) {
+        throw new Error(`${source.passwordOption} and ${source.passwordFileOption} cannot be used together`);
+    }
+    if (source.password !== undefined) {
+        return validatePassword(source.password, source.passwordOption);
     }
+    if (source.passwordFile !== undefined) {
+        if (source.passwordFile.length === 0) {
+            throw new Error(`${source.passwordFileOption} cannot be empty`);
+        }
+        const password = stripOneTrailingNewline(await readFile(source.passwordFile, 'utf-8'));
+        return validatePassword(password, source.passwordFileOption);
+    }
+    return undefined;
+}
+async function resolvePasswords(options) {
+    const sharedPassword = await resolvePasswordSource({
+        password: options.password,
+        passwordFile: options.passwordFile,
+        passwordOption: '--password',
+        passwordFileOption: '--password-file'
+    });
+    const ethPassword = await resolvePasswordSource({
+        password: options.ethPassword,
+        passwordFile: options.ethPasswordFile,
+        passwordOption: '--eth-password',
+        passwordFileOption: '--eth-password-file'
+    }) ?? sharedPassword;
+    const blsPassword = await resolvePasswordSource({
+        password: options.blsPassword,
+        passwordFile: options.blsPasswordFile,
+        passwordOption: '--bls-password',
+        passwordFileOption: '--bls-password-file'
+    }) ?? sharedPassword;
+    if (ethPassword === undefined && blsPassword === undefined) {
+        return {};
+    }
+    if (ethPassword === undefined || blsPassword === undefined) {
+        throw new Error('Both ETH and BLS passwords are required when writing encrypted keystores. Provide --password to use one password for both, or provide both --eth-password and --bls-password.');
+    }
+    return {
+        ethPassword,
+        blsPassword
+    };
+}
+export async function newValidatorKeystore(options, log) {
+    // validate bls-path inputs before proceeding with key generation
+    validateBlsPathOptions(options);
+    // validate staker output options before proceeding with key generation
+    validateStakerOutputOptions(options);
+    // validate publisher options
+    validatePublisherOptions(options);
+    // validate remote signer options
+    validateRemoteSignerOptions(options);
+    const { dataDir, file, count, publisherCount = 0, publishers, json, coinbase, accountIndex = 0, addressIndex = 0, feeRecipient, remoteSigner, blsPath, ikm, mnemonic: _mnemonic, password: passwordOption, passwordFile, ethPassword: ethPasswordOption, ethPasswordFile, blsPassword: blsPasswordOption, blsPasswordFile, encryptedKeystoreDir, stakerOutput, gseAddress, l1RpcUrls, l1ChainId } = options;
+    const { ethPassword, blsPassword } = await resolvePasswords({
+        password: passwordOption,
+        passwordFile,
+        ethPassword: ethPasswordOption,
+        ethPasswordFile,
+        blsPassword: blsPasswordOption,
+        blsPasswordFile
+    });
+    const shouldEncryptKeystores = ethPassword !== undefined && blsPassword !== undefined;
     const mnemonic = _mnemonic ?? generateMnemonic(wordlist);
+    if (!_mnemonic && !json && !shouldEncryptKeystores) {
+        log('No mnemonic provided, generating new one...');
+        log(`Using new mnemonic:`);
+        log('');
+        log(mnemonic);
+        log('');
+    }
     const validatorCount = typeof count === 'number' && Number.isFinite(count) && count > 0 ? Math.floor(count) : 1;
     const { outputPath } = await resolveKeystoreOutputPath(dataDir, file);
+    const keystoreOutDir = dirname(outputPath);
     const { validators, summaries } = await buildValidatorEntries({
         validatorCount,
         publisherCount,
+        publishers,
         accountIndex,
         baseAddressIndex: addressIndex,
         mnemonic,
         ikm,
         blsPath,
-        blsOnly,
         feeRecipient,
         coinbase,
-        remoteSigner,
-        fundingAccount
+        remoteSigner
     });
     // If password provided, write ETH JSON V3 and BLS BN254 keystores and replace plaintext
-    if (password !== undefined) {
-        const keystoreOutDir = outDir && outDir.length > 0 ? outDir : dirname(outputPath);
+    if (shouldEncryptKeystores) {
+        const encryptedKeystoreOutDir = encryptedKeystoreDir && encryptedKeystoreDir.length > 0 ? encryptedKeystoreDir : keystoreOutDir;
         await writeEthJsonV3ToFile(validators, {
-            outDir: keystoreOutDir,
-            password
+            outDir: encryptedKeystoreOutDir,
