@aztec/node-keystore 4.0.0-nightly.20250907 → 4.0.0-nightly.20260108

package/dest/config.d.ts

@@ -4,4 +4,4 @@ export type KeyStoreConfig = {
 };
 export declare const keyStoreConfigMappings: ConfigMappingsType<KeyStoreConfig>;
 export declare function getKeyStoreConfigFromEnv(): KeyStoreConfig;
-//# sourceMappingURL=config.d.ts.map
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY29uZmlnLmQudHMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi9zcmMvY29uZmlnLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLE9BQU8sRUFBRSxLQUFLLGtCQUFrQixFQUF5QixNQUFNLDBCQUEwQixDQUFDO0FBRTFGLE1BQU0sTUFBTSxjQUFjLEdBQUc7SUFDM0IsaUJBQWlCLEVBQUUsTUFBTSxHQUFHLFNBQVMsQ0FBQztDQUN2QyxDQUFDO0FBRUYsZUFBTyxNQUFNLHNCQUFzQixFQUFFLGtCQUFrQixDQUFDLGNBQWMsQ0FLckUsQ0FBQztBQUVGLHdCQUFnQix3QkFBd0IsSUFBSSxjQUFjLENBRXpEIn0=

package/dest/index.d.ts

@@ -4,4 +4,4 @@ export * from './schemas.js';
 export * from './signer.js';
 export * from './keystore_manager.js';
 export * from './config.js';
-//# sourceMappingURL=index.d.ts.map
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguZC50cyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uL3NyYy9pbmRleC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxjQUFjLFlBQVksQ0FBQztBQUMzQixjQUFjLGFBQWEsQ0FBQztBQUM1QixjQUFjLGNBQWMsQ0FBQztBQUM3QixjQUFjLGFBQWEsQ0FBQztBQUM1QixjQUFjLHVCQUF1QixDQUFDO0FBQ3RDLGNBQWMsYUFBYSxDQUFDIn0=

package/dest/keystore_manager.d.ts

@@ -3,10 +3,11 @@
  *
  * Manages keystore configuration and delegates signing operations to appropriate signers.
  */
-import type { EthSigner } from '@aztec/ethereum';
+import type { EthSigner } from '@aztec/ethereum/eth-signer';
 import { Buffer32 } from '@aztec/foundation/buffer';
 import { EthAddress } from '@aztec/foundation/eth-address';
 import type { Signature } from '@aztec/foundation/eth-signature';
+import type { AztecAddress } from '@aztec/stdlib/aztec-address';
 import type { TypedDataDefinition } from 'viem';
 import type { EthAccounts, EthRemoteSignerConfig, KeyStore, ProverKeyStore, ValidatorKeyStore as ValidatorKeystoreConfig } from './types.js';
 /**
@@ -27,6 +28,11 @@ export declare class KeystoreManager {
      * @param keystore Parsed keystore configuration
      */
     constructor(keystore: KeyStore);
+    /**
+     * Validates all remote signers in the keystore are accessible and have the required addresses.
+     * Should be called after construction if validation is needed.
+     */
+    validateSigners(): Promise<void>;
     /**
      * Validates that attester addresses are unique across all validators
      * Only checks simple private key attesters, not JSON-V3 or mnemonic attesters,
@@ -39,12 +45,16 @@ export declare class KeystoreManager {
      * This is used at construction time to check for obvious duplicates without throwing for invalid inputs.
      */
     private extractAddressesWithoutSensitiveOperations;
+    /**
+     * Extract addresses from EthAccounts without sensitive operations (no decryption/derivation).
+     */
+    private extractAddressesFromEthAccountsNonSensitive;
     /**
      * Create signers for validator attester accounts
      */
     createAttesterSigners(validatorIndex: number): EthSigner[];
     /**
-     * Create signers for validator publisher accounts (falls back to attester if not specified)
+     * Create signers for validator publisher accounts (falls back to keystore-level publisher, then to attester if not specified)
      */
     createPublisherSigners(validatorIndex: number): EthSigner[];
     createAllValidatorPublisherSigners(): EthSigner[];
@@ -68,13 +78,13 @@ export declare class KeystoreManager {
      */
     getValidatorCount(): number;
     /**
-     * Get coinbase address for validator (falls back to first attester address)
+     * Get coinbase address for validator (falls back to keystore-level coinbase, then to the specific attester address)
      */
-    getCoinbaseAddress(validatorIndex: number): EthAddress;
+    getCoinbaseAddress(validatorIndex: number, attesterAddress: EthAddress): EthAddress;
     /**
-     * Get fee recipient for validator
+     * Get fee recipient for validator (falls back to keystore-level feeRecipient)
      */
-    getFeeRecipient(validatorIndex: number): string;
+    getFeeRecipient(validatorIndex: number): AztecAddress;
     /**
      * Get the raw slasher configuration as provided in the keystore file.
