@aztec/p2p 0.0.1-commit.2f68f620 → 0.0.1-commit.321f6a9

package/dest/services/libp2p/libp2p_service.js

@@ -372,12 +372,15 @@ function _apply_decs_2203_r(targetClass, memberDecs, classDecs, parentClass) {
 }
 var _dec, _dec1, _dec2, _dec3, _dec4, _dec5, _initProto;
 import { BlockNumber } from '@aztec/foundation/branded-types';
-import { maxBy, merge } from '@aztec/foundation/collection';
+import { compactArray, maxBy, merge } from '@aztec/foundation/collection';
 import { createLibp2pComponentLogger, createLogger } from '@aztec/foundation/log';
 import { RunningPromise } from '@aztec/foundation/running-promise';
 import { Timer } from '@aztec/foundation/timer';
 import { protocolContractsHash } from '@aztec/protocol-contracts';
+import { DEFAULT_MAX_BLOCKS_PER_CHECKPOINT } from '@aztec/stdlib/config';
+import { getNetworkTxGasLimits } from '@aztec/stdlib/gas';
 import { BlockProposal, CheckpointAttestation, CheckpointProposal, P2PMessage, PeerErrorSeverity, PeerErrorSeverityByHarshness, TopicType, createTopicString, getTopicsForConfig, metricsTopicStrToLabels } from '@aztec/stdlib/p2p';
+import { ConsensusTimetable, getDefaultCheckpointProposalSyncGrace } from '@aztec/stdlib/timetable';
 import { MerkleTreeId } from '@aztec/stdlib/trees';
 import { Tx } from '@aztec/stdlib/tx';
 import { compressComponentVersions } from '@aztec/stdlib/versioning';
@@ -404,14 +407,27 @@ import { convertToMultiaddr } from '../../util.js';
 import { getVersions } from '../../versioning.js';
 import { AztecDatastore } from '../data_store.js';
 import { DiscV5Service } from '../discv5/discV5_service.js';
-import { SnappyTransform, fastMsgIdFn, getMsgIdFn, msgIdToStrFn } from '../encoding.js';
+import { SnappyTransform, getMsgIdFn, msgIdToStrFn } from '../encoding.js';
 import { APP_SPECIFIC_WEIGHT, gossipScoreThresholds } from '../gossipsub/scoring.js';
 import { createAllTopicScoreParams } from '../gossipsub/topic_score_params.js';
 import { PeerManager } from '../peer-manager/peer_manager.js';
 import { PeerScoring } from '../peer-manager/peer_scoring.js';
+import { YAMUX_MAX_MESSAGE_SIZE_BYTES } from '../reqresp/config.js';
 import { ReqRespSubProtocol, ValidationError, pingHandler, reqGoodbyeHandler, reqRespBlockTxsHandler, reqRespStatusHandler, reqRespTxHandler } from '../reqresp/index.js';
 import { ReqResp } from '../reqresp/reqresp.js';
 import { P2PInstrumentation } from './instrumentation.js';
+/**
+ * Builds the {@link ConsensusTimetable} shared by the gossip validators for proposal/attestation receive-window
+ * bounds. Derived purely from protocol slot-timing constants plus the block sub-slot duration and the consensus
+ * materialization grace, so every node agrees on these bounds without depending on proposer operational budgets.
+ */ function buildConsensusTimetable(config, l1Constants) {
+    const blockDuration = config.blockDurationMs / 1000;
+    return new ConsensusTimetable({
+        l1Constants,
+        blockDuration,
+        checkpointProposalSyncGrace: config.checkpointProposalSyncGraceSeconds ?? getDefaultCheckpointProposalSyncGrace(blockDuration)
+    });
+}
 _dec = trackSpan('Libp2pService.validateAndStoreCheckpointAttestation', (_peerId, attestation)=>({
         [Attributes.SLOT_NUMBER]: attestation.payload.header.slotNumber.toString()
     })), _dec1 = trackSpan('Libp2pService.validateAndStoreBlockProposal', (_peerId, block)=>({
@@ -488,6 +504,7 @@ _dec = trackSpan('Libp2pService.validateAndStoreCheckpointAttestation', (_peerId
     protocolVersion;
     topicStrings;
     /** Callback invoked when a duplicate proposal is detected (triggers slashing). */ duplicateProposalCallback;
+    /** Callback invoked when an oversized block proposal is stored as slashing evidence (triggers slashing). */ oversizedProposalCallback;
     /** Callback invoked when a duplicate attestation is detected (triggers slashing). */ duplicateAttestationCallback;
     /** Callback invoked when a valid checkpoint attestation is accepted into the pool. */ checkpointAttestationCallback;
     /**
@@ -528,26 +545,27 @@ _dec = trackSpan('Libp2pService.validateAndStoreCheckpointAttestation', (_peerId
         this.topicStrings[TopicType.block_proposal] = createTopicString(TopicType.block_proposal, this.protocolVersion);
         this.topicStrings[TopicType.checkpoint_proposal] = createTopicString(TopicType.checkpoint_proposal, this.protocolVersion);
         this.topicStrings[TopicType.checkpoint_attestation] = createTopicString(TopicType.checkpoint_attestation, this.protocolVersion);
-        const p2pPropagationTime = config.attestationPropagationTime;
+        // Build the consensus timetable once from protocol slot-timing constants and inject it into every
+        // validator so they share one set of receive-window bounds, independent of proposer operational budgets.
+        const consensusTimetable = buildConsensusTimetable(config, epochCache.getL1Constants());
         const proposalValidatorOpts = {
             txsPermitted: !config.disableTransactions,
             maxTxsPerBlock: config.validateMaxTxsPerBlock ?? config.validateMaxTxsPerCheckpoint,
             maxBlocksPerCheckpoint: config.maxBlocksPerCheckpoint,
-            p2pPropagationTime,
             skipSlotValidation: config.skipProposalSlotValidation,
             signatureContext: {
                 chainId: config.l1ChainId,
                 rollupAddress: config.rollupAddress
-            }
+            },
+            clockDisparityMs: config.maxGossipClockDisparityMs
         };
-        this.blockProposalValidator = new BlockProposalValidator(epochCache, proposalValidatorOpts);
-        this.checkpointProposalValidator = new CheckpointProposalValidator(epochCache, proposalValidatorOpts);
+        this.blockProposalValidator = new BlockProposalValidator(epochCache, consensusTimetable, proposalValidatorOpts);
+        this.checkpointProposalValidator = new CheckpointProposalValidator(epochCache, consensusTimetable, proposalValidatorOpts);
         const attestationValidatorOpts = {
-            l1PublishingTime: config.l1PublishingTime,
-            p2pPropagationTime,
-            signatureContext: proposalValidatorOpts.signatureContext
+            signatureContext: proposalValidatorOpts.signatureContext,
+            clockDisparityMs: config.maxGossipClockDisparityMs
         };
-        this.checkpointAttestationValidator = config.fishermanMode ? new FishermanAttestationValidator(epochCache, mempools.attestationPool, telemetry, attestationValidatorOpts) : new CheckpointAttestationValidator(epochCache, attestationValidatorOpts);
+        this.checkpointAttestationValidator = config.fishermanMode ? new FishermanAttestationValidator(epochCache, consensusTimetable, mempools.attestationPool, telemetry, attestationValidatorOpts) : new CheckpointAttestationValidator(epochCache, consensusTimetable, attestationValidatorOpts);
         this.gossipSubEventHandler = this.handleGossipSubEvent.bind(this);
         this.blockReceivedCallback = async (block)=>{
             this.logger.warn(`Handler for block received not yet registered on P2P service. Received block ${block.blockNumber} for slot ${block.slotNumber} from peer.`, {
@@ -577,7 +595,7 @@ _dec = trackSpan('Libp2pService.validateAndStoreCheckpointAttestation', (_peerId
         const bindAddrTcp = convertToMultiaddr(listenAddress, p2pPort, 'tcp');
         const datastore = new AztecDatastore(peerStore);
         const otelMetricsAdapter = new OtelMetricsAdapter(telemetry, logger.getBindings());
-        const peerDiscoveryService = new DiscV5Service(peerId, config, packageVersion, telemetry, createLogger(`${logger.module}:discv5_service`, logger.getBindings()));
+        const peerDiscoveryService = new DiscV5Service(peerId, config, packageVersion, telemetry, createLogger(`${logger.module}:discv5_service`, logger.getBindings()), peerStore);
         // Seed libp2p's bootstrap discovery with private and trusted peers
         const bootstrapNodes = [
             ...config.privatePeers,
@@ -592,34 +610,45 @@ _dec = trackSpan('Libp2pService.validateAndStoreCheckpointAttestation', (_peerId
         const versions = getVersions(config);
         const protocolVersion = compressComponentVersions(versions);
         const preferredPeersEnrs = config.preferredPeers.map((enr)=>ENR.decodeTxt(enr));
-        const directPeers = (await Promise.all(preferredPeersEnrs.map(async (enr)=>{
-            const peerId = await enr.peerId();
-            const address = enr.getLocationMultiaddr('tcp');
-            if (address === undefined) {
-                throw new Error(`Direct peer ${peerId.toString()} has no TCP address, ENR: ${enr.encodeTxt()}`);
+        const directPeers = compactArray(await Promise.all(preferredPeersEnrs.map(async (enr)=>{
+            try {
+                const peerId = await enr.peerId();
+                const address = enr.getLocationMultiaddr('tcp');
+                if (address === undefined) {
+                    throw new Error(`Direct peer ${peerId.toString()} has no TCP address, ENR: ${enr.encodeTxt()}`);
+                }
+                return {
+                    id: peerId,
+                    addrs: [
+                        address
+                    ]
+                };
+            } catch (err) {
+                // A malformed configured ENR shouldn't abort node setup — skip it and log.
