@aztec/cli 3.0.0-nightly.20251118 → 3.0.0-nightly.20251119

package/dest/cmds/validator_keys/add.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"add.d.ts","sourceRoot":"","sources":["../../../src/cmds/validator_keys/add.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAQnD,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,UAAU,CAAC;AAU5D,MAAM,MAAM,uBAAuB,GAAG,2BAA2B,CAAC;AAElE,wBAAsB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,uBAAuB,EAAE,GAAG,EAAE,KAAK,iBAyFpG"}
+{"version":3,"file":"add.d.ts","sourceRoot":"","sources":["../../../src/cmds/validator_keys/add.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAQnD,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,UAAU,CAAC;AAW5D,MAAM,MAAM,uBAAuB,GAAG,2BAA2B,CAAC;AAElE,wBAAsB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,uBAAuB,EAAE,GAAG,EAAE,KAAK,iBAkGpG"}

package/dest/cmds/validator_keys/add.js

@@ -2,9 +2,11 @@ import { loadKeystoreFile } from '@aztec/node-keystore/loader';
 import { wordlist } from '@scure/bip39/wordlists/english.js';
 import { dirname, isAbsolute, join } from 'path';
 import { generateMnemonic } from 'viem/accounts';
-import { buildValidatorEntries, logValidatorSummaries, maybePrintJson, writeBlsBn254ToFile, writeEthJsonV3ToFile, writeKeystoreFile } from './shared.js';
+import { buildValidatorEntries, logValidatorSummaries, maybePrintJson, validateBlsPathOptions, writeBlsBn254ToFile, writeEthJsonV3ToFile, writeKeystoreFile } from './shared.js';
 export async function addValidatorKeys(existing, options, log) {
-    const { dataDir, file, count, publisherCount = 0, mnemonic, accountIndex = 0, addressIndex, ikm, blsPath, json, feeRecipient: feeRecipientOpt, coinbase: coinbaseOpt, fundingAccount: fundingAccountOpt, remoteSigner: remoteSignerOpt, password, outDir } = options;
+    // validate bls-path inputs before proceeding with key generation
+    validateBlsPathOptions(options);
+    const { dataDir, file, count, publisherCount = 0, mnemonic, accountIndex = 0, addressIndex, ikm, blsPath, json, feeRecipient: feeRecipientOpt, coinbase: coinbaseOpt, fundingAccount: fundingAccountOpt, remoteSigner: remoteSignerOpt, password, encryptedKeystoreDir } = options;
     const validatorCount = typeof count === 'number' && Number.isFinite(count) && count > 0 ? Math.floor(count) : 1;
     const baseAddressIndex = addressIndex ?? 0;
     const keystore = loadKeystoreFile(existing);
@@ -40,14 +42,22 @@ export async function addValidatorKeys(existing, options, log) {
     keystore.validators.push(...validators);
     // If password provided, write ETH JSON V3 and BLS BN254 keystores and replace plaintext
     if (password !== undefined) {
-        const targetDir = outDir && outDir.length > 0 ? outDir : dataDir && dataDir.length > 0 ? dataDir : dirname(existing);
+        let targetDir;
+        if (encryptedKeystoreDir && encryptedKeystoreDir.length > 0) {
+            targetDir = encryptedKeystoreDir;
+        } else if (dataDir && dataDir.length > 0) {
+            targetDir = dataDir;
+        } else {
+            targetDir = dirname(existing);
+        }
         await writeEthJsonV3ToFile(keystore.validators, {
             outDir: targetDir,
             password
         });
         await writeBlsBn254ToFile(keystore.validators, {
             outDir: targetDir,
-            password
+            password,
+            blsPath
         });
     }
     let outputPath = existing;

package/dest/cmds/validator_keys/generate_bls_keypair.js

@@ -1,9 +1,9 @@
 import { deriveBlsPrivateKey } from '@aztec/foundation/crypto';
 import { writeFile } from 'fs/promises';
-import { computeBlsPublicKeyCompressed, withValidatorIndex } from './shared.js';
+import { computeBlsPublicKeyCompressed, defaultBlsPath, withValidatorIndex } from './shared.js';
 export async function generateBlsKeypair(options, log) {
     const { mnemonic, ikm, blsPath, compressed = true, json, out } = options;
-    const path = withValidatorIndex(blsPath ?? 'm/12381/3600/0/0/0', 0);
+    const path = withValidatorIndex(blsPath ?? defaultBlsPath, 0);
     const priv = deriveBlsPrivateKey(mnemonic, ikm, path);
     const pub = await computeBlsPublicKeyCompressed(priv);
     const result = {

package/dest/cmds/validator_keys/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/cmds/validator_keys/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAEnD,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAIpC,wBAAgB,cAAc,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,WAqH1D"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/cmds/validator_keys/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAEnD,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAKpC,wBAAgB,cAAc,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,WAsH1D"}

