@aztec/validator-ha-signer 4.0.0-nightly.20260116 → 4.0.0-nightly.20260117

package/dest/slashing_protection_service.js

@@ -6,7 +6,7 @@
  */ import { createLogger } from '@aztec/foundation/log';
 import { RunningPromise } from '@aztec/foundation/promise';
 import { sleep } from '@aztec/foundation/sleep';
-import { DutyStatus } from './db/types.js';
+import { DutyStatus, getBlockIndexFromDutyIdentifier } from './db/types.js';
 import { DutyAlreadySignedError, SlashingProtectionError } from './errors.js';
 /**
  * Slashing Protection Service
@@ -28,6 +28,7 @@ import { DutyAlreadySignedError, SlashingProtectionError } from './errors.js';
     log;
     pollingIntervalMs;
     signingTimeoutMs;
+    maxStuckDutiesAgeMs;
     cleanupRunningPromise;
     constructor(db, config){
         this.db = db;
@@ -35,7 +36,9 @@ import { DutyAlreadySignedError, SlashingProtectionError } from './errors.js';
         this.log = createLogger('slashing-protection');
         this.pollingIntervalMs = config.pollingIntervalMs;
         this.signingTimeoutMs = config.signingTimeoutMs;
-        this.cleanupRunningPromise = new RunningPromise(this.cleanupStuckDuties.bind(this), this.log, this.config.maxStuckDutiesAgeMs);
+        // Default to 144s (2x 72s Aztec slot duration) if not explicitly configured
+        this.maxStuckDutiesAgeMs = config.maxStuckDutiesAgeMs ?? 144_000;
+        this.cleanupRunningPromise = new RunningPromise(this.cleanupStuckDuties.bind(this), this.log, this.maxStuckDutiesAgeMs);
     }
     /**
    * Check if a duty can be performed and acquire the lock if so.
@@ -81,9 +84,9 @@ import { DutyAlreadySignedError, SlashingProtectionError } from './errors.js';
                         existingNodeId: record.nodeId,
                         attemptingNodeId: nodeId
                     });
-                    throw new SlashingProtectionError(slot, dutyType, record.messageHash, messageHash);
+                    throw new SlashingProtectionError(slot, dutyType, record.blockIndexWithinCheckpoint, record.messageHash, messageHash, record.nodeId);
                 }
-                throw new DutyAlreadySignedError(slot, dutyType, record.nodeId);
+                throw new DutyAlreadySignedError(slot, dutyType, record.blockIndexWithinCheckpoint, record.nodeId);
             } else if (record.status === DutyStatus.SIGNING) {
                 // Another node is currently signing - check for timeout
                 if (Date.now() - startTime > this.signingTimeoutMs) {
@@ -92,7 +95,7 @@ import { DutyAlreadySignedError, SlashingProtectionError } from './errors.js';
                         timeoutMs: this.signingTimeoutMs,
                         signingNodeId: record.nodeId
                     });
-                    throw new DutyAlreadySignedError(slot, dutyType, 'unknown (timeout)');
+                    throw new DutyAlreadySignedError(slot, dutyType, record.blockIndexWithinCheckpoint, 'unknown (timeout)');
                 }
                 // Wait and poll
                 this.log.debug(`Waiting for signing to complete for duty ${dutyType} at slot ${slot}`, {
@@ -114,7 +117,8 @@ import { DutyAlreadySignedError, SlashingProtectionError } from './errors.js';
    * @returns true if the update succeeded, false if token didn't match
    */ async recordSuccess(params) {
         const { validatorAddress, slot, dutyType, signature, nodeId, lockToken } = params;
-        const success = await this.db.updateDutySigned(validatorAddress, slot, dutyType, signature.toString(), lockToken);
+        const blockIndexWithinCheckpoint = getBlockIndexFromDutyIdentifier(params);
+        const success = await this.db.updateDutySigned(validatorAddress, slot, dutyType, signature.toString(), lockToken, blockIndexWithinCheckpoint);
         if (success) {
             this.log.info(`Recorded successful signing for duty ${dutyType} at slot ${slot}`, {
                 validatorAddress: validatorAddress.toString(),
@@ -136,7 +140,8 @@ import { DutyAlreadySignedError, SlashingProtectionError } from './errors.js';
    * @returns true if the delete succeeded, false if token didn't match
    */ async deleteDuty(params) {
         const { validatorAddress, slot, dutyType, lockToken } = params;
-        const success = await this.db.deleteDuty(validatorAddress, slot, dutyType, lockToken);
+        const blockIndexWithinCheckpoint = getBlockIndexFromDutyIdentifier(params);
+        const success = await this.db.deleteDuty(validatorAddress, slot, dutyType, lockToken, blockIndexWithinCheckpoint);
         if (success) {
             this.log.info(`Deleted duty ${dutyType} at slot ${slot} to allow retry`, {
                 validatorAddress: validatorAddress.toString()
@@ -171,13 +176,20 @@ import { DutyAlreadySignedError, SlashingProtectionError } from './errors.js';
         });
     }
     /**
+   * Close the database connection.
+   * Should be called after stop() during graceful shutdown.
+   */ async close() {
+        await this.db.close();
+        this.log.info('Slashing protection database connection closed');
+    }
+    /**
    * Cleanup own stuck duties
    */ async cleanupStuckDuties() {
-        const numDuties = await this.db.cleanupOwnStuckDuties(this.config.nodeId, this.config.maxStuckDutiesAgeMs);
+        const numDuties = await this.db.cleanupOwnStuckDuties(this.config.nodeId, this.maxStuckDutiesAgeMs);
         if (numDuties > 0) {
             this.log.info(`Cleaned up ${numDuties} stuck duties`, {
                 nodeId: this.config.nodeId,
-                maxStuckDutiesAgeMs: this.config.maxStuckDutiesAgeMs
+                maxStuckDutiesAgeMs: this.maxStuckDutiesAgeMs
             });
         }
     }