      * @returns The slasher accounts configuration or undefined if not set
@@ -123,5 +133,7 @@ export declare class KeystoreManager {
      * Precedence: account-level override > validator-level config > file-level default
      */
     getEffectiveRemoteSignerConfig(validatorIndex: number, attesterAddress: EthAddress): EthRemoteSignerConfig | undefined;
+    /** Extract ETH accounts from AttesterAccounts */
+    private extractEthAccountsFromAttester;
 }
-//# sourceMappingURL=keystore_manager.d.ts.map
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoia2V5c3RvcmVfbWFuYWdlci5kLnRzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vc3JjL2tleXN0b3JlX21hbmFnZXIudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUE7Ozs7R0FJRztBQUNILE9BQU8sS0FBSyxFQUFFLFNBQVMsRUFBRSxNQUFNLDRCQUE0QixDQUFDO0FBQzVELE9BQU8sRUFBRSxRQUFRLEVBQUUsTUFBTSwwQkFBMEIsQ0FBQztBQUNwRCxPQUFPLEVBQUUsVUFBVSxFQUFFLE1BQU0sK0JBQStCLENBQUM7QUFDM0QsT0FBTyxLQUFLLEVBQUUsU0FBUyxFQUFFLE1BQU0saUNBQWlDLENBQUM7QUFDakUsT0FBTyxLQUFLLEVBQUUsWUFBWSxFQUFFLE1BQU0sNkJBQTZCLENBQUM7QUFLaEUsT0FBTyxLQUFLLEVBQUUsbUJBQW1CLEVBQUUsTUFBTSxNQUFNLENBQUM7QUFLaEQsT0FBTyxLQUFLLEVBSVYsV0FBVyxFQUVYLHFCQUFxQixFQUNyQixRQUFRLEVBRVIsY0FBYyxFQUNkLGlCQUFpQixJQUFJLHVCQUF1QixFQUM3QyxNQUFNLFlBQVksQ0FBQztBQUVwQjs7R0FFRztBQUNILHFCQUFhLGFBQWMsU0FBUSxLQUFLO0lBR3BCLEtBQUssQ0FBQztJQUZ4QixZQUNFLE9BQU8sRUFBRSxNQUFNLEVBQ0MsS0FBSyxDQUFDLG1CQUFPLEVBSTlCO0NBQ0Y7QUFFRDs7R0FFRztBQUNILHFCQUFhLGVBQWU7SUFDMUIsT0FBTyxDQUFDLFFBQVEsQ0FBQyxRQUFRLENBQVc7SUFFcEM7Ozs7T0FJRztJQUNILFlBQVksUUFBUSxFQUFFLFFBQVEsRUFHN0I7SUFFRDs7O09BR0c7SUFDRyxlQUFlLElBQUksT0FBTyxDQUFDLElBQUksQ0FBQyxDQXNFckM7SUFFRDs7Ozs7T0FLRztJQUNILE9BQU8sQ0FBQywrQkFBK0I7SUFrQnZDOzs7T0FHRztJQUNILE9BQU8sQ0FBQywwQ0FBMEM7SUFLbEQ7O09BRUc7SUFDSCxPQUFPLENBQUMsMkNBQTJDO0lBK0NuRDs7T0FFRztJQUNILHFCQUFxQixDQUFDLGNBQWMsRUFBRSxNQUFNLEdBQUcsU0FBUyxFQUFFLENBSXpEO0lBRUQ7O09BRUc7SUFDSCxzQkFBc0IsQ0FBQyxjQUFjLEVBQUUsTUFBTSxHQUFHLFNBQVMsRUFBRSxDQW9CMUQ7SUFFRCxrQ0FBa0MsSUFBSSxTQUFTLEVBQUUsQ0FTaEQ7SUFFRDs7T0FFRztJQUNILG9CQUFvQixJQUFJLFNBQVMsRUFBRSxDQU1sQztJQUVEOztPQUVHO0lBQ0gsbUJBQW1CLElBQUk7UUFBRSxFQUFFLEVBQUUsVUFBVSxHQUFHLFNBQVMsQ0FBQztRQUFDLE9BQU8sRUFBRSxTQUFTLEVBQUUsQ0FBQTtLQUFFLEdBQUcsU0FBUyxDQStCdEY7SUFFRDs7T0FFRztJQUNILFlBQVksQ0FBQyxLQUFLLEVBQUUsTUFBTSxHQUFHLHVCQUF1QixDQUtuRDtJQUVEOztPQUVHO0lBQ0gsaUJBQWlCLElBQUksTUFBTSxDQUUxQjtJQUVEOztPQUVHO0lBQ0gsa0JBQWtCLENBQUMsY0FBYyxFQUFFLE1BQU0sRUFBRSxlQUFlLEVBQUUsVUFBVSxHQUFHLFVBQVUsQ0FjbEY7SUFFRDs7T0FFRztJQUNILGVBQWUsQ0FBQyxjQUFjLEVBQUUsTUFBTSxHQUFHLFlBQVksQ0FlcEQ7SUFFRDs7O09BR0c7SUFDSCxrQkFBa0IsSUFBSSxXQUFXLEdBQUcsU0FBUyxDQUU1QztJQUVEOzs7T0FHRztJQUNILGVBQWUsSUFBSSxjQUFjLEdBQUcsU0FBUyxDQUU1QztJQUVEOzs7T0FHRztJQUNILHVDQUF1QyxJQUFJLElBQUksQ0FtQjlDO0lBRUQ7O09BRUc7SUFDSCxPQUFPLENBQUMsNEJBQTRCO0lBK0JwQzs7T0FFRztJQUNILE9BQU8sQ0FBQywwQkFBMEI7SUEyQ2xDOztPQUVHO0lBQ0gsT0FBTyxDQUFDLHNCQUFzQjtJQWtEOUI7O09BRUc7SUFDSCxPQUFPLENBQUMsZ0NBQWdDO0lBd0J4Qzs7T0FFRztJQUNILE9BQU8sQ0FBQyx5QkFBeUI7SUE4QmpDOztPQUVHO0lBQ0csV0FBVyxDQUFDLE1BQU0sRUFBRSxTQUFTLEVBQUUsT0FBTyxFQUFFLFFBQVEsR0FBRyxPQUFPLENBQUMsU0FBUyxDQUFDLENBRTFFO0lBRUQ7O09BRUc7SUFDRyxhQUFhLENBQUMsTUFBTSxFQUFFLFNBQVMsRUFBRSxTQUFTLEVBQUUsbUJBQW1CLEdBQUcsT0FBTyxDQUFDLFNBQVMsQ0FBQyxDQUV6RjtJQUVEOzs7T0FHRztJQUNILDhCQUE4QixDQUM1QixjQUFjLEVBQUUsTUFBTSxFQUN0QixlQUFlLEVBQUUsVUFBVSxHQUMxQixxQkFBcUIsR0FBRyxTQUFTLENBd0duQztJQUVELGlEQUFpRDtJQUNqRCxPQUFPLENBQUMsOEJBQThCO0NBeUJ2QyJ9

package/dest/keystore_manager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"keystore_manager.d.ts","sourceRoot":"","sources":["../src/keystore_manager.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AACpD,OAAO,EAAE,UAAU,EAAE,MAAM,+BAA+B,CAAC;AAC3D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iCAAiC,CAAC;AAKjE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,MAAM,CAAC;AAIhD,OAAO,KAAK,EAEV,WAAW,EAKX,qBAAqB,EACrB,QAAQ,EACR,cAAc,EACd,iBAAiB,IAAI,uBAAuB,EAC7C,MAAM,YAAY,CAAC;AAEpB;;GAEG;AACH,qBAAa,aAAc,SAAQ,KAAK;IAGpB,KAAK,CAAC,EAAE,KAAK;gBAD7B,OAAO,EAAE,MAAM,EACC,KAAK,CAAC,EAAE,KAAK,YAAA;CAKhC;AAED;;GAEG;AACH,qBAAa,eAAe;IAC1B,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAW;IAEpC;;;;OAIG;gBACS,QAAQ,EAAE,QAAQ;IAK9B;;;;;OAKG;IACH,OAAO,CAAC,+BAA+B;IAkBvC;;;OAGG;IACH,OAAO,CAAC,0CAA0C;IAiElD;;OAEG;IACH,qBAAqB,CAAC,cAAc,EAAE,MAAM,GAAG,SAAS,EAAE;IAK1D;;OAEG;IACH,sBAAsB,CAAC,cAAc,EAAE,MAAM,GAAG,SAAS,EAAE;IAc3D,kCAAkC,IAAI,SAAS,EAAE;IAWjD;;OAEG;IACH,oBAAoB,IAAI,SAAS,EAAE;IAQnC;;OAEG;IACH,mBAAmB,IAAI;QAAE,EAAE,EAAE,UAAU,GAAG,SAAS,CAAC;QAAC,OAAO,EAAE,SAAS,EAAE,CAAA;KAAE,GAAG,SAAS;IAwBvF;;OAEG;IACH,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,uBAAuB;IAOpD;;OAEG;IACH,iBAAiB,IAAI,MAAM;IAI3B;;OAEG;IACH,kBAAkB,CAAC,cAAc,EAAE,MAAM,GAAG,UAAU;IAgBtD;;OAEG;IACH,eAAe,CAAC,cAAc,EAAE,MAAM,GAAG,MAAM;IAK/C;;;OAGG;IACH,kBAAkB,IAAI,WAAW,GAAG,SAAS;IAI7C;;;OAGG;IACH,eAAe,IAAI,cAAc,GAAG,SAAS;IAI7C;;;OAGG;IACH,uCAAuC,IAAI,IAAI;IAqB/C;;OAEG;IACH,OAAO,CAAC,4BAA4B;IA+BpC;;OAEG;IACH,OAAO,CAAC,0BAA0B;IA+ClC;;OAEG;IACH,OAAO,CAAC,sBAAsB;IAkD9B;;OAEG;IACH,OAAO,CAAC,gCAAgC;IAwBxC;;OAEG;IACH,OAAO,CAAC,yBAAyB;IA8BjC;;OAEG;IACG,WAAW,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,GAAG,OAAO,CAAC,SAAS,CAAC;IAI3E;;OAEG;IACG,aAAa,CAAC,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,mBAAmB,GAAG,OAAO,CAAC,SAAS,CAAC;IAI1F;;;OAGG;IACH,8BAA8B,CAC5B,cAAc,EAAE,MAAM,EACtB,eAAe,EAAE,UAAU,GAC1B,qBAAqB,GAAG,SAAS;CAiIrC"}
