@hsuite/smart-engines-cli 1.0.0

package/dist/libs/infrastructure/src/security/dilithium-module-loader.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dilithium-module-loader.js","sourceRoot":"","sources":["../../../../../../../libs/infrastructure/src/security/dilithium-module-loader.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4IA,kDAsBC;AAoID,oDAEC;AAKD,0EAEC;AAKD,gDAEC;AAKD,4DAcC;AAKD,sDAKC;AAnVD,2CAAwC;AA0CxC,IAAI,eAAyC,CAAC;AAC9C,IAAI,qBAAoE,CAAC;AACzE,IAAI,mBAAsC,CAAC;AAC3C,IAAI,YAAY,GAAG,CAAC,CAAC;AACrB,IAAI,oBAAoB,GAAG,KAAK,CAAC;AAEjC,MAAM,iBAAiB,GAAG,CAAC,CAAC;AAC5B,MAAM,mBAAmB,GAAG,GAAG,CAAC;AAEhC,MAAM,MAAM,GAAG,IAAI,eAAM,CAAC,uBAAuB,CAAC,CAAC;AAKnD,SAAS,KAAK,CAAC,EAAU;IACvB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAC3D,CAAC;AAeD,SAAS,uBAAuB;IAC9B,IAAI,CAAC;QAEH,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,oBAAoB,CAAC,CAAC;QAI1D,IAAI,YAAY,GAAG,CAAC,CAAC;QACrB,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;YACjC,MAAM,KAAK,GAAG,QAAQ,CAAC,QAAQ,EAAE,CAAC;YAElC,IAAI,KAAK,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;gBACvC,SAAS;YACX,CAAC;YAMD,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC5B,OAAO,CAAC,cAAc,CAAC,oBAAoB,EAAE,QAAQ,CAAC,CAAC;gBACvD,YAAY,EAAE,CAAC;gBACf,MAAM,CAAC,KAAK,CAAC,uCAAuC,KAAK,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC;YACnF,CAAC;QACH,CAAC;QAED,IAAI,YAAY,GAAG,CAAC,EAAE,CAAC;YACrB,MAAM,CAAC,GAAG,CAAC,aAAa,YAAY,sDAAsD,CAAC,CAAC;QAC9F,CAAC;QAID,MAAM,gBAAgB,GAAG,OAAO,CAAC,SAAS,CAAC,oBAAoB,CAAC,CAAC;QACjE,MAAM,cAAc,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,CAAC;QAE/F,IAAI,CAAC,cAAc,IAAI,CAAC,oBAAoB,EAAE,CAAC;YAC7C,MAAM,WAAW,GAAG,CAAC,MAAe,EAAE,QAA0B,EAAE,EAAE;gBAClE,MAAM,KAAK,GAAG,MAAM,YAAY,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;gBAE3E,MAAM,CAAC,IAAI,CAAC,sDAAsD,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;gBACnF,IAAI,KAAK,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;oBAC3D,MAAM,CAAC,KAAK,CAAC,gBAAgB,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;gBAC9C,CAAC;YAEH,CAAC,CAAC;YAGF,OAAO,CAAC,eAAe,CAAC,oBAAoB,EAAE,WAAW,CAAC,CAAC;YAC3D,MAAM,CAAC,KAAK,CAAC,yDAAyD,CAAC,CAAC;YACxE,oBAAoB,GAAG,IAAI,CAAC;QAC9B,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,IAAI,CAAC,2CAA4C,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;IACnF,CAAC;AACH,CAAC;AAaM,KAAK,UAAU,mBAAmB;IAEvC,IAAI,eAAe,EAAE,CAAC;QACpB,OAAO,eAAe,CAAC;IACzB,CAAC;IAGD,IAAI,qBAAqB,EAAE,CAAC;QAC1B,OAAO,qBAAqB,CAAC;IAC/B,CAAC;IAGD,qBAAqB,GAAG,qBAAqB,EAAE,CAAC;IAEhD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC;QAC3C,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAEf,qBAAqB,GAAG,SAAS,CAAC;QAClC,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAKD,KAAK,UAAU,qBAAqB;IAGlC,uBAAuB,EAAE,CAAC;IAE1B,OAAO,YAAY,GAAG,iBAAiB,EAAE,CAAC;QACxC,YAAY,EAAE,CAAC;QAEf,IAAI,CAAC;YACH,MAAM,CAAC,KAAK,CACV,0CAA0C,YAAY,IAAI,iBAAiB,MAAM,CAClF,CAAC;YAYF,MAAM,YAAY,GAAG,wDAAa,uBAAuB,GAAC,CAAC;YAI3D,uBAAuB,EAAE,CAAC;YAI1B,IAAI,aAAkB,CAAC;YAEvB,IAAI,SAAS,IAAI,YAAY,EAAE,CAAC;gBAC9B,aAAa,GAAI,YAAoB,CAAC,OAAO,CAAC;YAChD,CAAC;iBAAM,CAAC;gBACN,aAAa,GAAG,YAAY,CAAC;YAC/B,CAAC;YAGD,IAAI,aAAa,IAAI,OAAO,aAAa,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;gBAE9D,MAAM,cAAc,GAAG,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE;oBACtD,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;gBAC5F,CAAC,CAAC,CAAC;gBAEH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,cAAc,CAAC,CAAC,CAAC;gBAGnE,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,CAAC,YAAY,KAAK,UAAU,EAAE,CAAC;oBACzD,MAAM,IAAI,KAAK,CACb,mDAAmD;wBACjD,QAAQ,OAAO,MAAM,WAAW,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CACrF,CAAC;gBACJ,CAAC;gBAED,eAAe,GAAG,MAAM,CAAC;gBACzB,mBAAmB,GAAG,SAAS,CAAC;gBAEhC,MAAM,CAAC,GAAG,CAAC,6CAA6C,CAAC,CAAC;gBAC1D,MAAM,CAAC,GAAG,CAAC,iDAAiD,CAAC,CAAC;gBAE9D,OAAO,eAAe,CAAC;YACzB,CAAC;YAGD,IAAI,aAAa,IAAI,OAAO,aAAa,CAAC,YAAY,KAAK,UAAU,EAAE,CAAC;gBACtE,eAAe,GAAG,aAAa,CAAC;gBAChC,mBAAmB,GAAG,SAAS,CAAC;gBAChC,MAAM,CAAC,GAAG,CAAC,8CAA8C,CAAC,CAAC;gBAC3D,OAAO,eAAe,CAAC;YACzB,CAAC;YAED,MAAM,IAAI,KAAK,CACb,sCAAsC;gBACpC,SAAS,OAAO,aAAa,IAAI;gBACjC,aAAa,CAAC,CAAC,aAAa,EAAE,IAAI,IAAI;gBACtC,gBAAgB,SAAS,IAAI,YAAY,EAAE,CAC9C,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,GAAG,GAAG,KAAc,CAAC;YAC3B,mBAAmB,GAAG,GAAG,CAAC;YAG1B,IAAI,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;gBAC3E,MAAM,CAAC,KAAK,CACV,mCAAmC;oBACjC,0EAA0E;oBAC1E,UAAU,GAAG,CAAC,OAAO,EAAE,CAC1B,CAAC;gBAEF,MAAM;YACR,CAAC;YAED,IAAI,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;gBAE1C,MAAM,CAAC,KAAK,CACV,uEAAuE,GAAG,CAAC,OAAO,EAAE,CACrF,CAAC;YACJ,CAAC;YAED,MAAM,CAAC,IAAI,CAAC,uCAAuC,YAAY,YAAY,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;YAE1F,IAAI,YAAY,GAAG,iBAAiB,EAAE,CAAC;gBACrC,MAAM,OAAO,GAAG,mBAAmB,GAAG,YAAY,CAAC;gBACnD,MAAM,CAAC,KAAK,CAAC,eAAe,OAAO,OAAO,CAAC,CAAC;gBAC5C,MAAM,KAAK,CAAC,OAAO,CAAC,CAAC;YACvB,CAAC;QACH,CAAC;IACH,CAAC;IAID,uBAAuB,EAAE,CAAC;IAE1B,MAAM,CAAC,IAAI,CACT,kCAAkC,iBAAiB,aAAa;QAC9D,yCAAyC;QACzC,eAAe,mBAAmB,EAAE,OAAO,EAAE,CAChD,CAAC;IAEF,OAAO,SAAS,CAAC;AACnB,CAAC;AAKD,SAAgB,oBAAoB;IAClC,OAAO,eAAe,KAAK,SAAS,CAAC;AACvC,CAAC;AAKD,SAAgB,+BAA+B;IAC7C,OAAO,eAAe,KAAK,SAAS,IAAI,YAAY,GAAG,iBAAiB,CAAC;AAC3E,CAAC;AAKD,SAAgB,kBAAkB;IAChC,OAAO,eAAe,CAAC;AACzB,CAAC;AAKD,SAAgB,wBAAwB;IAOtC,OAAO;QACL,MAAM,EAAE,eAAe,KAAK,SAAS;QACrC,SAAS,EAAE,+BAA+B,EAAE;QAC5C,QAAQ,EAAE,YAAY;QACtB,WAAW,EAAE,iBAAiB;QAC9B,KAAK,EAAE,mBAAmB,EAAE,OAAO;KACpC,CAAC;AACJ,CAAC;AAKD,SAAgB,qBAAqB;IACnC,eAAe,GAAG,SAAS,CAAC;IAC5B,qBAAqB,GAAG,SAAS,CAAC;IAClC,mBAAmB,GAAG,SAAS,CAAC;IAChC,YAAY,GAAG,CAAC,CAAC;AACnB,CAAC"}

package/dist/libs/infrastructure/src/security/post-quantum-share-encryption.service.d.ts

@@ -0,0 +1,47 @@
+import { OnModuleInit } from '@nestjs/common';
+export interface QuantumEncryptedShare {
+    dilithiumCiphertext: string;
+    dilithiumNonce: string;
+}
+export interface HybridKeyPair {
+    ecdh: {
+        publicKey: Buffer;
+        privateKey: Buffer;
+    };
+    dilithium?: {
+        publicKey: Uint8Array;
+        secretKey: Uint8Array;
+    };
+}