package/dest/types.d.ts

@@ -1,9 +1,10 @@
+import { BlockNumber, type CheckpointNumber, type SlotNumber } from '@aztec/foundation/branded-types';
 import type { EthAddress } from '@aztec/foundation/eth-address';
 import type { Pool } from 'pg';
-import type { CreateHASignerConfig, SlashingProtectionConfig } from './config.js';
-import type { CheckAndRecordParams, DeleteDutyParams, DutyIdentifier, DutyType, RecordSuccessParams, ValidatorDutyRecord } from './db/types.js';
-export type { CheckAndRecordParams, CreateHASignerConfig, DeleteDutyParams, DutyIdentifier, RecordSuccessParams, SlashingProtectionConfig, ValidatorDutyRecord, };
-export { DutyStatus, DutyType } from './db/types.js';
+import type { ValidatorHASignerConfig } from './config.js';
+import { type BlockProposalDutyIdentifier, type CheckAndRecordParams, type DeleteDutyParams, type DutyIdentifier, DutyType, type OtherDutyIdentifier, type RecordSuccessParams, type ValidatorDutyRecord } from './db/types.js';
+export type { BlockProposalDutyIdentifier, CheckAndRecordParams, DeleteDutyParams, DutyIdentifier, OtherDutyIdentifier, RecordSuccessParams, ValidatorDutyRecord, ValidatorHASignerConfig, };
+export { DutyStatus, DutyType, getBlockIndexFromDutyIdentifier, normalizeBlockIndex } from './db/types.js';
 /**
  * Result of tryInsertOrGetExisting operation
  */
@@ -24,16 +25,74 @@ export interface CreateHASignerDeps {
     pool?: Pool;
 }
 /**
- * Context required for slashing protection during signing operations
+ * Base context for signing operations
  */
-export interface SigningContext {
+interface BaseSigningContext {
     /** Slot number for this duty */
-    slot: bigint;
-    /** Block number for this duty */
-    blockNumber: bigint;
-    /** Type of duty being performed */
-    dutyType: DutyType;
+    slot: SlotNumber;
+    /**
+     * Block or checkpoint number for this duty.
+     * For block proposals, this is the block number.
+     * For checkpoint proposals, this is the checkpoint number.
+     */
+    blockNumber: BlockNumber | CheckpointNumber;
+}
+/**
+ * Signing context for block proposals.
+ * blockIndexWithinCheckpoint is REQUIRED and must be >= 0.
+ */
+export interface BlockProposalSigningContext extends BaseSigningContext {
+    /** Block index within checkpoint (0, 1, 2...). Required for block proposals. */
+    blockIndexWithinCheckpoint: number;
+    dutyType: DutyType.BLOCK_PROPOSAL;
+}
+/**
+ * Signing context for non-block-proposal duties that require HA protection.
+ * blockIndexWithinCheckpoint is not applicable (internally always -1).
+ */
+export interface OtherSigningContext extends BaseSigningContext {
+    dutyType: DutyType.CHECKPOINT_PROPOSAL | DutyType.ATTESTATION | DutyType.ATTESTATIONS_AND_SIGNERS;
+}
+/**
+ * Signing context for governance/slashing votes which only need slot for HA protection.
+ * blockNumber is not applicable (internally always 0).
+ */
+export interface VoteSigningContext {
+    slot: SlotNumber;
+    dutyType: DutyType.GOVERNANCE_VOTE | DutyType.SLASHING_VOTE;
+}
+/**
+ * Signing context for duties which don't require slot/blockNumber
+ * as they don't need HA protection (AUTH_REQUEST, TXS).
+ */
+export interface NoHAProtectionSigningContext {
+    dutyType: DutyType.AUTH_REQUEST | DutyType.TXS;
 }
+/**
+ * Signing contexts that require HA protection (excludes AUTH_REQUEST).
+ * Used by the HA signer's signWithProtection method.
+ */
+export type HAProtectedSigningContext = BlockProposalSigningContext | OtherSigningContext | VoteSigningContext;
+/**
+ * Type guard to check if a SigningContext requires HA protection.
+ * Returns true for contexts that need HA protection, false for AUTH_REQUEST and TXS.
+ */
+export declare function isHAProtectedContext(context: SigningContext): context is HAProtectedSigningContext;
+/**
+ * Gets the block number from a signing context.
+ * - Vote duties (GOVERNANCE_VOTE, SLASHING_VOTE): returns BlockNumber(0)
+ * - Other duties: returns the blockNumber from the context
+ */
+export declare function getBlockNumberFromSigningContext(context: HAProtectedSigningContext): BlockNumber | CheckpointNumber;
+/**
+ * Context required for slashing protection during signing operations.
+ * Uses discriminated union to enforce type safety:
+ * - BLOCK_PROPOSAL duties MUST have blockIndexWithinCheckpoint >= 0
+ * - Other duty types do NOT have blockIndexWithinCheckpoint (internally -1)
+ * - Vote duties only need slot (blockNumber is internally 0)
+ * - AUTH_REQUEST and TXS duties don't need slot/blockNumber (no HA protection needed)
+ */
+export type SigningContext = HAProtectedSigningContext | NoHAProtectionSigningContext;
 /**
  * Database interface for slashing protection operations
  * This abstraction allows for different database implementations (PostgreSQL, SQLite, etc.)
@@ -57,7 +116,7 @@ export interface SlashingProtectionDatabase {
      *
      * @returns true if the update succeeded, false if token didn't match or duty not found
      */
-    updateDutySigned(validatorAddress: EthAddress, slot: bigint, dutyType: DutyType, signature: string, lockToken: string): Promise<boolean>;
+    updateDutySigned(validatorAddress: EthAddress, slot: SlotNumber, dutyType: DutyType, signature: string, lockToken: string, blockIndexWithinCheckpoint: number): Promise<boolean>;
     /**
      * Delete a duty record.
      * Only succeeds if the lockToken matches (caller must be the one who created the duty).
@@ -65,11 +124,16 @@ export interface SlashingProtectionDatabase {
      *
      * @returns true if the delete succeeded, false if token didn't match or duty not found
      */
-    deleteDuty(validatorAddress: EthAddress, slot: bigint, dutyType: DutyType, lockToken: string): Promise<boolean>;
