@aztec/validator-ha-signer 0.0.1-commit.ee80a48 → 0.0.1-commit.f103f88

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (54) hide show
  1. package/README.md +10 -2
  2. package/dest/db/index.d.ts +2 -1
  3. package/dest/db/index.d.ts.map +1 -1
  4. package/dest/db/index.js +1 -0
  5. package/dest/db/lmdb.d.ts +66 -0
  6. package/dest/db/lmdb.d.ts.map +1 -0
  7. package/dest/db/lmdb.js +189 -0
  8. package/dest/db/migrations/1_initial-schema.d.ts +4 -2
  9. package/dest/db/migrations/1_initial-schema.d.ts.map +1 -1
  10. package/dest/db/migrations/1_initial-schema.js +34 -4
  11. package/dest/db/migrations/2_add-checkpoint-number.d.ts +7 -0
  12. package/dest/db/migrations/2_add-checkpoint-number.d.ts.map +1 -0
  13. package/dest/db/migrations/2_add-checkpoint-number.js +17 -0
  14. package/dest/db/postgres.d.ts +18 -2
  15. package/dest/db/postgres.d.ts.map +1 -1
  16. package/dest/db/postgres.js +39 -16
  17. package/dest/db/schema.d.ts +16 -9
  18. package/dest/db/schema.d.ts.map +1 -1
  19. package/dest/db/schema.js +23 -9
  20. package/dest/db/types.d.ts +47 -22
  21. package/dest/db/types.d.ts.map +1 -1
  22. package/dest/db/types.js +31 -15
  23. package/dest/factory.d.ts +39 -4
  24. package/dest/factory.d.ts.map +1 -1
  25. package/dest/factory.js +75 -5
  26. package/dest/metrics.d.ts +51 -0
  27. package/dest/metrics.d.ts.map +1 -0
  28. package/dest/metrics.js +103 -0
  29. package/dest/slashing_protection_service.d.ts +19 -6
  30. package/dest/slashing_protection_service.d.ts.map +1 -1
  31. package/dest/slashing_protection_service.js +53 -13
  32. package/dest/types.d.ts +31 -70
  33. package/dest/types.d.ts.map +1 -1
  34. package/dest/types.js +4 -20
  35. package/dest/validator_ha_signer.d.ts +13 -5
  36. package/dest/validator_ha_signer.d.ts.map +1 -1
  37. package/dest/validator_ha_signer.js +20 -10
  38. package/package.json +10 -6
  39. package/src/db/index.ts +1 -0
  40. package/src/db/lmdb.ts +265 -0
  41. package/src/db/migrations/1_initial-schema.ts +35 -4
  42. package/src/db/migrations/2_add-checkpoint-number.ts +19 -0
  43. package/src/db/postgres.ts +40 -13
  44. package/src/db/schema.ts +25 -9
  45. package/src/db/types.ts +67 -20
  46. package/src/factory.ts +93 -4
  47. package/src/metrics.ts +138 -0
  48. package/src/slashing_protection_service.ts +68 -18
  49. package/src/types.ts +53 -104
  50. package/src/validator_ha_signer.ts +38 -14
  51. package/dest/config.d.ts +0 -96
  52. package/dest/config.d.ts.map +0 -1
  53. package/dest/config.js +0 -86
  54. package/src/config.ts +0 -141
@@ -7,6 +7,8 @@
7
7
  import { type Logger, createLogger } from '@aztec/foundation/log';
8
8
  import { RunningPromise } from '@aztec/foundation/promise';
9
9
  import { sleep } from '@aztec/foundation/sleep';
10
+ import type { DateProvider } from '@aztec/foundation/timer';
11
+ import type { BaseSignerConfig } from '@aztec/stdlib/ha-signing';
10
12
 
11
13
  import {
12
14
  type CheckAndRecordParams,
@@ -16,7 +18,13 @@ import {
16
18
  getBlockIndexFromDutyIdentifier,
17
19
  } from './db/types.js';
18
20
  import { DutyAlreadySignedError, SlashingProtectionError } from './errors.js';
19
- import type { SlashingProtectionDatabase, ValidatorHASignerConfig } from './types.js';
21
+ import type { HASignerMetrics } from './metrics.js';
22
+ import type { SlashingProtectionDatabase } from './types.js';
23
+
24
+ export interface SlashingProtectionServiceDeps {
25
+ metrics: HASignerMetrics;
26
+ dateProvider: DateProvider;
27
+ }
20
28
 
21
29
  /**
22
30
  * Slashing Protection Service
@@ -39,11 +47,16 @@ export class SlashingProtectionService {
39
47
  private readonly signingTimeoutMs: number;
40
48
  private readonly maxStuckDutiesAgeMs: number;
41
49
 
