@aztec/cli 3.0.0-nightly.20251030-2 → 3.0.0-nightly.20251101

package/dest/cmds/validator_keys/add.d.ts

@@ -0,0 +1,5 @@
+import type { LogFn } from '@aztec/foundation/log';
+import type { NewValidatorKeystoreOptions } from './new.js';
+export type AddValidatorKeysOptions = NewValidatorKeystoreOptions;
+export declare function addValidatorKeys(existing: string, options: AddValidatorKeysOptions, log: LogFn): Promise<void>;
+//# sourceMappingURL=add.d.ts.map

package/dest/cmds/validator_keys/add.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"add.d.ts","sourceRoot":"","sources":["../../../src/cmds/validator_keys/add.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAQnD,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,UAAU,CAAC;AAU5D,MAAM,MAAM,uBAAuB,GAAG,2BAA2B,CAAC;AAElE,wBAAsB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,uBAAuB,EAAE,GAAG,EAAE,KAAK,iBA2FpG"}

package/dest/cmds/validator_keys/add.js

@@ -0,0 +1,70 @@
+import { loadKeystoreFile } from '@aztec/node-keystore/loader';
+import { wordlist } from '@scure/bip39/wordlists/english.js';
+import { dirname, isAbsolute, join } from 'path';
+import { generateMnemonic } from 'viem/accounts';
+import { buildValidatorEntries, logValidatorSummaries, maybePrintJson, writeBlsBn254ToFile, writeEthJsonV3ToFile, writeKeystoreFile } from './shared.js';
+export async function addValidatorKeys(existing, options, log) {
+    const { dataDir, file, count, publisherCount = 0, mnemonic, accountIndex = 0, addressIndex, ikm, blsPath, blsOnly, json, feeRecipient: feeRecipientOpt, coinbase: coinbaseOpt, fundingAccount: fundingAccountOpt, remoteSigner: remoteSignerOpt, password, outDir } = options;
+    const validatorCount = typeof count === 'number' && Number.isFinite(count) && count > 0 ? Math.floor(count) : 1;
+    const baseAddressIndex = addressIndex ?? 0;
+    const keystore = loadKeystoreFile(existing);
+    if (!keystore.validators || !Array.isArray(keystore.validators)) {
+        throw new Error('Invalid keystore: missing validators array');
+    }
+    const first = keystore.validators[0] ?? {};
+    const feeRecipient = feeRecipientOpt ?? first.feeRecipient;
+    if (!feeRecipient) {
+        throw new Error('feeRecipient is required (either present in existing file or via --fee-recipient)');
+    }
+    const coinbase = coinbaseOpt ?? first.coinbase;
+    const fundingAccount = fundingAccountOpt ?? first.fundingAccount;
+    const derivedRemoteSigner = first.attester?.remoteSignerUrl || first.attester?.eth?.remoteSignerUrl;
+    const remoteSigner = remoteSignerOpt ?? derivedRemoteSigner;
+    // Ensure we always have a mnemonic for key derivation if none was provided
+    const mnemonicToUse = mnemonic ?? generateMnemonic(wordlist);
+    // If user explicitly provided --address-index, use it as-is. Otherwise, append after existing validators.
+    const effectiveBaseAddressIndex = addressIndex === undefined ? baseAddressIndex + keystore.validators.length : baseAddressIndex;
+    const { validators, summaries } = await buildValidatorEntries({
+        validatorCount,
+        publisherCount,
+        accountIndex,
+        baseAddressIndex: effectiveBaseAddressIndex,
+        mnemonic: mnemonicToUse,
+        ikm,
+        blsPath,
+        blsOnly,
+        feeRecipient,
+        coinbase,
+        remoteSigner,
+        fundingAccount
+    });
+    keystore.validators.push(...validators);
+    // If password provided, write ETH JSON V3 and BLS BN254 keystores and replace plaintext
+    if (password !== undefined) {
+        const targetDir = outDir && outDir.length > 0 ? outDir : dataDir && dataDir.length > 0 ? dataDir : dirname(existing);
+        await writeEthJsonV3ToFile(keystore.validators, {
+            outDir: targetDir,
+            password
+        });
+        await writeBlsBn254ToFile(keystore.validators, {
+            outDir: targetDir,
+            password
+        });
+    }
+    let outputPath = existing;
+    if (file && file.length > 0) {
+        if (isAbsolute(file)) {
+            outputPath = file;
+        } else if (dataDir && dataDir.length > 0) {
+            outputPath = join(dataDir, file);
+        } else {
+            outputPath = join(dirname(existing), file);
+        }
+    }
+    await writeKeystoreFile(outputPath, keystore);
+    if (!json) {
+        log(`Updated keystore ${outputPath} with ${validators.length} new validator(s)`);
+        logValidatorSummaries(log, summaries);
+    }
+    maybePrintJson(log, !!json, keystore);
+}