+{"version":3,"file":"keystore_manager.d.ts","sourceRoot":"","sources":["../src/keystore_manager.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AACpD,OAAO,EAAE,UAAU,EAAE,MAAM,+BAA+B,CAAC;AAC3D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iCAAiC,CAAC;AACjE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAKhE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,MAAM,CAAC;AAKhD,OAAO,KAAK,EAIV,WAAW,EAEX,qBAAqB,EACrB,QAAQ,EAER,cAAc,EACd,iBAAiB,IAAI,uBAAuB,EAC7C,MAAM,YAAY,CAAC;AAEpB;;GAEG;AACH,qBAAa,aAAc,SAAQ,KAAK;IAGpB,KAAK,CAAC;IAFxB,YACE,OAAO,EAAE,MAAM,EACC,KAAK,CAAC,mBAAO,EAI9B;CACF;AAED;;GAEG;AACH,qBAAa,eAAe;IAC1B,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAW;IAEpC;;;;OAIG;IACH,YAAY,QAAQ,EAAE,QAAQ,EAG7B;IAED;;;OAGG;IACG,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC,CAsErC;IAED;;;;;OAKG;IACH,OAAO,CAAC,+BAA+B;IAkBvC;;;OAGG;IACH,OAAO,CAAC,0CAA0C;IAKlD;;OAEG;IACH,OAAO,CAAC,2CAA2C;IA+CnD;;OAEG;IACH,qBAAqB,CAAC,cAAc,EAAE,MAAM,GAAG,SAAS,EAAE,CAIzD;IAED;;OAEG;IACH,sBAAsB,CAAC,cAAc,EAAE,MAAM,GAAG,SAAS,EAAE,CAoB1D;IAED,kCAAkC,IAAI,SAAS,EAAE,CAShD;IAED;;OAEG;IACH,oBAAoB,IAAI,SAAS,EAAE,CAMlC;IAED;;OAEG;IACH,mBAAmB,IAAI;QAAE,EAAE,EAAE,UAAU,GAAG,SAAS,CAAC;QAAC,OAAO,EAAE,SAAS,EAAE,CAAA;KAAE,GAAG,SAAS,CA+BtF;IAED;;OAEG;IACH,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,uBAAuB,CAKnD;IAED;;OAEG;IACH,iBAAiB,IAAI,MAAM,CAE1B;IAED;;OAEG;IACH,kBAAkB,CAAC,cAAc,EAAE,MAAM,EAAE,eAAe,EAAE,UAAU,GAAG,UAAU,CAclF;IAED;;OAEG;IACH,eAAe,CAAC,cAAc,EAAE,MAAM,GAAG,YAAY,CAepD;IAED;;;OAGG;IACH,kBAAkB,IAAI,WAAW,GAAG,SAAS,CAE5C;IAED;;;OAGG;IACH,eAAe,IAAI,cAAc,GAAG,SAAS,CAE5C;IAED;;;OAGG;IACH,uCAAuC,IAAI,IAAI,CAmB9C;IAED;;OAEG;IACH,OAAO,CAAC,4BAA4B;IA+BpC;;OAEG;IACH,OAAO,CAAC,0BAA0B;IA2ClC;;OAEG;IACH,OAAO,CAAC,sBAAsB;IAkD9B;;OAEG;IACH,OAAO,CAAC,gCAAgC;IAwBxC;;OAEG;IACH,OAAO,CAAC,yBAAyB;IA8BjC;;OAEG;IACG,WAAW,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,GAAG,OAAO,CAAC,SAAS,CAAC,CAE1E;IAED;;OAEG;IACG,aAAa,CAAC,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,mBAAmB,GAAG,OAAO,CAAC,SAAS,CAAC,CAEzF;IAED;;;OAGG;IACH,8BAA8B,CAC5B,cAAc,EAAE,MAAM,EACtB,eAAe,EAAE,UAAU,GAC1B,qBAAqB,GAAG,SAAS,CAwGnC;IAED,iDAAiD;IACjD,OAAO,CAAC,8BAA8B;CAyBvC"}

package/dest/keystore_manager.js

@@ -3,11 +3,11 @@
  *
  * Manages keystore configuration and delegates signing operations to appropriate signers.
  */ import { Buffer32 } from '@aztec/foundation/buffer';
-import { EthAddress } from '@aztec/foundation/eth-address';
 import { Wallet } from '@ethersproject/wallet';
 import { readFileSync, readdirSync, statSync } from 'fs';
 import { extname, join } from 'path';
 import { mnemonicToAccount } from 'viem/accounts';
+import { ethPrivateKeySchema } from './schemas.js';
 import { LocalSigner, RemoteSigner } from './signer.js';
 /**
  * Error thrown when keystore operations fail
@@ -31,6 +31,70 @@ import { LocalSigner, RemoteSigner } from './signer.js';
         this.validateUniqueAttesterAddresses();
     }
     /**
+   * Validates all remote signers in the keystore are accessible and have the required addresses.
+   * Should be called after construction if validation is needed.