package/dest/cmds/validator_keys/index.js

@@ -1,14 +1,15 @@
 import { parseAztecAddress, parseEthereumAddress, parseHex, parseOptionalInteger } from '../../utils/commands.js';
+import { defaultBlsPath } from './shared.js';
 export function injectCommands(program, log) {
     const group = program.command('validator-keys').aliases([
         'valKeys',
         'valkeys'
     ]).description('Manage validator keystores for node operators');
-    group.command('new').summary('Generate a new validator keystore JSON').description('Generates a new validator keystore with ETH secp256k1 accounts and optional BLS accounts').option('--data-dir <path>', 'Directory to store keystore(s). Defaults to ~/.aztec/keystore').option('--file <name>', 'Keystore file name. Defaults to key1.json (or keyN.json if key1.json exists)').option('--count <N>', 'Number of validators to generate', parseOptionalInteger).option('--publisher-count <N>', 'Number of publisher accounts per validator (default 1)', (value)=>parseOptionalInteger(value, 0)).option('--mnemonic <mnemonic>', 'Mnemonic for ETH/BLS derivation').option('--passphrase <str>', 'Optional passphrase for mnemonic').option('--account-index <N>', 'Base account index for ETH derivation', parseOptionalInteger).option('--address-index <N>', 'Base address index for ETH derivation', parseOptionalInteger).option('--coinbase <address>', 'Coinbase ETH address to use when proposing', parseEthereumAddress).option('--funding-account <address>', 'ETH account to fund publishers', parseEthereumAddress).option('--remote-signer <url>', 'Default remote signer URL for accounts in this file').option('--ikm <hex>', 'Initial keying material for BLS (alternative to mnemonic)', (value)=>parseHex(value, 32)).option('--bls-path <path>', 'EIP-2334 path (default m/12381/3600/0/0/0)').option('--password <str>', 'Password for writing keystore files (ETH JSON V3 and BLS EIP-2335). Empty string allowed').option('--out-dir <dir>', 'Output directory for generated keystore file(s)').option('--json', 'Echo resulting JSON to stdout').option('--staker-output', 'Generate staker output JSON files for each attester').option('--gse-address <address>', 'GSE contract address (required with --staker-output)', parseEthereumAddress).option('--l1-rpc-urls <urls>', 'L1 RPC URLs (comma-separated, required with --staker-output)', (value)=>value.split(',')).option('-c, --l1-chain-id <number>', 'L1 chain ID (required with --staker-output)', (value)=>parseInt(value), 31337).requiredOption('--fee-recipient <address>', 'Aztec address that will receive fees', parseAztecAddress).action(async (options)=>{
+    group.command('new').summary('Generate a new validator keystore JSON').description('Generates a new validator keystore with ETH secp256k1 accounts and optional BLS accounts').option('--data-dir <path>', 'Directory to store keystore(s). Defaults to ~/.aztec/keystore').option('--file <name>', 'Keystore file name. Defaults to key1.json (or keyN.json if key1.json exists)').option('--count <N>', 'Number of validators to generate', parseOptionalInteger).option('--publisher-count <N>', 'Number of publisher accounts per validator (default 1)', (value)=>parseOptionalInteger(value, 0)).option('--mnemonic <mnemonic>', 'Mnemonic for ETH/BLS derivation').option('--passphrase <str>', 'Optional passphrase for mnemonic').option('--account-index <N>', 'Base account index for ETH/BLS derivation', parseOptionalInteger).option('--address-index <N>', 'Base address index for ETH/BLS derivation', parseOptionalInteger).option('--coinbase <address>', 'Coinbase ETH address to use when proposing', parseEthereumAddress).option('--funding-account <address>', 'ETH account to fund publishers', parseEthereumAddress).option('--remote-signer <url>', 'Default remote signer URL for accounts in this file').option('--ikm <hex>', 'Initial keying material for BLS (alternative to mnemonic)', (value)=>parseHex(value, 32)).option('--bls-path <path>', `EIP-2334 path (default ${defaultBlsPath})`).option('--password <str>', 'Password for writing keystore files (ETH JSON V3 and BLS EIP-2335). Empty string allowed').option('--encrypted-keystore-dir <dir>', 'Output directory for encrypted keystore file(s)').option('--json', 'Echo resulting JSON to stdout').option('--staker-output', 'Generate a single staker output JSON file with an array of validator entries').option('--gse-address <address>', 'GSE contract address (required with --staker-output)', parseEthereumAddress).option('--l1-rpc-urls <urls>', 'L1 RPC URLs (comma-separated, required with --staker-output)', (value)=>value.split(',')).option('-c, --l1-chain-id <number>', 'L1 chain ID (required with --staker-output)', (value)=>parseInt(value), 31337).requiredOption('--fee-recipient <address>', 'Aztec address that will receive fees', parseAztecAddress).action(async (options)=>{
         const { newValidatorKeystore } = await import('./new.js');
         await newValidatorKeystore(options, log);
     });
-    group.command('add').summary('Augment an existing validator keystore JSON').description('Adds attester/publisher/BLS entries to an existing keystore using the same flags as new').argument('<existing>', 'Path to existing keystore JSON').option('--data-dir <path>', 'Directory where keystore(s) live').option('--file <name>', 'Override output file name').option('--count <N>', 'Number of validators to add', parseOptionalInteger).option('--publisher-count <N>', 'Number of publisher accounts per validator (default 1)', (value)=>parseOptionalInteger(value, 0)).option('--mnemonic <mnemonic>', 'Mnemonic for ETH/BLS derivation').option('--passphrase <str>', 'Optional passphrase for mnemonic').option('--account-index <N>', 'Base account index for ETH derivation', parseOptionalInteger).option('--address-index <N>', 'Base address index for ETH derivation', parseOptionalInteger).option('--coinbase <address>', 'Coinbase ETH address to use when proposing', parseEthereumAddress).option('--funding-account <address>', 'ETH account to fund publishers', parseEthereumAddress).option('--remote-signer <url>', 'Default remote signer URL for accounts in this file').option('--ikm <hex>', 'Initial keying material for BLS (alternative to mnemonic)', (value)=>parseHex(value, 32)).option('--bls-path <path>', 'EIP-2334 path (default m/12381/3600/0/0/0)').option('--empty', 'Generate an empty skeleton without keys').option('--password <str>', 'Password for writing keystore files (ETH JSON V3 and BLS EIP-2335). Empty string allowed').option('--out-dir <dir>', 'Output directory for generated keystore file(s)').option('--json', 'Echo resulting JSON to stdout').requiredOption('--fee-recipient <address>', 'Aztec address that will receive fees', parseAztecAddress).action(async (existing, options)=>{
+    group.command('add').summary('Augment an existing validator keystore JSON').description('Adds attester/publisher/BLS entries to an existing keystore using the same flags as new').argument('<existing>', 'Path to existing keystore JSON').option('--data-dir <path>', 'Directory where keystore(s) live. (default: ~/.aztec/keystore)').option('--file <name>', 'Override output file name. (default: key<N>.json)').option('--count <N>', 'Number of validators to add. (default: 1)', parseOptionalInteger).option('--publisher-count <N>', 'Number of publisher accounts per validator (default 1)', (value)=>parseOptionalInteger(value, 0)).option('--mnemonic <mnemonic>', 'Mnemonic for ETH/BLS derivation').option('--passphrase <str>', 'Optional passphrase for mnemonic').option('--account-index <N>', 'Base account index for ETH/BLS derivation', parseOptionalInteger).option('--address-index <N>', 'Base address index for ETH/BLS derivation', parseOptionalInteger).option('--coinbase <address>', 'Coinbase ETH address to use when proposing', parseEthereumAddress).option('--funding-account <address>', 'ETH account to fund publishers', parseEthereumAddress).option('--remote-signer <url>', 'Default remote signer URL for accounts in this file').option('--ikm <hex>', 'Initial keying material for BLS (alternative to mnemonic)', (value)=>parseHex(value, 32)).option('--bls-path <path>', `EIP-2334 path (default ${defaultBlsPath})`).option('--empty', 'Generate an empty skeleton without keys').option('--password <str>', 'Password for writing keystore files (ETH JSON V3 and BLS EIP-2335). Empty string allowed').option('--encrypted-keystore-dir <dir>', 'Output directory for encrypted keystore file(s)').option('--json', 'Echo resulting JSON to stdout').requiredOption('--fee-recipient <address>', 'Aztec address that will receive fees', parseAztecAddress).action(async (existing, options)=>{
         const { addValidatorKeys } = await import('./add.js');
         await addValidatorKeys(existing, options, log);
     });
@@ -19,7 +20,7 @@ export function injectCommands(program, log) {
         await generateStakerJson(options, log);
     });
     // top-level convenience: aztec generate-bls-keypair
-    program.command('generate-bls-keypair').description('Generate a BLS keypair with convenience flags').option('--mnemonic <mnemonic>', 'Mnemonic for BLS derivation').option('--ikm <hex>', 'Initial keying material for BLS (alternative to mnemonic)', (value)=>parseHex(value, 32)).option('--bls-path <path>', 'EIP-2334 path (default m/12381/3600/0/0/0)').option('--g2', 'Derive on G2 subgroup').option('--compressed', 'Output compressed public key').option('--json', 'Print JSON output to stdout').option('--out <file>', 'Write output to file').action(async (options)=>{
+    program.command('generate-bls-keypair').description('Generate a BLS keypair with convenience flags').option('--mnemonic <mnemonic>', 'Mnemonic for BLS derivation').option('--ikm <hex>', 'Initial keying material for BLS (alternative to mnemonic)', (value)=>parseHex(value, 32)).option('--bls-path <path>', `EIP-2334 path (default ${defaultBlsPath})`).option('--g2', 'Derive on G2 subgroup').option('--compressed', 'Output compressed public key').option('--json', 'Print JSON output to stdout').option('--out <file>', 'Write output to file').action(async (options)=>{
         const { generateBlsKeypair } = await import('./generate_bls_keypair.js');
         await generateBlsKeypair(options, log);
     });

package/dest/cmds/validator_keys/new.d.ts

@@ -14,7 +14,7 @@ export type NewValidatorKeystoreOptions = {
     ikm?: string;
     blsPath?: string;
     password?: string;
-    outDir?: string;
+    encryptedKeystoreDir?: string;
     json?: boolean;
     feeRecipient: AztecAddress;
     coinbase?: EthAddress;

