@aztec/p2p 0.0.1-commit.2f68f620 → 0.0.1-commit.3100065

package/src/services/peer-manager/peer_scoring.ts

@@ -57,6 +57,9 @@ const MIN_SCORE_BEFORE_BAN = -100;
 const MIN_SCORE_BEFORE_DISCONNECT = -50;
 const SCORE_CLEANUP_THRESHOLD = 0.1;
 
+/** An active ban: the score the peer held when banned, and the timestamp at which the ban lifts. */
+type BanRecord = { score: number; expiry: number };
+
 export class PeerScoring {
   private logger = createLogger('p2p:peer-scoring');
   private scores: Map<string, number> = new Map();
@@ -67,11 +70,21 @@ export class PeerScoring {
 
   private peerStateCounter: UpDownCounter;
 
+  /** Active bans, keyed by peer id. Held in memory only, so they are cleared on restart. */
+  private bannedPeers: Map<string, BanRecord> = new Map();
+  /**
+   * How long a peer remains banned once its score crosses MIN_SCORE_BEFORE_BAN. While banned, the
+   * peer's ban score is returned by getScore regardless of decay, so it cannot recover its way out
+   * of the ban early. After the ban expires the live (decayed) score takes over again.
+   */
+  private readonly banDurationMs: number;
+
   constructor(
     config: P2PConfig,
     telemetry: TelemetryClient = getTelemetryClient(),
     private readonly dateProvider: DateProvider = new DateProvider(),
   ) {
+    this.banDurationMs = config.peerBanDurationSeconds * 1000;
     const orderedValues = config.peerPenaltyValues?.sort((a, b) => a - b);
     this.peerPenalties = {
       [PeerErrorSeverity.HighToleranceError]:
@@ -113,9 +126,31 @@ export class PeerScoring {
 
     this.scores.set(peerId, currentScore);
     this.lastUpdateTime.set(peerId, currentTime);
+
+    this.maybeBanPeer(peerId, currentScore);
+
     return currentScore;
   }
 
+  /**
+   * Records a ban for a peer whose score has crossed the ban threshold, with an expiry banDurationMs
+   * in the future. No-op if the score is above the threshold or the peer is already serving an active
+   * ban (an existing ban is not extended; the original window stands). A previously expired ban does
+   * not block a fresh one — getActiveBanScore prunes it first.
+   */
+  private maybeBanPeer(peerId: string, score: number): void {
+    if (score >= MIN_SCORE_BEFORE_BAN || this.getActiveBanScore(peerId) !== undefined) {
+      return;
+    }
+    const record: BanRecord = { score, expiry: this.dateProvider.now() + this.banDurationMs };
+    this.bannedPeers.set(peerId, record);
+    this.logger.verbose(`Banning peer ${peerId} until ${new Date(record.expiry).toISOString()}`, {
+      peerId,
+      score,
+      expiry: record.expiry,
+    });
+  }
+
   decayAllScores(): void {
     const currentTime = this.dateProvider.now();
     for (const [peerId, lastUpdate] of this.lastUpdateTime.entries()) {
@@ -135,10 +170,24 @@ export class PeerScoring {
     }
   }
 
+  /**
+   * Removes bans whose window has elapsed. Expired bans are otherwise only pruned lazily when their
+   * peer's score is next queried, so a banned peer that disconnects and is never queried again would
+   * linger in the map. Called periodically (per heartbeat) to bound the ban map's size.
+   */
+  pruneExpiredBans(): void {
+    const now = this.dateProvider.now();
+    const expired = [...this.bannedPeers.entries()].filter(([, ban]) => ban.expiry <= now).map(([peerId]) => peerId);
+    for (const peerId of expired) {
+      this.bannedPeers.delete(peerId);
+    }
+  }
+
   /** Resets all peer scores. Useful for benchmarks to prevent cross-case contamination. */
   resetAllScores(): void {
     this.scores.clear();
     this.lastUpdateTime.clear();
+    this.bannedPeers.clear();
   }
 
   removePeer(peerId: string): void {
@@ -146,12 +195,33 @@ export class PeerScoring {
     this.lastUpdateTime.delete(peerId);
   }
 
