@hsuite/smart-engines-cli 1.0.0 → 1.0.1

package/dist/libs/infrastructure/src/messaging/event-bus.service.js

@@ -1,797 +0,0 @@
-"use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
-    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-    return c > 3 && r && Object.defineProperty(target, key, r), r;
-};
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-var __metadata = (this && this.__metadata) || function (k, v) {
-    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-};
-var EventBusService_1;
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.EventBusService = void 0;
-const common_1 = require("@nestjs/common");
-const nats_1 = require("nats");
-const nats_acl_service_1 = require("../nats/nats-acl.service");
-const nats_mesh_service_1 = require("../nats/nats-mesh.service");
-const message_sequence_service_1 = require("./message-sequence.service");
-const crypto = __importStar(require("crypto"));
-const fs = __importStar(require("fs"));
-let EventBusService = EventBusService_1 = class EventBusService {
-    natsAcl;
-    messageSequence;
-    meshService;
-    logger = new common_1.Logger(EventBusService_1.name);
-    nc;
-    js;
-    jsm;
-    serviceName;
-    nodeId;
-    encryptionKey;
-    encryptedSubjects = ['security-stream', 'dkg-stream'];
-    meshBroadcastEnabled;
-    connectionReady;
-    resolveConnection;
-    rejectConnection;
-    constructor(natsAcl, messageSequence, meshService) {
-        this.natsAcl = natsAcl;
-        this.messageSequence = messageSequence;
-        this.meshService = meshService;
-        this.serviceName = process.env.SERVICE_NAME || 'smart-validator';
-        this.nodeId = process.env.NODE_ID || `validator-${crypto.randomBytes(8).toString('hex')}`;
-        const encryptionKey = process.env.EVENT_BUS_ENCRYPTION_KEY;
-        if (encryptionKey) {
-            this.encryptionKey = this.normalizeEncryptionKey(encryptionKey);
-            this.logger.log('Event bus encryption enabled for sensitive subjects');
-        }
-        this.meshBroadcastEnabled = process.env.NATS_MESH_BROADCAST !== 'false';
-        this.connectionReady = new Promise((resolve, reject) => {
-            this.resolveConnection = resolve;
-            this.rejectConnection = reject;
-        });
-        this.connectionReady.catch(() => undefined);
-        this.logger.log('Event bus running in MESH mode - connecting immediately...');
-        this.connectImmediate();
-    }
-    connectImmediate() {
-        (async () => {
-            try {
-                if (this.meshService) {
-                    await this.waitForMeshService();
-                }
-                await this.connect();
-                this.logger.log('✓ EventBusService connected successfully in constructor');
-                this.resolveConnection();
-            }
-            catch (err) {
-                this.logger.error(`Failed to connect in constructor: ${err.message}`);
-                this.rejectConnection(err);
-            }
-        })();
-    }
-    async onModuleInit() {
-        this.logger.debug('EventBusService.onModuleInit() START');
-        await this.connectionReady;
-        this.logger.debug('EventBusService.onModuleInit() END');
-    }
-    async waitForConnection() {
-        return this.connectionReady;
-    }
-    async waitForMeshService() {
-        this.logger.log('Waiting for NatsMeshService to connect...');
-        if (!this.meshService) {
-            throw new Error('NatsMeshService not available');
-        }
-        try {
-            await this.meshService.waitForConnection();
-            this.logger.log('✓ NatsMeshService is connected');
-        }
-        catch (error) {
-            const err = error;
-            throw new Error(`NatsMeshService failed to connect: ${err.message}. Ensure NATS server is running at ` +
-                (process.env.NATS_SERVERS || 'nats://localhost:4222'));
-        }
-    }
-    async onModuleDestroy() {
-        await this.disconnect();
-    }
-    async connect() {
-        try {
-            if (this.meshService) {
-                this.logger.log('Using mesh service for NATS connection...');
-                if (this.meshService.isLocalConnected()) {
-                    this.nc = this.meshService.getLocalConnection();