+    deleteDuty(validatorAddress: EthAddress, slot: SlotNumber, dutyType: DutyType, lockToken: string, blockIndexWithinCheckpoint: number): Promise<boolean>;
     /**
      * Cleanup own stuck duties
      * @returns the number of duties cleaned up
      */
     cleanupOwnStuckDuties(nodeId: string, maxAgeMs: number): Promise<number>;
+    /**
+     * Close the database connection.
+     * Should be called during graceful shutdown.
+     */
+    close(): Promise<void>;
 }
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoidHlwZXMuZC50cyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uL3NyYy90eXBlcy50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEtBQUssRUFBRSxVQUFVLEVBQUUsTUFBTSwrQkFBK0IsQ0FBQztBQUVoRSxPQUFPLEtBQUssRUFBRSxJQUFJLEVBQUUsTUFBTSxJQUFJLENBQUM7QUFFL0IsT0FBTyxLQUFLLEVBQUUsb0JBQW9CLEVBQUUsd0JBQXdCLEVBQUUsTUFBTSxhQUFhLENBQUM7QUFDbEYsT0FBTyxLQUFLLEVBQ1Ysb0JBQW9CLEVBQ3BCLGdCQUFnQixFQUNoQixjQUFjLEVBQ2QsUUFBUSxFQUNSLG1CQUFtQixFQUNuQixtQkFBbUIsRUFDcEIsTUFBTSxlQUFlLENBQUM7QUFFdkIsWUFBWSxFQUNWLG9CQUFvQixFQUNwQixvQkFBb0IsRUFDcEIsZ0JBQWdCLEVBQ2hCLGNBQWMsRUFDZCxtQkFBbUIsRUFDbkIsd0JBQXdCLEVBQ3hCLG1CQUFtQixHQUNwQixDQUFDO0FBQ0YsT0FBTyxFQUFFLFVBQVUsRUFBRSxRQUFRLEVBQUUsTUFBTSxlQUFlLENBQUM7QUFFckQ7O0dBRUc7QUFDSCxNQUFNLFdBQVcsb0JBQW9CO0lBQ25DLDJFQUEyRTtJQUMzRSxLQUFLLEVBQUUsT0FBTyxDQUFDO0lBQ2YscURBQXFEO0lBQ3JELE1BQU0sRUFBRSxtQkFBbUIsQ0FBQztDQUM3QjtBQUVEOztHQUVHO0FBQ0gsTUFBTSxXQUFXLGtCQUFrQjtJQUNqQzs7O09BR0c7SUFDSCxJQUFJLENBQUMsRUFBRSxJQUFJLENBQUM7Q0FDYjtBQUVEOztHQUVHO0FBQ0gsTUFBTSxXQUFXLGNBQWM7SUFDN0IsZ0NBQWdDO0lBQ2hDLElBQUksRUFBRSxNQUFNLENBQUM7SUFDYixpQ0FBaUM7SUFDakMsV0FBVyxFQUFFLE1BQU0sQ0FBQztJQUNwQixtQ0FBbUM7SUFDbkMsUUFBUSxFQUFFLFFBQVEsQ0FBQztDQUNwQjtBQUVEOzs7Ozs7OztHQVFHO0FBQ0gsTUFBTSxXQUFXLDBCQUEwQjtJQUN6Qzs7Ozs7T0FLRztJQUNILHNCQUFzQixDQUFDLE1BQU0sRUFBRSxvQkFBb0IsR0FBRyxPQUFPLENBQUMsb0JBQW9CLENBQUMsQ0FBQztJQUVwRjs7Ozs7T0FLRztJQUNILGdCQUFnQixDQUNkLGdCQUFnQixFQUFFLFVBQVUsRUFDNUIsSUFBSSxFQUFFLE1BQU0sRUFDWixRQUFRLEVBQUUsUUFBUSxFQUNsQixTQUFTLEVBQUUsTUFBTSxFQUNqQixTQUFTLEVBQUUsTUFBTSxHQUNoQixPQUFPLENBQUMsT0FBTyxDQUFDLENBQUM7SUFFcEI7Ozs7OztPQU1HO0lBQ0gsVUFBVSxDQUFDLGdCQUFnQixFQUFFLFVBQVUsRUFBRSxJQUFJLEVBQUUsTUFBTSxFQUFFLFFBQVEsRUFBRSxRQUFRLEVBQUUsU0FBUyxFQUFFLE1BQU0sR0FBRyxPQUFPLENBQUMsT0FBTyxDQUFDLENBQUM7SUFFaEg7OztPQUdHO0lBQ0gscUJBQXFCLENBQUMsTUFBTSxFQUFFLE1BQU0sRUFBRSxRQUFRLEVBQUUsTUFBTSxHQUFHLE9BQU8sQ0FBQyxNQUFNLENBQUMsQ0FBQztDQUMxRSJ9
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoidHlwZXMuZC50cyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uL3NyYy90eXBlcy50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEVBQUUsV0FBVyxFQUFFLEtBQUssZ0JBQWdCLEVBQUUsS0FBSyxVQUFVLEVBQUUsTUFBTSxpQ0FBaUMsQ0FBQztBQUN0RyxPQUFPLEtBQUssRUFBRSxVQUFVLEVBQUUsTUFBTSwrQkFBK0IsQ0FBQztBQUVoRSxPQUFPLEtBQUssRUFBRSxJQUFJLEVBQUUsTUFBTSxJQUFJLENBQUM7QUFFL0IsT0FBTyxLQUFLLEVBQUUsdUJBQXVCLEVBQUUsTUFBTSxhQUFhLENBQUM7QUFDM0QsT0FBTyxFQUNMLEtBQUssMkJBQTJCLEVBQ2hDLEtBQUssb0JBQW9CLEVBQ3pCLEtBQUssZ0JBQWdCLEVBQ3JCLEtBQUssY0FBYyxFQUNuQixRQUFRLEVBQ1IsS0FBSyxtQkFBbUIsRUFDeEIsS0FBSyxtQkFBbUIsRUFDeEIsS0FBSyxtQkFBbUIsRUFDekIsTUFBTSxlQUFlLENBQUM7QUFFdkIsWUFBWSxFQUNWLDJCQUEyQixFQUMzQixvQkFBb0IsRUFDcEIsZ0JBQWdCLEVBQ2hCLGNBQWMsRUFDZCxtQkFBbUIsRUFDbkIsbUJBQW1CLEVBQ25CLG1CQUFtQixFQUNuQix1QkFBdUIsR0FDeEIsQ0FBQztBQUNGLE9BQU8sRUFBRSxVQUFVLEVBQUUsUUFBUSxFQUFFLCtCQUErQixFQUFFLG1CQUFtQixFQUFFLE1BQU0sZUFBZSxDQUFDO0FBRTNHOztHQUVHO0FBQ0gsTUFBTSxXQUFXLG9CQUFvQjtJQUNuQywyRUFBMkU7SUFDM0UsS0FBSyxFQUFFLE9BQU8sQ0FBQztJQUNmLHFEQUFxRDtJQUNyRCxNQUFNLEVBQUUsbUJBQW1CLENBQUM7Q0FDN0I7QUFFRDs7R0FFRztBQUNILE1BQU0sV0FBVyxrQkFBa0I7SUFDakM7OztPQUdHO0lBQ0gsSUFBSSxDQUFDLEVBQUUsSUFBSSxDQUFDO0NBQ2I7QUFFRDs7R0FFRztBQUNILFVBQVUsa0JBQWtCO0lBQzFCLGdDQUFnQztJQUNoQyxJQUFJLEVBQUUsVUFBVSxDQUFDO0lBQ2pCOzs7O09BSUc7SUFDSCxXQUFXLEVBQUUsV0FBVyxHQUFHLGdCQUFnQixDQUFDO0NBQzdDO0FBRUQ7OztHQUdHO0FBQ0gsTUFBTSxXQUFXLDJCQUE0QixTQUFRLGtCQUFrQjtJQUNyRSxnRkFBZ0Y7SUFDaEYsMEJBQTBCLEVBQUUsTUFBTSxDQUFDO0lBQ25DLFFBQVEsRUFBRSxRQUFRLENBQUMsY0FBYyxDQUFDO0NBQ25DO0FBRUQ7OztHQUdHO0FBQ0gsTUFBTSxXQUFXLG1CQUFvQixTQUFRLGtCQUFrQjtJQUM3RCxRQUFRLEVBQUUsUUFBUSxDQUFDLG1CQUFtQixHQUFHLFFBQVEsQ0FBQyxXQUFXLEdBQUcsUUFBUSxDQUFDLHdCQUF3QixDQUFDO0NBQ25HO0FBRUQ7OztHQUdHO0FBQ0gsTUFBTSxXQUFXLGtCQUFrQjtJQUNqQyxJQUFJLEVBQUUsVUFBVSxDQUFDO0lBQ2pCLFFBQVEsRUFBRSxRQUFRLENBQUMsZUFBZSxHQUFHLFFBQVEsQ0FBQyxhQUFhLENBQUM7Q0FDN0Q7QUFFRDs7O0dBR0c7QUFDSCxNQUFNLFdBQVcsNEJBQTRCO0lBQzNDLFFBQVEsRUFBRSxRQUFRLENBQUMsWUFBWSxHQUFHLFFBQVEsQ0FBQyxHQUFHLENBQUM7Q0FDaEQ7QUFFRDs7O0dBR0c7QUFDSCxNQUFNLE1BQU0seUJBQXlCLEdBQUcsMkJBQTJCLEdBQUcsbUJBQW1CLEdBQUcsa0JBQWtCLENBQUM7QUFFL0c7OztHQUdHO0FBQ0gsd0JBQWdCLG9CQUFvQixDQUFDLE9BQU8sRUFBRSxjQUFjLEdBQUcsT0FBTyxJQUFJLHlCQUF5QixDQUVsRztBQUVEOzs7O0dBSUc7QUFDSCx3QkFBZ0IsZ0NBQWdDLENBQUMsT0FBTyxFQUFFLHlCQUF5QixHQUFHLFdBQVcsR0FBRyxnQkFBZ0IsQ0FZbkg7QUFFRDs7Ozs7OztHQU9HO0FBQ0gsTUFBTSxNQUFNLGNBQWMsR0FBRyx5QkFBeUIsR0FBRyw0QkFBNEIsQ0FBQztBQUV0Rjs7Ozs7Ozs7R0FRRztBQUNILE1BQU0sV0FBVywwQkFBMEI7SUFDekM7Ozs7O09BS0c7SUFDSCxzQkFBc0IsQ0FBQyxNQUFNLEVBQUUsb0JBQW9CLEdBQUcsT0FBTyxDQUFDLG9CQUFvQixDQUFDLENBQUM7SUFFcEY7Ozs7O09BS0c7SUFDSCxnQkFBZ0IsQ0FDZCxnQkFBZ0IsRUFBRSxVQUFVLEVBQzVCLElBQUksRUFBRSxVQUFVLEVBQ2hCLFFBQVEsRUFBRSxRQUFRLEVBQ2xCLFNBQVMsRUFBRSxNQUFNLEVBQ2pCLFNBQVMsRUFBRSxNQUFNLEVBQ2pCLDBCQUEwQixFQUFFLE1BQU0sR0FDakMsT0FBTyxDQUFDLE9BQU8sQ0FBQyxDQUFDO0lBRXBCOzs7Ozs7T0FNRztJQUNILFVBQVUsQ0FDUixnQkFBZ0IsRUFBRSxVQUFVLEVBQzVCLElBQUksRUFBRSxVQUFVLEVBQ2hCLFFBQVEsRUFBRSxRQUFRLEVBQ2xCLFNBQVMsRUFBRSxNQUFNLEVBQ2pCLDBCQUEwQixFQUFFLE1BQU0sR0FDakMsT0FBTyxDQUFDLE9BQU8sQ0FBQyxDQUFDO0lBRXBCOzs7T0FHRztJQUNILHFCQUFxQixDQUFDLE1BQU0sRUFBRSxNQUFNLEVBQUUsUUFBUSxFQUFFLE1BQU0sR0FBRyxPQUFPLENBQUMsTUFBTSxDQUFDLENBQUM7SUFFekU7OztPQUdHO0lBQ0gsS0FBSyxJQUFJLE9BQU8sQ0FBQyxJQUFJLENBQUMsQ0FBQztDQUN4QiJ9

