@aztec/node-keystore 0.0.1-commit.21caa21

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
@@ -0,0 +1,579 @@
1
+ /**
2
+ * Keystore Manager
3
+ *
4
+ * Manages keystore configuration and delegates signing operations to appropriate signers.
5
+ */ import { Buffer32 } from '@aztec/foundation/buffer';
6
+ import { Wallet } from '@ethersproject/wallet';
7
+ import { readFileSync, readdirSync, statSync } from 'fs';
8
+ import { extname, join } from 'path';
9
+ import { mnemonicToAccount } from 'viem/accounts';
10
+ import { ethPrivateKeySchema } from './schemas.js';
11
+ import { LocalSigner, RemoteSigner } from './signer.js';
12
+ /**
13
+ * Error thrown when keystore operations fail
14
+ */ export class KeystoreError extends Error {
15
+ cause;
16
+ constructor(message, cause){
17
+ super(message), this.cause = cause;
18
+ this.name = 'KeystoreError';
19
+ }
20
+ }
21
+ /**
22
+ * Keystore Manager - coordinates signing operations based on keystore configuration
23
+ */ export class KeystoreManager {
24
+ keystore;
25
+ /**
26
+ * Create a keystore manager from a parsed configuration.
27
+ * Performs a lightweight duplicate-attester check without decrypting JSON V3 or deriving mnemonics.
28
+ * @param keystore Parsed keystore configuration
29
+ */ constructor(keystore){
30
+ this.keystore = keystore;
31
+ this.validateUniqueAttesterAddresses();
32
+ }
33
+ /**
34
+ * Validates all remote signers in the keystore are accessible and have the required addresses.
35
+ * Should be called after construction if validation is needed.
36
+ */ async validateSigners() {
37
+ // Collect all remote signers with their addresses grouped by URL
38
+ const remoteSignersByUrl = new Map();
39
+ // Helper to extract remote signer URL from config
40
+ const getUrl = (config)=>{
41
+ return typeof config === 'string' ? config : config.remoteSignerUrl;
42
+ };
43
+ // Helper to collect remote signers from accounts
44
+ const collectRemoteSigners = (accounts, defaultRemoteSigner)=>{
45
+ const processAccount = (account)=>{
46
+ if (typeof account === 'object' && !('path' in account) && !('mnemonic' in account)) {
47
+ // This is a remote signer account
48
+ const remoteSigner = account;
49
+ const address = 'address' in remoteSigner ? remoteSigner.address : remoteSigner;
50
+ let url;
51
+ if ('remoteSignerUrl' in remoteSigner && remoteSigner.remoteSignerUrl) {
52
+ url = remoteSigner.remoteSignerUrl;
53
+ } else if (defaultRemoteSigner) {
54
+ url = getUrl(defaultRemoteSigner);
55
+ } else {
56
+ return; // No remote signer URL available
57
+ }
58
+ if (!remoteSignersByUrl.has(url)) {
59
+ remoteSignersByUrl.set(url, new Set());
60
+ }
61
+ remoteSignersByUrl.get(url).add(address.toString());
62
+ }
63
+ };
64
+ if (Array.isArray(accounts)) {
65
+ accounts.forEach((account)=>collectRemoteSigners(account, defaultRemoteSigner));
66
+ } else if (typeof accounts === 'object' && 'mnemonic' in accounts) {
67
+ // Skip mnemonic configs
68
+ } else {
69
+ processAccount(accounts);
70
+ }
71
+ };
72
+ // Collect from validators
73
+ const validatorCount = this.getValidatorCount();
74
+ for(let i = 0; i < validatorCount; i++){
75
+ const validator = this.getValidator(i);
76
+ const remoteSigner = validator.remoteSigner || this.keystore.remoteSigner;
77
+ collectRemoteSigners(this.extractEthAccountsFromAttester(validator.attester), remoteSigner);
78
+ if (validator.publisher) {
79
+ collectRemoteSigners(validator.publisher, remoteSigner);
80
+ }
81