-                    this.js = this.meshService.getLocalJetStream();
-                    this.jsm = this.meshService.getLocalJetStreamManager();
-                    this.logger.log('✓ Using mesh service NATS connection');
-                    await this.setupStreams();
-                    return;
-                }
-                else {
-                    throw new Error('Mesh service unexpectedly disconnected');
-                }
-            }
-            const servers = process.env.NATS_SERVERS?.split(',') || ['nats://localhost:4222'];
-            const tlsEnabled = process.env.NATS_TLS_ENABLED === 'true';
-            this.logger.log(`Connecting to NATS servers: ${servers.join(', ')}${tlsEnabled ? ' (TLS enabled)' : ''}`);
-            const connectOptions = {
-                servers,
-                name: this.serviceName,
-                token: process.env.NATS_TOKEN,
-                timeout: 10000,
-            };
-            if (tlsEnabled) {
-                const tlsCAFile = process.env.NATS_TLS_CA_FILE;
-                const tlsCertFile = process.env.NATS_TLS_CERT_FILE;
-                const tlsKeyFile = process.env.NATS_TLS_KEY_FILE;
-                const tlsOptions = {};
-                if (tlsCAFile && fs.existsSync(tlsCAFile)) {
-                    tlsOptions.caFile = tlsCAFile;
-                    this.logger.debug(`Using NATS CA file: ${tlsCAFile}`);
-                }
-                if (tlsCertFile && tlsKeyFile) {
-                    if (fs.existsSync(tlsCertFile) && fs.existsSync(tlsKeyFile)) {
-                        tlsOptions.certFile = tlsCertFile;
-                        tlsOptions.keyFile = tlsKeyFile;
-                        this.logger.debug(`Using NATS client cert: ${tlsCertFile}`);
-                    }
-                }
-                connectOptions.tls = tlsOptions;
-                this.logger.log('NATS TLS enabled');
-            }
-            this.nc = await (0, nats_1.connect)(connectOptions);
-            this.js = this.nc.jetstream();
-            this.jsm = await this.nc.jetstreamManager();
-            this.logger.log('Connected to NATS JetStream');
-            await this.setupStreams();
-        }
-        catch (error) {
-            const err = error;
-            this.logger.error('Failed to connect to NATS:', err.message);
-            throw new Error(`NATS connection required for event bus: ${err.message}`);
-        }
-    }
-    async setupStreams() {
-        const streams = [
-            {
-                name: 'multi-chain-stream',
-                subjects: ['multi-chain.>', 'multi-chain-stream.>'],
-                description: 'Cross-chain transaction coordination events',
-            },
-            {
-                name: 'networking-stream',
-                subjects: ['networking.>', 'networking-stream.>'],
-                description: 'Validator discovery and membership events',
-            },
-            {
-                name: 'security-stream',
-                subjects: ['security.>', 'security-stream.>'],
-                description: 'Security and signature verification events',
-            },
-            {
-                name: 'dkg-stream',
-                subjects: ['dkg.>', 'dkg-stream.>'],
-                description: 'Distributed Key Generation and threshold signature events',
-            },
-            {
-                name: 'genesis-stream',
-                subjects: ['genesis.>', 'genesis-stream.>'],
-                description: 'Genesis bootstrap and multi-chain genesis events',
-            },
-            {
-                name: 'governance-stream',
-                subjects: ['governance.>', 'governance-stream.>'],
-                description: 'Validator governance and registry events',
-            },
-            {
-                name: 'xrpl-stream',
-                subjects: ['xrpl.>', 'xrpl-stream.>'],
-                description: 'XRPL multi-sig signature coordination events',
-            },
-            {
-                name: 'hedera-stream',
-                subjects: ['hedera.>', 'hedera-stream.>'],
-                description: 'Hedera TSS/MPC signing coordination events',
-            },
-            {
-                name: 'polkadot-stream',
