@aztec/cli 2.1.0-rc.24 → 2.1.0-rc.28

package/dest/config/chain_l2_config.js

@@ -92,7 +92,6 @@ export const stagingIgnitionL2ChainConfig = {
     governanceProposerRoundSize: 300,
     governanceProposerQuorum: 151,
     // Node slashing config
-    // TODO TMNT-330
     slashMinPenaltyPercentage: 0.5,
     slashMaxPenaltyPercentage: 2.0,
     slashInactivityTargetPercentage: 0.7,
@@ -175,25 +174,49 @@ export const testnetL2ChainConfig = {
     txPoolDeleteTxsAfterReorg: true,
     skipArchiverInitialSync: true,
     blobAllowEmptySources: true,
-    // Deployment stuff
     /** How many seconds an L1 slot lasts. */ ethereumSlotDuration: 12,
-    /** How many seconds an L2 slots lasts (must be multiple of ethereum slot duration). */ aztecSlotDuration: 36,
+    /** How many seconds an L2 slots lasts (must be multiple of ethereum slot duration). */ aztecSlotDuration: 72,
     /** How many L2 slots an epoch lasts. */ aztecEpochDuration: 32,
-    /** The target validator committee size. */ aztecTargetCommitteeSize: 48,
+    /** The target validator committee size. */ aztecTargetCommitteeSize: 24,
     /** The number of epochs to lag behind the current epoch for validator selection. */ lagInEpochs: 2,
     /** The number of epochs after an epoch ends that proofs are still accepted. */ aztecProofSubmissionEpochs: 1,
-    /** The deposit amount for a validator */ activationThreshold: DefaultL1ContractsConfig.activationThreshold,
-    /** The minimum stake for a validator. */ ejectionThreshold: DefaultL1ContractsConfig.ejectionThreshold,
-    /** The local ejection threshold for a validator. Stricter than ejectionThreshold but local to a specific rollup */ localEjectionThreshold: DefaultL1ContractsConfig.localEjectionThreshold,
-    /** The slashing round size */ slashingRoundSizeInEpochs: DefaultL1ContractsConfig.slashingRoundSizeInEpochs,
-    /** Governance proposing round size */ governanceProposerRoundSize: DefaultL1ContractsConfig.governanceProposerRoundSize,
+    // This is a diff from mainnet: we have 2-strikes you're out, rather than 3 on mainnet.
+    localEjectionThreshold: 198_000n * 10n ** 18n,
+    /** How many sequencers must agree with a slash for it to be executed. */ slashingQuorum: 65,
+    slashingRoundSizeInEpochs: 4,
+    slashingExecutionDelayInRounds: 28,
+    slashingLifetimeInRounds: 34,
+    slashingVetoer: EthAddress.fromString('0xBbB4aF368d02827945748b28CD4b2D42e4A37480'),
+    slashingOffsetInRounds: 2,
+    slashingDisableDuration: 259_200,
+    slasherFlavor: 'tally',
+    slashAmountSmall: 2_000n * 10n ** 18n,
+    slashAmountMedium: 2_000n * 10n ** 18n,
+    slashAmountLarge: 2_000n * 10n ** 18n,
     /** The mana target for the rollup */ manaTarget: 0n,
-    /** The proving cost per mana */ provingCostPerMana: DefaultL1ContractsConfig.provingCostPerMana,
-    /** Exit delay for stakers */ exitDelaySeconds: DefaultL1ContractsConfig.exitDelaySeconds,
-    ...DefaultSlashConfig,
+    /** The proving cost per mana */ provingCostPerMana: 0n,
+    exitDelaySeconds: 4 * 24 * 60 * 60,
+    activationThreshold: 200_000n * 10n ** 18n,
+    ejectionThreshold: 100_000n * 10n ** 18n,
+    governanceProposerRoundSize: 300,
+    governanceProposerQuorum: 151,
+    // Node slashing config
+    slashInactivityTargetPercentage: 0.8,
+    slashInactivityConsecutiveEpochThreshold: 2,
+    slashInactivityPenalty: 2_000n * 10n ** 18n,
     slashPrunePenalty: 0n,
     slashDataWithholdingPenalty: 0n,
-    slashInactivityPenalty: DefaultL1ContractsConfig.slashAmountMedium,
+    slashProposeInvalidAttestationsPenalty: 2_000n * 10n ** 18n,