package/dest/cmds/validator_keys/generate_bls_keypair.d.ts

@@ -0,0 +1,12 @@
+import type { LogFn } from '@aztec/foundation/log';
+export type GenerateBlsKeypairOptions = {
+    mnemonic?: string;
+    ikm?: string;
+    blsPath?: string;
+    g2?: boolean;
+    compressed?: boolean;
+    json?: boolean;
+    out?: string;
+};
+export declare function generateBlsKeypair(options: GenerateBlsKeypairOptions, log: LogFn): Promise<void>;
+//# sourceMappingURL=generate_bls_keypair.d.ts.map

package/dest/cmds/validator_keys/generate_bls_keypair.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"generate_bls_keypair.d.ts","sourceRoot":"","sources":["../../../src/cmds/validator_keys/generate_bls_keypair.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAMnD,MAAM,MAAM,yBAAyB,GAAG;IACtC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,EAAE,CAAC,EAAE,OAAO,CAAC;IACb,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,wBAAsB,kBAAkB,CAAC,OAAO,EAAE,yBAAyB,EAAE,GAAG,EAAE,KAAK,iBAetF"}

package/dest/cmds/validator_keys/generate_bls_keypair.js

@@ -0,0 +1,26 @@
+import { deriveBlsPrivateKey } from '@aztec/foundation/crypto';
+import { writeFile } from 'fs/promises';
+import { computeBlsPublicKeyCompressed, withValidatorIndex } from './shared.js';
+export async function generateBlsKeypair(options, log) {
+    const { mnemonic, ikm, blsPath, compressed = true, json, out } = options;
+    const path = withValidatorIndex(blsPath ?? 'm/12381/3600/0/0/0', 0);
+    const priv = deriveBlsPrivateKey(mnemonic, ikm, path);
+    const pub = await computeBlsPublicKeyCompressed(priv);
+    const result = {
+        path,
+        privateKey: priv,
+        publicKey: pub,
+        format: compressed ? 'compressed' : 'uncompressed'
+    };
+    if (out) {
+        await writeFile(out, JSON.stringify(result, null, 2), {
+            encoding: 'utf-8'
+        });
+        if (!json) {
+            log(`Wrote BLS keypair to ${out}`);
+        }
+    }
+    if (json || !out) {
+        log(JSON.stringify(result, null, 2));
+    }
+}

package/dest/cmds/validator_keys/index.d.ts

@@ -0,0 +1,4 @@
+import type { LogFn } from '@aztec/foundation/log';
+import { Command } from 'commander';
+export declare function injectCommands(program: Command, log: LogFn): Command;
+//# sourceMappingURL=index.d.ts.map

package/dest/cmds/validator_keys/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/cmds/validator_keys/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAEnD,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAIpC,wBAAgB,cAAc,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,WAyF1D"}