-                subjects: ['polkadot.>', 'polkadot-stream.>'],
-                description: 'Polkadot pallet_multisig auto-watcher + approval coordination events',
-            },
-            {
-                name: 'membership-stream',
-                subjects: ['membership.>', 'membership-stream.>'],
-                description: 'Validator membership and deposit wallet events',
-            },
-            {
-                name: 'subscription-stream',
-                subjects: ['subscription.>', 'subscription-stream.>'],
-                description: 'Smart app subscription events',
-            },
-            {
-                name: 'entity-registry-stream',
-                subjects: ['entity-registry.>', 'entity-registry-stream.>'],
-                description: 'Entity-validator binding lifecycle events (Mongo + NATS + IPFS distribution layer)',
-            },
-            {
-                name: 'smart-app-stream',
-                subjects: ['smart-app.>', 'smart-app-stream.>'],
-                description: 'Smart-app deployment lifecycle events',
-            },
-            {
-                name: 'ipfs-stream',
-                subjects: ['ipfs.>', 'ipfs-stream.>'],
-                description: 'IPFS pin propagation and cluster sync events',
-            },
-            {
-                name: 'host-mesh-stream',
-                subjects: ['host-mesh.>', 'host-mesh-stream.>'],
-                description: 'Smart Host network coordination events',
-            },
-            {
-                name: 'agent-lifecycle-stream',
-                subjects: ['agent-lifecycle.>', 'agent.>'],
-                description: 'Smart Agent lifecycle events',
-            },
-        ];
-        for (const stream of streams) {
-            try {
-                await this.jsm.streams.info(stream.name);
-                this.logger.debug(`Stream ${stream.name} already exists`);
-            }
-            catch (error) {
-                try {
-                    await this.jsm.streams.add({
-                        name: stream.name,
-                        subjects: stream.subjects,
-                        max_age: 24 * 60 * 60 * 1e9,
-                    });
-                    this.logger.log(`Created stream: ${stream.name}`);
-                }
-                catch (createError) {
-                    const err = createError;
-                    this.logger.warn(`Failed to create stream ${stream.name}: ${err.message}`);
-                }
-            }
-        }
-    }
-    async disconnect() {
-        if (this.meshService) {
-            this.logger.log('NATS disconnection handled by mesh service');
-            this.nc = undefined;
-            this.js = undefined;
-            this.jsm = undefined;
-            return;
-        }
-        if (this.nc) {
-            await this.nc.drain();
-            await this.nc.close();
-            this.logger.log('Disconnected from NATS');
-        }
-    }
-    async publishEvent(streamName, eventType, data) {
-        if (!this.nc || !this.js) {
-            this.logger.debug(`Waiting for NATS connection before publishing to ${streamName}...`);
-            try {
-                await this.connectionReady;
-            }
-            catch (error) {
-                const err = error;
-                this.logger.error(`NATS connection failed, cannot publish to ${streamName}: ${err.message}`);
-                throw new Error(`NATS connection required for publishing: ${err.message}`);
-            }
-        }
-        if (!this.nc || !this.js) {
-            throw new Error(`NATS connection not established after waiting - cannot publish`);
-        }
-        const subject = `${streamName}.${eventType}`;
-        const aclCheck = this.natsAcl.canPublish(this.nodeId, subject);
-        if (!aclCheck.allowed) {
-            this.logger.error(`🚨 ACL VIOLATION: Node ${this.nodeId} denied publishing to ${subject}\n` +
-                `  Reason: ${aclCheck.reason}`);
-            throw new Error(`ACL violation: ${aclCheck.reason}`);
-        }
-        const sequence = this.messageSequence.getNextSequence(this.nodeId);
-        const event = {
-            eventId: crypto.randomUUID(),
-            eventType,
-            source: this.serviceName,