+    slashAttestDescendantOfInvalidPenalty: 2_000n * 10n ** 18n,
+    slashUnknownPenalty: 2_000n * 10n ** 18n,
+    slashBroadcastedInvalidBlockPenalty: 2_000n * 10n ** 18n,
+    slashGracePeriodL2Slots: 1_200,
+    slashOffenseExpirationRounds: 8,
+    slashMinPenaltyPercentage: 0.5,
+    slashMaxPenaltyPercentage: 2.0,
+    slashMaxPayloadSize: 50,
+    slashExecuteRoundsLookBack: 4,
+    sentinelEnabled: true,
     ...DefaultNetworkDBMapSizeConfig
 };
 export const mainnetL2ChainConfig = {
@@ -224,43 +247,42 @@ export const mainnetL2ChainConfig = {
     /** The target validator committee size. */ aztecTargetCommitteeSize: 24,
     /** The number of epochs to lag behind the current epoch for validator selection. */ lagInEpochs: 2,
     /** The number of epochs after an epoch ends that proofs are still accepted. */ aztecProofSubmissionEpochs: 1,
+    localEjectionThreshold: 196_000n * 10n ** 18n,
     /** How many sequencers must agree with a slash for it to be executed. */ slashingQuorum: 65,
     slashingRoundSizeInEpochs: 4,
-    slashingLifetimeInRounds: 40,
     slashingExecutionDelayInRounds: 28,
-    slashingDisableDuration: 5 * 24 * 60 * 60,
-    slashAmountSmall: 2_000n * 10n ** 18n,
-    slashAmountMedium: 10_000n * 10n ** 18n,
-    slashAmountLarge: 50_000n * 10n ** 18n,
+    slashingLifetimeInRounds: 34,
+    slashingVetoer: EthAddress.ZERO,
     slashingOffsetInRounds: 2,
+    slashingDisableDuration: 259_200,
     slasherFlavor: 'tally',
-    slashingVetoer: EthAddress.ZERO,
+    slashAmountSmall: 2_000n * 10n ** 18n,
+    slashAmountMedium: 2_000n * 10n ** 18n,
+    slashAmountLarge: 2_000n * 10n ** 18n,
     /** The mana target for the rollup */ manaTarget: 0n,
-    exitDelaySeconds: 5 * 24 * 60 * 60,
     /** The proving cost per mana */ provingCostPerMana: 0n,
-    ejectionThreshold: 100_000n * 10n ** 18n,
+    exitDelaySeconds: 4 * 24 * 60 * 60,
     activationThreshold: 200_000n * 10n ** 18n,
-    localEjectionThreshold: 196_000n * 10n ** 18n,
-    governanceProposerRoundSize: 300,
-    governanceProposerQuorum: 151,
+    ejectionThreshold: 100_000n * 10n ** 18n,
+    governanceProposerRoundSize: 1000,
+    governanceProposerQuorum: 600,
     // Node slashing config
-    // TODO TMNT-330
-    slashMinPenaltyPercentage: 0.5,
-    slashMaxPenaltyPercentage: 2.0,
-    slashInactivityTargetPercentage: 0.7,
+    slashInactivityTargetPercentage: 0.8,
     slashInactivityConsecutiveEpochThreshold: 2,
     slashInactivityPenalty: 2_000n * 10n ** 18n,
     slashPrunePenalty: 0n,
     slashDataWithholdingPenalty: 0n,
-    slashProposeInvalidAttestationsPenalty: 50_000n * 10n ** 18n,
-    slashAttestDescendantOfInvalidPenalty: 50_000n * 10n ** 18n,
+    slashProposeInvalidAttestationsPenalty: 2_000n * 10n ** 18n,
+    slashAttestDescendantOfInvalidPenalty: 2_000n * 10n ** 18n,
     slashUnknownPenalty: 2_000n * 10n ** 18n,
-    slashBroadcastedInvalidBlockPenalty: 0n,
-    slashMaxPayloadSize: 50,
-    slashGracePeriodL2Slots: 32 * 4,
+    slashBroadcastedInvalidBlockPenalty: 2_000n * 10n ** 18n,
+    slashGracePeriodL2Slots: 1_200,
     slashOffenseExpirationRounds: 8,
-    sentinelEnabled: true,
+    slashMinPenaltyPercentage: 0.5,
+    slashMaxPenaltyPercentage: 2.0,
+    slashMaxPayloadSize: 50,
     slashExecuteRoundsLookBack: 4,
+    sentinelEnabled: true,
     ...DefaultNetworkDBMapSizeConfig
 };
 export function getL2ChainConfig(networkName) {

package/dest/utils/commands.d.ts

@@ -35,6 +35,15 @@ export declare function atomicUpdateFile(filePath: string, contents: string): Pr
  * @returns An Aztec address. Will throw if one can't be found in either options.