+            password: ethPassword
         });
         await writeBlsBn254ToFile(validators, {
-            outDir: keystoreOutDir,
-            password
+            outDir: encryptedKeystoreOutDir,
+            password: blsPassword
         });
     }
     const keystore = {
@@ -41,13 +130,63 @@ export async function newValidatorKeystore(options, log) {
         validators
     };
     await writeKeystoreFile(outputPath, keystore);
-    maybePrintJson(log, json, keystore);
-    if (!json) {
+    // Generate staker outputs if requested
+    const allStakerOutputs = [];
+    if (stakerOutput && gseAddress && l1RpcUrls && l1ChainId !== undefined) {
+        const chain = createEthereumChain(l1RpcUrls, l1ChainId);
+        const publicClient = createPublicClient({
+            chain: chain.chainInfo,
+            transport: fallback(l1RpcUrls.map((url)=>http(url, {
+                    batch: false
+                })))
+        });
+        const gse = new GSEContract(publicClient, gseAddress);
+        // Extract keystore base name without extension for unique staker output filenames
+        const keystoreBaseName = basename(outputPath, '.json');
+        // Process each validator
+        for(let i = 0; i < validators.length; i++){
+            const validator = validators[i];
+            const outputs = await processAttesterAccounts(validator.attester, gse);
+            // Collect all staker outputs
+            for(let j = 0; j < outputs.length; j++){
+                allStakerOutputs.push(outputs[j]);
+            }
+        }
+        // Write a single JSON file with all staker outputs
+        if (allStakerOutputs.length > 0) {
+            const stakerOutputPath = join(keystoreOutDir, `${keystoreBaseName}_staker_output.json`);
+            await writeFile(stakerOutputPath, prettyPrintJSON(allStakerOutputs), 'utf-8');
+        }
+    }
+    const outputData = !_mnemonic && !shouldEncryptKeystores ? {
+        ...keystore,
+        generatedMnemonic: mnemonic
+    } : keystore;
+    // Handle JSON output
+    if (json) {
+        if (stakerOutput && allStakerOutputs.length > 0) {
+            const combinedOutput = {
+                keystore: outputData,
+                staker: allStakerOutputs
+            };
+            maybePrintJson(log, json, combinedOutput);
+        } else {
+            maybePrintJson(log, json, outputData);
+        }
+    } else {
         log(`Wrote validator keystore to ${outputPath}`);
+        if (stakerOutput && allStakerOutputs.length > 0) {
+            const keystoreBaseName = basename(outputPath, '.json');
+            const stakerOutputPath = join(keystoreOutDir, `${keystoreBaseName}_staker_output.json`);
+            log(`Wrote staker output for ${allStakerOutputs.length} validator(s) to ${stakerOutputPath}`);
+            log('');
+        }
     }
-    // Always print a concise summary of public keys (addresses and BLS pubkeys)
-    logValidatorSummaries(log, summaries);
-    if (!blsOnly && mnemonic && remoteSigner) {
+    // print a concise summary of public keys (addresses and BLS pubkeys) if no --json options was selected
+    if (!json) {
+        logValidatorSummaries(log, summaries);
+    }
+    if (mnemonic && remoteSigner && !json) {
         for(let i = 0; i < validatorCount; i++){
             const addrIdx = addressIndex + i;
             const acct = mnemonicToAccount(mnemonic, {
@@ -57,4 +196,9 @@ export async function newValidatorKeystore(options, log) {
             log(`attester address: ${acct.address} remoteSignerUrl: ${remoteSigner}`);
         }
     }
+    // Log staker outputs if not in JSON mode
+    if (!json && stakerOutput && allStakerOutputs.length > 0) {
+        log('\nStaker outputs:');
+        log(prettyPrintJSON(allStakerOutputs));
+    }
 }

package/dest/cmds/validator_keys/shared.d.ts

@@ -10,18 +10,17 @@ export type ValidatorSummary = {
 export type BuildValidatorsInput = {
     validatorCount: number;
     publisherCount?: number;
+    publishers?: string[];
     accountIndex: number;
     baseAddressIndex: number;
     mnemonic: string;
     ikm?: string;
     blsPath?: string;
-    blsOnly?: boolean;
     feeRecipient: AztecAddress;
     coinbase?: EthAddress;
     remoteSigner?: string;
-    fundingAccount?: EthAddress;
 };
-export declare function withValidatorIndex(path: string, index: number): string;
+export declare function withValidatorIndex(path: string, accountIndex?: number, addressIndex?: number): string;
 /**
  * Compute a compressed BN254 G1 public key from a private key.