-            sourceNode: this.nodeId,
-            sequence,
-            timestamp: new Date(),
-            data,
-        };
-        const payload = this.encodePayload(subject, event);
-        let meshTag;
-        if (!this.meshBroadcastEnabled) {
-            meshTag = '[mesh disabled]';
-        }
-        else {
-            try {
-                const peerCount = await this.meshService.broadcastToPeers(subject, payload);
-                meshTag = `[mesh broadcast: ${peerCount} peers]`;
-            }
-            catch (err) {
-                const e = err;
-                this.logger.warn(`Mesh broadcast failed for ${subject}: ${e.message} — local publish still proceeding`);
-                meshTag = `[mesh broadcast failed: ${e.message}]`;
-            }
-        }
-        try {
-            if (subject.startsWith('tss.') || subject.includes('proposal.')) {
-                this.nc.publish(subject, payload);
-                this.logger.debug(`✅ Published event via core NATS: ${subject} (ACL verified) ${meshTag}`);
-            }
-            else {
-                await this.js.publish(subject, payload);
-                this.logger.debug(`✅ Published event: ${subject} (ACL verified) ${meshTag}`);
-            }
-        }
-        catch (error) {
-            const err = error;
-            this.logger.error(`Failed to publish event to ${subject}: ${err.message}`);
-            throw error;
-        }
-    }
-    async subscribeToEvents(subject, handler) {
-        if (!this.nc || !this.js) {
-            this.logger.debug(`Waiting for NATS connection before subscribing to ${subject}...`);
-            try {
-                await this.connectionReady;
-            }
-            catch (error) {
-                const err = error;
-                this.logger.error(`NATS connection failed, cannot subscribe to ${subject}: ${err.message}`);
-                throw new Error(`NATS connection required for subscription: ${err.message}`);
-            }
-        }
-        if (!this.nc || !this.js) {
-            throw new Error(`NATS connection not established after waiting - cannot subscribe to ${subject}`);
-        }
-        const aclCheck = this.natsAcl.canSubscribe(this.nodeId, subject);
-        if (!aclCheck.allowed) {
-            this.logger.error(`🚨 ACL VIOLATION: Node ${this.nodeId} denied subscription to ${subject}\n` +
-                `  Reason: ${aclCheck.reason}\n` +
-                `  **POSSIBLE EAVESDROPPING ATTEMPT**`);
-            throw new Error(`ACL violation: ${aclCheck.reason}`);
-        }
-        if (subject.startsWith('tss.') || subject.includes('proposal.')) {
-            this.logger.log(`Subscribing to ${subject} via core NATS (real-time)`);
-            const sub = this.nc.subscribe(subject);
-            (async () => {
-                for await (const msg of sub) {
-                    try {
-                        const event = JSON.parse(msg.data.toString());
-                        handler(event).catch((handlerErr) => {
-                            this.logger.error(`Handler error on ${subject}: ${handlerErr}`);
-                        });
-                    }
-                    catch (parseErr) {
-                        this.logger.error(`Failed to parse message on ${subject}: ${parseErr}`);
-                    }
-                }
-            })().catch((err) => {
-                this.logger.error(`Subscription error on ${subject}: ${err}`);
-            });
-            this.logger.log(`✓ Subscribed to ${subject} (core NATS - real-time)`);
-            return;
-        }
-        const sanitizedSubject = subject.replace(/\./g, '-').replace(/\*/g, 'STAR').replace(/>/g, 'GT');
-        const durableName = `${this.serviceName}-${this.nodeId}-${sanitizedSubject}`;
-        const deliverySubject = `_INBOX.${durableName}`;
-        const opts = (0, nats_1.consumerOpts)()
-            .durable(durableName)
-            .deliverTo(deliverySubject)
-            .deliverAll()
-            .ackExplicit()
-            .maxDeliver(10);
-        const attemptSubscription = async () => {
-            const sub = await this.js.subscribe(subject, opts);
-            this.logger.log(`Subscribed to: ${subject}`);
-            this.processMessages(sub, handler);