+  /**
+   * The single source of truth for whether a peer is banned. Returns the ban score while the ban is
+   * active, or undefined if the peer is not banned. A ban that has expired is lazily lifted before
+   * returning undefined, so callers never see a stale ban.
+   */
+  private getActiveBanScore(peerId: string): number | undefined {
+    const ban = this.bannedPeers.get(peerId);
+    if (ban === undefined) {
+      return undefined;
+    }
+    if (ban.expiry > this.dateProvider.now()) {
+      return ban.score;
+    }
+    // Ban expired: lift it so the peer can recover.
+    this.bannedPeers.delete(peerId);
+    return undefined;
+  }
+
   getScore(peerId: string): number {
-    return this.scores.get(peerId) || 0;
+    // While a ban is active its ban score is returned regardless of how the live score has decayed,
+    // so the peer stays banned for the full duration.
+    return this.getActiveBanScore(peerId) ?? this.scores.get(peerId) ?? 0;
   }
 
   public getScoreState(peerId: string): PeerScoreState {
-    // TODO(#11329): permanently store banned peers?
+    // A banned peer stays banned for the full ban duration regardless of score decay (see getScore /
+    // maybeBanPeer), rather than silently recovering once its decayed score is cleaned up.
     const score = this.getScore(peerId);
     if (score < MIN_SCORE_BEFORE_BAN) {
       return PeerScoreState.Banned;
@@ -165,7 +235,9 @@ export class PeerScoring {
   getStats(): { medianScore: number; healthyCount: number; disconnectCount: number; bannedCount: number } {
     const stateCounts = { healthy: 0, disconnect: 0, banned: 0 };
 
-    for (const peerId of this.scores.keys()) {
+    // Include banned peers whose live score may have been decayed away but whose ban is still active.
+    const peerIds = new Set([...this.scores.keys(), ...this.bannedPeers.keys()]);
+    for (const peerId of peerIds) {
       const state = this.getScoreState(peerId);
       switch (state) {
         case PeerScoreState.Healthy:

package/src/services/reqresp/README.md

@@ -14,9 +14,8 @@ Applied before the protocol handler runs.
 | STATUS | 5/s | 10/s | same |
 | AUTH | 5/s | 10/s | same |
 | GOODBYE | 5/s | 10/s | same |
-| BLOCK | 2/s | 5/s | same |
 | BLOCK_TXS | 10/s | 200/s | same |
-| TX | (see rate limits file) | (see rate limits file) | same |
+| TX | 10/s | 200/s | same |
 
 - Per-peer limit exceeded: `HighToleranceError` penalty + `RATE_LIMIT_EXCEEDED` status. Penalty fires inside `RequestResponseRateLimiter.allow()`, not the stream handler.
 - Global limit exceeded: `RATE_LIMIT_EXCEEDED` status only (no peer penalty).
@@ -149,26 +148,6 @@ Protected peers (private/trusted/preferred) are always considered "authenticated
 
 ## Block Data Protocols
 
-### BLOCK Protocol (`/aztec/req/block/1.0.0`)
-
-**Server side**:
-
-| Rule | Consequence | File |
-|------|-------------|------|
-| Request must parse as `Fr` | `BADLY_FORMED_REQUEST` + LowToleranceError | `protocols/block.ts` |
-| Block lookup throws | `INTERNAL_ERROR` status | same |
-| Block not found | SUCCESS + empty buffer (design choice; no `NOT_FOUND` status used) | same |
-
-**Requester side** (Snappy limit: 3 MB):
-
-| Rule | Consequence | File |
-|------|-------------|------|
-| Response block number must match requested | LowToleranceError; rejected | `libp2p_service.ts` (`validateRequestedBlock`) |
-| Local block must exist for hash verification | Rejected (no penalty) | same |
-| Response block hash must equal local block hash | MidToleranceError; rejected | same |
-
-**Limitation**: the local-block requirement means BLOCK req/resp is unusable for initial P2P-only sync (before L1 sync provides local copies for verification). A TODO in the code acknowledges this.
-
 ### BLOCK_TXS Protocol (`/aztec/req/block_txs/1.0.0`)
 