  * @param privateKeyHex - Private key as 0x-prefixed hex string
@@ -57,6 +56,7 @@ export declare function writeBn254BlsKeystore(outDir: string, fileNameBase: stri
 export declare function writeBlsBn254ToFile(validators: ValidatorKeyStore[], options: {
     outDir: string;
     password: string;
+    blsPath?: string;
 }): Promise<void>;
 /** Writes an Ethereum JSON V3 keystore using ethers, returns absolute path */
 export declare function writeEthJsonV3Keystore(outDir: string, fileNameBase: string, password: string, privateKeyHex: string): Promise<string>;
@@ -65,4 +65,4 @@ export declare function writeEthJsonV3ToFile(validators: ValidatorKeyStore[], op
     outDir: string;
     password: string;
 }): Promise<void>;
-//# sourceMappingURL=shared.d.ts.map
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic2hhcmVkLmQudHMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi9zcmMvY21kcy92YWxpZGF0b3Jfa2V5cy9zaGFyZWQudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBS0EsT0FBTyxLQUFLLEVBQUUsVUFBVSxFQUFFLE1BQU0sK0JBQStCLENBQUM7QUFDaEUsT0FBTyxLQUFLLEVBQUUsS0FBSyxFQUFFLE1BQU0sdUJBQXVCLENBQUM7QUFDbkQsT0FBTyxLQUFLLEVBQUUsVUFBVSxFQUFFLGFBQWEsRUFBRSxpQkFBaUIsRUFBRSxNQUFNLDRCQUE0QixDQUFDO0FBQy9GLE9BQU8sS0FBSyxFQUFFLFlBQVksRUFBRSxNQUFNLDZCQUE2QixDQUFDO0FBMkRoRSxNQUFNLE1BQU0sZ0JBQWdCLEdBQUc7SUFBRSxXQUFXLENBQUMsRUFBRSxNQUFNLENBQUM7SUFBQyxXQUFXLENBQUMsRUFBRSxNQUFNLENBQUM7SUFBQyxZQUFZLENBQUMsRUFBRSxNQUFNLEVBQUUsQ0FBQTtDQUFFLENBQUM7QUFFdkcsTUFBTSxNQUFNLG9CQUFvQixHQUFHO0lBQ2pDLGNBQWMsRUFBRSxNQUFNLENBQUM7SUFDdkIsY0FBYyxDQUFDLEVBQUUsTUFBTSxDQUFDO0lBQ3hCLFVBQVUsQ0FBQyxFQUFFLE1BQU0sRUFBRSxDQUFDO0lBQ3RCLFlBQVksRUFBRSxNQUFNLENBQUM7SUFDckIsZ0JBQWdCLEVBQUUsTUFBTSxDQUFDO0lBQ3pCLFFBQVEsRUFBRSxNQUFNLENBQUM7SUFDakIsR0FBRyxDQUFDLEVBQUUsTUFBTSxDQUFDO0lBQ2IsT0FBTyxDQUFDLEVBQUUsTUFBTSxDQUFDO0lBQ2pCLFlBQVksRUFBRSxZQUFZLENBQUM7SUFDM0IsUUFBUSxDQUFDLEVBQUUsVUFBVSxDQUFDO0lBQ3RCLFlBQVksQ0FBQyxFQUFFLE1BQU0sQ0FBQztDQUN2QixDQUFDO0FBRUYsd0JBQWdCLGtCQUFrQixDQUFDLElBQUksRUFBRSxNQUFNLEVBQUUsWUFBWSxHQUFFLE1BQVUsRUFBRSxZQUFZLEdBQUUsTUFBVSxVQXFCbEc7QUFFRDs7OztHQUlHO0FBQ0gsd0JBQXNCLDZCQUE2QixDQUFDLGFBQWEsRUFBRSxNQUFNLEdBQUcsT0FBTyxDQUFDLE1BQU0sQ0FBQyxDQUUxRjtBQUVELHdCQUFnQixpQkFBaUIsQ0FDL0IsUUFBUSxFQUFFLE1BQU0sRUFDaEIsZ0JBQWdCLEVBQUUsTUFBTSxFQUN4QixZQUFZLEVBQUUsTUFBTSxFQUNwQixZQUFZLENBQUMsRUFBRSxNQUFNLEdBQ3BCLFVBQVUsR0FBRyxhQUFhLENBSzVCO0FBRUQsd0JBQXNCLHFCQUFxQixDQUFDLEtBQUssRUFBRSxvQkFBb0I7OztHQXVFdEU7QUFFRCx3QkFBc0IseUJBQXlCLENBQUMsT0FBTyxDQUFDLEVBQUUsTUFBTSxFQUFFLElBQUksQ0FBQyxFQUFFLE1BQU07OztHQW9COUU7QUFFRCx3QkFBc0IsaUJBQWlCLENBQUMsSUFBSSxFQUFFLE1BQU0sRUFBRSxRQUFRLEVBQUUsT0FBTyxpQkFHdEU7QUFFRCx3QkFBZ0IscUJBQXFCLENBQUMsR0FBRyxFQUFFLEtBQUssRUFBRSxTQUFTLEVBQUUsZ0JBQWdCLEVBQUUsUUFzQjlFO0FBRUQsd0JBQWdCLGNBQWMsQ0FBQyxHQUFHLEVBQUUsS0FBSyxFQUFFLFFBQVEsRUFBRSxPQUFPLEdBQUcsU0FBUyxFQUFFLEdBQUcsRUFBRSxPQUFPLFFBSXJGO0FBRUQ7Ozs7Ozs7Ozs7O0dBV0c7QUFDSCx3QkFBc0IscUJBQXFCLENBQ3pDLE1BQU0sRUFBRSxNQUFNLEVBQ2QsWUFBWSxFQUFFLE1BQU0sRUFDcEIsUUFBUSxFQUFFLE1BQU0sRUFDaEIsYUFBYSxFQUFFLE1BQU0sRUFDckIsU0FBUyxFQUFFLE1BQU0sRUFDakIsY0FBYyxFQUFFLE1BQU0sR0FDckIsT0FBTyxDQUFDLE1BQU0sQ0FBQyxDQVNqQjtBQUVELHlHQUF5RztBQUN6Ryx3QkFBc0IsbUJBQW1CLENBQ3ZDLFVBQVUsRUFBRSxpQkFBaUIsRUFBRSxFQUMvQixPQUFPLEVBQUU7SUFBRSxNQUFNLEVBQUUsTUFBTSxDQUFDO0lBQUMsUUFBUSxFQUFFLE1BQU0sQ0FBQztJQUFDLE9BQU8sQ0FBQyxFQUFFLE1BQU0sQ0FBQTtDQUFFLEdBQzlELE9BQU8sQ0FBQyxJQUFJLENBQUMsQ0F3QmY7QUFFRCw4RUFBOEU7QUFDOUUsd0JBQXNCLHNCQUFzQixDQUMxQyxNQUFNLEVBQUUsTUFBTSxFQUNkLFlBQVksRUFBRSxNQUFNLEVBQ3BCLFFBQVEsRUFBRSxNQUFNLEVBQ2hCLGFBQWEsRUFBRSxNQUFNLEdBQ3BCLE9BQU8sQ0FBQyxNQUFNLENBQUMsQ0FPakI7QUFFRCxrR0FBa0c7QUFDbEcsd0JBQXNCLG9CQUFvQixDQUN4QyxVQUFVLEVBQUUsaUJBQWlCLEVBQUUsRUFDL0IsT0FBTyxFQUFFO0lBQUUsTUFBTSxFQUFFLE1BQU0sQ0FBQztJQUFDLFFBQVEsRUFBRSxNQUFNLENBQUE7Q0FBRSxHQUM1QyxPQUFPLENBQUMsSUFBSSxDQUFDLENBeUNmIn0=