  */
 export declare function getTxSender(pxe: PXE, _from?: string): Promise<AztecAddress>;
+/**
+ * Parses and validates a hex string. Removes leading 0x if present, checks for hex validity,
+ * and enforces an optional minimum length.
+ * @param hex - The hex string to validate.
+ * @param minLen - Optional minimum length (in hex characters, after stripping '0x').
+ * @returns The normalized hex string (without leading 0x).
+ * @throws InvalidArgumentError if the string is not valid hex or does not meet the minimum length.
+ */
+export declare function parseHex(hex: string, minLen?: number): `0x${string}`;
 export declare function parseBigint(bigint: string): bigint | undefined;
 /**
  * Parses a hex encoded string to an Fr integer
@@ -84,7 +93,7 @@ export declare function parseOptionalSelector(selector: string): FunctionSelecto
  * @returns The parsed integer, or undefined if the input string is falsy.
  * @throws If the input is not a valid integer.
  */
-export declare function parseOptionalInteger(value: string): number | undefined;
+export declare function parseOptionalInteger(value: string, min?: number, max?: number): number | undefined;
 /**
  * Parses a TxHash from a string.
  * @param txHash - A transaction hash

package/dest/utils/commands.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"commands.d.ts","sourceRoot":"","sources":["../../src/utils/commands.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AACzD,OAAO,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AACzD,OAAO,EAAE,EAAE,EAAE,MAAM,wBAAwB,CAAC;AAC5C,OAAO,EAAE,KAAK,EAAE,MAAM,wBAAwB,CAAC;AAC/C,OAAO,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AACjD,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AACnD,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,iCAAiC,CAAC;AAC3D,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAEhD,OAAO,EAAE,KAAK,OAAO,EAAwC,MAAM,EAAE,MAAM,WAAW,CAAC;AAIvF;;;GAGG;AACH,eAAO,MAAM,YAAY,uBAGI,CAAC;AAE9B,eAAO,MAAM,SAAS,QAAuB,CAAC;AAC9C,eAAO,MAAQ,cAAc,UAA+B,WAAW,sBAAE,QAAQ,sBAAE,OAAO,sBAAE,WAAW,oBAAgB,CAAC;AAExH,wBAAgB,UAAU,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,WAG7D;AAED,eAAO,MAAM,aAAa,GAAI,WAAW,OAAO,WAKb,CAAC;AAEpC,eAAO,MAAM,SAAS,QAAsB,CAAC;AAE7C,eAAO,MAAM,eAAe,QASxB,CAAC;AAEL,eAAO,MAAM,qBAAqB,GAChC,aAAa,MAAM,EACnB,WAAW,OAAO,EAClB,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,KAAK,EAAE,WAKf,CAAC;AAEpC,eAAO,MAAM,OAAO,GAAI,KAAK,KAAK,MAAM,KAAK,MAAM,SAAsC,CAAC;AAE1F;;;;GAIG;AACH,wBAAsB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,iBAqBxE;AAED;;;;;;GAMG;AACH,wBAAsB,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,EAAE,MAAM,yBAgBzD;AAcD,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAE9D;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,MAAM,GAAG,EAAE,CAqBvD;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,YAAY,CAM/D;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,UAAU,CAMhE;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,MAAM,GAAG,YAAY,GAAG,SAAS,CAKnF;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,KAAK,GAAG,SAAS,CAKnE;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,gBAAgB,GAAG,SAAS,CASpF;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAStE;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAMlD;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAKtE;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CASxE;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,EAAE,CAMvD;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,EAAE,CAMpD;AAED;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,EAAE,CAyB5C;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,CAElD;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,MAAM,CAcjE"}