 **Server side**:
@@ -178,7 +157,7 @@ Protected peers (private/trusted/preferred) are always considered "authenticated
 | Request must parse as `BlockTxsRequest` (Fr + TxHashArray + BitVector) | `BADLY_FORMED_REQUEST` + LowToleranceError | `protocols/block_txs/block_txs_handler.ts` |
 | BitVector length: non-negative and <= `MAX_TXS_PER_BLOCK` (65536) | Deserialization throws -> `BADLY_FORMED_REQUEST` | `protocols/block_txs/bitvector.ts` |
 | Archive root not found and no explicit txHashes | `NOT_FOUND` status | handler |
-| Internal error during lookup | Unhandled exception -> stream abort (no `INTERNAL_ERROR` status, unlike BLOCK) | handler |
+| Internal error during lookup | Unhandled exception -> stream abort (no `INTERNAL_ERROR` status) | handler |
 
 Conditional registration: BLOCK_TXS handler only registered when `config.disableTransactions` is false. Otherwise peers get `ERR_UNSUPPORTED_PROTOCOL`.
 

package/src/services/reqresp/config.ts

@@ -5,6 +5,23 @@ export const DEFAULT_OVERALL_REQUEST_TIMEOUT_MS = 10_000; // Not currently used
 export const DEFAULT_REQRESP_DIAL_TIMEOUT_MS = 5_000;
 export const DEFAULT_OPTIMISTIC_NEGOTIATION = false;
 
+/**
+ * Max size of a yamux frame, header included. This is the library default, pinned explicitly when configuring the
+ * muxer in the libp2p service so a dependency upgrade cannot silently change it.
+ */
+export const YAMUX_MAX_MESSAGE_SIZE_BYTES = 64 * 1024;
+
+/** Size of a yamux data frame header. */
+const YAMUX_HEADER_LENGTH_BYTES = 12;
+
+/**
+ * Max size of a reqresp request payload. A request must fit in a single muxer frame: the responder never reassembles
+ * a request from multiple chunks (see `ReqResp.processStream`), and yamux splits writes larger than one frame into
+ * multiple frames, each of which arrives as a separate chunk. mplex only splits at 1 MiB, so yamux is the binding
+ * constraint.
+ */
+export const MAX_REQRESP_REQUEST_SIZE_BYTES = YAMUX_MAX_MESSAGE_SIZE_BYTES - YAMUX_HEADER_LENGTH_BYTES;
+
 // For use in tests.
 export const DEFAULT_P2P_REQRESP_CONFIG: P2PReqRespConfig = {
   overallRequestTimeoutMs: DEFAULT_OVERALL_REQUEST_TIMEOUT_MS,

package/src/services/reqresp/rate-limiter/rate_limits.ts

@@ -9,7 +9,7 @@ export const DEFAULT_RATE_LIMITS: ReqRespSubProtocolRateLimits = {
     },
     globalLimit: {
       quotaTimeMs: 1000,
-      quotaCount: 10,
+      quotaCount: 50,
     },
   },
   [ReqRespSubProtocol.STATUS]: {
@@ -19,7 +19,7 @@ export const DEFAULT_RATE_LIMITS: ReqRespSubProtocolRateLimits = {
     },
     globalLimit: {
       quotaTimeMs: 1000,
-      quotaCount: 10,
+      quotaCount: 50,
     },
   },
   [ReqRespSubProtocol.AUTH]: {
@@ -49,7 +49,7 @@ export const DEFAULT_RATE_LIMITS: ReqRespSubProtocolRateLimits = {
     },
     globalLimit: {
       quotaTimeMs: 1000,
-      quotaCount: 10,
+      quotaCount: 50,
     },
   },
   [ReqRespSubProtocol.BLOCK_TXS]: {

package/src/services/reqresp/reqresp.ts

@@ -10,12 +10,18 @@ import type { Libp2p } from 'libp2p';
 import { pipeline } from 'node:stream/promises';
 import type { Uint8ArrayList } from 'uint8arraylist';
 