+export declare class PostQuantumShareEncryptionService implements OnModuleInit {
+    private readonly logger;
+    private validatorKeys;
+    private myKeyPair?;
+    private nodeId;
+    constructor();
+    onModuleInit(): Promise<void>;
+    private getDilithium;
+    private get dilithium();
+    private initializeMyKeys;
+    getMyPublicKeys(): {
+        ecdhPublicKey: Buffer;
+        dilithiumPublicKey?: Uint8Array;
+        hasPostQuantum: boolean;
+    };
+    registerValidatorKeys(validatorId: string, ecdhPublicKey: Buffer, dilithiumPublicKey?: Uint8Array): void;
+    encryptForRecipient(data: string, recipientId: string): Promise<QuantumEncryptedShare>;
+    private encryptClassical;
+    private encryptQuantum;
+    decryptFromSender(envelope: QuantumEncryptedShare, senderId: string): Promise<string>;
+    private decryptClassical;
+    private decryptQuantum;
+    getStatus(): {
+        initialized: boolean;
+        hasPostQuantum: boolean;
+        dilithiumError?: string;
+        validatorCount: number;
+    };
+    getValidatorCount(): number;
+    hasValidatorKeys(validatorId: string): boolean;
+}
+//# sourceMappingURL=post-quantum-share-encryption.service.d.ts.map

package/dist/libs/infrastructure/src/security/post-quantum-share-encryption.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"post-quantum-share-encryption.service.d.ts","sourceRoot":"","sources":["../../../../../../../libs/infrastructure/src/security/post-quantum-share-encryption.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAsB,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAalE,MAAM,WAAW,qBAAqB;IAEpC,mBAAmB,EAAE,MAAM,CAAC;IAC5B,cAAc,EAAE,MAAM,CAAC;CACxB;AAKD,MAAM,WAAW,aAAa;IAE5B,IAAI,EAAE;QACJ,SAAS,EAAE,MAAM,CAAC;QAClB,UAAU,EAAE,MAAM,CAAC;KACpB,CAAC;IAGF,SAAS,CAAC,EAAE;QACV,SAAS,EAAE,UAAU,CAAC;QACtB,SAAS,EAAE,UAAU,CAAC;KACvB,CAAC;CACH;AAWD,qBACa,iCAAkC,YAAW,YAAY;IACpE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAsD;IAC7E,OAAO,CAAC,aAAa,CAAyC;IAC9D,OAAO,CAAC,SAAS,CAAC,CAAgB;IAClC,OAAO,CAAC,MAAM,CAAS;;IAMjB,YAAY;YAOJ,YAAY;IAQ1B,OAAO,KAAK,SAAS,GAEpB;YAKa,gBAAgB;IAuD9B,eAAe,IAAI;QACjB,aAAa,EAAE,MAAM,CAAC;QACtB,kBAAkB,CAAC,EAAE,UAAU,CAAC;QAChC,cAAc,EAAE,OAAO,CAAC;KACzB;IAeD,qBAAqB,CACnB,WAAW,EAAE,MAAM,EACnB,aAAa,EAAE,MAAM,EACrB,kBAAkB,CAAC,EAAE,UAAU,GAC9B,IAAI;IAyBD,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAmC5F,OAAO,CAAC,gBAAgB;YAkCV,cAAc;IAqCtB,iBAAiB,CAAC,QAAQ,EAAE,qBAAqB,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IA6C3F,OAAO,CAAC,gBAAgB;YA+BV,cAAc;IAmC5B,SAAS,IAAI;QACX,WAAW,EAAE,OAAO,CAAC;QACrB,cAAc,EAAE,OAAO,CAAC;QACxB,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,cAAc,EAAE,MAAM,CAAC;KACxB;IAUD,iBAAiB,IAAI,MAAM;IAI3B,gBAAgB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO;CAG/C"}

package/dist/libs/infrastructure/src/security/post-quantum-share-encryption.service.js

@@ -0,0 +1,299 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var PostQuantumShareEncryptionService_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PostQuantumShareEncryptionService = void 0;