package/dest/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,+BAA+B,CAAC;AAEhE,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,IAAI,CAAC;AAE/B,OAAO,KAAK,EAAE,oBAAoB,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AAClF,OAAO,KAAK,EACV,oBAAoB,EACpB,gBAAgB,EAChB,cAAc,EACd,QAAQ,EACR,mBAAmB,EACnB,mBAAmB,EACpB,MAAM,eAAe,CAAC;AAEvB,YAAY,EACV,oBAAoB,EACpB,oBAAoB,EACpB,gBAAgB,EAChB,cAAc,EACd,mBAAmB,EACnB,wBAAwB,EACxB,mBAAmB,GACpB,CAAC;AACF,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAErD;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,2EAA2E;IAC3E,KAAK,EAAE,OAAO,CAAC;IACf,qDAAqD;IACrD,MAAM,EAAE,mBAAmB,CAAC;CAC7B;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC;;;OAGG;IACH,IAAI,CAAC,EAAE,IAAI,CAAC;CACb;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,gCAAgC;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,iCAAiC;IACjC,WAAW,EAAE,MAAM,CAAC;IACpB,mCAAmC;IACnC,QAAQ,EAAE,QAAQ,CAAC;CACpB;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,0BAA0B;IACzC;;;;;OAKG;IACH,sBAAsB,CAAC,MAAM,EAAE,oBAAoB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAEpF;;;;;OAKG;IACH,gBAAgB,CACd,gBAAgB,EAAE,UAAU,EAC5B,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,QAAQ,EAClB,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,OAAO,CAAC,CAAC;IAEpB;;;;;;OAMG;IACH,UAAU,CAAC,gBAAgB,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAEhH;;;OAGG;IACH,qBAAqB,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAC1E"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,KAAK,gBAAgB,EAAE,KAAK,UAAU,EAAE,MAAM,iCAAiC,CAAC;AACtG,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,+BAA+B,CAAC;AAEhE,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,IAAI,CAAC;AAE/B,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AAC3D,OAAO,EACL,KAAK,2BAA2B,EAChC,KAAK,oBAAoB,EACzB,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACnB,QAAQ,EACR,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,EACzB,MAAM,eAAe,CAAC;AAEvB,YAAY,EACV,2BAA2B,EAC3B,oBAAoB,EACpB,gBAAgB,EAChB,cAAc,EACd,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,uBAAuB,GACxB,CAAC;AACF,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,+BAA+B,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AAE3G;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,2EAA2E;IAC3E,KAAK,EAAE,OAAO,CAAC;IACf,qDAAqD;IACrD,MAAM,EAAE,mBAAmB,CAAC;CAC7B;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC;;;OAGG;IACH,IAAI,CAAC,EAAE,IAAI,CAAC;CACb;AAED;;GAEG;AACH,UAAU,kBAAkB;IAC1B,gCAAgC;IAChC,IAAI,EAAE,UAAU,CAAC;IACjB;;;;OAIG;IACH,WAAW,EAAE,WAAW,GAAG,gBAAgB,CAAC;CAC7C;AAED;;;GAGG;AACH,MAAM,WAAW,2BAA4B,SAAQ,kBAAkB;IACrE,gFAAgF;IAChF,0BAA0B,EAAE,MAAM,CAAC;IACnC,QAAQ,EAAE,QAAQ,CAAC,cAAc,CAAC;CACnC;AAED;;;GAGG;AACH,MAAM,WAAW,mBAAoB,SAAQ,kBAAkB;IAC7D,QAAQ,EAAE,QAAQ,CAAC,mBAAmB,GAAG,QAAQ,CAAC,WAAW,GAAG,QAAQ,CAAC,wBAAwB,CAAC;CACnG;AAED;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,UAAU,CAAC;IACjB,QAAQ,EAAE,QAAQ,CAAC,eAAe,GAAG,QAAQ,CAAC,aAAa,CAAC;CAC7D;AAED;;;GAGG;AACH,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,EAAE,QAAQ,CAAC,YAAY,GAAG,QAAQ,CAAC,GAAG,CAAC;CAChD;AAED;;;GAGG;AACH,MAAM,MAAM,yBAAyB,GAAG,2BAA2B,GAAG,mBAAmB,GAAG,kBAAkB,CAAC;AAE/G;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,IAAI,yBAAyB,CAElG;AAED;;;;GAIG;AACH,wBAAgB,gCAAgC,CAAC,OAAO,EAAE,yBAAyB,GAAG,WAAW,GAAG,gBAAgB,CAYnH;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,cAAc,GAAG,yBAAyB,GAAG,4BAA4B,CAAC;AAEtF;;;;;;;;GAQG;AACH,MAAM,WAAW,0BAA0B;IACzC;;;;;OAKG;IACH,sBAAsB,CAAC,MAAM,EAAE,oBAAoB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAEpF;;;;;OAKG;IACH,gBAAgB,CACd,gBAAgB,EAAE,UAAU,EAC5B,IAAI,EAAE,UAAU,EAChB,QAAQ,EAAE,QAAQ,EAClB,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,EACjB,0BAA0B,EAAE,MAAM,GACjC,OAAO,CAAC,OAAO,CAAC,CAAC;IAEpB;;;;;;OAMG;IACH,UAAU,CACR,gBAAgB,EAAE,UAAU,EAC5B,IAAI,EAAE,UAAU,EAChB,QAAQ,EAAE,QAAQ,EAClB,SAAS,EAAE,MAAM,EACjB,0BAA0B,EAAE,MAAM,GACjC,OAAO,CAAC,OAAO,CAAC,CAAC;IAEpB;;;OAGG;IACH,qBAAqB,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAEzE;;;OAGG;IACH,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB"}

