@aztec/cli 3.0.0-nightly.20251119 → 3.0.0-nightly.20251121

package/dest/cmds/validator_keys/add.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"add.d.ts","sourceRoot":"","sources":["../../../src/cmds/validator_keys/add.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAQnD,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,UAAU,CAAC;AAW5D,MAAM,MAAM,uBAAuB,GAAG,2BAA2B,CAAC;AAElE,wBAAsB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,uBAAuB,EAAE,GAAG,EAAE,KAAK,iBAkGpG"}
+{"version":3,"file":"add.d.ts","sourceRoot":"","sources":["../../../src/cmds/validator_keys/add.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAQnD,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,UAAU,CAAC;AAW5D,MAAM,MAAM,uBAAuB,GAAG,2BAA2B,CAAC;AAElE,wBAAsB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,uBAAuB,EAAE,GAAG,EAAE,KAAK,iBAoGpG"}

package/dest/cmds/validator_keys/add.js

@@ -2,11 +2,16 @@ import { loadKeystoreFile } from '@aztec/node-keystore/loader';
 import { wordlist } from '@scure/bip39/wordlists/english.js';
 import { dirname, isAbsolute, join } from 'path';
 import { generateMnemonic } from 'viem/accounts';
-import { buildValidatorEntries, logValidatorSummaries, maybePrintJson, validateBlsPathOptions, writeBlsBn254ToFile, writeEthJsonV3ToFile, writeKeystoreFile } from './shared.js';
+import { buildValidatorEntries, logValidatorSummaries, maybePrintJson, writeBlsBn254ToFile, writeEthJsonV3ToFile, writeKeystoreFile } from './shared.js';
+import { validateBlsPathOptions, validatePublisherOptions, validateRemoteSignerOptions } from './utils.js';
 export async function addValidatorKeys(existing, options, log) {
     // validate bls-path inputs before proceeding with key generation
     validateBlsPathOptions(options);
-    const { dataDir, file, count, publisherCount = 0, mnemonic, accountIndex = 0, addressIndex, ikm, blsPath, json, feeRecipient: feeRecipientOpt, coinbase: coinbaseOpt, fundingAccount: fundingAccountOpt, remoteSigner: remoteSignerOpt, password, encryptedKeystoreDir } = options;
+    // validate publisher options
+    validatePublisherOptions(options);
+    // validate remote signer options
+    validateRemoteSignerOptions(options);
+    const { dataDir, file, count, publisherCount = 0, publishers, mnemonic, accountIndex = 0, addressIndex, ikm, blsPath, json, feeRecipient: feeRecipientOpt, coinbase: coinbaseOpt, remoteSigner: remoteSignerOpt, password, encryptedKeystoreDir } = options;
     const validatorCount = typeof count === 'number' && Number.isFinite(count) && count > 0 ? Math.floor(count) : 1;
     const baseAddressIndex = addressIndex ?? 0;
     const keystore = loadKeystoreFile(existing);
@@ -19,7 +24,6 @@ export async function addValidatorKeys(existing, options, log) {
         throw new Error('feeRecipient is required (either present in existing file or via --fee-recipient)');
     }
     const coinbase = coinbaseOpt ?? first.coinbase;
-    const fundingAccount = fundingAccountOpt ?? first.fundingAccount;
     const derivedRemoteSigner = first.attester?.remoteSignerUrl || first.attester?.eth?.remoteSignerUrl;
     const remoteSigner = remoteSignerOpt ?? derivedRemoteSigner;
     // Ensure we always have a mnemonic for key derivation if none was provided
@@ -29,6 +33,7 @@ export async function addValidatorKeys(existing, options, log) {
     const { validators, summaries } = await buildValidatorEntries({
         validatorCount,
         publisherCount,
+        publishers,
         accountIndex,
         baseAddressIndex: effectiveBaseAddressIndex,
         mnemonic: mnemonicToUse,
@@ -36,8 +41,7 @@ export async function addValidatorKeys(existing, options, log) {
         blsPath,
         feeRecipient,
         coinbase,
-        remoteSigner,
-        fundingAccount
+        remoteSigner
     });
     keystore.validators.push(...validators);
     // If password provided, write ETH JSON V3 and BLS BN254 keystores and replace plaintext

package/dest/cmds/validator_keys/generate_bls_keypair.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"generate_bls_keypair.d.ts","sourceRoot":"","sources":["../../../src/cmds/validator_keys/generate_bls_keypair.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAMnD,MAAM,MAAM,yBAAyB,GAAG;IACtC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,EAAE,CAAC,EAAE,OAAO,CAAC;IACb,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,wBAAsB,kBAAkB,CAAC,OAAO,EAAE,yBAAyB,EAAE,GAAG,EAAE,KAAK,iBAetF"}
+{"version":3,"file":"generate_bls_keypair.d.ts","sourceRoot":"","sources":["../../../src/cmds/validator_keys/generate_bls_keypair.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAOnD,MAAM,MAAM,yBAAyB,GAAG;IACtC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,EAAE,CAAC,EAAE,OAAO,CAAC;IACb,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,wBAAsB,kBAAkB,CAAC,OAAO,EAAE,yBAAyB,EAAE,GAAG,EAAE,KAAK,iBAetF"}

package/dest/cmds/validator_keys/generate_bls_keypair.js

@@ -1,6 +1,7 @@
 import { deriveBlsPrivateKey } from '@aztec/foundation/crypto';
 import { writeFile } from 'fs/promises';
-import { computeBlsPublicKeyCompressed, defaultBlsPath, withValidatorIndex } from './shared.js';
+import { computeBlsPublicKeyCompressed, withValidatorIndex } from './shared.js';
+import { defaultBlsPath } from './utils.js';
 export async function generateBlsKeypair(options, log) {
     const { mnemonic, ikm, blsPath, compressed = true, json, out } = options;
     const path = withValidatorIndex(blsPath ?? defaultBlsPath, 0);

package/dest/cmds/validator_keys/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/cmds/validator_keys/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAEnD,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAKpC,wBAAgB,cAAc,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,WAsH1D"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/cmds/validator_keys/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAEnD,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAKpC,wBAAgB,cAAc,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,WAsI1D"}

