@aztec/cli 5.0.0-nightly.20260703 → 5.0.0-nightly.20260705

package/dest/cmds/validator_keys/eth_json_v3_worker.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZXRoX2pzb25fdjNfd29ya2VyLmQudHMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi9zcmMvY21kcy92YWxpZGF0b3Jfa2V5cy9ldGhfanNvbl92M193b3JrZXIudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IiJ9

package/dest/cmds/validator_keys/eth_json_v3_worker.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"eth_json_v3_worker.d.ts","sourceRoot":"","sources":["../../../src/cmds/validator_keys/eth_json_v3_worker.ts"],"names":[],"mappings":""}

package/dest/cmds/validator_keys/eth_json_v3_worker.js

@@ -0,0 +1,27 @@
+import { Wallet } from '@ethersproject/wallet';
+import { parentPort, workerData } from 'worker_threads';
+function serializeError(error) {
+    if (error instanceof Error) {
+        return {
+            message: error.message,
+            name: error.name,
+            stack: error.stack
+        };
+    }
+    return {
+        message: String(error)
+    };
+}
+void (async ()=>{
+    try {
+        const { privateKeyHex, password } = workerData;
+        const json = await new Wallet(privateKeyHex).encrypt(password);
+        parentPort?.postMessage({
+            json
+        });
+    } catch (error) {
+        parentPort?.postMessage({
+            error: serializeError(error)
+        });
+    }
+})();

package/dest/cmds/validator_keys/index.d.ts

@@ -1,4 +1,4 @@
 import type { LogFn } from '@aztec/foundation/log';
 import { Command } from 'commander';
 export declare function injectCommands(program: Command, log: LogFn): Command;
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguZC50cyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uLy4uL3NyYy9jbWRzL3ZhbGlkYXRvcl9rZXlzL2luZGV4LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLE9BQU8sS0FBSyxFQUFFLEtBQUssRUFBRSxNQUFNLHVCQUF1QixDQUFDO0FBRW5ELE9BQU8sRUFBRSxPQUFPLEVBQUUsTUFBTSxXQUFXLENBQUM7QUFLcEMsd0JBQWdCLGNBQWMsQ0FBQyxPQUFPLEVBQUUsT0FBTyxFQUFFLEdBQUcsRUFBRSxLQUFLLFdBc0kxRCJ9
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguZC50cyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uLy4uL3NyYy9jbWRzL3ZhbGlkYXRvcl9rZXlzL2luZGV4LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLE9BQU8sS0FBSyxFQUFFLEtBQUssRUFBRSxNQUFNLHVCQUF1QixDQUFDO0FBRW5ELE9BQU8sRUFBRSxPQUFPLEVBQVUsTUFBTSxXQUFXLENBQUM7QUFLNUMsd0JBQWdCLGNBQWMsQ0FBQyxPQUFPLEVBQUUsT0FBTyxFQUFFLEdBQUcsRUFBRSxLQUFLLFdBb0oxRCJ9

package/dest/cmds/validator_keys/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/cmds/validator_keys/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAEnD,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAKpC,wBAAgB,cAAc,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,WAsI1D"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/cmds/validator_keys/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAEnD,OAAO,EAAE,OAAO,EAAU,MAAM,WAAW,CAAC;AAK5C,wBAAgB,cAAc,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,WAoJ1D"}

package/dest/cmds/validator_keys/index.js

@@ -1,3 +1,4 @@
+import { Option } from 'commander';
 import { parseAztecAddress, parseEthereumAddress, parseHex, parseOptionalInteger } from '../../utils/commands.js';
 import { defaultBlsPath } from './utils.js';
 export function injectCommands(program, log) {
@@ -7,7 +8,7 @@ export function injectCommands(program, log) {
     ]).description('Manage validator keystores for node operators');
     group.command('new').summary('Generate a new validator keystore JSON').description('Generates a new validator keystore with ETH secp256k1 accounts and optional BLS accounts').option('--data-dir <path>', 'Directory to store keystore(s). Defaults to ~/.aztec/keystore').option('--file <name>', 'Keystore file name. Defaults to key1.json (or keyN.json if key1.json exists)').option('--count <N>', 'Number of validators to generate', parseOptionalInteger).option('--publisher-count <N>', 'Number of publisher accounts per validator (default 0)', (value)=>parseOptionalInteger(value, 0)).option('--publishers <privateKeys>', 'Comma-separated list of publisher private keys for all validators.', (value)=>value.split(',').map((key)=>key.trim())).option('--mnemonic <mnemonic>', 'Mnemonic for ETH/BLS derivation').option('--passphrase <str>', 'Optional passphrase for mnemonic').option('--account-index <N>', 'Base account index for ETH/BLS derivation', parseOptionalInteger).option('--address-index <N>', 'Base address index for ETH/BLS derivation', parseOptionalInteger).option('--coinbase <address>', 'Coinbase ETH address to use when proposing. Defaults to attester address.', parseEthereumAddress)// TODO: add funding account back in when implemented
     // .option('--funding-account <privateKey|address>', 'ETH private key (or address for remote signer setup) to fund publishers')
-    .option('--remote-signer <url>', 'Default remote signer URL for accounts in this file').option('--ikm <hex>', 'Initial keying material for BLS (alternative to mnemonic)', (value)=>parseHex(value, 32)).option('--bls-path <path>', `EIP-2334 path (default ${defaultBlsPath})`).option('--password <str>', 'Password for writing keystore files (ETH JSON V3 and BLS EIP-2335). Empty string allowed').option('--encrypted-keystore-dir <dir>', 'Output directory for encrypted keystore file(s)').option('--json', 'Echo resulting JSON to stdout').option('--staker-output', 'Generate a single staker output JSON file with an array of validator entries').option('--gse-address <address>', 'GSE contract address (required with --staker-output)', parseEthereumAddress).option('--l1-rpc-urls <urls>', 'L1 RPC URLs (comma-separated, required with --staker-output)', (value)=>value.split(',')).option('-c, --l1-chain-id <number>', 'L1 chain ID (required with --staker-output)', (value)=>parseInt(value), 31337).requiredOption('--fee-recipient <address>', 'Aztec address that will receive fees', parseAztecAddress).action(async (options)=>{
+    .option('--remote-signer <url>', 'Default remote signer URL for accounts in this file').option('--ikm <hex>', 'Initial keying material for BLS (alternative to mnemonic)', (value)=>parseHex(value, 32)).option('--bls-path <path>', `EIP-2334 path (default ${defaultBlsPath})`).addOption(new Option('--password <str>', 'Shared password for writing ETH JSON V3 and BLS EIP-2335 keystore files').env('AZTEC_KEYSTORE_PASSWORD')).option('--password-file <path>', 'File containing the shared password for writing keystore files').addOption(new Option('--eth-password <str>', 'Password for writing ETH JSON V3 keystore files').env('AZTEC_ETH_KEYSTORE_PASSWORD')).option('--eth-password-file <path>', 'File containing the password for writing ETH JSON V3 keystore files').addOption(new Option('--bls-password <str>', 'Password for writing BLS EIP-2335 keystore files').env('AZTEC_BLS_KEYSTORE_PASSWORD')).option('--bls-password-file <path>', 'File containing the password for writing BLS EIP-2335 keystore files').option('--encrypted-keystore-dir <dir>', 'Output directory for encrypted keystore file(s)').option('--json', 'Echo resulting JSON to stdout').option('--staker-output', 'Generate a single staker output JSON file with an array of validator entries').option('--gse-address <address>', 'GSE contract address (required with --staker-output)', parseEthereumAddress).option('--l1-rpc-urls <urls>', 'L1 RPC URLs (comma-separated, required with --staker-output)', (value)=>value.split(',')).option('-c, --l1-chain-id <number>', 'L1 chain ID (required with --staker-output)', (value)=>parseInt(value), 31337).requiredOption('--fee-recipient <address>', 'Aztec address that will receive fees', parseAztecAddress).action(async (options)=>{
         const { newValidatorKeystore } = await import('./new.js');
         await newValidatorKeystore(options, log);
     });