package/dest/cmds/validator_keys/index.js

@@ -0,0 +1,20 @@
+import { parseAztecAddress, parseEthereumAddress, parseHex, parseOptionalInteger } from '../../utils/commands.js';
+export function injectCommands(program, log) {
+    const group = program.command('validator-keys').aliases([
+        'valKeys'
+    ]).description('Manage validator keystores for node operators');
+    group.command('new').summary('Generate a new validator keystore JSON').description('Generates a new validator keystore with ETH secp256k1 accounts and optional BLS accounts').option('--data-dir <path>', 'Directory to store keystore(s). Defaults to ~/.aztec/keystore').option('--file <name>', 'Keystore file name. Defaults to key1.json (or keyN.json if key1.json exists)').option('--count <N>', 'Number of validators to generate', parseOptionalInteger).option('--publisher-count <N>', 'Number of publisher accounts per validator (default 1)', (value)=>parseOptionalInteger(value, 0)).option('--mnemonic <mnemonic>', 'Mnemonic for ETH/BLS derivation').option('--passphrase <str>', 'Optional passphrase for mnemonic').option('--account-index <N>', 'Base account index for ETH derivation', parseOptionalInteger).option('--address-index <N>', 'Base address index for ETH derivation', parseOptionalInteger).option('--coinbase <address>', 'Coinbase ETH address to use when proposing', parseEthereumAddress).option('--funding-account <address>', 'ETH account to fund publishers', parseEthereumAddress).option('--remote-signer <url>', 'Default remote signer URL for accounts in this file').option('--ikm <hex>', 'Initial keying material for BLS (alternative to mnemonic)', (value)=>parseHex(value, 32)).option('--bls-path <path>', 'EIP-2334 path (default m/12381/3600/0/0/0)').option('--bls-only', 'Generate only BLS keys').option('--password <str>', 'Password for writing keystore files (ETH JSON V3 and BLS EIP-2335). Empty string allowed').option('--out-dir <dir>', 'Output directory for generated keystore file(s)').option('--json', 'Echo resulting JSON to stdout').requiredOption('--fee-recipient <address>', 'Aztec address that will receive fees', parseAztecAddress).action(async (options)=>{
+        const { newValidatorKeystore } = await import('./new.js');
+        await newValidatorKeystore(options, log);
+    });
+    group.command('add').summary('Augment an existing validator keystore JSON').description('Adds attester/publisher/BLS entries to an existing keystore using the same flags as new').argument('<existing>', 'Path to existing keystore JSON').option('--data-dir <path>', 'Directory where keystore(s) live').option('--file <name>', 'Override output file name').option('--count <N>', 'Number of validators to add', parseOptionalInteger).option('--publisher-count <N>', 'Number of publisher accounts per validator (default 1)', (value)=>parseOptionalInteger(value, 0)).option('--mnemonic <mnemonic>', 'Mnemonic for ETH/BLS derivation').option('--passphrase <str>', 'Optional passphrase for mnemonic').option('--account-index <N>', 'Base account index for ETH derivation', parseOptionalInteger).option('--address-index <N>', 'Base address index for ETH derivation', parseOptionalInteger).option('--coinbase <address>', 'Coinbase ETH address to use when proposing', parseEthereumAddress).option('--funding-account <address>', 'ETH account to fund publishers', parseEthereumAddress).option('--remote-signer <url>', 'Default remote signer URL for accounts in this file').option('--ikm <hex>', 'Initial keying material for BLS (alternative to mnemonic)', (value)=>parseHex(value, 32)).option('--bls-path <path>', 'EIP-2334 path (default m/12381/3600/0/0/0)').option('--bls-only', 'Generate only BLS keys').option('--empty', 'Generate an empty skeleton without keys').option('--password <str>', 'Password for writing keystore files (ETH JSON V3 and BLS EIP-2335). Empty string allowed').option('--out-dir <dir>', 'Output directory for generated keystore file(s)').option('--json', 'Echo resulting JSON to stdout').requiredOption('--fee-recipient <address>', 'Aztec address that will receive fees', parseAztecAddress).action(async (existing, options)=>{
+        const { addValidatorKeys } = await import('./add.js');
+        await addValidatorKeys(existing, options, log);
+    });
+    // top-level convenience: aztec generate-bls-keypair
+    program.command('generate-bls-keypair').description('Generate a BLS keypair with convenience flags').option('--mnemonic <mnemonic>', 'Mnemonic for BLS derivation').option('--ikm <hex>', 'Initial keying material for BLS (alternative to mnemonic)', (value)=>parseHex(value, 32)).option('--bls-path <path>', 'EIP-2334 path (default m/12381/3600/0/0/0)').option('--g2', 'Derive on G2 subgroup').option('--compressed', 'Output compressed public key').option('--json', 'Print JSON output to stdout').option('--out <file>', 'Write output to file').action(async (options)=>{
+        const { generateBlsKeypair } = await import('./generate_bls_keypair.js');
+        await generateBlsKeypair(options, log);
+    });
+    return program;
+}

package/dest/cmds/validator_keys/new.d.ts

@@ -0,0 +1,26 @@
+import type { EthAddress } from '@aztec/foundation/eth-address';
+import type { LogFn } from '@aztec/foundation/log';
+import type { AztecAddress } from '@aztec/stdlib/aztec-address';
+export type NewValidatorKeystoreOptions = {
+    dataDir?: string;
+    file?: string;
+    count?: number;
+    publisherCount?: number;
+    mnemonic?: string;
+    passphrase?: string;
+    accountIndex?: number;
+    addressIndex?: number;
+    separatePublisher?: boolean;
+    ikm?: string;
+    blsPath?: string;
+    blsOnly?: boolean;
+    password?: string;
+    outDir?: string;
+    json?: boolean;
+    feeRecipient: AztecAddress;
+    coinbase?: EthAddress;
+    remoteSigner?: string;
+    fundingAccount?: EthAddress;
+};
+export declare function newValidatorKeystore(options: NewValidatorKeystoreOptions, log: LogFn): Promise<void>;
+//# sourceMappingURL=new.d.ts.map

package/dest/cmds/validator_keys/new.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"new.d.ts","sourceRoot":"","sources":["../../../src/cmds/validator_keys/new.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,+BAA+B,CAAC;AAChE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AACnD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAgBhE,MAAM,MAAM,2BAA2B,GAAG;IACxC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,YAAY,EAAE,YAAY,CAAC;IAC3B,QAAQ,CAAC,EAAE,UAAU,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,cAAc,CAAC,EAAE,UAAU,CAAC;CAC7B,CAAC;AAEF,wBAAsB,oBAAoB,CAAC,OAAO,EAAE,2BAA2B,EAAE,GAAG,EAAE,KAAK,iBA+E1F"}