package/dest/cmds/validator_keys/new.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"new.d.ts","sourceRoot":"","sources":["../../../src/cmds/validator_keys/new.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,+BAA+B,CAAC;AAChE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AACnD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAmBhE,MAAM,MAAM,2BAA2B,GAAG;IACxC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,YAAY,EAAE,YAAY,CAAC;IAC3B,QAAQ,CAAC,EAAE,UAAU,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,cAAc,CAAC,EAAE,UAAU,CAAC;IAC5B,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,wBAAsB,oBAAoB,CAAC,OAAO,EAAE,2BAA2B,EAAE,GAAG,EAAE,KAAK,iBA+J1F"}
+{"version":3,"file":"new.d.ts","sourceRoot":"","sources":["../../../src/cmds/validator_keys/new.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,+BAA+B,CAAC;AAChE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AACnD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAoBhE,MAAM,MAAM,2BAA2B,GAAG;IACxC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,YAAY,EAAE,YAAY,CAAC;IAC3B,QAAQ,CAAC,EAAE,UAAU,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,cAAc,CAAC,EAAE,UAAU,CAAC;IAC5B,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,wBAAsB,oBAAoB,CAAC,OAAO,EAAE,2BAA2B,EAAE,GAAG,EAAE,KAAK,iBAoK1F"}

package/dest/cmds/validator_keys/new.js

@@ -5,10 +5,12 @@ import { writeFile } from 'fs/promises';
 import { basename, dirname, join } from 'path';
 import { createPublicClient, fallback, http } from 'viem';
 import { generateMnemonic, mnemonicToAccount } from 'viem/accounts';
-import { buildValidatorEntries, logValidatorSummaries, maybePrintJson, resolveKeystoreOutputPath, writeBlsBn254ToFile, writeEthJsonV3ToFile, writeKeystoreFile } from './shared.js';
+import { buildValidatorEntries, logValidatorSummaries, maybePrintJson, resolveKeystoreOutputPath, validateBlsPathOptions, writeBlsBn254ToFile, writeEthJsonV3ToFile, writeKeystoreFile } from './shared.js';
 import { processAttesterAccounts } from './staker.js';
 export async function newValidatorKeystore(options, log) {
-    const { dataDir, file, count, publisherCount = 0, json, coinbase, accountIndex = 0, addressIndex = 0, feeRecipient, remoteSigner, fundingAccount, blsPath, ikm, mnemonic: _mnemonic, password, outDir, stakerOutput, gseAddress, l1RpcUrls, l1ChainId } = options;
+    // validate bls-path inputs before proceeding with key generation
+    validateBlsPathOptions(options);
+    const { dataDir, file, count, publisherCount = 0, json, coinbase, accountIndex = 0, addressIndex = 0, feeRecipient, remoteSigner, fundingAccount, blsPath, ikm, mnemonic: _mnemonic, password, encryptedKeystoreDir, stakerOutput, gseAddress, l1RpcUrls, l1ChainId } = options;
     // Validate staker output requirements
     if (stakerOutput) {
         if (!gseAddress) {
@@ -34,6 +36,7 @@ export async function newValidatorKeystore(options, log) {
     }
     const validatorCount = typeof count === 'number' && Number.isFinite(count) && count > 0 ? Math.floor(count) : 1;
     const { outputPath } = await resolveKeystoreOutputPath(dataDir, file);
+    const keystoreOutDir = dirname(outputPath);
     const { validators, summaries } = await buildValidatorEntries({
         validatorCount,
         publisherCount,
@@ -49,13 +52,13 @@ export async function newValidatorKeystore(options, log) {
     });
     // If password provided, write ETH JSON V3 and BLS BN254 keystores and replace plaintext
     if (password !== undefined) {
-        const keystoreOutDir = outDir && outDir.length > 0 ? outDir : dirname(outputPath);
+        const encryptedKeystoreOutDir = encryptedKeystoreDir && encryptedKeystoreDir.length > 0 ? encryptedKeystoreDir : keystoreOutDir;
         await writeEthJsonV3ToFile(validators, {
-            outDir: keystoreOutDir,
+            outDir: encryptedKeystoreOutDir,
             password
         });
         await writeBlsBn254ToFile(validators, {
-            outDir: keystoreOutDir,
+            outDir: encryptedKeystoreOutDir,
             password
         });
     }
@@ -73,21 +76,22 @@ export async function newValidatorKeystore(options, log) {
             transport: fallback(l1RpcUrls.map((url)=>http(url)))
         });
         const gse = new GSEContract(publicClient, gseAddress);
-        const keystoreOutDir = outDir && outDir.length > 0 ? outDir : dirname(outputPath);
         // Extract keystore base name without extension for unique staker output filenames
         const keystoreBaseName = basename(outputPath, '.json');
         // Process each validator
         for(let i = 0; i < validators.length; i++){
             const validator = validators[i];
             const outputs = await processAttesterAccounts(validator.attester, gse, password);
-            // Save each attester's staker output
+            // Collect all staker outputs
             for(let j = 0; j < outputs.length; j++){
-                const attesterIndex = i + 1;
-                const stakerOutputPath = join(keystoreOutDir, `${keystoreBaseName}_attester${attesterIndex}_staker_output.json`);
-                await writeFile(stakerOutputPath, prettyPrintJSON(outputs[j]), 'utf-8');
                 allStakerOutputs.push(outputs[j]);
             }
         }
+        // Write a single JSON file with all staker outputs
+        if (allStakerOutputs.length > 0) {
+            const stakerOutputPath = join(keystoreOutDir, `${keystoreBaseName}_staker_output.json`);
+            await writeFile(stakerOutputPath, prettyPrintJSON(allStakerOutputs), 'utf-8');
+        }
     }
     const outputData = !_mnemonic ? {
         ...keystore,
@@ -107,8 +111,9 @@ export async function newValidatorKeystore(options, log) {
     } else {
         log(`Wrote validator keystore to ${outputPath}`);
         if (stakerOutput && allStakerOutputs.length > 0) {
-            const keystoreOutDir = outDir && outDir.length > 0 ? outDir : dirname(outputPath);
-            log(`Wrote ${allStakerOutputs.length} staker output file(s) to ${keystoreOutDir}`);
+            const keystoreBaseName = basename(outputPath, '.json');
+            const stakerOutputPath = join(keystoreOutDir, `${keystoreBaseName}_staker_output.json`);
+            log(`Wrote staker output for ${allStakerOutputs.length} validator(s) to ${stakerOutputPath}`);
             log('');
         }
     }

package/dest/cmds/validator_keys/shared.d.ts

@@ -20,6 +20,15 @@ export type BuildValidatorsInput = {
     remoteSigner?: string;
     fundingAccount?: EthAddress;
 };
+export declare const defaultBlsPath = "m/12381/3600/0/0/0";
+export declare function validateBlsPathOptions(options: {
+    count?: number;
+    publisherCount?: number;
+    accountIndex?: number;
+    addressIndex?: number;
+    blsPath?: string;
+    ikm?: string;
+}): void;
 export declare function withValidatorIndex(path: string, accountIndex?: number, addressIndex?: number): string;
 /**
  * Compute a compressed BN254 G1 public key from a private key.
@@ -56,6 +65,7 @@ export declare function writeBn254BlsKeystore(outDir: string, fileNameBase: stri
 export declare function writeBlsBn254ToFile(validators: ValidatorKeyStore[], options: {
     outDir: string;
     password: string;
+    blsPath?: string;
 }): Promise<void>;
 /** Writes an Ethereum JSON V3 keystore using ethers, returns absolute path */
 export declare function writeEthJsonV3Keystore(outDir: string, fileNameBase: string, password: string, privateKeyHex: string): Promise<string>;