50
+ private readonly metrics: HASignerMetrics;
51
+ private readonly dateProvider: DateProvider;
52
+
42
53
  private cleanupRunningPromise: RunningPromise;
54
+ private lastOldDutiesCleanupAtMs?: number;
43
55
 
44
56
  constructor(
45
57
  private readonly db: SlashingProtectionDatabase,
46
- private readonly config: ValidatorHASignerConfig,
58
+ private readonly config: BaseSignerConfig,
59
+ deps: SlashingProtectionServiceDeps,
47
60
  ) {
48
61
  this.log = createLogger('slashing-protection');
49
62
  this.pollingIntervalMs = config.pollingIntervalMs;
@@ -51,11 +64,9 @@ export class SlashingProtectionService {
51
64
  // Default to 144s (2x 72s Aztec slot duration) if not explicitly configured
52
65
  this.maxStuckDutiesAgeMs = config.maxStuckDutiesAgeMs ?? 144_000;
53
66
 
54
- this.cleanupRunningPromise = new RunningPromise(
55
- this.cleanupStuckDuties.bind(this),
56
- this.log,
57
- this.maxStuckDutiesAgeMs,
58
- );
67
+ this.cleanupRunningPromise = new RunningPromise(this.cleanup.bind(this), this.log, this.maxStuckDutiesAgeMs);
68
+ this.metrics = deps.metrics;
69
+ this.dateProvider = deps.dateProvider;
59
70
  }
60
71
 
61
72
  /**
@@ -67,7 +78,6 @@ export class SlashingProtectionService {
67
78
  * 2. If insert succeeds, we acquired the lock - return the lockToken
68
79
  * 3. If a record exists, handle based on status:
69
80
  * - SIGNED: Throw appropriate error (already signed or slashing protection)
70
- * - FAILED: Delete the failed record
71
81
  * - SIGNING: Wait and poll until status changes, then handle result
72
82
  *
73
83
  * @returns The lockToken that must be used for recordSuccess/deleteDuty
@@ -76,7 +86,7 @@ export class SlashingProtectionService {
76
86
  */
77
87
  async checkAndRecord(params: CheckAndRecordParams): Promise<string> {
78
88
  const { validatorAddress, slot, dutyType, messageHash, nodeId } = params;
79
- const startTime = Date.now();
89
+ const startTime = this.dateProvider.now();
80
90
 
81
91
  this.log.debug(`Checking duty: ${dutyType} for slot ${slot}`, {
82
92
  validatorAddress: validatorAddress.toString(),
@@ -89,10 +99,11 @@ export class SlashingProtectionService {
89
99
 
90
100
  if (isNew) {
91
101
  // We successfully acquired the lock
92
- this.log.info(`Acquired lock for duty ${dutyType} at slot ${slot}`, {
102
+ this.log.verbose(`Acquired lock for duty ${dutyType} at slot ${slot}`, {
93
103
  validatorAddress: validatorAddress.toString(),
94
104
  nodeId,
95
105
  });
106
+ this.metrics.recordLockAcquire(true);
96
107
  return record.lockToken;
97
108
  }
98
109
 
@@ -107,6 +118,7 @@ export class SlashingProtectionService {
107
118
  existingNodeId: record.nodeId,
108
119
  attemptingNodeId: nodeId,
109
120
  });
121
+ this.metrics.recordSlashingProtection(dutyType);
110
122
  throw new SlashingProtectionError(
111
123
  slot,
112
124
  dutyType,
@@ -116,15 +128,17 @@ export class SlashingProtectionService {
116
128
  record.nodeId,
117
129
  );
118
130
  }
131
+ this.metrics.recordDutyAlreadySigned(dutyType);
119
132
  throw new DutyAlreadySignedError(slot, dutyType, record.blockIndexWithinCheckpoint, record.nodeId);
120
133
  } else if (record.status === DutyStatus.SIGNING) {
121
134
  // Another node is currently signing - check for timeout
122
- if (Date.now() - startTime > this.signingTimeoutMs) {
135
+ if (this.dateProvider.now() - startTime > this.signingTimeoutMs) {
123
136
  this.log.warn(`Timeout waiting for signing to complete for duty ${dutyType} at slot ${slot}`, {
124
137
  validatorAddress: validatorAddress.toString(),
125
138
  timeoutMs: this.signingTimeoutMs,
126
139
  signingNodeId: record.nodeId,
127
140
  });
141
+ this.metrics.recordDutyAlreadySigned(dutyType);
128
142
  throw new DutyAlreadySignedError(slot, dutyType, record.blockIndexWithinCheckpoint, 'unknown (timeout)');
129
143
  }
130
144
 