+                logger.warn(`Skipping preferred peer with invalid ENR`, {
+                    err
+                });
+                return undefined;
             }
-            return {
-                id: peerId,
-                addrs: [
-                    address
-                ]
-            };
-        }))).filter((peer)=>peer !== undefined);
+        })));
         const announceTcpMultiaddr = config.p2pIp ? [
             convertToMultiaddr(config.p2pIp, p2pPort, 'tcp')
         ] : [];
-        // Create dynamic topic score params based on network configuration
+        // Create dynamic topic score params based on network configuration. Scoring uses the network-wide
+        // max-blocks-per-checkpoint config value directly to size expected per-slot message rates; these are
+        // peer-rate thresholds, not consensus deadlines, so they need no proposer operational budgets.
         const l1Constants = epochCache.getL1Constants();
         const topicScoreParams = createAllTopicScoreParams(protocolVersion, {
             slotDurationMs: l1Constants.slotDuration * 1000,
-            ethereumSlotDuration: l1Constants.ethereumSlotDuration,
             heartbeatIntervalMs: config.gossipsubInterval,
             targetCommitteeSize: l1Constants.targetCommitteeSize,
-            blockDurationMs: config.blockDurationMs,
-            l1PublishingTime: config.l1PublishingTime,
-            p2pPropagationTime: config.attestationPropagationTime,
+            maxBlocksPerCheckpoint: config.maxBlocksPerCheckpoint ?? DEFAULT_MAX_BLOCKS_PER_CHECKPOINT,
             expectedBlockProposalsPerSlot: config.expectedBlockProposalsPerSlot
         });
+        // Restrict gossipsub to exactly the topics we subscribe to. Without this, an arbitrary-topic
+        // message is transformed, msg-id'd and inserted into the seenCache before the subscription check,
+        // so a crafted topic colliding on msg id can suppress a real message as a duplicate.
+        const allowedTopics = getTopicsForConfig(config.disableTransactions).map((topic)=>createTopicString(topic, protocolVersion));
         const node = await createLibp2p({
             start: false,
             peerId,
@@ -653,8 +682,11 @@ _dec = trackSpan('Libp2pService.validateAndStoreCheckpointAttestation', (_peerId
             ],
             datastore,
             peerDiscovery,
+            // Pin the yamux frame size: MAX_REQRESP_REQUEST_SIZE_BYTES relies on a reqresp request fitting in one frame.
             streamMuxers: [
-                yamux(),
+                yamux({
+                    maxMessageSize: YAMUX_MAX_MESSAGE_SIZE_BYTES
+                }),
                 mplex()
             ],
             connectionEncryption: [
@@ -672,7 +704,7 @@ _dec = trackSpan('Libp2pService.validateAndStoreCheckpointAttestation', (_peerId
             },
             connectionGater: {
                 denyInboundConnection: (maConn)=>{
-                    const allowed = peerManager.isNodeAllowedToConnect(maConn.remoteAddr.nodeAddress().address);
+                    const allowed = peerManager.isAddressAllowedToConnect(maConn.remoteAddr.nodeAddress().address);
                     if (allowed) {
                         return false;
                     }
@@ -682,7 +714,7 @@ _dec = trackSpan('Libp2pService.validateAndStoreCheckpointAttestation', (_peerId
                 denyInboundEncryptedConnection: (peerId, _maConn)=>{
                     //NOTE: it is not necessary to check address here because this was already done by
                     // denyInboundConnection
-                    const allowed = peerManager.isNodeAllowedToConnect(peerId);
+                    const allowed = peerManager.isPeerAllowedToConnect(peerId);
                     if (allowed) {
                         return false;
                     }
@@ -709,9 +741,13 @@ _dec = trackSpan('Libp2pService.validateAndStoreCheckpointAttestation', (_peerId
                     mcacheLength: config.gossipsubMcacheLength,
                     mcacheGossip: config.gossipsubMcacheGossip,
                     seenTTL: config.gossipsubSeenTTL,
+                    allowedTopics,
+                    // No fastMsgIdFn: the fast-path dedup cache keys on a non-cryptographic 64-bit hash of the
+                    // raw data only (no topic), so a collision — accidental or engineered via a weak seed — drops
+                    // a different message with no fallback to the full id. Dedup instead rests solely on the
+                    // cryptographic, topic-framed msgIdFn below.
                     msgIdFn: getMsgIdFn,
                     msgIdToStrFn: msgIdToStrFn,
-                    fastMsgIdFn: fastMsgIdFn,
                     dataTransform: new SnappyTransform(),
                     metricsRegister: otelMetricsAdapter,
                     metricsTopicStrToLabel: metricsTopicStrToLabels(protocolVersion),
@@ -896,6 +932,11 @@ _dec = trackSpan('Libp2pService.validateAndStoreCheckpointAttestation', (_peerId
         this.duplicateProposalCallback = callback;
     }
     /**
+   * Registers a callback to be invoked when an oversized block proposal is stored as slashing evidence.
+   */ registerOversizedProposalCallback(callback) {
+        this.oversizedProposalCallback = callback;
+    }
+    /**
    * Registers a callback to be invoked when a duplicate attestation is detected.
    * A validator signing attestations for different proposals at the same slot.
    * This callback is triggered on the first duplicate (when count goes from 1 to 2).
@@ -1342,9 +1383,10 @@ _dec = trackSpan('Libp2pService.validateAndStoreCheckpointAttestation', (_peerId
         };
     }
     async processBlockFromPeer(payloadData, msgId, source) {
-        const { result, obj: block, metadata: { isEquivocated } = {} } = await this.validateReceivedMessage(()=>this.validateAndStoreBlockProposal(source, BlockProposal.fromBuffer(payloadData)), msgId, source, TopicType.block_proposal);
-        // If not accepted or equivocated, return
-        if (result !== TopicValidatorResult.Accept || !block || isEquivocated) {
+        const { result, obj: block, metadata: { isEquivocated, isOversized } = {} } = await this.validateReceivedMessage(()=>this.validateAndStoreBlockProposal(source, BlockProposal.fromBuffer(payloadData)), msgId, source, TopicType.block_proposal);
+        // If not accepted, equivocated, or oversized, return. Oversized proposals are re-broadcast as
+        // slashing evidence but never attested or processed.
+        if (result !== TopicValidatorResult.Accept || !block || isEquivocated || isOversized) {
             return;
         }
         await this.processValidBlockProposal(block, source);
@@ -1367,6 +1409,10 @@ _dec = trackSpan('Libp2pService.validateAndStoreCheckpointAttestation', (_peerId
         // Try to add the proposal: this handles existence check, cap check, and adding in one call
         const { added, alreadyExists, count } = await this.mempools.attestationPool.tryAddBlockProposal(block);
         const isEquivocated = count !== undefined && count > 1;
+        // An oversized proposal (index at or beyond the consensus per-checkpoint limit) is structurally valid
+        // proposer misbehavior: it is stored and re-broadcast as slashing evidence but never processed or
+        // attested to. No-ops when maxBlocksPerCheckpoint is unset (local/test).
+        const isOversized = this.config.maxBlocksPerCheckpoint !== undefined && block.indexWithinCheckpoint >= this.config.maxBlocksPerCheckpoint;
         // Duplicate proposal received, no need to re-broadcast
         if (alreadyExists) {
             this.logger.debug(`Ignoring duplicate block proposal received`, {
@@ -1379,7 +1425,8 @@ _dec = trackSpan('Libp2pService.validateAndStoreCheckpointAttestation', (_peerId
                 result: TopicValidatorResult.Ignore,
                 obj: block,
                 metadata: {
-                    isEquivocated
+                    isEquivocated,
+                    isOversized
                 }
             };
         }
@@ -1395,11 +1442,30 @@ _dec = trackSpan('Libp2pService.validateAndStoreCheckpointAttestation', (_peerId
             return {
                 result: TopicValidatorResult.Reject,
                 metadata: {
-                    isEquivocated
+                    isEquivocated,
+                    isOversized
                 },
                 severity: PeerErrorSeverity.HighToleranceError
             };
         }
+        // The proposal was stored: if oversized, invoke the oversized callback so the proposer can be
+        // slashed. Fired alongside (not instead of) equivocation detection below.
+        if (isOversized) {
+            const proposer = block.getSender();
+            if (proposer) {
+                this.logger.warn(`Detected oversized block proposal at slot ${block.slotNumber}`, {
+                    ...block.toBlockInfo(),
+                    indexWithinCheckpoint: block.indexWithinCheckpoint,
+                    maxBlocksPerCheckpoint: this.config.maxBlocksPerCheckpoint,
+                    source: peerId.toString(),
+                    proposer: proposer.toString()
+                });
+                this.oversizedProposalCallback?.({
+                    slot: block.slotNumber,
+                    proposer
+                });
+            }
+        }
         // If this was a duplicate proposal, do not process it, but do invoke the duplicate callback,
         // and do re-broadcast it so other nodes in the network know to slash the proposer
         if (isEquivocated) {
@@ -1421,14 +1487,19 @@ _dec = trackSpan('Libp2pService.validateAndStoreCheckpointAttestation', (_peerId
                 result: TopicValidatorResult.Accept,
                 obj: block,
                 metadata: {
-                    isEquivocated
+                    isEquivocated,
+                    isOversized
                 }
             };
         }
         // Otherwise, we're good to go!
         return {
             result: TopicValidatorResult.Accept,
-            obj: block
+            obj: block,
+            metadata: {
+                isEquivocated: false,
+                isOversized
+            }
         };
     }
     // REFACTOR(palla): This method should be moved to the p2p_client or to a separate component,
@@ -1447,15 +1518,19 @@ _dec = trackSpan('Libp2pService.validateAndStoreCheckpointAttestation', (_peerId
         const isValid = await this.blockReceivedCallback(block, sender);
         if (!isValid) {
             this.logger.info(`Block proposal validation failed for block ${block.blockNumber}`, block.toBlockInfo());
+            // Release the protections this proposal created so its txs return to pending. Only entries still
+            // keyed to this slot are cleared, so a tx referenced by a live proposal at another slot stays protected.