package/dest/cmds/validator_keys/new.d.ts

@@ -15,6 +15,11 @@ export type NewValidatorKeystoreOptions = {
     ikm?: string;
     blsPath?: string;
     password?: string;
+    passwordFile?: string;
+    ethPassword?: string;
+    ethPasswordFile?: string;
+    blsPassword?: string;
+    blsPasswordFile?: string;
     encryptedKeystoreDir?: string;
     json?: boolean;
     feeRecipient: AztecAddress;
@@ -26,4 +31,4 @@ export type NewValidatorKeystoreOptions = {
     l1ChainId?: number;
 };
 export declare function newValidatorKeystore(options: NewValidatorKeystoreOptions, log: LogFn): Promise<void>;
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoibmV3LmQudHMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi9zcmMvY21kcy92YWxpZGF0b3Jfa2V5cy9uZXcudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBR0EsT0FBTyxLQUFLLEVBQUUsVUFBVSxFQUFFLE1BQU0sK0JBQStCLENBQUM7QUFDaEUsT0FBTyxLQUFLLEVBQUUsS0FBSyxFQUFFLE1BQU0sdUJBQXVCLENBQUM7QUFDbkQsT0FBTyxLQUFLLEVBQUUsWUFBWSxFQUFFLE1BQU0sNkJBQTZCLENBQUM7QUF5QmhFLE1BQU0sTUFBTSwyQkFBMkIsR0FBRztJQUN4QyxPQUFPLENBQUMsRUFBRSxNQUFNLENBQUM7SUFDakIsSUFBSSxDQUFDLEVBQUUsTUFBTSxDQUFDO0lBQ2QsS0FBSyxDQUFDLEVBQUUsTUFBTSxDQUFDO0lBQ2YsY0FBYyxDQUFDLEVBQUUsTUFBTSxDQUFDO0lBQ3hCLFVBQVUsQ0FBQyxFQUFFLE1BQU0sRUFBRSxDQUFDO0lBQ3RCLFFBQVEsQ0FBQyxFQUFFLE1BQU0sQ0FBQztJQUNsQixVQUFVLENBQUMsRUFBRSxNQUFNLENBQUM7SUFDcEIsWUFBWSxDQUFDLEVBQUUsTUFBTSxDQUFDO0lBQ3RCLFlBQVksQ0FBQyxFQUFFLE1BQU0sQ0FBQztJQUN0QixpQkFBaUIsQ0FBQyxFQUFFLE9BQU8sQ0FBQztJQUM1QixHQUFHLENBQUMsRUFBRSxNQUFNLENBQUM7SUFDYixPQUFPLENBQUMsRUFBRSxNQUFNLENBQUM7SUFDakIsUUFBUSxDQUFDLEVBQUUsTUFBTSxDQUFDO0lBQ2xCLG9CQUFvQixDQUFDLEVBQUUsTUFBTSxDQUFDO0lBQzlCLElBQUksQ0FBQyxFQUFFLE9BQU8sQ0FBQztJQUNmLFlBQVksRUFBRSxZQUFZLENBQUM7SUFDM0IsUUFBUSxDQUFDLEVBQUUsVUFBVSxDQUFDO0lBQ3RCLFlBQVksQ0FBQyxFQUFFLE1BQU0sQ0FBQztJQUN0QixZQUFZLENBQUMsRUFBRSxPQUFPLENBQUM7SUFDdkIsVUFBVSxDQUFDLEVBQUUsVUFBVSxDQUFDO0lBQ3hCLFNBQVMsQ0FBQyxFQUFFLE1BQU0sRUFBRSxDQUFDO0lBQ3JCLFNBQVMsQ0FBQyxFQUFFLE1BQU0sQ0FBQztDQUNwQixDQUFDO0FBRUYsd0JBQXNCLG9CQUFvQixDQUFDLE9BQU8sRUFBRSwyQkFBMkIsRUFBRSxHQUFHLEVBQUUsS0FBSyxpQkF1SjFGIn0=
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoibmV3LmQudHMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi9zcmMvY21kcy92YWxpZGF0b3Jfa2V5cy9uZXcudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBR0EsT0FBTyxLQUFLLEVBQUUsVUFBVSxFQUFFLE1BQU0sK0JBQStCLENBQUM7QUFDaEUsT0FBTyxLQUFLLEVBQUUsS0FBSyxFQUFFLE1BQU0sdUJBQXVCLENBQUM7QUFDbkQsT0FBTyxLQUFLLEVBQUUsWUFBWSxFQUFFLE1BQU0sNkJBQTZCLENBQUM7QUF5QmhFLE1BQU0sTUFBTSwyQkFBMkIsR0FBRztJQUN4QyxPQUFPLENBQUMsRUFBRSxNQUFNLENBQUM7SUFDakIsSUFBSSxDQUFDLEVBQUUsTUFBTSxDQUFDO0lBQ2QsS0FBSyxDQUFDLEVBQUUsTUFBTSxDQUFDO0lBQ2YsY0FBYyxDQUFDLEVBQUUsTUFBTSxDQUFDO0lBQ3hCLFVBQVUsQ0FBQyxFQUFFLE1BQU0sRUFBRSxDQUFDO0lBQ3RCLFFBQVEsQ0FBQyxFQUFFLE1BQU0sQ0FBQztJQUNsQixVQUFVLENBQUMsRUFBRSxNQUFNLENBQUM7SUFDcEIsWUFBWSxDQUFDLEVBQUUsTUFBTSxDQUFDO0lBQ3RCLFlBQVksQ0FBQyxFQUFFLE1BQU0sQ0FBQztJQUN0QixpQkFBaUIsQ0FBQyxFQUFFLE9BQU8sQ0FBQztJQUM1QixHQUFHLENBQUMsRUFBRSxNQUFNLENBQUM7SUFDYixPQUFPLENBQUMsRUFBRSxNQUFNLENBQUM7SUFDakIsUUFBUSxDQUFDLEVBQUUsTUFBTSxDQUFDO0lBQ2xCLFlBQVksQ0FBQyxFQUFFLE1BQU0sQ0FBQztJQUN0QixXQUFXLENBQUMsRUFBRSxNQUFNLENBQUM7SUFDckIsZUFBZSxDQUFDLEVBQUUsTUFBTSxDQUFDO0lBQ3pCLFdBQVcsQ0FBQyxFQUFFLE1BQU0sQ0FBQztJQUNyQixlQUFlLENBQUMsRUFBRSxNQUFNLENBQUM7SUFDekIsb0JBQW9CLENBQUMsRUFBRSxNQUFNLENBQUM7SUFDOUIsSUFBSSxDQUFDLEVBQUUsT0FBTyxDQUFDO0lBQ2YsWUFBWSxFQUFFLFlBQVksQ0FBQztJQUMzQixRQUFRLENBQUMsRUFBRSxVQUFVLENBQUM7SUFDdEIsWUFBWSxDQUFDLEVBQUUsTUFBTSxDQUFDO0lBQ3RCLFlBQVksQ0FBQyxFQUFFLE9BQU8sQ0FBQztJQUN2QixVQUFVLENBQUMsRUFBRSxVQUFVLENBQUM7SUFDeEIsU0FBUyxDQUFDLEVBQUUsTUFBTSxFQUFFLENBQUM7SUFDckIsU0FBUyxDQUFDLEVBQUUsTUFBTSxDQUFDO0NBQ3BCLENBQUM7QUFrRkYsd0JBQXNCLG9CQUFvQixDQUFDLE9BQU8sRUFBRSwyQkFBMkIsRUFBRSxHQUFHLEVBQUUsS0FBSyxpQkFxSzFGIn0=

package/dest/cmds/validator_keys/new.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"new.d.ts","sourceRoot":"","sources":["../../../src/cmds/validator_keys/new.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,+BAA+B,CAAC;AAChE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AACnD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAyBhE,MAAM,MAAM,2BAA2B,GAAG;IACxC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,YAAY,EAAE,YAAY,CAAC;IAC3B,QAAQ,CAAC,EAAE,UAAU,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,wBAAsB,oBAAoB,CAAC,OAAO,EAAE,2BAA2B,EAAE,GAAG,EAAE,KAAK,iBAuJ1F"}
+{"version":3,"file":"new.d.ts","sourceRoot":"","sources":["../../../src/cmds/validator_keys/new.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,+BAA+B,CAAC;AAChE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AACnD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAyBhE,MAAM,MAAM,2BAA2B,GAAG;IACxC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,YAAY,EAAE,YAAY,CAAC;IAC3B,QAAQ,CAAC,EAAE,UAAU,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAkFF,wBAAsB,oBAAoB,CAAC,OAAO,EAAE,2BAA2B,EAAE,GAAG,EAAE,KAAK,iBAqK1F"}

