@hsuite/smart-engines-cli 1.0.0 → 1.0.3

package/dist/packages/plugin-dkg/src/crypto/bls-dkg.service.js

@@ -1,631 +0,0 @@
-"use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
-    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-    return c > 3 && r && Object.defineProperty(target, key, r), r;
-};
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-var __metadata = (this && this.__metadata) || function (k, v) {
-    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-};
-var BLSDKGService_1;
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.BLSDKGService = void 0;
-const common_1 = require("@nestjs/common");
-const smart_engines_infrastructure_1 = require("@hsuite/smart-engines-infrastructure");
-const shamir_secret_sharing_service_1 = require("./shamir-secret-sharing.service");
-const post_quantum_service_1 = require("./post-quantum.service");
-const share_encryption_service_1 = require("./share-encryption.service");
-const node_identity_service_1 = require("./node-identity.service");
-const bls12_381_1 = require("@noble/curves/bls12-381");
-const sha256_1 = require("@noble/hashes/sha256");
-const utils_1 = require("@noble/hashes/utils");
-const crypto = __importStar(require("crypto"));
-let BLSDKGService = BLSDKGService_1 = class BLSDKGService {
-    eventBus;
-    shamirSSS;
-    postQuantum;
-    shareEncryption;
-    nodeIdentity;
-    logger = new common_1.Logger(BLSDKGService_1.name);
-    ceremonies = new Map();
-    nodeId;
-    nodeEncryptionKeyPair;
-    initialized = false;
-    constructor(eventBus, shamirSSS, postQuantum, shareEncryption, nodeIdentity) {
-        this.eventBus = eventBus;
-        this.shamirSSS = shamirSSS;
-        this.postQuantum = postQuantum;
-        this.shareEncryption = shareEncryption;
-        this.nodeIdentity = nodeIdentity;
-        this.nodeEncryptionKeyPair = this.shareEncryption.generateValidatorKeyPair();
-    }
-    async onModuleInit() {
-        try {
-            const identity = await this.nodeIdentity.initializeIdentity();
-            this.nodeId = identity.nodeId;
-            this.logger.log(`🔒 BLS DKG Service initialized with SECURE node identity: ${this.nodeId}`);
-            this.logger.log(`  Node encryption public key: ${this.nodeEncryptionKeyPair.publicKey.substring(0, 16)}...`);
-            this.logger.log(`  Node authentication key: ${identity.publicKey.substring(0, 50)}...`);
-            await this.subscribeToEvents();
-            this.initialized = true;
-            this.logger.log('✅ BLS DKG Service fully initialized and ready');
-        }
-        catch (error) {
-            const err = error;
-            this.logger.error(`❌ Failed to initialize BLS DKG Service: ${err.message}`);
-            throw error;
-        }
-    }
-    ensureInitialized() {
-        if (!this.initialized) {
-            throw new Error('BLS DKG Service not initialized. Operations cannot be performed until onModuleInit completes.');
-        }
-    }
-    async initiateDKG(participants, threshold, securityLevel = 'maximum') {
-        this.ensureInitialized();
-        this.validateDKGParams(participants, threshold);
-        const ceremonyId = this.generateUniqueCeremonyId();
-        this.logger.log(`Initiating DKG ceremony ${ceremonyId} with ${participants.length} participants, ` +
-            `threshold ${threshold}, security level: ${securityLevel}`);
-        const ceremony = {
-            ceremonyId,
-            participants,
-            threshold,
-            status: 'initiated',
-            blsShares: new Map(),
-            pqKeyPairs: new Map(),
-            commitments: new Map(),
-            validatorEncryptionKeys: new Map(),
-            createdAt: new Date(),
-            expiresAt: new Date(Date.now() + 600000),
-            metadata: {
-                initiator: this.nodeId,
-                securityLevel,
-            },
-        };
-        this.ceremonies.set(ceremonyId, ceremony);
-        this.eventBus.grantCeremonyAccess(ceremonyId, participants, 600000);
-        ceremony.validatorEncryptionKeys.set(this.nodeId, this.nodeEncryptionKeyPair.publicKey);