package/dest/cmds/validator_keys/index.js

@@ -1,15 +1,19 @@
 import { parseAztecAddress, parseEthereumAddress, parseHex, parseOptionalInteger } from '../../utils/commands.js';
-import { defaultBlsPath } from './shared.js';
+import { defaultBlsPath } from './utils.js';
 export function injectCommands(program, log) {
     const group = program.command('validator-keys').aliases([
         'valKeys',
         'valkeys'
     ]).description('Manage validator keystores for node operators');
-    group.command('new').summary('Generate a new validator keystore JSON').description('Generates a new validator keystore with ETH secp256k1 accounts and optional BLS accounts').option('--data-dir <path>', 'Directory to store keystore(s). Defaults to ~/.aztec/keystore').option('--file <name>', 'Keystore file name. Defaults to key1.json (or keyN.json if key1.json exists)').option('--count <N>', 'Number of validators to generate', parseOptionalInteger).option('--publisher-count <N>', 'Number of publisher accounts per validator (default 1)', (value)=>parseOptionalInteger(value, 0)).option('--mnemonic <mnemonic>', 'Mnemonic for ETH/BLS derivation').option('--passphrase <str>', 'Optional passphrase for mnemonic').option('--account-index <N>', 'Base account index for ETH/BLS derivation', parseOptionalInteger).option('--address-index <N>', 'Base address index for ETH/BLS derivation', parseOptionalInteger).option('--coinbase <address>', 'Coinbase ETH address to use when proposing', parseEthereumAddress).option('--funding-account <address>', 'ETH account to fund publishers', parseEthereumAddress).option('--remote-signer <url>', 'Default remote signer URL for accounts in this file').option('--ikm <hex>', 'Initial keying material for BLS (alternative to mnemonic)', (value)=>parseHex(value, 32)).option('--bls-path <path>', `EIP-2334 path (default ${defaultBlsPath})`).option('--password <str>', 'Password for writing keystore files (ETH JSON V3 and BLS EIP-2335). Empty string allowed').option('--encrypted-keystore-dir <dir>', 'Output directory for encrypted keystore file(s)').option('--json', 'Echo resulting JSON to stdout').option('--staker-output', 'Generate a single staker output JSON file with an array of validator entries').option('--gse-address <address>', 'GSE contract address (required with --staker-output)', parseEthereumAddress).option('--l1-rpc-urls <urls>', 'L1 RPC URLs (comma-separated, required with --staker-output)', (value)=>value.split(',')).option('-c, --l1-chain-id <number>', 'L1 chain ID (required with --staker-output)', (value)=>parseInt(value), 31337).requiredOption('--fee-recipient <address>', 'Aztec address that will receive fees', parseAztecAddress).action(async (options)=>{
+    group.command('new').summary('Generate a new validator keystore JSON').description('Generates a new validator keystore with ETH secp256k1 accounts and optional BLS accounts').option('--data-dir <path>', 'Directory to store keystore(s). Defaults to ~/.aztec/keystore').option('--file <name>', 'Keystore file name. Defaults to key1.json (or keyN.json if key1.json exists)').option('--count <N>', 'Number of validators to generate', parseOptionalInteger).option('--publisher-count <N>', 'Number of publisher accounts per validator (default 0)', (value)=>parseOptionalInteger(value, 0)).option('--publishers <privateKeys>', 'Comma-separated list of publisher private keys for all validators.', (value)=>value.split(',').map((key)=>key.trim())).option('--mnemonic <mnemonic>', 'Mnemonic for ETH/BLS derivation').option('--passphrase <str>', 'Optional passphrase for mnemonic').option('--account-index <N>', 'Base account index for ETH/BLS derivation', parseOptionalInteger).option('--address-index <N>', 'Base address index for ETH/BLS derivation', parseOptionalInteger).option('--coinbase <address>', 'Coinbase ETH address to use when proposing. Defaults to attester address.', parseEthereumAddress)// TODO: add funding account back in when implemented
+    // .option('--funding-account <privateKey|address>', 'ETH private key (or address for remote signer setup) to fund publishers')
+    .option('--remote-signer <url>', 'Default remote signer URL for accounts in this file').option('--ikm <hex>', 'Initial keying material for BLS (alternative to mnemonic)', (value)=>parseHex(value, 32)).option('--bls-path <path>', `EIP-2334 path (default ${defaultBlsPath})`).option('--password <str>', 'Password for writing keystore files (ETH JSON V3 and BLS EIP-2335). Empty string allowed').option('--encrypted-keystore-dir <dir>', 'Output directory for encrypted keystore file(s)').option('--json', 'Echo resulting JSON to stdout').option('--staker-output', 'Generate a single staker output JSON file with an array of validator entries').option('--gse-address <address>', 'GSE contract address (required with --staker-output)', parseEthereumAddress).option('--l1-rpc-urls <urls>', 'L1 RPC URLs (comma-separated, required with --staker-output)', (value)=>value.split(',')).option('-c, --l1-chain-id <number>', 'L1 chain ID (required with --staker-output)', (value)=>parseInt(value), 31337).requiredOption('--fee-recipient <address>', 'Aztec address that will receive fees', parseAztecAddress).action(async (options)=>{
         const { newValidatorKeystore } = await import('./new.js');
         await newValidatorKeystore(options, log);
     });
-    group.command('add').summary('Augment an existing validator keystore JSON').description('Adds attester/publisher/BLS entries to an existing keystore using the same flags as new').argument('<existing>', 'Path to existing keystore JSON').option('--data-dir <path>', 'Directory where keystore(s) live. (default: ~/.aztec/keystore)').option('--file <name>', 'Override output file name. (default: key<N>.json)').option('--count <N>', 'Number of validators to add. (default: 1)', parseOptionalInteger).option('--publisher-count <N>', 'Number of publisher accounts per validator (default 1)', (value)=>parseOptionalInteger(value, 0)).option('--mnemonic <mnemonic>', 'Mnemonic for ETH/BLS derivation').option('--passphrase <str>', 'Optional passphrase for mnemonic').option('--account-index <N>', 'Base account index for ETH/BLS derivation', parseOptionalInteger).option('--address-index <N>', 'Base address index for ETH/BLS derivation', parseOptionalInteger).option('--coinbase <address>', 'Coinbase ETH address to use when proposing', parseEthereumAddress).option('--funding-account <address>', 'ETH account to fund publishers', parseEthereumAddress).option('--remote-signer <url>', 'Default remote signer URL for accounts in this file').option('--ikm <hex>', 'Initial keying material for BLS (alternative to mnemonic)', (value)=>parseHex(value, 32)).option('--bls-path <path>', `EIP-2334 path (default ${defaultBlsPath})`).option('--empty', 'Generate an empty skeleton without keys').option('--password <str>', 'Password for writing keystore files (ETH JSON V3 and BLS EIP-2335). Empty string allowed').option('--encrypted-keystore-dir <dir>', 'Output directory for encrypted keystore file(s)').option('--json', 'Echo resulting JSON to stdout').requiredOption('--fee-recipient <address>', 'Aztec address that will receive fees', parseAztecAddress).action(async (existing, options)=>{
+    group.command('add').summary('Augment an existing validator keystore JSON').description('Adds attester/publisher/BLS entries to an existing keystore using the same flags as new').argument('<existing>', 'Path to existing keystore JSON').option('--data-dir <path>', 'Directory where keystore(s) live. (default: ~/.aztec/keystore)').option('--file <name>', 'Override output file name. (default: key<N>.json)').option('--count <N>', 'Number of validators to add. (default: 1)', parseOptionalInteger).option('--publisher-count <N>', 'Number of publisher accounts per validator (default 0)', (value)=>parseOptionalInteger(value, 0)).option('--publishers <privateKeys>', 'Comma-separated list of publisher private keys for all validators.', (value)=>value.split(',').map((key)=>key.trim())).option('--mnemonic <mnemonic>', 'Mnemonic for ETH/BLS derivation').option('--passphrase <str>', 'Optional passphrase for mnemonic').option('--account-index <N>', 'Base account index for ETH/BLS derivation', parseOptionalInteger).option('--address-index <N>', 'Base address index for ETH/BLS derivation', parseOptionalInteger).option('--coinbase <address>', 'Coinbase ETH address to use when proposing. Defaults to attester address.', parseEthereumAddress)// TODO: add funding account back in when implemented
+    // .option('--funding-account <privateKey|address>', 'ETH private key (or address for remote signer setup) to fund publishers')
+    .option('--remote-signer <url>', 'Default remote signer URL for accounts in this file').option('--ikm <hex>', 'Initial keying material for BLS (alternative to mnemonic)', (value)=>parseHex(value, 32)).option('--bls-path <path>', `EIP-2334 path (default ${defaultBlsPath})`).option('--empty', 'Generate an empty skeleton without keys').option('--password <str>', 'Password for writing keystore files (ETH JSON V3 and BLS EIP-2335). Empty string allowed').option('--encrypted-keystore-dir <dir>', 'Output directory for encrypted keystore file(s)').option('--json', 'Echo resulting JSON to stdout').requiredOption('--fee-recipient <address>', 'Aztec address that will receive fees', parseAztecAddress).action(async (existing, options)=>{
         const { addValidatorKeys } = await import('./add.js');
         await addValidatorKeys(existing, options, log);
     });

package/dest/cmds/validator_keys/new.d.ts

@@ -6,6 +6,7 @@ export type NewValidatorKeystoreOptions = {
     file?: string;
     count?: number;
     publisherCount?: number;
+    publishers?: string[];
     mnemonic?: string;
     passphrase?: string;
     accountIndex?: number;
@@ -19,7 +20,6 @@ export type NewValidatorKeystoreOptions = {
     feeRecipient: AztecAddress;
     coinbase?: EthAddress;
     remoteSigner?: string;
-    fundingAccount?: EthAddress;
     stakerOutput?: boolean;
     gseAddress?: EthAddress;
     l1RpcUrls?: string[];