@@ -163,7 +177,7 @@ export class SlashingProtectionService {
163
177
  );
164
178
 
165
179
  if (success) {
166
- this.log.info(`Recorded successful signing for duty ${dutyType} at slot ${slot}`, {
180
+ this.log.verbose(`Recorded successful signing for duty ${dutyType} at slot ${slot}`, {
167
181
  validatorAddress: validatorAddress.toString(),
168
182
  nodeId,
169
183
  });
@@ -221,7 +235,20 @@ export class SlashingProtectionService {
221
235
  * Start running tasks.
222
236
  * Cleanup runs immediately on start to recover from any previous crashes.
223
237
  */
224
- start() {
238
+ /**
239
+ * Start the background cleanup task.
240
+ * Also performs one-time cleanup of duties with outdated rollup addresses.
241
+ */
242
+ async start() {
243
+ // One-time cleanup at startup: remove duties from previous rollup versions
244
+ const numOutdatedRollupDuties = await this.db.cleanupOutdatedRollupDuties(this.config.l1Contracts.rollupAddress);
245
+ if (numOutdatedRollupDuties > 0) {
246
+ this.log.info(`Cleaned up ${numOutdatedRollupDuties} duties with outdated rollup address at startup`, {
247
+ currentRollupAddress: this.config.l1Contracts.rollupAddress.toString(),
248
+ });
249
+ this.metrics.recordCleanup('outdated_rollup', numOutdatedRollupDuties);
250
+ }
251
+
225
252
  this.cleanupRunningPromise.start();
226
253
  this.log.info('Slashing protection service started', { nodeId: this.config.nodeId });
227
254
  }
@@ -244,15 +271,38 @@ export class SlashingProtectionService {
244
271
  }
245
272
 
246
273
  /**
247
- * Cleanup own stuck duties
274
+ * Periodic cleanup of stuck duties and optionally old signed duties.
275
+ * Runs in the background via RunningPromise.
248
276
  */
249
- private async cleanupStuckDuties() {
250
- const numDuties = await this.db.cleanupOwnStuckDuties(this.config.nodeId, this.maxStuckDutiesAgeMs);
251
- if (numDuties > 0) {
252
- this.log.info(`Cleaned up ${numDuties} stuck duties`, {
277
+ private async cleanup() {
278
+ // 1. Clean up stuck duties (our own node's duties that got stuck in 'signing' status)
279
+ const numStuckDuties = await this.db.cleanupOwnStuckDuties(this.config.nodeId, this.maxStuckDutiesAgeMs);
280
+ if (numStuckDuties > 0) {
281
+ this.log.verbose(`Cleaned up ${numStuckDuties} stuck duties`, {
253
282
  nodeId: this.config.nodeId,
254
283
  maxStuckDutiesAgeMs: this.maxStuckDutiesAgeMs,
255
284
  });
285
+ this.metrics.recordCleanup('stuck', numStuckDuties);
286
+ }
287
+
288
+ // 2. Clean up old signed duties if configured
289
+ // we shouldn't run this as often as stuck duty cleanup.
290
+ if (this.config.cleanupOldDutiesAfterHours !== undefined) {
291
+ const maxAgeMs = this.config.cleanupOldDutiesAfterHours * 60 * 60 * 1000;
292
+ const nowMs = this.dateProvider.now();
293
+ const shouldRun =
294
+ this.lastOldDutiesCleanupAtMs === undefined || nowMs - this.lastOldDutiesCleanupAtMs >= maxAgeMs;
295
+ if (shouldRun) {
296
+ const numOldDuties = await this.db.cleanupOldDuties(maxAgeMs);
297
+ this.lastOldDutiesCleanupAtMs = nowMs;
298
+ if (numOldDuties > 0) {
299
+ this.log.verbose(`Cleaned up ${numOldDuties} old signed duties`, {
300
+ cleanupOldDutiesAfterHours: this.config.cleanupOldDutiesAfterHours,
301
+ maxAgeMs,
302
+ });
303
+ this.metrics.recordCleanup('old', numOldDuties);
304
+ }
305
+ }
256
306
  }
257
307
  }
258
308
  }
package/src/types.ts CHANGED
@@ -1,38 +1,51 @@
1
- import {
2
- BlockNumber,
3
- type CheckpointNumber,
4
- type IndexWithinCheckpoint,
5
- type SlotNumber,
6
- } from '@aztec/foundation/branded-types';
1
+ import { SlotNumber } from '@aztec/foundation/branded-types';
7
2
  import type { EthAddress } from '@aztec/foundation/eth-address';
3
+ import { DateProvider } from '@aztec/foundation/timer';
4
+ import {
5
+ type AttestationSigningContext,
6
+ type CheckpointProposalSigningContext,
7
+ DutyType,
8
+ type HAProtectedSigningContext,
9
+ type SigningContext,
10
+ type ValidatorHASignerConfig,
11
+ getBlockNumberFromSigningContext as getBlockNumberFromSigningContextFromStdlib,
12
+ getCheckpointNumberFromSigningContext as getCheckpointNumberFromSigningContextFromStdlib,
13
+ isHAProtectedContext,
14
+ } from '@aztec/stdlib/ha-signing';
15
+ import type { TelemetryClient } from '@aztec/telemetry-client';
8
16
 