+const common_1 = require("@nestjs/common");
+const crypto = __importStar(require("crypto"));
+const sha256_1 = require("@noble/hashes/sha256");
+const dilithium_module_loader_1 = require("./dilithium-module-loader");
+let PostQuantumShareEncryptionService = PostQuantumShareEncryptionService_1 = class PostQuantumShareEncryptionService {
+    logger = new common_1.Logger(PostQuantumShareEncryptionService_1.name);
+    validatorKeys = new Map();
+    myKeyPair;
+    nodeId;
+    constructor() {
+        this.nodeId = process.env.NODE_ID || 'unknown';
+    }
+    async onModuleInit() {
+        await this.initializeMyKeys();
+    }
+    async getDilithium() {
+        return (0, dilithium_module_loader_1.loadDilithiumModule)();
+    }
+    get dilithium() {
+        return (0, dilithium_module_loader_1.getDilithiumModule)();
+    }
+    async initializeMyKeys() {
+        try {
+            const ecdh = crypto.createECDH('secp256k1');
+            ecdh.generateKeys();
+            this.myKeyPair = {
+                ecdh: {
+                    publicKey: ecdh.getPublicKey(),
+                    privateKey: ecdh.getPrivateKey(),
+                },
+            };
+            const dilithiumApi = await this.getDilithium();
+            if (dilithiumApi) {
+                try {
+                    const dilithiumKeys = dilithiumApi.generateKeys(2);
+                    if (dilithiumKeys.result === 0 && dilithiumKeys.publicKey && dilithiumKeys.privateKey) {
+                        this.myKeyPair.dilithium = {
+                            publicKey: dilithiumKeys.publicKey,
+                            secretKey: dilithiumKeys.privateKey,
+                        };
+                        this.logger.log(`Initialized HYBRID encryption keys for ${this.nodeId}:\n` +
+                            `  ECDH (classical): ${this.myKeyPair.ecdh.publicKey.toString('hex').substring(0, 16)}...\n` +
+                            `  Dilithium (post-quantum): ${Buffer.from(this.myKeyPair.dilithium.publicKey).toString('hex').substring(0, 16)}...`);
+                    }
+                    else {
+                        this.logger.warn('Dilithium key generation failed - using classical encryption only');
+                    }
+                }
+                catch (keyGenError) {
+                    this.logger.warn(`Dilithium key generation error: ${keyGenError.message}`);
+                }
+            }
+            if (!this.myKeyPair.dilithium) {
+                this.logger.log(`Initialized CLASSICAL encryption keys for ${this.nodeId}:\n` +
+                    `  ECDH: ${this.myKeyPair.ecdh.publicKey.toString('hex').substring(0, 16)}...\n` +
+                    `  ⚠️ Post-quantum protection NOT available`);
+            }
+        }
+        catch (error) {
+            this.logger.error(`Failed to initialize encryption keys: ${error}`);
+            throw error;
+        }
+    }
+    getMyPublicKeys() {