+            await this.mempools.txPool.unprotectTxs(block.txHashes, slot);
         }
     }
     /**
    * Handle a gossiped checkpoint proposal.
    * Validates and processes the checkpoint proposal, then triggers the callback for attestation.
    */ async handleGossipedCheckpointProposal(payloadData, msgId, source) {
-        const { result, obj: checkpoint, metadata: { isEquivocated, processBlock } = {} } = await this.validateReceivedMessage(()=>this.validateAndStoreCheckpointProposal(source, CheckpointProposal.fromBuffer(payloadData)), msgId, source, TopicType.checkpoint_proposal);
-        // Process checkpoint proposal if valid and not equivocated.
-        const processCheckpointFn = ()=>result === TopicValidatorResult.Accept && checkpoint && !isEquivocated ? this.processValidCheckpointProposal(checkpoint.toCore(), source) : Promise.resolve();
+        const { result, obj: checkpoint, metadata: { isEquivocated, processBlock, isOversized } = {} } = await this.validateReceivedMessage(()=>this.validateAndStoreCheckpointProposal(source, CheckpointProposal.fromBuffer(payloadData)), msgId, source, TopicType.checkpoint_proposal);
+        // An oversized checkpoint is re-broadcast as slashing evidence but never attested or processed.
+        // Process checkpoint proposal if valid and neither equivocated nor oversized.
+        const processCheckpointFn = ()=>result === TopicValidatorResult.Accept && checkpoint && !isEquivocated && !isOversized ? this.processValidCheckpointProposal(checkpoint.toCore(), source) : Promise.resolve();
         // If the checkpoint contained a valid last block, we process it even if the checkpoint itself is to be rejected
         // TODO(palla/mbps): Is this ok? Should we be considering a block from a checkpoint that was equivocated?
         const processBlockFn = ()=>processBlock && checkpoint && checkpoint.getBlockProposal() ? this.processValidBlockProposal(checkpoint.getBlockProposal(), source) : Promise.resolve();
@@ -1494,13 +1569,15 @@ _dec = trackSpan('Libp2pService.validateAndStoreCheckpointAttestation', (_peerId
         // Extract and try to add the block proposal first if present
         const blockProposal = checkpoint.getBlockProposal();
         let processBlock = false;
+        let isOversized = false;
         if (blockProposal) {
             this.logger.debug(`Validating block proposal from propagated checkpoint`, {
                 [Attributes.SLOT_NUMBER]: checkpoint.slotNumber.toString(),
                 [Attributes.P2P_ID]: peerId.toString()
             });
             const blockProposalResult = await this.validateAndStoreBlockProposal(peerId, blockProposal);
-            const { obj, metadata: { isEquivocated } = {} } = blockProposalResult;
+            const { obj, metadata: { isEquivocated, isOversized: blockIsOversized } = {} } = blockProposalResult;
+            isOversized = blockIsOversized ?? false;
             if (blockProposalResult.result === TopicValidatorResult.Reject || !obj || isEquivocated) {
                 this.logger.debug(`Rejecting checkpoint due to invalid last block proposal`, {
                     [Attributes.SLOT_NUMBER]: checkpoint.slotNumber.toString(),
@@ -1512,7 +1589,8 @@ _dec = trackSpan('Libp2pService.validateAndStoreCheckpointAttestation', (_peerId
                     result: TopicValidatorResult.Reject,
                     severity: 'severity' in blockProposalResult ? blockProposalResult.severity : PeerErrorSeverity.MidToleranceError
                 };
-            } else if (blockProposalResult.result === TopicValidatorResult.Accept && obj && !isEquivocated) {
+            } else if (blockProposalResult.result === TopicValidatorResult.Accept && obj && !isEquivocated && !isOversized) {
+                // An oversized terminal block is re-broadcast as slashing evidence but never processed.
                 processBlock = true;
             }
         }
@@ -1532,11 +1610,12 @@ _dec = trackSpan('Libp2pService.validateAndStoreCheckpointAttestation', (_peerId
                 obj: checkpoint,
                 metadata: {
                     isEquivocated,
-                    processBlock
+                    processBlock,
+                    isOversized
                 }
             };
         }
-        // Too many checkpoint proposals received for this slot, penalize peer and do not re-broadcast
+        // Too many checkpoint proposals received for this slot, penalize peer and do not re-broadcast.
         // Note: We still return the checkpoint obj so the lastBlock can be processed if valid
         if (!added) {
             this.logger.warn(`Penalizing peer for checkpoint proposal exceeding per-slot cap`, {
@@ -1549,7 +1628,8 @@ _dec = trackSpan('Libp2pService.validateAndStoreCheckpointAttestation', (_peerId
                 obj: checkpoint,
                 metadata: {
                     isEquivocated,
-                    processBlock
+                    processBlock,
+                    isOversized
                 },
                 severity: PeerErrorSeverity.HighToleranceError
             };
@@ -1576,7 +1656,8 @@ _dec = trackSpan('Libp2pService.validateAndStoreCheckpointAttestation', (_peerId
                 obj: checkpoint,
                 metadata: {
                     isEquivocated,
-                    processBlock
+                    processBlock,
+                    isOversized
                 }
             };
         }
@@ -1586,7 +1667,8 @@ _dec = trackSpan('Libp2pService.validateAndStoreCheckpointAttestation', (_peerId
             obj: checkpoint,
             metadata: {
                 processBlock,
-                isEquivocated
+                isEquivocated,
+                isOversized
             }
         };
     }
@@ -1738,10 +1820,10 @@ _dec = trackSpan('Libp2pService.validateAndStoreCheckpointAttestation', (_peerId
         ];
         const blockNumber = BlockNumber(currentBlockNumber + 1);
         const l1Constants = await this.archiver.getL1Constants();
+        const networkTxGasLimits = getNetworkTxGasLimits(this.config, l1Constants);
         return createFirstStageTxValidationsForGossipedTransactions(nextSlotTimestamp, blockNumber, this.worldStateSynchronizer, gasFees, this.config.l1ChainId, this.config.rollupVersion, protocolContractsHash, this.archiver, !this.config.disableTransactions, allowedInSetup, this.logger.getBindings(), {
-            rollupManaLimit: l1Constants.rollupManaLimit,
-            maxBlockL2Gas: this.config.validateMaxL2BlockGas,
-            maxBlockDAGas: this.config.validateMaxDABlockGas
+            maxTxL2Gas: networkTxGasLimits.l2Gas,
+            maxTxDAGas: networkTxGasLimits.daGas
         });
     }
     /** Creates the second stage (expensive proof verification) validators for gossiped transactions. */ createSecondStageMessageValidators() {

package/dest/services/peer-manager/peer_manager.d.ts

@@ -129,7 +129,20 @@ export declare class PeerManager implements PeerManagerInterface {
     shouldDisableP2PGossip(peerId: string): boolean;
     getPeers(includePending?: boolean): PeerInfo[];
     isAuthenticatedPeer(peerId: PeerId): boolean;
-    isNodeAllowedToConnect(id: string | PeerId): boolean;
+    /**
+     * Whether a peer is allowed to connect, given its peer id. Rejects peers serving an active ban and
+     * peers that have exceeded the failed auth-handshake limit. Use this once the peer id is known —
+     * i.e. for the encrypted-inbound gater and when dialing.
+     */
+    isPeerAllowedToConnect(peerId: string | PeerId): boolean;
+    /**
+     * Whether a connection from an address is allowed. Bans are keyed by peer id, which isn't known at
+     * the raw-inbound layer, so only the failed auth-handshake limit (also tracked per address) is
+     * enforced here; the ban is applied once the peer id is known via {@link isPeerAllowedToConnect}.
+     */
+    isAddressAllowedToConnect(address: string): boolean;
+    /** Whether the failed auth-handshake count for a peer id or address is below the configured limit. */
+    private isWithinFailedAuthLimit;
     /**
      * Discovers peers.