package/dest/cmds/validator_keys/shared.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"shared.d.ts","sourceRoot":"","sources":["../../../src/cmds/validator_keys/shared.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,+BAA+B,CAAC;AAChE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AACnD,OAAO,KAAK,EAAE,UAAU,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAC/F,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAShE,MAAM,MAAM,gBAAgB,GAAG;IAAE,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC;AAEvG,MAAM,MAAM,oBAAoB,GAAG;IACjC,cAAc,EAAE,MAAM,CAAC;IACvB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,YAAY,EAAE,MAAM,CAAC;IACrB,gBAAgB,EAAE,MAAM,CAAC;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,YAAY,CAAC;IAC3B,QAAQ,CAAC,EAAE,UAAU,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,cAAc,CAAC,EAAE,UAAU,CAAC;CAC7B,CAAC;AAEF,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,GAAE,MAAU,EAAE,YAAY,GAAE,MAAU,UAQlG;AAED;;;;GAIG;AACH,wBAAsB,6BAA6B,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAE1F;AAED,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,MAAM,EAChB,gBAAgB,EAAE,MAAM,EACxB,YAAY,EAAE,MAAM,EACpB,YAAY,CAAC,EAAE,MAAM,GACpB,UAAU,GAAG,aAAa,CAK5B;AAED,wBAAsB,qBAAqB,CAAC,KAAK,EAAE,oBAAoB;;;GAsEtE;AAED,wBAAsB,yBAAyB,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM;;;GAoB9E;AAED,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,iBAGtE;AAED,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,KAAK,EAAE,SAAS,EAAE,gBAAgB,EAAE,QAsB9E;AAED,wBAAgB,cAAc,CAAC,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,GAAG,SAAS,EAAE,GAAG,EAAE,OAAO,QAIrF;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,qBAAqB,CACzC,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,EAChB,aAAa,EAAE,MAAM,EACrB,SAAS,EAAE,MAAM,EACjB,cAAc,EAAE,MAAM,GACrB,OAAO,CAAC,MAAM,CAAC,CASjB;AAED,yGAAyG;AACzG,wBAAsB,mBAAmB,CACvC,UAAU,EAAE,iBAAiB,EAAE,EAC/B,OAAO,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAC5C,OAAO,CAAC,IAAI,CAAC,CAuBf;AAED,8EAA8E;AAC9E,wBAAsB,sBAAsB,CAC1C,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,EAChB,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,MAAM,CAAC,CAQjB;AAED,kGAAkG;AAClG,wBAAsB,oBAAoB,CACxC,UAAU,EAAE,iBAAiB,EAAE,EAC/B,OAAO,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAC5C,OAAO,CAAC,IAAI,CAAC,CA2Cf"}
+{"version":3,"file":"shared.d.ts","sourceRoot":"","sources":["../../../src/cmds/validator_keys/shared.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,+BAA+B,CAAC;AAChE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AACnD,OAAO,KAAK,EAAE,UAAU,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAC/F,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAShE,MAAM,MAAM,gBAAgB,GAAG;IAAE,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC;AAEvG,MAAM,MAAM,oBAAoB,GAAG;IACjC,cAAc,EAAE,MAAM,CAAC;IACvB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,YAAY,EAAE,MAAM,CAAC;IACrB,gBAAgB,EAAE,MAAM,CAAC;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,YAAY,CAAC;IAC3B,QAAQ,CAAC,EAAE,UAAU,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,cAAc,CAAC,EAAE,UAAU,CAAC;CAC7B,CAAC;AAEF,eAAO,MAAM,cAAc,uBAAuB,CAAC;AAEnD,wBAAgB,sBAAsB,CAAC,OAAO,EAAE;IAC9C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,QAWA;AAED,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,GAAE,MAAU,EAAE,YAAY,GAAE,MAAU,UAqBlG;AAED;;;;GAIG;AACH,wBAAsB,6BAA6B,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAE1F;AAED,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,MAAM,EAChB,gBAAgB,EAAE,MAAM,EACxB,YAAY,EAAE,MAAM,EACpB,YAAY,CAAC,EAAE,MAAM,GACpB,UAAU,GAAG,aAAa,CAK5B;AAED,wBAAsB,qBAAqB,CAAC,KAAK,EAAE,oBAAoB;;;GAqEtE;AAED,wBAAsB,yBAAyB,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM;;;GAoB9E;AAED,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,iBAGtE;AAED,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,KAAK,EAAE,SAAS,EAAE,gBAAgB,EAAE,QAsB9E;AAED,wBAAgB,cAAc,CAAC,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,GAAG,SAAS,EAAE,GAAG,EAAE,OAAO,QAIrF;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,qBAAqB,CACzC,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,EAChB,aAAa,EAAE,MAAM,EACrB,SAAS,EAAE,MAAM,EACjB,cAAc,EAAE,MAAM,GACrB,OAAO,CAAC,MAAM,CAAC,CASjB;AAED,yGAAyG;AACzG,wBAAsB,mBAAmB,CACvC,UAAU,EAAE,iBAAiB,EAAE,EAC/B,OAAO,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,GAC9D,OAAO,CAAC,IAAI,CAAC,CAuBf;AAED,8EAA8E;AAC9E,wBAAsB,sBAAsB,CAC1C,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,EAChB,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,MAAM,CAAC,CAQjB;AAED,kGAAkG;AAClG,wBAAsB,oBAAoB,CACxC,UAAU,EAAE,iBAAiB,EAAE,EAC/B,OAAO,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAC5C,OAAO,CAAC,IAAI,CAAC,CA2Cf"}

package/dest/cmds/validator_keys/shared.js

@@ -7,11 +7,34 @@ import { access, writeFile } from 'fs/promises';
 import { homedir } from 'os';
 import { dirname, isAbsolute, join } from 'path';
 import { mnemonicToAccount } from 'viem/accounts';
+export const defaultBlsPath = 'm/12381/3600/0/0/0';
+export function validateBlsPathOptions(options) {
+    if (options.blsPath && options.blsPath !== defaultBlsPath) {
+        if (options.count && options.count !== 1 || options.publisherCount && options.publisherCount > 0 || options.accountIndex && options.accountIndex !== 0 || options.addressIndex && options.addressIndex !== 0) {
+            throw new Error('--bls-path cannot be used with --count, --publisher-count, --account-index, or --address-index');
+        }
+    }
+}
 export function withValidatorIndex(path, accountIndex = 0, addressIndex = 0) {
+    // NOTE: The legacy BLS CLI is to allow users who generated keys in 2.1.4 to be able to use the same command
+    // to re-generate their keys. In 2.1.5 we switched how we append addresses to the path so this is to maintain backwards compatibility.
+    const useLegacyBlsCli = [
+        'true',
+        '1',
+        'yes',
+        'y'
+    ].includes(process.env.LEGACY_BLS_CLI ?? '');
+    const defaultBlsPathParts = defaultBlsPath.split('/');
     const parts = path.split('/');
-    if (parts.length == 6 && parts[0] === 'm' && parts[1] === '12381' && parts[2] === '3600') {
-        parts[3] = String(accountIndex);
-        parts[5] = String(addressIndex);
+    if (parts.length == defaultBlsPathParts.length && parts.every((part, index)=>part === defaultBlsPathParts[index])) {
+        if (useLegacyBlsCli) {
+            // In 2.1.4, we were using address-index in parts[3] and did NOT use account-index, check lines 32 & 84
+            // https://github.com/AztecProtocol/aztec-packages/blob/v2.1.4/yarn-project/cli/src/cmds/validator_keys/shared.ts
+            parts[3] = String(addressIndex);
+        } else {
+            parts[3] = String(accountIndex);
+            parts[5] = String(addressIndex);
+        }
         return parts.join('/');
     }
     return path;
@@ -35,7 +58,6 @@ export function deriveEthAttester(mnemonic, baseAccountIndex, addressIndex, remo
 }
 export async function buildValidatorEntries(input) {
     const { validatorCount, publisherCount = 0, accountIndex, baseAddressIndex, mnemonic, ikm, blsPath, feeRecipient, coinbase, remoteSigner, fundingAccount } = input;
-    const defaultBlsPath = 'm/12381/3600/0/0/0';
     const summaries = [];
     const validators = await Promise.all(Array.from({
         length: validatorCount
@@ -191,7 +213,7 @@ export function maybePrintJson(log, jsonFlag, obj) {
             continue;
         }
         const pub = await computeBlsPublicKeyCompressed(blsKey);
-        const path = 'm/12381/3600/0/0/0';
+        const path = options.blsPath ?? defaultBlsPath;
         const fileBase = `${String(i + 1)}_${pub.slice(2, 18)}`;
         const keystorePath = await writeBn254BlsKeystore(options.outDir, fileBase, options.password, blsKey, pub, path);
         if (typeof att === 'object') {