package/dest/cmds/validator_keys/new.js

@@ -2,13 +2,74 @@ import { prettyPrintJSON } from '@aztec/cli/utils';
 import { createEthereumChain } from '@aztec/ethereum/chain';
 import { GSEContract } from '@aztec/ethereum/contracts';
 import { wordlist } from '@scure/bip39/wordlists/english.js';
-import { writeFile } from 'fs/promises';
+import { readFile, writeFile } from 'fs/promises';
 import { basename, dirname, join } from 'path';
 import { createPublicClient, fallback, http } from 'viem';
 import { generateMnemonic, mnemonicToAccount } from 'viem/accounts';
 import { buildValidatorEntries, logValidatorSummaries, maybePrintJson, resolveKeystoreOutputPath, writeBlsBn254ToFile, writeEthJsonV3ToFile, writeKeystoreFile } from './shared.js';
 import { processAttesterAccounts } from './staker.js';
 import { validateBlsPathOptions, validatePublisherOptions, validateRemoteSignerOptions, validateStakerOutputOptions } from './utils.js';
+function validatePassword(password, source) {
+    if (password.length === 0) {
+        throw new Error(`${source} cannot be empty`);
+    }
+    return password;
+}
+function stripOneTrailingNewline(password) {
+    if (password.endsWith('\n')) {
+        password = password.slice(0, -1);
+    }
+    if (password.endsWith('\r')) {
+        password = password.slice(0, -1);
+    }
+    return password;
+}
+async function resolvePasswordSource(source) {
+    if (source.password !== undefined && source.passwordFile !== undefined) {
+        throw new Error(`${source.passwordOption} and ${source.passwordFileOption} cannot be used together`);
+    }
+    if (source.password !== undefined) {
+        return validatePassword(source.password, source.passwordOption);
+    }
+    if (source.passwordFile !== undefined) {
+        if (source.passwordFile.length === 0) {
+            throw new Error(`${source.passwordFileOption} cannot be empty`);
+        }
+        const password = stripOneTrailingNewline(await readFile(source.passwordFile, 'utf-8'));
+        return validatePassword(password, source.passwordFileOption);
+    }
+    return undefined;
+}
+async function resolvePasswords(options) {
+    const sharedPassword = await resolvePasswordSource({
+        password: options.password,
+        passwordFile: options.passwordFile,
+        passwordOption: '--password',
+        passwordFileOption: '--password-file'
+    });
+    const ethPassword = await resolvePasswordSource({
+        password: options.ethPassword,
+        passwordFile: options.ethPasswordFile,
+        passwordOption: '--eth-password',
+        passwordFileOption: '--eth-password-file'
+    }) ?? sharedPassword;
+    const blsPassword = await resolvePasswordSource({
+        password: options.blsPassword,
+        passwordFile: options.blsPasswordFile,
+        passwordOption: '--bls-password',
+        passwordFileOption: '--bls-password-file'
+    }) ?? sharedPassword;
+    if (ethPassword === undefined && blsPassword === undefined) {
+        return {};
+    }
+    if (ethPassword === undefined || blsPassword === undefined) {
+        throw new Error('Both ETH and BLS passwords are required when writing encrypted keystores. Provide --password to use one password for both, or provide both --eth-password and --bls-password.');
+    }
+    return {
+        ethPassword,
+        blsPassword
+    };
+}
 export async function newValidatorKeystore(options, log) {
     // validate bls-path inputs before proceeding with key generation
     validateBlsPathOptions(options);
@@ -18,9 +79,18 @@ export async function newValidatorKeystore(options, log) {
     validatePublisherOptions(options);
     // validate remote signer options
     validateRemoteSignerOptions(options);
-    const { dataDir, file, count, publisherCount = 0, publishers, json, coinbase, accountIndex = 0, addressIndex = 0, feeRecipient, remoteSigner, blsPath, ikm, mnemonic: _mnemonic, password, encryptedKeystoreDir, stakerOutput, gseAddress, l1RpcUrls, l1ChainId } = options;
+    const { dataDir, file, count, publisherCount = 0, publishers, json, coinbase, accountIndex = 0, addressIndex = 0, feeRecipient, remoteSigner, blsPath, ikm, mnemonic: _mnemonic, password: passwordOption, passwordFile, ethPassword: ethPasswordOption, ethPasswordFile, blsPassword: blsPasswordOption, blsPasswordFile, encryptedKeystoreDir, stakerOutput, gseAddress, l1RpcUrls, l1ChainId } = options;
+    const { ethPassword, blsPassword } = await resolvePasswords({
+        password: passwordOption,
+        passwordFile,
+        ethPassword: ethPasswordOption,
+        ethPasswordFile,
+        blsPassword: blsPasswordOption,
+        blsPasswordFile
+    });
+    const shouldEncryptKeystores = ethPassword !== undefined && blsPassword !== undefined;
     const mnemonic = _mnemonic ?? generateMnemonic(wordlist);
-    if (!_mnemonic && !json) {
+    if (!_mnemonic && !json && !shouldEncryptKeystores) {
         log('No mnemonic provided, generating new one...');
         log(`Using new mnemonic:`);
         log('');
@@ -44,15 +114,15 @@ export async function newValidatorKeystore(options, log) {
         remoteSigner
     });
     // If password provided, write ETH JSON V3 and BLS BN254 keystores and replace plaintext
-    if (password !== undefined) {
+    if (shouldEncryptKeystores) {
         const encryptedKeystoreOutDir = encryptedKeystoreDir && encryptedKeystoreDir.length > 0 ? encryptedKeystoreDir : keystoreOutDir;
         await writeEthJsonV3ToFile(validators, {
             outDir: encryptedKeystoreOutDir,
-            password
+            password: ethPassword
         });
         await writeBlsBn254ToFile(validators, {
             outDir: encryptedKeystoreOutDir,
-            password
+            password: blsPassword
         });
     }
     const keystore = {
@@ -76,7 +146,7 @@ export async function newValidatorKeystore(options, log) {
         // Process each validator
         for(let i = 0; i < validators.length; i++){
             const validator = validators[i];
-            const outputs = await processAttesterAccounts(validator.attester, gse, password);
+            const outputs = await processAttesterAccounts(validator.attester, gse);
             // Collect all staker outputs
             for(let j = 0; j < outputs.length; j++){
                 allStakerOutputs.push(outputs[j]);
@@ -88,7 +158,7 @@ export async function newValidatorKeystore(options, log) {
             await writeFile(stakerOutputPath, prettyPrintJSON(allStakerOutputs), 'utf-8');
         }
     }
-    const outputData = !_mnemonic ? {
+    const outputData = !_mnemonic && !shouldEncryptKeystores ? {
         ...keystore,
         generatedMnemonic: mnemonic
     } : keystore;

