@aztec/p2p 0.0.1-commit.f2ce05ee → 0.0.1-commit.f5a9928

package/dest/services/reqresp/reqresp.js

@@ -371,30 +371,25 @@ function applyDecs2203RFactory() {
 function _apply_decs_2203_r(targetClass, memberDecs, classDecs, parentClass) {
     return (_apply_decs_2203_r = applyDecs2203RFactory())(targetClass, memberDecs, classDecs, parentClass);
 }
-var _dec, _dec1, _dec2, _initProto;
-import { compactArray } from '@aztec/foundation/collection';
+var _dec, _dec1, _initProto;
 import { AbortError, TimeoutError } from '@aztec/foundation/error';
 import { createLogger } from '@aztec/foundation/log';
 import { executeTimeout } from '@aztec/foundation/timer';
 import { PeerErrorSeverity } from '@aztec/stdlib/p2p';
 import { Attributes, getTelemetryClient, trackSpan } from '@aztec/telemetry-client';
 import { pipeline } from 'node:stream/promises';
-import { CollectiveReqRespTimeoutError, IndividualReqRespTimeoutError, InvalidResponseError } from '../../errors/reqresp.error.js';
-import { SnappyTransform } from '../encoding.js';
-import { DEFAULT_INDIVIDUAL_REQUEST_TIMEOUT_MS, DEFAULT_REQRESP_DIAL_TIMEOUT_MS } from './config.js';
-import { BatchConnectionSampler } from './connection-sampler/batch_connection_sampler.js';
+import { IndividualReqRespTimeoutError, OversizedReqRespRequestError } from '../../errors/reqresp.error.js';
+import { DEFAULT_MAX_RESPONSE_SIZE_KB, OversizedSnappyResponseError, ResponseSizeLimitExceededError, SnappyTransform } from '../encoding.js';
+import { DEFAULT_INDIVIDUAL_REQUEST_TIMEOUT_MS, DEFAULT_REQRESP_DIAL_TIMEOUT_MS, MAX_REQRESP_REQUEST_SIZE_BYTES } from './config.js';
 import { ConnectionSampler, RandomSampler } from './connection-sampler/connection_sampler.js';
-import { DEFAULT_SUB_PROTOCOL_VALIDATORS, ReqRespSubProtocol, responseFromBuffer } from './interface.js';
+import { ReqRespSubProtocol, UNAUTHENTICATED_ALLOWED_PROTOCOLS, subProtocolSizeCalculators } from './interface.js';
 import { ReqRespMetrics } from './metrics.js';
 import { RateLimitStatus, RequestResponseRateLimiter, prettyPrintRateLimitStatus } from './rate-limiter/rate_limiter.js';
-import { ReqRespStatus, ReqRespStatusError, parseStatusChunk, prettyPrintReqRespStatus } from './status.js';
-_dec = trackSpan('ReqResp.sendBatchRequest', (subProtocol, requests)=>({
-        [Attributes.P2P_REQ_RESP_PROTOCOL]: subProtocol,
-        [Attributes.P2P_REQ_RESP_BATCH_REQUESTS_COUNT]: requests.length
-    })), _dec1 = trackSpan('ReqResp.sendRequestToPeer', (peerId, subProtocol, _)=>({
+import { ReqRespStatus, ReqRespStatusError, parseStatusChunk } from './status.js';
+_dec = trackSpan('ReqResp.sendRequestToPeer', (peerId, subProtocol, _)=>({
         [Attributes.P2P_ID]: peerId.toString(),
         [Attributes.P2P_REQ_RESP_PROTOCOL]: subProtocol
-    })), _dec2 = trackSpan('ReqResp.streamHandler', (protocol, { connection })=>({
+    })), _dec1 = trackSpan('ReqResp.streamHandler', (protocol, { connection })=>({
         [Attributes.P2P_REQ_RESP_PROTOCOL]: protocol,
         [Attributes.P2P_ID]: connection.remotePeer.toString()
     }));
@@ -402,7 +397,7 @@ _dec = trackSpan('ReqResp.sendBatchRequest', (subProtocol, requests)=>({
  * The Request Response Service
  *
  * It allows nodes to request specific information from their peers, its use case covers recovering
- * information that was missed during a syncronisation or a gossip event.
+ * information that was missed during a synchronisation or a gossip event.
  *
  * This service implements the request response sub protocol, it is heavily inspired from
  * ethereum implementations of the same name.
@@ -420,15 +415,10 @@ _dec = trackSpan('ReqResp.sendBatchRequest', (subProtocol, requests)=>({
             [
                 _dec,
                 2,
-                "sendBatchRequest"
-            ],
-            [
-                _dec1,
-                2,
                 "sendRequestToPeer"
             ],
             [
-                _dec2,
+                _dec1,
                 2,
                 "streamHandler"
             ]
@@ -437,10 +427,10 @@ _dec = trackSpan('ReqResp.sendBatchRequest', (subProtocol, requests)=>({
     individualRequestTimeoutMs;
     dialTimeoutMs;
     subProtocolHandlers;
-    subProtocolValidators;
     connectionSampler;
     rateLimiter;
     snappyTransform;
+    shouldRejectPeer;
     metrics;
     constructor(config, libp2p, peerScoring, logger = createLogger('p2p:reqresp'), rateLimits = {}, telemetryClient = getTelemetryClient()){
         this.libp2p = libp2p;
@@ -449,7 +439,6 @@ _dec = trackSpan('ReqResp.sendBatchRequest', (subProtocol, requests)=>({
         this.individualRequestTimeoutMs = (_initProto(this), DEFAULT_INDIVIDUAL_REQUEST_TIMEOUT_MS);
         this.dialTimeoutMs = DEFAULT_REQRESP_DIAL_TIMEOUT_MS;
         this.subProtocolHandlers = {};
-        this.subProtocolValidators = {};
         this.updateConfig(config);
         this.rateLimiter = new RequestResponseRateLimiter(peerScoring, rateLimits);
         // Connection sampler is used to sample our connected peers
@@ -465,6 +454,9 @@ _dec = trackSpan('ReqResp.sendBatchRequest', (subProtocol, requests)=>({
             this.dialTimeoutMs = config.dialTimeoutMs;
         }
     }
+    setShouldRejectPeer(checker) {
+        this.shouldRejectPeer = checker;
+    }
     get tracer() {
         return this.metrics.tracer;
     }
@@ -475,19 +467,18 @@ _dec = trackSpan('ReqResp.sendBatchRequest', (subProtocol, requests)=>({
     }
     /**
    * Start the reqresp service
-   */ async start(subProtocolHandlers, subProtocolValidators) {
+   */ async start(subProtocolHandlers) {
         Object.assign(this.subProtocolHandlers, subProtocolHandlers);
-        Object.assign(this.subProtocolValidators, subProtocolValidators);
-        // Register all protocol handlers
+        // Register streamHandler with libp2p.
