@aztec/cli 5.0.0-rc.2 → 5.0.1

package/src/cmds/validator_keys/set_funding_account.ts

@@ -0,0 +1,55 @@
+import type { LogFn } from '@aztec/foundation/log';
+import { loadKeystoreFile } from '@aztec/node-keystore/loader';
+import type { KeyStore } from '@aztec/node-keystore/types';
+
+import { dirname } from 'path';
+import { privateKeyToAccount } from 'viem/accounts';
+
+import { encryptFundingAccountToFile, maybePrintJson, resolveFundingAccount, writeKeystoreFile } from './shared.js';
+import { validateFundingAccountOptions } from './utils.js';
+
+export type SetFundingAccountOptions = {
+  remoteSigner?: string;
+  password?: string;
+  encryptedKeystoreDir?: string;
+  json?: boolean;
+};
+
+/**
+ * Sets the top-level funding account of an existing keystore, replacing any previous one. The
+ * account may be a private key, or an address paired with a remote signer URL. With a password,
+ * a plaintext key is encrypted to an ETH JSON V3 file and stored as a { path, password } reference.
+ */
+export async function setFundingAccount(
+  existing: string,
+  fundingAccount: string,
+  options: SetFundingAccountOptions,
+  log: LogFn,
+) {
+  const { remoteSigner, password, encryptedKeystoreDir, json } = options;
+
+  const keystore: KeyStore = loadKeystoreFile(existing);
+
+  const validated = { fundingAccount, remoteSigner };
+  validateFundingAccountOptions(validated, !!keystore.remoteSigner);
+
+  let resolved = resolveFundingAccount(validated.fundingAccount!, remoteSigner);
+  if (password !== undefined) {
+    const outDir = encryptedKeystoreDir && encryptedKeystoreDir.length > 0 ? encryptedKeystoreDir : dirname(existing);
+    resolved = await encryptFundingAccountToFile(resolved, { outDir, password });
+  }
+
+  if (keystore.fundingAccount) {
+    log('Replacing existing funding account in keystore');
+  }
+  keystore.fundingAccount = resolved;
+
+  await writeKeystoreFile(existing, keystore);
+
+  if (!json) {
+    const value = validated.fundingAccount!;
+    const funderAddress = value.length === 66 ? privateKeyToAccount(value as `0x${string}`).address : value;
+    log(`Set funding account ${funderAddress} in ${existing}`);
+  }
+  maybePrintJson(log, !!json, keystore as unknown as Record<string, any>);
+}

package/src/cmds/validator_keys/shared.ts

@@ -1,8 +1,9 @@
 import { prettyPrintJSON } from '@aztec/cli/utils';
+import { asyncPool } from '@aztec/foundation/async-pool';
 import { deriveBlsPrivateKey } from '@aztec/foundation/crypto/bls';
 import { createBn254Keystore } from '@aztec/foundation/crypto/bls/bn254_keystore';
 import { computeBn254G1PublicKeyCompressed } from '@aztec/foundation/crypto/bn254';
-import type { EthAddress } from '@aztec/foundation/eth-address';
+import { EthAddress } from '@aztec/foundation/eth-address';
 import type { LogFn } from '@aztec/foundation/log';
 import type { EthAccount, EthPrivateKey, ValidatorKeyStore } from '@aztec/node-keystore/types';
 import type { AztecAddress } from '@aztec/stdlib/aztec-address';
@@ -10,12 +11,60 @@ import type { AztecAddress } from '@aztec/stdlib/aztec-address';
 import { Wallet } from '@ethersproject/wallet';
 import { constants as fsConstants, mkdirSync } from 'fs';
 import { access, writeFile } from 'fs/promises';
-import { homedir } from 'os';
+import { availableParallelism, homedir } from 'os';
 import { dirname, isAbsolute, join } from 'path';
 import { mnemonicToAccount } from 'viem/accounts';
+import { Worker } from 'worker_threads';
 
 import { defaultBlsPath } from './utils.js';
 