package/dest/cmds/validator_keys/staker.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"staker.d.ts","sourceRoot":"","sources":["../../../src/cmds/validator_keys/staker.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAuB,MAAM,iBAAiB,CAAC;AAGnE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,+BAA+B,CAAC;AAEhE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAEnD,OAAO,KAAK,EAEV,gBAAgB,EAKjB,MAAM,4BAA4B,CAAC;AAOpC,MAAM,MAAM,aAAa,GAAG;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,UAAU,CAAC;IACvB,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,YAAY,GAAG;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE;QACX,CAAC,EAAE,MAAM,CAAC;QACV,CAAC,EAAE,MAAM,CAAC;KACX,CAAC;IACF,WAAW,EAAE;QACX,EAAE,EAAE,MAAM,CAAC;QACX,EAAE,EAAE,MAAM,CAAC;QACX,EAAE,EAAE,MAAM,CAAC;QACX,EAAE,EAAE,MAAM,CAAC;KACZ,CAAC;IACF,iBAAiB,EAAE;QACjB,CAAC,EAAE,MAAM,CAAC;QACV,CAAC,EAAE,MAAM,CAAC;KACX,CAAC;CACH,CAAC;AA2KF;;GAEG;AACH,wBAAsB,uBAAuB,CAC3C,gBAAgB,EAAE,gBAAgB,EAClC,GAAG,EAAE,WAAW,EAChB,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,YAAY,EAAE,CAAC,CAqBzB;AAED;;GAEG;AACH,wBAAsB,kBAAkB,CAAC,OAAO,EAAE,aAAa,EAAE,GAAG,EAAE,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CA8C1F"}
+{"version":3,"file":"staker.d.ts","sourceRoot":"","sources":["../../../src/cmds/validator_keys/staker.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAuB,MAAM,iBAAiB,CAAC;AAGnE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,+BAA+B,CAAC;AAEhE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAEnD,OAAO,KAAK,EAEV,gBAAgB,EAKjB,MAAM,4BAA4B,CAAC;AAQpC,MAAM,MAAM,aAAa,GAAG;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,UAAU,CAAC;IACvB,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,YAAY,GAAG;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE;QACX,CAAC,EAAE,MAAM,CAAC;QACV,CAAC,EAAE,MAAM,CAAC;KACX,CAAC;IACF,WAAW,EAAE;QACX,EAAE,EAAE,MAAM,CAAC;QACX,EAAE,EAAE,MAAM,CAAC;QACX,EAAE,EAAE,MAAM,CAAC;QACX,EAAE,EAAE,MAAM,CAAC;KACZ,CAAC;IACF,iBAAiB,EAAE;QACjB,CAAC,EAAE,MAAM,CAAC;QACV,CAAC,EAAE,MAAM,CAAC;KACX,CAAC;CACH,CAAC;AA2KF;;GAEG;AACH,wBAAsB,uBAAuB,CAC3C,gBAAgB,EAAE,gBAAgB,EAClC,GAAG,EAAE,WAAW,EAChB,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,YAAY,EAAE,CAAC,CAqBzB;AAED;;GAEG;AACH,wBAAsB,kBAAkB,CAAC,OAAO,EAAE,aAAa,EAAE,GAAG,EAAE,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CA+C1F"}

package/dest/cmds/validator_keys/staker.js

@@ -6,6 +6,7 @@ import { Fr } from '@aztec/foundation/fields';
 import { loadKeystoreFile } from '@aztec/node-keystore/loader';
 import { Wallet } from '@ethersproject/wallet';
 import { readFileSync, writeFileSync } from 'fs';
+import { basename, dirname, join } from 'path';
 import { createPublicClient, fallback, http } from 'viem';
 import { privateKeyToAddress } from 'viem/accounts';
 /**
@@ -186,21 +187,21 @@ import { privateKeyToAddress } from 'viem/accounts';
         transport: fallback(l1RpcUrls.map((url)=>http(url)))
     });
     const gse = new GSEContract(publicClient, gseAddress);
-    // Process each validator
-    for (const validator of keystore.validators){
+    const keystoreBaseName = basename(from, '.json');
+    const outputDir = output ? output : dirname(from);
+    for(let i = 0; i < keystore.validators.length; i++){
+        const validator = keystore.validators[i];
         const outputs = await processAttesterAccounts(validator.attester, gse, password);
-        allOutputs.push(...outputs);
+        for(let j = 0; j < outputs.length; j++){
+            allOutputs.push(outputs[j]);
+        }
     }
     if (allOutputs.length === 0) {
         log('No attesters with BLS keys found (skipping mnemonics and encrypted keystores without password)');
         return;
     }
-    const jsonOutput = prettyPrintJSON(allOutputs);
-    // Write to file if output is specified, otherwise log to stdout
-    if (output) {
-        writeFileSync(output, jsonOutput, 'utf-8');
-        log(`Wrote staking data to ${output}`);
-    } else {
-        log(jsonOutput);
-    }
+    // Write a single JSON file with all staker outputs
+    const stakerOutputPath = join(outputDir, `${keystoreBaseName}_staker_output.json`);
+    writeFileSync(stakerOutputPath, prettyPrintJSON(allOutputs), 'utf-8');
+    log(`Wrote staker output for ${allOutputs.length} validator(s) to ${stakerOutputPath}`);
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aztec/cli",
-  "version": "3.0.0-nightly.20251118",
+  "version": "3.0.0-nightly.20251119",
   "type": "module",
   "exports": {
     "./contracts": "./dest/cmds/contracts/index.js",
@@ -71,21 +71,21 @@
     ]
   },
   "dependencies": {
-    "@aztec/accounts": "3.0.0-nightly.20251118",
-    "@aztec/archiver": "3.0.0-nightly.20251118",
-    "@aztec/aztec.js": "3.0.0-nightly.20251118",
-    "@aztec/constants": "3.0.0-nightly.20251118",
-    "@aztec/entrypoints": "3.0.0-nightly.20251118",
-    "@aztec/ethereum": "3.0.0-nightly.20251118",
-    "@aztec/foundation": "3.0.0-nightly.20251118",
-    "@aztec/l1-artifacts": "3.0.0-nightly.20251118",
-    "@aztec/node-keystore": "3.0.0-nightly.20251118",
-    "@aztec/node-lib": "3.0.0-nightly.20251118",
-    "@aztec/p2p": "3.0.0-nightly.20251118",
-    "@aztec/protocol-contracts": "3.0.0-nightly.20251118",
-    "@aztec/stdlib": "3.0.0-nightly.20251118",
-    "@aztec/test-wallet": "3.0.0-nightly.20251118",
-    "@aztec/world-state": "3.0.0-nightly.20251118",
+    "@aztec/accounts": "3.0.0-nightly.20251119",
+    "@aztec/archiver": "3.0.0-nightly.20251119",
+    "@aztec/aztec.js": "3.0.0-nightly.20251119",
+    "@aztec/constants": "3.0.0-nightly.20251119",
+    "@aztec/entrypoints": "3.0.0-nightly.20251119",
+    "@aztec/ethereum": "3.0.0-nightly.20251119",
+    "@aztec/foundation": "3.0.0-nightly.20251119",
+    "@aztec/l1-artifacts": "3.0.0-nightly.20251119",
+    "@aztec/node-keystore": "3.0.0-nightly.20251119",
+    "@aztec/node-lib": "3.0.0-nightly.20251119",
+    "@aztec/p2p": "3.0.0-nightly.20251119",
+    "@aztec/protocol-contracts": "3.0.0-nightly.20251119",
+    "@aztec/stdlib": "3.0.0-nightly.20251119",
+    "@aztec/test-wallet": "3.0.0-nightly.20251119",
+    "@aztec/world-state": "3.0.0-nightly.20251119",
     "@ethersproject/wallet": "^5.8.0",
     "@iarna/toml": "^2.2.5",
     "@libp2p/peer-id-factory": "^3.0.4",
@@ -99,9 +99,9 @@
     "viem": "npm:@spalladino/viem@2.38.2-eip7594.0"
   },
   "devDependencies": {
-    "@aztec/aztec-node": "3.0.0-nightly.20251118",
-    "@aztec/kv-store": "3.0.0-nightly.20251118",
-    "@aztec/telemetry-client": "3.0.0-nightly.20251118",
+    "@aztec/aztec-node": "3.0.0-nightly.20251119",
+    "@aztec/kv-store": "3.0.0-nightly.20251119",
+    "@aztec/telemetry-client": "3.0.0-nightly.20251119",
     "@jest/globals": "^30.0.0",
     "@types/jest": "^30.0.0",
     "@types/lodash.chunk": "^4.2.9",
@@ -117,20 +117,21 @@
     "typescript": "^5.3.3"
   },
   "peerDependencies": {
-    "@aztec/accounts": "3.0.0-nightly.20251118",
-    "@aztec/bb-prover": "3.0.0-nightly.20251118",
-    "@aztec/ethereum": "3.0.0-nightly.20251118",
-    "@aztec/l1-artifacts": "3.0.0-nightly.20251118",
-    "@aztec/noir-contracts.js": "3.0.0-nightly.20251118",
-    "@aztec/noir-protocol-circuits-types": "3.0.0-nightly.20251118",
-    "@aztec/noir-test-contracts.js": "3.0.0-nightly.20251118",
-    "@aztec/protocol-contracts": "3.0.0-nightly.20251118",
-    "@aztec/stdlib": "3.0.0-nightly.20251118"
+    "@aztec/accounts": "3.0.0-nightly.20251119",
+    "@aztec/bb-prover": "3.0.0-nightly.20251119",
+    "@aztec/ethereum": "3.0.0-nightly.20251119",
+    "@aztec/l1-artifacts": "3.0.0-nightly.20251119",
+    "@aztec/noir-contracts.js": "3.0.0-nightly.20251119",
+    "@aztec/noir-protocol-circuits-types": "3.0.0-nightly.20251119",
+    "@aztec/noir-test-contracts.js": "3.0.0-nightly.20251119",
+    "@aztec/protocol-contracts": "3.0.0-nightly.20251119",
+    "@aztec/stdlib": "3.0.0-nightly.20251119"
   },
   "files": [
     "dest",
     "src",
-    "!*.test.*"
+    "!*.test.*",
+    "public_include_metric_prefixes.json"
   ],
   "types": "./dest/index.d.ts",
   "engines": {