package/dest/cmds/validator_keys/new.js

@@ -0,0 +1,60 @@
+import { wordlist } from '@scure/bip39/wordlists/english.js';
+import { dirname } from 'path';
+import { generateMnemonic, mnemonicToAccount } from 'viem/accounts';
+import { buildValidatorEntries, logValidatorSummaries, maybePrintJson, resolveKeystoreOutputPath, writeBlsBn254ToFile, writeEthJsonV3ToFile, writeKeystoreFile } from './shared.js';
+export async function newValidatorKeystore(options, log) {
+    const { dataDir, file, count, publisherCount = 0, json, coinbase, accountIndex = 0, addressIndex = 0, feeRecipient, remoteSigner, fundingAccount, blsOnly, blsPath, ikm, mnemonic: _mnemonic, password, outDir } = options;
+    if (remoteSigner && !_mnemonic) {
+        throw new Error('Using --remote-signer requires a deterministic key source. Provide --mnemonic to derive keys, or omit --remote-signer to write new private keys to keystore.');
+    }
+    const mnemonic = _mnemonic ?? generateMnemonic(wordlist);
+    const validatorCount = typeof count === 'number' && Number.isFinite(count) && count > 0 ? Math.floor(count) : 1;
+    const { outputPath } = await resolveKeystoreOutputPath(dataDir, file);
+    const { validators, summaries } = await buildValidatorEntries({
+        validatorCount,
+        publisherCount,
+        accountIndex,
+        baseAddressIndex: addressIndex,
+        mnemonic,
+        ikm,
+        blsPath,
+        blsOnly,
+        feeRecipient,
+        coinbase,
+        remoteSigner,
+        fundingAccount
+    });
+    // If password provided, write ETH JSON V3 and BLS BN254 keystores and replace plaintext
+    if (password !== undefined) {
+        const keystoreOutDir = outDir && outDir.length > 0 ? outDir : dirname(outputPath);
+        await writeEthJsonV3ToFile(validators, {
+            outDir: keystoreOutDir,
+            password
+        });
+        await writeBlsBn254ToFile(validators, {
+            outDir: keystoreOutDir,
+            password
+        });
+    }
+    const keystore = {
+        schemaVersion: 1,
+        validators
+    };
+    await writeKeystoreFile(outputPath, keystore);
+    maybePrintJson(log, json, keystore);
+    if (!json) {
+        log(`Wrote validator keystore to ${outputPath}`);
+    }
+    // Always print a concise summary of public keys (addresses and BLS pubkeys)
+    logValidatorSummaries(log, summaries);
+    if (!blsOnly && mnemonic && remoteSigner) {
+        for(let i = 0; i < validatorCount; i++){
+            const addrIdx = addressIndex + i;
+            const acct = mnemonicToAccount(mnemonic, {
+                accountIndex,
+                addressIndex: addrIdx
+            });
+            log(`attester address: ${acct.address} remoteSignerUrl: ${remoteSigner}`);
+        }
+    }
+}

package/dest/cmds/validator_keys/shared.d.ts

@@ -0,0 +1,68 @@
+import type { EthAddress } from '@aztec/foundation/eth-address';
+import type { LogFn } from '@aztec/foundation/log';
+import type { EthAccount, EthPrivateKey, ValidatorKeyStore } from '@aztec/node-keystore/types';
+import type { AztecAddress } from '@aztec/stdlib/aztec-address';
+export type ValidatorSummary = {
+    attesterEth?: string;
+    attesterBls?: string;
+    publisherEth?: string[];
+};
+export type BuildValidatorsInput = {
+    validatorCount: number;
+    publisherCount?: number;
+    accountIndex: number;
+    baseAddressIndex: number;
+    mnemonic: string;
+    ikm?: string;
+    blsPath?: string;
+    blsOnly?: boolean;
+    feeRecipient: AztecAddress;
+    coinbase?: EthAddress;
+    remoteSigner?: string;
+    fundingAccount?: EthAddress;
+};
+export declare function withValidatorIndex(path: string, index: number): string;
+/**
+ * Compute a compressed BN254 G1 public key from a private key.
+ * @param privateKeyHex - Private key as 0x-prefixed hex string
+ * @returns Compressed G1 point (32 bytes with sign bit in MSB)
+ */
+export declare function computeBlsPublicKeyCompressed(privateKeyHex: string): Promise<string>;
+export declare function deriveEthAttester(mnemonic: string, baseAccountIndex: number, addressIndex: number, remoteSigner?: string): EthAccount | EthPrivateKey;
+export declare function buildValidatorEntries(input: BuildValidatorsInput): Promise<{
+    validators: ValidatorKeyStore[];
+    summaries: ValidatorSummary[];
+}>;
+export declare function resolveKeystoreOutputPath(dataDir?: string, file?: string): Promise<{
+    resolvedDir: string;
+    outputPath: string;
+}>;
+export declare function writeKeystoreFile(path: string, keystore: unknown): Promise<void>;
+export declare function logValidatorSummaries(log: LogFn, summaries: ValidatorSummary[]): void;
+export declare function maybePrintJson(log: LogFn, jsonFlag: boolean | undefined, obj: unknown): void;
+/**
+ * Writes a BN254 keystore file for a BN254 BLS private key.
+ * Returns the absolute path to the written file.
+ *
+ * @param outDir - Directory to write the keystore file to
+ * @param fileNameBase - Base name for the keystore file (will be sanitized)
+ * @param password - Password for encrypting the private key
+ * @param privateKeyHex - Private key as 0x-prefixed hex string (32 bytes)
+ * @param pubkeyHex - Public key as hex string
+ * @param derivationPath - BIP-44 style derivation path
+ * @returns Absolute path to the written keystore file
+ */
+export declare function writeBn254BlsKeystore(outDir: string, fileNameBase: string, password: string, privateKeyHex: string, pubkeyHex: string, derivationPath: string): Promise<string>;
+/** Replace plaintext BLS keys in validators with { path, password } pointing to BN254 keystore files. */
+export declare function writeBlsBn254ToFile(validators: ValidatorKeyStore[], options: {
+    outDir: string;
+    password: string;
+}): Promise<void>;
+/** Writes an Ethereum JSON V3 keystore using ethers, returns absolute path */
+export declare function writeEthJsonV3Keystore(outDir: string, fileNameBase: string, password: string, privateKeyHex: string): Promise<string>;
+/** Replace plaintext ETH keys in validators with { path, password } pointing to JSON V3 files. */
+export declare function writeEthJsonV3ToFile(validators: ValidatorKeyStore[], options: {
+    outDir: string;
+    password: string;
+}): Promise<void>;
+//# sourceMappingURL=shared.d.ts.map