      */
@@ -175,4 +188,4 @@ export declare class PeerManager implements PeerManagerInterface {
     handleAuthRequestFromPeer(_authRequest: AuthRequest, peerId: PeerId): Promise<StatusMessage>;
     private updateAuthenticatedPeers;
 }
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicGVlcl9tYW5hZ2VyLmQudHMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi9zcmMvc2VydmljZXMvcGVlci1tYW5hZ2VyL3BlZXJfbWFuYWdlci50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEtBQUssRUFBRSxtQkFBbUIsRUFBRSxNQUFNLG9CQUFvQixDQUFDO0FBRzlELE9BQU8sS0FBSyxFQUFFLFVBQVUsRUFBRSxNQUFNLCtCQUErQixDQUFDO0FBR2hFLE9BQU8sRUFBRSxZQUFZLEVBQUUsTUFBTSx5QkFBeUIsQ0FBQztBQUN2RCxPQUFPLEtBQUssRUFBRSxRQUFRLEVBQUUsc0JBQXNCLEVBQUUsTUFBTSxpQ0FBaUMsQ0FBQztBQUN4RixPQUFPLEtBQUssRUFBRSxpQkFBaUIsRUFBRSxNQUFNLG1CQUFtQixDQUFDO0FBQzNELE9BQU8sS0FBSyxFQUFFLGVBQWUsRUFBRSxNQUFNLHlCQUF5QixDQUFDO0FBRS9ELE9BQU8sS0FBSyxFQUFjLE1BQU0sRUFBRSxNQUFNLG1CQUFtQixDQUFDO0FBTTVELE9BQU8sS0FBSyxFQUFFLFNBQVMsRUFBRSxNQUFNLGlCQUFpQixDQUFDO0FBRWpELE9BQU8sS0FBSyxFQUFFLFVBQVUsRUFBRSxNQUFNLGVBQWUsQ0FBQztBQUVoRCxPQUFPLEVBQUUsV0FBVyxFQUFnQixNQUFNLDhCQUE4QixDQUFDO0FBQ3pFLE9BQU8sRUFBRSxhQUFhLEVBQXVCLE1BQU0saUNBQWlDLENBQUM7QUFDckYsT0FBTyxFQUFFLGFBQWEsRUFBRSxNQUFNLGdDQUFnQyxDQUFDO0FBQy9ELE9BQU8sS0FBSyxFQUFFLE9BQU8sRUFBRSxNQUFNLHVCQUF1QixDQUFDO0FBRXJELE9BQU8sS0FBSyxFQUFFLG9CQUFvQixFQUFFLE1BQU0sZUFBZSxDQUFDO0FBQzFELE9BQU8sS0FBSyxFQUFFLG9CQUFvQixFQUFFLE1BQU0sZ0JBQWdCLENBQUM7QUFFM0QsT0FBTyxFQUFrQixLQUFLLFdBQVcsRUFBRSxNQUFNLG1CQUFtQixDQUFDO0FBMkJyRSxxQkFBYSxXQUFZLFlBQVcsb0JBQW9CO0lBeUJwRCxPQUFPLENBQUMsVUFBVTtJQUNsQixPQUFPLENBQUMsb0JBQW9CO0lBQzVCLE9BQU8sQ0FBQyxNQUFNO0lBRWQsT0FBTyxDQUFDLE1BQU07SUFDZCxPQUFPLENBQUMsV0FBVztJQUNuQixPQUFPLENBQUMsT0FBTztJQUNmLE9BQU8sQ0FBQyxRQUFRLENBQUMsc0JBQXNCO0lBQ3ZDLE9BQU8sQ0FBQyxRQUFRLENBQUMsZUFBZTtJQUNoQyxPQUFPLENBQUMsUUFBUSxDQUFDLFVBQVU7SUFDM0IsT0FBTyxDQUFDLFFBQVEsQ0FBQyxZQUFZO0lBbEMvQixPQUFPLENBQUMsV0FBVyxDQUFzQztJQUN6RCxPQUFPLENBQUMsZ0JBQWdCLENBQWE7SUFDckMsT0FBTyxDQUFDLDhCQUE4QixDQUFhO0lBQ25ELE9BQU8sQ0FBQyxhQUFhLENBQXdDO0lBQzdELE9BQU8sQ0FBQyxZQUFZLENBQTBCO0lBQzlDLE9BQU8sQ0FBQyx1QkFBdUIsQ0FBa0I7SUFDakQsT0FBTyxDQUFDLFlBQVksQ0FBMEI7SUFDOUMsT0FBTyxDQUFDLHVCQUF1QixDQUFrQjtJQUNqRCxPQUFPLENBQUMsY0FBYyxDQUEwQjtJQUNoRCxPQUFPLENBQUMscUNBQXFDLENBQXNDO0lBQ25GLE9BQU8sQ0FBQyxxQ0FBcUMsQ0FBa0M7SUFDL0UsT0FBTyxDQUFDLHFCQUFxQixDQUEwQjtJQUN2RCxPQUFPLENBQUMsb0JBQW9CLENBQW9EO0lBQ2hGLE9BQU8sQ0FBQyxrQkFBa0IsQ0FBb0I7SUFDOUMsT0FBTyxDQUFDLHlCQUF5QixDQUFrQjtJQUVuRCxPQUFPLENBQUMsT0FBTyxDQUFxQjtJQUNwQyxPQUFPLENBQUMsUUFBUSxDQUlkO0lBRUYsWUFDVSxVQUFVLEVBQUUsVUFBVSxFQUN0QixvQkFBb0IsRUFBRSxvQkFBb0IsRUFDMUMsTUFBTSxFQUFFLFNBQVMsRUFDekIsZUFBZSxFQUFFLGVBQWUsRUFDeEIsTUFBTSxvREFBbUMsRUFDekMsV0FBVyxFQUFFLFdBQVcsRUFDeEIsT0FBTyxFQUFFLE9BQU8sRUFDUCxzQkFBc0IsRUFBRSxzQkFBc0IsRUFDOUMsZUFBZSxFQUFFLE1BQU0sRUFDdkIsVUFBVSxFQUFFLG1CQUFtQixFQUMvQixZQUFZLEdBQUUsWUFBaUMsRUF5QmpFO0lBQ0Q7Ozs7T0FJRztJQUNHLGVBQWUsa0JBbUNwQjtJQUVELElBQUksTUFBTSw2Q0FFVDtJQUVZLFNBQVMsa0JBVXJCO0lBSUssMkJBQTJCLGtCQWdEaEM7SUFFRDs7Ozs7Ozs7OztPQVVHO0lBQ0gsT0FBTyxDQUFDLHNCQUFzQjtZQXNCaEIsMkJBQTJCO0lBc0J6Qzs7O09BR0c7SUFDSCxPQUFPLENBQUMsd0JBQXdCO0lBdUJoQzs7O09BR0c7SUFDSCxPQUFPLENBQUMsMkJBQTJCO0lBbUI1Qiw4QkFBOEIsQ0FBQyxPQUFPLEVBQUUsVUFBVSxFQUFFLEdBQUcsSUFBSSxDQUVqRTtJQUVEOzs7OztPQUtHO0lBQ0gsT0FBTyxDQUFDLGFBQWE7SUFRckI7OztPQUdHO0lBQ0ksY0FBYyxDQUFDLE1BQU0sRUFBRSxNQUFNLEdBQUcsSUFBSSxDQU0xQztJQUVEOzs7T0FHRztJQUNJLGNBQWMsQ0FBQyxNQUFNLEVBQUUsTUFBTSxHQUFHLElBQUksQ0FRMUM7SUFFRDs7OztPQUlHO0lBQ0gsT0FBTyxDQUFDLGFBQWE7SUFRckI7OztPQUdHO0lBQ0ksZ0JBQWdCLENBQUMsTUFBTSxFQUFFLE1BQU0sR0FBRyxJQUFJLENBSzVDO0lBRUQ7Ozs7T0FJRztJQUNILE9BQU8sQ0FBQyxlQUFlO0lBSXZCOzs7O09BSUc7SUFDSCxPQUFPLENBQUMsZUFBZTtJQUl2Qjs7Ozs7O09BTUc7SUFDSSxlQUFlLENBQUMsTUFBTSxFQUFFLE1BQU0sRUFBRSxNQUFNLEVBQUUsYUFBYSxRQU0zRDtJQUVNLFlBQVksQ0FBQyxNQUFNLEVBQUUsTUFBTSxFQUFFLE9BQU8sRUFBRSxpQkFBaUIsUUFFN0Q7SUFFTSxZQUFZLENBQUMsTUFBTSxFQUFFLE1BQU0sR0FBRyxNQUFNLENBRTFDO0lBRU0sc0JBQXNCLENBQUMsTUFBTSxFQUFFLE1BQU0sR0FBRyxPQUFPLENBR3JEO0lBRU0sUUFBUSxDQUFDLGNBQWMsVUFBUSxHQUFHLFFBQVEsRUFBRSxDQStCbEQ7SUFFTSxtQkFBbUIsQ0FBQyxNQUFNLEVBQUUsTUFBTSxHQUFHLE9BQU8sQ0FRbEQ7SUFTTSxzQkFBc0IsQ0FBQyxFQUFFLEVBQUUsTUFBTSxHQUFHLE1BQU0sR0FBRyxPQUFPLENBYTFEO0lBRUQ7O09BRUc7SUFDSCxPQUFPLENBQUMsUUFBUTtJQW9FaEIsT0FBTyxDQUFDLG9CQUFvQjtJQUk1QixPQUFPLENBQUMscUJBQXFCO0lBSTdCLE9BQU8sQ0FBQyxtQkFBbUI7SUFzQjNCOzs7OztPQUtHO0lBQ0gsT0FBTyxDQUFDLGVBQWU7WUF5QlQsd0JBQXdCO0lBZ0N0QyxPQUFPLENBQUMscUJBQXFCO1lBWWYsY0FBYztZQWtCZCxvQkFBb0I7WUEwRXBCLFFBQVE7SUE0QnRCLE9BQU8sQ0FBQyxjQUFjO0lBV3RCLE9BQU8sQ0FBQyxnQkFBZ0I7WUFzQlYsbUJBQW1CO1lBZW5CLHVCQUF1QjtZQTJDdkIscUJBQXFCO0lBMkZuQyxPQUFPLENBQUMsdUJBQXVCO0lBbUMvQixPQUFPLENBQUMsd0JBQXdCO0lBVWhDOzs7T0FHRztJQUNVLElBQUksa0JBV2hCO0lBRUQsT0FBTyxDQUFDLHVCQUF1QjtJQUkvQjs7Ozs7Ozs7O1NBU0s7SUFDUSx5QkFBeUIsQ0FBQyxZQUFZLEVBQUUsV0FBVyxFQUFFLE1BQU0sRUFBRSxNQUFNLEdBQUcsT0FBTyxDQUFDLGFBQWEsQ0FBQyxDQU94RztZQUVhLHdCQUF3QjtDQXdCdkMifQ==
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicGVlcl9tYW5hZ2VyLmQudHMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi9zcmMvc2VydmljZXMvcGVlci1tYW5hZ2VyL3BlZXJfbWFuYWdlci50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEtBQUssRUFBRSxtQkFBbUIsRUFBRSxNQUFNLG9CQUFvQixDQUFDO0FBSTlELE9BQU8sS0FBSyxFQUFFLFVBQVUsRUFBRSxNQUFNLCtCQUErQixDQUFDO0FBR2hFLE9BQU8sRUFBRSxZQUFZLEVBQUUsTUFBTSx5QkFBeUIsQ0FBQztBQUN2RCxPQUFPLEtBQUssRUFBRSxRQUFRLEVBQUUsc0JBQXNCLEVBQUUsTUFBTSxpQ0FBaUMsQ0FBQztBQUN4RixPQUFPLEtBQUssRUFBRSxpQkFBaUIsRUFBRSxNQUFNLG1CQUFtQixDQUFDO0FBQzNELE9BQU8sS0FBSyxFQUFFLGVBQWUsRUFBRSxNQUFNLHlCQUF5QixDQUFDO0FBRS9ELE9BQU8sS0FBSyxFQUFjLE1BQU0sRUFBRSxNQUFNLG1CQUFtQixDQUFDO0FBTTVELE9BQU8sS0FBSyxFQUFFLFNBQVMsRUFBRSxNQUFNLGlCQUFpQixDQUFDO0FBRWpELE9BQU8sS0FBSyxFQUFFLFVBQVUsRUFBRSxNQUFNLGVBQWUsQ0FBQztBQUVoRCxPQUFPLEVBQUUsV0FBVyxFQUFnQixNQUFNLDhCQUE4QixDQUFDO0FBQ3pFLE9BQU8sRUFBRSxhQUFhLEVBQXVCLE1BQU0saUNBQWlDLENBQUM7QUFDckYsT0FBTyxFQUFFLGFBQWEsRUFBRSxNQUFNLGdDQUFnQyxDQUFDO0FBQy9ELE9BQU8sS0FBSyxFQUFFLE9BQU8sRUFBRSxNQUFNLHVCQUF1QixDQUFDO0FBRXJELE9BQU8sS0FBSyxFQUFFLG9CQUFvQixFQUFFLE1BQU0sZUFBZSxDQUFDO0FBQzFELE9BQU8sS0FBSyxFQUFFLG9CQUFvQixFQUFFLE1BQU0sZ0JBQWdCLENBQUM7QUFFM0QsT0FBTyxFQUFrQixLQUFLLFdBQVcsRUFBRSxNQUFNLG1CQUFtQixDQUFDO0FBMkJyRSxxQkFBYSxXQUFZLFlBQVcsb0JBQW9CO0lBeUJwRCxPQUFPLENBQUMsVUFBVTtJQUNsQixPQUFPLENBQUMsb0JBQW9CO0lBQzVCLE9BQU8sQ0FBQyxNQUFNO0lBRWQsT0FBTyxDQUFDLE1BQU07SUFDZCxPQUFPLENBQUMsV0FBVztJQUNuQixPQUFPLENBQUMsT0FBTztJQUNmLE9BQU8sQ0FBQyxRQUFRLENBQUMsc0JBQXNCO0lBQ3ZDLE9BQU8sQ0FBQyxRQUFRLENBQUMsZUFBZTtJQUNoQyxPQUFPLENBQUMsUUFBUSxDQUFDLFVBQVU7SUFDM0IsT0FBTyxDQUFDLFFBQVEsQ0FBQyxZQUFZO0lBbEMvQixPQUFPLENBQUMsV0FBVyxDQUFzQztJQUN6RCxPQUFPLENBQUMsZ0JBQWdCLENBQWE7SUFDckMsT0FBTyxDQUFDLDhCQUE4QixDQUFhO0lBQ25ELE9BQU8sQ0FBQyxhQUFhLENBQXdDO0lBQzdELE9BQU8sQ0FBQyxZQUFZLENBQTBCO0lBQzlDLE9BQU8sQ0FBQyx1QkFBdUIsQ0FBa0I7SUFDakQsT0FBTyxDQUFDLFlBQVksQ0FBMEI7SUFDOUMsT0FBTyxDQUFDLHVCQUF1QixDQUFrQjtJQUNqRCxPQUFPLENBQUMsY0FBYyxDQUEwQjtJQUNoRCxPQUFPLENBQUMscUNBQXFDLENBQXNDO0lBQ25GLE9BQU8sQ0FBQyxxQ0FBcUMsQ0FBa0M7SUFDL0UsT0FBTyxDQUFDLHFCQUFxQixDQUEwQjtJQUN2RCxPQUFPLENBQUMsb0JBQW9CLENBQW9EO0lBQ2hGLE9BQU8sQ0FBQyxrQkFBa0IsQ0FBb0I7SUFDOUMsT0FBTyxDQUFDLHlCQUF5QixDQUFrQjtJQUVuRCxPQUFPLENBQUMsT0FBTyxDQUFxQjtJQUNwQyxPQUFPLENBQUMsUUFBUSxDQUlkO0lBRUYsWUFDVSxVQUFVLEVBQUUsVUFBVSxFQUN0QixvQkFBb0IsRUFBRSxvQkFBb0IsRUFDMUMsTUFBTSxFQUFFLFNBQVMsRUFDekIsZUFBZSxFQUFFLGVBQWUsRUFDeEIsTUFBTSxvREFBbUMsRUFDekMsV0FBVyxFQUFFLFdBQVcsRUFDeEIsT0FBTyxFQUFFLE9BQU8sRUFDUCxzQkFBc0IsRUFBRSxzQkFBc0IsRUFDOUMsZUFBZSxFQUFFLE1BQU0sRUFDdkIsVUFBVSxFQUFFLG1CQUFtQixFQUMvQixZQUFZLEdBQUUsWUFBaUMsRUF5QmpFO0lBQ0Q7Ozs7T0FJRztJQUNHLGVBQWUsa0JBbUNwQjtJQUVELElBQUksTUFBTSw2Q0FFVDtJQUVZLFNBQVMsa0JBV3JCO0lBSUssMkJBQTJCLGtCQXNEaEM7SUFFRDs7Ozs7Ozs7OztPQVVHO0lBQ0gsT0FBTyxDQUFDLHNCQUFzQjtZQXNCaEIsMkJBQTJCO0lBc0J6Qzs7O09BR0c7SUFDSCxPQUFPLENBQUMsd0JBQXdCO0lBdUJoQzs7O09BR0c7SUFDSCxPQUFPLENBQUMsMkJBQTJCO0lBbUI1Qiw4QkFBOEIsQ0FBQyxPQUFPLEVBQUUsVUFBVSxFQUFFLEdBQUcsSUFBSSxDQUVqRTtJQUVEOzs7OztPQUtHO0lBQ0gsT0FBTyxDQUFDLGFBQWE7SUFRckI7OztPQUdHO0lBQ0ksY0FBYyxDQUFDLE1BQU0sRUFBRSxNQUFNLEdBQUcsSUFBSSxDQU0xQztJQUVEOzs7T0FHRztJQUNJLGNBQWMsQ0FBQyxNQUFNLEVBQUUsTUFBTSxHQUFHLElBQUksQ0FRMUM7SUFFRDs7OztPQUlHO0lBQ0gsT0FBTyxDQUFDLGFBQWE7SUFRckI7OztPQUdHO0lBQ0ksZ0JBQWdCLENBQUMsTUFBTSxFQUFFLE1BQU0sR0FBRyxJQUFJLENBSzVDO0lBRUQ7Ozs7T0FJRztJQUNILE9BQU8sQ0FBQyxlQUFlO0lBSXZCOzs7O09BSUc7SUFDSCxPQUFPLENBQUMsZUFBZTtJQUl2Qjs7Ozs7O09BTUc7SUFDSSxlQUFlLENBQUMsTUFBTSxFQUFFLE1BQU0sRUFBRSxNQUFNLEVBQUUsYUFBYSxRQU0zRDtJQUVNLFlBQVksQ0FBQyxNQUFNLEVBQUUsTUFBTSxFQUFFLE9BQU8sRUFBRSxpQkFBaUIsUUFFN0Q7SUFFTSxZQUFZLENBQUMsTUFBTSxFQUFFLE1BQU0sR0FBRyxNQUFNLENBRTFDO0lBRU0sc0JBQXNCLENBQUMsTUFBTSxFQUFFLE1BQU0sR0FBRyxPQUFPLENBR3JEO0lBRU0sUUFBUSxDQUFDLGNBQWMsVUFBUSxHQUFHLFFBQVEsRUFBRSxDQStCbEQ7SUFFTSxtQkFBbUIsQ0FBQyxNQUFNLEVBQUUsTUFBTSxHQUFHLE9BQU8sQ0FRbEQ7SUFTRDs7OztPQUlHO0lBQ0ksc0JBQXNCLENBQUMsTUFBTSxFQUFFLE1BQU0sR0FBRyxNQUFNLEdBQUcsT0FBTyxDQU05RDtJQUVEOzs7O09BSUc7SUFDSSx5QkFBeUIsQ0FBQyxPQUFPLEVBQUUsTUFBTSxHQUFHLE9BQU8sQ0FFekQ7SUFFRCxzR0FBc0c7SUFDdEcsT0FBTyxDQUFDLHVCQUF1QjtJQWUvQjs7T0FFRztJQUNILE9BQU8sQ0FBQyxRQUFRO0lBb0VoQixPQUFPLENBQUMsb0JBQW9CO0lBSTVCLE9BQU8sQ0FBQyxxQkFBcUI7SUFJN0IsT0FBTyxDQUFDLG1CQUFtQjtJQXNCM0I7Ozs7O09BS0c7SUFDSCxPQUFPLENBQUMsZUFBZTtZQXlCVCx3QkFBd0I7SUFnQ3RDLE9BQU8sQ0FBQyxxQkFBcUI7WUFZZixjQUFjO1lBa0JkLG9CQUFvQjtZQTBFcEIsUUFBUTtJQTRCdEIsT0FBTyxDQUFDLGNBQWM7SUFXdEIsT0FBTyxDQUFDLGdCQUFnQjtZQXNCVixtQkFBbUI7WUFlbkIsdUJBQXVCO1lBMkN2QixxQkFBcUI7SUEyRm5DLE9BQU8sQ0FBQyx1QkFBdUI7SUFtQy9CLE9BQU8sQ0FBQyx3QkFBd0I7SUFVaEM7OztPQUdHO0lBQ1UsSUFBSSxrQkFXaEI7SUFFRCxPQUFPLENBQUMsdUJBQXVCO0lBSS9COzs7Ozs7Ozs7U0FTSztJQUNRLHlCQUF5QixDQUFDLFlBQVksRUFBRSxXQUFXLEVBQUUsTUFBTSxFQUFFLE1BQU0sR0FBRyxPQUFPLENBQUMsYUFBYSxDQUFDLENBT3hHO1lBRWEsd0JBQXdCO0NBd0J2QyJ9

package/dest/services/peer-manager/peer_manager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"peer_manager.d.ts","sourceRoot":"","sources":["../../../src/services/peer-manager/peer_manager.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAG9D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,+BAA+B,CAAC;AAGhE,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACvD,OAAO,KAAK,EAAE,QAAQ,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AACxF,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAC3D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAE/D,OAAO,KAAK,EAAc,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAM5D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAEjD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAEhD,OAAO,EAAE,WAAW,EAAgB,MAAM,8BAA8B,CAAC;AACzE,OAAO,EAAE,aAAa,EAAuB,MAAM,iCAAiC,CAAC;AACrF,OAAO,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AAC/D,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AAErD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAC1D,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AAE3D,OAAO,EAAkB,KAAK,WAAW,EAAE,MAAM,mBAAmB,CAAC;AA2BrE,qBAAa,WAAY,YAAW,oBAAoB;IAyBpD,OAAO,CAAC,UAAU;IAClB,OAAO,CAAC,oBAAoB;IAC5B,OAAO,CAAC,MAAM;IAEd,OAAO,CAAC,MAAM;IACd,OAAO,CAAC,WAAW;IACnB,OAAO,CAAC,OAAO;IACf,OAAO,CAAC,QAAQ,CAAC,sBAAsB;IACvC,OAAO,CAAC,QAAQ,CAAC,eAAe;IAChC,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B,OAAO,CAAC,QAAQ,CAAC,YAAY;IAlC/B,OAAO,CAAC,WAAW,CAAsC;IACzD,OAAO,CAAC,gBAAgB,CAAa;IACrC,OAAO,CAAC,8BAA8B,CAAa;IACnD,OAAO,CAAC,aAAa,CAAwC;IAC7D,OAAO,CAAC,YAAY,CAA0B;IAC9C,OAAO,CAAC,uBAAuB,CAAkB;IACjD,OAAO,CAAC,YAAY,CAA0B;IAC9C,OAAO,CAAC,uBAAuB,CAAkB;IACjD,OAAO,CAAC,cAAc,CAA0B;IAChD,OAAO,CAAC,qCAAqC,CAAsC;IACnF,OAAO,CAAC,qCAAqC,CAAkC;IAC/E,OAAO,CAAC,qBAAqB,CAA0B;IACvD,OAAO,CAAC,oBAAoB,CAAoD;IAChF,OAAO,CAAC,kBAAkB,CAAoB;IAC9C,OAAO,CAAC,yBAAyB,CAAkB;IAEnD,OAAO,CAAC,OAAO,CAAqB;IACpC,OAAO,CAAC,QAAQ,CAId;IAEF,YACU,UAAU,EAAE,UAAU,EACtB,oBAAoB,EAAE,oBAAoB,EAC1C,MAAM,EAAE,SAAS,EACzB,eAAe,EAAE,eAAe,EACxB,MAAM,oDAAmC,EACzC,WAAW,EAAE,WAAW,EACxB,OAAO,EAAE,OAAO,EACP,sBAAsB,EAAE,sBAAsB,EAC9C,eAAe,EAAE,MAAM,EACvB,UAAU,EAAE,mBAAmB,EAC/B,YAAY,GAAE,YAAiC,EAyBjE;IACD;;;;OAIG;IACG,eAAe,kBAmCpB;IAED,IAAI,MAAM,6CAET;IAEY,SAAS,kBAUrB;IAIK,2BAA2B,kBAgDhC;IAED;;;;;;;;;;OAUG;IACH,OAAO,CAAC,sBAAsB;YAsBhB,2BAA2B;IAsBzC;;;OAGG;IACH,OAAO,CAAC,wBAAwB;IAuBhC;;;OAGG;IACH,OAAO,CAAC,2BAA2B;IAmB5B,8BAA8B,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG,IAAI,CAEjE;IAED;;;;;OAKG;IACH,OAAO,CAAC,aAAa;IAQrB;;;OAGG;IACI,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAM1C;IAED;;;OAGG;IACI,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAQ1C;IAED;;;;OAIG;IACH,OAAO,CAAC,aAAa;IAQrB;;;OAGG;IACI,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAK5C;IAED;;;;OAIG;IACH,OAAO,CAAC,eAAe;IAIvB;;;;OAIG;IACH,OAAO,CAAC,eAAe;IAIvB;;;;;;OAMG;IACI,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,QAM3D;IAEM,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB,QAE7D;IAEM,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAE1C;IAEM,sBAAsB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAGrD;IAEM,QAAQ,CAAC,cAAc,UAAQ,GAAG,QAAQ,EAAE,CA+BlD;IAEM,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAQlD;IASM,sBAAsB,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAa1D;IAED;;OAEG;IACH,OAAO,CAAC,QAAQ;IAoEhB,OAAO,CAAC,oBAAoB;IAI5B,OAAO,CAAC,qBAAqB;IAI7B,OAAO,CAAC,mBAAmB;IAsB3B;;;;;OAKG;IACH,OAAO,CAAC,eAAe;YAyBT,wBAAwB;IAgCtC,OAAO,CAAC,qBAAqB;YAYf,cAAc;YAkBd,oBAAoB;YA0EpB,QAAQ;IA4BtB,OAAO,CAAC,cAAc;IAWtB,OAAO,CAAC,gBAAgB;YAsBV,mBAAmB;YAenB,uBAAuB;YA2CvB,qBAAqB;IA2FnC,OAAO,CAAC,uBAAuB;IAmC/B,OAAO,CAAC,wBAAwB;IAUhC;;;OAGG;IACU,IAAI,kBAWhB;IAED,OAAO,CAAC,uBAAuB;IAI/B;;;;;;;;;SASK;IACQ,yBAAyB,CAAC,YAAY,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAOxG;YAEa,wBAAwB;CAwBvC"}
+{"version":3,"file":"peer_manager.d.ts","sourceRoot":"","sources":["../../../src/services/peer-manager/peer_manager.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAI9D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,+BAA+B,CAAC;AAGhE,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACvD,OAAO,KAAK,EAAE,QAAQ,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AACxF,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAC3D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAE/D,OAAO,KAAK,EAAc,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAM5D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAEjD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAEhD,OAAO,EAAE,WAAW,EAAgB,MAAM,8BAA8B,CAAC;AACzE,OAAO,EAAE,aAAa,EAAuB,MAAM,iCAAiC,CAAC;AACrF,OAAO,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AAC/D,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AAErD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAC1D,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AAE3D,OAAO,EAAkB,KAAK,WAAW,EAAE,MAAM,mBAAmB,CAAC;AA2BrE,qBAAa,WAAY,YAAW,oBAAoB;IAyBpD,OAAO,CAAC,UAAU;IAClB,OAAO,CAAC,oBAAoB;IAC5B,OAAO,CAAC,MAAM;IAEd,OAAO,CAAC,MAAM;IACd,OAAO,CAAC,WAAW;IACnB,OAAO,CAAC,OAAO;IACf,OAAO,CAAC,QAAQ,CAAC,sBAAsB;IACvC,OAAO,CAAC,QAAQ,CAAC,eAAe;IAChC,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B,OAAO,CAAC,QAAQ,CAAC,YAAY;IAlC/B,OAAO,CAAC,WAAW,CAAsC;IACzD,OAAO,CAAC,gBAAgB,CAAa;IACrC,OAAO,CAAC,8BAA8B,CAAa;IACnD,OAAO,CAAC,aAAa,CAAwC;IAC7D,OAAO,CAAC,YAAY,CAA0B;IAC9C,OAAO,CAAC,uBAAuB,CAAkB;IACjD,OAAO,CAAC,YAAY,CAA0B;IAC9C,OAAO,CAAC,uBAAuB,CAAkB;IACjD,OAAO,CAAC,cAAc,CAA0B;IAChD,OAAO,CAAC,qCAAqC,CAAsC;IACnF,OAAO,CAAC,qCAAqC,CAAkC;IAC/E,OAAO,CAAC,qBAAqB,CAA0B;IACvD,OAAO,CAAC,oBAAoB,CAAoD;IAChF,OAAO,CAAC,kBAAkB,CAAoB;IAC9C,OAAO,CAAC,yBAAyB,CAAkB;IAEnD,OAAO,CAAC,OAAO,CAAqB;IACpC,OAAO,CAAC,QAAQ,CAId;IAEF,YACU,UAAU,EAAE,UAAU,EACtB,oBAAoB,EAAE,oBAAoB,EAC1C,MAAM,EAAE,SAAS,EACzB,eAAe,EAAE,eAAe,EACxB,MAAM,oDAAmC,EACzC,WAAW,EAAE,WAAW,EACxB,OAAO,EAAE,OAAO,EACP,sBAAsB,EAAE,sBAAsB,EAC9C,eAAe,EAAE,MAAM,EACvB,UAAU,EAAE,mBAAmB,EAC/B,YAAY,GAAE,YAAiC,EAyBjE;IACD;;;;OAIG;IACG,eAAe,kBAmCpB;IAED,IAAI,MAAM,6CAET;IAEY,SAAS,kBAWrB;IAIK,2BAA2B,kBAsDhC;IAED;;;;;;;;;;OAUG;IACH,OAAO,CAAC,sBAAsB;YAsBhB,2BAA2B;IAsBzC;;;OAGG;IACH,OAAO,CAAC,wBAAwB;IAuBhC;;;OAGG;IACH,OAAO,CAAC,2BAA2B;IAmB5B,8BAA8B,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG,IAAI,CAEjE;IAED;;;;;OAKG;IACH,OAAO,CAAC,aAAa;IAQrB;;;OAGG;IACI,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAM1C;IAED;;;OAGG;IACI,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAQ1C;IAED;;;;OAIG;IACH,OAAO,CAAC,aAAa;IAQrB;;;OAGG;IACI,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAK5C;IAED;;;;OAIG;IACH,OAAO,CAAC,eAAe;IAIvB;;;;OAIG;IACH,OAAO,CAAC,eAAe;IAIvB;;;;;;OAMG;IACI,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,QAM3D;IAEM,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB,QAE7D;IAEM,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAE1C;IAEM,sBAAsB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAGrD;IAEM,QAAQ,CAAC,cAAc,UAAQ,GAAG,QAAQ,EAAE,CA+BlD;IAEM,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAQlD;IASD;;;;OAIG;IACI,sBAAsB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAM9D;IAED;;;;OAIG;IACI,yBAAyB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAEzD;IAED,sGAAsG;IACtG,OAAO,CAAC,uBAAuB;IAe/B;;OAEG;IACH,OAAO,CAAC,QAAQ;IAoEhB,OAAO,CAAC,oBAAoB;IAI5B,OAAO,CAAC,qBAAqB;IAI7B,OAAO,CAAC,mBAAmB;IAsB3B;;;;;OAKG;IACH,OAAO,CAAC,eAAe;YAyBT,wBAAwB;IAgCtC,OAAO,CAAC,qBAAqB;YAYf,cAAc;YAkBd,oBAAoB;YA0EpB,QAAQ;IA4BtB,OAAO,CAAC,cAAc;IAWtB,OAAO,CAAC,gBAAgB;YAsBV,mBAAmB;YAenB,uBAAuB;YA2CvB,qBAAqB;IA2FnC,OAAO,CAAC,uBAAuB;IAmC/B,OAAO,CAAC,wBAAwB;IAUhC;;;OAGG;IACU,IAAI,kBAWhB;IAED,OAAO,CAAC,uBAAuB;IAI/B;;;;;;;;;SASK;IACQ,yBAAyB,CAAC,YAAY,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAOxG;YAEa,wBAAwB;CAwBvC"}

package/dest/services/peer-manager/peer_manager.js

@@ -1,3 +1,4 @@
+import { compactArray } from '@aztec/foundation/collection';