-import { IndividualReqRespTimeoutError } from '../../errors/reqresp.error.js';
-import { OversizedSnappyResponseError, SnappyTransform } from '../encoding.js';
+import { IndividualReqRespTimeoutError, OversizedReqRespRequestError } from '../../errors/reqresp.error.js';
+import {
+  DEFAULT_MAX_RESPONSE_SIZE_KB,
+  OversizedSnappyResponseError,
+  ResponseSizeLimitExceededError,
+  SnappyTransform,
+} from '../encoding.js';
 import type { PeerScoring } from '../peer-manager/peer_scoring.js';
 import {
   DEFAULT_INDIVIDUAL_REQUEST_TIMEOUT_MS,
   DEFAULT_REQRESP_DIAL_TIMEOUT_MS,
+  MAX_REQRESP_REQUEST_SIZE_BYTES,
   type P2PReqRespConfig,
 } from './config.js';
 import { ConnectionSampler, RandomSampler } from './connection-sampler/connection_sampler.js';
@@ -207,6 +213,11 @@ export class ReqResp implements ReqRespInterface {
     payload: Buffer,
     dialTimeout: number = this.dialTimeoutMs,
   ): Promise<ReqRespResponse> {
+    // Thrown before the try block so the generic error handling below does not penalize the peer for our own bug.
+    if (payload.length > MAX_REQRESP_REQUEST_SIZE_BYTES) {
+      throw new OversizedReqRespRequestError(subProtocol, payload.length, MAX_REQRESP_REQUEST_SIZE_BYTES);
+    }
+
     let stream: Stream | undefined;
     try {
       this.metrics.recordRequestSent(subProtocol);
@@ -291,6 +302,14 @@ export class ReqResp implements ReqRespInterface {
    * - The first chunk should contain a control byte, indicating the status of the response see `ReqRespStatus`
    * - The second chunk should contain the response data
    *
+   * To bound memory usage we abort reception as soon as the accumulated compressed bytes exceed a
+   * bound derived from `maxSizeKb`, before the full stream has been buffered. Without this a peer we
+   * dialed could stream data up to the request timeout, forcing us to buffer arbitrarily much (the
+   * `maxSizeKb` guard in `inboundTransformData` only runs after the whole compressed payload is
+   * concatenated, so it does nothing to cap reception memory). Snappy can expand incompressible input
+   * to ~1.17x its size, so we allow 2x `maxSizeKb`: comfortably above the worst-case expansion of a
+   * legitimate max-size response, while still capping buffered memory at twice the permitted size.
+   *
    * @param source - The async iterable source of data chunks
    * @param maxSizeKb - Optional maximum expected size in KB for the decompressed response
    */
@@ -298,10 +317,20 @@ export class ReqResp implements ReqRespInterface {
     let status: ReqRespStatus | undefined;
     const chunks: Uint8Array[] = [];
 
+    const maxAccumulatedBytes = (maxSizeKb ?? DEFAULT_MAX_RESPONSE_SIZE_KB) * 1024 * 2;
+    let accumulatedBytes = 0;
+
     try {
       for await (const chunk of source) {
         const statusParsed = status !== undefined;
         if (statusParsed) {
+          // Use `byteLength` (the logical length) rather than `chunk.subarray().length`: calling
+          // `subarray()` on a `Uint8ArrayList` consolidates its backing buffers into a single copy,
+          // which would materialize the very chunk we are trying to reject.
+          accumulatedBytes += chunk.byteLength;
+          if (accumulatedBytes > maxAccumulatedBytes) {
+            throw new ResponseSizeLimitExceededError(accumulatedBytes, maxAccumulatedBytes);
+          }
           chunks.push(chunk.subarray());
           continue;
         }
@@ -440,6 +469,9 @@ export class ReqResp implements ReqRespInterface {
     await pipeline(
       stream.source,
       async function* (source: any) {
+        // Req/resp is one-request-one-response: an honest sender writes a single payload and half-closes.
+        // Process only the first chunk and return, so extra frames a peer queues on the same stream cannot
+        // drive further handler invocations that bypass the per-stream rate-limit check in streamHandler.
         for await (const chunk of source) {
           const response = await handler(connection.remotePeer, chunk.subarray());
 
@@ -454,6 +486,7 @@ export class ReqResp implements ReqRespInterface {
 
           yield SUCCESS;
           yield snappy.outboundTransformData(response);
+          return;
         }
       },
       stream.sink,
@@ -564,6 +597,13 @@ export class ReqResp implements ReqRespInterface {
       return PeerErrorSeverity.LowToleranceError;
     }
 