package/dest/cmds/validator_keys/shared.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"shared.d.ts","sourceRoot":"","sources":["../../../src/cmds/validator_keys/shared.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,+BAA+B,CAAC;AAChE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AACnD,OAAO,KAAK,EAAE,UAAU,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAC/F,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAShE,MAAM,MAAM,gBAAgB,GAAG;IAAE,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC;AAEvG,MAAM,MAAM,oBAAoB,GAAG;IACjC,cAAc,EAAE,MAAM,CAAC;IACvB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,YAAY,EAAE,MAAM,CAAC;IACrB,gBAAgB,EAAE,MAAM,CAAC;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,YAAY,EAAE,YAAY,CAAC;IAC3B,QAAQ,CAAC,EAAE,UAAU,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,cAAc,CAAC,EAAE,UAAU,CAAC;CAC7B,CAAC;AAEF,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,UAO7D;AAED;;;;GAIG;AACH,wBAAsB,6BAA6B,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAE1F;AAED,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,MAAM,EAChB,gBAAgB,EAAE,MAAM,EACxB,YAAY,EAAE,MAAM,EACpB,YAAY,CAAC,EAAE,MAAM,GACpB,UAAU,GAAG,aAAa,CAK5B;AAED,wBAAsB,qBAAqB,CAAC,KAAK,EAAE,oBAAoB;;;GA6EtE;AAED,wBAAsB,yBAAyB,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM;;;GAoB9E;AAED,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,iBAGtE;AAED,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,KAAK,EAAE,SAAS,EAAE,gBAAgB,EAAE,QAsB9E;AAED,wBAAgB,cAAc,CAAC,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,GAAG,SAAS,EAAE,GAAG,EAAE,OAAO,QAIrF;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,qBAAqB,CACzC,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,EAChB,aAAa,EAAE,MAAM,EACrB,SAAS,EAAE,MAAM,EACjB,cAAc,EAAE,MAAM,GACrB,OAAO,CAAC,MAAM,CAAC,CASjB;AAED,yGAAyG;AACzG,wBAAsB,mBAAmB,CACvC,UAAU,EAAE,iBAAiB,EAAE,EAC/B,OAAO,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAC5C,OAAO,CAAC,IAAI,CAAC,CAuBf;AAED,8EAA8E;AAC9E,wBAAsB,sBAAsB,CAC1C,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,EAChB,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,MAAM,CAAC,CAQjB;AAED,kGAAkG;AAClG,wBAAsB,oBAAoB,CACxC,UAAU,EAAE,iBAAiB,EAAE,EAC/B,OAAO,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAC5C,OAAO,CAAC,IAAI,CAAC,CA2Cf"}
+{"version":3,"file":"shared.d.ts","sourceRoot":"","sources":["../../../src/cmds/validator_keys/shared.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,+BAA+B,CAAC;AAChE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AACnD,OAAO,KAAK,EAAE,UAAU,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAC/F,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AA2DhE,MAAM,MAAM,gBAAgB,GAAG;IAAE,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC;AAEvG,MAAM,MAAM,oBAAoB,GAAG;IACjC,cAAc,EAAE,MAAM,CAAC;IACvB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,gBAAgB,EAAE,MAAM,CAAC;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,YAAY,CAAC;IAC3B,QAAQ,CAAC,EAAE,UAAU,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,GAAE,MAAU,EAAE,YAAY,GAAE,MAAU,UAqBlG;AAED;;;;GAIG;AACH,wBAAsB,6BAA6B,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAE1F;AAED,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,MAAM,EAChB,gBAAgB,EAAE,MAAM,EACxB,YAAY,EAAE,MAAM,EACpB,YAAY,CAAC,EAAE,MAAM,GACpB,UAAU,GAAG,aAAa,CAK5B;AAED,wBAAsB,qBAAqB,CAAC,KAAK,EAAE,oBAAoB;;;GAuEtE;AAED,wBAAsB,yBAAyB,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM;;;GAoB9E;AAED,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,iBAGtE;AAED,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,KAAK,EAAE,SAAS,EAAE,gBAAgB,EAAE,QAsB9E;AAED,wBAAgB,cAAc,CAAC,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,GAAG,SAAS,EAAE,GAAG,EAAE,OAAO,QAIrF;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,qBAAqB,CACzC,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,EAChB,aAAa,EAAE,MAAM,EACrB,SAAS,EAAE,MAAM,EACjB,cAAc,EAAE,MAAM,GACrB,OAAO,CAAC,MAAM,CAAC,CASjB;AAED,yGAAyG;AACzG,wBAAsB,mBAAmB,CACvC,UAAU,EAAE,iBAAiB,EAAE,EAC/B,OAAO,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,GAC9D,OAAO,CAAC,IAAI,CAAC,CAwBf;AAED,8EAA8E;AAC9E,wBAAsB,sBAAsB,CAC1C,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,EAChB,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,MAAM,CAAC,CAOjB;AAED,kGAAkG;AAClG,wBAAsB,oBAAoB,CACxC,UAAU,EAAE,iBAAiB,EAAE,EAC/B,OAAO,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAC5C,OAAO,CAAC,IAAI,CAAC,CAyCf"}

package/dest/cmds/validator_keys/shared.js

@@ -1,16 +1,78 @@
 import { prettyPrintJSON } from '@aztec/cli/utils';
-import { computeBn254G1PublicKeyCompressed, deriveBlsPrivateKey } from '@aztec/foundation/crypto';
+import { asyncPool } from '@aztec/foundation/async-pool';
+import { deriveBlsPrivateKey } from '@aztec/foundation/crypto/bls';
 import { createBn254Keystore } from '@aztec/foundation/crypto/bls/bn254_keystore';
+import { computeBn254G1PublicKeyCompressed } from '@aztec/foundation/crypto/bn254';
 import { Wallet } from '@ethersproject/wallet';
 import { constants as fsConstants, mkdirSync } from 'fs';
 import { access, writeFile } from 'fs/promises';
-import { homedir } from 'os';
+import { availableParallelism, homedir } from 'os';
 import { dirname, isAbsolute, join } from 'path';
 import { mnemonicToAccount } from 'viem/accounts';
-export function withValidatorIndex(path, index) {
+import { Worker } from 'worker_threads';
+import { defaultBlsPath } from './utils.js';
+// ethers' default scrypt parameters use substantial memory, so keep worker fan-out bounded.
+const maxEthKeystoreWorkers = Math.max(1, Math.min(4, availableParallelism()));
+function deserializeWorkerError(error) {
+    const result = new Error(error.message);
+    result.name = error.name ?? result.name;
+    result.stack = error.stack;
+    return result;
+}
+function encryptEthJsonV3InWorker(privateKeyHex, password) {
+    return new Promise((resolve, reject)=>{
+        const worker = new Worker(new URL('./eth_json_v3_worker.js', import.meta.url), {
+            workerData: {
+                privateKeyHex,
+                password
+            }
+        });
+        let settled = false;
+        worker.once('message', (result)=>{
+            settled = true;
+            if ('json' in result) {
+                resolve(result.json);
+            } else {
+                reject(deserializeWorkerError(result.error));
+            }
+        });
+        worker.once('error', (error)=>{
+            settled = true;
+            reject(error);
+        });
+        worker.once('exit', (code)=>{
+            if (!settled) {
+                reject(new Error(`ETH JSON V3 worker stopped with exit code ${code}`));
+            }
+        });
+    });
+}
+async function encryptEthJsonV3(privateKeyHex, password) {
+    if (process.env.JEST_WORKER_ID !== undefined) {
+        return await new Wallet(privateKeyHex).encrypt(password);
+    }
+    return await encryptEthJsonV3InWorker(privateKeyHex, password);
+}
+export function withValidatorIndex(path, accountIndex = 0, addressIndex = 0) {
+    // NOTE: The legacy BLS CLI is to allow users who generated keys in 2.1.4 to be able to use the same command
+    // to re-generate their keys. In 2.1.5 we switched how we append addresses to the path so this is to maintain backwards compatibility.