package/public_include_metric_prefixes.json

@@ -0,0 +1 @@
+["aztec.validator", "aztec.tx_collector", "aztec.mempool", "aztec.p2p.gossip.agg_", "aztec.ivc_verifier.agg_"]

package/src/cmds/validator_keys/add.ts

@@ -12,6 +12,7 @@ import {
   buildValidatorEntries,
   logValidatorSummaries,
   maybePrintJson,
+  validateBlsPathOptions,
   writeBlsBn254ToFile,
   writeEthJsonV3ToFile,
   writeKeystoreFile,
@@ -20,6 +21,9 @@ import {
 export type AddValidatorKeysOptions = NewValidatorKeystoreOptions;
 
 export async function addValidatorKeys(existing: string, options: AddValidatorKeysOptions, log: LogFn) {
+  // validate bls-path inputs before proceeding with key generation
+  validateBlsPathOptions(options);
+
   const {
     dataDir,
     file,
@@ -36,7 +40,7 @@ export async function addValidatorKeys(existing: string, options: AddValidatorKe
     fundingAccount: fundingAccountOpt,
     remoteSigner: remoteSignerOpt,
     password,
-    outDir,
+    encryptedKeystoreDir,
   } = options;
 
   const validatorCount = typeof count === 'number' && Number.isFinite(count) && count > 0 ? Math.floor(count) : 1;
@@ -84,10 +88,16 @@ export async function addValidatorKeys(existing: string, options: AddValidatorKe
 
   // If password provided, write ETH JSON V3 and BLS BN254 keystores and replace plaintext
   if (password !== undefined) {
-    const targetDir =
-      outDir && outDir.length > 0 ? outDir : dataDir && dataDir.length > 0 ? dataDir : dirname(existing);
+    let targetDir: string;
+    if (encryptedKeystoreDir && encryptedKeystoreDir.length > 0) {
+      targetDir = encryptedKeystoreDir;
+    } else if (dataDir && dataDir.length > 0) {
+      targetDir = dataDir;
+    } else {
+      targetDir = dirname(existing);
+    }
     await writeEthJsonV3ToFile(keystore.validators, { outDir: targetDir, password });
-    await writeBlsBn254ToFile(keystore.validators, { outDir: targetDir, password });
+    await writeBlsBn254ToFile(keystore.validators, { outDir: targetDir, password, blsPath });
   }
 
   let outputPath = existing;

package/src/cmds/validator_keys/generate_bls_keypair.ts

@@ -3,7 +3,7 @@ import type { LogFn } from '@aztec/foundation/log';
 
 import { writeFile } from 'fs/promises';
 
-import { computeBlsPublicKeyCompressed, withValidatorIndex } from './shared.js';
+import { computeBlsPublicKeyCompressed, defaultBlsPath, withValidatorIndex } from './shared.js';
 
 export type GenerateBlsKeypairOptions = {
   mnemonic?: string;
@@ -17,7 +17,7 @@ export type GenerateBlsKeypairOptions = {
 
 export async function generateBlsKeypair(options: GenerateBlsKeypairOptions, log: LogFn) {
   const { mnemonic, ikm, blsPath, compressed = true, json, out } = options;
-  const path = withValidatorIndex(blsPath ?? 'm/12381/3600/0/0/0', 0);
+  const path = withValidatorIndex(blsPath ?? defaultBlsPath, 0);
   const priv = deriveBlsPrivateKey(mnemonic, ikm, path);
   const pub = await computeBlsPublicKeyCompressed(priv);
   const result = { path, privateKey: priv, publicKey: pub, format: compressed ? 'compressed' : 'uncompressed' };

package/src/cmds/validator_keys/index.ts

@@ -3,6 +3,7 @@ import type { LogFn } from '@aztec/foundation/log';
 import { Command } from 'commander';
 
 import { parseAztecAddress, parseEthereumAddress, parseHex, parseOptionalInteger } from '../../utils/commands.js';
+import { defaultBlsPath } from './shared.js';
 