-        const keyAnnouncement = JSON.stringify({
-            ceremonyId,
-            nodeId: this.nodeId,
-            encryptionPublicKey: this.nodeEncryptionKeyPair.publicKey,
-            timestamp: new Date().toISOString(),
-        });
-        const keySignature = await this.nodeIdentity.signChallenge(keyAnnouncement);
-        await this.eventBus.publishEvent('dkg-stream', 'ceremony.initiated', {
-            ceremonyId,
-            participants,
-            threshold,
-            securityLevel,
-            initiator: this.nodeId,
-            initiatorEncryptionKey: this.nodeEncryptionKeyPair.publicKey,
-            initiatorIdentityKey: this.nodeIdentity.getIdentity().publicKey,
-            keySignature: keySignature.toString('base64'),
-            expiresAt: ceremony.expiresAt,
-        });
-        setTimeout(() => this.handleTimeout(ceremonyId), 600000);
-        if (participants.includes(this.nodeId)) {
-            await this.contributeToPhase1(ceremonyId);
-        }
-        return ceremonyId;
-    }
-    async contributeToPhase1(ceremonyId) {
-        const ceremony = this.ceremonies.get(ceremonyId);
-        if (!ceremony) {
-            throw new Error(`Ceremony not found: ${ceremonyId}`);
-        }
-        this.logger.debug(`Phase 1: Generating secret shares for ceremony ${ceremonyId}`);
-        const mySecret = this.shamirSSS.generateRandomSecret();
-        const shares = this.shamirSSS.split(mySecret, ceremony.threshold, ceremony.participants.length);
-        const commitments = this.generateFeldmanCommitments(mySecret, ceremony.threshold);
-        ceremony.commitments.set(this.nodeId, commitments);
-        ceremony.validatorEncryptionKeys.set(this.nodeId, this.nodeEncryptionKeyPair.publicKey);
-        const keyAnnouncement = JSON.stringify({
-            ceremonyId,
-            nodeId: this.nodeId,
-            encryptionPublicKey: this.nodeEncryptionKeyPair.publicKey,
-            timestamp: new Date().toISOString(),
-        });
-        const keySignature = await this.nodeIdentity.signChallenge(keyAnnouncement);
-        await this.eventBus.publishEvent('dkg-stream', 'commitments.submitted', {
-            ceremonyId,
-            participantId: this.nodeId,
-            commitments: commitments.map((c) => (0, utils_1.bytesToHex)(c)),
-            encryptionPublicKey: this.nodeEncryptionKeyPair.publicKey,
-            identityPublicKey: this.nodeIdentity.getIdentity().publicKey,
-            keySignature: keySignature.toString('base64'),
-            timestamp: new Date(),
-        });
-        for (let i = 0; i < ceremony.participants.length; i++) {
-            const recipientId = ceremony.participants[i];
-            const share = shares[i];
-            const recipientEncryptionKey = ceremony.validatorEncryptionKeys.get(recipientId);
-            if (!recipientEncryptionKey) {
-                this.logger.warn(`No encryption key found for ${recipientId}, waiting for key exchange...`);
-                continue;
-            }
-            const shareValueHex = share.value.toString(16);
-            const encryptedShare = this.shareEncryption.encryptShare(shareValueHex, share.id, recipientEncryptionKey);
-            await this.eventBus.publishEvent('dkg-stream', `share.private.${recipientId}`, {
-                ceremonyId,
-                fromParticipant: this.nodeId,
-                toParticipant: recipientId,
-                encryptedShare,
-                timestamp: new Date(),
-            });
-            this.logger.debug(`Sent encrypted share ${share.id} to ${recipientId}`);
-        }
-        ceremony.status = 'collecting_commitments';
-    }
-    async finalizeShares(ceremonyId) {
-        const ceremony = this.ceremonies.get(ceremonyId);
-        if (!ceremony)
-            return;
-        this.logger.debug(`Phase 2: Finalizing shares for ceremony ${ceremonyId}`);
-        if (ceremony.commitments.size < ceremony.threshold) {
-            this.logger.warn(`Not enough commitments: ${ceremony.commitments.size}/${ceremony.threshold}`);
-            return;
-        }
-        const publicKeys = [];