+    const useLegacyBlsCli = [
+        'true',
+        '1',
+        'yes',
+        'y'
+    ].includes(process.env.LEGACY_BLS_CLI ?? '');
+    const defaultBlsPathParts = defaultBlsPath.split('/');
     const parts = path.split('/');
-    if (parts.length >= 4 && parts[0] === 'm' && parts[1] === '12381' && parts[2] === '3600') {
-        parts[3] = String(index);
+    if (parts.length == defaultBlsPathParts.length && parts.every((part, index)=>part === defaultBlsPathParts[index])) {
+        if (useLegacyBlsCli) {
+            // In 2.1.4, we were using address-index in parts[3] and did NOT use account-index, check lines 32 & 84
+            // https://github.com/AztecProtocol/aztec-packages/blob/v2.1.4/yarn-project/cli/src/cmds/validator_keys/shared.ts
+            parts[3] = String(addressIndex);
+        } else {
+            parts[3] = String(accountIndex);
+            parts[5] = String(addressIndex);
+        }
         return parts.join('/');
     }
     return path;
@@ -33,29 +95,16 @@ export function deriveEthAttester(mnemonic, baseAccountIndex, addressIndex, remo
     } : '0x' + Buffer.from(acct.getHdKey().privateKey).toString('hex');
 }
 export async function buildValidatorEntries(input) {
-    const { validatorCount, publisherCount = 0, accountIndex, baseAddressIndex, mnemonic, ikm, blsPath, blsOnly, feeRecipient, coinbase, remoteSigner, fundingAccount } = input;
-    const defaultBlsPath = 'm/12381/3600/0/0/0';
+    const { validatorCount, publisherCount = 0, publishers, accountIndex, baseAddressIndex, mnemonic, ikm, blsPath, feeRecipient, coinbase, remoteSigner } = input;
     const summaries = [];
     const validators = await Promise.all(Array.from({
         length: validatorCount
     }, async (_unused, i)=>{
         const addressIndex = baseAddressIndex + i;
         const basePath = blsPath ?? defaultBlsPath;
-        const perValidatorPath = withValidatorIndex(basePath, addressIndex);
-        const blsPrivKey = blsOnly || ikm || mnemonic ? deriveBlsPrivateKey(mnemonic, ikm, perValidatorPath) : undefined;
+        const perValidatorPath = withValidatorIndex(basePath, accountIndex, addressIndex);
+        const blsPrivKey = ikm || mnemonic ? deriveBlsPrivateKey(mnemonic, ikm, perValidatorPath) : undefined;
         const blsPubCompressed = blsPrivKey ? await computeBlsPublicKeyCompressed(blsPrivKey) : undefined;
-        if (blsOnly) {
-            const attester = {
-                bls: blsPrivKey
-            };
-            summaries.push({
-                attesterBls: blsPubCompressed
-            });
-            return {
-                attester,
-                feeRecipient
-            };
-        }
         const ethAttester = deriveEthAttester(mnemonic, accountIndex, addressIndex, remoteSigner);
         const attester = blsPrivKey ? {
             eth: ethAttester,
@@ -63,7 +112,10 @@ export async function buildValidatorEntries(input) {
         } : ethAttester;
         let publisherField;
         const publisherAddresses = [];
-        if (publisherCount > 0) {
+        if (publishers && publishers.length > 0) {
+            publisherAddresses.push(...publishers);
+            publisherField = publishers.length === 1 ? publishers[0] : publishers;
+        } else if (publisherCount > 0) {
             const publishersBaseIndex = baseAddressIndex + validatorCount + i * publisherCount;
             const publisherAccounts = Array.from({
                 length: publisherCount
@@ -97,8 +149,7 @@ export async function buildValidatorEntries(input) {
                 publisher: publisherField
             } : {},
             feeRecipient,
-            coinbase,
-            fundingAccount
+            coinbase: coinbase ?? attesterEthAddress
         };
     }));
     return {
@@ -181,7 +232,7 @@ export function maybePrintJson(log, jsonFlag, obj) {
     mkdirSync(outDir, {
         recursive: true
     });
-    const keystore = createBn254Keystore(password, privateKeyHex, pubkeyHex, derivationPath);
+    const keystore = await createBn254Keystore(password, privateKeyHex, pubkeyHex, derivationPath);
     const safeBase = fileNameBase.replace(/[^a-zA-Z0-9_-]/g, '_');
     const outPath = join(outDir, `keystore-${safeBase}.json`);
     await writeFile(outPath, JSON.stringify(keystore, null, 2), {
@@ -190,19 +241,18 @@ export function maybePrintJson(log, jsonFlag, obj) {