package/dest/cmds/validator_keys/new.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"new.d.ts","sourceRoot":"","sources":["../../../src/cmds/validator_keys/new.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,+BAA+B,CAAC;AAChE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AACnD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAoBhE,MAAM,MAAM,2BAA2B,GAAG;IACxC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,YAAY,EAAE,YAAY,CAAC;IAC3B,QAAQ,CAAC,EAAE,UAAU,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,cAAc,CAAC,EAAE,UAAU,CAAC;IAC5B,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,wBAAsB,oBAAoB,CAAC,OAAO,EAAE,2BAA2B,EAAE,GAAG,EAAE,KAAK,iBAoK1F"}
+{"version":3,"file":"new.d.ts","sourceRoot":"","sources":["../../../src/cmds/validator_keys/new.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,+BAA+B,CAAC;AAChE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AACnD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAyBhE,MAAM,MAAM,2BAA2B,GAAG;IACxC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,YAAY,EAAE,YAAY,CAAC;IAC3B,QAAQ,CAAC,EAAE,UAAU,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,wBAAsB,oBAAoB,CAAC,OAAO,EAAE,2BAA2B,EAAE,GAAG,EAAE,KAAK,iBAuJ1F"}

package/dest/cmds/validator_keys/new.js

@@ -5,27 +5,19 @@ import { writeFile } from 'fs/promises';
 import { basename, dirname, join } from 'path';
 import { createPublicClient, fallback, http } from 'viem';
 import { generateMnemonic, mnemonicToAccount } from 'viem/accounts';
-import { buildValidatorEntries, logValidatorSummaries, maybePrintJson, resolveKeystoreOutputPath, validateBlsPathOptions, writeBlsBn254ToFile, writeEthJsonV3ToFile, writeKeystoreFile } from './shared.js';
+import { buildValidatorEntries, logValidatorSummaries, maybePrintJson, resolveKeystoreOutputPath, writeBlsBn254ToFile, writeEthJsonV3ToFile, writeKeystoreFile } from './shared.js';
 import { processAttesterAccounts } from './staker.js';
+import { validateBlsPathOptions, validatePublisherOptions, validateRemoteSignerOptions, validateStakerOutputOptions } from './utils.js';
 export async function newValidatorKeystore(options, log) {
     // validate bls-path inputs before proceeding with key generation
     validateBlsPathOptions(options);
-    const { dataDir, file, count, publisherCount = 0, json, coinbase, accountIndex = 0, addressIndex = 0, feeRecipient, remoteSigner, fundingAccount, blsPath, ikm, mnemonic: _mnemonic, password, encryptedKeystoreDir, stakerOutput, gseAddress, l1RpcUrls, l1ChainId } = options;
-    // Validate staker output requirements
-    if (stakerOutput) {
-        if (!gseAddress) {
-            throw new Error('--gse-address is required when using --staker-output');
-        }
-        if (!l1RpcUrls || l1RpcUrls.length === 0) {
-            throw new Error('--l1-rpc-urls is required when using --staker-output');
-        }
-        if (l1ChainId === undefined) {
-            throw new Error('--l1-chain-id is required when using --staker-output');
-        }
-    }
-    if (remoteSigner && !_mnemonic) {
-        throw new Error('Using --remote-signer requires a deterministic key source. Provide --mnemonic to derive keys, or omit --remote-signer to write new private keys to keystore.');
-    }
+    // validate staker output options before proceeding with key generation
+    validateStakerOutputOptions(options);
+    // validate publisher options
+    validatePublisherOptions(options);
+    // validate remote signer options
+    validateRemoteSignerOptions(options);
+    const { dataDir, file, count, publisherCount = 0, publishers, json, coinbase, accountIndex = 0, addressIndex = 0, feeRecipient, remoteSigner, blsPath, ikm, mnemonic: _mnemonic, password, encryptedKeystoreDir, stakerOutput, gseAddress, l1RpcUrls, l1ChainId } = options;
     const mnemonic = _mnemonic ?? generateMnemonic(wordlist);
     if (!_mnemonic && !json) {
         log('No mnemonic provided, generating new one...');
@@ -40,6 +32,7 @@ export async function newValidatorKeystore(options, log) {
     const { validators, summaries } = await buildValidatorEntries({
         validatorCount,
         publisherCount,
+        publishers,
         accountIndex,
         baseAddressIndex: addressIndex,
         mnemonic,
@@ -47,8 +40,7 @@ export async function newValidatorKeystore(options, log) {
         blsPath,
         feeRecipient,
         coinbase,
-        remoteSigner,
-        fundingAccount
+        remoteSigner
     });
     // If password provided, write ETH JSON V3 and BLS BN254 keystores and replace plaintext
     if (password !== undefined) {

package/dest/cmds/validator_keys/shared.d.ts

@@ -10,6 +10,7 @@ export type ValidatorSummary = {
 export type BuildValidatorsInput = {
     validatorCount: number;
     publisherCount?: number;
+    publishers?: string[];
     accountIndex: number;
     baseAddressIndex: number;
     mnemonic: string;
@@ -18,17 +19,7 @@ export type BuildValidatorsInput = {
     feeRecipient: AztecAddress;
     coinbase?: EthAddress;
     remoteSigner?: string;
-    fundingAccount?: EthAddress;
 };
-export declare const defaultBlsPath = "m/12381/3600/0/0/0";
-export declare function validateBlsPathOptions(options: {
-    count?: number;
-    publisherCount?: number;
-    accountIndex?: number;
-    addressIndex?: number;
-    blsPath?: string;
-    ikm?: string;
-}): void;
 export declare function withValidatorIndex(path: string, accountIndex?: number, addressIndex?: number): string;
 /**
  * Compute a compressed BN254 G1 public key from a private key.