9
17
  import type { Pool } from 'pg';
10
18
 
11
- import type { ValidatorHASignerConfig } from './config.js';
12
- import {
13
- type BlockProposalDutyIdentifier,
14
- type CheckAndRecordParams,
15
- type DeleteDutyParams,
16
- type DutyIdentifier,
17
- type DutyRow,
18
- DutyType,
19
- type OtherDutyIdentifier,
20
- type RecordSuccessParams,
21
- type ValidatorDutyRecord,
19
+ import type {
20
+ BlockProposalDutyIdentifier,
21
+ CheckAndRecordParams,
22
+ DeleteDutyParams,
23
+ DutyIdentifier,
24
+ DutyRow,
25
+ OtherDutyIdentifier,
26
+ RecordSuccessParams,
27
+ ValidatorDutyRecord,
22
28
  } from './db/types.js';
23
29
 
24
30
  export type {
31
+ AttestationSigningContext,
25
32
  BlockProposalDutyIdentifier,
26
33
  CheckAndRecordParams,
34
+ CheckpointProposalSigningContext,
27
35
  DeleteDutyParams,
28
36
  DutyIdentifier,
29
37
  DutyRow,
38
+ HAProtectedSigningContext,
30
39
  OtherDutyIdentifier,
31
40
  RecordSuccessParams,
41
+ SigningContext,
32
42
  ValidatorDutyRecord,
33
43
  ValidatorHASignerConfig,
34
44
  };
35
45
  export { DutyStatus, DutyType, getBlockIndexFromDutyIdentifier, normalizeBlockIndex } from './db/types.js';
46
+ export { isHAProtectedContext };
47
+ export { getBlockNumberFromSigningContextFromStdlib as getBlockNumberFromSigningContext };
48
+ export { getCheckpointNumberFromSigningContextFromStdlib as getCheckpointNumberFromSigningContext };
36
49
 
37
50
  /**
38
51
  * Result of tryInsertOrGetExisting operation
@@ -53,99 +66,20 @@ export interface CreateHASignerDeps {
53
66
  * If provided, databaseUrl and poolConfig are ignored
54
67
  */
55
68
  pool?: Pool;
56
- }
57
-
58
- /**
59
- * Base context for signing operations
60
- */
61
- interface BaseSigningContext {
62
- /** Slot number for this duty */
63
- slot: SlotNumber;
64
69
  /**
65
- * Block or checkpoint number for this duty.
66
- * For block proposals, this is the block number.
67
- * For checkpoint proposals, this is the checkpoint number.
70
+ * Optional telemetry client for metrics
68
71
  */
69
- blockNumber: BlockNumber | CheckpointNumber;
70
- }
71
-
72
- /**
73
- * Signing context for block proposals.
74
- * blockIndexWithinCheckpoint is REQUIRED and must be >= 0.
75
- */
76
- export interface BlockProposalSigningContext extends BaseSigningContext {
77
- /** Block index within checkpoint (0, 1, 2...). Required for block proposals. */
78
- blockIndexWithinCheckpoint: IndexWithinCheckpoint;
79
- dutyType: DutyType.BLOCK_PROPOSAL;
80
- }
81
-
82
- /**
83
- * Signing context for non-block-proposal duties that require HA protection.
84
- * blockIndexWithinCheckpoint is not applicable (internally always -1).
85
- */
86
- export interface OtherSigningContext extends BaseSigningContext {
87
- dutyType: DutyType.CHECKPOINT_PROPOSAL | DutyType.ATTESTATION | DutyType.ATTESTATIONS_AND_SIGNERS;
88
- }
89
-
90
- /**
91
- * Signing context for governance/slashing votes which only need slot for HA protection.
92
- * blockNumber is not applicable (internally always 0).
93
- */
94
- export interface VoteSigningContext {
95
- slot: SlotNumber;
96
- dutyType: DutyType.GOVERNANCE_VOTE | DutyType.SLASHING_VOTE;
97
- }
98
-
99
- /**
100
- * Signing context for duties which don't require slot/blockNumber
101
- * as they don't need HA protection (AUTH_REQUEST, TXS).
102
- */
103
- export interface NoHAProtectionSigningContext {
104
- dutyType: DutyType.AUTH_REQUEST | DutyType.TXS;
105
- }
106
-
107
- /**
108
- * Signing contexts that require HA protection (excludes AUTH_REQUEST).
109
- * Used by the HA signer's signWithProtection method.
110
- */
111
- export type HAProtectedSigningContext = BlockProposalSigningContext | OtherSigningContext | VoteSigningContext;
112
-
113
- /**
114
- * Type guard to check if a SigningContext requires HA protection.
115
- * Returns true for contexts that need HA protection, false for AUTH_REQUEST and TXS.
116
- */
117
- export function isHAProtectedContext(context: SigningContext): context is HAProtectedSigningContext {
118
- return context.dutyType !== DutyType.AUTH_REQUEST && context.dutyType !== DutyType.TXS;
119
- }
120
-
121
- /**
122
- * Gets the block number from a signing context.
123
- * - Vote duties (GOVERNANCE_VOTE, SLASHING_VOTE): returns BlockNumber(0)
124
- * - Other duties: returns the blockNumber from the context
125
- */
126
- export function getBlockNumberFromSigningContext(context: HAProtectedSigningContext): BlockNumber | CheckpointNumber {
127
- // Check for duty types that have blockNumber
128
- if (
129
- context.dutyType === DutyType.BLOCK_PROPOSAL ||
130
- context.dutyType === DutyType.CHECKPOINT_PROPOSAL ||
131
- context.dutyType === DutyType.ATTESTATION ||
132
- context.dutyType === DutyType.ATTESTATIONS_AND_SIGNERS
133
- ) {
134
- return context.blockNumber;
135
- }
136
- // Vote duties (GOVERNANCE_VOTE, SLASHING_VOTE) don't have blockNumber
137
- return BlockNumber(0);
72
+ telemetryClient?: TelemetryClient;
73
+ /**
74
+ * Optional date provider for timestamps
75
+ */
76
+ dateProvider?: DateProvider;
138
77
  }
139
78
 