 import { makeEthSignDigest, tryRecoverAddress } from '@aztec/foundation/crypto/secp256k1-signer';
 import { Fr } from '@aztec/foundation/curves/bn254';
 import { createLogger } from '@aztec/foundation/log';
@@ -127,6 +128,7 @@ export class PeerManager {
     async heartbeat() {
         this.heartbeatCounter++;
         this.peerScoring.decayAllScores();
+        this.peerScoring.pruneExpiredBans();
         this.cleanupExpiredTimeouts();
         await this.setupDirectPeersIfValidator();
         await this.updateAuthenticatedPeers();
@@ -150,19 +152,27 @@ export class PeerManager {
         }
         const preferredPeersEnrs = this.config.preferredPeers.map((enr)=>ENR.decodeTxt(enr));
         await Promise.all(preferredPeersEnrs.map((enr)=>enr.peerId())).then((peerIds)=>peerIds.forEach((peerId)=>this.preferredPeers.add(peerId.toString()))).catch((e)=>this.logger.error('Error initializing preferred peers', e));
-        const directPeers = (await Promise.all(preferredPeersEnrs.map(async (enr)=>{
-            const peerId = await enr.peerId();
-            const address = enr.getLocationMultiaddr('tcp');
-            if (address === undefined) {
-                throw new Error(`Direct peer ${peerId.toString()} has no TCP address, ENR: ${enr.encodeTxt()}`);
+        const directPeers = compactArray(await Promise.all(preferredPeersEnrs.map(async (enr)=>{
+            try {
+                const peerId = await enr.peerId();
+                const address = enr.getLocationMultiaddr('tcp');
+                if (address === undefined) {
+                    throw new Error(`Direct peer ${peerId.toString()} has no TCP address, ENR: ${enr.encodeTxt()}`);
+                }
+                return {
+                    id: peerId,
+                    addrs: [
+                        address
+                    ]
+                };
+            } catch (err) {
+                // A malformed configured ENR shouldn't abort preferred-peer setup — skip it and log.
+                this.logger.warn(`Skipping preferred peer with invalid ENR`, {
+                    err
+                });
+                return undefined;
             }
-            return {
-                id: peerId,
-                addrs: [
-                    address
-                ]
-            };
-        }))).filter((peer)=>peer !== undefined);
+        })));
         await Promise.all(directPeers.map((peer)=>{
             this.libP2PNode.services.pubsub.direct.add(peer.id.toString());
             return this.libP2PNode.peerStore.merge(peer.id, {
@@ -390,14 +400,32 @@ export class PeerManager {
    * @param id: Address of the node or it's peerId
    *
    * @returns: True if node is allowed to connect, otherwise false
-   * */ isNodeAllowedToConnect(id) {
-        const entry = this.failedAuthHandshakes.get(id.toString());
+   * */ /**
+   * Whether a peer is allowed to connect, given its peer id. Rejects peers serving an active ban and
+   * peers that have exceeded the failed auth-handshake limit. Use this once the peer id is known —
+   * i.e. for the encrypted-inbound gater and when dialing.
+   */ isPeerAllowedToConnect(peerId) {
+        const id = peerId.toString();
+        if (this.peerScoring.getScoreState(id) === PeerScoreState.Banned) {
+            return false;
+        }
+        return this.isWithinFailedAuthLimit(id);
+    }
+    /**
+   * Whether a connection from an address is allowed. Bans are keyed by peer id, which isn't known at
+   * the raw-inbound layer, so only the failed auth-handshake limit (also tracked per address) is
+   * enforced here; the ban is applied once the peer id is known via {@link isPeerAllowedToConnect}.
+   */ isAddressAllowedToConnect(address) {
+        return this.isWithinFailedAuthLimit(address);
+    }
+    /** Whether the failed auth-handshake count for a peer id or address is below the configured limit. */ isWithinFailedAuthLimit(key) {
+        const entry = this.failedAuthHandshakes.get(key);
         if (!entry) {
             return true;
         }
         // In case entry is too old, remove it and allow connection
         if (this.dateProvider.now() - entry.lastFailureTimestamp > FAILED_AUTH_HANDSHAKE_EXPIRY_MS) {
-            this.failedAuthHandshakes.delete(id.toString());
+            this.failedAuthHandshakes.delete(key);
             return true;
         }
         return entry.count <= this.config.p2pMaxFailedAuthAttemptsAllowed;
@@ -572,9 +600,9 @@ export class PeerManager {
         if (this.peerScoring.getScoreState(peerIdString) != PeerScoreState.Healthy) {
             return;
         }
-        // Don't dial peers that have exceeded the auth failure threshold
-        if (!this.isNodeAllowedToConnect(peerId)) {
-            this.logger.trace(`Skipping peer ${peerId} due to failed auth handshake attempts`);
+        // Don't dial banned peers or those that have exceeded the auth failure threshold
+        if (!this.isPeerAllowedToConnect(peerId)) {
+            this.logger.trace(`Skipping peer ${peerId} due to ban or failed auth handshake attempts`);
             return;
         }
         const [multiaddrTcp] = await Promise.all([

package/dest/services/peer-manager/peer_scoring.d.ts

@@ -19,13 +19,40 @@ export declare class PeerScoring {
         [key in PeerErrorSeverity]: number;
     };
     private peerStateCounter;
+    /** Active bans, keyed by peer id. Held in memory only, so they are cleared on restart. */
+    private bannedPeers;
+    /**
+     * How long a peer remains banned once its score crosses MIN_SCORE_BEFORE_BAN. While banned, the
+     * peer's ban score is returned by getScore regardless of decay, so it cannot recover its way out
+     * of the ban early. After the ban expires the live (decayed) score takes over again.