+{"version":3,"file":"commands.d.ts","sourceRoot":"","sources":["../../src/utils/commands.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AACzD,OAAO,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AACzD,OAAO,EAAE,EAAE,EAAE,MAAM,wBAAwB,CAAC;AAC5C,OAAO,EAAE,KAAK,EAAE,MAAM,wBAAwB,CAAC;AAC/C,OAAO,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AACjD,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AACnD,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,iCAAiC,CAAC;AAC3D,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAEhD,OAAO,EAAE,KAAK,OAAO,EAAwC,MAAM,EAAE,MAAM,WAAW,CAAC;AAIvF;;;GAGG;AACH,eAAO,MAAM,YAAY,uBAGI,CAAC;AAE9B,eAAO,MAAM,SAAS,QAAuB,CAAC;AAC9C,eAAO,MAAQ,cAAc,UAA+B,WAAW,sBAAE,QAAQ,sBAAE,OAAO,sBAAE,WAAW,oBAAgB,CAAC;AAExH,wBAAgB,UAAU,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,WAG7D;AAED,eAAO,MAAM,aAAa,GAAI,WAAW,OAAO,WAKb,CAAC;AAEpC,eAAO,MAAM,SAAS,QAAsB,CAAC;AAE7C,eAAO,MAAM,eAAe,QASxB,CAAC;AAEL,eAAO,MAAM,qBAAqB,GAChC,aAAa,MAAM,EACnB,WAAW,OAAO,EAClB,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,KAAK,EAAE,WAKf,CAAC;AAEpC,eAAO,MAAM,OAAO,GAAI,KAAK,KAAK,MAAM,KAAK,MAAM,SAAsC,CAAC;AAE1F;;;;GAIG;AACH,wBAAsB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,iBAqBxE;AAED;;;;;;GAMG;AACH,wBAAsB,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,EAAE,MAAM,yBAgBzD;AAED;;;;;;;GAOG;AAEH,wBAAgB,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,KAAK,MAAM,EAAE,CAiBpE;AAcD,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAE9D;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,MAAM,GAAG,EAAE,CAqBvD;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,YAAY,CAM/D;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,UAAU,CAMhE;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,MAAM,GAAG,YAAY,GAAG,SAAS,CAKnF;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,KAAK,GAAG,SAAS,CAKnE;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,gBAAgB,GAAG,SAAS,CASpF;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,MAAM,EACb,GAAG,GAAE,MAAgC,EACrC,GAAG,GAAE,MAAgC,GACpC,MAAM,GAAG,SAAS,CAepB;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAMlD;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAKtE;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CASxE;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,EAAE,CAMvD;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,EAAE,CAMpD;AAED;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,EAAE,CAyB5C;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,CAElD;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,MAAM,CAcjE"}

package/dest/utils/commands.js

@@ -74,6 +74,27 @@ export const logJson = (log)=>(obj)=>log(JSON.stringify(obj, null, 2));
     }
     return from;
 }
+/**
+ * Parses and validates a hex string. Removes leading 0x if present, checks for hex validity,
+ * and enforces an optional minimum length.
+ * @param hex - The hex string to validate.
+ * @param minLen - Optional minimum length (in hex characters, after stripping '0x').
+ * @returns The normalized hex string (without leading 0x).
+ * @throws InvalidArgumentError if the string is not valid hex or does not meet the minimum length.
+ */ // minLen is now interpreted as the minimum number of bytes (2 hex characters per byte)
+export function parseHex(hex, minLen) {
+    const normalized = hex.startsWith('0x') ? hex.slice(2) : hex;
+    if (!/^[0-9a-fA-F]*$/.test(normalized)) {
+        throw new InvalidArgumentError('Invalid hex string');
+    }
+    if (minLen !== undefined) {
+        const minHexLen = minLen * 2;
+        if (normalized.length < minHexLen) {
+            throw new InvalidArgumentError(`Hex string is too short (length ${normalized.length}), minimum byte length is ${minLen} (hex chars: ${minHexLen})`);
+        }
+    }
+    return `0x${normalized}`;
+}
 /**
  * Removes the leading 0x from a hex string. If no leading 0x is found the string is returned unchanged.
  * @param hex - A hex string
@@ -118,7 +139,7 @@ export function parseBigint(bigint) {
     try {
         return AztecAddress.fromString(address);
     } catch  {
-        throw new InvalidArgumentError(`Invalid address: ${address}`);
+        throw new InvalidArgumentError(`Invalid Aztec address: ${address}`);
     }
 }
 /**
@@ -130,7 +151,7 @@ export function parseBigint(bigint) {
     try {
         return EthAddress.fromString(address);
     } catch  {
-        throw new InvalidArgumentError(`Invalid address: ${address}`);
+        throw new InvalidArgumentError(`Invalid Ethereumaddress: ${address}`);
     }
 }
 /**
@@ -176,7 +197,7 @@ export function parseBigint(bigint) {
  * @param value - The string to parse into an integer.