package/dest/cmds/validator_keys/shared.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"shared.d.ts","sourceRoot":"","sources":["../../../src/cmds/validator_keys/shared.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,+BAA+B,CAAC;AAChE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AACnD,OAAO,KAAK,EAAE,UAAU,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAC/F,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAShE,MAAM,MAAM,gBAAgB,GAAG;IAAE,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC;AAEvG,MAAM,MAAM,oBAAoB,GAAG;IACjC,cAAc,EAAE,MAAM,CAAC;IACvB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,YAAY,EAAE,MAAM,CAAC;IACrB,gBAAgB,EAAE,MAAM,CAAC;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,YAAY,EAAE,YAAY,CAAC;IAC3B,QAAQ,CAAC,EAAE,UAAU,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,cAAc,CAAC,EAAE,UAAU,CAAC;CAC7B,CAAC;AAEF,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,UAO7D;AAED;;;;GAIG;AACH,wBAAsB,6BAA6B,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAE1F;AAED,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,MAAM,EAChB,gBAAgB,EAAE,MAAM,EACxB,YAAY,EAAE,MAAM,EACpB,YAAY,CAAC,EAAE,MAAM,GACpB,UAAU,GAAG,aAAa,CAK5B;AAED,wBAAsB,qBAAqB,CAAC,KAAK,EAAE,oBAAoB;;;GA6EtE;AAED,wBAAsB,yBAAyB,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM;;;GAoB9E;AAED,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,iBAGtE;AAED,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,KAAK,EAAE,SAAS,EAAE,gBAAgB,EAAE,QAsB9E;AAED,wBAAgB,cAAc,CAAC,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,GAAG,SAAS,EAAE,GAAG,EAAE,OAAO,QAIrF;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,qBAAqB,CACzC,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,EAChB,aAAa,EAAE,MAAM,EACrB,SAAS,EAAE,MAAM,EACjB,cAAc,EAAE,MAAM,GACrB,OAAO,CAAC,MAAM,CAAC,CASjB;AAED,yGAAyG;AACzG,wBAAsB,mBAAmB,CACvC,UAAU,EAAE,iBAAiB,EAAE,EAC/B,OAAO,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAC5C,OAAO,CAAC,IAAI,CAAC,CAuBf;AAED,8EAA8E;AAC9E,wBAAsB,sBAAsB,CAC1C,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,EAChB,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,MAAM,CAAC,CAQjB;AAED,kGAAkG;AAClG,wBAAsB,oBAAoB,CACxC,UAAU,EAAE,iBAAiB,EAAE,EAC/B,OAAO,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAC5C,OAAO,CAAC,IAAI,CAAC,CA2Cf"}