+        if (!this.myKeyPair) {
+            throw new Error('Keys not initialized');
+        }
+        return {
+            ecdhPublicKey: this.myKeyPair.ecdh.publicKey,
+            dilithiumPublicKey: this.myKeyPair.dilithium?.publicKey,
+            hasPostQuantum: !!this.myKeyPair.dilithium,
+        };
+    }
+    registerValidatorKeys(validatorId, ecdhPublicKey, dilithiumPublicKey) {
+        const keys = {
+            ecdh: {
+                publicKey: ecdhPublicKey,
+                privateKey: Buffer.alloc(0),
+            },
+        };
+        if (dilithiumPublicKey && dilithiumPublicKey.length > 0) {
+            keys.dilithium = {
+                publicKey: dilithiumPublicKey,
+                secretKey: new Uint8Array(0),
+            };
+        }
+        this.validatorKeys.set(validatorId, keys);
+        this.logger.debug(`Registered ${keys.dilithium ? 'hybrid' : 'classical'} keys for ${validatorId}`);
+    }
+    async encryptForRecipient(data, recipientId) {
+        const recipientKeys = this.validatorKeys.get(recipientId);
+        if (!recipientKeys || recipientKeys.ecdh.publicKey.length === 0) {
+            throw new Error(`No keys registered for recipient: ${recipientId}`);
+        }
+        if (!this.myKeyPair) {
+            throw new Error('My keypair not initialized');
+        }
+        const classicalEncrypted = this.encryptClassical(data, recipientKeys.ecdh.publicKey);
+        if (this.dilithium && this.myKeyPair.dilithium) {
+            try {
+                return await this.encryptQuantum(classicalEncrypted);
+            }
+            catch (error) {
+                this.logger.warn(`Quantum encryption failed, using classical only: ${error.message}`);
+            }
+        }
+        return {
+            dilithiumCiphertext: Buffer.from(classicalEncrypted, 'utf8').toString('base64'),
+            dilithiumNonce: crypto.randomBytes(12).toString('base64'),
+        };
+    }
+    encryptClassical(data, recipientECDHKey) {
+        if (!this.myKeyPair) {
+            throw new Error('Keys not initialized');
+        }
+        const ephemeralECDH = crypto.createECDH('secp256k1');
+        ephemeralECDH.generateKeys();
+        const sharedSecret = ephemeralECDH.computeSecret(recipientECDHKey);
+        const aesKey = Buffer.from((0, sha256_1.sha256)(Buffer.concat([Buffer.from((0, sha256_1.sha256)(sharedSecret)), Buffer.from('tss-share-classical')])));
+        const iv = crypto.randomBytes(12);
+        const cipher = crypto.createCipheriv('aes-256-gcm', aesKey, iv);
+        const plaintext = Buffer.from(data, 'utf8');
+        const ciphertext = Buffer.concat([cipher.update(plaintext), cipher.final()]);
+        const tag = cipher.getAuthTag();
+        const envelope = [
+            ephemeralECDH.getPublicKey().toString('base64'),
+            iv.toString('base64'),
+            tag.toString('base64'),
+            ciphertext.toString('base64'),
+        ].join(':');
+        return envelope;
+    }
+    async encryptQuantum(data) {