  * @returns The parsed integer, or undefined if the input string is falsy.
  * @throws If the input is not a valid integer.
- */ export function parseOptionalInteger(value) {
+ */ export function parseOptionalInteger(value, min = Number.MIN_SAFE_INTEGER, max = Number.MAX_SAFE_INTEGER) {
     if (!value) {
         return undefined;
     }
@@ -184,6 +205,12 @@ export function parseBigint(bigint) {
     if (!Number.isInteger(parsed)) {
         throw new InvalidArgumentError('Invalid integer.');
     }
+    if (parsed < min) {
+        throw new InvalidArgumentError(`Value must be greater than ${min}.`);
+    }
+    if (parsed > max) {
+        throw new InvalidArgumentError(`Value must be less than ${max}.`);
+    }
     return parsed;
 }
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aztec/cli",
-  "version": "2.1.0-rc.24",
+  "version": "2.1.0-rc.28",
   "type": "module",
   "exports": {
     "./contracts": "./dest/cmds/contracts/index.js",
@@ -10,6 +10,7 @@
     "./pxe": "./dest/cmds/pxe/index.js",
     "./cli-utils": "./dest/utils/index.js",
     "./misc": "./dest/cmds/misc/index.js",
+    "./validator_keys": "./dest/cmds/validator_keys/index.js",
     "./setup-contracts": "./dest/cmds/misc/setup_contracts.js",
     "./utils": "./dest/utils/index.js",
     "./inspect": "./dest/utils/inspect.js",
@@ -70,19 +71,22 @@
     ]
   },
   "dependencies": {
-    "@aztec/archiver": "2.1.0-rc.24",
-    "@aztec/aztec.js": "2.1.0-rc.24",
-    "@aztec/constants": "2.1.0-rc.24",
-    "@aztec/entrypoints": "2.1.0-rc.24",
-    "@aztec/ethereum": "2.1.0-rc.24",
-    "@aztec/foundation": "2.1.0-rc.24",
-    "@aztec/l1-artifacts": "2.1.0-rc.24",
-    "@aztec/node-lib": "2.1.0-rc.24",
-    "@aztec/p2p": "2.1.0-rc.24",
-    "@aztec/stdlib": "2.1.0-rc.24",
-    "@aztec/world-state": "2.1.0-rc.24",
+    "@aztec/archiver": "2.1.0-rc.28",
+    "@aztec/aztec.js": "2.1.0-rc.28",
+    "@aztec/constants": "2.1.0-rc.28",
+    "@aztec/entrypoints": "2.1.0-rc.28",
+    "@aztec/ethereum": "2.1.0-rc.28",
+    "@aztec/foundation": "2.1.0-rc.28",
+    "@aztec/l1-artifacts": "2.1.0-rc.28",
+    "@aztec/node-keystore": "2.1.0-rc.28",
+    "@aztec/node-lib": "2.1.0-rc.28",
+    "@aztec/p2p": "2.1.0-rc.28",
+    "@aztec/stdlib": "2.1.0-rc.28",
+    "@aztec/world-state": "2.1.0-rc.28",
+    "@ethersproject/wallet": "^5.8.0",
     "@iarna/toml": "^2.2.5",
     "@libp2p/peer-id-factory": "^3.0.4",
+    "@scure/bip39": "^2.0.1",
     "commander": "^12.1.0",
     "lodash.chunk": "^4.2.0",
     "lodash.groupby": "^4.6.0",
@@ -92,8 +96,8 @@
     "viem": "npm:@spalladino/viem@2.38.2-eip7594.0"
   },
   "devDependencies": {
-    "@aztec/accounts": "2.1.0-rc.24",
-    "@aztec/protocol-contracts": "2.1.0-rc.24",
+    "@aztec/accounts": "2.1.0-rc.28",
+    "@aztec/protocol-contracts": "2.1.0-rc.28",
     "@jest/globals": "^30.0.0",
     "@types/jest": "^30.0.0",
     "@types/lodash.chunk": "^4.2.9",
@@ -109,15 +113,15 @@
     "typescript": "^5.3.3"
   },
   "peerDependencies": {
-    "@aztec/accounts": "2.1.0-rc.24",
-    "@aztec/bb-prover": "2.1.0-rc.24",
-    "@aztec/ethereum": "2.1.0-rc.24",
-    "@aztec/l1-artifacts": "2.1.0-rc.24",
-    "@aztec/noir-contracts.js": "2.1.0-rc.24",