-        ceremony.commitments.forEach((commitments) => {
-            publicKeys.push(commitments[0]);
-        });
-        ceremony.blsGroupPublicKey = this.aggregateBLSPublicKeys(publicKeys);
-        const pqLevel = this.securityLevelToDilithium(ceremony.metadata.securityLevel);
-        const pqKeyPair = await this.postQuantum.generateKeyPair(pqLevel);
-        ceremony.pqKeyPairs.set(this.nodeId, pqKeyPair);
-        await this.eventBus.publishEvent('dkg-stream', 'pq-key.submitted', {
-            ceremonyId,
-            participantId: this.nodeId,
-            pqPublicKey: (0, utils_1.bytesToHex)(pqKeyPair.publicKey),
-            algorithm: pqKeyPair.algorithm,
-            timestamp: new Date(),
-        });
-        ceremony.status = 'collecting_shares';
-        this.checkCeremonyCompletion(ceremonyId);
-    }
-    async checkCeremonyCompletion(ceremonyId) {
-        const ceremony = this.ceremonies.get(ceremonyId);
-        if (!ceremony)
-            return;
-        const hasAllCommitments = ceremony.commitments.size >= ceremony.threshold;
-        const hasAllPQKeys = ceremony.pqKeyPairs.size >= ceremony.threshold;
-        if (hasAllCommitments && hasAllPQKeys) {
-            await this.completeCeremony(ceremonyId);
-        }
-    }
-    async completeCeremony(ceremonyId) {
-        const ceremony = this.ceremonies.get(ceremonyId);
-        if (!ceremony || ceremony.status === 'completed') {
-            return;
-        }
-        this.logger.log(`Completing DKG ceremony ${ceremonyId}`);
-        const pqPublicKeys = [];
-        ceremony.pqKeyPairs.forEach((keyPair) => {
-            pqPublicKeys.push(keyPair.publicKey);
-        });
-        const pqKeysConcat = Buffer.concat(pqPublicKeys);
-        ceremony.pqGroupPublicKey = (0, sha256_1.sha256)(pqKeysConcat);
-        ceremony.status = 'completed';
-        this.logger.log(`✅ DKG ceremony ${ceremonyId} completed successfully\n` +
-            `  BLS Group Public Key: ${(0, utils_1.bytesToHex)(ceremony.blsGroupPublicKey).substring(0, 32)}...\n` +
-            `  PQ Group Key Hash: ${(0, utils_1.bytesToHex)(ceremony.pqGroupPublicKey).substring(0, 32)}...`);
-        setTimeout(() => {
-            this.ceremonies.delete(ceremonyId);
-            this.logger.log(`🧹 Cleaned up completed ceremony ${ceremonyId} (1 hour retention)`);
-        }, 3600000);
-        await this.eventBus.publishEvent('dkg-stream', 'ceremony.completed', {
-            ceremonyId,
-            blsGroupPublicKey: (0, utils_1.bytesToHex)(ceremony.blsGroupPublicKey),
-            pqGroupKeyHash: (0, utils_1.bytesToHex)(ceremony.pqGroupPublicKey),
-            participants: Array.from(ceremony.commitments.keys()),
-            threshold: ceremony.threshold,
-            completedAt: new Date(),
-        });
-    }
-    async generateThresholdSignature(ceremonyId, message) {
-        const ceremony = this.ceremonies.get(ceremonyId);
-        if (!ceremony) {
-            throw new Error(`Ceremony not found: ${ceremonyId}`);
-        }
-        if (ceremony.status !== 'completed') {
-            throw new Error(`Ceremony not completed: ${ceremony.status}`);
-        }
-        const messageBytes = typeof message === 'string' ? new TextEncoder().encode(message) : message;
-        const messageHash = (0, sha256_1.sha256)(messageBytes);
-        this.logger.debug(`Generating threshold signature for ceremony ${ceremonyId}`);
-        const myShare = ceremony.blsShares.get(this.nodeId);
-        if (!myShare) {
-            throw new Error('No BLS share available');
-        }
-        const partialBLSSig = this.signWithBLSShare(messageHash, myShare.secretShare);
-        const myPQKeyPair = ceremony.pqKeyPairs.get(this.nodeId);
-        if (!myPQKeyPair) {
-            throw new Error('No PQ key pair available');
-        }
-        const pqSignature = await this.postQuantum.sign(messageHash, myPQKeyPair.secretKey, myPQKeyPair.algorithm);
-        const requestId = crypto.randomUUID();
-        await this.eventBus.publishEvent('dkg-stream', 'threshold-signature.partial', {
-            requestId,
-            ceremonyId,