     return outPath;
 }
 /** Replace plaintext BLS keys in validators with { path, password } pointing to BN254 keystore files. */ export async function writeBlsBn254ToFile(validators, options) {
-    for(let i = 0; i < validators.length; i++){
-        const v = validators[i];
+    await Promise.all(validators.map(async (v, i)=>{
         if (!v || typeof v !== 'object' || !('attester' in v)) {
-            continue;
+            return;
         }
         const att = v.attester;
         // Shapes: { bls: <hex> } or { eth: <ethAccount>, bls?: <hex> } or plain EthAccount
         const blsKey = typeof att === 'object' && 'bls' in att ? att.bls : undefined;
         if (!blsKey || typeof blsKey !== 'string') {
-            continue;
+            return;
         }
         const pub = await computeBlsPublicKeyCompressed(blsKey);
-        const path = 'm/12381/3600/0/0/0';
+        const path = options.blsPath ?? defaultBlsPath;
         const fileBase = `${String(i + 1)}_${pub.slice(2, 18)}`;
         const keystorePath = await writeBn254BlsKeystore(options.outDir, fileBase, options.password, blsKey, pub, path);
         if (typeof att === 'object') {
@@ -211,15 +261,14 @@ export function maybePrintJson(log, jsonFlag, obj) {
                 password: options.password
             };
         }
-    }
+    }));
 }
 /** Writes an Ethereum JSON V3 keystore using ethers, returns absolute path */ export async function writeEthJsonV3Keystore(outDir, fileNameBase, password, privateKeyHex) {
     const safeBase = fileNameBase.replace(/[^a-zA-Z0-9_-]/g, '_');
     mkdirSync(outDir, {
         recursive: true
     });
-    const wallet = new Wallet(privateKeyHex);
-    const json = await wallet.encrypt(password);
+    const json = await encryptEthJsonV3(privateKeyHex, password);
     const outPath = join(outDir, `keystore-eth-${safeBase}.json`);
     await writeFile(outPath, json, {
         encoding: 'utf-8'
@@ -227,16 +276,18 @@ export function maybePrintJson(log, jsonFlag, obj) {
     return outPath;
 }
 /** Replace plaintext ETH keys in validators with { path, password } pointing to JSON V3 files. */ export async function writeEthJsonV3ToFile(validators, options) {
-    const maybeEncryptEth = async (account, label)=>{
+    const tasks = [];
+    const maybeQueueEncryptEth = (account, label, setEncryptedAccount)=>{
         if (typeof account === 'string' && account.startsWith('0x') && account.length === 66) {
-            const fileBase = `${label}_${account.slice(2, 10)}`;
-            const p = await writeEthJsonV3Keystore(options.outDir, fileBase, options.password, account);
-            return {
-                path: p,
-                password: options.password
-            };
+            tasks.push(async ()=>{
+                const fileBase = `${label}_${account.slice(2, 10)}`;
+                const path = await writeEthJsonV3Keystore(options.outDir, fileBase, options.password, account);
+                setEncryptedAccount({
+                    path,
+                    password: options.password
+                });
+            });
         }
-        return account;
     };
     for(let i = 0; i < validators.length; i++){
         const v = validators[i];
@@ -246,26 +297,21 @@ export function maybePrintJson(log, jsonFlag, obj) {
         // attester may be string (eth), object with eth, or remote signer
         const att = v.attester;
         if (typeof att === 'string') {
-            v.attester = await maybeEncryptEth(att, `attester_${i + 1}`);
+            maybeQueueEncryptEth(att, `attester_${i + 1}`, (account)=>v.attester = account);
         } else if (att && typeof att === 'object' && 'eth' in att) {
-            att.eth = await maybeEncryptEth(att.eth, `attester_${i + 1}`);
+            maybeQueueEncryptEth(att.eth, `attester_${i + 1}`, (account)=>att.eth = account);
         }
         // publisher can be single or array
         if ('publisher' in v) {
             const pub = v.publisher;
             if (Array.isArray(pub)) {
-                const out = [];
                 for(let j = 0; j < pub.length; j++){
-                    out.push(await maybeEncryptEth(pub[j], `publisher_${i + 1}_${j + 1}`));
+                    maybeQueueEncryptEth(pub[j], `publisher_${i + 1}_${j + 1}`, (account)=>pub[j] = account);
                 }
-                v.publisher = out;