package/dest/cmds/validator_keys/shared.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"shared.d.ts","sourceRoot":"","sources":["../../../src/cmds/validator_keys/shared.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,+BAA+B,CAAC;AAChE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AACnD,OAAO,KAAK,EAAE,UAAU,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAC/F,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAShE,MAAM,MAAM,gBAAgB,GAAG;IAAE,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC;AAEvG,MAAM,MAAM,oBAAoB,GAAG;IACjC,cAAc,EAAE,MAAM,CAAC;IACvB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,YAAY,EAAE,MAAM,CAAC;IACrB,gBAAgB,EAAE,MAAM,CAAC;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,YAAY,CAAC;IAC3B,QAAQ,CAAC,EAAE,UAAU,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,cAAc,CAAC,EAAE,UAAU,CAAC;CAC7B,CAAC;AAEF,eAAO,MAAM,cAAc,uBAAuB,CAAC;AAEnD,wBAAgB,sBAAsB,CAAC,OAAO,EAAE;IAC9C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,QAWA;AAED,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,GAAE,MAAU,EAAE,YAAY,GAAE,MAAU,UAqBlG;AAED;;;;GAIG;AACH,wBAAsB,6BAA6B,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAE1F;AAED,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,MAAM,EAChB,gBAAgB,EAAE,MAAM,EACxB,YAAY,EAAE,MAAM,EACpB,YAAY,CAAC,EAAE,MAAM,GACpB,UAAU,GAAG,aAAa,CAK5B;AAED,wBAAsB,qBAAqB,CAAC,KAAK,EAAE,oBAAoB;;;GAqEtE;AAED,wBAAsB,yBAAyB,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM;;;GAoB9E;AAED,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,iBAGtE;AAED,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,KAAK,EAAE,SAAS,EAAE,gBAAgB,EAAE,QAsB9E;AAED,wBAAgB,cAAc,CAAC,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,GAAG,SAAS,EAAE,GAAG,EAAE,OAAO,QAIrF;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,qBAAqB,CACzC,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,EAChB,aAAa,EAAE,MAAM,EACrB,SAAS,EAAE,MAAM,EACjB,cAAc,EAAE,MAAM,GACrB,OAAO,CAAC,MAAM,CAAC,CASjB;AAED,yGAAyG;AACzG,wBAAsB,mBAAmB,CACvC,UAAU,EAAE,iBAAiB,EAAE,EAC/B,OAAO,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,GAC9D,OAAO,CAAC,IAAI,CAAC,CAuBf;AAED,8EAA8E;AAC9E,wBAAsB,sBAAsB,CAC1C,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,EAChB,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,MAAM,CAAC,CAQjB;AAED,kGAAkG;AAClG,wBAAsB,oBAAoB,CACxC,UAAU,EAAE,iBAAiB,EAAE,EAC/B,OAAO,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAC5C,OAAO,CAAC,IAAI,CAAC,CA2Cf"}
+{"version":3,"file":"shared.d.ts","sourceRoot":"","sources":["../../../src/cmds/validator_keys/shared.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,+BAA+B,CAAC;AAChE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AACnD,OAAO,KAAK,EAAE,UAAU,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAC/F,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAWhE,MAAM,MAAM,gBAAgB,GAAG;IAAE,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC;AAEvG,MAAM,MAAM,oBAAoB,GAAG;IACjC,cAAc,EAAE,MAAM,CAAC;IACvB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,gBAAgB,EAAE,MAAM,CAAC;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,YAAY,CAAC;IAC3B,QAAQ,CAAC,EAAE,UAAU,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,GAAE,MAAU,EAAE,YAAY,GAAE,MAAU,UAqBlG;AAED;;;;GAIG;AACH,wBAAsB,6BAA6B,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAE1F;AAED,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,MAAM,EAChB,gBAAgB,EAAE,MAAM,EACxB,YAAY,EAAE,MAAM,EACpB,YAAY,CAAC,EAAE,MAAM,GACpB,UAAU,GAAG,aAAa,CAK5B;AAED,wBAAsB,qBAAqB,CAAC,KAAK,EAAE,oBAAoB;;;GAuEtE;AAED,wBAAsB,yBAAyB,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM;;;GAoB9E;AAED,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,iBAGtE;AAED,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,KAAK,EAAE,SAAS,EAAE,gBAAgB,EAAE,QAsB9E;AAED,wBAAgB,cAAc,CAAC,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,GAAG,SAAS,EAAE,GAAG,EAAE,OAAO,QAIrF;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,qBAAqB,CACzC,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,EAChB,aAAa,EAAE,MAAM,EACrB,SAAS,EAAE,MAAM,EACjB,cAAc,EAAE,MAAM,GACrB,OAAO,CAAC,MAAM,CAAC,CASjB;AAED,yGAAyG;AACzG,wBAAsB,mBAAmB,CACvC,UAAU,EAAE,iBAAiB,EAAE,EAC/B,OAAO,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,GAC9D,OAAO,CAAC,IAAI,CAAC,CAuBf;AAED,8EAA8E;AAC9E,wBAAsB,sBAAsB,CAC1C,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,EAChB,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,MAAM,CAAC,CAQjB;AAED,kGAAkG;AAClG,wBAAsB,oBAAoB,CACxC,UAAU,EAAE,iBAAiB,EAAE,EAC/B,OAAO,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAC5C,OAAO,CAAC,IAAI,CAAC,CAsCf"}

package/dest/cmds/validator_keys/shared.js

@@ -7,14 +7,7 @@ import { access, writeFile } from 'fs/promises';
 import { homedir } from 'os';
 import { dirname, isAbsolute, join } from 'path';
 import { mnemonicToAccount } from 'viem/accounts';
-export const defaultBlsPath = 'm/12381/3600/0/0/0';
-export function validateBlsPathOptions(options) {
-    if (options.blsPath && options.blsPath !== defaultBlsPath) {
-        if (options.count && options.count !== 1 || options.publisherCount && options.publisherCount > 0 || options.accountIndex && options.accountIndex !== 0 || options.addressIndex && options.addressIndex !== 0) {
-            throw new Error('--bls-path cannot be used with --count, --publisher-count, --account-index, or --address-index');
-        }
-    }
-}
+import { defaultBlsPath } from './utils.js';
 export function withValidatorIndex(path, accountIndex = 0, addressIndex = 0) {
     // NOTE: The legacy BLS CLI is to allow users who generated keys in 2.1.4 to be able to use the same command
     // to re-generate their keys. In 2.1.5 we switched how we append addresses to the path so this is to maintain backwards compatibility.
@@ -57,7 +50,7 @@ export function deriveEthAttester(mnemonic, baseAccountIndex, addressIndex, remo
     } : '0x' + Buffer.from(acct.getHdKey().privateKey).toString('hex');
 }
 export async function buildValidatorEntries(input) {
-    const { validatorCount, publisherCount = 0, accountIndex, baseAddressIndex, mnemonic, ikm, blsPath, feeRecipient, coinbase, remoteSigner, fundingAccount } = input;
+    const { validatorCount, publisherCount = 0, publishers, accountIndex, baseAddressIndex, mnemonic, ikm, blsPath, feeRecipient, coinbase, remoteSigner } = input;
     const summaries = [];
     const validators = await Promise.all(Array.from({
         length: validatorCount
@@ -74,7 +67,10 @@ export async function buildValidatorEntries(input) {
         } : ethAttester;
         let publisherField;
         const publisherAddresses = [];
-        if (publisherCount > 0) {
+        if (publishers && publishers.length > 0) {
+            publisherAddresses.push(...publishers);
+            publisherField = publishers.length === 1 ? publishers[0] : publishers;
+        } else if (publisherCount > 0) {
             const publishersBaseIndex = baseAddressIndex + validatorCount + i * publisherCount;
             const publisherAccounts = Array.from({
                 length: publisherCount
@@ -108,8 +104,7 @@ export async function buildValidatorEntries(input) {
                 publisher: publisherField
             } : {},
             feeRecipient,
-            coinbase,
-            fundingAccount
+            coinbase: coinbase ?? attesterEthAddress
         };
     }));
     return {
@@ -274,9 +269,5 @@ export function maybePrintJson(log, jsonFlag, obj) {
                 v.publisher = await maybeEncryptEth(pub, `publisher_${i + 1}`);
             }
         }
-        // Optional fundingAccount within validator
-        if ('fundingAccount' in v) {
-            v.fundingAccount = await maybeEncryptEth(v.fundingAccount, `funding_${i + 1}`);
-        }
     }
 }

package/dest/cmds/validator_keys/utils.d.ts

@@ -0,0 +1,25 @@
+import type { EthAddress } from '@aztec/foundation/eth-address';
+export declare const defaultBlsPath = "m/12381/3600/0/0/0";
+export declare function validateBlsPathOptions(options: {
+    count?: number;
+    publisherCount?: number;
+    accountIndex?: number;
+    addressIndex?: number;
+    blsPath?: string;
+    ikm?: string;
+}): void;
+export declare function validateStakerOutputOptions(options: {
+    stakerOutput?: boolean;
+    gseAddress?: EthAddress;
+    l1RpcUrls?: string[];
+    l1ChainId?: number;
+}): void;
+export declare function validateRemoteSignerOptions(options: {
+    remoteSigner?: string;
+    mnemonic?: string;
+}): void;
+export declare function validatePublisherOptions(options: {
+    publishers?: string[];
+    publisherCount?: number;
+}): void;
+//# sourceMappingURL=utils.d.ts.map

package/dest/cmds/validator_keys/utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../../../src/cmds/validator_keys/utils.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,+BAA+B,CAAC;AAGhE,eAAO,MAAM,cAAc,uBAAuB,CAAC;AAEnD,wBAAgB,sBAAsB,CAAC,OAAO,EAAE;IAC9C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,QAWA;AAED,wBAAgB,2BAA2B,CAAC,OAAO,EAAE;IACnD,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,QAeA;AAED,wBAAgB,2BAA2B,CAAC,OAAO,EAAE;IAAE,YAAY,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,QAMhG;AAED,wBAAgB,wBAAwB,CAAC,OAAO,EAAE;IAAE,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IAAC,cAAc,CAAC,EAAE,MAAM,CAAA;CAAE,QAwBnG"}