+ }
82
+ // Collect from slasher
83
+ if (this.keystore.slasher) {
84
+ collectRemoteSigners(this.keystore.slasher, this.keystore.remoteSigner);
85
+ }
86
+ // Collect from prover
87
+ if (this.keystore.prover && typeof this.keystore.prover === 'object' && 'publisher' in this.keystore.prover) {
88
+ collectRemoteSigners(this.keystore.prover.publisher, this.keystore.remoteSigner);
89
+ }
90
+ // Validate each remote signer URL with all its addresses
91
+ for (const [url, addresses] of remoteSignersByUrl.entries()){
92
+ if (addresses.size > 0) {
93
+ await RemoteSigner.validateAccess(url, Array.from(addresses));
94
+ }
95
+ }
96
+ }
97
+ /**
98
+ * Validates that attester addresses are unique across all validators
99
+ * Only checks simple private key attesters, not JSON-V3 or mnemonic attesters,
100
+ * these are validated when decrypting the JSON-V3 keystore files
101
+ * @throws KeystoreError if duplicate attester addresses are found
102
+ */ validateUniqueAttesterAddresses() {
103
+ const seenAddresses = new Set();
104
+ const validatorCount = this.getValidatorCount();
105
+ for(let validatorIndex = 0; validatorIndex < validatorCount; validatorIndex++){
106
+ const validator = this.getValidator(validatorIndex);
107
+ const addresses = this.extractAddressesWithoutSensitiveOperations(validator.attester);
108
+ for (const addr of addresses){
109
+ const address = addr.toString().toLowerCase();
110
+ if (seenAddresses.has(address)) {
111
+ throw new KeystoreError(`Duplicate attester address found: ${addr.toString()}. An attester address may only appear once across all configuration blocks.`);
112
+ }
113
+ seenAddresses.add(address);
114
+ }
115
+ }
116
+ }
117
+ /**
118
+ * Best-effort address extraction that avoids decryption/derivation (no JSON-V3 or mnemonic processing).
119
+ * This is used at construction time to check for obvious duplicates without throwing for invalid inputs.
120
+ */ extractAddressesWithoutSensitiveOperations(accounts) {
121
+ const ethAccounts = this.extractEthAccountsFromAttester(accounts);
122
+ return this.extractAddressesFromEthAccountsNonSensitive(ethAccounts);
123
+ }
124
+ /**
125
+ * Extract addresses from EthAccounts without sensitive operations (no decryption/derivation).
126
+ */ extractAddressesFromEthAccountsNonSensitive(accounts) {
127
+ const results = [];
128
+ const handleAccount = (account)=>{
129
+ if (typeof account === 'string') {
130
+ if (account.startsWith('0x') && account.length === 66) {
131
+ try {
132
+ const signer = new LocalSigner(Buffer32.fromString(ethPrivateKeySchema.parse(account)));
133
+ results.push(signer.address);
134
+ } catch {
135
+ // ignore invalid private key at construction time
136
+ }
137
+ }
138
+ return;
139
+ }
140
+ if ('path' in account) {
141
+ return;
142
+ }
143
+ if ('mnemonic' in account) {
144
+ return;
145
+ }
146
+ const remoteSigner = account;
147
+ if ('address' in remoteSigner) {
148
+ results.push(remoteSigner.address);
149
+ return;
150
+ }
151
+ results.push(remoteSigner);
152
+ };
153
+ if (Array.isArray(accounts)) {
154
+ for (const account of accounts){
155
+ handleAccount(account);
156
+ }
157
+ return results;
158
+ }
159
+ if (typeof accounts === 'object' && accounts !== null && 'mnemonic' in accounts) {
160
+ return results;
161
+ }
162
+ handleAccount(accounts);
163
+ return results;
164
+ }
165
+ /**
166
+ * Create signers for validator attester accounts
167
+ */ createAttesterSigners(validatorIndex) {
168