package/dest/cmds/validator_keys/shared.d.ts

@@ -65,4 +65,4 @@ export declare function writeEthJsonV3ToFile(validators: ValidatorKeyStore[], op
     outDir: string;
     password: string;
 }): Promise<void>;
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic2hhcmVkLmQudHMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi9zcmMvY21kcy92YWxpZGF0b3Jfa2V5cy9zaGFyZWQudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBSUEsT0FBTyxLQUFLLEVBQUUsVUFBVSxFQUFFLE1BQU0sK0JBQStCLENBQUM7QUFDaEUsT0FBTyxLQUFLLEVBQUUsS0FBSyxFQUFFLE1BQU0sdUJBQXVCLENBQUM7QUFDbkQsT0FBTyxLQUFLLEVBQUUsVUFBVSxFQUFFLGFBQWEsRUFBRSxpQkFBaUIsRUFBRSxNQUFNLDRCQUE0QixDQUFDO0FBQy9GLE9BQU8sS0FBSyxFQUFFLFlBQVksRUFBRSxNQUFNLDZCQUE2QixDQUFDO0FBV2hFLE1BQU0sTUFBTSxnQkFBZ0IsR0FBRztJQUFFLFdBQVcsQ0FBQyxFQUFFLE1BQU0sQ0FBQztJQUFDLFdBQVcsQ0FBQyxFQUFFLE1BQU0sQ0FBQztJQUFDLFlBQVksQ0FBQyxFQUFFLE1BQU0sRUFBRSxDQUFBO0NBQUUsQ0FBQztBQUV2RyxNQUFNLE1BQU0sb0JBQW9CLEdBQUc7SUFDakMsY0FBYyxFQUFFLE1BQU0sQ0FBQztJQUN2QixjQUFjLENBQUMsRUFBRSxNQUFNLENBQUM7SUFDeEIsVUFBVSxDQUFDLEVBQUUsTUFBTSxFQUFFLENBQUM7SUFDdEIsWUFBWSxFQUFFLE1BQU0sQ0FBQztJQUNyQixnQkFBZ0IsRUFBRSxNQUFNLENBQUM7SUFDekIsUUFBUSxFQUFFLE1BQU0sQ0FBQztJQUNqQixHQUFHLENBQUMsRUFBRSxNQUFNLENBQUM7SUFDYixPQUFPLENBQUMsRUFBRSxNQUFNLENBQUM7SUFDakIsWUFBWSxFQUFFLFlBQVksQ0FBQztJQUMzQixRQUFRLENBQUMsRUFBRSxVQUFVLENBQUM7SUFDdEIsWUFBWSxDQUFDLEVBQUUsTUFBTSxDQUFDO0NBQ3ZCLENBQUM7QUFFRix3QkFBZ0Isa0JBQWtCLENBQUMsSUFBSSxFQUFFLE1BQU0sRUFBRSxZQUFZLEdBQUUsTUFBVSxFQUFFLFlBQVksR0FBRSxNQUFVLFVBcUJsRztBQUVEOzs7O0dBSUc7QUFDSCx3QkFBc0IsNkJBQTZCLENBQUMsYUFBYSxFQUFFLE1BQU0sR0FBRyxPQUFPLENBQUMsTUFBTSxDQUFDLENBRTFGO0FBRUQsd0JBQWdCLGlCQUFpQixDQUMvQixRQUFRLEVBQUUsTUFBTSxFQUNoQixnQkFBZ0IsRUFBRSxNQUFNLEVBQ3hCLFlBQVksRUFBRSxNQUFNLEVBQ3BCLFlBQVksQ0FBQyxFQUFFLE1BQU0sR0FDcEIsVUFBVSxHQUFHLGFBQWEsQ0FLNUI7QUFFRCx3QkFBc0IscUJBQXFCLENBQUMsS0FBSyxFQUFFLG9CQUFvQjs7O0dBdUV0RTtBQUVELHdCQUFzQix5QkFBeUIsQ0FBQyxPQUFPLENBQUMsRUFBRSxNQUFNLEVBQUUsSUFBSSxDQUFDLEVBQUUsTUFBTTs7O0dBb0I5RTtBQUVELHdCQUFzQixpQkFBaUIsQ0FBQyxJQUFJLEVBQUUsTUFBTSxFQUFFLFFBQVEsRUFBRSxPQUFPLGlCQUd0RTtBQUVELHdCQUFnQixxQkFBcUIsQ0FBQyxHQUFHLEVBQUUsS0FBSyxFQUFFLFNBQVMsRUFBRSxnQkFBZ0IsRUFBRSxRQXNCOUU7QUFFRCx3QkFBZ0IsY0FBYyxDQUFDLEdBQUcsRUFBRSxLQUFLLEVBQUUsUUFBUSxFQUFFLE9BQU8sR0FBRyxTQUFTLEVBQUUsR0FBRyxFQUFFLE9BQU8sUUFJckY7QUFFRDs7Ozs7Ozs7Ozs7R0FXRztBQUNILHdCQUFzQixxQkFBcUIsQ0FDekMsTUFBTSxFQUFFLE1BQU0sRUFDZCxZQUFZLEVBQUUsTUFBTSxFQUNwQixRQUFRLEVBQUUsTUFBTSxFQUNoQixhQUFhLEVBQUUsTUFBTSxFQUNyQixTQUFTLEVBQUUsTUFBTSxFQUNqQixjQUFjLEVBQUUsTUFBTSxHQUNyQixPQUFPLENBQUMsTUFBTSxDQUFDLENBU2pCO0FBRUQseUdBQXlHO0FBQ3pHLHdCQUFzQixtQkFBbUIsQ0FDdkMsVUFBVSxFQUFFLGlCQUFpQixFQUFFLEVBQy9CLE9BQU8sRUFBRTtJQUFFLE1BQU0sRUFBRSxNQUFNLENBQUM7SUFBQyxRQUFRLEVBQUUsTUFBTSxDQUFDO0lBQUMsT0FBTyxDQUFDLEVBQUUsTUFBTSxDQUFBO0NBQUUsR0FDOUQsT0FBTyxDQUFDLElBQUksQ0FBQyxDQXVCZjtBQUVELDhFQUE4RTtBQUM5RSx3QkFBc0Isc0JBQXNCLENBQzFDLE1BQU0sRUFBRSxNQUFNLEVBQ2QsWUFBWSxFQUFFLE1BQU0sRUFDcEIsUUFBUSxFQUFFLE1BQU0sRUFDaEIsYUFBYSxFQUFFLE1BQU0sR0FDcEIsT0FBTyxDQUFDLE1BQU0sQ0FBQyxDQVFqQjtBQUVELGtHQUFrRztBQUNsRyx3QkFBc0Isb0JBQW9CLENBQ3hDLFVBQVUsRUFBRSxpQkFBaUIsRUFBRSxFQUMvQixPQUFPLEVBQUU7SUFBRSxNQUFNLEVBQUUsTUFBTSxDQUFDO0lBQUMsUUFBUSxFQUFFLE1BQU0sQ0FBQTtDQUFFLEdBQzVDLE9BQU8sQ0FBQyxJQUFJLENBQUMsQ0FzQ2YifQ==
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic2hhcmVkLmQudHMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi9zcmMvY21kcy92YWxpZGF0b3Jfa2V5cy9zaGFyZWQudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBS0EsT0FBTyxLQUFLLEVBQUUsVUFBVSxFQUFFLE1BQU0sK0JBQStCLENBQUM7QUFDaEUsT0FBTyxLQUFLLEVBQUUsS0FBSyxFQUFFLE1BQU0sdUJBQXVCLENBQUM7QUFDbkQsT0FBTyxLQUFLLEVBQUUsVUFBVSxFQUFFLGFBQWEsRUFBRSxpQkFBaUIsRUFBRSxNQUFNLDRCQUE0QixDQUFDO0FBQy9GLE9BQU8sS0FBSyxFQUFFLFlBQVksRUFBRSxNQUFNLDZCQUE2QixDQUFDO0FBMkRoRSxNQUFNLE1BQU0sZ0JBQWdCLEdBQUc7SUFBRSxXQUFXLENBQUMsRUFBRSxNQUFNLENBQUM7SUFBQyxXQUFXLENBQUMsRUFBRSxNQUFNLENBQUM7SUFBQyxZQUFZLENBQUMsRUFBRSxNQUFNLEVBQUUsQ0FBQTtDQUFFLENBQUM7QUFFdkcsTUFBTSxNQUFNLG9CQUFvQixHQUFHO0lBQ2pDLGNBQWMsRUFBRSxNQUFNLENBQUM7SUFDdkIsY0FBYyxDQUFDLEVBQUUsTUFBTSxDQUFDO0lBQ3hCLFVBQVUsQ0FBQyxFQUFFLE1BQU0sRUFBRSxDQUFDO0lBQ3RCLFlBQVksRUFBRSxNQUFNLENBQUM7SUFDckIsZ0JBQWdCLEVBQUUsTUFBTSxDQUFDO0lBQ3pCLFFBQVEsRUFBRSxNQUFNLENBQUM7SUFDakIsR0FBRyxDQUFDLEVBQUUsTUFBTSxDQUFDO0lBQ2IsT0FBTyxDQUFDLEVBQUUsTUFBTSxDQUFDO0lBQ2pCLFlBQVksRUFBRSxZQUFZLENBQUM7SUFDM0IsUUFBUSxDQUFDLEVBQUUsVUFBVSxDQUFDO0lBQ3RCLFlBQVksQ0FBQyxFQUFFLE1BQU0sQ0FBQztDQUN2QixDQUFDO0FBRUYsd0JBQWdCLGtCQUFrQixDQUFDLElBQUksRUFBRSxNQUFNLEVBQUUsWUFBWSxHQUFFLE1BQVUsRUFBRSxZQUFZLEdBQUUsTUFBVSxVQXFCbEc7QUFFRDs7OztHQUlHO0FBQ0gsd0JBQXNCLDZCQUE2QixDQUFDLGFBQWEsRUFBRSxNQUFNLEdBQUcsT0FBTyxDQUFDLE1BQU0sQ0FBQyxDQUUxRjtBQUVELHdCQUFnQixpQkFBaUIsQ0FDL0IsUUFBUSxFQUFFLE1BQU0sRUFDaEIsZ0JBQWdCLEVBQUUsTUFBTSxFQUN4QixZQUFZLEVBQUUsTUFBTSxFQUNwQixZQUFZLENBQUMsRUFBRSxNQUFNLEdBQ3BCLFVBQVUsR0FBRyxhQUFhLENBSzVCO0FBRUQsd0JBQXNCLHFCQUFxQixDQUFDLEtBQUssRUFBRSxvQkFBb0I7OztHQXVFdEU7QUFFRCx3QkFBc0IseUJBQXlCLENBQUMsT0FBTyxDQUFDLEVBQUUsTUFBTSxFQUFFLElBQUksQ0FBQyxFQUFFLE1BQU07OztHQW9COUU7QUFFRCx3QkFBc0IsaUJBQWlCLENBQUMsSUFBSSxFQUFFLE1BQU0sRUFBRSxRQUFRLEVBQUUsT0FBTyxpQkFHdEU7QUFFRCx3QkFBZ0IscUJBQXFCLENBQUMsR0FBRyxFQUFFLEtBQUssRUFBRSxTQUFTLEVBQUUsZ0JBQWdCLEVBQUUsUUFzQjlFO0FBRUQsd0JBQWdCLGNBQWMsQ0FBQyxHQUFHLEVBQUUsS0FBSyxFQUFFLFFBQVEsRUFBRSxPQUFPLEdBQUcsU0FBUyxFQUFFLEdBQUcsRUFBRSxPQUFPLFFBSXJGO0FBRUQ7Ozs7Ozs7Ozs7O0dBV0c7QUFDSCx3QkFBc0IscUJBQXFCLENBQ3pDLE1BQU0sRUFBRSxNQUFNLEVBQ2QsWUFBWSxFQUFFLE1BQU0sRUFDcEIsUUFBUSxFQUFFLE1BQU0sRUFDaEIsYUFBYSxFQUFFLE1BQU0sRUFDckIsU0FBUyxFQUFFLE1BQU0sRUFDakIsY0FBYyxFQUFFLE1BQU0sR0FDckIsT0FBTyxDQUFDLE1BQU0sQ0FBQyxDQVNqQjtBQUVELHlHQUF5RztBQUN6Ryx3QkFBc0IsbUJBQW1CLENBQ3ZDLFVBQVUsRUFBRSxpQkFBaUIsRUFBRSxFQUMvQixPQUFPLEVBQUU7SUFBRSxNQUFNLEVBQUUsTUFBTSxDQUFDO0lBQUMsUUFBUSxFQUFFLE1BQU0sQ0FBQztJQUFDLE9BQU8sQ0FBQyxFQUFFLE1BQU0sQ0FBQTtDQUFFLEdBQzlELE9BQU8sQ0FBQyxJQUFJLENBQUMsQ0F3QmY7QUFFRCw4RUFBOEU7QUFDOUUsd0JBQXNCLHNCQUFzQixDQUMxQyxNQUFNLEVBQUUsTUFBTSxFQUNkLFlBQVksRUFBRSxNQUFNLEVBQ3BCLFFBQVEsRUFBRSxNQUFNLEVBQ2hCLGFBQWEsRUFBRSxNQUFNLEdBQ3BCLE9BQU8sQ0FBQyxNQUFNLENBQUMsQ0FPakI7QUFFRCxrR0FBa0c7QUFDbEcsd0JBQXNCLG9CQUFvQixDQUN4QyxVQUFVLEVBQUUsaUJBQWlCLEVBQUUsRUFDL0IsT0FBTyxFQUFFO0lBQUUsTUFBTSxFQUFFLE1BQU0sQ0FBQztJQUFDLFFBQVEsRUFBRSxNQUFNLENBQUE7Q0FBRSxHQUM1QyxPQUFPLENBQUMsSUFBSSxDQUFDLENBeUNmIn0=