package/dest/cmds/validator_keys/utils.js

@@ -0,0 +1,52 @@
+import { ethPrivateKeySchema } from '@aztec/node-keystore';
+export const defaultBlsPath = 'm/12381/3600/0/0/0';
+export function validateBlsPathOptions(options) {
+    if (options.blsPath && options.blsPath !== defaultBlsPath) {
+        if (options.count && options.count !== 1 || options.publisherCount && options.publisherCount > 0 || options.accountIndex && options.accountIndex !== 0 || options.addressIndex && options.addressIndex !== 0) {
+            throw new Error('--bls-path cannot be used with --count, --publisher-count, --account-index, or --address-index');
+        }
+    }
+}
+export function validateStakerOutputOptions(options) {
+    if (!options.stakerOutput) {
+        return;
+    }
+    // Required options for staker output
+    if (!options.gseAddress) {
+        throw new Error('--gse-address is required when using --staker-output');
+    }
+    if (!options.l1RpcUrls || options.l1RpcUrls.length === 0) {
+        throw new Error('--l1-rpc-urls is required when using --staker-output');
+    }
+    if (options.l1ChainId === undefined) {
+        throw new Error('--l1-chain-id is required when using --staker-output');
+    }
+}
+export function validateRemoteSignerOptions(options) {
+    if (options.remoteSigner && !options.mnemonic) {
+        throw new Error('Using --remote-signer requires a deterministic key source. Provide --mnemonic to derive keys, or omit --remote-signer to write new private keys to keystore.');
+    }
+}
+export function validatePublisherOptions(options) {
+    if (options.publisherCount && options.publisherCount > 0 && options.publishers && options.publishers.length > 0) {
+        throw new Error('--publishers and --publisher-count cannot be used together');
+    }
+    if (options.publishers && options.publishers.length > 0) {
+        // Normalize each private key by adding 0x prefix if missing
+        const normalizedKeys = [];
+        for (const key of options.publishers){
+            let privateKey = key.trim();
+            if (!privateKey.startsWith('0x')) {
+                privateKey = '0x' + privateKey;
+            }
+            try {
+                ethPrivateKeySchema.parse(privateKey);
+                normalizedKeys.push(privateKey);
+            } catch (error) {
+                throw new Error(`Invalid publisher private key: ${error instanceof Error ? error.message : String(error)}`);
+            }
+        }
+        // Update the options with the normalized keys
+        options.publishers = normalizedKeys;
+    }
+}

package/dest/config/network_config.d.ts

@@ -1,7 +1,7 @@
 import { type NetworkConfig, type NetworkNames } from '@aztec/foundation/config';
 /**
  * Fetches remote network configuration from GitHub with caching support.
- * Uses the reusable cachedFetch utility.
+ * Uses the reusable cachedFetch utility. Falls back to metadata.aztec.network if the default URL fails.
  *
  * @param networkName - The network name to fetch config for
  * @param cacheDir - Optional cache directory for storing fetched config

package/dest/config/network_config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"network_config.d.ts","sourceRoot":"","sources":["../../src/config/network_config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,aAAa,EAA0B,KAAK,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAYzG;;;;;;;GAOG;AACH,wBAAsB,gBAAgB,CACpC,WAAW,EAAE,YAAY,EACzB,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC,CAiDpC;AAED;;;;;;GAMG;AACH,wBAAsB,kCAAkC,CAAC,WAAW,EAAE,YAAY,iBAoBjF"}
+{"version":3,"file":"network_config.d.ts","sourceRoot":"","sources":["../../src/config/network_config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,aAAa,EAA0B,KAAK,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAazG;;;;;;;GAOG;AACH,wBAAsB,gBAAgB,CACpC,WAAW,EAAE,YAAY,EACzB,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC,CAapC;AA0DD;;;;;;GAMG;AACH,wBAAsB,kCAAkC,CAAC,WAAW,EAAE,YAAY,iBAoBjF"}

package/dest/config/network_config.js

@@ -4,20 +4,34 @@ import { join } from 'path';
 import { cachedFetch } from './cached_fetch.js';
 import { enrichEthAddressVar, enrichVar } from './enrich_env.js';
 const DEFAULT_CONFIG_URL = 'https://raw.githubusercontent.com/AztecProtocol/networks/refs/heads/main/network_config.json';
+const FALLBACK_CONFIG_URL = 'https://metadata.aztec.network/network_config.json';
 const NETWORK_CONFIG_CACHE_DURATION_MS = 60 * 60 * 1000; // 1 hour
 /**
  * Fetches remote network configuration from GitHub with caching support.
- * Uses the reusable cachedFetch utility.
+ * Uses the reusable cachedFetch utility. Falls back to metadata.aztec.network if the default URL fails.
  *
  * @param networkName - The network name to fetch config for
  * @param cacheDir - Optional cache directory for storing fetched config
  * @returns Remote configuration for the specified network, or undefined if not found/error
  */ export async function getNetworkConfig(networkName, cacheDir) {
-    let url;
+    // Try with the primary URL (env var or default)
     const configLocation = process.env.NETWORK_CONFIG_LOCATION || DEFAULT_CONFIG_URL;
-    if (!configLocation) {
-        return undefined;
+    // First try the primary config location
+    let config = await fetchNetworkConfigFromUrl(configLocation, networkName, cacheDir);
+    // If primary fails and we were using the default URL, try the fallback
+    if (!config && configLocation === DEFAULT_CONFIG_URL) {
+        config = await fetchNetworkConfigFromUrl(FALLBACK_CONFIG_URL, networkName, cacheDir);
     }
+    return config;
+}
+/**
+ * Helper function to fetch network config from a specific URL.
+ * @param configLocation - The URL or file path to fetch from
+ * @param networkName - The network name to fetch config for
+ * @param cacheDir - Optional cache directory for storing fetched config
+ * @returns Remote configuration for the specified network, or undefined if not found/error
+ */ async function fetchNetworkConfigFromUrl(configLocation, networkName, cacheDir) {
+    let url;
     try {
         if (configLocation.includes('://')) {
             url = new URL(configLocation);
@@ -67,7 +81,7 @@ const NETWORK_CONFIG_CACHE_DURATION_MS = 60 * 60 * 1000; // 1 hour
     const cacheDir = process.env.DATA_DIRECTORY ? join(process.env.DATA_DIRECTORY, 'cache') : undefined;
     const networkConfig = await getNetworkConfig(networkName, cacheDir);
     if (!networkConfig) {
-        return;
+        throw new Error(`Failed to fetch network config for network: ${networkName}`);
     }
     enrichVar('BOOTSTRAP_NODES', networkConfig.bootnodes.join(','));
     enrichVar('L1_CHAIN_ID', String(networkConfig.l1ChainId));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aztec/cli",
-  "version": "3.0.0-nightly.20251119",
+  "version": "3.0.0-nightly.20251121",
   "type": "module",
   "exports": {
     "./contracts": "./dest/cmds/contracts/index.js",
@@ -71,21 +71,21 @@
     ]
   },
   "dependencies": {
-    "@aztec/accounts": "3.0.0-nightly.20251119",
-    "@aztec/archiver": "3.0.0-nightly.20251119",
-    "@aztec/aztec.js": "3.0.0-nightly.20251119",
-    "@aztec/constants": "3.0.0-nightly.20251119",
-    "@aztec/entrypoints": "3.0.0-nightly.20251119",
-    "@aztec/ethereum": "3.0.0-nightly.20251119",
-    "@aztec/foundation": "3.0.0-nightly.20251119",
-    "@aztec/l1-artifacts": "3.0.0-nightly.20251119",
-    "@aztec/node-keystore": "3.0.0-nightly.20251119",
-    "@aztec/node-lib": "3.0.0-nightly.20251119",
-    "@aztec/p2p": "3.0.0-nightly.20251119",
-    "@aztec/protocol-contracts": "3.0.0-nightly.20251119",
-    "@aztec/stdlib": "3.0.0-nightly.20251119",
-    "@aztec/test-wallet": "3.0.0-nightly.20251119",
-    "@aztec/world-state": "3.0.0-nightly.20251119",
+    "@aztec/accounts": "3.0.0-nightly.20251121",
+    "@aztec/archiver": "3.0.0-nightly.20251121",
+    "@aztec/aztec.js": "3.0.0-nightly.20251121",
+    "@aztec/constants": "3.0.0-nightly.20251121",
+    "@aztec/entrypoints": "3.0.0-nightly.20251121",
+    "@aztec/ethereum": "3.0.0-nightly.20251121",
+    "@aztec/foundation": "3.0.0-nightly.20251121",
+    "@aztec/l1-artifacts": "3.0.0-nightly.20251121",
+    "@aztec/node-keystore": "3.0.0-nightly.20251121",
+    "@aztec/node-lib": "3.0.0-nightly.20251121",
+    "@aztec/p2p": "3.0.0-nightly.20251121",
+    "@aztec/protocol-contracts": "3.0.0-nightly.20251121",
+    "@aztec/stdlib": "3.0.0-nightly.20251121",
+    "@aztec/test-wallet": "3.0.0-nightly.20251121",
+    "@aztec/world-state": "3.0.0-nightly.20251121",
     "@ethersproject/wallet": "^5.8.0",
     "@iarna/toml": "^2.2.5",
     "@libp2p/peer-id-factory": "^3.0.4",
@@ -99,9 +99,9 @@
     "viem": "npm:@spalladino/viem@2.38.2-eip7594.0"
   },
   "devDependencies": {
-    "@aztec/aztec-node": "3.0.0-nightly.20251119",
-    "@aztec/kv-store": "3.0.0-nightly.20251119",
-    "@aztec/telemetry-client": "3.0.0-nightly.20251119",
+    "@aztec/aztec-node": "3.0.0-nightly.20251121",
+    "@aztec/kv-store": "3.0.0-nightly.20251121",
+    "@aztec/telemetry-client": "3.0.0-nightly.20251121",
     "@jest/globals": "^30.0.0",
     "@types/jest": "^30.0.0",
     "@types/lodash.chunk": "^4.2.9",
@@ -117,15 +117,15 @@
     "typescript": "^5.3.3"
   },
   "peerDependencies": {
-    "@aztec/accounts": "3.0.0-nightly.20251119",
-    "@aztec/bb-prover": "3.0.0-nightly.20251119",
-    "@aztec/ethereum": "3.0.0-nightly.20251119",
-    "@aztec/l1-artifacts": "3.0.0-nightly.20251119",
-    "@aztec/noir-contracts.js": "3.0.0-nightly.20251119",
-    "@aztec/noir-protocol-circuits-types": "3.0.0-nightly.20251119",
-    "@aztec/noir-test-contracts.js": "3.0.0-nightly.20251119",
-    "@aztec/protocol-contracts": "3.0.0-nightly.20251119",
-    "@aztec/stdlib": "3.0.0-nightly.20251119"
+    "@aztec/accounts": "3.0.0-nightly.20251121",
+    "@aztec/bb-prover": "3.0.0-nightly.20251121",
+    "@aztec/ethereum": "3.0.0-nightly.20251121",
+    "@aztec/l1-artifacts": "3.0.0-nightly.20251121",
+    "@aztec/noir-contracts.js": "3.0.0-nightly.20251121",
+    "@aztec/noir-protocol-circuits-types": "3.0.0-nightly.20251121",
+    "@aztec/noir-test-contracts.js": "3.0.0-nightly.20251121",
+    "@aztec/protocol-contracts": "3.0.0-nightly.20251121",
+    "@aztec/stdlib": "3.0.0-nightly.20251121"
   },
   "files": [
     "dest",