+ const validator = this.getValidator(validatorIndex);
169
+ const ethAccounts = this.extractEthAccountsFromAttester(validator.attester);
170
+ return this.createSignersFromEthAccounts(ethAccounts, validator.remoteSigner || this.keystore.remoteSigner);
171
+ }
172
+ /**
173
+ * Create signers for validator publisher accounts (falls back to attester if not specified)
174
+ */ createPublisherSigners(validatorIndex) {
175
+ const validator = this.getValidator(validatorIndex);
176
+ if (validator.publisher) {
177
+ return this.createSignersFromEthAccounts(validator.publisher, validator.remoteSigner || this.keystore.remoteSigner);
178
+ }
179
+ // Fall back to attester signers
180
+ return this.createAttesterSigners(validatorIndex);
181
+ }
182
+ createAllValidatorPublisherSigners() {
183
+ const numValidators = this.getValidatorCount();
184
+ const allPublishers = [];
185
+ for(let i = 0; i < numValidators; i++){
186
+ allPublishers.push(...this.createPublisherSigners(i));
187
+ }
188
+ return allPublishers;
189
+ }
190
+ /**
191
+ * Create signers for slasher accounts
192
+ */ createSlasherSigners() {
193
+ if (!this.keystore.slasher) {
194
+ return [];
195
+ }
196
+ return this.createSignersFromEthAccounts(this.keystore.slasher, this.keystore.remoteSigner);
197
+ }
198
+ /**
199
+ * Create signers for prover accounts
200
+ */ createProverSigners() {
201
+ if (!this.keystore.prover) {
202
+ return undefined;
203
+ }
204
+ // Handle prover being a private key, JSON key store or remote signer with nested address
205
+ if (typeof this.keystore.prover === 'string' || 'path' in this.keystore.prover || 'address' in this.keystore.prover) {
206
+ const signers = this.createSignersFromEthAccounts(this.keystore.prover, this.keystore.remoteSigner);
207
+ return {
208
+ id: undefined,
209
+ signers
210
+ };
211
+ }
212
+ // Handle prover as Id and specified publishers
213
+ if ('id' in this.keystore.prover) {
214
+ const id = this.keystore.prover.id;
215
+ const signers = this.createSignersFromEthAccounts(this.keystore.prover.publisher, this.keystore.remoteSigner);
216
+ return {
217
+ id,
218
+ signers
219
+ };
220
+ }
221
+ // Here, prover is just an EthAddress for a remote signer
222
+ const signers = this.createSignersFromEthAccounts(this.keystore.prover, this.keystore.remoteSigner);
223
+ return {
224
+ id: undefined,
225
+ signers
226
+ };
227
+ }
228
+ /**
229
+ * Get validator configuration by index
230
+ */ getValidator(index) {
231
+ if (!this.keystore.validators || index >= this.keystore.validators.length || index < 0) {
232
+ throw new KeystoreError(`Validator index ${index} out of bounds`);
233
+ }
234
+ return this.keystore.validators[index];
235
+ }
236
+ /**
237
+ * Get validator count
238
+ */ getValidatorCount() {
239
+ return this.keystore.validators?.length || 0;
240
+ }
241
+ /**
242
+ * Get coinbase address for validator (falls back to the specific attester address)
243
+ */ getCoinbaseAddress(validatorIndex, attesterAddress) {
244
+ const validator = this.getValidator(validatorIndex);
245
+ if (validator.coinbase) {
246
+ return validator.coinbase;
247
+ }
248
+ // Fall back to the specific attester address
249
+ return attesterAddress;
250
+ }
251
+ /**
252
+ * Get fee recipient for validator
253
+ */ getFeeRecipient(validatorIndex) {
254
+ const validator = this.getValidator(validatorIndex);
255
+ return validator.feeRecipient;
256
+ }
257
+ /**
258
+ * Get the raw slasher configuration as provided in the keystore file.