package/dest/cmds/validator_keys/shared.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"shared.d.ts","sourceRoot":"","sources":["../../../src/cmds/validator_keys/shared.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,+BAA+B,CAAC;AAChE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AACnD,OAAO,KAAK,EAAE,UAAU,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAC/F,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAWhE,MAAM,MAAM,gBAAgB,GAAG;IAAE,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC;AAEvG,MAAM,MAAM,oBAAoB,GAAG;IACjC,cAAc,EAAE,MAAM,CAAC;IACvB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,gBAAgB,EAAE,MAAM,CAAC;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,YAAY,CAAC;IAC3B,QAAQ,CAAC,EAAE,UAAU,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,GAAE,MAAU,EAAE,YAAY,GAAE,MAAU,UAqBlG;AAED;;;;GAIG;AACH,wBAAsB,6BAA6B,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAE1F;AAED,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,MAAM,EAChB,gBAAgB,EAAE,MAAM,EACxB,YAAY,EAAE,MAAM,EACpB,YAAY,CAAC,EAAE,MAAM,GACpB,UAAU,GAAG,aAAa,CAK5B;AAED,wBAAsB,qBAAqB,CAAC,KAAK,EAAE,oBAAoB;;;GAuEtE;AAED,wBAAsB,yBAAyB,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM;;;GAoB9E;AAED,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,iBAGtE;AAED,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,KAAK,EAAE,SAAS,EAAE,gBAAgB,EAAE,QAsB9E;AAED,wBAAgB,cAAc,CAAC,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,GAAG,SAAS,EAAE,GAAG,EAAE,OAAO,QAIrF;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,qBAAqB,CACzC,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,EAChB,aAAa,EAAE,MAAM,EACrB,SAAS,EAAE,MAAM,EACjB,cAAc,EAAE,MAAM,GACrB,OAAO,CAAC,MAAM,CAAC,CASjB;AAED,yGAAyG;AACzG,wBAAsB,mBAAmB,CACvC,UAAU,EAAE,iBAAiB,EAAE,EAC/B,OAAO,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,GAC9D,OAAO,CAAC,IAAI,CAAC,CAuBf;AAED,8EAA8E;AAC9E,wBAAsB,sBAAsB,CAC1C,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,EAChB,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,MAAM,CAAC,CAQjB;AAED,kGAAkG;AAClG,wBAAsB,oBAAoB,CACxC,UAAU,EAAE,iBAAiB,EAAE,EAC/B,OAAO,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAC5C,OAAO,CAAC,IAAI,CAAC,CAsCf"}
+{"version":3,"file":"shared.d.ts","sourceRoot":"","sources":["../../../src/cmds/validator_keys/shared.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,+BAA+B,CAAC;AAChE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AACnD,OAAO,KAAK,EAAE,UAAU,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAC/F,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AA2DhE,MAAM,MAAM,gBAAgB,GAAG;IAAE,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC;AAEvG,MAAM,MAAM,oBAAoB,GAAG;IACjC,cAAc,EAAE,MAAM,CAAC;IACvB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,gBAAgB,EAAE,MAAM,CAAC;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,YAAY,CAAC;IAC3B,QAAQ,CAAC,EAAE,UAAU,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,GAAE,MAAU,EAAE,YAAY,GAAE,MAAU,UAqBlG;AAED;;;;GAIG;AACH,wBAAsB,6BAA6B,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAE1F;AAED,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,MAAM,EAChB,gBAAgB,EAAE,MAAM,EACxB,YAAY,EAAE,MAAM,EACpB,YAAY,CAAC,EAAE,MAAM,GACpB,UAAU,GAAG,aAAa,CAK5B;AAED,wBAAsB,qBAAqB,CAAC,KAAK,EAAE,oBAAoB;;;GAuEtE;AAED,wBAAsB,yBAAyB,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM;;;GAoB9E;AAED,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,iBAGtE;AAED,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,KAAK,EAAE,SAAS,EAAE,gBAAgB,EAAE,QAsB9E;AAED,wBAAgB,cAAc,CAAC,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,GAAG,SAAS,EAAE,GAAG,EAAE,OAAO,QAIrF;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,qBAAqB,CACzC,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,EAChB,aAAa,EAAE,MAAM,EACrB,SAAS,EAAE,MAAM,EACjB,cAAc,EAAE,MAAM,GACrB,OAAO,CAAC,MAAM,CAAC,CASjB;AAED,yGAAyG;AACzG,wBAAsB,mBAAmB,CACvC,UAAU,EAAE,iBAAiB,EAAE,EAC/B,OAAO,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,GAC9D,OAAO,CAAC,IAAI,CAAC,CAwBf;AAED,8EAA8E;AAC9E,wBAAsB,sBAAsB,CAC1C,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,EAChB,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,MAAM,CAAC,CAOjB;AAED,kGAAkG;AAClG,wBAAsB,oBAAoB,CACxC,UAAU,EAAE,iBAAiB,EAAE,EAC/B,OAAO,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAC5C,OAAO,CAAC,IAAI,CAAC,CAyCf"}