+    // Response exceeded the reception buffer bound: the peer streamed more compressed data than the
+    // per-request size limit allows. Same protocol violation as above, penalize harshly.
+    if (e instanceof ResponseSizeLimitExceededError) {
+      this.logger.warn(`Oversized response from peer ${peerId.toString()} in ${subProtocol}: ${e.message}`, logTags);
+      return PeerErrorSeverity.LowToleranceError;
+    }
+
     return this.categorizeConnectionErrors(e, peerId, subProtocol);
   }
 

package/src/services/service.ts

@@ -58,6 +58,19 @@ export type DuplicateProposalInfo = {
  */
 export type P2PDuplicateProposalCallback = (info: DuplicateProposalInfo) => void;
 
+/** Minimal info passed to the oversized proposal callback. */
+export type OversizedProposalInfo = {
+  slot: SlotNumber;
+  proposer: EthAddress;
+};
+
+/**
+ * Callback for when a block proposal whose index lands at or beyond the consensus per-checkpoint block
+ * limit is stored and re-broadcast as slashing evidence. May fire multiple times per (slot, proposer)
+ * if the proposer signed several oversized proposals; consumers are expected to dedup.
+ */
+export type P2POversizedProposalCallback = (info: OversizedProposalInfo) => void;
+
 /** Minimal info passed to the duplicate attestation callback. */
 export type DuplicateAttestationInfo = {
   slot: SlotNumber;
@@ -108,6 +121,12 @@ export interface P2PService {
    */
   registerDuplicateProposalCallback(callback: P2PDuplicateProposalCallback): void;
 
+  /**
+   * Registers a callback invoked when an oversized block proposal (index at or beyond the consensus
+   * per-checkpoint block limit) is stored and re-broadcast as slashing evidence.
+   */
+  registerOversizedProposalCallback(callback: P2POversizedProposalCallback): void;
+
   /**
    * Registers a callback invoked when a duplicate attestation is detected (equivocation).
    * A validator signing attestations for different proposals at the same slot.

package/src/services/tx_collection/tx_source.ts

@@ -30,7 +30,8 @@ export class NodeRpcTxSource implements TxSource {
   }
 
   public async getTxsByHash(txHashes: TxHash[]): Promise<TxSourceCollectionResult> {
-    return this.verifyTxs(await this.client.getTxsByHash(txHashes));
+    // Collected txs feed block validation and proving, so we need their proofs.
+    return this.verifyTxs(await this.client.getTxsByHash(txHashes, { includeProof: true }));
   }
 
   private async verifyTxs(txs: Tx[]): Promise<TxSourceCollectionResult> {

package/src/test-helpers/testbench-utils.ts

@@ -119,6 +119,10 @@ export class InMemoryTxPool extends EventEmitter implements TxPoolV2 {
     return Promise.resolve();
   }
 
+  unprotectTxs(_txHashes: TxHash[], _slotNumber: SlotNumber): Promise<void> {
+    return Promise.resolve();
+  }
+
   handlePrunedBlocks(_latestBlock: L2BlockId, _options?: { deleteAllTxs?: boolean }): Promise<void> {
     return Promise.resolve();
   }
@@ -167,6 +171,10 @@ export class InMemoryTxPool extends EventEmitter implements TxPoolV2 {
     return Promise.resolve(this.txsByHash.size);
   }
 
+  async hasEligiblePendingTxs(minCount: number): Promise<boolean> {
+    return (await this.getPendingTxCount()) >= minCount;
+  }
+
   getMinedTxHashes(): Promise<[TxHash, L2BlockId][]> {
     return Promise.resolve([]);
   }
@@ -237,6 +245,10 @@ export class InMemoryAttestationPool {
     return Promise.resolve(this.checkpoints.get(slot)?.[0]);
   }
 