+        // The streamHandler is responsible for reading the incoming stream, determining the protocol, then triggering the appropriate handler.
         for (const subProtocol of Object.keys(subProtocolHandlers)){
             this.logger.debug(`Registering handler for sub protocol ${subProtocol}`);
             await this.libp2p.handle(subProtocol, (data)=>void this.streamHandler(subProtocol, data).catch((err)=>this.logger.error(`Error on libp2p subprotocol ${subProtocol} handler`, err)));
         }
         this.rateLimiter.start();
     }
-    async addSubProtocol(subProtocol, handler, validator = DEFAULT_SUB_PROTOCOL_VALIDATORS[subProtocol]) {
+    async addSubProtocol(subProtocol, handler) {
         this.subProtocolHandlers[subProtocol] = handler;
-        this.subProtocolValidators[subProtocol] = validator;
         this.logger.debug(`Registering handler for sub protocol ${subProtocol}`);
         await this.libp2p.handle(subProtocol, (data)=>void this.streamHandler(subProtocol, data).catch((err)=>this.logger.error(`Error on libp2p subprotocol ${subProtocol} handler`, err)));
     }
@@ -509,179 +500,6 @@ _dec = trackSpan('ReqResp.sendBatchRequest', (subProtocol, requests)=>({
     // NOTE: We assume libp2p instance is managed by the caller
     }
     /**
-   * Request multiple messages over the same sub protocol, balancing the requests across peers.
-   *
-   * @devnote
-   * - The function prioritizes sending requests to free peers using a batch sampling strategy.
-   * - If a peer fails to respond or returns an invalid response, it is removed from the sampling pool and replaced.
-   * - The function stops retrying once all requests are processed, no active peers remain, or the maximum retry attempts are reached.
-   * - Responses are validated using a custom validator for the sub-protocol.*
-   *
-   * Requests are sent in parallel to each peer, but multiple requests are sent to the same peer in series
-   * - If a peer fails to respond or returns an invalid response, it is removed from the sampling pool and replaced.
-   * - The function stops retrying once all requests are processed, no active peers remain, or the maximum retry attempts are reached.
-   * - Responses are validated using a custom validator for the sub-protocol.*
-   *
-   * @param subProtocol
-   * @param requests
-   * @param timeoutMs
-   * @param maxPeers
-   * @returns
-   *
-   * @throws {CollectiveReqRespTimeoutError} - If the request batch exceeds the specified timeout (`timeoutMs`).
-   */ async sendBatchRequest(subProtocol, requests, pinnedPeer, timeoutMs = 10000, maxPeers = Math.max(10, Math.ceil(requests.length / 3)), maxRetryAttempts = 3) {
-        const responseValidator = this.subProtocolValidators[subProtocol] ?? DEFAULT_SUB_PROTOCOL_VALIDATORS[subProtocol];
-        const responses = new Array(requests.length);
-        const requestBuffers = requests.map((req)=>req.toBuffer());
-        const isEmptyResponse = (value)=>{
-            // Some responses serialize to a non-empty buffer even when they contain no items (e.g., empty TxArray).
-            if (!value || typeof value !== 'object') {
-                return false;
-            }
-            const length = value.length;
-            return typeof length === 'number' && length === 0;
-        };
-        const requestFunction = async (signal)=>{
-            // Track which requests still need to be processed
-            const pendingRequestIndices = new Set(requestBuffers.map((_, i)=>i));
-            // Create batch sampler with the total number of requests and max peers
-            const batchSampler = new BatchConnectionSampler(this.connectionSampler, requests.length, maxPeers, compactArray([
-                pinnedPeer
-            ]), createLogger(`${this.logger.module}:batch-connection-sampler`));
-            if (batchSampler.activePeerCount === 0 && !pinnedPeer) {
-                this.logger.warn('No active peers to send requests to');
-                return [];
-            }
-            // This is where it gets fun
-            // The outer loop is the retry loop, we will continue to retry until we process all indices we have
-            // not received a response for, or we have reached the max retry attempts
-            // The inner loop is the batch loop, we will process all requests for each peer in parallel
-            // We will then process the results of the requests, and resample any peers that failed to respond
-            // We will continue to retry until we have processed all indices, or we have reached the max retry attempts
-            let retryAttempts = 0;
-            while(pendingRequestIndices.size > 0 && batchSampler.activePeerCount > 0 && retryAttempts < maxRetryAttempts){
-                if (signal.aborted) {
-                    throw new AbortError('Batch request aborted');
-                }
-                const requestBatches = new Map();
-                // Group requests by peer
-                for (const requestIndex of pendingRequestIndices){
-                    const peer = batchSampler.getPeerForRequest(requestIndex);
-                    if (!peer) {
-                        continue;
-                    }
-                    const peerAsString = peer.toString();
-                    if (!requestBatches.has(peerAsString)) {
-                        requestBatches.set(peerAsString, {
-                            peerId: peer,
-                            indices: []
-                        });
-                    }
-                    requestBatches.get(peerAsString).indices.push(requestIndex);
-                }
-                // If there is a pinned peer, we will always send every request to that peer
-                // We use the default limits for the subprotocol to avoid hitting the rate limiter
-                if (pinnedPeer) {
-                    const limit = this.rateLimiter.getRateLimits(subProtocol).peerLimit.quotaCount;
-                    requestBatches.set(pinnedPeer.toString(), {
-                        peerId: pinnedPeer,
-                        indices: Array.from(pendingRequestIndices.values()).slice(0, limit)
-                    });
-                }
-                // If no requests could be assigned (all peers exhausted for all indices), exit early
-                if (requestBatches.size === 0) {
-                    this.logger.warn('No peers available for any pending request indices, stopping batch request');
-                    break;
-                }
-                // Make parallel requests for each peer's batch
-                // A batch entry will look something like this:
-                // PeerId0: [0, 1, 2, 3]
-                // PeerId1: [4, 5, 6, 7]
-                // Peer Id 0 will send requests 0, 1, 2, 3 in serial
-                // while simultaneously Peer Id 1 will send requests 4, 5, 6, 7 in serial
-                const batchResults = await Promise.all(Array.from(requestBatches.entries()).map(async ([peerAsString, { peerId: peer, indices }])=>{
-                    try {
-                        const markIndexFailed = (index)=>batchSampler.markPeerFailedForIndex(peer, index);
-                        // Requests all going to the same peer are sent synchronously
-                        const peerResults = [];
-                        let shouldReplacePeer = false;
-                        const handleFailure = (status, index)=>{
-                            this.logger.warn(`Request to peer ${peerAsString} failed with status ${prettyPrintReqRespStatus(status)}`);
-                            markIndexFailed(index);
-                            return status === ReqRespStatus.RATE_LIMIT_EXCEEDED;
-                        };
-                        for (const index of indices){
-                            this.logger.info(`Sending request ${index} to peer ${peerAsString}`);
-                            const response = await this.sendRequestToPeer(peer, subProtocol, requestBuffers[index]);
-                            // Check the status of the response buffer
-                            if (response.status !== ReqRespStatus.SUCCESS) {
-                                shouldReplacePeer = handleFailure(response.status, index);
-                                if (shouldReplacePeer) {
-                                    break;
-                                }
-                                continue;
-                            }
-                            if (response.data.length === 0) {
-                                markIndexFailed(index);
-                                continue;
-                            }
-                            const object = responseFromBuffer(subProtocol, response.data);
-                            if (isEmptyResponse(object)) {
-                                markIndexFailed(index);
-                                continue;
-                            }
-                            const isValid = await responseValidator(requests[index], object, peer);
-                            if (!isValid) {
-                                markIndexFailed(index);
-                                continue;
-                            }
-                            peerResults.push({
-                                index,
-                                response: object
-                            });
-                        }
-                        // If peer had a hard failure (rate limit), replace it for future iterations
-                        if (shouldReplacePeer) {
-                            this.logger.warn(`Peer ${peerAsString} hit a hard failure, removing from sampler`);
-                            batchSampler.removePeerAndReplace(peer);
-                        }
-                        return {
-                            peer,
-                            results: peerResults
-                        };
-                    } catch (error) {
-                        this.logger.warn(`Failed batch request to peer ${peerAsString}:`, error);
-                        batchSampler.removePeerAndReplace(peer);
-                        return {
-                            peer,
-                            results: []
-                        };
-                    }
-                }));
-                // Process results
-                for (const { results } of batchResults){
-                    for (const { index, response } of results){
-                        if (response) {
-                            responses[index] = response;
-                            pendingRequestIndices.delete(index);
-                        }
-                    }
-                }
-                retryAttempts++;
-            }
-            if (retryAttempts >= maxRetryAttempts) {
-                this.logger.warn(`Max retry attempts ${maxRetryAttempts} reached for batch request`);
-            }
-            return responses;
-        };
-        try {
-            return await executeTimeout(requestFunction, timeoutMs, ()=>new CollectiveReqRespTimeoutError());
-        } catch (e) {
-            this.logger.warn(`${e.message} | subProtocol: ${subProtocol}`);
-            return [];
-        }
-    }
-    /**
    * Sends a request to a specific peer
    *
    * We first dial a particular protocol for the peer, this ensures that the peer knows
@@ -706,26 +524,34 @@ _dec = trackSpan('ReqResp.sendBatchRequest', (subProtocol, requests)=>({
    * If the stream is not closed by the dialled peer, and a timeout occurs, then
    * the stream is closed on the requester's end and sender (us) updates its peer score
    */ async sendRequestToPeer(peerId, subProtocol, payload, dialTimeout = this.dialTimeoutMs) {
+        // Thrown before the try block so the generic error handling below does not penalize the peer for our own bug.