-        };
-        try {
-            await attemptSubscription();
-        }
-        catch (error) {
-            const err = error;
-            const errMessage = err.message?.toLowerCase() || '';
-            const isNoStreamError = errMessage.includes('no stream matches subject') || errMessage.includes('stream not found');
-            if (isNoStreamError) {
-                this.logger.warn(`Stream not found for ${subject} - subscription skipped. ` +
-                    `Stream may be created later during bootstrap.`);
-                return;
-            }
-            const isNoResponders = errMessage === '503' ||
-                err.message === '503' ||
-                errMessage.includes('no responders') ||
-                errMessage.includes('503');
-            if (isNoResponders) {
-                this.logger.warn(`JetStream subscription to ${subject} returned 503 (no responders / ` +
-                    `meta-leader unavailable). Retrying in background with exponential backoff...`);
-                void (async () => {
-                    const retryDelays = [1000, 2000, 5000, 10000, 20000, 30000, 60000, 120000, 300000];
-                    for (let i = 0; i < retryDelays.length; i++) {
-                        await new Promise((resolve) => setTimeout(resolve, retryDelays[i]));
-                        try {
-                            await attemptSubscription();
-                            this.logger.log(`✓ JetStream subscription to ${subject} succeeded on retry ${i + 1} after ` +
-                                `${retryDelays.slice(0, i + 1).reduce((a, b) => a + b, 0) / 1000}s of backoff.`);
-                            return;
-                        }
-                        catch (retryErr) {
-                            const retryMsg = retryErr.message?.toLowerCase() || '';
-                            const stillNoResponders = retryMsg === '503' ||
-                                retryMsg.includes('no responders') ||
-                                retryMsg.includes('503');
-                            if (!stillNoResponders) {
-                                this.logger.error(`JetStream subscription to ${subject} failed on retry ${i + 1} with new ` +
-                                    `error: ${retryErr.message}. Giving up.`);
-                                return;
-                            }
-                            this.logger.debug(`JetStream subscription to ${subject} retry ${i + 1} still 503 — backing off further.`);
-                        }
-                    }
-                    this.logger.error(`JetStream subscription to ${subject} still 503 after ${retryDelays.length} retries ` +
-                        `(~${retryDelays.reduce((a, b) => a + b, 0) / 1000}s total). Subscription skipped.`);
-                })();
-                return;
-            }
-            const isDuplicateSubscription = errMessage.includes('duplicate subscription') || errMessage.includes('already bound');
-            if (isDuplicateSubscription && this.jsm) {
-                const streamName = this.resolveStreamName(subject);
-                this.logger.warn(`Duplicate subscription detected for ${subject} (durable ${durableName}). ` +
-                    `Removing stale consumer from stream ${streamName} and retrying...`);
-                try {
-                    await this.jsm.consumers.delete(streamName, durableName);
-                    await attemptSubscription();
-                    return;
-                }
-                catch (cleanupError) {
-                    const cleanupErr = cleanupError;
-                    this.logger.error(`Failed to clean up stale consumer ${durableName} on stream ${streamName}: ${cleanupErr.message}`);
-                }
-            }
-            this.logger.error(`Failed to subscribe to ${subject}: ${err.message}`);
-            throw error;
-        }
-    }
-    async processMessages(subscription, handler) {
-        (async () => {
-            for await (const msg of subscription) {
-                try {
-                    const event = this.decodePayload(msg.subject, msg.data);
-                    const isOwnMessage = event.sourceNode === this.nodeId;
-                    if (!isOwnMessage) {