-            participantId: this.nodeId,
-            partialBLSSignature: (0, utils_1.bytesToHex)(partialBLSSig),
-            pqSignature: (0, utils_1.bytesToHex)(pqSignature),
-            messageHash: (0, utils_1.bytesToHex)(messageHash),
-            timestamp: new Date(),
-        });
-        return requestId;
-    }
-    generateFeldmanCommitments(secret, threshold) {
-        const commitments = [];
-        const CURVE_ORDER = BigInt('0x73eda753299d7d483339d80809a1d80553bda402fffe5bfeffffffff00000001');
-        const g = bls12_381_1.bls12_381.G1.ProjectivePoint.BASE;
-        const reducedSecret = ((secret % CURVE_ORDER) + CURVE_ORDER) % CURVE_ORDER;
-        const secretCommitment = g.multiply(reducedSecret);
-        commitments.push(secretCommitment.toRawBytes());
-        for (let i = 1; i < threshold; i++) {
-            const coeff = this.shamirSSS.generateRandomSecret();
-            const reducedCoeff = ((coeff % CURVE_ORDER) + CURVE_ORDER) % CURVE_ORDER;
-            const commitment = g.multiply(reducedCoeff);
-            commitments.push(commitment.toRawBytes());
-        }
-        return commitments;
-    }
-    verifyShareWithCommitments(share, commitments) {
-        try {
-            if (!this.validateCommitments(commitments)) {
-                this.logger.error(`🚨 INVALID COMMITMENTS DETECTED!\n` +
-                    `  Share ID: ${share.id}\n` +
-                    `  Commitments are not valid curve points or contain malicious data`);
-                return false;
-            }
-            const g = bls12_381_1.bls12_381.G1.ProjectivePoint.BASE;
-            let expectedCommitment = bls12_381_1.bls12_381.G1.ProjectivePoint.ZERO;
-            let xPower = BigInt(1);
-            const x = BigInt(share.id);
-            const CURVE_ORDER = BigInt('0x73eda753299d7d483339d80809a1d80553bda402fffe5bfeffffffff00000001');
-            for (const commitmentBytes of commitments) {
-                const commitment = bls12_381_1.bls12_381.G1.ProjectivePoint.fromHex(commitmentBytes);
-                const term = commitment.multiply(xPower);
-                expectedCommitment = expectedCommitment.add(term);
-                xPower = (xPower * x) % CURVE_ORDER;
-            }
-            const reducedShareValue = ((share.value % CURVE_ORDER) + CURVE_ORDER) % CURVE_ORDER;
-            const actualCommitment = g.multiply(reducedShareValue);
-            const isValid = expectedCommitment.equals(actualCommitment);
-            if (!isValid) {
-                this.logger.error(`🚨 SHARE VERIFICATION FAILED!\n` +
-                    `  Share ID: ${share.id}\n` +
-                    `  Expected commitment doesn't match actual\n` +
-                    `  **POSSIBLE MALICIOUS SHARE DETECTED**`);
-            }
-            return isValid;
-        }
-        catch (error) {
-            const err = error;
-            this.logger.error(`Share verification exception: ${err.message}`);
-            return false;
-        }
-    }
-    validateCommitments(commitments) {
-        if (!commitments || commitments.length === 0) {
-            return false;
-        }
-        try {
-            for (const commitmentBytes of commitments) {
-                const point = bls12_381_1.bls12_381.G1.ProjectivePoint.fromHex(commitmentBytes);
-                if (!point) {
-                    return false;
-                }
-                if (point.equals(bls12_381_1.bls12_381.G1.ProjectivePoint.ZERO)) {
-                    this.logger.warn('⚠️  Commitment contains zero point (suspicious)');
-                    return false;
-                }
-                const g = bls12_381_1.bls12_381.G1.ProjectivePoint.BASE;
-                if (!g) {
-                    return false;
-                }
-            }
-            return true;
-        }
-        catch (error) {
-            const err = error;
-            this.logger.error(`Commitment validation failed: ${err.message}`);
-            return false;
-        }
-    }
-    aggregateBLSPublicKeys(publicKeys) {
-        let aggregated = bls12_381_1.bls12_381.G1.ProjectivePoint.ZERO;
-        for (const pkBytes of publicKeys) {