+        if (payload.length > MAX_REQRESP_REQUEST_SIZE_BYTES) {
+            throw new OversizedReqRespRequestError(subProtocol, payload.length, MAX_REQRESP_REQUEST_SIZE_BYTES);
+        }
         let stream;
         try {
             this.metrics.recordRequestSent(subProtocol);
+            // Calculate expected response size based on the request payload
+            const expectedSizeKb = subProtocolSizeCalculators[subProtocol](payload);
             this.logger.trace(`Sending request to peer ${peerId.toString()} on sub protocol ${subProtocol}`);
             stream = await this.connectionSampler.dialProtocol(peerId, subProtocol, dialTimeout);
             this.logger.trace(`Opened stream ${stream.id} for sending request to peer ${peerId.toString()} on sub protocol ${subProtocol}`);
             const timeoutErr = new IndividualReqRespTimeoutError();
+            // Create a wrapper to pass the expected size to readMessage
+            const readMessageWithSizeLimit = (source)=>this.readMessage(source, expectedSizeKb);
             const [_, resp] = await executeTimeout((signal)=>Promise.all([
                     pipeline([
                         payload
                     ], stream.sink, {
                         signal
                     }),
-                    pipeline(stream.source, this.readMessage.bind(this), {
+                    pipeline(stream.source, readMessageWithSizeLimit, {
                         signal
                     })
                 ]), this.individualRequestTimeoutMs, ()=>timeoutErr);
             return resp;
         } catch (e) {
-            this.logger.warn(`SUBPROTOCOL: ${subProtocol}\n`, e);
+            this.logger.debug(`SUBPROTOCOL: ${subProtocol}\n`, e);
             // On error we immediately abort the stream, this is preferred way,
             // because it signals to the sender that error happened, whereas
             // closing the stream only closes our side and is much slower
@@ -773,13 +599,33 @@ _dec = trackSpan('ReqResp.sendBatchRequest', (subProtocol, requests)=>({
    * The message is split into two components
    * - The first chunk should contain a control byte, indicating the status of the response see `ReqRespStatus`
    * - The second chunk should contain the response data
-   */ async readMessage(source) {
+   *
+   * To bound memory usage we abort reception as soon as the accumulated compressed bytes exceed a
+   * bound derived from `maxSizeKb`, before the full stream has been buffered. Without this a peer we
+   * dialed could stream data up to the request timeout, forcing us to buffer arbitrarily much (the
+   * `maxSizeKb` guard in `inboundTransformData` only runs after the whole compressed payload is
+   * concatenated, so it does nothing to cap reception memory). Snappy can expand incompressible input
+   * to ~1.17x its size, so we allow 2x `maxSizeKb`: comfortably above the worst-case expansion of a
+   * legitimate max-size response, while still capping buffered memory at twice the permitted size.
+   *
+   * @param source - The async iterable source of data chunks
+   * @param maxSizeKb - Optional maximum expected size in KB for the decompressed response
+   */ async readMessage(source, maxSizeKb) {
         let status;
         const chunks = [];
+        const maxAccumulatedBytes = (maxSizeKb ?? DEFAULT_MAX_RESPONSE_SIZE_KB) * 1024 * 2;
+        let accumulatedBytes = 0;
         try {
             for await (const chunk of source){
                 const statusParsed = status !== undefined;
                 if (statusParsed) {
+                    // Use `byteLength` (the logical length) rather than `chunk.subarray().length`: calling
+                    // `subarray()` on a `Uint8ArrayList` consolidates its backing buffers into a single copy,
+                    // which would materialize the very chunk we are trying to reject.
+                    accumulatedBytes += chunk.byteLength;
+                    if (accumulatedBytes > maxAccumulatedBytes) {
+                        throw new ResponseSizeLimitExceededError(accumulatedBytes, maxAccumulatedBytes);
+                    }
                     chunks.push(chunk.subarray());
                     continue;
                 }
@@ -794,20 +640,16 @@ _dec = trackSpan('ReqResp.sendBatchRequest', (subProtocol, requests)=>({
                 }
             }
             const messageData = Buffer.concat(chunks);
-            const message = this.snappyTransform.inboundTransformData(messageData);
+            const message = this.snappyTransform.inboundTransformData(messageData, undefined, maxSizeKb);
             return {
                 status: status ?? ReqRespStatus.UNKNOWN,
                 data: message
             };
         } catch (e) {
+            // All errors (invalid status bytes, oversized snappy responses, corrupt data, etc.)