259
+ * @returns The slasher accounts configuration or undefined if not set
260
+ */ getSlasherAccounts() {
261
+ return this.keystore.slasher;
262
+ }
263
+ /**
264
+ * Get the raw prover configuration as provided in the keystore file.
265
+ * @returns The prover configuration or undefined if not set
266
+ */ getProverConfig() {
267
+ return this.keystore.prover;
268
+ }
269
+ /**
270
+ * Resolves attester accounts (including JSON V3 and mnemonic) and checks for duplicate addresses across validators.
271
+ * Throws if the same resolved address appears in more than one validator configuration.
272
+ */ validateResolvedUniqueAttesterAddresses() {
273
+ const seenAddresses = new Set();
274
+ const validatorCount = this.getValidatorCount();
275
+ for(let validatorIndex = 0; validatorIndex < validatorCount; validatorIndex++){
276
+ const validator = this.getValidator(validatorIndex);
277
+ const signers = this.createSignersFromEthAccounts(this.extractEthAccountsFromAttester(validator.attester), validator.remoteSigner || this.keystore.remoteSigner);
278
+ for (const signer of signers){
279
+ const address = signer.address.toString().toLowerCase();
280
+ if (seenAddresses.has(address)) {
281
+ throw new KeystoreError(`Duplicate attester address found after resolving accounts: ${address}. An attester address may only appear once across all configuration blocks.`);
282
+ }
283
+ seenAddresses.add(address);
284
+ }
285
+ }
286
+ }
287
+ /**
288
+ * Create signers from EthAccounts configuration
289
+ */ createSignersFromEthAccounts(accounts, defaultRemoteSigner) {
290
+ if (typeof accounts === 'string') {
291
+ return [
292
+ this.createSignerFromEthAccount(accounts, defaultRemoteSigner)
293
+ ];
294
+ }
295
+ if (Array.isArray(accounts)) {
296
+ const signers = [];
297
+ for (const account of accounts){
298
+ const accountSigners = this.createSignersFromEthAccounts(account, defaultRemoteSigner);
299
+ signers.push(...accountSigners);
300
+ }
301
+ return signers;
302
+ }
303
+ // Mnemonic configuration
304
+ if ('mnemonic' in accounts) {
305
+ return this.createSignersFromMnemonic(accounts);
306
+ }
307
+ // Single account object - handle JSON V3 directory case
308
+ if ('path' in accounts) {
309
+ const result = this.createSignerFromJsonV3(accounts);
310
+ return result;
311
+ }
312
+ return [
313
+ this.createSignerFromEthAccount(accounts, defaultRemoteSigner)
314
+ ];
315
+ }
316
+ /**
317
+ * Create a signer from a single EthAccount configuration
318
+ */ createSignerFromEthAccount(account, defaultRemoteSigner) {
319
+ // Private key (hex string)
320
+ if (typeof account === 'string') {
321
+ if (account.startsWith('0x') && account.length === 66) {
322
+ // Private key
323
+ return new LocalSigner(Buffer32.fromString(ethPrivateKeySchema.parse(account)));
324
+ } else {
325
+ throw new Error(`Invalid private key`);
326
+ }
327
+ }
328
+ // JSON V3 keystore
329
+ if ('path' in account) {
330
+ const result = this.createSignerFromJsonV3(account);
331
+ return result[0];
332
+ }
333
+ // Remote signer account
334
+ const remoteSigner = account;
335
+ if ('address' in remoteSigner) {
336
+ // Remote signer with config
337
+ const config = remoteSigner.remoteSignerUrl ? {
338
+ remoteSignerUrl: remoteSigner.remoteSignerUrl,
339
+ certPath: remoteSigner.certPath,
340
+ certPass: remoteSigner.certPass
341
+ } : defaultRemoteSigner;
342
+ if (!config) {
343
+ throw new KeystoreError(`No remote signer configuration found for address ${remoteSigner.address}`);
344
+ }
345
+ return new RemoteSigner(remoteSigner.address, config);
346
+ }
347
+ // Just an address - use default config
348
+ if (!defaultRemoteSigner) {
349
+ throw new KeystoreError(`No remote signer configuration found for address ${remoteSigner}`);
350
+ }
351
+ return new RemoteSigner(remoteSigner, defaultRemoteSigner);
352
+ }
353
+ /**
354
+ * Create signer from JSON V3 keystore file or directory
355
+ */ createSignerFromJsonV3(config) {
356
+ try {
357
+ const stats = statSync(config.path);
358
+ if (stats.isDirectory()) {
359
+ // Handle directory - load all JSON files
360
+ const files = readdirSync(config.path);
361
+ const signers = [];
362
+ const seenAddresses = new Map(); // address -> file name
363
+ for (const file of files){
364
+ // Only process .json files
365
+ if (extname(file).toLowerCase() !== '.json') {
366
+ continue;
367
+ }
368
+ const filePath = join(config.path, file);
369
+ try {
370
+ const signer = this.createSignerFromSingleJsonV3File(filePath, config.password);
371
+ const addressString = signer.address.toString().toLowerCase();
372
+ const existingFile = seenAddresses.get(addressString);
373
+ if (existingFile) {
374
+ throw new KeystoreError(`Duplicate JSON V3 keystore address ${addressString} found in directory ${config.path} (files: ${existingFile} and ${file}). Each keystore must have a unique address.`);
375
+ }
376
+ seenAddresses.set(addressString, file);
377
+ signers.push(signer);
378
+ } catch (error) {
379
+ // Re-throw with file context
380
+ throw new KeystoreError(`Failed to load keystore file ${file}: ${error}`, error);
381
+ }
382
+ }
383
+ if (signers.length === 0) {
384
+ throw new KeystoreError(`No JSON keystore files found in directory ${config.path}`);
385
+ }
386
+ return signers;
387
+ } else {
388
+ // Single file
389
+ return [
390
+ this.createSignerFromSingleJsonV3File(config.path, config.password)
391
+ ];
392
+ }
393
+ } catch (error) {
394
+ if (error instanceof KeystoreError) {
395
+ throw error;
396
+ }
397
+ throw new KeystoreError(`Failed to access JSON V3 keystore ${config.path}: ${error}`, error);
398
+ }
399
+ }
400
+ /**
401
+ * Create signer from a single JSON V3 keystore file
402
+ */ createSignerFromSingleJsonV3File(filePath, password) {
403
+ try {
404
+ // Read the keystore file
405
+ const keystoreJson = readFileSync(filePath, 'utf8');
406
+ // Get password - prompt for it if not provided
407
+ const resolvedPassword = password;
408
+ if (!resolvedPassword) {
409
+ throw new KeystoreError(`No password provided for keystore ${filePath}. Provide password in config.`);
410
+ }
411
+ // Use @ethersproject/wallet to decrypt the JSON V3 keystore synchronously
412
+ const ethersWallet = Wallet.fromEncryptedJsonSync(keystoreJson, resolvedPassword);
413
+ // Convert the private key to our format
414
+ const privateKey = Buffer32.fromString(ethersWallet.privateKey);
415
+ return new LocalSigner(privateKey);
416
+ } catch (error) {
417
+ const err = error;
418
+ throw new KeystoreError(`Failed to decrypt JSON V3 keystore ${filePath}: ${err.message}`, err);
419
+ }
420
+ }
421
+ /**
422
+ * Create signers from mnemonic configuration using BIP44 derivation
423
+ */ createSignersFromMnemonic(config) {
424
+ const { mnemonic, addressIndex = 0, accountIndex = 0, addressCount = 1, accountCount = 1 } = config;
425
+ const signers = [];
426
+ try {
427
+ // Use viem's mnemonic derivation (imported at top of file)
428
+ // Normalize mnemonic by trimming whitespace
429
+ const normalizedMnemonic = mnemonic.trim();
430
+ for(let accIdx = accountIndex; accIdx < accountIndex + accountCount; accIdx++){