package/dest/cmds/validator_keys/shared.js

@@ -0,0 +1,271 @@
+import { prettyPrintJSON } from '@aztec/cli/utils';
+import { computeBn254G1PublicKeyCompressed, deriveBlsPrivateKey } from '@aztec/foundation/crypto';
+import { createBn254Keystore } from '@aztec/foundation/crypto/bls/bn254_keystore';
+import { Wallet } from '@ethersproject/wallet';
+import { constants as fsConstants, mkdirSync } from 'fs';
+import { access, writeFile } from 'fs/promises';
+import { homedir } from 'os';
+import { dirname, isAbsolute, join } from 'path';
+import { mnemonicToAccount } from 'viem/accounts';
+export function withValidatorIndex(path, index) {
+    const parts = path.split('/');
+    if (parts.length >= 4 && parts[0] === 'm' && parts[1] === '12381' && parts[2] === '3600') {
+        parts[3] = String(index);
+        return parts.join('/');
+    }
+    return path;
+}
+/**
+ * Compute a compressed BN254 G1 public key from a private key.
+ * @param privateKeyHex - Private key as 0x-prefixed hex string
+ * @returns Compressed G1 point (32 bytes with sign bit in MSB)
+ */ export async function computeBlsPublicKeyCompressed(privateKeyHex) {
+    return await computeBn254G1PublicKeyCompressed(privateKeyHex);
+}
+export function deriveEthAttester(mnemonic, baseAccountIndex, addressIndex, remoteSigner) {
+    const acct = mnemonicToAccount(mnemonic, {
+        accountIndex: baseAccountIndex,
+        addressIndex
+    });
+    return remoteSigner ? {
+        address: acct.address,
+        remoteSignerUrl: remoteSigner
+    } : '0x' + Buffer.from(acct.getHdKey().privateKey).toString('hex');
+}
+export async function buildValidatorEntries(input) {
+    const { validatorCount, publisherCount = 0, accountIndex, baseAddressIndex, mnemonic, ikm, blsPath, blsOnly, feeRecipient, coinbase, remoteSigner, fundingAccount } = input;
+    const defaultBlsPath = 'm/12381/3600/0/0/0';
+    const summaries = [];
+    const validators = await Promise.all(Array.from({
+        length: validatorCount
+    }, async (_unused, i)=>{
+        const addressIndex = baseAddressIndex + i;
+        const basePath = blsPath ?? defaultBlsPath;
+        const perValidatorPath = withValidatorIndex(basePath, addressIndex);
+        const blsPrivKey = blsOnly || ikm || mnemonic ? deriveBlsPrivateKey(mnemonic, ikm, perValidatorPath) : undefined;
+        const blsPubCompressed = blsPrivKey ? await computeBlsPublicKeyCompressed(blsPrivKey) : undefined;
+        if (blsOnly) {
+            const attester = {
+                bls: blsPrivKey
+            };
+            summaries.push({
+                attesterBls: blsPubCompressed
+            });
+            return {
+                attester,
+                feeRecipient
+            };
+        }
+        const ethAttester = deriveEthAttester(mnemonic, accountIndex, addressIndex, remoteSigner);
+        const attester = blsPrivKey ? {
+            eth: ethAttester,
+            bls: blsPrivKey
+        } : ethAttester;
+        let publisherField;
+        const publisherAddresses = [];
+        if (publisherCount > 0) {
+            const publishersBaseIndex = baseAddressIndex + validatorCount + i * publisherCount;
+            const publisherAccounts = Array.from({
+                length: publisherCount
+            }, (_unused2, j)=>{
+                const publisherAddressIndex = publishersBaseIndex + j;
+                const pubAcct = mnemonicToAccount(mnemonic, {
+                    accountIndex,
+                    addressIndex: publisherAddressIndex
+                });
+                publisherAddresses.push(pubAcct.address);
+                return remoteSigner ? {
+                    address: pubAcct.address,
+                    remoteSignerUrl: remoteSigner
+                } : '0x' + Buffer.from(pubAcct.getHdKey().privateKey).toString('hex');
+            });
+            publisherField = publisherCount === 1 ? publisherAccounts[0] : publisherAccounts;
+        }
+        const acct = mnemonicToAccount(mnemonic, {
+            accountIndex,
+            addressIndex
+        });
+        const attesterEthAddress = acct.address;
+        summaries.push({
+            attesterEth: attesterEthAddress,
+            attesterBls: blsPubCompressed,
+            publisherEth: publisherAddresses.length > 0 ? publisherAddresses : undefined
+        });
+        return {
+            attester,
+            ...publisherField !== undefined ? {
+                publisher: publisherField
+            } : {},
+            feeRecipient,
+            coinbase,
+            fundingAccount
+        };
+    }));
+    return {
+        validators,
+        summaries
+    };
+}
+export async function resolveKeystoreOutputPath(dataDir, file) {
+    const defaultDataDir = join(homedir(), '.aztec', 'keystore');
+    const resolvedDir = dataDir && dataDir.length > 0 ? dataDir : defaultDataDir;
+    let outputPath;
+    if (file && file.length > 0) {
+        outputPath = isAbsolute(file) ? file : join(resolvedDir, file);
+    } else {
+        let index = 1;
+        while(true){
+            const candidate = join(resolvedDir, `key${index}.json`);
+            try {
+                await access(candidate, fsConstants.F_OK);
+                index += 1;
+            } catch  {
+                outputPath = candidate;
+                break;
+            }
+        }
+    }
+    return {
+        resolvedDir,
+        outputPath: outputPath
+    };
+}
+export async function writeKeystoreFile(path, keystore) {
+    mkdirSync(dirname(path), {
+        recursive: true
+    });
+    await writeFile(path, JSON.stringify(keystore, null, 2), {
+        encoding: 'utf-8'
+    });
+}
+export function logValidatorSummaries(log, summaries) {
+    const lines = [];
+    for(let i = 0; i < summaries.length; i++){
+        const v = summaries[i];
+        lines.push(`acc${i + 1}:`);
+        lines.push(`  attester:`);
+        if (v.attesterEth) {
+            lines.push(`    eth: ${v.attesterEth}`);
+        }
+        if (v.attesterBls) {
+            lines.push(`    bls: ${v.attesterBls}`);
+        }
+        if (v.publisherEth && v.publisherEth.length > 0) {
+            lines.push(`  publisher:`);
+            for (const addr of v.publisherEth){
+                lines.push(`    - ${addr}`);
+            }
+        }
+    }
+    if (lines.length > 0) {
+        log(lines.join('\n'));
+    }
+}
+export function maybePrintJson(log, jsonFlag, obj) {
+    if (jsonFlag) {
+        log(prettyPrintJSON(obj));
+    }
+}
+/**
+ * Writes a BN254 keystore file for a BN254 BLS private key.
+ * Returns the absolute path to the written file.
+ *
+ * @param outDir - Directory to write the keystore file to
+ * @param fileNameBase - Base name for the keystore file (will be sanitized)
+ * @param password - Password for encrypting the private key
+ * @param privateKeyHex - Private key as 0x-prefixed hex string (32 bytes)
+ * @param pubkeyHex - Public key as hex string
+ * @param derivationPath - BIP-44 style derivation path
+ * @returns Absolute path to the written keystore file
+ */ export async function writeBn254BlsKeystore(outDir, fileNameBase, password, privateKeyHex, pubkeyHex, derivationPath) {
+    mkdirSync(outDir, {
+        recursive: true
+    });
+    const keystore = createBn254Keystore(password, privateKeyHex, pubkeyHex, derivationPath);
+    const safeBase = fileNameBase.replace(/[^a-zA-Z0-9_-]/g, '_');
+    const outPath = join(outDir, `keystore-${safeBase}.json`);
+    await writeFile(outPath, JSON.stringify(keystore, null, 2), {
+        encoding: 'utf-8'
+    });
+    return outPath;
+}
+/** Replace plaintext BLS keys in validators with { path, password } pointing to BN254 keystore files. */ export async function writeBlsBn254ToFile(validators, options) {
+    for(let i = 0; i < validators.length; i++){
+        const v = validators[i];
+        if (!v || typeof v !== 'object' || !('attester' in v)) {
+            continue;
+        }
+        const att = v.attester;
+        // Shapes: { bls: <hex> } or { eth: <ethAccount>, bls?: <hex> } or plain EthAccount
+        const blsKey = typeof att === 'object' && 'bls' in att ? att.bls : undefined;
+        if (!blsKey || typeof blsKey !== 'string') {
+            continue;
+        }
+        const pub = await computeBlsPublicKeyCompressed(blsKey);
+        const path = 'm/12381/3600/0/0/0';
+        const fileBase = `${String(i + 1)}_${pub.slice(2, 18)}`;
+        const keystorePath = await writeBn254BlsKeystore(options.outDir, fileBase, options.password, blsKey, pub, path);
+        if (typeof att === 'object') {
+            att.bls = {
+                path: keystorePath,
+                password: options.password
+            };
+        }
+    }
+}
+/** Writes an Ethereum JSON V3 keystore using ethers, returns absolute path */ export async function writeEthJsonV3Keystore(outDir, fileNameBase, password, privateKeyHex) {
+    const safeBase = fileNameBase.replace(/[^a-zA-Z0-9_-]/g, '_');
+    mkdirSync(outDir, {
+        recursive: true
+    });
+    const wallet = new Wallet(privateKeyHex);
+    const json = await wallet.encrypt(password);
+    const outPath = join(outDir, `keystore-eth-${safeBase}.json`);
+    await writeFile(outPath, json, {
+        encoding: 'utf-8'
+    });
+    return outPath;
+}
+/** Replace plaintext ETH keys in validators with { path, password } pointing to JSON V3 files. */ export async function writeEthJsonV3ToFile(validators, options) {
+    const maybeEncryptEth = async (account, label)=>{
+        if (typeof account === 'string' && account.startsWith('0x') && account.length === 66) {
+            const fileBase = `${label}_${account.slice(2, 10)}`;
+            const p = await writeEthJsonV3Keystore(options.outDir, fileBase, options.password, account);
+            return {
+                path: p,
+                password: options.password
+            };
+        }
+        return account;
+    };
+    for(let i = 0; i < validators.length; i++){
+        const v = validators[i];
+        if (!v || typeof v !== 'object') {
+            continue;
+        }
+        // attester may be string (eth), object with eth, or remote signer
+        const att = v.attester;
+        if (typeof att === 'string') {
+            v.attester = await maybeEncryptEth(att, `attester_${i + 1}`);
+        } else if (att && typeof att === 'object' && 'eth' in att) {
+            att.eth = await maybeEncryptEth(att.eth, `attester_${i + 1}`);
+        }
+        // publisher can be single or array
+        if ('publisher' in v) {
+            const pub = v.publisher;
+            if (Array.isArray(pub)) {
+                const out = [];
+                for(let j = 0; j < pub.length; j++){
+                    out.push(await maybeEncryptEth(pub[j], `publisher_${i + 1}_${j + 1}`));
+                }
+                v.publisher = out;
+            } else if (pub !== undefined) {
+                v.publisher = await maybeEncryptEth(pub, `publisher_${i + 1}`);
+            }
+        }
+        // Optional fundingAccount within validator
+        if ('fundingAccount' in v) {
+            v.fundingAccount = await maybeEncryptEth(v.fundingAccount, `funding_${i + 1}`);
+        }
+    }
+}