+            // are re-thrown so the caller can penalize the peer via handleResponseError.
             this.logger.debug(`Reading message failed: ${e.message}`);
-            let status = ReqRespStatus.UNKNOWN;
-            if (e instanceof ReqRespStatusError) {
-                status = e.status;
-            }
-            return {
-                status
-            };
+            throw e;
         }
     }
     /**
@@ -835,6 +677,11 @@ _dec = trackSpan('ReqResp.sendBatchRequest', (subProtocol, requests)=>({
                 this.logger.verbose(`Rate limit exceeded ${prettyPrintRateLimitStatus(rateLimitStatus)} for ${protocol} from ${connection.remotePeer}`);
                 throw new ReqRespStatusError(ReqRespStatus.RATE_LIMIT_EXCEEDED);
             }
+            // When p2pAllowOnlyValidators is enabled, reject unauthenticated peers on data protocols
+            if (!UNAUTHENTICATED_ALLOWED_PROTOCOLS.has(protocol) && (this.shouldRejectPeer?.(connection.remotePeer.toString()) ?? false)) {
+                this.logger.debug(`Rejecting unauthenticated peer ${connection.remotePeer} on gated protocol ${protocol}`);
+                throw new ReqRespStatusError(ReqRespStatus.FAILURE);
+            }
             await this.processStream(protocol, incomingStream);
         } catch (err) {
             this.metrics.recordResponseError(protocol);
@@ -855,7 +702,8 @@ _dec = trackSpan('ReqResp.sendBatchRequest', (subProtocol, requests)=>({
                 // and that this stream should be dropped
                 const isMessageToNotWarn = err instanceof Error && [
                     'stream reset',
-                    'Cannot push value onto an ended pushable'
+                    'Cannot push value onto an ended pushable',
+                    'read ECONNRESET'
                 ].some((msg)=>err.message.includes(msg));
                 const level = isMessageToNotWarn ? 'debug' : 'warn';
                 this.logger[level]('Unknown stream error while handling the stream, aborting', {
@@ -884,6 +732,9 @@ _dec = trackSpan('ReqResp.sendBatchRequest', (subProtocol, requests)=>({
         const snappy = this.snappyTransform;
         const SUCCESS = Uint8Array.of(ReqRespStatus.SUCCESS);
         await pipeline(stream.source, async function*(source) {
+            // Req/resp is one-request-one-response: an honest sender writes a single payload and half-closes.
+            // Process only the first chunk and return, so extra frames a peer queues on the same stream cannot
+            // drive further handler invocations that bypass the per-stream rate-limit check in streamHandler.
             for await (const chunk of source){
                 const response = await handler(connection.remotePeer, chunk.subarray());
                 if (protocol === ReqRespSubProtocol.GOODBYE) {
@@ -895,6 +746,7 @@ _dec = trackSpan('ReqResp.sendBatchRequest', (subProtocol, requests)=>({
                 stream.metadata.written = true; // Mark the stream as written to;
                 yield SUCCESS;
                 yield snappy.outboundTransformData(response);
+                return;
             }
         }, stream.sink);
     }
@@ -943,12 +795,12 @@ _dec = trackSpan('ReqResp.sendBatchRequest', (subProtocol, requests)=>({
             peerId: peerId.toString(),
             subProtocol
         };
-        //Punishable error - peer should never send badly formed request
+        // Punishable error - peer should never send badly formed request
         if (e instanceof ReqRespStatusError && e.status === ReqRespStatus.BADLY_FORMED_REQUEST) {
             this.logger.debug(`Punishable error in ${subProtocol}: ${e.cause}`, logTags);
             return PeerErrorSeverity.LowToleranceError;
         }
-        //TODO: (mralj): think if we should penalize peer here based on connection errors
+        // TODO: (mralj): think if we should penalize peer here based on connection errors
         return undefined;
     }
     /**
@@ -965,16 +817,30 @@ _dec = trackSpan('ReqResp.sendBatchRequest', (subProtocol, requests)=>({
             this.logger.debug('Error encountered on goodbye sub protocol, no penalty', logTags);
             return undefined;
         }
-        // We do not punish a collective timeout, as the node triggers this interupt, independent of the peer's behaviour
-        if (e instanceof CollectiveReqRespTimeoutError || e instanceof InvalidResponseError) {
-            this.logger.debug(`Non-punishable error in ${subProtocol}: ${e.message}`, logTags);
-            return undefined;
+        // Invalid status byte: the peer sent a status byte that doesn't match any known status code.
+        // This is a protocol violation, penalize harshly.
+        if (e instanceof ReqRespStatusError) {
+            this.logger.warn(`Invalid status byte from peer ${peerId.toString()} in ${subProtocol}: ${e.message}`, logTags);
+            return PeerErrorSeverity.LowToleranceError;
+        }
+        // Oversized snappy response: the peer is sending data that exceeds the allowed size.
+        // This is a protocol violation that wastes bandwidth, so penalize harshly.
+        if (e instanceof OversizedSnappyResponseError) {
+            this.logger.warn(`Oversized response from peer ${peerId.toString()} in ${subProtocol}: ${e.message}`, logTags);
+            return PeerErrorSeverity.LowToleranceError;
+        }
+        // Response exceeded the reception buffer bound: the peer streamed more compressed data than the
+        // per-request size limit allows. Same protocol violation as above, penalize harshly.
+        if (e instanceof ResponseSizeLimitExceededError) {
+            this.logger.warn(`Oversized response from peer ${peerId.toString()} in ${subProtocol}: ${e.message}`, logTags);
+            return PeerErrorSeverity.LowToleranceError;
         }
         return this.categorizeConnectionErrors(e, peerId, subProtocol);
     }
     /*
    * Errors specific to connection  handling
-   * These can happen  both when sending request and response*/ categorizeConnectionErrors(e, peerId, subProtocol) {
+   * These can happen  both when sending request and response.
+   */ categorizeConnectionErrors(e, peerId, subProtocol) {
         const logTags = {
             peerId: peerId.toString(),
             subProtocol

package/dest/services/service.d.ts

@@ -1,7 +1,7 @@
 import type { SlotNumber } from '@aztec/foundation/branded-types';
 import type { EthAddress } from '@aztec/foundation/eth-address';
-import type { PeerInfo } from '@aztec/stdlib/interfaces/server';
-import type { BlockProposal, CheckpointAttestation, CheckpointProposalCore, Gossipable } from '@aztec/stdlib/p2p';
+import type { P2PConnectivity, PeerInfo } from '@aztec/stdlib/interfaces/server';
+import type { CheckpointAttestation, Gossipable, TopicType, ValidatedBlockProposal, ValidatedCheckpointProposalCore } from '@aztec/stdlib/p2p';
 import type { Tx } from '@aztec/stdlib/tx';
 import type { PeerId } from '@libp2p/interface';
 import type { ENR } from '@nethermindeth/enr';
@@ -9,7 +9,7 @@ import type EventEmitter from 'events';
 import type { BatchTxRequesterLibP2PService } from './reqresp/batch-tx-requester/interface.js';
 import type { P2PReqRespConfig } from './reqresp/config.js';
 import type { StatusMessage } from './reqresp/index.js';
-import type { ReqRespSubProtocol, ReqRespSubProtocolHandler, ReqRespSubProtocolValidators, SubProtocolMap } from './reqresp/interface.js';
+import type { ReqRespSubProtocol, ReqRespSubProtocolHandler } from './reqresp/interface.js';
 import type { AuthRequest, AuthResponse } from './reqresp/protocols/auth.js';
 export declare enum PeerDiscoveryState {
     RUNNING = "running",
@@ -18,16 +18,19 @@ export declare enum PeerDiscoveryState {
 /**
  * Callback for when a block proposal is received.
  * Validators validate but DO NOT attest to individual blocks - attestations are only for checkpoints.
+ * The proposal is passed as a ValidatedBlockProposal: it has already passed p2p ingress validation, and
+ * consumers are not expected to repeat it.
  * @returns true if the proposal is valid, false otherwise
  */
-export type P2PBlockReceivedCallback = (block: BlockProposal, sender: PeerId) => Promise<boolean>;
+export type P2PBlockReceivedCallback = (block: ValidatedBlockProposal, sender: PeerId) => Promise<boolean>;
 /**
  * Callback for when a checkpoint proposal is received.