package/src/cmds/validator_keys/add.ts

@@ -12,23 +12,28 @@ import {
   buildValidatorEntries,
   logValidatorSummaries,
   maybePrintJson,
-  validateBlsPathOptions,
   writeBlsBn254ToFile,
   writeEthJsonV3ToFile,
   writeKeystoreFile,
 } from './shared.js';
+import { validateBlsPathOptions, validatePublisherOptions, validateRemoteSignerOptions } from './utils.js';
 
 export type AddValidatorKeysOptions = NewValidatorKeystoreOptions;
 
 export async function addValidatorKeys(existing: string, options: AddValidatorKeysOptions, log: LogFn) {
   // validate bls-path inputs before proceeding with key generation
   validateBlsPathOptions(options);
+  // validate publisher options
+  validatePublisherOptions(options);
+  // validate remote signer options
+  validateRemoteSignerOptions(options);
 
   const {
     dataDir,
     file,
     count,
     publisherCount = 0,
+    publishers,
     mnemonic,
     accountIndex = 0,
     addressIndex,
@@ -37,7 +42,6 @@ export async function addValidatorKeys(existing: string, options: AddValidatorKe
     json,
     feeRecipient: feeRecipientOpt,
     coinbase: coinbaseOpt,
-    fundingAccount: fundingAccountOpt,
     remoteSigner: remoteSignerOpt,
     password,
     encryptedKeystoreDir,
@@ -58,8 +62,6 @@ export async function addValidatorKeys(existing: string, options: AddValidatorKe
     throw new Error('feeRecipient is required (either present in existing file or via --fee-recipient)');
   }
   const coinbase = (coinbaseOpt as EthAddress | undefined) ?? (first.coinbase as EthAddress | undefined);
-  const fundingAccount =
-    (fundingAccountOpt as EthAddress | undefined) ?? (first.fundingAccount as EthAddress | undefined);
   const derivedRemoteSigner = (first.attester as any)?.remoteSignerUrl || (first.attester as any)?.eth?.remoteSignerUrl;
   const remoteSigner = remoteSignerOpt ?? derivedRemoteSigner;
 
@@ -73,6 +75,7 @@ export async function addValidatorKeys(existing: string, options: AddValidatorKe
   const { validators, summaries } = await buildValidatorEntries({
     validatorCount,
     publisherCount,
+    publishers,
     accountIndex,
     baseAddressIndex: effectiveBaseAddressIndex,
     mnemonic: mnemonicToUse,
@@ -81,7 +84,6 @@ export async function addValidatorKeys(existing: string, options: AddValidatorKe
     feeRecipient,
     coinbase,
     remoteSigner,
-    fundingAccount,
   });
 
   keystore.validators.push(...validators);

package/src/cmds/validator_keys/generate_bls_keypair.ts

@@ -3,7 +3,8 @@ import type { LogFn } from '@aztec/foundation/log';
 
 import { writeFile } from 'fs/promises';
 
-import { computeBlsPublicKeyCompressed, defaultBlsPath, withValidatorIndex } from './shared.js';
+import { computeBlsPublicKeyCompressed, withValidatorIndex } from './shared.js';
+import { defaultBlsPath } from './utils.js';
 
 export type GenerateBlsKeypairOptions = {
   mnemonic?: string;

package/src/cmds/validator_keys/index.ts

@@ -3,7 +3,7 @@ import type { LogFn } from '@aztec/foundation/log';
 import { Command } from 'commander';
 
 import { parseAztecAddress, parseEthereumAddress, parseHex, parseOptionalInteger } from '../../utils/commands.js';
-import { defaultBlsPath } from './shared.js';
+import { defaultBlsPath } from './utils.js';
 