-                        const sequenceCheck = this.messageSequence.verifyMessage(event.eventId, event.sourceNode, event.sequence, new Date(event.timestamp));
-                        if (!sequenceCheck.isValid) {
-                            this.logger.error(`🚨 INVALID MESSAGE SEQUENCE - REJECTING\n` +
-                                `  Event: ${event.eventType}\n` +
-                                `  Source: ${event.sourceNode}\n` +
-                                `  Reason: ${sequenceCheck.reason}`);
-                            msg.ack();
-                            continue;
-                        }
-                    }
-                    else {
-                        this.logger.debug(`⤴️  Skipping sequence validation for own message: ${event.eventType} (seq ${event.sequence})`);
-                    }
-                    await handler(event);
-                    msg.ack();
-                }
-                catch (error) {
-                    const err = error;
-                    this.logger.error(`Error processing message: ${err.message}`);
-                    msg.nak();
-                }
-            }
-        })();
-    }
-    isConnected() {
-        if (this.meshService) {
-            return this.meshService.isLocalConnected();
-        }
-        return this.nc ? !this.nc.isClosed() : false;
-    }
-    getMode() {
-        return 'mesh';
-    }
-    getMeshService() {
-        return this.meshService;
-    }
-    getConnectedPeerCount() {
-        if (this.meshService) {
-            return this.meshService.getConnectedPeerCount();
-        }
-        return 0;
-    }
-    grantCeremonyAccess(ceremonyId, participants, durationMs = 3600000) {
-        this.natsAcl.grantCeremonyAccess(ceremonyId, participants, durationMs);
-        this.logger.log(`✅ Granted NATS access for ceremony ${ceremonyId} to ${participants.length} participants`);
-    }
-    getAclService() {
-        return this.natsAcl;
-    }
-    getNodeId() {
-        return this.nodeId;
-    }
-    resolveStreamName(subject) {
-        if (subject.startsWith('networking-stream.') || subject.startsWith('networking.')) {
-            return 'networking-stream';
-        }
-        if (subject.startsWith('multi-chain-stream.') || subject.startsWith('multi-chain.')) {
-            return 'multi-chain-stream';
-        }
-        if (subject.startsWith('security-stream.') || subject.startsWith('security.')) {
-            return 'security-stream';
-        }
-        if (subject.startsWith('dkg-stream.') || subject.startsWith('dkg.')) {
-            return 'dkg-stream';
-        }
-        if (subject.startsWith('smart-app-stream.') || subject.startsWith('smart-app.')) {
-            return 'smart-app-stream';
-        }
-        if (subject.startsWith('entity-registry-stream.') || subject.startsWith('entity-registry.')) {
-            return 'entity-registry-stream';
-        }
-        if (subject.startsWith('agent-lifecycle-stream.') || subject.startsWith('agent-lifecycle.') || subject.startsWith('agent.')) {
-            return 'agent-lifecycle-stream';
-        }
-        return subject.split('.')[0];
-    }
-    shouldEncryptSubject(subject) {
-        return (!!this.encryptionKey &&
-            this.encryptedSubjects.some((prefix) => subject === prefix || subject.startsWith(`${prefix}.`)));
-    }
-    encodePayload(subject, event) {
-        if (!this.shouldEncryptSubject(subject)) {
-            return Buffer.from(JSON.stringify(event));
-        }
-        const envelope = this.encryptEvent(event);
-        return Buffer.from(JSON.stringify(envelope));
-    }
-    decodePayload(subject, payload) {
-        const raw = Buffer.from(payload).toString();
-        if (!this.shouldEncryptSubject(subject)) {
-            return JSON.parse(raw);
-        }
-        const envelope = JSON.parse(raw);
-        if (!envelope.__enc) {
-            return envelope;
-        }
-        const decrypted = this.decryptEvent(envelope);
-        return JSON.parse(decrypted);
-    }
-    encryptEvent(event) {
-        const iv = crypto.randomBytes(12);
-        const cipher = crypto.createCipheriv('aes-256-gcm', this.encryptionKey, iv);
-        const plaintext = Buffer.from(JSON.stringify(event), 'utf8');