-    "@aztec/noir-protocol-circuits-types": "2.1.0-rc.24",
-    "@aztec/noir-test-contracts.js": "2.1.0-rc.24",
-    "@aztec/protocol-contracts": "2.1.0-rc.24",
-    "@aztec/stdlib": "2.1.0-rc.24"
+    "@aztec/accounts": "2.1.0-rc.28",
+    "@aztec/bb-prover": "2.1.0-rc.28",
+    "@aztec/ethereum": "2.1.0-rc.28",
+    "@aztec/l1-artifacts": "2.1.0-rc.28",
+    "@aztec/noir-contracts.js": "2.1.0-rc.28",
+    "@aztec/noir-protocol-circuits-types": "2.1.0-rc.28",
+    "@aztec/noir-test-contracts.js": "2.1.0-rc.28",
+    "@aztec/protocol-contracts": "2.1.0-rc.28",
+    "@aztec/stdlib": "2.1.0-rc.28"
   },
   "files": [
     "dest",

package/src/cmds/validator_keys/add.ts

@@ -0,0 +1,113 @@
+import type { EthAddress } from '@aztec/foundation/eth-address';
+import type { LogFn } from '@aztec/foundation/log';
+import { loadKeystoreFile } from '@aztec/node-keystore/loader';
+import type { KeyStore } from '@aztec/node-keystore/types';
+
+import { wordlist } from '@scure/bip39/wordlists/english.js';
+import { dirname, isAbsolute, join } from 'path';
+import { generateMnemonic } from 'viem/accounts';
+
+import type { NewValidatorKeystoreOptions } from './new.js';
+import {
+  buildValidatorEntries,
+  logValidatorSummaries,
+  maybePrintJson,
+  writeBlsBn254ToFile,
+  writeEthJsonV3ToFile,
+  writeKeystoreFile,
+} from './shared.js';
+
+export type AddValidatorKeysOptions = NewValidatorKeystoreOptions;
+
+export async function addValidatorKeys(existing: string, options: AddValidatorKeysOptions, log: LogFn) {
+  const {
+    dataDir,
+    file,
+    count,
+    publisherCount = 0,
+    mnemonic,
+    accountIndex = 0,
+    addressIndex,
+    ikm,
+    blsPath,
+    blsOnly,
+    json,
+    feeRecipient: feeRecipientOpt,
+    coinbase: coinbaseOpt,
+    fundingAccount: fundingAccountOpt,
+    remoteSigner: remoteSignerOpt,
+    password,
+    outDir,
+  } = options;
+
+  const validatorCount = typeof count === 'number' && Number.isFinite(count) && count > 0 ? Math.floor(count) : 1;
+  const baseAddressIndex = addressIndex ?? 0;
+
+  const keystore: KeyStore = loadKeystoreFile(existing);
+
+  if (!keystore.validators || !Array.isArray(keystore.validators)) {
+    throw new Error('Invalid keystore: missing validators array');
+  }
+
+  const first = keystore.validators[0] ?? {};
+  const feeRecipient = feeRecipientOpt ?? first.feeRecipient;
+  if (!feeRecipient) {
+    throw new Error('feeRecipient is required (either present in existing file or via --fee-recipient)');
+  }
+  const coinbase = (coinbaseOpt as EthAddress | undefined) ?? (first.coinbase as EthAddress | undefined);
+  const fundingAccount =
+    (fundingAccountOpt as EthAddress | undefined) ?? (first.fundingAccount as EthAddress | undefined);
+  const derivedRemoteSigner = (first.attester as any)?.remoteSignerUrl || (first.attester as any)?.eth?.remoteSignerUrl;
+  const remoteSigner = remoteSignerOpt ?? derivedRemoteSigner;
+
+  // Ensure we always have a mnemonic for key derivation if none was provided
+  const mnemonicToUse = mnemonic ?? generateMnemonic(wordlist);
+
+  // If user explicitly provided --address-index, use it as-is. Otherwise, append after existing validators.