 export function injectCommands(program: Command, log: LogFn) {
   const group = program
@@ -22,20 +23,20 @@ export function injectCommands(program: Command, log: LogFn) {
     )
     .option('--mnemonic <mnemonic>', 'Mnemonic for ETH/BLS derivation')
     .option('--passphrase <str>', 'Optional passphrase for mnemonic')
-    .option('--account-index <N>', 'Base account index for ETH derivation', parseOptionalInteger)
-    .option('--address-index <N>', 'Base address index for ETH derivation', parseOptionalInteger)
+    .option('--account-index <N>', 'Base account index for ETH/BLS derivation', parseOptionalInteger)
+    .option('--address-index <N>', 'Base address index for ETH/BLS derivation', parseOptionalInteger)
     .option('--coinbase <address>', 'Coinbase ETH address to use when proposing', parseEthereumAddress)
     .option('--funding-account <address>', 'ETH account to fund publishers', parseEthereumAddress)
     .option('--remote-signer <url>', 'Default remote signer URL for accounts in this file')
     .option('--ikm <hex>', 'Initial keying material for BLS (alternative to mnemonic)', value => parseHex(value, 32))
-    .option('--bls-path <path>', 'EIP-2334 path (default m/12381/3600/0/0/0)')
+    .option('--bls-path <path>', `EIP-2334 path (default ${defaultBlsPath})`)
     .option(
       '--password <str>',
       'Password for writing keystore files (ETH JSON V3 and BLS EIP-2335). Empty string allowed',
     )
-    .option('--out-dir <dir>', 'Output directory for generated keystore file(s)')
+    .option('--encrypted-keystore-dir <dir>', 'Output directory for encrypted keystore file(s)')
     .option('--json', 'Echo resulting JSON to stdout')
-    .option('--staker-output', 'Generate staker output JSON files for each attester')
+    .option('--staker-output', 'Generate a single staker output JSON file with an array of validator entries')
     .option('--gse-address <address>', 'GSE contract address (required with --staker-output)', parseEthereumAddress)
     .option('--l1-rpc-urls <urls>', 'L1 RPC URLs (comma-separated, required with --staker-output)', value =>
       value.split(','),
@@ -49,6 +50,7 @@ export function injectCommands(program: Command, log: LogFn) {
     .requiredOption('--fee-recipient <address>', 'Aztec address that will receive fees', parseAztecAddress)
     .action(async options => {
       const { newValidatorKeystore } = await import('./new.js');
+
       await newValidatorKeystore(options, log);
     });
 
@@ -57,27 +59,27 @@ export function injectCommands(program: Command, log: LogFn) {
     .summary('Augment an existing validator keystore JSON')
     .description('Adds attester/publisher/BLS entries to an existing keystore using the same flags as new')
     .argument('<existing>', 'Path to existing keystore JSON')
-    .option('--data-dir <path>', 'Directory where keystore(s) live')
-    .option('--file <name>', 'Override output file name')
-    .option('--count <N>', 'Number of validators to add', parseOptionalInteger)
+    .option('--data-dir <path>', 'Directory where keystore(s) live. (default: ~/.aztec/keystore)')
+    .option('--file <name>', 'Override output file name. (default: key<N>.json)')
+    .option('--count <N>', 'Number of validators to add. (default: 1)', parseOptionalInteger)
     .option('--publisher-count <N>', 'Number of publisher accounts per validator (default 1)', value =>
       parseOptionalInteger(value, 0),
     )
     .option('--mnemonic <mnemonic>', 'Mnemonic for ETH/BLS derivation')
     .option('--passphrase <str>', 'Optional passphrase for mnemonic')
-    .option('--account-index <N>', 'Base account index for ETH derivation', parseOptionalInteger)
-    .option('--address-index <N>', 'Base address index for ETH derivation', parseOptionalInteger)
+    .option('--account-index <N>', 'Base account index for ETH/BLS derivation', parseOptionalInteger)
+    .option('--address-index <N>', 'Base address index for ETH/BLS derivation', parseOptionalInteger)
     .option('--coinbase <address>', 'Coinbase ETH address to use when proposing', parseEthereumAddress)
     .option('--funding-account <address>', 'ETH account to fund publishers', parseEthereumAddress)
     .option('--remote-signer <url>', 'Default remote signer URL for accounts in this file')
     .option('--ikm <hex>', 'Initial keying material for BLS (alternative to mnemonic)', value => parseHex(value, 32))
-    .option('--bls-path <path>', 'EIP-2334 path (default m/12381/3600/0/0/0)')
+    .option('--bls-path <path>', `EIP-2334 path (default ${defaultBlsPath})`)
     .option('--empty', 'Generate an empty skeleton without keys')
     .option(
       '--password <str>',
       'Password for writing keystore files (ETH JSON V3 and BLS EIP-2335). Empty string allowed',
     )
-    .option('--out-dir <dir>', 'Output directory for generated keystore file(s)')
+    .option('--encrypted-keystore-dir <dir>', 'Output directory for encrypted keystore file(s)')
     .option('--json', 'Echo resulting JSON to stdout')
     .requiredOption('--fee-recipient <address>', 'Aztec address that will receive fees', parseAztecAddress)
     .action(async (existing: string, options) => {
@@ -110,7 +112,7 @@ export function injectCommands(program: Command, log: LogFn) {
     .description('Generate a BLS keypair with convenience flags')
     .option('--mnemonic <mnemonic>', 'Mnemonic for BLS derivation')
     .option('--ikm <hex>', 'Initial keying material for BLS (alternative to mnemonic)', value => parseHex(value, 32))
-    .option('--bls-path <path>', 'EIP-2334 path (default m/12381/3600/0/0/0)')
+    .option('--bls-path <path>', `EIP-2334 path (default ${defaultBlsPath})`)
     .option('--g2', 'Derive on G2 subgroup')
     .option('--compressed', 'Output compressed public key')
     .option('--json', 'Print JSON output to stdout')

package/src/cmds/validator_keys/new.ts

@@ -15,6 +15,7 @@ import {
   logValidatorSummaries,
   maybePrintJson,
   resolveKeystoreOutputPath,
+  validateBlsPathOptions,
   writeBlsBn254ToFile,
   writeEthJsonV3ToFile,
   writeKeystoreFile,
@@ -34,7 +35,7 @@ export type NewValidatorKeystoreOptions = {
   ikm?: string;
   blsPath?: string;
   password?: string;
-  outDir?: string;
+  encryptedKeystoreDir?: string;
   json?: boolean;
   feeRecipient: AztecAddress;
   coinbase?: EthAddress;
@@ -47,6 +48,9 @@ export type NewValidatorKeystoreOptions = {
 };
 
 export async function newValidatorKeystore(options: NewValidatorKeystoreOptions, log: LogFn) {
+  // validate bls-path inputs before proceeding with key generation
+  validateBlsPathOptions(options);
+
   const {
     dataDir,
     file,
@@ -63,7 +67,7 @@ export async function newValidatorKeystore(options: NewValidatorKeystoreOptions,
     ikm,
     mnemonic: _mnemonic,
     password,
-    outDir,
+    encryptedKeystoreDir,
     stakerOutput,
     gseAddress,
     l1RpcUrls,
@@ -101,6 +105,7 @@ export async function newValidatorKeystore(options: NewValidatorKeystoreOptions,
 
   const validatorCount = typeof count === 'number' && Number.isFinite(count) && count > 0 ? Math.floor(count) : 1;
   const { outputPath } = await resolveKeystoreOutputPath(dataDir, file);
+  const keystoreOutDir = dirname(outputPath);
 
   const { validators, summaries } = await buildValidatorEntries({
     validatorCount,
@@ -118,9 +123,10 @@ export async function newValidatorKeystore(options: NewValidatorKeystoreOptions,
 
   // If password provided, write ETH JSON V3 and BLS BN254 keystores and replace plaintext
   if (password !== undefined) {
-    const keystoreOutDir = outDir && outDir.length > 0 ? outDir : dirname(outputPath);
-    await writeEthJsonV3ToFile(validators, { outDir: keystoreOutDir, password });
-    await writeBlsBn254ToFile(validators, { outDir: keystoreOutDir, password });
+    const encryptedKeystoreOutDir =
+      encryptedKeystoreDir && encryptedKeystoreDir.length > 0 ? encryptedKeystoreDir : keystoreOutDir;
+    await writeEthJsonV3ToFile(validators, { outDir: encryptedKeystoreOutDir, password });
+    await writeBlsBn254ToFile(validators, { outDir: encryptedKeystoreOutDir, password });
   }
 
   const keystore = {
@@ -140,7 +146,6 @@ export async function newValidatorKeystore(options: NewValidatorKeystoreOptions,
     });
     const gse = new GSEContract(publicClient, gseAddress);
 