+type EthJsonV3WorkerResult = { json: string } | { error: { message: string; name?: string; stack?: string } };
+
+// ethers' default scrypt parameters use substantial memory, so keep worker fan-out bounded.
+const maxEthKeystoreWorkers = Math.max(1, Math.min(4, availableParallelism()));
+
+function deserializeWorkerError(error: { message: string; name?: string; stack?: string }) {
+  const result = new Error(error.message);
+  result.name = error.name ?? result.name;
+  result.stack = error.stack;
+  return result;
+}
+
+function encryptEthJsonV3InWorker(privateKeyHex: string, password: string): Promise<string> {
+  return new Promise<string>((resolve, reject) => {
+    const worker = new Worker(new URL('./eth_json_v3_worker.js', import.meta.url), {
+      workerData: { privateKeyHex, password },
+    });
+    let settled = false;
+
+    worker.once('message', (result: EthJsonV3WorkerResult) => {
+      settled = true;
+
+      if ('json' in result) {
+        resolve(result.json);
+      } else {
+        reject(deserializeWorkerError(result.error));
+      }
+    });
+    worker.once('error', error => {
+      settled = true;
+      reject(error);
+    });
+    worker.once('exit', code => {
+      if (!settled) {
+        reject(new Error(`ETH JSON V3 worker stopped with exit code ${code}`));
+      }
+    });
+  });
+}
+
+async function encryptEthJsonV3(privateKeyHex: string, password: string): Promise<string> {
+  if (process.env.JEST_WORKER_ID !== undefined) {
+    return await new Wallet(privateKeyHex).encrypt(password);
+  }
+  return await encryptEthJsonV3InWorker(privateKeyHex, password);
+}
+
 export type ValidatorSummary = { attesterEth?: string; attesterBls?: string; publisherEth?: string[] };
 
 export type BuildValidatorsInput = {
@@ -76,6 +125,21 @@ export function deriveEthAttester(
     : (('0x' + Buffer.from(acct.getHdKey().privateKey!).toString('hex')) as EthPrivateKey);
 }
 
+/**
+ * Resolve a `--funding-account` value into a keystore `EthAccount`. A 66-char value is a private key
+ * (used verbatim). A 42-char value is an address: with an explicit `remoteSigner` URL it becomes an
+ * `{ address, remoteSignerUrl }` pair; without one it is stored as a bare address that falls back to
+ * the keystore-level remote signer at runtime. Callers must validate the value first (see
+ * `validateFundingAccountOptions`).
+ */
+export function resolveFundingAccount(fundingAccount: string, remoteSigner?: string): EthAccount {
+  if (fundingAccount.length === 66) {
+    return fundingAccount as EthPrivateKey;
+  }
+  const address = EthAddress.fromString(fundingAccount);
+  return remoteSigner ? ({ address, remoteSignerUrl: remoteSigner } as EthAccount) : address;
+}
+
 export async function buildValidatorEntries(input: BuildValidatorsInput) {
   const {
     validatorCount,
@@ -228,7 +292,7 @@ export async function writeBn254BlsKeystore(
 ): Promise<string> {
   mkdirSync(outDir, { recursive: true });
 
-  const keystore = createBn254Keystore(password, privateKeyHex, pubkeyHex, derivationPath);
+  const keystore = await createBn254Keystore(password, privateKeyHex, pubkeyHex, derivationPath);
 
   const safeBase = fileNameBase.replace(/[^a-zA-Z0-9_-]/g, '_');
   const outPath = join(outDir, `keystore-${safeBase}.json`);
@@ -241,28 +305,29 @@ export async function writeBlsBn254ToFile(
   validators: ValidatorKeyStore[],
   options: { outDir: string; password: string; blsPath?: string },
 ): Promise<void> {
-  for (let i = 0; i < validators.length; i++) {
-    const v = validators[i];
-    if (!v || typeof v !== 'object' || !('attester' in v)) {
-      continue;
-    }
-    const att = (v as any).attester;
+  await Promise.all(
+    validators.map(async (v, i) => {
+      if (!v || typeof v !== 'object' || !('attester' in v)) {
+        return;
+      }
+      const att = (v as any).attester;
 
-    // Shapes: { bls: <hex> } or { eth: <ethAccount>, bls?: <hex> } or plain EthAccount
-    const blsKey: string | undefined = typeof att === 'object' && 'bls' in att ? (att as any).bls : undefined;
-    if (!blsKey || typeof blsKey !== 'string') {
-      continue;
-    }
+      // Shapes: { bls: <hex> } or { eth: <ethAccount>, bls?: <hex> } or plain EthAccount
+      const blsKey: string | undefined = typeof att === 'object' && 'bls' in att ? (att as any).bls : undefined;
+      if (!blsKey || typeof blsKey !== 'string') {
+        return;
+      }
 
-    const pub = await computeBlsPublicKeyCompressed(blsKey);
-    const path = options.blsPath ?? defaultBlsPath;
-    const fileBase = `${String(i + 1)}_${pub.slice(2, 18)}`;
-    const keystorePath = await writeBn254BlsKeystore(options.outDir, fileBase, options.password, blsKey, pub, path);
+      const pub = await computeBlsPublicKeyCompressed(blsKey);
+      const path = options.blsPath ?? defaultBlsPath;
+      const fileBase = `${String(i + 1)}_${pub.slice(2, 18)}`;
+      const keystorePath = await writeBn254BlsKeystore(options.outDir, fileBase, options.password, blsKey, pub, path);
 