+  const effectiveBaseAddressIndex =
+    addressIndex === undefined ? baseAddressIndex + keystore.validators.length : baseAddressIndex;
+
+  const { validators, summaries } = await buildValidatorEntries({
+    validatorCount,
+    publisherCount,
+    accountIndex,
+    baseAddressIndex: effectiveBaseAddressIndex,
+    mnemonic: mnemonicToUse,
+    ikm,
+    blsPath,
+    blsOnly,
+    feeRecipient,
+    coinbase,
+    remoteSigner,
+    fundingAccount,
+  });
+
+  keystore.validators.push(...validators);
+
+  // If password provided, write ETH JSON V3 and BLS BN254 keystores and replace plaintext
+  if (password !== undefined) {
+    const targetDir =
+      outDir && outDir.length > 0 ? outDir : dataDir && dataDir.length > 0 ? dataDir : dirname(existing);
+    await writeEthJsonV3ToFile(keystore.validators, { outDir: targetDir, password });
+    await writeBlsBn254ToFile(keystore.validators, { outDir: targetDir, password });
+  }
+
+  let outputPath = existing;
+  if (file && file.length > 0) {
+    if (isAbsolute(file)) {
+      outputPath = file;
+    } else if (dataDir && dataDir.length > 0) {
+      outputPath = join(dataDir, file);
+    } else {
+      outputPath = join(dirname(existing), file);
+    }
+  }
+
+  await writeKeystoreFile(outputPath, keystore);
+
+  if (!json) {
+    log(`Updated keystore ${outputPath} with ${validators.length} new validator(s)`);
+    logValidatorSummaries(log, summaries);
+  }
+  maybePrintJson(log, !!json, keystore as unknown as Record<string, any>);
+}

package/src/cmds/validator_keys/generate_bls_keypair.ts

@@ -0,0 +1,33 @@
+import { deriveBlsPrivateKey } from '@aztec/foundation/crypto';
+import type { LogFn } from '@aztec/foundation/log';
+
+import { writeFile } from 'fs/promises';
+
+import { computeBlsPublicKeyCompressed, withValidatorIndex } from './shared.js';
+
+export type GenerateBlsKeypairOptions = {
+  mnemonic?: string;
+  ikm?: string;
+  blsPath?: string;
+  g2?: boolean;
+  compressed?: boolean;
+  json?: boolean;
+  out?: string;
+};
+
+export async function generateBlsKeypair(options: GenerateBlsKeypairOptions, log: LogFn) {
+  const { mnemonic, ikm, blsPath, compressed = true, json, out } = options;
+  const path = withValidatorIndex(blsPath ?? 'm/12381/3600/0/0/0', 0);
+  const priv = deriveBlsPrivateKey(mnemonic, ikm, path);
+  const pub = await computeBlsPublicKeyCompressed(priv);
+  const result = { path, privateKey: priv, publicKey: pub, format: compressed ? 'compressed' : 'uncompressed' };
+  if (out) {
+    await writeFile(out, JSON.stringify(result, null, 2), { encoding: 'utf-8' });
+    if (!json) {
+      log(`Wrote BLS keypair to ${out}`);
+    }
+  }
+  if (json || !out) {
+    log(JSON.stringify(result, null, 2));
+  }
+}

package/src/cmds/validator_keys/index.ts

@@ -0,0 +1,96 @@
+import type { LogFn } from '@aztec/foundation/log';
+
+import { Command } from 'commander';
+
+import { parseAztecAddress, parseEthereumAddress, parseHex, parseOptionalInteger } from '../../utils/commands.js';
+
+export function injectCommands(program: Command, log: LogFn) {
+  const group = program
+    .command('validator-keys')
+    .aliases(['valKeys'])
+    .description('Manage validator keystores for node operators');
+
+  group
+    .command('new')
+    .summary('Generate a new validator keystore JSON')
+    .description('Generates a new validator keystore with ETH secp256k1 accounts and optional BLS accounts')
+    .option('--data-dir <path>', 'Directory to store keystore(s). Defaults to ~/.aztec/keystore')
+    .option('--file <name>', 'Keystore file name. Defaults to key1.json (or keyN.json if key1.json exists)')
+    .option('--count <N>', 'Number of validators to generate', parseOptionalInteger)
+    .option('--publisher-count <N>', 'Number of publisher accounts per validator (default 1)', value =>
+      parseOptionalInteger(value, 0),
+    )
+    .option('--mnemonic <mnemonic>', 'Mnemonic for ETH/BLS derivation')
+    .option('--passphrase <str>', 'Optional passphrase for mnemonic')
+    .option('--account-index <N>', 'Base account index for ETH derivation', parseOptionalInteger)