package/dest/cmds/validator_keys/shared.js

@@ -1,14 +1,58 @@
 import { prettyPrintJSON } from '@aztec/cli/utils';
+import { asyncPool } from '@aztec/foundation/async-pool';
 import { deriveBlsPrivateKey } from '@aztec/foundation/crypto/bls';
 import { createBn254Keystore } from '@aztec/foundation/crypto/bls/bn254_keystore';
 import { computeBn254G1PublicKeyCompressed } from '@aztec/foundation/crypto/bn254';
 import { Wallet } from '@ethersproject/wallet';
 import { constants as fsConstants, mkdirSync } from 'fs';
 import { access, writeFile } from 'fs/promises';
-import { homedir } from 'os';
+import { availableParallelism, homedir } from 'os';
 import { dirname, isAbsolute, join } from 'path';
 import { mnemonicToAccount } from 'viem/accounts';
+import { Worker } from 'worker_threads';
 import { defaultBlsPath } from './utils.js';
+// ethers' default scrypt parameters use substantial memory, so keep worker fan-out bounded.
+const maxEthKeystoreWorkers = Math.max(1, Math.min(4, availableParallelism()));
+function deserializeWorkerError(error) {
+    const result = new Error(error.message);
+    result.name = error.name ?? result.name;
+    result.stack = error.stack;
+    return result;
+}
+function encryptEthJsonV3InWorker(privateKeyHex, password) {
+    return new Promise((resolve, reject)=>{
+        const worker = new Worker(new URL('./eth_json_v3_worker.js', import.meta.url), {
+            workerData: {
+                privateKeyHex,
+                password
+            }
+        });
+        let settled = false;
+        worker.once('message', (result)=>{
+            settled = true;
+            if ('json' in result) {
+                resolve(result.json);
+            } else {
+                reject(deserializeWorkerError(result.error));
+            }
+        });
+        worker.once('error', (error)=>{
+            settled = true;
+            reject(error);
+        });
+        worker.once('exit', (code)=>{
+            if (!settled) {
+                reject(new Error(`ETH JSON V3 worker stopped with exit code ${code}`));
+            }
+        });
+    });
+}
+async function encryptEthJsonV3(privateKeyHex, password) {
+    if (process.env.JEST_WORKER_ID !== undefined) {
+        return await new Wallet(privateKeyHex).encrypt(password);
+    }
+    return await encryptEthJsonV3InWorker(privateKeyHex, password);
+}
 export function withValidatorIndex(path, accountIndex = 0, addressIndex = 0) {
     // NOTE: The legacy BLS CLI is to allow users who generated keys in 2.1.4 to be able to use the same command
     // to re-generate their keys. In 2.1.5 we switched how we append addresses to the path so this is to maintain backwards compatibility.
@@ -188,7 +232,7 @@ export function maybePrintJson(log, jsonFlag, obj) {
     mkdirSync(outDir, {
         recursive: true
     });
-    const keystore = createBn254Keystore(password, privateKeyHex, pubkeyHex, derivationPath);
+    const keystore = await createBn254Keystore(password, privateKeyHex, pubkeyHex, derivationPath);
     const safeBase = fileNameBase.replace(/[^a-zA-Z0-9_-]/g, '_');
     const outPath = join(outDir, `keystore-${safeBase}.json`);
     await writeFile(outPath, JSON.stringify(keystore, null, 2), {
@@ -197,16 +241,15 @@ export function maybePrintJson(log, jsonFlag, obj) {
     return outPath;
 }
 /** Replace plaintext BLS keys in validators with { path, password } pointing to BN254 keystore files. */ export async function writeBlsBn254ToFile(validators, options) {
-    for(let i = 0; i < validators.length; i++){
-        const v = validators[i];
+    await Promise.all(validators.map(async (v, i)=>{
         if (!v || typeof v !== 'object' || !('attester' in v)) {
-            continue;
+            return;
         }
         const att = v.attester;
         // Shapes: { bls: <hex> } or { eth: <ethAccount>, bls?: <hex> } or plain EthAccount
         const blsKey = typeof att === 'object' && 'bls' in att ? att.bls : undefined;
         if (!blsKey || typeof blsKey !== 'string') {
-            continue;
+            return;
         }
         const pub = await computeBlsPublicKeyCompressed(blsKey);
         const path = options.blsPath ?? defaultBlsPath;
@@ -218,15 +261,14 @@ export function maybePrintJson(log, jsonFlag, obj) {
                 password: options.password
             };
         }
-    }
+    }));
 }
 /** Writes an Ethereum JSON V3 keystore using ethers, returns absolute path */ export async function writeEthJsonV3Keystore(outDir, fileNameBase, password, privateKeyHex) {
     const safeBase = fileNameBase.replace(/[^a-zA-Z0-9_-]/g, '_');
     mkdirSync(outDir, {
         recursive: true
     });
-    const wallet = new Wallet(privateKeyHex);
-    const json = await wallet.encrypt(password);
+    const json = await encryptEthJsonV3(privateKeyHex, password);
     const outPath = join(outDir, `keystore-eth-${safeBase}.json`);
     await writeFile(outPath, json, {
         encoding: 'utf-8'
@@ -234,16 +276,18 @@ export function maybePrintJson(log, jsonFlag, obj) {
     return outPath;
 }
 /** Replace plaintext ETH keys in validators with { path, password } pointing to JSON V3 files. */ export async function writeEthJsonV3ToFile(validators, options) {
-    const maybeEncryptEth = async (account, label)=>{
+    const tasks = [];
+    const maybeQueueEncryptEth = (account, label, setEncryptedAccount)=>{
         if (typeof account === 'string' && account.startsWith('0x') && account.length === 66) {
-            const fileBase = `${label}_${account.slice(2, 10)}`;
-            const p = await writeEthJsonV3Keystore(options.outDir, fileBase, options.password, account);
-            return {
-                path: p,
-                password: options.password
-            };
+            tasks.push(async ()=>{
+                const fileBase = `${label}_${account.slice(2, 10)}`;
+                const path = await writeEthJsonV3Keystore(options.outDir, fileBase, options.password, account);
+                setEncryptedAccount({
+                    path,
+                    password: options.password
+                });
+            });
         }
-        return account;
     };
     for(let i = 0; i < validators.length; i++){
         const v = validators[i];
@@ -253,22 +297,21 @@ export function maybePrintJson(log, jsonFlag, obj) {
         // attester may be string (eth), object with eth, or remote signer
         const att = v.attester;
         if (typeof att === 'string') {
-            v.attester = await maybeEncryptEth(att, `attester_${i + 1}`);
+            maybeQueueEncryptEth(att, `attester_${i + 1}`, (account)=>v.attester = account);
         } else if (att && typeof att === 'object' && 'eth' in att) {
-            att.eth = await maybeEncryptEth(att.eth, `attester_${i + 1}`);
+            maybeQueueEncryptEth(att.eth, `attester_${i + 1}`, (account)=>att.eth = account);
         }
         // publisher can be single or array
         if ('publisher' in v) {
             const pub = v.publisher;
             if (Array.isArray(pub)) {
-                const out = [];
                 for(let j = 0; j < pub.length; j++){
-                    out.push(await maybeEncryptEth(pub[j], `publisher_${i + 1}_${j + 1}`));
+                    maybeQueueEncryptEth(pub[j], `publisher_${i + 1}_${j + 1}`, (account)=>pub[j] = account);
                 }
-                v.publisher = out;
             } else if (pub !== undefined) {
-                v.publisher = await maybeEncryptEth(pub, `publisher_${i + 1}`);
+                maybeQueueEncryptEth(pub, `publisher_${i + 1}`, (account)=>v.publisher = account);
             }
         }
     }
+    await asyncPool(maxEthKeystoreWorkers, tasks, (task)=>task());
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aztec/cli",
-  "version": "5.0.0-nightly.20260703",
+  "version": "5.0.0-nightly.20260705",
   "type": "module",
   "exports": {
     "./contracts": "./dest/cmds/contracts/index.js",
@@ -77,23 +77,23 @@
     ]
   },
   "dependencies": {
-    "@aztec/accounts": "5.0.0-nightly.20260703",
-    "@aztec/archiver": "5.0.0-nightly.20260703",
-    "@aztec/aztec.js": "5.0.0-nightly.20260703",
-    "@aztec/constants": "5.0.0-nightly.20260703",
-    "@aztec/entrypoints": "5.0.0-nightly.20260703",
-    "@aztec/ethereum": "5.0.0-nightly.20260703",
-    "@aztec/foundation": "5.0.0-nightly.20260703",
-    "@aztec/l1-artifacts": "5.0.0-nightly.20260703",
-    "@aztec/node-keystore": "5.0.0-nightly.20260703",
-    "@aztec/node-lib": "5.0.0-nightly.20260703",
-    "@aztec/p2p": "5.0.0-nightly.20260703",
-    "@aztec/protocol-contracts": "5.0.0-nightly.20260703",
-    "@aztec/sequencer-client": "5.0.0-nightly.20260703",
-    "@aztec/slasher": "5.0.0-nightly.20260703",
-    "@aztec/stdlib": "5.0.0-nightly.20260703",
-    "@aztec/wallets": "5.0.0-nightly.20260703",
-    "@aztec/world-state": "5.0.0-nightly.20260703",
+    "@aztec/accounts": "5.0.0-nightly.20260705",
+    "@aztec/archiver": "5.0.0-nightly.20260705",
+    "@aztec/aztec.js": "5.0.0-nightly.20260705",
+    "@aztec/constants": "5.0.0-nightly.20260705",
+    "@aztec/entrypoints": "5.0.0-nightly.20260705",
+    "@aztec/ethereum": "5.0.0-nightly.20260705",
+    "@aztec/foundation": "5.0.0-nightly.20260705",
+    "@aztec/l1-artifacts": "5.0.0-nightly.20260705",
+    "@aztec/node-keystore": "5.0.0-nightly.20260705",
+    "@aztec/node-lib": "5.0.0-nightly.20260705",
+    "@aztec/p2p": "5.0.0-nightly.20260705",
+    "@aztec/protocol-contracts": "5.0.0-nightly.20260705",
+    "@aztec/sequencer-client": "5.0.0-nightly.20260705",
+    "@aztec/slasher": "5.0.0-nightly.20260705",
+    "@aztec/stdlib": "5.0.0-nightly.20260705",
+    "@aztec/wallets": "5.0.0-nightly.20260705",
+    "@aztec/world-state": "5.0.0-nightly.20260705",
     "@ethersproject/wallet": "^5.8.0",
     "@iarna/toml": "^2.2.5",
     "@libp2p/peer-id-factory": "^3.0.4",
@@ -107,9 +107,9 @@
     "viem": "npm:@aztec/viem@2.38.2"
   },
   "devDependencies": {
-    "@aztec/aztec-node": "5.0.0-nightly.20260703",
-    "@aztec/kv-store": "5.0.0-nightly.20260703",
-    "@aztec/telemetry-client": "5.0.0-nightly.20260703",
+    "@aztec/aztec-node": "5.0.0-nightly.20260705",
+    "@aztec/kv-store": "5.0.0-nightly.20260705",
+    "@aztec/telemetry-client": "5.0.0-nightly.20260705",
     "@jest/globals": "^30.0.0",
     "@types/jest": "^30.0.0",
     "@types/lodash.chunk": "^4.2.9",
@@ -126,15 +126,15 @@
     "typescript": "^5.3.3"
   },
   "peerDependencies": {
-    "@aztec/accounts": "5.0.0-nightly.20260703",
-    "@aztec/bb-prover": "5.0.0-nightly.20260703",
-    "@aztec/ethereum": "5.0.0-nightly.20260703",
-    "@aztec/l1-artifacts": "5.0.0-nightly.20260703",
-    "@aztec/noir-contracts.js": "5.0.0-nightly.20260703",
-    "@aztec/noir-protocol-circuits-types": "5.0.0-nightly.20260703",
-    "@aztec/noir-test-contracts.js": "5.0.0-nightly.20260703",
-    "@aztec/protocol-contracts": "5.0.0-nightly.20260703",
-    "@aztec/stdlib": "5.0.0-nightly.20260703"
+    "@aztec/accounts": "5.0.0-nightly.20260705",
+    "@aztec/bb-prover": "5.0.0-nightly.20260705",
+    "@aztec/ethereum": "5.0.0-nightly.20260705",
+    "@aztec/l1-artifacts": "5.0.0-nightly.20260705",
+    "@aztec/noir-contracts.js": "5.0.0-nightly.20260705",
+    "@aztec/noir-protocol-circuits-types": "5.0.0-nightly.20260705",
+    "@aztec/noir-test-contracts.js": "5.0.0-nightly.20260705",
+    "@aztec/protocol-contracts": "5.0.0-nightly.20260705",
+    "@aztec/stdlib": "5.0.0-nightly.20260705"
   },
   "files": [
     "dest",

package/src/cmds/validator_keys/eth_json_v3_worker.ts

@@ -0,0 +1,30 @@
+import { Wallet } from '@ethersproject/wallet';
+import { parentPort, workerData } from 'worker_threads';
+
+type EthJsonV3WorkerData = {
+  privateKeyHex: string;
+  password: string;
+};
+
+type SerializedError = {
+  message: string;
+  name?: string;
+  stack?: string;
+};
+
+function serializeError(error: unknown): SerializedError {
+  if (error instanceof Error) {
+    return { message: error.message, name: error.name, stack: error.stack };
+  }
+  return { message: String(error) };
+}
+
+void (async () => {
+  try {
+    const { privateKeyHex, password } = workerData as EthJsonV3WorkerData;
+    const json = await new Wallet(privateKeyHex).encrypt(password);
+    parentPort?.postMessage({ json });
+  } catch (error) {
+    parentPort?.postMessage({ error: serializeError(error) });
+  }
+})();

package/src/cmds/validator_keys/index.ts

@@ -1,6 +1,6 @@
 import type { LogFn } from '@aztec/foundation/log';
 