             } else if (pub !== undefined) {
-                v.publisher = await maybeEncryptEth(pub, `publisher_${i + 1}`);
+                maybeQueueEncryptEth(pub, `publisher_${i + 1}`, (account)=>v.publisher = account);
             }
         }
-        // Optional fundingAccount within validator
-        if ('fundingAccount' in v) {
-            v.fundingAccount = await maybeEncryptEth(v.fundingAccount, `funding_${i + 1}`);
-        }
     }
+    await asyncPool(maxEthKeystoreWorkers, tasks, (task)=>task());
 }

package/dest/cmds/validator_keys/staker.d.ts

@@ -0,0 +1,38 @@
+import { GSEContract } from '@aztec/ethereum/contracts';
+import type { EthAddress } from '@aztec/foundation/eth-address';
+import type { LogFn } from '@aztec/foundation/log';
+import type { AttesterAccounts } from '@aztec/node-keystore/types';
+export type StakerOptions = {
+    from: string;
+    password?: string;
+    output?: string;
+    gseAddress: EthAddress;
+    l1RpcUrls: string[];
+    l1ChainId: number;
+};
+export type StakerOutput = {
+    attester: string;
+    publicKeyG1: {
+        x: string;
+        y: string;
+    };
+    publicKeyG2: {
+        x0: string;
+        x1: string;
+        y0: string;
+        y1: string;
+    };
+    proofOfPossession: {
+        x: string;
+        y: string;
+    };
+};
+/**
+ * Process AttesterAccounts (which can be a single attester, array, or mnemonic)
+ */
+export declare function processAttesterAccounts(attesterAccounts: AttesterAccounts, gse: GSEContract, password?: string): Promise<StakerOutput[]>;
+/**
+ * Main staker command function
+ */
+export declare function generateStakerJson(options: StakerOptions, log: LogFn): Promise<void>;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic3Rha2VyLmQudHMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi9zcmMvY21kcy92YWxpZGF0b3Jfa2V5cy9zdGFrZXIudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBRUEsT0FBTyxFQUFFLFdBQVcsRUFBRSxNQUFNLDJCQUEyQixDQUFDO0FBSXhELE9BQU8sS0FBSyxFQUFFLFVBQVUsRUFBRSxNQUFNLCtCQUErQixDQUFDO0FBQ2hFLE9BQU8sS0FBSyxFQUFFLEtBQUssRUFBRSxNQUFNLHVCQUF1QixDQUFDO0FBRW5ELE9BQU8sS0FBSyxFQUVWLGdCQUFnQixFQUtqQixNQUFNLDRCQUE0QixDQUFDO0FBUXBDLE1BQU0sTUFBTSxhQUFhLEdBQUc7SUFDMUIsSUFBSSxFQUFFLE1BQU0sQ0FBQztJQUNiLFFBQVEsQ0FBQyxFQUFFLE1BQU0sQ0FBQztJQUNsQixNQUFNLENBQUMsRUFBRSxNQUFNLENBQUM7SUFDaEIsVUFBVSxFQUFFLFVBQVUsQ0FBQztJQUN2QixTQUFTLEVBQUUsTUFBTSxFQUFFLENBQUM7SUFDcEIsU0FBUyxFQUFFLE1BQU0sQ0FBQztDQUNuQixDQUFDO0FBRUYsTUFBTSxNQUFNLFlBQVksR0FBRztJQUN6QixRQUFRLEVBQUUsTUFBTSxDQUFDO0lBQ2pCLFdBQVcsRUFBRTtRQUNYLENBQUMsRUFBRSxNQUFNLENBQUM7UUFDVixDQUFDLEVBQUUsTUFBTSxDQUFDO0tBQ1gsQ0FBQztJQUNGLFdBQVcsRUFBRTtRQUNYLEVBQUUsRUFBRSxNQUFNLENBQUM7UUFDWCxFQUFFLEVBQUUsTUFBTSxDQUFDO1FBQ1gsRUFBRSxFQUFFLE1BQU0sQ0FBQztRQUNYLEVBQUUsRUFBRSxNQUFNLENBQUM7S0FDWixDQUFDO0lBQ0YsaUJBQWlCLEVBQUU7UUFDakIsQ0FBQyxFQUFFLE1BQU0sQ0FBQztRQUNWLENBQUMsRUFBRSxNQUFNLENBQUM7S0FDWCxDQUFDO0NBQ0gsQ0FBQztBQTJLRjs7R0FFRztBQUNILHdCQUFzQix1QkFBdUIsQ0FDM0MsZ0JBQWdCLEVBQUUsZ0JBQWdCLEVBQ2xDLEdBQUcsRUFBRSxXQUFXLEVBQ2hCLFFBQVEsQ0FBQyxFQUFFLE1BQU0sR0FDaEIsT0FBTyxDQUFDLFlBQVksRUFBRSxDQUFDLENBcUJ6QjtBQUVEOztHQUVHO0FBQ0gsd0JBQXNCLGtCQUFrQixDQUFDLE9BQU8sRUFBRSxhQUFhLEVBQUUsR0FBRyxFQUFFLEtBQUssR0FBRyxPQUFPLENBQUMsSUFBSSxDQUFDLENBK0MxRiJ9

package/dest/cmds/validator_keys/staker.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"staker.d.ts","sourceRoot":"","sources":["../../../src/cmds/validator_keys/staker.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AAIxD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,+BAA+B,CAAC;AAChE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAEnD,OAAO,KAAK,EAEV,gBAAgB,EAKjB,MAAM,4BAA4B,CAAC;AAQpC,MAAM,MAAM,aAAa,GAAG;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,UAAU,CAAC;IACvB,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,YAAY,GAAG;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE;QACX,CAAC,EAAE,MAAM,CAAC;QACV,CAAC,EAAE,MAAM,CAAC;KACX,CAAC;IACF,WAAW,EAAE;QACX,EAAE,EAAE,MAAM,CAAC;QACX,EAAE,EAAE,MAAM,CAAC;QACX,EAAE,EAAE,MAAM,CAAC;QACX,EAAE,EAAE,MAAM,CAAC;KACZ,CAAC;IACF,iBAAiB,EAAE;QACjB,CAAC,EAAE,MAAM,CAAC;QACV,CAAC,EAAE,MAAM,CAAC;KACX,CAAC;CACH,CAAC;AA2KF;;GAEG;AACH,wBAAsB,uBAAuB,CAC3C,gBAAgB,EAAE,gBAAgB,EAClC,GAAG,EAAE,WAAW,EAChB,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,YAAY,EAAE,CAAC,CAqBzB;AAED;;GAEG;AACH,wBAAsB,kBAAkB,CAAC,OAAO,EAAE,aAAa,EAAE,GAAG,EAAE,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CA+C1F"}