-            const pk = bls12_381_1.bls12_381.G1.ProjectivePoint.fromHex(pkBytes);
-            aggregated = aggregated.add(pk);
-        }
-        return aggregated.toRawBytes();
-    }
-    signWithBLSShare(message, secretShare) {
-        const CURVE_ORDER = BigInt('0x73eda753299d7d483339d80809a1d80553bda402fffe5bfeffffffff00000001');
-        const reducedShare = ((secretShare % CURVE_ORDER) + CURVE_ORDER) % CURVE_ORDER;
-        const msgPoint = bls12_381_1.bls12_381.longSignatures.hash(message, 'HSuite-TSS-v1');
-        return bls12_381_1.bls12_381.longSignatures.sign(msgPoint, reducedShare).toRawBytes();
-    }
-    securityLevelToDilithium(level) {
-        switch (level) {
-            case 'standard':
-                return 2;
-            case 'high':
-                return 3;
-            case 'maximum':
-                return 3;
-            default:
-                return 3;
-        }
-    }
-    async subscribeToEvents() {
-        await this.eventBus.subscribeToEvents('dkg-stream.ceremony.initiated', async (event) => await this.onCeremonyInitiated(event));
-        await this.eventBus.subscribeToEvents('dkg-stream.commitments.submitted', async (event) => await this.onCommitmentsReceived(event));
-        await this.eventBus.subscribeToEvents(`dkg-stream.share.private.${this.nodeId}`, async (event) => await this.onPrivateShareReceived(event));
-        await this.eventBus.subscribeToEvents('dkg-stream.pq-key.submitted', async (event) => await this.onPQKeyReceived(event));
-        this.logger.log('Subscribed to DKG event streams');
-    }
-    async onCeremonyInitiated(event) {
-        const { ceremonyId, participants, threshold, securityLevel, expiresAt, initiator, initiatorEncryptionKey, initiatorIdentityKey, keySignature, } = event.data;
-        if (!participants.includes(this.nodeId)) {
-            return;
-        }
-        if (keySignature && initiatorIdentityKey) {
-            try {
-                const keyAnnouncement = JSON.stringify({
-                    ceremonyId,
-                    nodeId: initiator,
-                    encryptionPublicKey: initiatorEncryptionKey,
-                    timestamp: event.timestamp.toISOString(),
-                });
-                const signature = Buffer.from(keySignature, 'base64');
-                const isValid = await this.nodeIdentity.verifyNodeIdentity(initiator, signature, keyAnnouncement, initiatorIdentityKey);
-                if (!isValid) {
-                    this.logger.error(`🚨 CRITICAL: PUBLIC KEY MITM ATTACK DETECTED!\n` +
-                        `  Ceremony: ${ceremonyId}\n` +
-                        `  Claimed initiator: ${initiator}\n` +
-                        `  Invalid key signature - possible key substitution attack!\n` +
-                        `  **REFUSING TO PARTICIPATE IN COMPROMISED CEREMONY**`);
-                    return;
-                }
-                this.logger.log(`✅ Verified encryption key signature from ${initiator}`);
-            }
-            catch (error) {
-                const err = error;
-                this.logger.error(`Failed to verify key signature for ceremony ${ceremonyId}: ${err.message}`);
-                return;
-            }
-        }
-        else {
-            this.logger.warn(`⚠️  Ceremony ${ceremonyId} initiated without key signatures. ` +
-                `This may be from an older version. Proceeding with caution...`);
-        }
-        const ceremony = {
-            ceremonyId,
-            participants,
-            threshold,
-            status: 'initiated',
-            blsShares: new Map(),
-            pqKeyPairs: new Map(),
-            commitments: new Map(),
-            validatorEncryptionKeys: new Map(),
-            createdAt: new Date(),
-            expiresAt: new Date(expiresAt),
-            metadata: {
-                initiator,
-                securityLevel: securityLevel || 'high',
-            },
-        };
-        if (initiatorEncryptionKey) {
-            ceremony.validatorEncryptionKeys.set(initiator, initiatorEncryptionKey);
-        }