+        if (!this.dilithium || !this.myKeyPair?.dilithium) {
+            throw new Error('Dilithium not available');
+        }
+        const ephemeralKey = crypto.randomBytes(32);
+        const nonce = crypto.randomBytes(12);
+        const cipher = crypto.createCipheriv('aes-256-gcm', ephemeralKey, nonce);
+        const plaintext = Buffer.from(data, 'utf8');
+        const ciphertext = Buffer.concat([cipher.update(plaintext), cipher.final()]);
+        const tag = cipher.getAuthTag();
+        const keyMaterial = Buffer.concat([ephemeralKey, nonce]);
+        const dilithiumSig = this.dilithium.sign(keyMaterial, this.myKeyPair.dilithium.secretKey, 2);
+        if (dilithiumSig.result !== 0) {
+            throw new Error(`Dilithium signing failed with code ${dilithiumSig.result}`);
+        }
+        const envelope = Buffer.concat([
+            ephemeralKey,
+            nonce,
+            tag,
+            ciphertext,
+            Buffer.from(dilithiumSig.signature),
+        ]);
+        return {
+            dilithiumCiphertext: envelope.toString('base64'),
+            dilithiumNonce: nonce.toString('base64'),
+        };
+    }
+    async decryptFromSender(envelope, senderId) {
+        if (!this.myKeyPair) {
+            throw new Error('Keys not initialized');
+        }
+        const senderKeys = this.validatorKeys.get(senderId);
+        if (!senderKeys) {
+            throw new Error(`No keys for sender: ${senderId}`);
+        }
+        try {
+            if (this.dilithium && senderKeys.dilithium) {
+                try {
+                    const classicalData = await this.decryptQuantum(envelope, senderKeys.dilithium.publicKey);
+                    const plaintext = this.decryptClassical(classicalData);
+                    this.logger.debug(`Decrypted share from ${senderId} (hybrid quantum-resistant)`);
+                    return plaintext;
+                }
+                catch (quantumError) {
+                    this.logger.debug(`Quantum decryption failed, trying classical: ${quantumError.message}`);
+                }
+            }
+            const classicalData = Buffer.from(envelope.dilithiumCiphertext, 'base64').toString('utf8');
+            if (classicalData.includes(':')) {
+                const plaintext = this.decryptClassical(classicalData);
+                this.logger.debug(`Decrypted share from ${senderId} (classical only)`);
+                return plaintext;
+            }
+            throw new Error('Unable to decrypt: unknown envelope format');
+        }
+        catch (error) {
+            this.logger.error(`Failed to decrypt share from ${senderId}: ${error}`);
+            throw error;
+        }
+    }
+    decryptClassical(envelope) {
+        if (!this.myKeyPair) {
+            throw new Error('Keys not initialized');
+        }
+        const [ephemeralPubKeyB64, ivB64, tagB64, ciphertextB64] = envelope.split(':');
+        const ephemeralPublicKey = Buffer.from(ephemeralPubKeyB64, 'base64');
+        const iv = Buffer.from(ivB64, 'base64');
+        const tag = Buffer.from(tagB64, 'base64');
+        const ciphertext = Buffer.from(ciphertextB64, 'base64');
+        const ecdh = crypto.createECDH('secp256k1');
+        ecdh.setPrivateKey(this.myKeyPair.ecdh.privateKey);
+        const sharedSecret = ecdh.computeSecret(ephemeralPublicKey);
+        const aesKey = Buffer.from((0, sha256_1.sha256)(Buffer.concat([Buffer.from((0, sha256_1.sha256)(sharedSecret)), Buffer.from('tss-share-classical')])));
+        const decipher = crypto.createDecipheriv('aes-256-gcm', aesKey, iv);
+        decipher.setAuthTag(tag);
+        const decrypted = Buffer.concat([decipher.update(ciphertext), decipher.final()]);
+        return decrypted.toString('utf8');
+    }
+    async decryptQuantum(envelope, senderDilithiumKey) {
+        if (!this.dilithium) {
+            throw new Error('Dilithium not available');
+        }
+        const envelopeBuffer = Buffer.from(envelope.dilithiumCiphertext, 'base64');
+        const ephemeralKey = envelopeBuffer.slice(0, 32);
+        const nonce = envelopeBuffer.slice(32, 44);
+        const tag = envelopeBuffer.slice(44, 60);
+        const signatureLength = 2706;
+        const ciphertext = envelopeBuffer.slice(60, -signatureLength);
+        const signature = envelopeBuffer.slice(-signatureLength);
+        const keyMaterial = Buffer.concat([ephemeralKey, nonce]);
+        const verifyResult = this.dilithium.verify(signature, keyMaterial, senderDilithiumKey, 2);
+        if (verifyResult.result !== 0) {
+            throw new Error('Dilithium signature verification failed');
+        }
+        const decipher = crypto.createDecipheriv('aes-256-gcm', ephemeralKey, nonce);
+        decipher.setAuthTag(tag);
+        const decrypted = Buffer.concat([decipher.update(ciphertext), decipher.final()]);
+        return decrypted.toString('utf8');
+    }
+    getStatus() {
+        const loaderStatus = (0, dilithium_module_loader_1.getDilithiumLoaderStatus)();
+        return {
+            initialized: !!this.myKeyPair,
+            hasPostQuantum: !!this.myKeyPair?.dilithium,
+            dilithiumError: loaderStatus.error,
+            validatorCount: this.validatorKeys.size,
+        };
+    }
+    getValidatorCount() {
+        return this.validatorKeys.size;
+    }
+    hasValidatorKeys(validatorId) {
+        return this.validatorKeys.has(validatorId);
+    }
+};
+exports.PostQuantumShareEncryptionService = PostQuantumShareEncryptionService;
+exports.PostQuantumShareEncryptionService = PostQuantumShareEncryptionService = PostQuantumShareEncryptionService_1 = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [])
+], PostQuantumShareEncryptionService);
+//# sourceMappingURL=post-quantum-share-encryption.service.js.map