-import { Command } from 'commander';
+import { Command, Option } from 'commander';
 
 import { parseAztecAddress, parseEthereumAddress, parseHex, parseOptionalInteger } from '../../utils/commands.js';
 import { defaultBlsPath } from './utils.js';
@@ -38,10 +38,24 @@ export function injectCommands(program: Command, log: LogFn) {
     .option('--remote-signer <url>', 'Default remote signer URL for accounts in this file')
     .option('--ikm <hex>', 'Initial keying material for BLS (alternative to mnemonic)', value => parseHex(value, 32))
     .option('--bls-path <path>', `EIP-2334 path (default ${defaultBlsPath})`)
-    .option(
-      '--password <str>',
-      'Password for writing keystore files (ETH JSON V3 and BLS EIP-2335). Empty string allowed',
+    .addOption(
+      new Option('--password <str>', 'Shared password for writing ETH JSON V3 and BLS EIP-2335 keystore files').env(
+        'AZTEC_KEYSTORE_PASSWORD',
+      ),
+    )
+    .option('--password-file <path>', 'File containing the shared password for writing keystore files')
+    .addOption(
+      new Option('--eth-password <str>', 'Password for writing ETH JSON V3 keystore files').env(
+        'AZTEC_ETH_KEYSTORE_PASSWORD',
+      ),
+    )
+    .option('--eth-password-file <path>', 'File containing the password for writing ETH JSON V3 keystore files')
+    .addOption(
+      new Option('--bls-password <str>', 'Password for writing BLS EIP-2335 keystore files').env(
+        'AZTEC_BLS_KEYSTORE_PASSWORD',
+      ),
     )
+    .option('--bls-password-file <path>', 'File containing the password for writing BLS EIP-2335 keystore files')
     .option('--encrypted-keystore-dir <dir>', 'Output directory for encrypted keystore file(s)')
     .option('--json', 'Echo resulting JSON to stdout')
     .option('--staker-output', 'Generate a single staker output JSON file with an array of validator entries')

package/src/cmds/validator_keys/new.ts

@@ -6,7 +6,7 @@ import type { LogFn } from '@aztec/foundation/log';
 import type { AztecAddress } from '@aztec/stdlib/aztec-address';
 
 import { wordlist } from '@scure/bip39/wordlists/english.js';
-import { writeFile } from 'fs/promises';
+import { readFile, writeFile } from 'fs/promises';
 import { basename, dirname, join } from 'path';
 import { createPublicClient, fallback, http } from 'viem';
 import { generateMnemonic, mnemonicToAccount } from 'viem/accounts';
@@ -42,6 +42,11 @@ export type NewValidatorKeystoreOptions = {
   ikm?: string;
   blsPath?: string;
   password?: string;
+  passwordFile?: string;
+  ethPassword?: string;
+  ethPasswordFile?: string;
+  blsPassword?: string;
+  blsPasswordFile?: string;
   encryptedKeystoreDir?: string;
   json?: boolean;
   feeRecipient: AztecAddress;
@@ -53,6 +58,86 @@ export type NewValidatorKeystoreOptions = {
   l1ChainId?: number;
 };
 
+type PasswordSourceOptions = Pick<
+  NewValidatorKeystoreOptions,
+  'password' | 'passwordFile' | 'ethPassword' | 'ethPasswordFile' | 'blsPassword' | 'blsPasswordFile'
+>;
+
+type PasswordSource = {
+  password?: string;
+  passwordFile?: string;
+  passwordOption: string;
+  passwordFileOption: string;
+};
+
+function validatePassword(password: string, source: string): string {
+  if (password.length === 0) {
+    throw new Error(`${source} cannot be empty`);
+  }
+  return password;
+}
+
+function stripOneTrailingNewline(password: string): string {
+  if (password.endsWith('\n')) {
+    password = password.slice(0, -1);
+  }
+  if (password.endsWith('\r')) {
+    password = password.slice(0, -1);
+  }
+  return password;
+}
+
+async function resolvePasswordSource(source: PasswordSource): Promise<string | undefined> {
+  if (source.password !== undefined && source.passwordFile !== undefined) {
+    throw new Error(`${source.passwordOption} and ${source.passwordFileOption} cannot be used together`);
+  }
+  if (source.password !== undefined) {
+    return validatePassword(source.password, source.passwordOption);
+  }
+  if (source.passwordFile !== undefined) {
+    if (source.passwordFile.length === 0) {
+      throw new Error(`${source.passwordFileOption} cannot be empty`);
+    }
+    const password = stripOneTrailingNewline(await readFile(source.passwordFile, 'utf-8'));
+    return validatePassword(password, source.passwordFileOption);
+  }
+
+  return undefined;
+}
+
+async function resolvePasswords(options: PasswordSourceOptions) {
+  const sharedPassword = await resolvePasswordSource({
+    password: options.password,
+    passwordFile: options.passwordFile,
+    passwordOption: '--password',
+    passwordFileOption: '--password-file',
+  });
+  const ethPassword =
+    (await resolvePasswordSource({
+      password: options.ethPassword,
+      passwordFile: options.ethPasswordFile,
+      passwordOption: '--eth-password',
+      passwordFileOption: '--eth-password-file',
+    })) ?? sharedPassword;
+  const blsPassword =
+    (await resolvePasswordSource({
+      password: options.blsPassword,
+      passwordFile: options.blsPasswordFile,
+      passwordOption: '--bls-password',
+      passwordFileOption: '--bls-password-file',
+    })) ?? sharedPassword;
+
+  if (ethPassword === undefined && blsPassword === undefined) {
+    return {};
+  }
+  if (ethPassword === undefined || blsPassword === undefined) {
+    throw new Error(
+      'Both ETH and BLS passwords are required when writing encrypted keystores. Provide --password to use one password for both, or provide both --eth-password and --bls-password.',
+    );
+  }
+  return { ethPassword, blsPassword };
+}
+
 export async function newValidatorKeystore(options: NewValidatorKeystoreOptions, log: LogFn) {
   // validate bls-path inputs before proceeding with key generation
   validateBlsPathOptions(options);
@@ -78,7 +163,12 @@ export async function newValidatorKeystore(options: NewValidatorKeystoreOptions,
     blsPath,
     ikm,
     mnemonic: _mnemonic,
-    password,
+    password: passwordOption,
+    passwordFile,
+    ethPassword: ethPasswordOption,
+    ethPasswordFile,
+    blsPassword: blsPasswordOption,
+    blsPasswordFile,
     encryptedKeystoreDir,
     stakerOutput,
     gseAddress,
@@ -86,9 +176,18 @@ export async function newValidatorKeystore(options: NewValidatorKeystoreOptions,
     l1ChainId,
   } = options;
 
+  const { ethPassword, blsPassword } = await resolvePasswords({
+    password: passwordOption,
+    passwordFile,
+    ethPassword: ethPasswordOption,
+    ethPasswordFile,
+    blsPassword: blsPasswordOption,
+    blsPasswordFile,
+  });
+  const shouldEncryptKeystores = ethPassword !== undefined && blsPassword !== undefined;
   const mnemonic = _mnemonic ?? generateMnemonic(wordlist);
 
-  if (!_mnemonic && !json) {
+  if (!_mnemonic && !json && !shouldEncryptKeystores) {
     log('No mnemonic provided, generating new one...');
     log(`Using new mnemonic:`);
     log('');
@@ -115,11 +214,11 @@ export async function newValidatorKeystore(options: NewValidatorKeystoreOptions,
   });
 
   // If password provided, write ETH JSON V3 and BLS BN254 keystores and replace plaintext
-  if (password !== undefined) {
+  if (shouldEncryptKeystores) {
     const encryptedKeystoreOutDir =
       encryptedKeystoreDir && encryptedKeystoreDir.length > 0 ? encryptedKeystoreDir : keystoreOutDir;
-    await writeEthJsonV3ToFile(validators, { outDir: encryptedKeystoreOutDir, password });
-    await writeBlsBn254ToFile(validators, { outDir: encryptedKeystoreOutDir, password });
+    await writeEthJsonV3ToFile(validators, { outDir: encryptedKeystoreOutDir, password: ethPassword });
+    await writeBlsBn254ToFile(validators, { outDir: encryptedKeystoreOutDir, password: blsPassword });
   }
 
   const keystore = {
@@ -145,7 +244,7 @@ export async function newValidatorKeystore(options: NewValidatorKeystoreOptions,
     // Process each validator
     for (let i = 0; i < validators.length; i++) {
       const validator = validators[i];
-      const outputs = await processAttesterAccounts(validator.attester, gse, password);
+      const outputs = await processAttesterAccounts(validator.attester, gse);
 
       // Collect all staker outputs
       for (let j = 0; j < outputs.length; j++) {
@@ -160,7 +259,7 @@ export async function newValidatorKeystore(options: NewValidatorKeystoreOptions,
     }
   }
 