+   */ async validateSigners() {
+        // Collect all remote signers with their addresses grouped by URL
+        const remoteSignersByUrl = new Map();
+        // Helper to extract remote signer URL from config
+        const getUrl = (config)=>{
+            return typeof config === 'string' ? config : config.remoteSignerUrl;
+        };
+        // Helper to collect remote signers from accounts
+        const collectRemoteSigners = (accounts, defaultRemoteSigner)=>{
+            const processAccount = (account)=>{
+                if (typeof account === 'object' && !('path' in account) && !('mnemonic' in account)) {
+                    // This is a remote signer account
+                    const remoteSigner = account;
+                    const address = 'address' in remoteSigner ? remoteSigner.address : remoteSigner;
+                    let url;
+                    if ('remoteSignerUrl' in remoteSigner && remoteSigner.remoteSignerUrl) {
+                        url = remoteSigner.remoteSignerUrl;
+                    } else if (defaultRemoteSigner) {
+                        url = getUrl(defaultRemoteSigner);
+                    } else {
+                        return; // No remote signer URL available
+                    }
+                    if (!remoteSignersByUrl.has(url)) {
+                        remoteSignersByUrl.set(url, new Set());
+                    }
+                    remoteSignersByUrl.get(url).add(address.toString());
+                }
+            };
+            if (Array.isArray(accounts)) {
+                accounts.forEach((account)=>collectRemoteSigners(account, defaultRemoteSigner));
+            } else if (typeof accounts === 'object' && 'mnemonic' in accounts) {
+            // Skip mnemonic configs
+            } else {
+                processAccount(accounts);
+            }
+        };
+        // Collect from validators
+        const validatorCount = this.getValidatorCount();
+        for(let i = 0; i < validatorCount; i++){
+            const validator = this.getValidator(i);
+            const remoteSigner = validator.remoteSigner || this.keystore.remoteSigner;
+            collectRemoteSigners(this.extractEthAccountsFromAttester(validator.attester), remoteSigner);
+            if (validator.publisher) {
+                collectRemoteSigners(validator.publisher, remoteSigner);
+            }
+        }
+        // Collect from slasher
+        if (this.keystore.slasher) {
+            collectRemoteSigners(this.keystore.slasher, this.keystore.remoteSigner);
+        }
+        // Collect from prover
+        if (this.keystore.prover && typeof this.keystore.prover === 'object' && 'publisher' in this.keystore.prover) {
+            collectRemoteSigners(this.keystore.prover.publisher, this.keystore.remoteSigner);
+        }
+        // Validate each remote signer URL with all its addresses
+        for (const [url, addresses] of remoteSignersByUrl.entries()){
+            if (addresses.size > 0) {
+                await RemoteSigner.validateAccess(url, Array.from(addresses));
+            }
+        }
+    }
+    /**
    * Validates that attester addresses are unique across all validators
    * Only checks simple private key attesters, not JSON-V3 or mnemonic attesters,
    * these are validated when decrypting the JSON-V3 keystore files
@@ -54,58 +118,47 @@ import { LocalSigner, RemoteSigner } from './signer.js';
    * Best-effort address extraction that avoids decryption/derivation (no JSON-V3 or mnemonic processing).
    * This is used at construction time to check for obvious duplicates without throwing for invalid inputs.
    */ extractAddressesWithoutSensitiveOperations(accounts) {
+        const ethAccounts = this.extractEthAccountsFromAttester(accounts);
+        return this.extractAddressesFromEthAccountsNonSensitive(ethAccounts);
+    }
+    /**
+   * Extract addresses from EthAccounts without sensitive operations (no decryption/derivation).
+   */ extractAddressesFromEthAccountsNonSensitive(accounts) {
         const results = [];
         const handleAccount = (account)=>{
-            // String cases: private key or address or remote signer address
             if (typeof account === 'string') {
                 if (account.startsWith('0x') && account.length === 66) {
-                    // Private key -> derive address locally without external deps
                     try {
-                        const signer = new LocalSigner(Buffer32.fromString(account));
+                        const signer = new LocalSigner(Buffer32.fromString(ethPrivateKeySchema.parse(account)));
                         results.push(signer.address);
                     } catch  {
-                    // Ignore invalid private key at construction time
+                    // ignore invalid private key at construction time
                     }
-                    return;
                 }
-                if (account.startsWith('0x') && account.length === 42) {
-                    // Address string
-                    try {
-                        results.push(EthAddress.fromString(account));
-                    } catch  {
-                    // Ignore invalid address format at construction time
-                    }
-                    return;
-                }
-                // Any other string cannot be confidently resolved here
                 return;
             }
-            // JSON V3 keystore: skip (requires decryption)
             if ('path' in account) {
                 return;
             }
-            // Mnemonic: skip (requires derivation and may throw on invalid mnemonics)
             if ('mnemonic' in account) {
                 return;
             }
-            // Remote signer account (object form)
             const remoteSigner = account;
-            const address = typeof remoteSigner === 'string' ? remoteSigner : remoteSigner.address;
-            if (address) {
-                try {
-                    results.push(EthAddress.fromString(address));
-                } catch  {
-                // Ignore invalid address format at construction time
-                }
+            if ('address' in remoteSigner) {
+                results.push(remoteSigner.address);
+                return;
             }
+            results.push(remoteSigner);
         };
         if (Array.isArray(accounts)) {
             for (const account of accounts){
-                const subResults = this.extractAddressesWithoutSensitiveOperations(account);
-                results.push(...subResults);
+                handleAccount(account);
             }
             return results;
         }
+        if (typeof accounts === 'object' && accounts !== null && 'mnemonic' in accounts) {
+            return results;
+        }
         handleAccount(accounts);
         return results;
     }
@@ -113,15 +166,20 @@ import { LocalSigner, RemoteSigner } from './signer.js';
    * Create signers for validator attester accounts
    */ createAttesterSigners(validatorIndex) {
         const validator = this.getValidator(validatorIndex);
-        return this.createSignersFromEthAccounts(validator.attester, validator.remoteSigner || this.keystore.remoteSigner);
+        const ethAccounts = this.extractEthAccountsFromAttester(validator.attester);
+        return this.createSignersFromEthAccounts(ethAccounts, validator.remoteSigner || this.keystore.remoteSigner);
     }
     /**
-   * Create signers for validator publisher accounts (falls back to attester if not specified)