-        const ciphertext = Buffer.concat([cipher.update(plaintext), cipher.final()]);
-        const tag = cipher.getAuthTag();
-        return {
-            __enc: true,
-            alg: 'aes-256-gcm',
-            iv: iv.toString('base64'),
-            tag: tag.toString('base64'),
-            data: ciphertext.toString('base64'),
-        };
-    }
-    async publishSignedEvent(streamName, eventType, data, signingKey, publicKey) {
-        if (!this.nc || !this.js) {
-            this.logger.debug(`Waiting for NATS connection before publishing signed event to ${streamName}...`);
-            try {
-                await this.connectionReady;
-            }
-            catch (error) {
-                const err = error;
-                this.logger.error(`NATS connection failed, cannot publish signed event: ${err.message}`);
-                throw new Error(`NATS connection required for signed event publishing: ${err.message}`);
-            }
-        }
-        if (!this.nc || !this.js) {
-            throw new Error(`NATS connection not established after waiting - cannot publish signed event`);
-        }
-        const subject = `${streamName}.${eventType}`;
-        const aclCheck = this.natsAcl.canPublish(this.nodeId, subject);
-        if (!aclCheck.allowed) {
-            this.logger.error(`🚨 ACL VIOLATION: Node ${this.nodeId} denied publishing to ${subject}\n` +
-                `  Reason: ${aclCheck.reason}`);
-            throw new Error(`ACL violation: ${aclCheck.reason}`);
-        }
-        const sequence = this.messageSequence.getNextSequence(this.nodeId);
-        const nonce = crypto.randomBytes(16).toString('hex');
-        const eventId = crypto.randomUUID();
-        const timestamp = new Date();
-        const signaturePayload = JSON.stringify({
-            eventId,
-            eventType,
-            sourceNode: this.nodeId,
-            sequence,
-            timestamp: timestamp.toISOString(),
-            nonce,
-            data,
-        });
-        const key = signingKey || process.env.VALIDATOR_SIGNING_KEY || process.env.HEDERA_PRIVATE_KEY;
-        const pubKey = publicKey || process.env.VALIDATOR_PUBLIC_KEY || process.env.HEDERA_PUBLIC_KEY;
-        if (!key || !pubKey) {
-            throw new Error('Signing key not configured for signed events');
-        }
-        const signature = this.createSignature(signaturePayload, key);
-        const event = {
-            eventId,
-            eventType,
-            source: this.serviceName,
-            sourceNode: this.nodeId,
-            sequence,
-            timestamp,
-            data,
-            nonce,
-            signature: {
-                signature,
-                publicKey: pubKey,
-                algorithm: 'hmac-sha256',
-                chain: process.env.HEDERA_ENABLED === 'true' ? 'hedera' : 'xrpl',
-            },
-        };
-        const payload = this.encodePayload(subject, event);
-        try {
-            if (subject.startsWith('tss.') || subject.includes('proposal.')) {
-                this.nc.publish(subject, payload);
-                this.logger.debug(`✅ Published signed event via core NATS: ${subject}`);
-            }
-            else {
-                await this.js.publish(subject, payload);
-                this.logger.debug(`✅ Published signed event: ${subject}`);
-            }
-        }
-        catch (error) {
-            const err = error;
-            this.logger.error(`Failed to publish signed event to ${subject}: ${err.message}`);
-            throw error;
-        }
-    }
-    verifyEventSignature(event) {
-        if (!event.signature) {
-            return { valid: false, reason: 'No signature present' };
-        }
-        if (!event.nonce) {
-            return { valid: false, reason: 'No nonce present' };
-        }
-        try {
-            const signaturePayload = JSON.stringify({
-                eventId: event.eventId,
-                eventType: event.eventType,
-                sourceNode: event.sourceNode,
-                sequence: event.sequence,
-                timestamp: event.timestamp instanceof Date ? event.timestamp.toISOString() : event.timestamp,
-                nonce: event.nonce,
-                data: event.data,
-            });