+    .option('--address-index <N>', 'Base address index for ETH derivation', parseOptionalInteger)
+    .option('--coinbase <address>', 'Coinbase ETH address to use when proposing', parseEthereumAddress)
+    .option('--funding-account <address>', 'ETH account to fund publishers', parseEthereumAddress)
+    .option('--remote-signer <url>', 'Default remote signer URL for accounts in this file')
+    .option('--ikm <hex>', 'Initial keying material for BLS (alternative to mnemonic)', value => parseHex(value, 32))
+    .option('--bls-path <path>', 'EIP-2334 path (default m/12381/3600/0/0/0)')
+    .option('--bls-only', 'Generate only BLS keys')
+    .option(
+      '--password <str>',
+      'Password for writing keystore files (ETH JSON V3 and BLS EIP-2335). Empty string allowed',
+    )
+    .option('--out-dir <dir>', 'Output directory for generated keystore file(s)')
+    .option('--json', 'Echo resulting JSON to stdout')
+    .requiredOption('--fee-recipient <address>', 'Aztec address that will receive fees', parseAztecAddress)
+    .action(async options => {
+      const { newValidatorKeystore } = await import('./new.js');
+      await newValidatorKeystore(options, log);
+    });
+
+  group
+    .command('add')
+    .summary('Augment an existing validator keystore JSON')
+    .description('Adds attester/publisher/BLS entries to an existing keystore using the same flags as new')
+    .argument('<existing>', 'Path to existing keystore JSON')
+    .option('--data-dir <path>', 'Directory where keystore(s) live')
+    .option('--file <name>', 'Override output file name')
+    .option('--count <N>', 'Number of validators to add', parseOptionalInteger)
+    .option('--publisher-count <N>', 'Number of publisher accounts per validator (default 1)', value =>
+      parseOptionalInteger(value, 0),
+    )
+    .option('--mnemonic <mnemonic>', 'Mnemonic for ETH/BLS derivation')
+    .option('--passphrase <str>', 'Optional passphrase for mnemonic')
+    .option('--account-index <N>', 'Base account index for ETH derivation', parseOptionalInteger)
+    .option('--address-index <N>', 'Base address index for ETH derivation', parseOptionalInteger)
+    .option('--coinbase <address>', 'Coinbase ETH address to use when proposing', parseEthereumAddress)
+    .option('--funding-account <address>', 'ETH account to fund publishers', parseEthereumAddress)
+    .option('--remote-signer <url>', 'Default remote signer URL for accounts in this file')
+    .option('--ikm <hex>', 'Initial keying material for BLS (alternative to mnemonic)', value => parseHex(value, 32))
+    .option('--bls-path <path>', 'EIP-2334 path (default m/12381/3600/0/0/0)')
+    .option('--bls-only', 'Generate only BLS keys')
+    .option('--empty', 'Generate an empty skeleton without keys')
+    .option(
+      '--password <str>',
+      'Password for writing keystore files (ETH JSON V3 and BLS EIP-2335). Empty string allowed',
+    )
+    .option('--out-dir <dir>', 'Output directory for generated keystore file(s)')
+    .option('--json', 'Echo resulting JSON to stdout')
+    .requiredOption('--fee-recipient <address>', 'Aztec address that will receive fees', parseAztecAddress)
+    .action(async (existing: string, options) => {
+      const { addValidatorKeys } = await import('./add.js');
+      await addValidatorKeys(existing, options, log);
+    });
+
+  // top-level convenience: aztec generate-bls-keypair
+  program
+    .command('generate-bls-keypair')
+    .description('Generate a BLS keypair with convenience flags')
+    .option('--mnemonic <mnemonic>', 'Mnemonic for BLS derivation')
+    .option('--ikm <hex>', 'Initial keying material for BLS (alternative to mnemonic)', value => parseHex(value, 32))
+    .option('--bls-path <path>', 'EIP-2334 path (default m/12381/3600/0/0/0)')
+    .option('--g2', 'Derive on G2 subgroup')
+    .option('--compressed', 'Output compressed public key')
+    .option('--json', 'Print JSON output to stdout')
+    .option('--out <file>', 'Write output to file')
+    .action(async options => {
+      const { generateBlsKeypair } = await import('./generate_bls_keypair.js');
+      await generateBlsKeypair(options, log);
+    });
+
+  return program;
+}