431
+ for(let addrIdx = addressIndex; addrIdx < addressIndex + addressCount; addrIdx++){
432
+ const viemAccount = mnemonicToAccount(normalizedMnemonic, {
433
+ accountIndex: accIdx,
434
+ addressIndex: addrIdx
435
+ });
436
+ // Extract the private key from the viem account
437
+ const privateKeyBytes = viemAccount.getHdKey().privateKey;
438
+ const privateKey = Buffer32.fromBuffer(Buffer.from(privateKeyBytes));
439
+ signers.push(new LocalSigner(privateKey));
440
+ }
441
+ }
442
+ return signers;
443
+ } catch (error) {
444
+ throw new KeystoreError(`Failed to derive accounts from mnemonic: ${error}`, error);
445
+ }
446
+ }
447
+ /**
448
+ * Sign message with a specific signer
449
+ */ async signMessage(signer, message) {
450
+ return await signer.signMessage(message);
451
+ }
452
+ /**
453
+ * Sign typed data with a specific signer
454
+ */ async signTypedData(signer, typedData) {
455
+ return await signer.signTypedData(typedData);
456
+ }
457
+ /**
458
+ * Get the effective remote signer configuration for a specific attester address
459
+ * Precedence: account-level override > validator-level config > file-level default
460
+ */ getEffectiveRemoteSignerConfig(validatorIndex, attesterAddress) {
461
+ const validator = this.getValidator(validatorIndex);
462
+ // Helper to get address from an account configuration
463
+ const getAddressFromAccount = (account)=>{
464
+ if (typeof account === 'string') {
465
+ if (account.startsWith('0x') && account.length === 66) {
466
+ // This is a private key - derive the address
467
+ try {
468
+ const signer = new LocalSigner(Buffer32.fromString(ethPrivateKeySchema.parse(account)));
469
+ return signer.address;
470
+ } catch {
471
+ return undefined;
472
+ }
473
+ }
474
+ return undefined;
475
+ }
476
+ // JSON V3 keystore
477
+ if ('path' in account) {
478
+ try {
479
+ const signers = this.createSignerFromJsonV3(account);
480
+ return signers.map((s)=>s.address);
481
+ } catch {
482
+ return undefined;
483
+ }
484
+ }
485
+ // Remote signer account, either it is an address or the address is nested
486
+ const remoteSigner = account;
487
+ if ('address' in remoteSigner) {
488
+ return remoteSigner.address;
489
+ }
490
+ return remoteSigner;
491
+ };
492
+ // Helper to check if account matches and get its remote signer config
493
+ const checkAccount = (account)=>{
494
+ const addresses = getAddressFromAccount(account);
495
+ if (!addresses) {
496
+ return undefined;
497
+ }
498
+ const addressArray = Array.isArray(addresses) ? addresses : [
499
+ addresses
500
+ ];
501
+ const matches = addressArray.some((addr)=>addr.equals(attesterAddress));
502
+ if (!matches) {
503
+ return undefined;
504
+ }
505
+ // Found a match - determine the config to return
506
+ if (typeof account === 'string') {
507
+ return undefined;
508
+ }
509
+ // JSON V3 - local signer, no remote config
510
+ if ('path' in account) {
511
+ return undefined;
512
+ }
513
+ // Remote signer account with potential override
514
+ const remoteSigner = account;
515
+ if ('address' in remoteSigner) {
516
+ // Has inline config
517
+ if (remoteSigner.remoteSignerUrl) {
518
+ return {
519
+ remoteSignerUrl: remoteSigner.remoteSignerUrl,
520
+ certPath: remoteSigner.certPath,
521
+ certPass: remoteSigner.certPass
522
+ };
523
+ } else {
524
+ // No URL specified, use defaults
525
+ return validator.remoteSigner || this.keystore.remoteSigner;
526
+ }
527
+ }
528
+ // Just an address, use defaults
529
+ return validator.remoteSigner || this.keystore.remoteSigner;
530
+ };
531