- * The checkpoint proposal is passed as CheckpointProposalCore (without lastBlock) since
+ * The checkpoint proposal is passed as ValidatedCheckpointProposalCore (without lastBlock) since
  * the lastBlock is extracted and stored separately as a BlockProposal, and the block
- * callback is invoked and awaited before this checkpoint callback.
+ * callback is invoked and awaited before this checkpoint callback. As with block proposals, it has already
+ * passed p2p ingress validation.
  */
-export type P2PCheckpointReceivedCallback = (checkpoint: CheckpointProposalCore, sender: PeerId) => Promise<CheckpointAttestation[] | undefined>;
+export type P2PCheckpointReceivedCallback = (checkpoint: ValidatedCheckpointProposalCore, sender: PeerId) => Promise<CheckpointAttestation[] | undefined>;
 export type AuthReceivedCallback = (peerId: PeerId, authRequest: AuthRequest) => Promise<AuthResponse | undefined>;
 /** Minimal info passed to the duplicate proposal callback. */
 export type DuplicateProposalInfo = {
@@ -40,6 +43,29 @@ export type DuplicateProposalInfo = {
  * Invoked on the first duplicate (when count goes from 1 to 2).
  */
 export type P2PDuplicateProposalCallback = (info: DuplicateProposalInfo) => void;
+/** Minimal info passed to the oversized proposal callback. */
+export type OversizedProposalInfo = {
+    slot: SlotNumber;
+    proposer: EthAddress;
+};
+/**
+ * Callback for when a block proposal whose index lands at or beyond the consensus per-checkpoint block
+ * limit is stored and re-broadcast as slashing evidence. May fire multiple times per (slot, proposer)
+ * if the proposer signed several oversized proposals; consumers are expected to dedup.
+ */
+export type P2POversizedProposalCallback = (info: OversizedProposalInfo) => void;
+/** Minimal info passed to the duplicate attestation callback. */
+export type DuplicateAttestationInfo = {
+    slot: SlotNumber;
+    attester: EthAddress;
+};
+/**
+ * Callback for when a duplicate attestation is detected (equivocation).
+ * A validator signing attestations for different proposals at the same slot.
+ * Invoked on the first duplicate (when count goes from 1 to 2).
+ */
+export type P2PDuplicateAttestationCallback = (info: DuplicateAttestationInfo) => void;
+export type P2PCheckpointAttestationCallback = (attestation: CheckpointAttestation) => void;
 /**
  * The interface for a P2P service implementation.
  */
@@ -59,25 +85,41 @@ export interface P2PService {
      * @param message - The message to be propagated.
      */
     propagate<T extends Gossipable>(message: T): Promise<void>;
-    /**
-     * Send a batch of requests to peers, and return the responses
-     *
-     * @param protocol - The request response protocol to use
-     * @param requests - The requests to send to the peers
-     * @returns The responses to the requests
-     */
-    sendBatchRequest<Protocol extends ReqRespSubProtocol>(protocol: Protocol, requests: InstanceType<SubProtocolMap[Protocol]['request']>[], pinnedPeerId?: PeerId, timeoutMs?: number, maxPeers?: number, maxRetryAttempts?: number): Promise<InstanceType<SubProtocolMap[Protocol]['response']>[]>;
     registerBlockReceivedCallback(callback: P2PBlockReceivedCallback): void;
-    registerCheckpointReceivedCallback(callback: P2PCheckpointReceivedCallback): void;
+    registerValidatorCheckpointReceivedCallback(callback: P2PCheckpointReceivedCallback): void;
+    registerAllNodesCheckpointReceivedCallback(callback: P2PCheckpointReceivedCallback): void;
     /**
      * Registers a callback invoked when a duplicate proposal is detected (equivocation).
      * The callback is triggered on the first duplicate (when count goes from 1 to 2).
      */
     registerDuplicateProposalCallback(callback: P2PDuplicateProposalCallback): void;
+    /**
+     * Registers a callback invoked when an oversized block proposal (index at or beyond the consensus
+     * per-checkpoint block limit) is stored and re-broadcast as slashing evidence.
+     */
+    registerOversizedProposalCallback(callback: P2POversizedProposalCallback): void;
+    /**
+     * Registers a callback invoked when a duplicate attestation is detected (equivocation).
+     * A validator signing attestations for different proposals at the same slot.
+     * The callback is triggered on the first duplicate (when count goes from 1 to 2).
+     */
+    registerDuplicateAttestationCallback(callback: P2PDuplicateAttestationCallback): void;
+    registerCheckpointAttestationCallback(callback: P2PCheckpointAttestationCallback): void;
     getEnr(): ENR | undefined;
     getPeers(includePending?: boolean): PeerInfo[];
-    validate(txs: Tx[]): Promise<void>;
-    addReqRespSubProtocol(subProtocol: ReqRespSubProtocol, handler: ReqRespSubProtocolHandler, validator?: ReqRespSubProtocolValidators[ReqRespSubProtocol]): Promise<void>;
+    /**
+     * Returns whether this p2p service is a real p2p stack, and how many peers it is currently connected to.
+     * Implementations that do not run p2p at all report `enabled: false`.
+     */
+    getP2PConnectivity(): P2PConnectivity;
+    /** Returns the number of peers in the GossipSub mesh for a given topic type. */
+    getGossipMeshPeerCount(topicType: TopicType): number;
+    /**
+     * Runs minimum integrity validation on txs carried in a block proposal.
+     * @throws InvalidBlockProposalTxsError - If any tx fails validation.