+  hasCheckpointProposalForSlot(slot: SlotNumber): Promise<boolean> {
+    return Promise.resolve(this.checkpoints.has(slot));
+  }
+
   getProposalsForSlot(slot: SlotNumber): Promise<{
     blockProposals: BlockProposal[];
     checkpointProposals: CheckpointProposalCore[];

package/src/testbench/p2p_client_testbench_worker.ts

@@ -17,6 +17,7 @@ import { getVKTreeRoot } from '@aztec/noir-protocol-circuits-types/vk-tree';
 import { protocolContractsHash } from '@aztec/protocol-contracts';
 import type { L2BlockSource } from '@aztec/stdlib/block';
 import type { ContractDataSource } from '@aztec/stdlib/contract';
+import { EmptyL1RollupConstants, type L1RollupConstants } from '@aztec/stdlib/epoch-helpers';
 import { GasFees } from '@aztec/stdlib/gas';
 import type { ClientProtocolCircuitVerifier, WorldStateSynchronizer } from '@aztec/stdlib/interfaces/server';
 import type { DataStoreConfig } from '@aztec/stdlib/kv-store';
@@ -84,6 +85,25 @@ export interface BenchReadyMessage {
 }
 const txCache = new Map<number, Tx[]>();
 
+const BENCH_L1_CONSTANTS: L1RollupConstants = {
+  ...EmptyL1RollupConstants,
+  slotDuration: 12,
+  ethereumSlotDuration: 4,
+};
+
+class TestbenchL2BlockSource extends MockL2BlockSource {
+  public override getL1Constants(): Promise<L1RollupConstants> {
+    return Promise.resolve(BENCH_L1_CONSTANTS);
+  }
+}
+
+function createBenchmarkEpochCache(): EpochCacheInterface {
+  return {
+    ...createMockEpochCache(),
+    getL1Constants: () => BENCH_L1_CONSTANTS,
+  };
+}
+
 class TestLibP2PService extends LibP2PService {
   private disableTxValidation: boolean;
   private gossipMessageCount = 0;
@@ -370,9 +390,9 @@ process.on('message', async msg => {
       workerConfig = config;
       workerTxPool = new InMemoryTxPool();
       workerAttestationPool = new InMemoryAttestationPool();
-      const epochCache = createMockEpochCache();
+      const epochCache = createBenchmarkEpochCache();
       const worldState = createMockWorldStateSynchronizer();
-      const l2BlockSource = new MockL2BlockSource();
+      const l2BlockSource = new TestbenchL2BlockSource();
 
       const proofVerifier = new AlwaysTrueCircuitVerifier();
       kvStore = await openTmpStore(`test-${clientIndex}`, true, BENCHMARK_CONSTANTS.KV_STORE_MAP_SIZE_KB);

package/dest/msg_validators/clock_tolerance.d.ts

@@ -1,32 +0,0 @@
-import type { EpochCacheInterface } from '@aztec/epoch-cache';
-import { SlotNumber } from '@aztec/foundation/branded-types';
-/**
- * Maximum clock disparity tolerance for P2P message validation (in milliseconds).
- * Messages for the previous slot are accepted if we're within this many milliseconds
- * of the current slot start. This prevents penalizing peers for messages that
- * were valid when sent but arrived slightly late due to network latency.
- *
- * This follows Ethereum's MAXIMUM_GOSSIP_CLOCK_DISPARITY approach.
- */
-export declare const MAXIMUM_GOSSIP_CLOCK_DISPARITY_MS = 500;
-/**
- * Checks if a message for the previous slot should be accepted due to clock tolerance.
- *
- * @param messageSlot - The slot number from the received message
- * @param currentSlot - The current slot number
- * @param epochCache - EpochCache to get timing information
- * @returns true if the message is for the previous slot AND we're within the clock tolerance window
- */
-export declare function isWithinClockTolerance(messageSlot: SlotNumber, currentSlot: SlotNumber, epochCache: EpochCacheInterface): boolean;
-export declare class PipeliningWindow {
-    private readonly epochCache;
-    private readonly proposalWindowIntoTargetSlot;
-    private readonly attestationWindowIntoTargetSlot;
-    constructor(epochCache: EpochCacheInterface, opts?: {
-        p2pPropagationTime?: number;
-        l1PublishingTime?: number;
-    });
-    acceptsProposal(messageSlot: SlotNumber): boolean;
-    acceptsAttestation(messageSlot: SlotNumber): boolean;
-}
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2xvY2tfdG9sZXJhbmNlLmQudHMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvbXNnX3ZhbGlkYXRvcnMvY2xvY2tfdG9sZXJhbmNlLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLE9BQU8sS0FBSyxFQUFFLG1CQUFtQixFQUFFLE1BQU0sb0JBQW9CLENBQUM7QUFDOUQsT0FBTyxFQUFFLFVBQVUsRUFBRSxNQUFNLGlDQUFpQyxDQUFDO0FBRzdEOzs7Ozs7O0dBT0c7QUFDSCxlQUFPLE1BQU0saUNBQWlDLE1BQU0sQ0FBQztBQUVyRDs7Ozs7OztHQU9HO0FBQ0gsd0JBQWdCLHNCQUFzQixDQUNwQyxXQUFXLEVBQUUsVUFBVSxFQUN2QixXQUFXLEVBQUUsVUFBVSxFQUN2QixVQUFVLEVBQUUsbUJBQW1CLEdBQzlCLE9BQU8sQ0EwQlQ7QUFzQ0QscUJBQWEsZ0JBQWdCO0lBS3pCLE9BQU8sQ0FBQyxRQUFRLENBQUMsVUFBVTtJQUo3QixPQUFPLENBQUMsUUFBUSxDQUFDLDRCQUE0QixDQUFTO0lBQ3RELE9BQU8sQ0FBQyxRQUFRLENBQUMsK0JBQStCLENBQVM7SUFFekQsWUFDbUIsVUFBVSxFQUFFLG1CQUFtQixFQUNoRCxJQUFJLEdBQUU7UUFDSixrQkFBa0IsQ0FBQyxFQUFFLE1BQU0sQ0FBQztRQUM1QixnQkFBZ0IsQ0FBQyxFQUFFLE1BQU0sQ0FBQztLQUN0QixFQVlQO0lBRU0sZUFBZSxDQUFDLFdBQVcsRUFBRSxVQUFVLEdBQUcsT0FBTyxDQUV2RDtJQUVNLGtCQUFrQixDQUFDLFdBQVcsRUFBRSxVQUFVLEdBQUcsT0FBTyxDQUUxRDtDQUNGIn0=