-        this.ceremonies.set(ceremonyId, ceremony);
-        await this.contributeToPhase1(ceremonyId);
-    }
-    async onCommitmentsReceived(event) {
-        const { ceremonyId, participantId, commitments, encryptionPublicKey, identityPublicKey, keySignature, } = event.data;
-        const ceremony = this.ceremonies.get(ceremonyId);
-        if (!ceremony)
-            return;
-        if (keySignature && identityPublicKey && encryptionPublicKey) {
-            try {
-                const keyAnnouncement = JSON.stringify({
-                    ceremonyId,
-                    nodeId: participantId,
-                    encryptionPublicKey,
-                    timestamp: event.timestamp.toISOString(),
-                });
-                const signature = Buffer.from(keySignature, 'base64');
-                const isValid = await this.nodeIdentity.verifyNodeIdentity(participantId, signature, keyAnnouncement, identityPublicKey);
-                if (!isValid) {
-                    this.logger.error(`🚨 CRITICAL: PUBLIC KEY MITM ATTACK DETECTED!\n` +
-                        `  Ceremony: ${ceremonyId}\n` +
-                        `  Participant: ${participantId}\n` +
-                        `  Invalid key signature - REJECTING commitments and key!`);
-                    return;
-                }
-                this.logger.debug(`✅ Verified encryption key signature from ${participantId}`);
-            }
-            catch (error) {
-                const err = error;
-                this.logger.error(`Failed to verify key signature from ${participantId}: ${err.message}`);
-                return;
-            }
-        }
-        const commitmentBytes = commitments.map((hex) => (0, utils_1.hexToBytes)(hex));
-        ceremony.commitments.set(participantId, commitmentBytes);
-        if (encryptionPublicKey) {
-            ceremony.validatorEncryptionKeys.set(participantId, encryptionPublicKey);
-            this.logger.debug(`Stored VERIFIED encryption key for ${participantId}`);
-        }
-        this.logger.debug(`Received commitments from ${participantId} for ceremony ${ceremonyId} ` +
-            `(${ceremony.commitments.size}/${ceremony.participants.length})`);
-        if (ceremony.commitments.size >= ceremony.threshold) {
-            await this.finalizeShares(ceremonyId);
-        }
-    }
-    async onPrivateShareReceived(event) {
-        const { ceremonyId, fromParticipant, encryptedShare } = event.data;
-        const ceremony = this.ceremonies.get(ceremonyId);
-        if (!ceremony)
-            return;
-        try {
-            const shareValueHex = this.shareEncryption.decryptShare(encryptedShare, this.nodeEncryptionKeyPair.privateKey);
-            const secretShare = {
-                id: encryptedShare.shareId,
-                value: BigInt('0x' + shareValueHex),
-            };
-            const senderCommitments = ceremony.commitments.get(fromParticipant);
-            if (senderCommitments) {
-                const isValid = this.verifyShareWithCommitments(secretShare, senderCommitments);
-                if (!isValid) {
-                    this.logger.warn(`Invalid share from ${fromParticipant} for ceremony ${ceremonyId}`);
-                    return;
-                }
-            }
-            const blsShare = {
-                shareId: secretShare.id,
-                secretShare: secretShare.value,
-                publicShare: new Uint8Array(),
-                participantId: fromParticipant,
-            };
-            ceremony.blsShares.set(fromParticipant, blsShare);
-            this.logger.debug(`Received and decrypted valid share from ${fromParticipant} for ceremony ${ceremonyId}`);
-        }
-        catch (error) {
-            const err = error;
-            this.logger.error(`Failed to decrypt share from ${fromParticipant} for ceremony ${ceremonyId}: ${err.message}`);
-        }
-    }
-    async onPQKeyReceived(event) {
-        const { ceremonyId, participantId, pqPublicKey, algorithm } = event.data;
-        const ceremony = this.ceremonies.get(ceremonyId);
-        if (!ceremony)
-            return;
-        const pqKeyPair = {