+     */
+    validateTxsReceivedInBlockProposal(txs: Tx[]): Promise<void>;
+    addReqRespSubProtocol(subProtocol: ReqRespSubProtocol, handler: ReqRespSubProtocolHandler): Promise<void>;
     handleAuthRequestFromPeer(authRequest: AuthRequest, peerId: PeerId): Promise<StatusMessage>;
     updateConfig(config: Partial<P2PReqRespConfig>): void;
     /** If node running this P2P stack is validator, passes in validator address to P2P layer */
@@ -117,8 +159,10 @@ export interface PeerDiscoveryService extends EventEmitter {
      */
     on(event: 'peer:discovered', listener: (enr: ENR) => void): this;
     emit(event: 'peer:discovered', enr: ENR): boolean;
+    on(event: 'ip:changed', listener: (ip: string) => void): this;
+    emit(event: 'ip:changed', ip: string): boolean;
     getStatus(): PeerDiscoveryState;
     getEnr(): ENR | undefined;
     bootstrapNodeEnrs: ENR[];
 }
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic2VydmljZS5kLnRzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc3JjL3NlcnZpY2VzL3NlcnZpY2UudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxLQUFLLEVBQUUsVUFBVSxFQUFFLE1BQU0saUNBQWlDLENBQUM7QUFDbEUsT0FBTyxLQUFLLEVBQUUsVUFBVSxFQUFFLE1BQU0sK0JBQStCLENBQUM7QUFDaEUsT0FBTyxLQUFLLEVBQUUsUUFBUSxFQUFFLE1BQU0saUNBQWlDLENBQUM7QUFDaEUsT0FBTyxLQUFLLEVBQUUsYUFBYSxFQUFFLHFCQUFxQixFQUFFLHNCQUFzQixFQUFFLFVBQVUsRUFBRSxNQUFNLG1CQUFtQixDQUFDO0FBQ2xILE9BQU8sS0FBSyxFQUFFLEVBQUUsRUFBRSxNQUFNLGtCQUFrQixDQUFDO0FBRTNDLE9BQU8sS0FBSyxFQUFFLE1BQU0sRUFBRSxNQUFNLG1CQUFtQixDQUFDO0FBQ2hELE9BQU8sS0FBSyxFQUFFLEdBQUcsRUFBRSxNQUFNLG9CQUFvQixDQUFDO0FBQzlDLE9BQU8sS0FBSyxZQUFZLE1BQU0sUUFBUSxDQUFDO0FBRXZDLE9BQU8sS0FBSyxFQUFFLDZCQUE2QixFQUFFLE1BQU0sMkNBQTJDLENBQUM7QUFDL0YsT0FBTyxLQUFLLEVBQUUsZ0JBQWdCLEVBQUUsTUFBTSxxQkFBcUIsQ0FBQztBQUM1RCxPQUFPLEtBQUssRUFBRSxhQUFhLEVBQUUsTUFBTSxvQkFBb0IsQ0FBQztBQUN4RCxPQUFPLEtBQUssRUFDVixrQkFBa0IsRUFDbEIseUJBQXlCLEVBQ3pCLDRCQUE0QixFQUM1QixjQUFjLEVBQ2YsTUFBTSx3QkFBd0IsQ0FBQztBQUNoQyxPQUFPLEtBQUssRUFBRSxXQUFXLEVBQUUsWUFBWSxFQUFFLE1BQU0sNkJBQTZCLENBQUM7QUFFN0Usb0JBQVksa0JBQWtCO0lBQzVCLE9BQU8sWUFBWTtJQUNuQixPQUFPLFlBQVk7Q0FDcEI7QUFFRDs7OztHQUlHO0FBQ0gsTUFBTSxNQUFNLHdCQUF3QixHQUFHLENBQUMsS0FBSyxFQUFFLGFBQWEsRUFBRSxNQUFNLEVBQUUsTUFBTSxLQUFLLE9BQU8sQ0FBQyxPQUFPLENBQUMsQ0FBQztBQUVsRzs7Ozs7R0FLRztBQUNILE1BQU0sTUFBTSw2QkFBNkIsR0FBRyxDQUMxQyxVQUFVLEVBQUUsc0JBQXNCLEVBQ2xDLE1BQU0sRUFBRSxNQUFNLEtBQ1gsT0FBTyxDQUFDLHFCQUFxQixFQUFFLEdBQUcsU0FBUyxDQUFDLENBQUM7QUFFbEQsTUFBTSxNQUFNLG9CQUFvQixHQUFHLENBQUMsTUFBTSxFQUFFLE1BQU0sRUFBRSxXQUFXLEVBQUUsV0FBVyxLQUFLLE9BQU8sQ0FBQyxZQUFZLEdBQUcsU0FBUyxDQUFDLENBQUM7QUFFbkgsOERBQThEO0FBQzlELE1BQU0sTUFBTSxxQkFBcUIsR0FBRztJQUNsQyxJQUFJLEVBQUUsVUFBVSxDQUFDO0lBQ2pCLFFBQVEsRUFBRSxVQUFVLENBQUM7SUFDckIsSUFBSSxFQUFFLFlBQVksR0FBRyxPQUFPLENBQUM7Q0FDOUIsQ0FBQztBQUVGOzs7R0FHRztBQUNILE1BQU0sTUFBTSw0QkFBNEIsR0FBRyxDQUFDLElBQUksRUFBRSxxQkFBcUIsS0FBSyxJQUFJLENBQUM7QUFFakY7O0dBRUc7QUFDSCxNQUFNLFdBQVcsVUFBVTtJQUN6Qjs7O09BR0c7SUFDSCxLQUFLLElBQUksT0FBTyxDQUFDLElBQUksQ0FBQyxDQUFDO0lBRXZCOzs7T0FHRztJQUNILElBQUksSUFBSSxPQUFPLENBQUMsSUFBSSxDQUFDLENBQUM7SUFFdEI7OztPQUdHO0lBQ0gsU0FBUyxDQUFDLENBQUMsU0FBUyxVQUFVLEVBQUUsT0FBTyxFQUFFLENBQUMsR0FBRyxPQUFPLENBQUMsSUFBSSxDQUFDLENBQUM7SUFFM0Q7Ozs7OztPQU1HO0lBQ0gsZ0JBQWdCLENBQUMsUUFBUSxTQUFTLGtCQUFrQixFQUNsRCxRQUFRLEVBQUUsUUFBUSxFQUNsQixRQUFRLEVBQUUsWUFBWSxDQUFDLGNBQWMsQ0FBQyxRQUFRLENBQUMsQ0FBQyxTQUFTLENBQUMsQ0FBQyxFQUFFLEVBQzdELFlBQVksQ0FBQyxFQUFFLE1BQU0sRUFDckIsU0FBUyxDQUFDLEVBQUUsTUFBTSxFQUNsQixRQUFRLENBQUMsRUFBRSxNQUFNLEVBQ2pCLGdCQUFnQixDQUFDLEVBQUUsTUFBTSxHQUN4QixPQUFPLENBQUMsWUFBWSxDQUFDLGNBQWMsQ0FBQyxRQUFRLENBQUMsQ0FBQyxVQUFVLENBQUMsQ0FBQyxFQUFFLENBQUMsQ0FBQztJQUdqRSw2QkFBNkIsQ0FBQyxRQUFRLEVBQUUsd0JBQXdCLEdBQUcsSUFBSSxDQUFDO0lBRXhFLGtDQUFrQyxDQUFDLFFBQVEsRUFBRSw2QkFBNkIsR0FBRyxJQUFJLENBQUM7SUFFbEY7OztPQUdHO0lBQ0gsaUNBQWlDLENBQUMsUUFBUSxFQUFFLDRCQUE0QixHQUFHLElBQUksQ0FBQztJQUVoRixNQUFNLElBQUksR0FBRyxHQUFHLFNBQVMsQ0FBQztJQUUxQixRQUFRLENBQUMsY0FBYyxDQUFDLEVBQUUsT0FBTyxHQUFHLFFBQVEsRUFBRSxDQUFDO0lBRS9DLFFBQVEsQ0FBQyxHQUFHLEVBQUUsRUFBRSxFQUFFLEdBQUcsT0FBTyxDQUFDLElBQUksQ0FBQyxDQUFDO0lBRW5DLHFCQUFxQixDQUNuQixXQUFXLEVBQUUsa0JBQWtCLEVBQy9CLE9BQU8sRUFBRSx5QkFBeUIsRUFDbEMsU0FBUyxDQUFDLEVBQUUsNEJBQTRCLENBQUMsa0JBQWtCLENBQUMsR0FDM0QsT0FBTyxDQUFDLElBQUksQ0FBQyxDQUFDO0lBRWpCLHlCQUF5QixDQUFDLFdBQVcsRUFBRSxXQUFXLEVBQUUsTUFBTSxFQUFFLE1BQU0sR0FBRyxPQUFPLENBQUMsYUFBYSxDQUFDLENBQUM7SUFFNUYsWUFBWSxDQUFDLE1BQU0sRUFBRSxPQUFPLENBQUMsZ0JBQWdCLENBQUMsR0FBRyxJQUFJLENBQUM7SUFFdEQsNEZBQTRGO0lBQzVGLDhCQUE4QixDQUFDLE9BQU8sRUFBRSxVQUFVLEVBQUUsR0FBRyxJQUFJLENBQUM7SUFFNUQsZ0RBQWdEO0lBQ2hELDBCQUEwQixJQUFJLDZCQUE2QixDQUFDO0NBQzdEO0FBRUQ7O0dBRUc7QUFDSCxNQUFNLFdBQVcsb0JBQXFCLFNBQVEsWUFBWTtJQUN4RDs7U0FFSztJQUNMLEtBQUssSUFBSSxPQUFPLENBQUMsSUFBSSxDQUFDLENBQUM7SUFFdkI7O1NBRUs7SUFDTCxJQUFJLElBQUksT0FBTyxDQUFDLElBQUksQ0FBQyxDQUFDO0lBRXRCOzs7T0FHRztJQUNILFlBQVksSUFBSSxHQUFHLEVBQUUsQ0FBQztJQUV0Qjs7T0FFRztJQUNILG1CQUFtQixJQUFJLE9BQU8sQ0FBQyxJQUFJLENBQUMsQ0FBQztJQUVyQzs7OztPQUlHO0lBQ0gsZUFBZSxDQUFDLE1BQU0sRUFBRSxNQUFNLEdBQUcsT0FBTyxDQUFDO0lBRXpDOztPQUVHO0lBQ0gsRUFBRSxDQUFDLEtBQUssRUFBRSxpQkFBaUIsRUFBRSxRQUFRLEVBQUUsQ0FBQyxHQUFHLEVBQUUsR0FBRyxLQUFLLElBQUksR0FBRyxJQUFJLENBQUM7SUFDakUsSUFBSSxDQUFDLEtBQUssRUFBRSxpQkFBaUIsRUFBRSxHQUFHLEVBQUUsR0FBRyxHQUFHLE9BQU8sQ0FBQztJQUVsRCxTQUFTLElBQUksa0JBQWtCLENBQUM7SUFFaEMsTUFBTSxJQUFJLEdBQUcsR0FBRyxTQUFTLENBQUM7SUFFMUIsaUJBQWlCLEVBQUUsR0FBRyxFQUFFLENBQUM7Q0FDMUIifQ==
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic2VydmljZS5kLnRzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc3JjL3NlcnZpY2VzL3NlcnZpY2UudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxLQUFLLEVBQUUsVUFBVSxFQUFFLE1BQU0saUNBQWlDLENBQUM7QUFDbEUsT0FBTyxLQUFLLEVBQUUsVUFBVSxFQUFFLE1BQU0sK0JBQStCLENBQUM7QUFDaEUsT0FBTyxLQUFLLEVBQUUsZUFBZSxFQUFFLFFBQVEsRUFBRSxNQUFNLGlDQUFpQyxDQUFDO0FBQ2pGLE9BQU8sS0FBSyxFQUNWLHFCQUFxQixFQUNyQixVQUFVLEVBQ1YsU0FBUyxFQUNULHNCQUFzQixFQUN0QiwrQkFBK0IsRUFDaEMsTUFBTSxtQkFBbUIsQ0FBQztBQUMzQixPQUFPLEtBQUssRUFBRSxFQUFFLEVBQUUsTUFBTSxrQkFBa0IsQ0FBQztBQUUzQyxPQUFPLEtBQUssRUFBRSxNQUFNLEVBQUUsTUFBTSxtQkFBbUIsQ0FBQztBQUNoRCxPQUFPLEtBQUssRUFBRSxHQUFHLEVBQUUsTUFBTSxvQkFBb0IsQ0FBQztBQUM5QyxPQUFPLEtBQUssWUFBWSxNQUFNLFFBQVEsQ0FBQztBQUV2QyxPQUFPLEtBQUssRUFBRSw2QkFBNkIsRUFBRSxNQUFNLDJDQUEyQyxDQUFDO0FBQy9GLE9BQU8sS0FBSyxFQUFFLGdCQUFnQixFQUFFLE1BQU0scUJBQXFCLENBQUM7QUFDNUQsT0FBTyxLQUFLLEVBQUUsYUFBYSxFQUFFLE1BQU0sb0JBQW9CLENBQUM7QUFDeEQsT0FBTyxLQUFLLEVBQUUsa0JBQWtCLEVBQUUseUJBQXlCLEVBQUUsTUFBTSx3QkFBd0IsQ0FBQztBQUM1RixPQUFPLEtBQUssRUFBRSxXQUFXLEVBQUUsWUFBWSxFQUFFLE1BQU0sNkJBQTZCLENBQUM7QUFFN0Usb0JBQVksa0JBQWtCO0lBQzVCLE9BQU8sWUFBWTtJQUNuQixPQUFPLFlBQVk7Q0FDcEI7QUFFRDs7Ozs7O0dBTUc7QUFDSCxNQUFNLE1BQU0sd0JBQXdCLEdBQUcsQ0FBQyxLQUFLLEVBQUUsc0JBQXNCLEVBQUUsTUFBTSxFQUFFLE1BQU0sS0FBSyxPQUFPLENBQUMsT0FBTyxDQUFDLENBQUM7QUFFM0c7Ozs7OztHQU1HO0FBQ0gsTUFBTSxNQUFNLDZCQUE2QixHQUFHLENBQzFDLFVBQVUsRUFBRSwrQkFBK0IsRUFDM0MsTUFBTSxFQUFFLE1BQU0sS0FDWCxPQUFPLENBQUMscUJBQXFCLEVBQUUsR0FBRyxTQUFTLENBQUMsQ0FBQztBQUVsRCxNQUFNLE1BQU0sb0JBQW9CLEdBQUcsQ0FBQyxNQUFNLEVBQUUsTUFBTSxFQUFFLFdBQVcsRUFBRSxXQUFXLEtBQUssT0FBTyxDQUFDLFlBQVksR0FBRyxTQUFTLENBQUMsQ0FBQztBQUVuSCw4REFBOEQ7QUFDOUQsTUFBTSxNQUFNLHFCQUFxQixHQUFHO0lBQ2xDLElBQUksRUFBRSxVQUFVLENBQUM7SUFDakIsUUFBUSxFQUFFLFVBQVUsQ0FBQztJQUNyQixJQUFJLEVBQUUsWUFBWSxHQUFHLE9BQU8sQ0FBQztDQUM5QixDQUFDO0FBRUY7OztHQUdHO0FBQ0gsTUFBTSxNQUFNLDRCQUE0QixHQUFHLENBQUMsSUFBSSxFQUFFLHFCQUFxQixLQUFLLElBQUksQ0FBQztBQUVqRiw4REFBOEQ7QUFDOUQsTUFBTSxNQUFNLHFCQUFxQixHQUFHO0lBQ2xDLElBQUksRUFBRSxVQUFVLENBQUM7SUFDakIsUUFBUSxFQUFFLFVBQVUsQ0FBQztDQUN0QixDQUFDO0FBRUY7Ozs7R0FJRztBQUNILE1BQU0sTUFBTSw0QkFBNEIsR0FBRyxDQUFDLElBQUksRUFBRSxxQkFBcUIsS0FBSyxJQUFJLENBQUM7QUFFakYsaUVBQWlFO0FBQ2pFLE1BQU0sTUFBTSx3QkFBd0IsR0FBRztJQUNyQyxJQUFJLEVBQUUsVUFBVSxDQUFDO0lBQ2pCLFFBQVEsRUFBRSxVQUFVLENBQUM7Q0FDdEIsQ0FBQztBQUVGOzs7O0dBSUc7QUFDSCxNQUFNLE1BQU0sK0JBQStCLEdBQUcsQ0FBQyxJQUFJLEVBQUUsd0JBQXdCLEtBQUssSUFBSSxDQUFDO0FBRXZGLE1BQU0sTUFBTSxnQ0FBZ0MsR0FBRyxDQUFDLFdBQVcsRUFBRSxxQkFBcUIsS0FBSyxJQUFJLENBQUM7QUFFNUY7O0dBRUc7QUFDSCxNQUFNLFdBQVcsVUFBVTtJQUN6Qjs7O09BR0c7SUFDSCxLQUFLLElBQUksT0FBTyxDQUFDLElBQUksQ0FBQyxDQUFDO0lBRXZCOzs7T0FHRztJQUNILElBQUksSUFBSSxPQUFPLENBQUMsSUFBSSxDQUFDLENBQUM7SUFFdEI7OztPQUdHO0lBQ0gsU0FBUyxDQUFDLENBQUMsU0FBUyxVQUFVLEVBQUUsT0FBTyxFQUFFLENBQUMsR0FBRyxPQUFPLENBQUMsSUFBSSxDQUFDLENBQUM7SUFHM0QsNkJBQTZCLENBQUMsUUFBUSxFQUFFLHdCQUF3QixHQUFHLElBQUksQ0FBQztJQUV4RSwyQ0FBMkMsQ0FBQyxRQUFRLEVBQUUsNkJBQTZCLEdBQUcsSUFBSSxDQUFDO0lBRTNGLDBDQUEwQyxDQUFDLFFBQVEsRUFBRSw2QkFBNkIsR0FBRyxJQUFJLENBQUM7SUFFMUY7OztPQUdHO0lBQ0gsaUNBQWlDLENBQUMsUUFBUSxFQUFFLDRCQUE0QixHQUFHLElBQUksQ0FBQztJQUVoRjs7O09BR0c7SUFDSCxpQ0FBaUMsQ0FBQyxRQUFRLEVBQUUsNEJBQTRCLEdBQUcsSUFBSSxDQUFDO0lBRWhGOzs7O09BSUc7SUFDSCxvQ0FBb0MsQ0FBQyxRQUFRLEVBQUUsK0JBQStCLEdBQUcsSUFBSSxDQUFDO0lBRXRGLHFDQUFxQyxDQUFDLFFBQVEsRUFBRSxnQ0FBZ0MsR0FBRyxJQUFJLENBQUM7SUFFeEYsTUFBTSxJQUFJLEdBQUcsR0FBRyxTQUFTLENBQUM7SUFFMUIsUUFBUSxDQUFDLGNBQWMsQ0FBQyxFQUFFLE9BQU8sR0FBRyxRQUFRLEVBQUUsQ0FBQztJQUUvQzs7O09BR0c7SUFDSCxrQkFBa0IsSUFBSSxlQUFlLENBQUM7SUFFdEMsZ0ZBQWdGO0lBQ2hGLHNCQUFzQixDQUFDLFNBQVMsRUFBRSxTQUFTLEdBQUcsTUFBTSxDQUFDO0lBRXJEOzs7T0FHRztJQUNILGtDQUFrQyxDQUFDLEdBQUcsRUFBRSxFQUFFLEVBQUUsR0FBRyxPQUFPLENBQUMsSUFBSSxDQUFDLENBQUM7SUFFN0QscUJBQXFCLENBQUMsV0FBVyxFQUFFLGtCQUFrQixFQUFFLE9BQU8sRUFBRSx5QkFBeUIsR0FBRyxPQUFPLENBQUMsSUFBSSxDQUFDLENBQUM7SUFFMUcseUJBQXlCLENBQUMsV0FBVyxFQUFFLFdBQVcsRUFBRSxNQUFNLEVBQUUsTUFBTSxHQUFHLE9BQU8sQ0FBQyxhQUFhLENBQUMsQ0FBQztJQUU1RixZQUFZLENBQUMsTUFBTSxFQUFFLE9BQU8sQ0FBQyxnQkFBZ0IsQ0FBQyxHQUFHLElBQUksQ0FBQztJQUV0RCw0RkFBNEY7SUFDNUYsOEJBQThCLENBQUMsT0FBTyxFQUFFLFVBQVUsRUFBRSxHQUFHLElBQUksQ0FBQztJQUU1RCxnREFBZ0Q7SUFDaEQsMEJBQTBCLElBQUksNkJBQTZCLENBQUM7Q0FDN0Q7QUFFRDs7R0FFRztBQUNILE1BQU0sV0FBVyxvQkFBcUIsU0FBUSxZQUFZO0lBQ3hEOztTQUVLO0lBQ0wsS0FBSyxJQUFJLE9BQU8sQ0FBQyxJQUFJLENBQUMsQ0FBQztJQUV2Qjs7U0FFSztJQUNMLElBQUksSUFBSSxPQUFPLENBQUMsSUFBSSxDQUFDLENBQUM7SUFFdEI7OztPQUdHO0lBQ0gsWUFBWSxJQUFJLEdBQUcsRUFBRSxDQUFDO0lBRXRCOztPQUVHO0lBQ0gsbUJBQW1CLElBQUksT0FBTyxDQUFDLElBQUksQ0FBQyxDQUFDO0lBRXJDOzs7O09BSUc7SUFDSCxlQUFlLENBQUMsTUFBTSxFQUFFLE1BQU0sR0FBRyxPQUFPLENBQUM7SUFFekM7O09BRUc7SUFDSCxFQUFFLENBQUMsS0FBSyxFQUFFLGlCQUFpQixFQUFFLFFBQVEsRUFBRSxDQUFDLEdBQUcsRUFBRSxHQUFHLEtBQUssSUFBSSxHQUFHLElBQUksQ0FBQztJQUNqRSxJQUFJLENBQUMsS0FBSyxFQUFFLGlCQUFpQixFQUFFLEdBQUcsRUFBRSxHQUFHLEdBQUcsT0FBTyxDQUFDO0lBRWxELEVBQUUsQ0FBQyxLQUFLLEVBQUUsWUFBWSxFQUFFLFFBQVEsRUFBRSxDQUFDLEVBQUUsRUFBRSxNQUFNLEtBQUssSUFBSSxHQUFHLElBQUksQ0FBQztJQUM5RCxJQUFJLENBQUMsS0FBSyxFQUFFLFlBQVksRUFBRSxFQUFFLEVBQUUsTUFBTSxHQUFHLE9BQU8sQ0FBQztJQUUvQyxTQUFTLElBQUksa0JBQWtCLENBQUM7SUFFaEMsTUFBTSxJQUFJLEdBQUcsR0FBRyxTQUFTLENBQUM7SUFFMUIsaUJBQWlCLEVBQUUsR0FBRyxFQUFFLENBQUM7Q0FDMUIifQ==