+ // Normalize attester to EthAccounts and search
532
+ const normalized = this.extractEthAccountsFromAttester(validator.attester);
533
+ const findInEthAccounts = (accs)=>{
534
+ if (typeof accs === 'string') {
535
+ return checkAccount(accs);
536
+ }
537
+ if (Array.isArray(accs)) {
538
+ for (const a of accs){
539
+ const res = checkAccount(a);
540
+ if (res !== undefined) {
541
+ return res;
542
+ }
543
+ }
544
+ return undefined;
545
+ }
546
+ if (typeof accs === 'object' && accs !== null && 'mnemonic' in accs) {
547
+ // mnemonic-derived keys are local signers; no remote signer config
548
+ return undefined;
549
+ }
550
+ return checkAccount(accs);
551
+ };
552
+ return findInEthAccounts(normalized);
553
+ }
554
+ /** Extract ETH accounts from AttesterAccounts */ extractEthAccountsFromAttester(attester) {
555
+ if (typeof attester === 'string') {
556
+ return attester;
557
+ }
558
+ if (Array.isArray(attester)) {
559
+ const out = [];
560
+ for (const item of attester){
561
+ if (typeof item === 'string') {
562
+ out.push(item);
563
+ } else if ('eth' in item) {
564
+ out.push(item.eth);
565
+ } else if (!('mnemonic' in item)) {
566
+ out.push(item);
567
+ }
568
+ }
569
+ return out;
570
+ }
571
+ if ('mnemonic' in attester) {
572
+ return attester;
573
+ }
574
+ if ('eth' in attester) {
575
+ return attester.eth;
576
+ }
577
+ return attester;
578
+ }
579
+ }
@@ -0,0 +1,62 @@
1
+ import type { KeyStore } from './types.js';
2
+ /**
3
+ * Error thrown when keystore loading fails
4
+ */
5
+ export declare class KeyStoreLoadError extends Error {
6
+ filePath: string;
7
+ cause?: Error | undefined;
8
+ constructor(message: string, filePath: string, cause?: Error | undefined);
9
+ }
10
+ /**
11
+ * Loads and validates a single keystore JSON file.
12
+ *
13
+ * @param filePath Absolute or relative path to a keystore JSON file.
14
+ * @returns Parsed keystore object adhering to the schema.
15
+ * @throws KeyStoreLoadError When JSON is invalid, schema validation fails, or other IO/parse errors occur.
16
+ */
17
+ export declare function loadKeystoreFile(filePath: string): KeyStore;
18
+ /**
19
+ * Loads keystore files from a directory (only .json files).
20
+ *
21
+ * @param dirPath Absolute or relative path to a directory containing keystore files.
22
+ * @returns Array of parsed keystores loaded from all .json files in the directory.
23
+ * @throws KeyStoreLoadError When the directory can't be read or contains no valid keystore files.
24
+ */
25
+ export declare function loadKeystoreDirectory(dirPath: string): KeyStore[];
26
+ /**
27
+ * Loads keystore(s) from a path (file or directory).
28
+ *
29
+ * If a file is provided, loads a single keystore. If a directory is provided,
30
+ * loads all keystore files within that directory.
31
+ *
32
+ * @param path File or directory path.
33
+ * @returns Array of parsed keystores.
34
+ * @throws KeyStoreLoadError When the path is invalid or cannot be accessed.
35
+ */
36
+ export declare function loadKeystores(path: string): KeyStore[];
37
+ /**
38
+ * Loads keystore(s) from multiple paths (comma-separated string or array).
39
+ *
40
+ * @param paths Comma-separated string or array of file/directory paths.
41
+ * @returns Flattened array of all parsed keystores from all paths.
42
+ * @throws KeyStoreLoadError When any path fails to load; includes context for which path list was used.
43
+ */
44
+ export declare function loadMultipleKeystores(paths: string | string[]): KeyStore[];
45
+ /**
46
+ * Merges multiple keystores into a single configuration.