package/dest/types.js

@@ -1 +1,21 @@
-export { DutyStatus, DutyType } from './db/types.js';
+import { BlockNumber } from '@aztec/foundation/branded-types';
+import { DutyType } from './db/types.js';
+export { DutyStatus, DutyType, getBlockIndexFromDutyIdentifier, normalizeBlockIndex } from './db/types.js';
+/**
+ * Type guard to check if a SigningContext requires HA protection.
+ * Returns true for contexts that need HA protection, false for AUTH_REQUEST and TXS.
+ */ export function isHAProtectedContext(context) {
+    return context.dutyType !== DutyType.AUTH_REQUEST && context.dutyType !== DutyType.TXS;
+}
+/**
+ * Gets the block number from a signing context.
+ * - Vote duties (GOVERNANCE_VOTE, SLASHING_VOTE): returns BlockNumber(0)
+ * - Other duties: returns the blockNumber from the context
+ */ export function getBlockNumberFromSigningContext(context) {
+    // Check for duty types that have blockNumber
+    if (context.dutyType === DutyType.BLOCK_PROPOSAL || context.dutyType === DutyType.CHECKPOINT_PROPOSAL || context.dutyType === DutyType.ATTESTATION || context.dutyType === DutyType.ATTESTATIONS_AND_SIGNERS) {
+        return context.blockNumber;
+    }
+    // Vote duties (GOVERNANCE_VOTE, SLASHING_VOTE) don't have blockNumber
+    return BlockNumber(0);
+}