140
79
  /**
141
- * Context required for slashing protection during signing operations.
142
- * Uses discriminated union to enforce type safety:
143
- * - BLOCK_PROPOSAL duties MUST have blockIndexWithinCheckpoint >= 0
144
- * - Other duty types do NOT have blockIndexWithinCheckpoint (internally -1)
145
- * - Vote duties only need slot (blockNumber is internally 0)
146
- * - AUTH_REQUEST and TXS duties don't need slot/blockNumber (no HA protection needed)
80
+ * deps for creating a local signing protection signer
147
81
  */
148
- export type SigningContext = HAProtectedSigningContext | NoHAProtectionSigningContext;
82
+ export type CreateLocalSignerWithProtectionDeps = Omit<CreateHASignerDeps, 'pool'>;
149
83
 
150
84
  /**
151
85
  * Database interface for slashing protection operations
@@ -203,6 +137,21 @@ export interface SlashingProtectionDatabase {
203
137
  */
204
138
  cleanupOwnStuckDuties(nodeId: string, maxAgeMs: number): Promise<number>;
205
139
 
140
+ /**
141
+ * Cleanup duties with outdated rollup address.
142
+ * Removes all duties where the rollup address doesn't match the current one.
143
+ * Used after a rollup upgrade to clean up duties for the old rollup.
144
+ * @returns the number of duties cleaned up
145
+ */
146
+ cleanupOutdatedRollupDuties(currentRollupAddress: EthAddress): Promise<number>;
147
+
148
+ /**
149
+ * Cleanup old signed duties.
150
+ * Removes only signed duties older than the specified age.
151
+ * @returns the number of duties cleaned up
152
+ */
153
+ cleanupOldDuties(maxAgeMs: number): Promise<number>;
154
+
206
155
  /**
207
156
  * Close the database connection.
208
157
  * Should be called during graceful shutdown.
@@ -9,15 +9,24 @@ import type { Buffer32 } from '@aztec/foundation/buffer';
9
9
  import { EthAddress } from '@aztec/foundation/eth-address';
10
10
  import type { Signature } from '@aztec/foundation/eth-signature';
11
11
  import { type Logger, createLogger } from '@aztec/foundation/log';
12
-
13
- import type { ValidatorHASignerConfig } from './config.js';
14
- import { type DutyIdentifier, DutyType } from './db/types.js';
15
- import { SlashingProtectionService } from './slashing_protection_service.js';
12
+ import type { DateProvider } from '@aztec/foundation/timer';
16
13
  import {
14
+ type BaseSignerConfig,
15
+ DutyType,
17
16
  type HAProtectedSigningContext,
18
- type SlashingProtectionDatabase,
19
17
  getBlockNumberFromSigningContext,
20
- } from './types.js';
18
+ getCheckpointNumberFromSigningContext,
19
+ } from '@aztec/stdlib/ha-signing';
20
+
21
+ import type { DutyIdentifier } from './db/types.js';
22
+ import type { HASignerMetrics } from './metrics.js';
23
+ import { SlashingProtectionService } from './slashing_protection_service.js';
24
+ import type { SlashingProtectionDatabase } from './types.js';
25
+
26
+ export interface ValidatorHASignerDeps {
27
+ metrics: HASignerMetrics;
28
+ dateProvider: DateProvider;
29
+ }
21
30
 