package/dest/msg_validators/clock_tolerance.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"clock_tolerance.d.ts","sourceRoot":"","sources":["../../src/msg_validators/clock_tolerance.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAAE,UAAU,EAAE,MAAM,iCAAiC,CAAC;AAG7D;;;;;;;GAOG;AACH,eAAO,MAAM,iCAAiC,MAAM,CAAC;AAErD;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CACpC,WAAW,EAAE,UAAU,EACvB,WAAW,EAAE,UAAU,EACvB,UAAU,EAAE,mBAAmB,GAC9B,OAAO,CA0BT;AAsCD,qBAAa,gBAAgB;IAKzB,OAAO,CAAC,QAAQ,CAAC,UAAU;IAJ7B,OAAO,CAAC,QAAQ,CAAC,4BAA4B,CAAS;IACtD,OAAO,CAAC,QAAQ,CAAC,+BAA+B,CAAS;IAEzD,YACmB,UAAU,EAAE,mBAAmB,EAChD,IAAI,GAAE;QACJ,kBAAkB,CAAC,EAAE,MAAM,CAAC;QAC5B,gBAAgB,CAAC,EAAE,MAAM,CAAC;KACtB,EAYP;IAEM,eAAe,CAAC,WAAW,EAAE,UAAU,GAAG,OAAO,CAEvD;IAEM,kBAAkB,CAAC,WAAW,EAAE,UAAU,GAAG,OAAO,CAE1D;CACF"}