-            const isValid = this.verifySignature(signaturePayload, event.signature.signature, event.signature.publicKey);
-            if (!isValid) {
-                return { valid: false, reason: 'Signature verification failed' };
-            }
-            return { valid: true };
-        }
-        catch (error) {
-            const errorMsg = error instanceof Error ? error.message : 'Unknown error';
-            return { valid: false, reason: `Verification error: ${errorMsg}` };
-        }
-    }
-    async subscribeToSignedEvents(subject, handler, requireSignature = true) {
-        const verifiedHandler = async (event) => {
-            if (event.signature) {
-                const verification = this.verifyEventSignature(event);
-                if (!verification.valid) {
-                    this.logger.warn(`🚨 Invalid signature on ${event.eventType} from ${event.sourceNode}: ${verification.reason}`);
-                    return;
-                }
-                this.logger.debug(`✅ Signature verified for ${event.eventType} from ${event.sourceNode}`);
-            }
-            else if (requireSignature) {
-                this.logger.warn(`🚨 Missing signature on ${event.eventType} from ${event.sourceNode} - rejecting`);
-                return;
-            }
-            await handler(event);
-        };
-        await this.subscribeToEvents(subject, verifiedHandler);
-    }
-    createSignature(payload, key) {
-        const hmac = crypto.createHmac('sha256', key);
-        hmac.update(payload);
-        return hmac.digest('hex');
-    }
-    verifySignature(payload, signature, _publicKey) {
-        try {
-            if (!/^[0-9a-fA-F]{64}$/.test(signature)) {
-                return false;
-            }
-            const signingKey = process.env.VALIDATOR_SIGNING_KEY || process.env.HEDERA_PRIVATE_KEY;
-            if (!signingKey) {
-                this.logger.warn('No signing key configured - signature verification skipped');
-                return true;
-            }
-            const expectedSignature = this.createSignature(payload, signingKey);
-            const sigBuffer = Buffer.from(signature, 'hex');
-            const expectedBuffer = Buffer.from(expectedSignature, 'hex');
-            if (sigBuffer.length !== expectedBuffer.length) {
-                return false;
-            }
-            return crypto.timingSafeEqual(sigBuffer, expectedBuffer);
-        }
-        catch (error) {
-            this.logger.warn(`Signature verification error: ${error instanceof Error ? error.message : 'Unknown'}`);
-            return false;
-        }
-    }
-    decryptEvent(envelope) {
-        if (!this.encryptionKey) {
-            throw new Error('Encryption key not configured');
-        }
-        const iv = Buffer.from(envelope.iv, 'base64');
-        const tag = Buffer.from(envelope.tag, 'base64');
-        const ciphertext = Buffer.from(envelope.data, 'base64');
-        const decipher = crypto.createDecipheriv('aes-256-gcm', this.encryptionKey, iv);
-        decipher.setAuthTag(tag);
-        const decrypted = Buffer.concat([decipher.update(ciphertext), decipher.final()]);
-        return decrypted.toString('utf8');
-    }
-    normalizeEncryptionKey(value) {
-        const trimmed = value.trim();
-        const looksLikeHex = /^[0-9a-fA-F]+$/.test(trimmed);
-        if (looksLikeHex && trimmed.length === 64) {
-            const hexBuffer = Buffer.from(trimmed, 'hex');
-            if (hexBuffer.length !== 32) {
-                throw new Error('EVENT_BUS_ENCRYPTION_KEY hex value must be 32 bytes (64 hex chars)');
-            }
-            return hexBuffer;
-        }
-        const buffer = Buffer.from(trimmed, 'base64');
-        if (buffer.length !== 32) {
-            throw new Error('EVENT_BUS_ENCRYPTION_KEY must decode to 32 bytes (AES-256 key)');
-        }
-        return buffer;
-    }
-};
-exports.EventBusService = EventBusService;
-exports.EventBusService = EventBusService = EventBusService_1 = __decorate([
-    (0, common_1.Injectable)(),
-    __metadata("design:paramtypes", [nats_acl_service_1.NatsAclService,
-        message_sequence_service_1.MessageSequenceService,
-        nats_mesh_service_1.NatsMeshService])
-], EventBusService);
-//# sourceMappingURL=event-bus.service.js.map