package/dest/config/chain_l2_config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"chain_l2_config.d.ts","sourceRoot":"","sources":["../../src/config/chain_l2_config.ts"],"names":[],"mappings":"AAAA,OAAO,EAA4B,KAAK,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACnF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAE7D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAYrE,MAAM,MAAM,aAAa,GAAG,iBAAiB,GAC3C,IAAI,CAAC,aAAa,EAAE,sBAAsB,GAAG,uBAAuB,CAAC,GAAG;IACtE,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,OAAO,CAAC;IACtB,YAAY,EAAE,OAAO,CAAC;IACtB,UAAU,EAAE,OAAO,CAAC;IACpB,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,UAAU,EAAE,OAAO,CAAC;IACpB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,UAAU,EAAE,gBAAgB,CAAC,YAAY,CAAC,CAAC;IAC3C,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,MAAM,CAAC;IACtB,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAC;IAChC,yBAAyB,CAAC,EAAE,MAAM,CAAC;IACnC,wBAAwB,CAAC,EAAE,MAAM,EAAE,CAAC;IACpC,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAClC,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAIhC,WAAW,EAAE,MAAM,CAAC;IACpB,sBAAsB,EAAE,MAAM,CAAC;IAC/B,qBAAqB,EAAE,MAAM,CAAC;IAC9B,sBAAsB,EAAE,MAAM,CAAC;IAC/B,uBAAuB,EAAE,MAAM,CAAC;IAGhC,eAAe,EAAE,OAAO,CAAC;IACzB,mBAAmB,EAAE,OAAO,CAAC;CAC9B,CAAC;AA+CJ,eAAO,MAAM,4BAA4B,EAAE,aA+E1C,CAAC;AAEF,eAAO,MAAM,0BAA0B,EAAE,aAmDxC,CAAC;AAEF,eAAO,MAAM,oBAAoB,EAAE,aAmDlC,CAAC;AAEF,eAAO,MAAM,oBAAoB,EAAE,aAuDlC,CAAC;AAEF,eAAO,MAAM,oBAAoB,EAAE,aAiFlC,CAAC;AAEF,eAAO,MAAM,mBAAmB,EAAE,aAmDjC,CAAC;AAEF,wBAAgB,gBAAgB,CAAC,WAAW,EAAE,YAAY,GAAG,aAAa,GAAG,SAAS,CAgBrF;AAMD,wBAAgB,gCAAgC,CAAC,WAAW,EAAE,YAAY,QAoGzE"}
+{"version":3,"file":"chain_l2_config.d.ts","sourceRoot":"","sources":["../../src/config/chain_l2_config.ts"],"names":[],"mappings":"AAAA,OAAO,EAA4B,KAAK,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACnF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAE7D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAYrE,MAAM,MAAM,aAAa,GAAG,iBAAiB,GAC3C,IAAI,CAAC,aAAa,EAAE,sBAAsB,GAAG,uBAAuB,CAAC,GAAG;IACtE,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,OAAO,CAAC;IACtB,YAAY,EAAE,OAAO,CAAC;IACtB,UAAU,EAAE,OAAO,CAAC;IACpB,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,UAAU,EAAE,OAAO,CAAC;IACpB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,UAAU,EAAE,gBAAgB,CAAC,YAAY,CAAC,CAAC;IAC3C,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,MAAM,CAAC;IACtB,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAC;IAChC,yBAAyB,CAAC,EAAE,MAAM,CAAC;IACnC,wBAAwB,CAAC,EAAE,MAAM,EAAE,CAAC;IACpC,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAClC,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAIhC,WAAW,EAAE,MAAM,CAAC;IACpB,sBAAsB,EAAE,MAAM,CAAC;IAC/B,qBAAqB,EAAE,MAAM,CAAC;IAC9B,sBAAsB,EAAE,MAAM,CAAC;IAC/B,uBAAuB,EAAE,MAAM,CAAC;IAGhC,eAAe,EAAE,OAAO,CAAC;IACzB,mBAAmB,EAAE,OAAO,CAAC;CAC9B,CAAC;AA+CJ,eAAO,MAAM,4BAA4B,EAAE,aA+E1C,CAAC;AAEF,eAAO,MAAM,0BAA0B,EAAE,aAmDxC,CAAC;AAEF,eAAO,MAAM,oBAAoB,EAAE,aAmDlC,CAAC;AAEF,eAAO,MAAM,oBAAoB,EAAE,aAuDlC,CAAC;AAEF,eAAO,MAAM,oBAAoB,EAAE,aAmFlC,CAAC;AAEF,eAAO,MAAM,mBAAmB,EAAE,aAmDjC,CAAC;AAEF,wBAAgB,gBAAgB,CAAC,WAAW,EAAE,YAAY,GAAG,aAAa,GAAG,SAAS,CAgBrF;AAMD,wBAAgB,gCAAgC,CAAC,WAAW,EAAE,YAAY,QAoGzE"}