package/dest/validator_ha_signer.d.ts

@@ -8,8 +8,8 @@
 import type { Buffer32 } from '@aztec/foundation/buffer';
 import type { EthAddress } from '@aztec/foundation/eth-address';
 import type { Signature } from '@aztec/foundation/eth-signature';
-import type { CreateHASignerConfig } from './config.js';
-import type { SigningContext, SlashingProtectionDatabase } from './types.js';
+import type { ValidatorHASignerConfig } from './config.js';
+import { type HAProtectedSigningContext, type SlashingProtectionDatabase } from './types.js';
 /**
  * Validator High Availability Signer
  *
@@ -33,7 +33,7 @@ export declare class ValidatorHASigner {
     private readonly config;
     private readonly log;
     private readonly slashingProtection;
-    constructor(db: SlashingProtectionDatabase, config: CreateHASignerConfig);
+    constructor(db: SlashingProtectionDatabase, config: ValidatorHASignerConfig);
     /**
      * Sign a message with slashing protection.
      *
@@ -44,18 +44,14 @@ export declare class ValidatorHASigner {
      *
      * @param validatorAddress - The validator's Ethereum address
      * @param messageHash - The hash to be signed
-     * @param context - The signing context (slot, block number, duty type)
+     * @param context - The signing context (HA-protected duty types only)
      * @param signFn - Function that performs the actual signing
      * @returns The signature
      *
      * @throws DutyAlreadySignedError if the duty was already signed (expected in HA)
      * @throws SlashingProtectionError if attempting to sign different data for same slot (expected in HA)
      */
-    signWithProtection(validatorAddress: EthAddress, messageHash: Buffer32, context: SigningContext, signFn: (messageHash: Buffer32) => Promise<Signature>): Promise<Signature>;
-    /**
-     * Check if slashing protection is enabled
-     */
-    get isEnabled(): boolean;
+    signWithProtection(validatorAddress: EthAddress, messageHash: Buffer32, context: HAProtectedSigningContext, signFn: (messageHash: Buffer32) => Promise<Signature>): Promise<Signature>;
     /**
      * Get the node ID for this signer
      */
@@ -66,9 +62,9 @@ export declare class ValidatorHASigner {
      */
     start(): void;
     /**
-     * Stop the HA signer background tasks.
+     * Stop the HA signer background tasks and close database connection.
      * Should be called during graceful shutdown.
      */
     stop(): Promise<void>;
 }
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoidmFsaWRhdG9yX2hhX3NpZ25lci5kLnRzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vc3JjL3ZhbGlkYXRvcl9oYV9zaWduZXIudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUE7Ozs7OztHQU1HO0FBQ0gsT0FBTyxLQUFLLEVBQUUsUUFBUSxFQUFFLE1BQU0sMEJBQTBCLENBQUM7QUFDekQsT0FBTyxLQUFLLEVBQUUsVUFBVSxFQUFFLE1BQU0sK0JBQStCLENBQUM7QUFDaEUsT0FBTyxLQUFLLEVBQUUsU0FBUyxFQUFFLE1BQU0saUNBQWlDLENBQUM7QUFHakUsT0FBTyxLQUFLLEVBQUUsb0JBQW9CLEVBQUUsTUFBTSxhQUFhLENBQUM7QUFFeEQsT0FBTyxLQUFLLEVBQUUsY0FBYyxFQUFFLDBCQUEwQixFQUFFLE1BQU0sWUFBWSxDQUFDO0FBRTdFOzs7Ozs7Ozs7Ozs7Ozs7Ozs7R0FrQkc7QUFDSCxxQkFBYSxpQkFBaUI7SUFNMUIsT0FBTyxDQUFDLFFBQVEsQ0FBQyxNQUFNO0lBTHpCLE9BQU8sQ0FBQyxRQUFRLENBQUMsR0FBRyxDQUFTO0lBQzdCLE9BQU8sQ0FBQyxRQUFRLENBQUMsa0JBQWtCLENBQXdDO0lBRTNFLFlBQ0UsRUFBRSxFQUFFLDBCQUEwQixFQUNiLE1BQU0sRUFBRSxvQkFBb0IsRUFnQjlDO0lBRUQ7Ozs7Ozs7Ozs7Ozs7Ozs7T0FnQkc7SUFDRyxrQkFBa0IsQ0FDdEIsZ0JBQWdCLEVBQUUsVUFBVSxFQUM1QixXQUFXLEVBQUUsUUFBUSxFQUNyQixPQUFPLEVBQUUsY0FBYyxFQUN2QixNQUFNLEVBQUUsQ0FBQyxXQUFXLEVBQUUsUUFBUSxLQUFLLE9BQU8sQ0FBQyxTQUFTLENBQUMsR0FDcEQsT0FBTyxDQUFDLFNBQVMsQ0FBQyxDQW1EcEI7SUFFRDs7T0FFRztJQUNILElBQUksU0FBUyxJQUFJLE9BQU8sQ0FFdkI7SUFFRDs7T0FFRztJQUNILElBQUksTUFBTSxJQUFJLE1BQU0sQ0FFbkI7SUFFRDs7O09BR0c7SUFDSCxLQUFLLFNBRUo7SUFFRDs7O09BR0c7SUFDRyxJQUFJLGtCQUVUO0NBQ0YifQ==
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoidmFsaWRhdG9yX2hhX3NpZ25lci5kLnRzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vc3JjL3ZhbGlkYXRvcl9oYV9zaWduZXIudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUE7Ozs7OztHQU1HO0FBQ0gsT0FBTyxLQUFLLEVBQUUsUUFBUSxFQUFFLE1BQU0sMEJBQTBCLENBQUM7QUFDekQsT0FBTyxLQUFLLEVBQUUsVUFBVSxFQUFFLE1BQU0sK0JBQStCLENBQUM7QUFDaEUsT0FBTyxLQUFLLEVBQUUsU0FBUyxFQUFFLE1BQU0saUNBQWlDLENBQUM7QUFHakUsT0FBTyxLQUFLLEVBQUUsdUJBQXVCLEVBQUUsTUFBTSxhQUFhLENBQUM7QUFHM0QsT0FBTyxFQUNMLEtBQUsseUJBQXlCLEVBQzlCLEtBQUssMEJBQTBCLEVBRWhDLE1BQU0sWUFBWSxDQUFDO0FBRXBCOzs7Ozs7Ozs7Ozs7Ozs7Ozs7R0FrQkc7QUFDSCxxQkFBYSxpQkFBaUI7SUFNMUIsT0FBTyxDQUFDLFFBQVEsQ0FBQyxNQUFNO0lBTHpCLE9BQU8sQ0FBQyxRQUFRLENBQUMsR0FBRyxDQUFTO0lBQzdCLE9BQU8sQ0FBQyxRQUFRLENBQUMsa0JBQWtCLENBQTRCO0lBRS9ELFlBQ0UsRUFBRSxFQUFFLDBCQUEwQixFQUNiLE1BQU0sRUFBRSx1QkFBdUIsRUFnQmpEO0lBRUQ7Ozs7Ozs7Ozs7Ozs7Ozs7T0FnQkc7SUFDRyxrQkFBa0IsQ0FDdEIsZ0JBQWdCLEVBQUUsVUFBVSxFQUM1QixXQUFXLEVBQUUsUUFBUSxFQUNyQixPQUFPLEVBQUUseUJBQXlCLEVBQ2xDLE1BQU0sRUFBRSxDQUFDLFdBQVcsRUFBRSxRQUFRLEtBQUssT0FBTyxDQUFDLFNBQVMsQ0FBQyxHQUNwRCxPQUFPLENBQUMsU0FBUyxDQUFDLENBNkNwQjtJQUVEOztPQUVHO0lBQ0gsSUFBSSxNQUFNLElBQUksTUFBTSxDQUVuQjtJQUVEOzs7T0FHRztJQUNILEtBQUssU0FFSjtJQUVEOzs7T0FHRztJQUNHLElBQUksa0JBR1Q7Q0FDRiJ9