 export function injectCommands(program: Command, log: LogFn) {
   const group = program
@@ -18,15 +18,23 @@ export function injectCommands(program: Command, log: LogFn) {
     .option('--data-dir <path>', 'Directory to store keystore(s). Defaults to ~/.aztec/keystore')
     .option('--file <name>', 'Keystore file name. Defaults to key1.json (or keyN.json if key1.json exists)')
     .option('--count <N>', 'Number of validators to generate', parseOptionalInteger)
-    .option('--publisher-count <N>', 'Number of publisher accounts per validator (default 1)', value =>
+    .option('--publisher-count <N>', 'Number of publisher accounts per validator (default 0)', value =>
       parseOptionalInteger(value, 0),
     )
+    .option('--publishers <privateKeys>', 'Comma-separated list of publisher private keys for all validators.', value =>
+      value.split(',').map((key: string) => key.trim()),
+    )
     .option('--mnemonic <mnemonic>', 'Mnemonic for ETH/BLS derivation')
     .option('--passphrase <str>', 'Optional passphrase for mnemonic')
     .option('--account-index <N>', 'Base account index for ETH/BLS derivation', parseOptionalInteger)
     .option('--address-index <N>', 'Base address index for ETH/BLS derivation', parseOptionalInteger)
-    .option('--coinbase <address>', 'Coinbase ETH address to use when proposing', parseEthereumAddress)
-    .option('--funding-account <address>', 'ETH account to fund publishers', parseEthereumAddress)
+    .option(
+      '--coinbase <address>',
+      'Coinbase ETH address to use when proposing. Defaults to attester address.',
+      parseEthereumAddress,
+    )
+    // TODO: add funding account back in when implemented
+    // .option('--funding-account <privateKey|address>', 'ETH private key (or address for remote signer setup) to fund publishers')
     .option('--remote-signer <url>', 'Default remote signer URL for accounts in this file')
     .option('--ikm <hex>', 'Initial keying material for BLS (alternative to mnemonic)', value => parseHex(value, 32))
     .option('--bls-path <path>', `EIP-2334 path (default ${defaultBlsPath})`)
@@ -62,15 +70,23 @@ export function injectCommands(program: Command, log: LogFn) {
     .option('--data-dir <path>', 'Directory where keystore(s) live. (default: ~/.aztec/keystore)')
     .option('--file <name>', 'Override output file name. (default: key<N>.json)')
     .option('--count <N>', 'Number of validators to add. (default: 1)', parseOptionalInteger)
-    .option('--publisher-count <N>', 'Number of publisher accounts per validator (default 1)', value =>
+    .option('--publisher-count <N>', 'Number of publisher accounts per validator (default 0)', value =>
       parseOptionalInteger(value, 0),
     )
+    .option('--publishers <privateKeys>', 'Comma-separated list of publisher private keys for all validators.', value =>
+      value.split(',').map((key: string) => key.trim()),
+    )
     .option('--mnemonic <mnemonic>', 'Mnemonic for ETH/BLS derivation')
     .option('--passphrase <str>', 'Optional passphrase for mnemonic')
     .option('--account-index <N>', 'Base account index for ETH/BLS derivation', parseOptionalInteger)
     .option('--address-index <N>', 'Base address index for ETH/BLS derivation', parseOptionalInteger)
-    .option('--coinbase <address>', 'Coinbase ETH address to use when proposing', parseEthereumAddress)
-    .option('--funding-account <address>', 'ETH account to fund publishers', parseEthereumAddress)
+    .option(
+      '--coinbase <address>',
+      'Coinbase ETH address to use when proposing. Defaults to attester address.',
+      parseEthereumAddress,
+    )
+    // TODO: add funding account back in when implemented
+    // .option('--funding-account <privateKey|address>', 'ETH private key (or address for remote signer setup) to fund publishers')
     .option('--remote-signer <url>', 'Default remote signer URL for accounts in this file')
     .option('--ikm <hex>', 'Initial keying material for BLS (alternative to mnemonic)', value => parseHex(value, 32))
     .option('--bls-path <path>', `EIP-2334 path (default ${defaultBlsPath})`)

package/src/cmds/validator_keys/new.ts

@@ -15,18 +15,24 @@ import {
   logValidatorSummaries,
   maybePrintJson,
   resolveKeystoreOutputPath,
-  validateBlsPathOptions,
   writeBlsBn254ToFile,
   writeEthJsonV3ToFile,
   writeKeystoreFile,
 } from './shared.js';
 import { processAttesterAccounts } from './staker.js';
+import {
+  validateBlsPathOptions,
+  validatePublisherOptions,
+  validateRemoteSignerOptions,
+  validateStakerOutputOptions,
+} from './utils.js';
 
 export type NewValidatorKeystoreOptions = {
   dataDir?: string;
   file?: string;
   count?: number;
   publisherCount?: number;
+  publishers?: string[];
   mnemonic?: string;
   passphrase?: string;
   accountIndex?: number;
@@ -40,7 +46,6 @@ export type NewValidatorKeystoreOptions = {
   feeRecipient: AztecAddress;
   coinbase?: EthAddress;
   remoteSigner?: string;
-  fundingAccount?: EthAddress;
   stakerOutput?: boolean;
   gseAddress?: EthAddress;
   l1RpcUrls?: string[];
@@ -50,19 +55,25 @@ export type NewValidatorKeystoreOptions = {
 export async function newValidatorKeystore(options: NewValidatorKeystoreOptions, log: LogFn) {
   // validate bls-path inputs before proceeding with key generation
   validateBlsPathOptions(options);
+  // validate staker output options before proceeding with key generation
+  validateStakerOutputOptions(options);
+  // validate publisher options
+  validatePublisherOptions(options);
+  // validate remote signer options
+  validateRemoteSignerOptions(options);
 
   const {
     dataDir,
     file,
     count,
     publisherCount = 0,
+    publishers,
     json,
     coinbase,
     accountIndex = 0,
     addressIndex = 0,
     feeRecipient,
     remoteSigner,
-    fundingAccount,
     blsPath,
     ikm,
     mnemonic: _mnemonic,
@@ -74,25 +85,6 @@ export async function newValidatorKeystore(options: NewValidatorKeystoreOptions,
     l1ChainId,
   } = options;
 
-  // Validate staker output requirements
-  if (stakerOutput) {
-    if (!gseAddress) {
-      throw new Error('--gse-address is required when using --staker-output');
-    }
-    if (!l1RpcUrls || l1RpcUrls.length === 0) {
-      throw new Error('--l1-rpc-urls is required when using --staker-output');
-    }
-    if (l1ChainId === undefined) {
-      throw new Error('--l1-chain-id is required when using --staker-output');
-    }
-  }
-
-  if (remoteSigner && !_mnemonic) {
-    throw new Error(
-      'Using --remote-signer requires a deterministic key source. Provide --mnemonic to derive keys, or omit --remote-signer to write new private keys to keystore.',
-    );
-  }
-
   const mnemonic = _mnemonic ?? generateMnemonic(wordlist);
 
   if (!_mnemonic && !json) {
@@ -110,6 +102,7 @@ export async function newValidatorKeystore(options: NewValidatorKeystoreOptions,
   const { validators, summaries } = await buildValidatorEntries({
     validatorCount,
     publisherCount,
+    publishers,
     accountIndex,
     baseAddressIndex: addressIndex,
     mnemonic,
@@ -118,7 +111,6 @@ export async function newValidatorKeystore(options: NewValidatorKeystoreOptions,
     feeRecipient,
     coinbase,
     remoteSigner,
-    fundingAccount,
   });
 
   // If password provided, write ETH JSON V3 and BLS BN254 keystores and replace plaintext

package/src/cmds/validator_keys/shared.ts

@@ -13,11 +13,14 @@ import { homedir } from 'os';
 import { dirname, isAbsolute, join } from 'path';
 import { mnemonicToAccount } from 'viem/accounts';
 
+import { defaultBlsPath } from './utils.js';
+
 export type ValidatorSummary = { attesterEth?: string; attesterBls?: string; publisherEth?: string[] };
 
 export type BuildValidatorsInput = {
   validatorCount: number;
   publisherCount?: number;
+  publishers?: string[];
   accountIndex: number;
   baseAddressIndex: number;
   mnemonic: string;
@@ -26,31 +29,8 @@ export type BuildValidatorsInput = {
   feeRecipient: AztecAddress;
   coinbase?: EthAddress;
   remoteSigner?: string;
-  fundingAccount?: EthAddress;
 };
 