package/dest/msg_validators/clock_tolerance.js

@@ -1,90 +0,0 @@
-import { SlotNumber } from '@aztec/foundation/branded-types';
-import { DEFAULT_P2P_PROPAGATION_TIME, createPipelinedCheckpointTimingModel } from '@aztec/stdlib/timetable';
-/**
- * Maximum clock disparity tolerance for P2P message validation (in milliseconds).
- * Messages for the previous slot are accepted if we're within this many milliseconds
- * of the current slot start. This prevents penalizing peers for messages that
- * were valid when sent but arrived slightly late due to network latency.
- *
- * This follows Ethereum's MAXIMUM_GOSSIP_CLOCK_DISPARITY approach.
- */ export const MAXIMUM_GOSSIP_CLOCK_DISPARITY_MS = 500;
-/**
- * Checks if a message for the previous slot should be accepted due to clock tolerance.
- *
- * @param messageSlot - The slot number from the received message
- * @param currentSlot - The current slot number
- * @param epochCache - EpochCache to get timing information
- * @returns true if the message is for the previous slot AND we're within the clock tolerance window
- */ export function isWithinClockTolerance(messageSlot, currentSlot, epochCache) {
-    // Guard against slot 0 edge case (genesis)
-    if (currentSlot === SlotNumber.ZERO) {
-        return false;
-    }
-    // Only apply tolerance to messages for the previous slot
-    const previousSlot = SlotNumber(currentSlot - 1);
-    if (messageSlot !== previousSlot) {
-        return false;
-    }
-    // Check how far we are into the current slot (in milliseconds)
-    const { ts: slotStartTs, nowMs } = epochCache.getEpochAndSlotNow();
-    const targetSlot = epochCache.getTargetSlot();
-    // Sanity check: ensure the epoch cache's target slot matches the expected current slot
-    if (targetSlot !== currentSlot) {
-        return false;
-    }
-    // ts is in seconds, convert to ms; nowMs is already in milliseconds
-    const slotStartMs = slotStartTs * 1000n;
-    const elapsedMs = Number(nowMs - slotStartMs);
-    return elapsedMs < MAXIMUM_GOSSIP_CLOCK_DISPARITY_MS;
-}
-/**
- * Checks if a straggler message for the previous target slot should be accepted.
- *
- * Proposals and attestations carry the target slot N. Most of the time the receiver is either
- * still in the build slot N-1 (accepted via the main `slotNumber === targetSlot` match) or in the
- * target slot N (accepted again via `targetSlot`). Stragglers that arrive after the receiver has
- * rolled past the target slot fall to this check: accept `messageSlot === slotNow` while we're
- * still within the first `windowSeconds + clock-disparity` of the slot.
- *
- * Under the early-pipelining schedule `windowSeconds` is small (0 for proposals,
- * `2*p2pPropagationTime` for attestations) since the proposer collects everything
- * before the slot boundary.
- *
- * @param messageSlot - The slot number from the received message
- * @param epochCache - EpochCache to get timing state
- * @param windowSeconds - How far into the current slot we still accept previous-target messages
- * @returns true if the message is for the current wallclock slot and we're within the grace period
- */ function isWithinPipeliningWindow(messageSlot, epochCache, windowSeconds) {
-    const currentSlot = epochCache.getSlotNow();
-    if (messageSlot !== currentSlot) {
-        return false;
-    }
-    const { ts: slotStartTs, nowMs } = epochCache.getEpochAndSlotNow();
-    const slotStartMs = slotStartTs * 1000n;
-    const elapsedMs = Number(nowMs - slotStartMs);
-    const windowMs = windowSeconds * 1000 + MAXIMUM_GOSSIP_CLOCK_DISPARITY_MS;
-    return elapsedMs < windowMs;
-}
-export class PipeliningWindow {
-    epochCache;
-    proposalWindowIntoTargetSlot;
-    attestationWindowIntoTargetSlot;
-    constructor(epochCache, opts = {}){
-        this.epochCache = epochCache;
-        const l1Constants = epochCache.getL1Constants();
-        const checkpointTiming = createPipelinedCheckpointTimingModel({
-            aztecSlotDuration: l1Constants.slotDuration,
-            ethereumSlotDuration: l1Constants.ethereumSlotDuration,
-            l1PublishingTime: opts.l1PublishingTime ?? l1Constants.ethereumSlotDuration,
-            p2pPropagationTime: opts.p2pPropagationTime ?? DEFAULT_P2P_PROPAGATION_TIME
-        });
-        this.proposalWindowIntoTargetSlot = checkpointTiming.proposalWindowIntoTargetSlot;
-        this.attestationWindowIntoTargetSlot = checkpointTiming.attestationWindowIntoTargetSlot;
-    }
-    acceptsProposal(messageSlot) {
-        return isWithinPipeliningWindow(messageSlot, this.epochCache, this.proposalWindowIntoTargetSlot);
-    }
-    acceptsAttestation(messageSlot) {
-        return isWithinPipeliningWindow(messageSlot, this.epochCache, this.attestationWindowIntoTargetSlot);
-    }
-}