22
31
  /**
23
32
  * Validator High Availability Signer
@@ -43,22 +52,27 @@ export class ValidatorHASigner {
43
52
  private readonly slashingProtection: SlashingProtectionService;
44
53
  private readonly rollupAddress: EthAddress;
45
54
 
55
+ private readonly dateProvider: DateProvider;
56
+ private readonly metrics: HASignerMetrics;
57
+
46
58
  constructor(
47
59
  db: SlashingProtectionDatabase,
48
- private readonly config: ValidatorHASignerConfig,
60
+ private readonly config: BaseSignerConfig,
61
+ deps: ValidatorHASignerDeps,
49
62
  ) {
50
63
  this.log = createLogger('validator-ha-signer');
51
64
 
52
- if (!config.haSigningEnabled) {
53
- // this shouldn't happen, the validator should use different signer for non-HA setups
54
- throw new Error('Validator HA Signer is not enabled in config');
55
- }
65
+ this.metrics = deps.metrics;
66
+ this.dateProvider = deps.dateProvider;
56
67
 
57
68
  if (!config.nodeId || config.nodeId === '') {
58
69
  throw new Error('NODE_ID is required for high-availability setups');
59
70
  }
60
71
  this.rollupAddress = config.l1Contracts.rollupAddress;
61
- this.slashingProtection = new SlashingProtectionService(db, config);
72
+ this.slashingProtection = new SlashingProtectionService(db, config, {
73
+ metrics: deps.metrics,
74
+ dateProvider: deps.dateProvider,
75
+ });
62
76
  this.log.info('Validator HA Signer initialized with slashing protection', {
63
77
  nodeId: config.nodeId,
64
78
  rollupAddress: this.rollupAddress.toString(),
@@ -88,6 +102,9 @@ export class ValidatorHASigner {
88
102
  context: HAProtectedSigningContext,
89
103
  signFn: (messageHash: Buffer32) => Promise<Signature>,
90
104
  ): Promise<Signature> {
105
+ const startTime = this.dateProvider.now();
106
+ const dutyType = context.dutyType;
107
+
91
108
  let dutyIdentifier: DutyIdentifier;
92
109
  if (context.dutyType === DutyType.BLOCK_PROPOSAL) {
93
110
  dutyIdentifier = {
@@ -107,10 +124,13 @@ export class ValidatorHASigner {
107
124
  }
108
125
 
109
126
  // Acquire lock and get the token for ownership verification
127
+ // DutyAlreadySignedError and SlashingProtectionError may be thrown here and are recorded in the service
110
128
  const blockNumber = getBlockNumberFromSigningContext(context);
129
+ const checkpointNumber = getCheckpointNumberFromSigningContext(context);
111
130
  const lockToken = await this.slashingProtection.checkAndRecord({
112
131
  ...dutyIdentifier,
113
132
  blockNumber,
133
+ checkpointNumber,
114
134
  messageHash: messageHash.toString(),
115
135
  nodeId: this.config.nodeId,
116
136
  });
@@ -122,6 +142,7 @@ export class ValidatorHASigner {
122
142
  } catch (error: any) {
123
143
  // Delete duty to allow retry (only succeeds if we own the lock)
124
144
  await this.slashingProtection.deleteDuty({ ...dutyIdentifier, lockToken });
145
+ this.metrics.recordSigningError(dutyType);
125
146
  throw error;
126
147
  }
127
148
 
@@ -133,6 +154,9 @@ export class ValidatorHASigner {
133
154
  lockToken,
134
155
  });
135
156
 
157
+ const duration = this.dateProvider.now() - startTime;
158
+ this.metrics.recordSigningSuccess(dutyType, duration);
159
+
136
160
  return signature;
137
161
  }
138
162
 
@@ -147,8 +171,8 @@ export class ValidatorHASigner {
147
171
  * Start the HA signer background tasks (cleanup of stuck duties).
148
172
  * Should be called after construction and before signing operations.
149
173
  */
150
- start() {
151
- this.slashingProtection.start();
174
+ async start() {
175
+ await this.slashingProtection.start();
152
176
  }
153
177
 