+   * Create signers for validator publisher accounts (falls back to keystore-level publisher, then to attester if not specified)
    */ createPublisherSigners(validatorIndex) {
         const validator = this.getValidator(validatorIndex);
         if (validator.publisher) {
             return this.createSignersFromEthAccounts(validator.publisher, validator.remoteSigner || this.keystore.remoteSigner);
         }
+        // Fall back to keystore-level publisher
+        if (this.keystore.publisher) {
+            return this.createSignersFromEthAccounts(this.keystore.publisher, validator.remoteSigner || this.keystore.remoteSigner);
+        }
         // Fall back to attester signers
         return this.createAttesterSigners(validatorIndex);
     }
@@ -147,7 +205,7 @@ import { LocalSigner, RemoteSigner } from './signer.js';
         if (!this.keystore.prover) {
             return undefined;
         }
-        // Handle simple prover case (just a private key)
+        // Handle prover being a private key, JSON key store or remote signer with nested address
         if (typeof this.keystore.prover === 'string' || 'path' in this.keystore.prover || 'address' in this.keystore.prover) {
             const signers = this.createSignersFromEthAccounts(this.keystore.prover, this.keystore.remoteSigner);
             return {
@@ -155,10 +213,19 @@ import { LocalSigner, RemoteSigner } from './signer.js';
                 signers
             };
         }
-        const id = EthAddress.fromString(this.keystore.prover.id);
-        const signers = this.createSignersFromEthAccounts(this.keystore.prover.publisher, this.keystore.remoteSigner);
+        // Handle prover as Id and specified publishers
+        if ('id' in this.keystore.prover) {
+            const id = this.keystore.prover.id;
+            const signers = this.createSignersFromEthAccounts(this.keystore.prover.publisher, this.keystore.remoteSigner);
+            return {
+                id,
+                signers
+            };
+        }
+        // Here, prover is just an EthAddress for a remote signer
+        const signers = this.createSignersFromEthAccounts(this.keystore.prover, this.keystore.remoteSigner);
         return {
-            id,
+            id: undefined,
             signers
         };
     }
@@ -176,24 +243,31 @@ import { LocalSigner, RemoteSigner } from './signer.js';
         return this.keystore.validators?.length || 0;
     }
     /**
-   * Get coinbase address for validator (falls back to first attester address)
-   */ getCoinbaseAddress(validatorIndex) {
+   * Get coinbase address for validator (falls back to keystore-level coinbase, then to the specific attester address)
+   */ getCoinbaseAddress(validatorIndex, attesterAddress) {
         const validator = this.getValidator(validatorIndex);
         if (validator.coinbase) {
-            return EthAddress.fromString(validator.coinbase);
+            return validator.coinbase;
         }
-        // Fall back to first attester address
-        const attesterSigners = this.createAttesterSigners(validatorIndex);
-        if (attesterSigners.length === 0) {
-            throw new KeystoreError(`No attester signers found for validator ${validatorIndex}`);
+        // Fall back to keystore-level coinbase
+        if (this.keystore.coinbase) {
+            return this.keystore.coinbase;
         }
-        return attesterSigners[0].address;
+        // Fall back to the specific attester address
+        return attesterAddress;
     }
     /**
-   * Get fee recipient for validator
+   * Get fee recipient for validator (falls back to keystore-level feeRecipient)
    */ getFeeRecipient(validatorIndex) {
         const validator = this.getValidator(validatorIndex);
-        return validator.feeRecipient;
+        if (validator.feeRecipient) {
+            return validator.feeRecipient;
+        }
+        // Fall back to keystore-level feeRecipient
+        if (this.keystore.feeRecipient) {
+            return this.keystore.feeRecipient;
+        }
+        throw new KeystoreError(`No feeRecipient configured for validator ${validatorIndex}. You can set it at validator or keystore level.`);
     }
     /**
    * Get the raw slasher configuration as provided in the keystore file.
@@ -215,7 +289,7 @@ import { LocalSigner, RemoteSigner } from './signer.js';
         const validatorCount = this.getValidatorCount();
         for(let validatorIndex = 0; validatorIndex < validatorCount; validatorIndex++){
             const validator = this.getValidator(validatorIndex);
-            const signers = this.createSignersFromEthAccounts(validator.attester, validator.remoteSigner || this.keystore.remoteSigner);
+            const signers = this.createSignersFromEthAccounts(this.extractEthAccountsFromAttester(validator.attester), validator.remoteSigner || this.keystore.remoteSigner);
             for (const signer of signers){
                 const address = signer.address.toString().toLowerCase();
                 if (seenAddresses.has(address)) {
@@ -261,13 +335,9 @@ import { LocalSigner, RemoteSigner } from './signer.js';
         if (typeof account === 'string') {
             if (account.startsWith('0x') && account.length === 66) {
                 // Private key
-                return new LocalSigner(Buffer32.fromString(account));
+                return new LocalSigner(Buffer32.fromString(ethPrivateKeySchema.parse(account)));
             } else {
-                // Remote signer address only - use default remote signer config
-                if (!defaultRemoteSigner) {
-                    throw new KeystoreError(`No remote signer configuration found for address ${account}`);
-                }
-                return new RemoteSigner(EthAddress.fromString(account), defaultRemoteSigner);
+                throw new Error(`Invalid private key`);
             }
         }
         // JSON V3 keystore
@@ -277,23 +347,23 @@ import { LocalSigner, RemoteSigner } from './signer.js';
         }
         // Remote signer account
         const remoteSigner = account;
-        if (typeof remoteSigner === 'string') {
-            // Just an address - use default config
-            if (!defaultRemoteSigner) {
-                throw new KeystoreError(`No remote signer configuration found for address ${remoteSigner}`);
+        if ('address' in remoteSigner) {
+            // Remote signer with config
+            const config = remoteSigner.remoteSignerUrl ? {
+                remoteSignerUrl: remoteSigner.remoteSignerUrl,
+                certPath: remoteSigner.certPath,
+                certPass: remoteSigner.certPass
+            } : defaultRemoteSigner;
+            if (!config) {
+                throw new KeystoreError(`No remote signer configuration found for address ${remoteSigner.address}`);
             }
-            return new RemoteSigner(EthAddress.fromString(remoteSigner), defaultRemoteSigner);
-        }
-        // Remote signer with config
-        const config = remoteSigner.remoteSignerUrl ? {
-            remoteSignerUrl: remoteSigner.remoteSignerUrl,
-            certPath: remoteSigner.certPath,
-            certPass: remoteSigner.certPass
-        } : defaultRemoteSigner;
-        if (!config) {
-            throw new KeystoreError(`No remote signer configuration found for address ${remoteSigner.address}`);
-        }
-        return new RemoteSigner(EthAddress.fromString(remoteSigner.address), config);
+            return new RemoteSigner(remoteSigner.address, config);
+        }
+        // Just an address - use default config
+        if (!defaultRemoteSigner) {