47
+ *
48
+ * - Concatenates validator arrays and enforces unique attester addresses by simple structural keys
49
+ * - Accumulates all slasher accounts across inputs
50
+ * - Applies last-one-wins semantics for file-level remote signer defaults
51
+ * - Requires at most one prover configuration across inputs
52
+ *
53
+ * Note: Full duplicate detection (e.g., after resolving JSON V3 or mnemonics) is
54
+ * performed downstream by the validator client.
55
+ *
56
+ * @param keystores Array of keystores to merge.
57
+ * @returns A merged keystore object.
58
+ * @throws Error When keystore list is empty.
59
+ * @throws KeyStoreLoadError When duplicate attester keys are found or multiple prover configs exist.
60
+ */
61
+ export declare function mergeKeystores(keystores: KeyStore[]): KeyStore;
62
+ //# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoibG9hZGVyLmQudHMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi9zcmMvbG9hZGVyLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQVdBLE9BQU8sS0FBSyxFQUFlLFFBQVEsRUFBRSxNQUFNLFlBQVksQ0FBQztBQUl4RDs7R0FFRztBQUNILHFCQUFhLGlCQUFrQixTQUFRLEtBQUs7SUFHakMsUUFBUSxFQUFFLE1BQU07SUFDUCxLQUFLLENBQUM7SUFIeEIsWUFDRSxPQUFPLEVBQUUsTUFBTSxFQUNSLFFBQVEsRUFBRSxNQUFNLEVBQ1AsS0FBSyxDQUFDLG1CQUFPLEVBSTlCO0NBQ0Y7QUFFRDs7Ozs7O0dBTUc7QUFDSCx3QkFBZ0IsZ0JBQWdCLENBQUMsUUFBUSxFQUFFLE1BQU0sR0FBRyxRQUFRLENBdUIzRDtBQUVEOzs7Ozs7R0FNRztBQUNILHdCQUFnQixxQkFBcUIsQ0FBQyxPQUFPLEVBQUUsTUFBTSxHQUFHLFFBQVEsRUFBRSxDQW1DakU7QUFFRDs7Ozs7Ozs7O0dBU0c7QUFDSCx3QkFBZ0IsYUFBYSxDQUFDLElBQUksRUFBRSxNQUFNLEdBQUcsUUFBUSxFQUFFLENBdUJ0RDtBQUVEOzs7Ozs7R0FNRztBQUNILHdCQUFnQixxQkFBcUIsQ0FBQyxLQUFLLEVBQUUsTUFBTSxHQUFHLE1BQU0sRUFBRSxHQUFHLFFBQVEsRUFBRSxDQThCMUU7QUFFRDs7Ozs7Ozs7Ozs7Ozs7O0dBZUc7QUFDSCx3QkFBZ0IsY0FBYyxDQUFDLFNBQVMsRUFBRSxRQUFRLEVBQUUsR0FBRyxRQUFRLENBK0U5RCJ9
@@ -0,0 +1 @@
1
+ {"version":3,"file":"loader.d.ts","sourceRoot":"","sources":["../src/loader.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAe,QAAQ,EAAE,MAAM,YAAY,CAAC;AAIxD;;GAEG;AACH,qBAAa,iBAAkB,SAAQ,KAAK;IAGjC,QAAQ,EAAE,MAAM;IACP,KAAK,CAAC;IAHxB,YACE,OAAO,EAAE,MAAM,EACR,QAAQ,EAAE,MAAM,EACP,KAAK,CAAC,mBAAO,EAI9B;CACF;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,QAAQ,CAuB3D;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,QAAQ,EAAE,CAmCjE;AAED;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,QAAQ,EAAE,CAuBtD;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,QAAQ,EAAE,CA8B1E;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,cAAc,CAAC,SAAS,EAAE,QAAQ,EAAE,GAAG,QAAQ,CA+E9D"}