-export const defaultBlsPath = 'm/12381/3600/0/0/0';
-
-export function validateBlsPathOptions(options: {
-  count?: number;
-  publisherCount?: number;
-  accountIndex?: number;
-  addressIndex?: number;
-  blsPath?: string;
-  ikm?: string;
-}) {
-  if (options.blsPath && options.blsPath !== defaultBlsPath) {
-    if (
-      (options.count && options.count !== 1) ||
-      (options.publisherCount && options.publisherCount > 0) ||
-      (options.accountIndex && options.accountIndex !== 0) ||
-      (options.addressIndex && options.addressIndex !== 0)
-    ) {
-      throw new Error('--bls-path cannot be used with --count, --publisher-count, --account-index, or --address-index');
-    }
-  }
-}
-
 export function withValidatorIndex(path: string, accountIndex: number = 0, addressIndex: number = 0) {
   // NOTE: The legacy BLS CLI is to allow users who generated keys in 2.1.4 to be able to use the same command
   // to re-generate their keys. In 2.1.5 we switched how we append addresses to the path so this is to maintain backwards compatibility.
@@ -99,6 +79,7 @@ export async function buildValidatorEntries(input: BuildValidatorsInput) {
   const {
     validatorCount,
     publisherCount = 0,
+    publishers,
     accountIndex,
     baseAddressIndex,
     mnemonic,
@@ -107,7 +88,6 @@ export async function buildValidatorEntries(input: BuildValidatorsInput) {
     feeRecipient,
     coinbase,
     remoteSigner,
-    fundingAccount,
   } = input;
 
   const summaries: ValidatorSummary[] = [];
@@ -126,7 +106,10 @@ export async function buildValidatorEntries(input: BuildValidatorsInput) {
 
       let publisherField: EthAccount | EthPrivateKey | (EthAccount | EthPrivateKey)[] | undefined;
       const publisherAddresses: string[] = [];
-      if (publisherCount > 0) {
+      if (publishers && publishers.length > 0) {
+        publisherAddresses.push(...publishers);
+        publisherField = publishers.length === 1 ? (publishers[0] as EthPrivateKey) : (publishers as EthPrivateKey[]);
+      } else if (publisherCount > 0) {
         const publishersBaseIndex = baseAddressIndex + validatorCount + i * publisherCount;
         const publisherAccounts = Array.from({ length: publisherCount }, (_unused2, j) => {
           const publisherAddressIndex = publishersBaseIndex + j;
@@ -157,8 +140,7 @@ export async function buildValidatorEntries(input: BuildValidatorsInput) {
         attester,
         ...(publisherField !== undefined ? { publisher: publisherField } : {}),
         feeRecipient,
-        coinbase,
-        fundingAccount,
+        coinbase: coinbase ?? attesterEthAddress,
       } as ValidatorKeyStore;
     }),
   );
@@ -339,10 +321,5 @@ export async function writeEthJsonV3ToFile(
         (v as any).publisher = await maybeEncryptEth(pub, `publisher_${i + 1}`);
       }
     }
-
-    // Optional fundingAccount within validator
-    if ('fundingAccount' in v) {
-      (v as any).fundingAccount = await maybeEncryptEth((v as any).fundingAccount, `funding_${i + 1}`);
-    }
   }
 }

package/src/cmds/validator_keys/utils.ts

@@ -0,0 +1,80 @@
+import type { EthAddress } from '@aztec/foundation/eth-address';
+import { type EthPrivateKey, ethPrivateKeySchema } from '@aztec/node-keystore';
+
+export const defaultBlsPath = 'm/12381/3600/0/0/0';
+
+export function validateBlsPathOptions(options: {
+  count?: number;
+  publisherCount?: number;
+  accountIndex?: number;
+  addressIndex?: number;
+  blsPath?: string;
+  ikm?: string;
+}) {
+  if (options.blsPath && options.blsPath !== defaultBlsPath) {
+    if (
+      (options.count && options.count !== 1) ||
+      (options.publisherCount && options.publisherCount > 0) ||
+      (options.accountIndex && options.accountIndex !== 0) ||
+      (options.addressIndex && options.addressIndex !== 0)
+    ) {
+      throw new Error('--bls-path cannot be used with --count, --publisher-count, --account-index, or --address-index');
+    }
+  }
+}
+
+export function validateStakerOutputOptions(options: {
+  stakerOutput?: boolean;
+  gseAddress?: EthAddress;
+  l1RpcUrls?: string[];
+  l1ChainId?: number;
+}) {
+  if (!options.stakerOutput) {
+    return;
+  }
+  // Required options for staker output
+  if (!options.gseAddress) {
+    throw new Error('--gse-address is required when using --staker-output');
+  }
+  if (!options.l1RpcUrls || options.l1RpcUrls.length === 0) {
+    throw new Error('--l1-rpc-urls is required when using --staker-output');
+  }
+
+  if (options.l1ChainId === undefined) {
+    throw new Error('--l1-chain-id is required when using --staker-output');
+  }
+}
+
+export function validateRemoteSignerOptions(options: { remoteSigner?: string; mnemonic?: string }) {
+  if (options.remoteSigner && !options.mnemonic) {
+    throw new Error(
+      'Using --remote-signer requires a deterministic key source. Provide --mnemonic to derive keys, or omit --remote-signer to write new private keys to keystore.',
+    );
+  }
+}
+
+export function validatePublisherOptions(options: { publishers?: string[]; publisherCount?: number }) {
+  if (options.publisherCount && options.publisherCount > 0 && options.publishers && options.publishers.length > 0) {
+    throw new Error('--publishers and --publisher-count cannot be used together');
+  }
+
+  if (options.publishers && options.publishers.length > 0) {
+    // Normalize each private key by adding 0x prefix if missing
+    const normalizedKeys: string[] = [];
+    for (const key of options.publishers) {
+      let privateKey = key.trim();
+      if (!privateKey.startsWith('0x')) {
+        privateKey = '0x' + privateKey;
+      }
+
+      try {
+        ethPrivateKeySchema.parse(privateKey);
+        normalizedKeys.push(privateKey);
+      } catch (error) {
+        throw new Error(`Invalid publisher private key: ${error instanceof Error ? error.message : String(error)}`);
+      }
+    }
+    // Update the options with the normalized keys
+    options.publishers = normalizedKeys as EthPrivateKey[];
+  }
+}

package/src/config/network_config.ts

@@ -8,11 +8,12 @@ import { enrichEthAddressVar, enrichVar } from './enrich_env.js';
 
 const DEFAULT_CONFIG_URL =
   'https://raw.githubusercontent.com/AztecProtocol/networks/refs/heads/main/network_config.json';
+const FALLBACK_CONFIG_URL = 'https://metadata.aztec.network/network_config.json';
 const NETWORK_CONFIG_CACHE_DURATION_MS = 60 * 60 * 1000; // 1 hour
 
 /**
  * Fetches remote network configuration from GitHub with caching support.
- * Uses the reusable cachedFetch utility.
+ * Uses the reusable cachedFetch utility. Falls back to metadata.aztec.network if the default URL fails.
  *
  * @param networkName - The network name to fetch config for
  * @param cacheDir - Optional cache directory for storing fetched config
@@ -22,13 +23,33 @@ export async function getNetworkConfig(
   networkName: NetworkNames,
   cacheDir?: string,
 ): Promise<NetworkConfig | undefined> {
-  let url: URL | undefined;
+  // Try with the primary URL (env var or default)
   const configLocation = process.env.NETWORK_CONFIG_LOCATION || DEFAULT_CONFIG_URL;
 
-  if (!configLocation) {
-    return undefined;
+  // First try the primary config location
+  let config = await fetchNetworkConfigFromUrl(configLocation, networkName, cacheDir);
+
+  // If primary fails and we were using the default URL, try the fallback
+  if (!config && configLocation === DEFAULT_CONFIG_URL) {
+    config = await fetchNetworkConfigFromUrl(FALLBACK_CONFIG_URL, networkName, cacheDir);
   }
 
+  return config;
+}
+
+/**
+ * Helper function to fetch network config from a specific URL.
+ * @param configLocation - The URL or file path to fetch from
+ * @param networkName - The network name to fetch config for
+ * @param cacheDir - Optional cache directory for storing fetched config
+ * @returns Remote configuration for the specified network, or undefined if not found/error
+ */
+async function fetchNetworkConfigFromUrl(
+  configLocation: string,
+  networkName: NetworkNames,
+  cacheDir?: string,
+): Promise<NetworkConfig | undefined> {
+  let url: URL | undefined;
   try {
     if (configLocation.includes('://')) {
       url = new URL(configLocation);
@@ -88,7 +109,7 @@ export async function enrichEnvironmentWithNetworkConfig(networkName: NetworkNam
   const networkConfig = await getNetworkConfig(networkName, cacheDir);
 
   if (!networkConfig) {
-    return;
+    throw new Error(`Failed to fetch network config for network: ${networkName}`);
   }
 
   enrichVar('BOOTSTRAP_NODES', networkConfig.bootnodes.join(','));