+     */
+    private readonly banDurationMs;
     constructor(config: P2PConfig, telemetry?: TelemetryClient, dateProvider?: DateProvider);
     penalizePeer(peerId: PeerId, penalty: PeerErrorSeverity): number;
     updateScore(peerId: string, scoreDelta: number): number;
+    /**
+     * Records a ban for a peer whose score has crossed the ban threshold, with an expiry banDurationMs
+     * in the future. No-op if the score is above the threshold or the peer is already serving an active
+     * ban (an existing ban is not extended; the original window stands). A previously expired ban does
+     * not block a fresh one — getActiveBanScore prunes it first.
+     */
+    private maybeBanPeer;
     decayAllScores(): void;
+    /**
+     * Removes bans whose window has elapsed. Expired bans are otherwise only pruned lazily when their
+     * peer's score is next queried, so a banned peer that disconnects and is never queried again would
+     * linger in the map. Called periodically (per heartbeat) to bound the ban map's size.
+     */
+    pruneExpiredBans(): void;
     /** Resets all peer scores. Useful for benchmarks to prevent cross-case contamination. */
     resetAllScores(): void;
     removePeer(peerId: string): void;
+    /**
+     * The single source of truth for whether a peer is banned. Returns the ban score while the ban is
+     * active, or undefined if the peer is not banned. A ban that has expired is lazily lifted before
+     * returning undefined, so callers never see a stale ban.
+     */
+    private getActiveBanScore;
     getScore(peerId: string): number;
     getScoreState(peerId: string): PeerScoreState;
     getStats(): {
@@ -35,4 +62,4 @@ export declare class PeerScoring {
         bannedCount: number;
     };
 }
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicGVlcl9zY29yaW5nLmQudHMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi9zcmMvc2VydmljZXMvcGVlci1tYW5hZ2VyL3BlZXJfc2NvcmluZy50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFFQSxPQUFPLEVBQUUsWUFBWSxFQUFFLE1BQU0seUJBQXlCLENBQUM7QUFDdkQsT0FBTyxFQUFFLGlCQUFpQixFQUFFLE1BQU0sbUJBQW1CLENBQUM7QUFDdEQsT0FBTyxFQUdMLEtBQUssZUFBZSxFQUlyQixNQUFNLHlCQUF5QixDQUFDO0FBRWpDLE9BQU8sS0FBSyxFQUFFLE1BQU0sRUFBRSxNQUFNLG1CQUFtQixDQUFDO0FBRWhELE9BQU8sS0FBSyxFQUFFLFNBQVMsRUFBRSxNQUFNLGlCQUFpQixDQUFDO0FBdUJqRCxvQkFBWSxjQUFjO0lBQ3hCLE1BQU0sSUFBQTtJQUNOLFVBQVUsSUFBQTtJQUNWLE9BQU8sSUFBQTtDQUNSO0FBaUJELHFCQUFhLFdBQVc7SUFhcEIsT0FBTyxDQUFDLFFBQVEsQ0FBQyxZQUFZO0lBWi9CLE9BQU8sQ0FBQyxNQUFNLENBQW9DO0lBQ2xELE9BQU8sQ0FBQyxNQUFNLENBQWtDO0lBQ2hELE9BQU8sQ0FBQyxjQUFjLENBQWtDO0lBQ3hELE9BQU8sQ0FBQyxhQUFhLENBQWE7SUFDbEMsT0FBTyxDQUFDLFdBQVcsQ0FBTztJQUMxQixhQUFhLEVBQUU7U0FBRyxHQUFHLElBQUksaUJBQWlCLEdBQUcsTUFBTTtLQUFFLENBQUM7SUFFdEQsT0FBTyxDQUFDLGdCQUFnQixDQUFnQjtJQUV4QyxZQUNFLE1BQU0sRUFBRSxTQUFTLEVBQ2pCLFNBQVMsR0FBRSxlQUFzQyxFQUNoQyxZQUFZLEdBQUUsWUFBaUMsRUFpQmpFO0lBRU0sWUFBWSxDQUFDLE1BQU0sRUFBRSxNQUFNLEVBQUUsT0FBTyxFQUFFLGlCQUFpQixVQU03RDtJQUVELFdBQVcsQ0FBQyxNQUFNLEVBQUUsTUFBTSxFQUFFLFVBQVUsRUFBRSxNQUFNLEdBQUcsTUFBTSxDQWlCdEQ7SUFFRCxjQUFjLElBQUksSUFBSSxDQWlCckI7SUFFRCx5RkFBeUY7SUFDekYsY0FBYyxJQUFJLElBQUksQ0FHckI7SUFFRCxVQUFVLENBQUMsTUFBTSxFQUFFLE1BQU0sR0FBRyxJQUFJLENBRy9CO0lBRUQsUUFBUSxDQUFDLE1BQU0sRUFBRSxNQUFNLEdBQUcsTUFBTSxDQUUvQjtJQUVNLGFBQWEsQ0FBQyxNQUFNLEVBQUUsTUFBTSxHQUFHLGNBQWMsQ0FVbkQ7SUFFRCxRQUFRLElBQUk7UUFBRSxXQUFXLEVBQUUsTUFBTSxDQUFDO1FBQUMsWUFBWSxFQUFFLE1BQU0sQ0FBQztRQUFDLGVBQWUsRUFBRSxNQUFNLENBQUM7UUFBQyxXQUFXLEVBQUUsTUFBTSxDQUFBO0tBQUUsQ0E0QnRHO0NBQ0YifQ==
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicGVlcl9zY29yaW5nLmQudHMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi9zcmMvc2VydmljZXMvcGVlci1tYW5hZ2VyL3BlZXJfc2NvcmluZy50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFFQSxPQUFPLEVBQUUsWUFBWSxFQUFFLE1BQU0seUJBQXlCLENBQUM7QUFDdkQsT0FBTyxFQUFFLGlCQUFpQixFQUFFLE1BQU0sbUJBQW1CLENBQUM7QUFDdEQsT0FBTyxFQUdMLEtBQUssZUFBZSxFQUlyQixNQUFNLHlCQUF5QixDQUFDO0FBRWpDLE9BQU8sS0FBSyxFQUFFLE1BQU0sRUFBRSxNQUFNLG1CQUFtQixDQUFDO0FBRWhELE9BQU8sS0FBSyxFQUFFLFNBQVMsRUFBRSxNQUFNLGlCQUFpQixDQUFDO0FBdUJqRCxvQkFBWSxjQUFjO0lBQ3hCLE1BQU0sSUFBQTtJQUNOLFVBQVUsSUFBQTtJQUNWLE9BQU8sSUFBQTtDQUNSO0FBb0JELHFCQUFhLFdBQVc7SUFzQnBCLE9BQU8sQ0FBQyxRQUFRLENBQUMsWUFBWTtJQXJCL0IsT0FBTyxDQUFDLE1BQU0sQ0FBb0M7SUFDbEQsT0FBTyxDQUFDLE1BQU0sQ0FBa0M7SUFDaEQsT0FBTyxDQUFDLGNBQWMsQ0FBa0M7SUFDeEQsT0FBTyxDQUFDLGFBQWEsQ0FBYTtJQUNsQyxPQUFPLENBQUMsV0FBVyxDQUFPO0lBQzFCLGFBQWEsRUFBRTtTQUFHLEdBQUcsSUFBSSxpQkFBaUIsR0FBRyxNQUFNO0tBQUUsQ0FBQztJQUV0RCxPQUFPLENBQUMsZ0JBQWdCLENBQWdCO0lBRXhDLDBGQUEwRjtJQUMxRixPQUFPLENBQUMsV0FBVyxDQUFxQztJQUN4RDs7OztPQUlHO0lBQ0gsT0FBTyxDQUFDLFFBQVEsQ0FBQyxhQUFhLENBQVM7SUFFdkMsWUFDRSxNQUFNLEVBQUUsU0FBUyxFQUNqQixTQUFTLEdBQUUsZUFBc0MsRUFDaEMsWUFBWSxHQUFFLFlBQWlDLEVBa0JqRTtJQUVNLFlBQVksQ0FBQyxNQUFNLEVBQUUsTUFBTSxFQUFFLE9BQU8sRUFBRSxpQkFBaUIsVUFNN0Q7SUFFRCxXQUFXLENBQUMsTUFBTSxFQUFFLE1BQU0sRUFBRSxVQUFVLEVBQUUsTUFBTSxHQUFHLE1BQU0sQ0FvQnREO0lBRUQ7Ozs7O09BS0c7SUFDSCxPQUFPLENBQUMsWUFBWTtJQWFwQixjQUFjLElBQUksSUFBSSxDQWlCckI7SUFFRDs7OztPQUlHO0lBQ0gsZ0JBQWdCLElBQUksSUFBSSxDQU12QjtJQUVELHlGQUF5RjtJQUN6RixjQUFjLElBQUksSUFBSSxDQUlyQjtJQUVELFVBQVUsQ0FBQyxNQUFNLEVBQUUsTUFBTSxHQUFHLElBQUksQ0FHL0I7SUFFRDs7OztPQUlHO0lBQ0gsT0FBTyxDQUFDLGlCQUFpQjtJQWF6QixRQUFRLENBQUMsTUFBTSxFQUFFLE1BQU0sR0FBRyxNQUFNLENBSS9CO0lBRU0sYUFBYSxDQUFDLE1BQU0sRUFBRSxNQUFNLEdBQUcsY0FBYyxDQVduRDtJQUVELFFBQVEsSUFBSTtRQUFFLFdBQVcsRUFBRSxNQUFNLENBQUM7UUFBQyxZQUFZLEVBQUUsTUFBTSxDQUFDO1FBQUMsZUFBZSxFQUFFLE1BQU0sQ0FBQztRQUFDLFdBQVcsRUFBRSxNQUFNLENBQUE7S0FBRSxDQThCdEc7Q0FDRiJ9