+            throw new KeystoreError(`No remote signer configuration found for address ${remoteSigner}`);
+        }
+        return new RemoteSigner(remoteSigner, defaultRemoteSigner);
     }
     /**
    * Create signer from JSON V3 keystore file or directory
@@ -410,20 +480,13 @@ import { LocalSigner, RemoteSigner } from './signer.js';
                 if (account.startsWith('0x') && account.length === 66) {
                     // This is a private key - derive the address
                     try {
-                        const signer = new LocalSigner(Buffer32.fromString(account));
+                        const signer = new LocalSigner(Buffer32.fromString(ethPrivateKeySchema.parse(account)));
                         return signer.address;
                     } catch  {
-                        return null;
-                    }
-                } else if (account.startsWith('0x') && account.length === 42) {
-                    // This is an address
-                    try {
-                        return EthAddress.fromString(account);
-                    } catch  {
-                        return null;
+                        return undefined;
                     }
                 }
-                return null;
+                return undefined;
             }
             // JSON V3 keystore
             if ('path' in account) {
@@ -431,17 +494,15 @@ import { LocalSigner, RemoteSigner } from './signer.js';
                     const signers = this.createSignerFromJsonV3(account);
                     return signers.map((s)=>s.address);
                 } catch  {
-                    return null;
+                    return undefined;
                 }
             }
-            // Remote signer account
+            // Remote signer account, either it is an address or the address is nested
             const remoteSigner = account;
-            const address = typeof remoteSigner === 'string' ? remoteSigner : remoteSigner.address;
-            try {
-                return EthAddress.fromString(address);
-            } catch  {
-                return null;
+            if ('address' in remoteSigner) {
+                return remoteSigner.address;
             }
+            return remoteSigner;
         };
         // Helper to check if account matches and get its remote signer config
         const checkAccount = (account)=>{
@@ -458,13 +519,7 @@ import { LocalSigner, RemoteSigner } from './signer.js';
             }
             // Found a match - determine the config to return
             if (typeof account === 'string') {
-                if (account.startsWith('0x') && account.length === 66) {
-                    // Private key - local signer, no remote config
-                    return undefined;
-                } else {
-                    // Address only - use defaults
-                    return validator.remoteSigner || this.keystore.remoteSigner;
-                }
+                return undefined;
             }
             // JSON V3 - local signer, no remote config
             if ('path' in account) {
@@ -472,50 +527,68 @@ import { LocalSigner, RemoteSigner } from './signer.js';
             }
             // Remote signer account with potential override
             const remoteSigner = account;
-            if (typeof remoteSigner === 'string') {
-                // Just an address - use defaults
-                return validator.remoteSigner || this.keystore.remoteSigner;
+            if ('address' in remoteSigner) {
+                // Has inline config
+                if (remoteSigner.remoteSignerUrl) {
+                    return {
+                        remoteSignerUrl: remoteSigner.remoteSignerUrl,
+                        certPath: remoteSigner.certPath,
+                        certPass: remoteSigner.certPass
+                    };
+                } else {
+                    // No URL specified, use defaults
+                    return validator.remoteSigner || this.keystore.remoteSigner;
+                }
             }
-            // Has inline config
-            if (remoteSigner.remoteSignerUrl) {
-                return {
-                    remoteSignerUrl: remoteSigner.remoteSignerUrl,
-                    certPath: remoteSigner.certPath,
-                    certPass: remoteSigner.certPass
-                };
-            } else {
-                // No URL specified, use defaults
-                return validator.remoteSigner || this.keystore.remoteSigner;
+            // Just an address, use defaults
+            return validator.remoteSigner || this.keystore.remoteSigner;
+        };
+        // Normalize attester to EthAccounts and search
+        const normalized = this.extractEthAccountsFromAttester(validator.attester);
+        const findInEthAccounts = (accs)=>{
+            if (typeof accs === 'string') {
+                return checkAccount(accs);
+            }
+            if (Array.isArray(accs)) {
+                for (const a of accs){
+                    const res = checkAccount(a);
+                    if (res !== undefined) {
+                        return res;
+                    }
+                }
+                return undefined;
             }
+            if (typeof accs === 'object' && accs !== null && 'mnemonic' in accs) {
+                // mnemonic-derived keys are local signers; no remote signer config
+                return undefined;
+            }
+            return checkAccount(accs);
         };
-        // Check the attester configuration
-        const { attester } = validator;
+        return findInEthAccounts(normalized);
+    }
+    /** Extract ETH accounts from AttesterAccounts */ extractEthAccountsFromAttester(attester) {
         if (typeof attester === 'string') {
-            const result = checkAccount(attester);
-            return result === undefined ? undefined : result;
+            return attester;
         }
         if (Array.isArray(attester)) {
-            for (const account of attester){
-                const result = checkAccount(account);
-                if (result !== undefined) {
-                    return result;
+            const out = [];
+            for (const item of attester){
+                if (typeof item === 'string') {
+                    out.push(item);
+                } else if ('eth' in item) {
+                    out.push(item.eth);
+                } else if (!('mnemonic' in item)) {
+                    out.push(item);
                 }
             }
-            return undefined;
+            return out;
         }
-        // Mnemonic configuration
         if ('mnemonic' in attester) {
-            try {
-                const signers = this.createSignersFromMnemonic(attester);
-                const matches = signers.some((s)=>s.address.equals(attesterAddress));
-                // Mnemonic-derived keys are local signers
-                return matches ? undefined : undefined;
-            } catch  {
-                return undefined;
-            }
+            return attester;
+        }
+        if ('eth' in attester) {
+            return attester.eth;
         }
-        // Single account object
-        const result = checkAccount(attester);
-        return result === undefined ? undefined : result;
+        return attester;
     }
 }

package/dest/loader.d.ts

@@ -59,4 +59,4 @@ export declare function loadMultipleKeystores(paths: string | string[]): KeyStor
  * @throws KeyStoreLoadError When duplicate attester keys are found or multiple prover configs exist.