154
178
  /**
package/dest/config.d.ts DELETED
@@ -1,96 +0,0 @@
1
- import type { L1ContractAddresses } from '@aztec/ethereum/l1-contract-addresses';
2
- import { type ConfigMappingsType } from '@aztec/foundation/config';
3
- import { EthAddress } from '@aztec/foundation/eth-address';
4
- import { z } from 'zod';
5
- /**
6
- * Configuration for the Validator HA Signer
7
- *
8
- * This config is used for distributed locking and slashing protection
9
- * when running multiple validator nodes in a high-availability setup.
10
- */
11
- export interface ValidatorHASignerConfig {
12
- /** Whether HA signing / slashing protection is enabled */
13
- haSigningEnabled: boolean;
14
- /** L1 contract addresses (rollup address required) */
15
- l1Contracts: Pick<L1ContractAddresses, 'rollupAddress'>;
16
- /** Unique identifier for this node */
17
- nodeId: string;
18
- /** How long to wait between polls when a duty is being signed (ms) */
19
- pollingIntervalMs: number;
20
- /** Maximum time to wait for a duty being signed to complete (ms) */
21
- signingTimeoutMs: number;
22
- /** Maximum age of a stuck duty in ms (defaults to 2x hardcoded Aztec slot duration if not set) */
23
- maxStuckDutiesAgeMs?: number;
24
- /**
25
- * PostgreSQL connection string
26
- * Format: postgresql://user:password@host:port/database
27
- */
28
- databaseUrl?: string;
29
- /**
30
- * PostgreSQL connection pool configuration
31
- */
32
- /** Maximum number of clients in the pool (default: 10) */
33
- poolMaxCount?: number;
34
- /** Minimum number of clients in the pool (default: 0) */
35
- poolMinCount?: number;
36
- /** Idle timeout in milliseconds (default: 10000) */
37
- poolIdleTimeoutMs?: number;
38
- /** Connection timeout in milliseconds (default: 0, no timeout) */
39
- poolConnectionTimeoutMs?: number;
40
- }
41
- export declare const validatorHASignerConfigMappings: ConfigMappingsType<ValidatorHASignerConfig>;
42
- export declare const defaultValidatorHASignerConfig: ValidatorHASignerConfig;
43
- /**
44
- * Returns the validator HA signer configuration from environment variables.
45
- * Note: If an environment variable is not set, the default value is used.
46
- * @returns The validator HA signer configuration.
47
- */
48
- export declare function getConfigEnvVars(): ValidatorHASignerConfig;
49
- export declare const ValidatorHASignerConfigSchema: z.ZodObject<{
50
- haSigningEnabled: z.ZodBoolean;
51
- l1Contracts: z.ZodObject<{
52
- rollupAddress: z.ZodType<EthAddress, z.ZodTypeDef, EthAddress>;
53
- }, "strip", z.ZodTypeAny, {
54
- rollupAddress: EthAddress;
55
- }, {
56
- rollupAddress: EthAddress;
57
- }>;
58
- nodeId: z.ZodString;
59
- pollingIntervalMs: z.ZodNumber;
60
- signingTimeoutMs: z.ZodNumber;
61
- maxStuckDutiesAgeMs: z.ZodOptional<z.ZodNumber>;
62
- databaseUrl: z.ZodOptional<z.ZodString>;
63
- poolMaxCount: z.ZodOptional<z.ZodNumber>;
64
- poolMinCount: z.ZodOptional<z.ZodNumber>;
65
- poolIdleTimeoutMs: z.ZodOptional<z.ZodNumber>;
66
- poolConnectionTimeoutMs: z.ZodOptional<z.ZodNumber>;
67
- }, "strip", z.ZodTypeAny, {
68
- haSigningEnabled: boolean;
69
- l1Contracts: {
70
- rollupAddress: EthAddress;
71
- };
72
- nodeId: string;
73
- pollingIntervalMs: number;
74
- signingTimeoutMs: number;
75