-    const keystoreOutDir = outDir && outDir.length > 0 ? outDir : dirname(outputPath);
     // Extract keystore base name without extension for unique staker output filenames
     const keystoreBaseName = basename(outputPath, '.json');
 
@@ -149,17 +154,17 @@ export async function newValidatorKeystore(options: NewValidatorKeystoreOptions,
       const validator = validators[i];
       const outputs = await processAttesterAccounts(validator.attester, gse, password);
 
-      // Save each attester's staker output
+      // Collect all staker outputs
       for (let j = 0; j < outputs.length; j++) {
-        const attesterIndex = i + 1;
-        const stakerOutputPath = join(
-          keystoreOutDir,
-          `${keystoreBaseName}_attester${attesterIndex}_staker_output.json`,
-        );
-        await writeFile(stakerOutputPath, prettyPrintJSON(outputs[j]), 'utf-8');
         allStakerOutputs.push(outputs[j]);
       }
     }
+
+    // Write a single JSON file with all staker outputs
+    if (allStakerOutputs.length > 0) {
+      const stakerOutputPath = join(keystoreOutDir, `${keystoreBaseName}_staker_output.json`);
+      await writeFile(stakerOutputPath, prettyPrintJSON(allStakerOutputs), 'utf-8');
+    }
   }
 
   const outputData = !_mnemonic ? { ...keystore, generatedMnemonic: mnemonic } : keystore;
@@ -178,8 +183,9 @@ export async function newValidatorKeystore(options: NewValidatorKeystoreOptions,
   } else {
     log(`Wrote validator keystore to ${outputPath}`);
     if (stakerOutput && allStakerOutputs.length > 0) {
-      const keystoreOutDir = outDir && outDir.length > 0 ? outDir : dirname(outputPath);
-      log(`Wrote ${allStakerOutputs.length} staker output file(s) to ${keystoreOutDir}`);
+      const keystoreBaseName = basename(outputPath, '.json');
+      const stakerOutputPath = join(keystoreOutDir, `${keystoreBaseName}_staker_output.json`);
+      log(`Wrote staker output for ${allStakerOutputs.length} validator(s) to ${stakerOutputPath}`);
       log('');
     }
   }

package/src/cmds/validator_keys/shared.ts

@@ -29,11 +29,46 @@ export type BuildValidatorsInput = {
   fundingAccount?: EthAddress;
 };
 
+export const defaultBlsPath = 'm/12381/3600/0/0/0';
+
+export function validateBlsPathOptions(options: {
+  count?: number;
+  publisherCount?: number;
+  accountIndex?: number;
+  addressIndex?: number;
+  blsPath?: string;
+  ikm?: string;
+}) {
+  if (options.blsPath && options.blsPath !== defaultBlsPath) {
+    if (
+      (options.count && options.count !== 1) ||
+      (options.publisherCount && options.publisherCount > 0) ||
+      (options.accountIndex && options.accountIndex !== 0) ||
+      (options.addressIndex && options.addressIndex !== 0)
+    ) {
+      throw new Error('--bls-path cannot be used with --count, --publisher-count, --account-index, or --address-index');
+    }
+  }
+}
+
 export function withValidatorIndex(path: string, accountIndex: number = 0, addressIndex: number = 0) {
+  // NOTE: The legacy BLS CLI is to allow users who generated keys in 2.1.4 to be able to use the same command
+  // to re-generate their keys. In 2.1.5 we switched how we append addresses to the path so this is to maintain backwards compatibility.
+  const useLegacyBlsCli = ['true', '1', 'yes', 'y'].includes(process.env.LEGACY_BLS_CLI ?? '');
+
+  const defaultBlsPathParts = defaultBlsPath.split('/');
+
   const parts = path.split('/');
-  if (parts.length == 6 && parts[0] === 'm' && parts[1] === '12381' && parts[2] === '3600') {
-    parts[3] = String(accountIndex);
-    parts[5] = String(addressIndex);
+  if (parts.length == defaultBlsPathParts.length && parts.every((part, index) => part === defaultBlsPathParts[index])) {
+    if (useLegacyBlsCli) {
+      // In 2.1.4, we were using address-index in parts[3] and did NOT use account-index, check lines 32 & 84
+      // https://github.com/AztecProtocol/aztec-packages/blob/v2.1.4/yarn-project/cli/src/cmds/validator_keys/shared.ts
+
+      parts[3] = String(addressIndex);
+    } else {
+      parts[3] = String(accountIndex);
+      parts[5] = String(addressIndex);
+    }
     return parts.join('/');
   }
   return path;
@@ -75,7 +110,6 @@ export async function buildValidatorEntries(input: BuildValidatorsInput) {
     fundingAccount,
   } = input;
 
-  const defaultBlsPath = 'm/12381/3600/0/0/0';
   const summaries: ValidatorSummary[] = [];
 
   const validators = await Promise.all(
@@ -222,7 +256,7 @@ export async function writeBn254BlsKeystore(
 /** Replace plaintext BLS keys in validators with { path, password } pointing to BN254 keystore files. */
 export async function writeBlsBn254ToFile(
   validators: ValidatorKeyStore[],
-  options: { outDir: string; password: string },
+  options: { outDir: string; password: string; blsPath?: string },
 ): Promise<void> {
   for (let i = 0; i < validators.length; i++) {
     const v = validators[i];
@@ -238,7 +272,7 @@ export async function writeBlsBn254ToFile(
     }
 
     const pub = await computeBlsPublicKeyCompressed(blsKey);
-    const path = 'm/12381/3600/0/0/0';
+    const path = options.blsPath ?? defaultBlsPath;
     const fileBase = `${String(i + 1)}_${pub.slice(2, 18)}`;
     const keystorePath = await writeBn254BlsKeystore(options.outDir, fileBase, options.password, blsKey, pub, path);
 

package/src/cmds/validator_keys/staker.ts

@@ -17,6 +17,7 @@ import type {
 
 import { Wallet } from '@ethersproject/wallet';
 import { readFileSync, writeFileSync } from 'fs';
+import { basename, dirname, join } from 'path';
 import { createPublicClient, fallback, http } from 'viem';
 import { privateKeyToAddress } from 'viem/accounts';
 
@@ -275,10 +276,16 @@ export async function generateStakerJson(options: StakerOptions, log: LogFn): Pr
   });
   const gse = new GSEContract(publicClient, gseAddress);
 
-  // Process each validator
-  for (const validator of keystore.validators) {
+  const keystoreBaseName = basename(from, '.json');
+  const outputDir = output ? output : dirname(from);
+
+  for (let i = 0; i < keystore.validators.length; i++) {
+    const validator = keystore.validators[i];
     const outputs = await processAttesterAccounts(validator.attester, gse, password);
-    allOutputs.push(...outputs);
+
+    for (let j = 0; j < outputs.length; j++) {
+      allOutputs.push(outputs[j]);
+    }
   }
 
   if (allOutputs.length === 0) {
@@ -286,13 +293,8 @@ export async function generateStakerJson(options: StakerOptions, log: LogFn): Pr
     return;
   }
 
-  const jsonOutput = prettyPrintJSON(allOutputs);
-
-  // Write to file if output is specified, otherwise log to stdout
-  if (output) {
-    writeFileSync(output, jsonOutput, 'utf-8');
-    log(`Wrote staking data to ${output}`);
-  } else {
-    log(jsonOutput);
-  }
+  // Write a single JSON file with all staker outputs
+  const stakerOutputPath = join(outputDir, `${keystoreBaseName}_staker_output.json`);
+  writeFileSync(stakerOutputPath, prettyPrintJSON(allOutputs), 'utf-8');
+  log(`Wrote staker output for ${allOutputs.length} validator(s) to ${stakerOutputPath}`);
 }