package/dest/validator_ha_signer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validator_ha_signer.d.ts","sourceRoot":"","sources":["../src/validator_ha_signer.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AACzD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,+BAA+B,CAAC;AAChE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iCAAiC,CAAC;AAGjE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAExD,OAAO,KAAK,EAAE,cAAc,EAAE,0BAA0B,EAAE,MAAM,YAAY,CAAC;AAE7E;;;;;;;;;;;;;;;;;;GAkBG;AACH,qBAAa,iBAAiB;IAM1B,OAAO,CAAC,QAAQ,CAAC,MAAM;IALzB,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAS;IAC7B,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAwC;IAE3E,YACE,EAAE,EAAE,0BAA0B,EACb,MAAM,EAAE,oBAAoB,EAgB9C;IAED;;;;;;;;;;;;;;;;OAgBG;IACG,kBAAkB,CACtB,gBAAgB,EAAE,UAAU,EAC5B,WAAW,EAAE,QAAQ,EACrB,OAAO,EAAE,cAAc,EACvB,MAAM,EAAE,CAAC,WAAW,EAAE,QAAQ,KAAK,OAAO,CAAC,SAAS,CAAC,GACpD,OAAO,CAAC,SAAS,CAAC,CAmDpB;IAED;;OAEG;IACH,IAAI,SAAS,IAAI,OAAO,CAEvB;IAED;;OAEG;IACH,IAAI,MAAM,IAAI,MAAM,CAEnB;IAED;;;OAGG;IACH,KAAK,SAEJ;IAED;;;OAGG;IACG,IAAI,kBAET;CACF"}
+{"version":3,"file":"validator_ha_signer.d.ts","sourceRoot":"","sources":["../src/validator_ha_signer.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AACzD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,+BAA+B,CAAC;AAChE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iCAAiC,CAAC;AAGjE,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AAG3D,OAAO,EACL,KAAK,yBAAyB,EAC9B,KAAK,0BAA0B,EAEhC,MAAM,YAAY,CAAC;AAEpB;;;;;;;;;;;;;;;;;;GAkBG;AACH,qBAAa,iBAAiB;IAM1B,OAAO,CAAC,QAAQ,CAAC,MAAM;IALzB,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAS;IAC7B,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAA4B;IAE/D,YACE,EAAE,EAAE,0BAA0B,EACb,MAAM,EAAE,uBAAuB,EAgBjD;IAED;;;;;;;;;;;;;;;;OAgBG;IACG,kBAAkB,CACtB,gBAAgB,EAAE,UAAU,EAC5B,WAAW,EAAE,QAAQ,EACrB,OAAO,EAAE,yBAAyB,EAClC,MAAM,EAAE,CAAC,WAAW,EAAE,QAAQ,KAAK,OAAO,CAAC,SAAS,CAAC,GACpD,OAAO,CAAC,SAAS,CAAC,CA6CpB;IAED;;OAEG;IACH,IAAI,MAAM,IAAI,MAAM,CAEnB;IAED;;;OAGG;IACH,KAAK,SAEJ;IAED;;;OAGG;IACG,IAAI,kBAGT;CACF"}

package/dest/validator_ha_signer.js

@@ -5,7 +5,9 @@
  * This ensures that even with multiple validator nodes running, only one
  * node will sign for a given duty (slot + duty type).
  */ import { createLogger } from '@aztec/foundation/log';
+import { DutyType } from './db/types.js';
 import { SlashingProtectionService } from './slashing_protection_service.js';
+import { getBlockNumberFromSigningContext } from './types.js';
 /**
  * Validator High Availability Signer
  *
@@ -31,7 +33,7 @@ import { SlashingProtectionService } from './slashing_protection_service.js';
     constructor(db, config){
         this.config = config;
         this.log = createLogger('validator-ha-signer');
-        if (!config.enabled) {
+        if (!config.haSigningEnabled) {
             // this shouldn't happen, the validator should use different signer for non-HA setups
             throw new Error('Validator HA Signer is not enabled in config');
         }
@@ -53,31 +55,33 @@ import { SlashingProtectionService } from './slashing_protection_service.js';
    *
    * @param validatorAddress - The validator's Ethereum address
    * @param messageHash - The hash to be signed
-   * @param context - The signing context (slot, block number, duty type)
+   * @param context - The signing context (HA-protected duty types only)
    * @param signFn - Function that performs the actual signing
    * @returns The signature
    *
    * @throws DutyAlreadySignedError if the duty was already signed (expected in HA)
    * @throws SlashingProtectionError if attempting to sign different data for same slot (expected in HA)
    */ async signWithProtection(validatorAddress, messageHash, context, signFn) {
-        // If slashing protection is disabled, just sign directly
-        if (!this.slashingProtection) {
-            this.log.info('Signing without slashing protection enabled', {
-                validatorAddress: validatorAddress.toString(),
-                nodeId: this.config.nodeId,
-                dutyType: context.dutyType,
+        let dutyIdentifier;
+        if (context.dutyType === DutyType.BLOCK_PROPOSAL) {
+            dutyIdentifier = {
+                validatorAddress,
                 slot: context.slot,
-                blockNumber: context.blockNumber
-            });
-            return await signFn(messageHash);
+                blockIndexWithinCheckpoint: context.blockIndexWithinCheckpoint,
+                dutyType: context.dutyType
+            };
+        } else {
+            dutyIdentifier = {
+                validatorAddress,
+                slot: context.slot,
+                dutyType: context.dutyType
+            };
         }
-        const { slot, blockNumber, dutyType } = context;
         // Acquire lock and get the token for ownership verification
+        const blockNumber = getBlockNumberFromSigningContext(context);
         const lockToken = await this.slashingProtection.checkAndRecord({
-            validatorAddress,
-            slot,
+            ...dutyIdentifier,
             blockNumber,
-            dutyType,
             messageHash: messageHash.toString(),
             nodeId: this.config.nodeId
         });
@@ -88,18 +92,14 @@ import { SlashingProtectionService } from './slashing_protection_service.js';
         } catch (error) {
             // Delete duty to allow retry (only succeeds if we own the lock)
             await this.slashingProtection.deleteDuty({
-                validatorAddress,
-                slot,
-                dutyType,
+                ...dutyIdentifier,
                 lockToken
             });
             throw error;
         }
         // Record success (only succeeds if we own the lock)
         await this.slashingProtection.recordSuccess({
-            validatorAddress,
-            slot,
-            dutyType,
+            ...dutyIdentifier,
             signature,
             nodeId: this.config.nodeId,
             lockToken
@@ -107,11 +107,6 @@ import { SlashingProtectionService } from './slashing_protection_service.js';
         return signature;
     }
     /**
-   * Check if slashing protection is enabled
-   */ get isEnabled() {
-        return this.slashingProtection !== undefined;
-    }
-    /**
    * Get the node ID for this signer
    */ get nodeId() {
         return this.config.nodeId;
@@ -120,12 +115,13 @@ import { SlashingProtectionService } from './slashing_protection_service.js';
    * Start the HA signer background tasks (cleanup of stuck duties).
    * Should be called after construction and before signing operations.
    */ start() {
-        this.slashingProtection?.start();
+        this.slashingProtection.start();
     }
     /**
-   * Stop the HA signer background tasks.
+   * Stop the HA signer background tasks and close database connection.
    * Should be called during graceful shutdown.
    */ async stop() {
-        await this.slashingProtection?.stop();
+        await this.slashingProtection.stop();
+        await this.slashingProtection.close();
     }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aztec/validator-ha-signer",
-  "version": "4.0.0-nightly.20260116",
+  "version": "4.0.0-nightly.20260117",
   "type": "module",
   "exports": {
     "./config": "./dest/config.js",
@@ -10,7 +10,8 @@
     "./migrations": "./dest/migrations.js",
     "./slashing-protection-service": "./dest/slashing_protection_service.js",
     "./types": "./dest/types.js",
-    "./validator-ha-signer": "./dest/validator_ha_signer.js"
+    "./validator-ha-signer": "./dest/validator_ha_signer.js",
+    "./test": "./dest/test/pglite_pool.js"
   },
   "typedocOptions": {
     "entryPoints": [
@@ -73,11 +74,11 @@
     ]
   },
   "dependencies": {
-    "@aztec/foundation": "4.0.0-nightly.20260116",
-    "@aztec/node-keystore": "4.0.0-nightly.20260116",
+    "@aztec/foundation": "4.0.0-nightly.20260117",
     "node-pg-migrate": "^8.0.4",
     "pg": "^8.11.3",
-    "tslib": "^2.4.0"
+    "tslib": "^2.4.0",
+    "zod": "^3.23.8"
   },
   "devDependencies": {
     "@electric-sql/pglite": "^0.3.14",

package/src/config.ts

@@ -4,66 +4,34 @@ import {
   getConfigFromMappings,
   getDefaultConfig,
   numberConfigHelper,
+  optionalNumberConfigHelper,
 } from '@aztec/foundation/config';
+import type { ZodFor } from '@aztec/foundation/schemas';
+
+import { z } from 'zod';
 