  */
 export declare function mergeKeystores(keystores: KeyStore[]): KeyStore;
-//# sourceMappingURL=loader.d.ts.map
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoibG9hZGVyLmQudHMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi9zcmMvbG9hZGVyLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQWNBLE9BQU8sS0FBSyxFQUFlLFFBQVEsRUFBRSxNQUFNLFlBQVksQ0FBQztBQUl4RDs7R0FFRztBQUNILHFCQUFhLGlCQUFrQixTQUFRLEtBQUs7SUFHakMsUUFBUSxFQUFFLE1BQU07SUFDUCxLQUFLLENBQUM7SUFIeEIsWUFDRSxPQUFPLEVBQUUsTUFBTSxFQUNSLFFBQVEsRUFBRSxNQUFNLEVBQ1AsS0FBSyxDQUFDLG1CQUFPLEVBSTlCO0NBQ0Y7QUFFRDs7Ozs7O0dBTUc7QUFDSCx3QkFBZ0IsZ0JBQWdCLENBQUMsUUFBUSxFQUFFLE1BQU0sR0FBRyxRQUFRLENBdUIzRDtBQUVEOzs7Ozs7R0FNRztBQUNILHdCQUFnQixxQkFBcUIsQ0FBQyxPQUFPLEVBQUUsTUFBTSxHQUFHLFFBQVEsRUFBRSxDQW1DakU7QUFFRDs7Ozs7Ozs7O0dBU0c7QUFDSCx3QkFBZ0IsYUFBYSxDQUFDLElBQUksRUFBRSxNQUFNLEdBQUcsUUFBUSxFQUFFLENBdUJ0RDtBQUVEOzs7Ozs7R0FNRztBQUNILHdCQUFnQixxQkFBcUIsQ0FBQyxLQUFLLEVBQUUsTUFBTSxHQUFHLE1BQU0sRUFBRSxHQUFHLFFBQVEsRUFBRSxDQThCMUU7QUFFRDs7Ozs7Ozs7Ozs7Ozs7O0dBZUc7QUFDSCx3QkFBZ0IsY0FBYyxDQUFDLFNBQVMsRUFBRSxRQUFRLEVBQUUsR0FBRyxRQUFRLENBdUk5RCJ9

package/dest/loader.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"loader.d.ts","sourceRoot":"","sources":["../src/loader.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAe,QAAQ,EAAE,MAAM,YAAY,CAAC;AAIxD;;GAEG;AACH,qBAAa,iBAAkB,SAAQ,KAAK;IAGjC,QAAQ,EAAE,MAAM;IACP,KAAK,CAAC,EAAE,KAAK;gBAF7B,OAAO,EAAE,MAAM,EACR,QAAQ,EAAE,MAAM,EACP,KAAK,CAAC,EAAE,KAAK,YAAA;CAKhC;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,QAAQ,CAuB3D;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,QAAQ,EAAE,CAmCjE;AAED;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,QAAQ,EAAE,CAuBtD;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,QAAQ,EAAE,CA8B1E;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,cAAc,CAAC,SAAS,EAAE,QAAQ,EAAE,GAAG,QAAQ,CA+E9D"}
+{"version":3,"file":"loader.d.ts","sourceRoot":"","sources":["../src/loader.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAe,QAAQ,EAAE,MAAM,YAAY,CAAC;AAIxD;;GAEG;AACH,qBAAa,iBAAkB,SAAQ,KAAK;IAGjC,QAAQ,EAAE,MAAM;IACP,KAAK,CAAC;IAHxB,YACE,OAAO,EAAE,MAAM,EACR,QAAQ,EAAE,MAAM,EACP,KAAK,CAAC,mBAAO,EAI9B;CACF;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,QAAQ,CAuB3D;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,QAAQ,EAAE,CAmCjE;AAED;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,QAAQ,EAAE,CAuBtD;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,QAAQ,EAAE,CA8B1E;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,cAAc,CAAC,SAAS,EAAE,QAAQ,EAAE,GAAG,QAAQ,CAuI9D"}