-            publicKey: (0, utils_1.hexToBytes)(pqPublicKey),
-            secretKey: new Uint8Array(),
-            algorithm,
-        };
-        ceremony.pqKeyPairs.set(participantId, pqKeyPair);
-        this.logger.debug(`Received PQ key from ${participantId} for ceremony ${ceremonyId} ` +
-            `(${ceremony.pqKeyPairs.size}/${ceremony.participants.length})`);
-        await this.checkCeremonyCompletion(ceremonyId);
-    }
-    handleTimeout(ceremonyId) {
-        const ceremony = this.ceremonies.get(ceremonyId);
-        if (!ceremony || ceremony.status === 'completed') {
-            return;
-        }
-        ceremony.status = 'failed';
-        this.logger.warn(`⏱️  DKG ceremony ${ceremonyId} TIMED OUT\n` +
-            `  Commitments: ${ceremony.commitments.size}/${ceremony.participants.length}\n` +
-            `  PQ keys: ${ceremony.pqKeyPairs.size}/${ceremony.participants.length}\n` +
-            `  Cleaning up to prevent memory leak...`);
-        setTimeout(() => {
-            this.ceremonies.delete(ceremonyId);
-            this.logger.log(`🧹 Cleaned up failed ceremony ${ceremonyId}`);
-        }, 300000);
-    }
-    validateDKGParams(participants, threshold) {
-        if (participants.length < 2) {
-            throw new Error('Need at least 2 participants for DKG');
-        }
-        if (new Set(participants).size !== participants.length) {
-            throw new Error('Duplicate participants not allowed');
-        }
-        const bftMinThreshold = Math.ceil((participants.length + 1) / 2);
-        if (threshold < bftMinThreshold) {
-            throw new Error(`Threshold ${threshold} is below BFT minimum ${bftMinThreshold} for ${participants.length} participants. ` +
-                `Byzantine Fault Tolerance requires at least ⌈(N+1)/2⌉ signatures.`);
-        }
-        if (threshold > participants.length) {
-            throw new Error(`Threshold ${threshold} cannot exceed number of participants ${participants.length}`);
-        }
-        this.logger.log(`DKG params validated: ${participants.length} participants, threshold ${threshold} ` +
-            `(BFT minimum: ${bftMinThreshold}, tolerates ${Math.floor((participants.length - 1) / 2)} faults)`);
-    }
-    getCeremonyStatus(ceremonyId) {
-        return this.ceremonies.get(ceremonyId) || null;
-    }
-    listCeremonies() {
-        return Array.from(this.ceremonies.values());
-    }
-    getStats() {
-        const stats = {
-            totalCeremonies: this.ceremonies.size,
-            initiated: 0,
-            collecting_commitments: 0,
-            collecting_shares: 0,
-            completed: 0,
-            failed: 0,
-        };
-        this.ceremonies.forEach((ceremony) => {
-            stats[ceremony.status]++;
-        });
-        return stats;
-    }
-    generateUniqueCeremonyId() {
-        const MAX_ATTEMPTS = 10;
-        let attempts = 0;
-        while (attempts < MAX_ATTEMPTS) {
-            const ceremonyId = crypto.randomUUID();
-            if (!this.ceremonies.has(ceremonyId)) {
-                return ceremonyId;
-            }
-            attempts++;
-            this.logger.warn(`⚠️  Ceremony ID collision detected (attempt ${attempts}/${MAX_ATTEMPTS}): ${ceremonyId}. ` +
-                `Generating new ID...`);
-        }
-        throw new Error(`Failed to generate unique ceremony ID after ${MAX_ATTEMPTS} attempts. ` +
-            `This is statistically impossible with crypto.randomUUID() unless under active attack. ` +
-            `Current active ceremonies: ${this.ceremonies.size}`);
-    }
-};
-exports.BLSDKGService = BLSDKGService;
-exports.BLSDKGService = BLSDKGService = BLSDKGService_1 = __decorate([
-    (0, common_1.Injectable)(),
-    __metadata("design:paramtypes", [smart_engines_infrastructure_1.EventBusService,
-        shamir_secret_sharing_service_1.ShamirSecretSharingService,
-        post_quantum_service_1.PostQuantumCryptoService,
-        share_encryption_service_1.ShareEncryptionService,
-        node_identity_service_1.NodeIdentityService])
-], BLSDKGService);
-//# sourceMappingURL=bls-dkg.service.js.map