 /**
- * Configuration for the slashing protection service
+ * Configuration for the Validator HA Signer
+ *
+ * This config is used for distributed locking and slashing protection
+ * when running multiple validator nodes in a high-availability setup.
  */
-export interface SlashingProtectionConfig {
-  /** Whether slashing protection is enabled */
-  enabled: boolean;
+export interface ValidatorHASignerConfig {
+  /** Whether HA signing / slashing protection is enabled */
+  haSigningEnabled: boolean;
   /** Unique identifier for this node */
   nodeId: string;
   /** How long to wait between polls when a duty is being signed (ms) */
   pollingIntervalMs: number;
   /** Maximum time to wait for a duty being signed to complete (ms) */
   signingTimeoutMs: number;
-  /** Maximum age of a stuck duty in ms */
-  maxStuckDutiesAgeMs: number;
-}
-
-export const slashingProtectionConfigMappings: ConfigMappingsType<SlashingProtectionConfig> = {
-  enabled: {
-    env: 'SLASHING_PROTECTION_ENABLED',
-    description: 'Whether slashing protection is enabled',
-    ...booleanConfigHelper(true),
-  },
-  nodeId: {
-    env: 'SLASHING_PROTECTION_NODE_ID',
-    description: 'The unique identifier for this node',
-    defaultValue: '',
-  },
-  pollingIntervalMs: {
-    env: 'SLASHING_PROTECTION_POLLING_INTERVAL_MS',
-    description: 'The number of ms to wait between polls when a duty is being signed',
-    ...numberConfigHelper(100),
-  },
-  signingTimeoutMs: {
-    env: 'SLASHING_PROTECTION_SIGNING_TIMEOUT_MS',
-    description: 'The maximum time to wait for a duty being signed to complete',
-    ...numberConfigHelper(3_000),
-  },
-  maxStuckDutiesAgeMs: {
-    env: 'SLASHING_PROTECTION_MAX_STUCK_DUTIES_AGE_MS',
-    description: 'The maximum age of a stuck duty in ms',
-    // hard-coding at current 2 slot duration. This should be set by the validator on init
-    ...numberConfigHelper(72_000),
-  },
-};
-
-export const defaultSlashingProtectionConfig: SlashingProtectionConfig = getDefaultConfig(
-  slashingProtectionConfigMappings,
-);
-
-/**
- * Configuration for creating an HA signer with PostgreSQL backend
- */
-export interface CreateHASignerConfig extends SlashingProtectionConfig {
+  /** Maximum age of a stuck duty in ms (defaults to 2x hardcoded Aztec slot duration if not set) */
+  maxStuckDutiesAgeMs?: number;
   /**
    * PostgreSQL connection string
    * Format: postgresql://user:password@host:port/database
    */
-  databaseUrl: string;
+  databaseUrl?: string;
   /**
    * PostgreSQL connection pool configuration
    */
@@ -77,8 +45,32 @@ export interface CreateHASignerConfig extends SlashingProtectionConfig {
   poolConnectionTimeoutMs?: number;
 }
 
-export const createHASignerConfigMappings: ConfigMappingsType<CreateHASignerConfig> = {
-  ...slashingProtectionConfigMappings,
+export const validatorHASignerConfigMappings: ConfigMappingsType<ValidatorHASignerConfig> = {
+  haSigningEnabled: {
+    env: 'VALIDATOR_HA_SIGNING_ENABLED',
+    description: 'Whether HA signing / slashing protection is enabled',
+    ...booleanConfigHelper(false),
+  },
+  nodeId: {
+    env: 'VALIDATOR_HA_NODE_ID',
+    description: 'The unique identifier for this node',
+    defaultValue: '',
+  },
+  pollingIntervalMs: {
+    env: 'VALIDATOR_HA_POLLING_INTERVAL_MS',
+    description: 'The number of ms to wait between polls when a duty is being signed',
+    ...numberConfigHelper(100),
+  },
+  signingTimeoutMs: {
+    env: 'VALIDATOR_HA_SIGNING_TIMEOUT_MS',
+    description: 'The maximum time to wait for a duty being signed to complete',
+    ...numberConfigHelper(3_000),
+  },
+  maxStuckDutiesAgeMs: {
+    env: 'VALIDATOR_HA_MAX_STUCK_DUTIES_AGE_MS',
+    description: 'The maximum age of a stuck duty in ms (defaults to 2x Aztec slot duration)',
+    ...optionalNumberConfigHelper(),
+  },
   databaseUrl: {
     env: 'VALIDATOR_HA_DATABASE_URL',
     description:
@@ -106,11 +98,28 @@ export const createHASignerConfigMappings: ConfigMappingsType<CreateHASignerConf
   },
 };
 
+export const defaultValidatorHASignerConfig: ValidatorHASignerConfig = getDefaultConfig(
+  validatorHASignerConfigMappings,
+);
+
 /**
  * Returns the validator HA signer configuration from environment variables.
  * Note: If an environment variable is not set, the default value is used.
  * @returns The validator HA signer configuration.
  */
-export function getConfigEnvVars(): CreateHASignerConfig {
-  return getConfigFromMappings<CreateHASignerConfig>(createHASignerConfigMappings);
+export function getConfigEnvVars(): ValidatorHASignerConfig {
+  return getConfigFromMappings<ValidatorHASignerConfig>(validatorHASignerConfigMappings);
 }
+
+export const ValidatorHASignerConfigSchema = z.object({
+  haSigningEnabled: z.boolean(),
+  nodeId: z.string(),
+  pollingIntervalMs: z.number().min(0),
+  signingTimeoutMs: z.number().min(0),
+  maxStuckDutiesAgeMs: z.number().min(0).optional(),
+  databaseUrl: z.string().optional(),
+  poolMaxCount: z.number().min(0).optional(),
+  poolMinCount: z.number().min(0).optional(),
+  poolIdleTimeoutMs: z.number().min(0).optional(),
+  poolConnectionTimeoutMs: z.number().min(0).optional(),
+}) satisfies ZodFor<ValidatorHASignerConfig>;