-  const outputData = !_mnemonic ? { ...keystore, generatedMnemonic: mnemonic } : keystore;
+  const outputData = !_mnemonic && !shouldEncryptKeystores ? { ...keystore, generatedMnemonic: mnemonic } : keystore;
 
   // Handle JSON output
   if (json) {

package/src/cmds/validator_keys/shared.ts

@@ -1,4 +1,5 @@
 import { prettyPrintJSON } from '@aztec/cli/utils';
+import { asyncPool } from '@aztec/foundation/async-pool';
 import { deriveBlsPrivateKey } from '@aztec/foundation/crypto/bls';
 import { createBn254Keystore } from '@aztec/foundation/crypto/bls/bn254_keystore';
 import { computeBn254G1PublicKeyCompressed } from '@aztec/foundation/crypto/bn254';
@@ -10,12 +11,60 @@ import type { AztecAddress } from '@aztec/stdlib/aztec-address';
 import { Wallet } from '@ethersproject/wallet';
 import { constants as fsConstants, mkdirSync } from 'fs';
 import { access, writeFile } from 'fs/promises';
-import { homedir } from 'os';
+import { availableParallelism, homedir } from 'os';
 import { dirname, isAbsolute, join } from 'path';
 import { mnemonicToAccount } from 'viem/accounts';
+import { Worker } from 'worker_threads';
 
 import { defaultBlsPath } from './utils.js';
 
+type EthJsonV3WorkerResult = { json: string } | { error: { message: string; name?: string; stack?: string } };
+
+// ethers' default scrypt parameters use substantial memory, so keep worker fan-out bounded.
+const maxEthKeystoreWorkers = Math.max(1, Math.min(4, availableParallelism()));
+
+function deserializeWorkerError(error: { message: string; name?: string; stack?: string }) {
+  const result = new Error(error.message);
+  result.name = error.name ?? result.name;
+  result.stack = error.stack;
+  return result;
+}
+
+function encryptEthJsonV3InWorker(privateKeyHex: string, password: string): Promise<string> {
+  return new Promise<string>((resolve, reject) => {
+    const worker = new Worker(new URL('./eth_json_v3_worker.js', import.meta.url), {
+      workerData: { privateKeyHex, password },
+    });
+    let settled = false;
+
+    worker.once('message', (result: EthJsonV3WorkerResult) => {
+      settled = true;
+
+      if ('json' in result) {
+        resolve(result.json);
+      } else {
+        reject(deserializeWorkerError(result.error));
+      }
+    });
+    worker.once('error', error => {
+      settled = true;
+      reject(error);
+    });
+    worker.once('exit', code => {
+      if (!settled) {
+        reject(new Error(`ETH JSON V3 worker stopped with exit code ${code}`));
+      }
+    });
+  });
+}
+
+async function encryptEthJsonV3(privateKeyHex: string, password: string): Promise<string> {
+  if (process.env.JEST_WORKER_ID !== undefined) {
+    return await new Wallet(privateKeyHex).encrypt(password);
+  }
+  return await encryptEthJsonV3InWorker(privateKeyHex, password);
+}
+
 export type ValidatorSummary = { attesterEth?: string; attesterBls?: string; publisherEth?: string[] };
 
 export type BuildValidatorsInput = {
@@ -228,7 +277,7 @@ export async function writeBn254BlsKeystore(
 ): Promise<string> {
   mkdirSync(outDir, { recursive: true });
 
-  const keystore = createBn254Keystore(password, privateKeyHex, pubkeyHex, derivationPath);
+  const keystore = await createBn254Keystore(password, privateKeyHex, pubkeyHex, derivationPath);
 
   const safeBase = fileNameBase.replace(/[^a-zA-Z0-9_-]/g, '_');
   const outPath = join(outDir, `keystore-${safeBase}.json`);
@@ -241,28 +290,29 @@ export async function writeBlsBn254ToFile(
   validators: ValidatorKeyStore[],
   options: { outDir: string; password: string; blsPath?: string },
 ): Promise<void> {
-  for (let i = 0; i < validators.length; i++) {
-    const v = validators[i];
-    if (!v || typeof v !== 'object' || !('attester' in v)) {
-      continue;
-    }
-    const att = (v as any).attester;
+  await Promise.all(
+    validators.map(async (v, i) => {
+      if (!v || typeof v !== 'object' || !('attester' in v)) {
+        return;
+      }
+      const att = (v as any).attester;
 
-    // Shapes: { bls: <hex> } or { eth: <ethAccount>, bls?: <hex> } or plain EthAccount
-    const blsKey: string | undefined = typeof att === 'object' && 'bls' in att ? (att as any).bls : undefined;
-    if (!blsKey || typeof blsKey !== 'string') {
-      continue;
-    }
+      // Shapes: { bls: <hex> } or { eth: <ethAccount>, bls?: <hex> } or plain EthAccount
+      const blsKey: string | undefined = typeof att === 'object' && 'bls' in att ? (att as any).bls : undefined;
+      if (!blsKey || typeof blsKey !== 'string') {
+        return;
+      }
 
-    const pub = await computeBlsPublicKeyCompressed(blsKey);
-    const path = options.blsPath ?? defaultBlsPath;
-    const fileBase = `${String(i + 1)}_${pub.slice(2, 18)}`;
-    const keystorePath = await writeBn254BlsKeystore(options.outDir, fileBase, options.password, blsKey, pub, path);
+      const pub = await computeBlsPublicKeyCompressed(blsKey);
+      const path = options.blsPath ?? defaultBlsPath;
+      const fileBase = `${String(i + 1)}_${pub.slice(2, 18)}`;
+      const keystorePath = await writeBn254BlsKeystore(options.outDir, fileBase, options.password, blsKey, pub, path);
 
-    if (typeof att === 'object') {
-      (att as any).bls = { path: keystorePath, password: options.password };
-    }
-  }
+      if (typeof att === 'object') {
+        (att as any).bls = { path: keystorePath, password: options.password };
+      }
+    }),
+  );
 }
 
 /** Writes an Ethereum JSON V3 keystore using ethers, returns absolute path */
@@ -274,8 +324,7 @@ export async function writeEthJsonV3Keystore(
 ): Promise<string> {
   const safeBase = fileNameBase.replace(/[^a-zA-Z0-9_-]/g, '_');
   mkdirSync(outDir, { recursive: true });
-  const wallet = new Wallet(privateKeyHex);
-  const json = await wallet.encrypt(password);
+  const json = await encryptEthJsonV3(privateKeyHex, password);
   const outPath = join(outDir, `keystore-eth-${safeBase}.json`);
   await writeFile(outPath, json, { encoding: 'utf-8' });
   return outPath;
@@ -286,13 +335,16 @@ export async function writeEthJsonV3ToFile(
   validators: ValidatorKeyStore[],
   options: { outDir: string; password: string },
 ): Promise<void> {
-  const maybeEncryptEth = async (account: any, label: string) => {
+  const tasks: (() => Promise<void>)[] = [];
+
+  const maybeQueueEncryptEth = (account: any, label: string, setEncryptedAccount: (account: any) => void) => {
     if (typeof account === 'string' && account.startsWith('0x') && account.length === 66) {
-      const fileBase = `${label}_${account.slice(2, 10)}`;
-      const p = await writeEthJsonV3Keystore(options.outDir, fileBase, options.password, account);
-      return { path: p, password: options.password };
+      tasks.push(async () => {
+        const fileBase = `${label}_${account.slice(2, 10)}`;
+        const path = await writeEthJsonV3Keystore(options.outDir, fileBase, options.password, account);
+        setEncryptedAccount({ path, password: options.password });
+      });
     }
-    return account;
   };
 
   for (let i = 0; i < validators.length; i++) {
@@ -304,23 +356,23 @@ export async function writeEthJsonV3ToFile(
     // attester may be string (eth), object with eth, or remote signer
     const att = (v as any).attester;
     if (typeof att === 'string') {
-      (v as any).attester = await maybeEncryptEth(att, `attester_${i + 1}`);
+      maybeQueueEncryptEth(att, `attester_${i + 1}`, account => ((v as any).attester = account));
     } else if (att && typeof att === 'object' && 'eth' in att) {
-      (att as any).eth = await maybeEncryptEth((att as any).eth, `attester_${i + 1}`);
+      maybeQueueEncryptEth((att as any).eth, `attester_${i + 1}`, account => ((att as any).eth = account));
     }
 
     // publisher can be single or array
     if ('publisher' in v) {
       const pub = (v as any).publisher;
       if (Array.isArray(pub)) {
-        const out: any[] = [];
         for (let j = 0; j < pub.length; j++) {
-          out.push(await maybeEncryptEth(pub[j], `publisher_${i + 1}_${j + 1}`));
+          maybeQueueEncryptEth(pub[j], `publisher_${i + 1}_${j + 1}`, account => (pub[j] = account));
         }
-        (v as any).publisher = out;
       } else if (pub !== undefined) {
-        (v as any).publisher = await maybeEncryptEth(pub, `publisher_${i + 1}`);
+        maybeQueueEncryptEth(pub, `publisher_${i + 1}`, account => ((v as any).publisher = account));
       }
     }
   }
+
+  await asyncPool(maxEthKeystoreWorkers, tasks, task => task());
 }