- maxStuckDutiesAgeMs?: number | undefined;
76
- databaseUrl?: string | undefined;
77
- poolMaxCount?: number | undefined;
78
- poolMinCount?: number | undefined;
79
- poolIdleTimeoutMs?: number | undefined;
80
- poolConnectionTimeoutMs?: number | undefined;
81
- }, {
82
- haSigningEnabled: boolean;
83
- l1Contracts: {
84
- rollupAddress: EthAddress;
85
- };
86
- nodeId: string;
87
- pollingIntervalMs: number;
88
- signingTimeoutMs: number;
89
- maxStuckDutiesAgeMs?: number | undefined;
90
- databaseUrl?: string | undefined;
91
- poolMaxCount?: number | undefined;
92
- poolMinCount?: number | undefined;
93
- poolIdleTimeoutMs?: number | undefined;
94
- poolConnectionTimeoutMs?: number | undefined;
95
- }>;
96
- //# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY29uZmlnLmQudHMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi9zcmMvY29uZmlnLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLE9BQU8sS0FBSyxFQUFFLG1CQUFtQixFQUFFLE1BQU0sdUNBQXVDLENBQUM7QUFDakYsT0FBTyxFQUNMLEtBQUssa0JBQWtCLEVBTXhCLE1BQU0sMEJBQTBCLENBQUM7QUFDbEMsT0FBTyxFQUFFLFVBQVUsRUFBRSxNQUFNLCtCQUErQixDQUFDO0FBRzNELE9BQU8sRUFBRSxDQUFDLEVBQUUsTUFBTSxLQUFLLENBQUM7QUFFeEI7Ozs7O0dBS0c7QUFDSCxNQUFNLFdBQVcsdUJBQXVCO0lBQ3RDLDBEQUEwRDtJQUMxRCxnQkFBZ0IsRUFBRSxPQUFPLENBQUM7SUFDMUIsc0RBQXNEO0lBQ3RELFdBQVcsRUFBRSxJQUFJLENBQUMsbUJBQW1CLEVBQUUsZUFBZSxDQUFDLENBQUM7SUFDeEQsc0NBQXNDO0lBQ3RDLE1BQU0sRUFBRSxNQUFNLENBQUM7SUFDZixzRUFBc0U7SUFDdEUsaUJBQWlCLEVBQUUsTUFBTSxDQUFDO0lBQzFCLG9FQUFvRTtJQUNwRSxnQkFBZ0IsRUFBRSxNQUFNLENBQUM7SUFDekIsa0dBQWtHO0lBQ2xHLG1CQUFtQixDQUFDLEVBQUUsTUFBTSxDQUFDO0lBQzdCOzs7T0FHRztJQUNILFdBQVcsQ0FBQyxFQUFFLE1BQU0sQ0FBQztJQUNyQjs7T0FFRztJQUNILDBEQUEwRDtJQUMxRCxZQUFZLENBQUMsRUFBRSxNQUFNLENBQUM7SUFDdEIseURBQXlEO0lBQ3pELFlBQVksQ0FBQyxFQUFFLE1BQU0sQ0FBQztJQUN0QixvREFBb0Q7SUFDcEQsaUJBQWlCLENBQUMsRUFBRSxNQUFNLENBQUM7SUFDM0Isa0VBQWtFO0lBQ2xFLHVCQUF1QixDQUFDLEVBQUUsTUFBTSxDQUFDO0NBQ2xDO0FBRUQsZUFBTyxNQUFNLCtCQUErQixFQUFFLGtCQUFrQixDQUFDLHVCQUF1QixDQTREdkYsQ0FBQztBQUVGLGVBQU8sTUFBTSw4QkFBOEIsRUFBRSx1QkFFNUMsQ0FBQztBQUVGOzs7O0dBSUc7QUFDSCx3QkFBZ0IsZ0JBQWdCLElBQUksdUJBQXVCLENBRTFEO0FBRUQsZUFBTyxNQUFNLDZCQUE2Qjs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7OztFQWNFLENBQUMifQ==
@@ -1 +0,0 @@
1
- {"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,uCAAuC,CAAC;AACjF,OAAO,EACL,KAAK,kBAAkB,EAMxB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,UAAU,EAAE,MAAM,+BAA+B,CAAC;AAG3D,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;GAKG;AACH,MAAM,WAAW,uBAAuB;IACtC,0DAA0D;IAC1D,gBAAgB,EAAE,OAAO,CAAC;IAC1B,sDAAsD;IACtD,WAAW,EAAE,IAAI,CAAC,mBAAmB,EAAE,eAAe,CAAC,CAAC;IACxD,sCAAsC;IACtC,MAAM,EAAE,MAAM,CAAC;IACf,sEAAsE;IACtE,iBAAiB,EAAE,MAAM,CAAC;IAC1B,oEAAoE;IACpE,gBAAgB,EAAE,MAAM,CAAC;IACzB,kGAAkG;IAClG,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;OAEG;IACH,0DAA0D;IAC1D,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,yDAAyD;IACzD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,oDAAoD;IACpD,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,kEAAkE;IAClE,uBAAuB,CAAC,EAAE,MAAM,CAAC;CAClC;AAED,eAAO,MAAM,+BAA+B,EAAE,kBAAkB,CAAC,uBAAuB,CA4DvF,CAAC;AAEF,eAAO,MAAM,8BAA8B,EAAE,uBAE5C,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,gBAAgB,IAAI,uBAAuB,CAE1D;AAED,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAcE,CAAC"}