-    if (typeof att === 'object') {
-      (att as any).bls = { path: keystorePath, password: options.password };
-    }
-  }
+      if (typeof att === 'object') {
+        (att as any).bls = { path: keystorePath, password: options.password };
+      }
+    }),
+  );
 }
 
 /** Writes an Ethereum JSON V3 keystore using ethers, returns absolute path */
@@ -274,25 +339,48 @@ export async function writeEthJsonV3Keystore(
 ): Promise<string> {
   const safeBase = fileNameBase.replace(/[^a-zA-Z0-9_-]/g, '_');
   mkdirSync(outDir, { recursive: true });
-  const wallet = new Wallet(privateKeyHex);
-  const json = await wallet.encrypt(password);
+  const json = await encryptEthJsonV3(privateKeyHex, password);
   const outPath = join(outDir, `keystore-eth-${safeBase}.json`);
   await writeFile(outPath, json, { encoding: 'utf-8' });
   return outPath;
 }
 
+/**
+ * If `account` is a plaintext ETH private key, encrypt it to a JSON V3 file and return a
+ * { path, password } reference; otherwise return it unchanged.
+ */
+async function maybeEncryptEthAccount(account: any, label: string, options: { outDir: string; password: string }) {
+  if (typeof account === 'string' && account.startsWith('0x') && account.length === 66) {
+    const fileBase = `${label}_${account.slice(2, 10)}`;
+    const p = await writeEthJsonV3Keystore(options.outDir, fileBase, options.password, account);
+    return { path: p, password: options.password };
+  }
+  return account;
+}
+
+/** Encrypt a plaintext funding-account key to a JSON V3 file, replacing it with a { path, password } reference. */
+export async function encryptFundingAccountToFile(
+  account: EthAccount,
+  options: { outDir: string; password: string },
+): Promise<EthAccount> {
+  return (await maybeEncryptEthAccount(account, 'funding', options)) as EthAccount;
+}
+
 /** Replace plaintext ETH keys in validators with { path, password } pointing to JSON V3 files. */
 export async function writeEthJsonV3ToFile(
   validators: ValidatorKeyStore[],
   options: { outDir: string; password: string },
 ): Promise<void> {
-  const maybeEncryptEth = async (account: any, label: string) => {
+  const tasks: (() => Promise<void>)[] = [];
+
+  const maybeQueueEncryptEth = (account: any, label: string, setEncryptedAccount: (account: any) => void) => {
     if (typeof account === 'string' && account.startsWith('0x') && account.length === 66) {
-      const fileBase = `${label}_${account.slice(2, 10)}`;
-      const p = await writeEthJsonV3Keystore(options.outDir, fileBase, options.password, account);
-      return { path: p, password: options.password };
+      tasks.push(async () => {
+        const fileBase = `${label}_${account.slice(2, 10)}`;
+        const path = await writeEthJsonV3Keystore(options.outDir, fileBase, options.password, account);
+        setEncryptedAccount({ path, password: options.password });
+      });
     }
-    return account;
   };
 
   for (let i = 0; i < validators.length; i++) {
@@ -304,23 +392,23 @@ export async function writeEthJsonV3ToFile(
     // attester may be string (eth), object with eth, or remote signer
     const att = (v as any).attester;
     if (typeof att === 'string') {
-      (v as any).attester = await maybeEncryptEth(att, `attester_${i + 1}`);
+      maybeQueueEncryptEth(att, `attester_${i + 1}`, account => ((v as any).attester = account));
     } else if (att && typeof att === 'object' && 'eth' in att) {
-      (att as any).eth = await maybeEncryptEth((att as any).eth, `attester_${i + 1}`);
+      maybeQueueEncryptEth((att as any).eth, `attester_${i + 1}`, account => ((att as any).eth = account));
     }
 
     // publisher can be single or array
     if ('publisher' in v) {
       const pub = (v as any).publisher;
       if (Array.isArray(pub)) {
-        const out: any[] = [];
         for (let j = 0; j < pub.length; j++) {
-          out.push(await maybeEncryptEth(pub[j], `publisher_${i + 1}_${j + 1}`));
+          maybeQueueEncryptEth(pub[j], `publisher_${i + 1}_${j + 1}`, account => (pub[j] = account));
         }
-        (v as any).publisher = out;
       } else if (pub !== undefined) {
-        (v as any).publisher = await maybeEncryptEth(pub, `publisher_${i + 1}`);
+        maybeQueueEncryptEth(pub, `publisher_${i + 1}`, account => ((v as any).publisher = account));
       }
     }
   }
+
+  await asyncPool(maxEthKeystoreWorkers, tasks, task => task());
 }

package/src/cmds/validator_keys/utils.ts

@@ -1,4 +1,4 @@
-import type { EthAddress } from '@aztec/foundation/eth-address';
+import { EthAddress } from '@aztec/foundation/eth-address';
 import { ethPrivateKeySchema } from '@aztec/node-keystore/schemas';
 import type { EthPrivateKey } from '@aztec/node-keystore/types';
 
@@ -79,3 +79,46 @@ export function validatePublisherOptions(options: { publishers?: string[]; publi
     options.publishers = normalizedKeys as EthPrivateKey[];
   }
 }
+
+/**
+ * Validates and normalizes the `--funding-account` option in place. The value may be a private key
+ * (used as a local signer) or an ETH address. An address needs a remote signer to sign funding txs:
+ * either `--remote-signer`, or a keystore that already defines one (pass `hasKeystoreRemoteSigner`),
+ * which a bare address inherits at runtime.
+ */
+export function validateFundingAccountOptions(
+  options: { fundingAccount?: string; remoteSigner?: string },
+  hasKeystoreRemoteSigner = false,
+) {
+  if (!options.fundingAccount) {
+    return;
+  }
+
+  let value = options.fundingAccount.trim();
+  if (!value.startsWith('0x')) {
+    value = '0x' + value;
+  }
+
+  if (value.length === 66) {
+    try {
+      ethPrivateKeySchema.parse(value);
+    } catch (error) {
+      throw new Error(`Invalid funding account private key: ${error instanceof Error ? error.message : String(error)}`);
+    }
+  } else if (value.length === 42) {
+    try {
+      EthAddress.fromString(value);
+    } catch (error) {
+      throw new Error(`Invalid funding account address: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    if (!options.remoteSigner && !hasKeystoreRemoteSigner) {
+      throw new Error(
+        '--funding-account as an address requires --remote-signer, or a keystore that already defines a remote signer',
+      );
+    }
+  } else {
+    throw new Error('Invalid funding account: expected a 32-byte private key or a 20-byte address');
+  }
+
+  options.fundingAccount = value;
+}

package/src/utils/commands.ts

@@ -1,4 +1,5 @@
 import { Fr } from '@aztec/foundation/curves/bn254';
+import { GrumpkinScalar } from '@aztec/foundation/curves/grumpkin';
 import { EthAddress } from '@aztec/foundation/eth-address';
 import type { LogFn } from '@aztec/foundation/log';
 import type { PXE } from '@aztec/pxe/server';
@@ -50,14 +51,14 @@ export const l1ChainIdOption = new Option('-c, --l1-chain-id <number>', 'Chain I
     return parsedValue;
   });
 
-export const createSecretKeyOption = (
+export const createSigningKeyOption = (
   description: string,
   mandatory: boolean,
-  argsParser?: (value: string, previous: Fr) => Fr,
+  argsParser?: (value: string, previous: GrumpkinScalar) => GrumpkinScalar,
 ) =>
-  new Option('-sk, --secret-key <string>', description)
-    .env('SECRET_KEY')
-    .argParser(argsParser ?? parseSecretKey)
+  new Option('-sk, --signing-key <string>', description)
+    .env('SIGNING_KEY')
+    .argParser(argsParser ?? parseSigningKey)
     .makeOptionMandatory(mandatory);
 
 export const logJson = (log: LogFn) => (obj: object) => log(JSON.stringify(obj, null, 2));
@@ -357,16 +358,16 @@ export function parsePartialAddress(address: string): Fr {
 }
 
 /**
- * Parses a secret key from a string.
- * @param privateKey - A string
- * @returns A secret key
+ * Parses an account signing key from a string.
+ * @param signingKey - A string
+ * @returns A signing key
  * @throws InvalidArgumentError if the input string is not valid.
  */
-export function parseSecretKey(secretKey: string): Fr {
+export function parseSigningKey(signingKey: string): GrumpkinScalar {
   try {
-    return Fr.fromHexString(secretKey);
+    return GrumpkinScalar.fromHexString(signingKey);
   } catch {
-    throw new InvalidArgumentError(`Invalid encryption secret key: ${secretKey}`);
+    throw new InvalidArgumentError(`Invalid signing key: ${signingKey}`);
   }
 }