package/dist/libs/infrastructure/src/security/post-quantum-share-encryption.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"post-quantum-share-encryption.service.js","sourceRoot":"","sources":["../../../../../../../libs/infrastructure/src/security/post-quantum-share-encryption.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,2CAAkE;AAClE,+CAAiC;AACjC,iDAA8C;AAC9C,uEAKmC;AAsC5B,IAAM,iCAAiC,yCAAvC,MAAM,iCAAiC;IAC3B,MAAM,GAAG,IAAI,eAAM,CAAC,mCAAiC,CAAC,IAAI,CAAC,CAAC;IACrE,aAAa,GAA+B,IAAI,GAAG,EAAE,CAAC;IACtD,SAAS,CAAiB;IAC1B,MAAM,CAAS;IAEvB;QACE,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,SAAS,CAAC;IACjD,CAAC;IAED,KAAK,CAAC,YAAY;QAChB,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;IAChC,CAAC;IAKO,KAAK,CAAC,YAAY;QAExB,OAAO,IAAA,6CAAmB,GAAE,CAAC;IAC/B,CAAC;IAKD,IAAY,SAAS;QACnB,OAAO,IAAA,4CAAkB,GAAE,CAAC;IAC9B,CAAC;IAKO,KAAK,CAAC,gBAAgB;QAC5B,IAAI,CAAC;YAEH,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;YAC5C,IAAI,CAAC,YAAY,EAAE,CAAC;YAEpB,IAAI,CAAC,SAAS,GAAG;gBACf,IAAI,EAAE;oBACJ,SAAS,EAAE,IAAI,CAAC,YAAY,EAAE;oBAC9B,UAAU,EAAE,IAAI,CAAC,aAAa,EAAE;iBACjC;aACF,CAAC;YAGF,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;YAE/C,IAAI,YAAY,EAAE,CAAC;gBACjB,IAAI,CAAC;oBAEH,MAAM,aAAa,GAAG,YAAY,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;oBAEnD,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,IAAI,aAAa,CAAC,SAAS,IAAI,aAAa,CAAC,UAAU,EAAE,CAAC;wBACtF,IAAI,CAAC,SAAS,CAAC,SAAS,GAAG;4BACzB,SAAS,EAAE,aAAa,CAAC,SAAS;4BAClC,SAAS,EAAE,aAAa,CAAC,UAAU;yBACpC,CAAC;wBACF,IAAI,CAAC,MAAM,CAAC,GAAG,CACb,0CAA0C,IAAI,CAAC,MAAM,KAAK;4BACxD,uBAAuB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO;4BAC5F,+BAA+B,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CACvH,CAAC;oBACJ,CAAC;yBAAM,CAAC;wBACN,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,mEAAmE,CAAC,CAAC;oBACxF,CAAC;gBACH,CAAC;gBAAC,OAAO,WAAW,EAAE,CAAC;oBACrB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,mCAAoC,WAAqB,CAAC,OAAO,EAAE,CAAC,CAAC;gBACxF,CAAC;YACH,CAAC;YAED,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,CAAC;gBAC9B,IAAI,CAAC,MAAM,CAAC,GAAG,CACb,6CAA6C,IAAI,CAAC,MAAM,KAAK;oBAC3D,WAAW,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO;oBAChF,4CAA4C,CAC/C,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,yCAAyC,KAAK,EAAE,CAAC,CAAC;YACpE,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAKD,eAAe;QAKb,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAC1C,CAAC;QAED,OAAO;YACL,aAAa,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS;YAC5C,kBAAkB,EAAE,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,SAAS;YACvD,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS;SAC3C,CAAC;IACJ,CAAC;IAKD,qBAAqB,CACnB,WAAmB,EACnB,aAAqB,EACrB,kBAA+B;QAE/B,MAAM,IAAI,GAAkB;YAC1B,IAAI,EAAE;gBACJ,SAAS,EAAE,aAAa;gBACxB,UAAU,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;aAC5B;SACF,CAAC;QAEF,IAAI,kBAAkB,IAAI,kBAAkB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxD,IAAI,CAAC,SAAS,GAAG;gBACf,SAAS,EAAE,kBAAkB;gBAC7B,SAAS,EAAE,IAAI,UAAU,CAAC,CAAC,CAAC;aAC7B,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;QAC1C,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,cAAc,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,aAAa,WAAW,EAAE,CAChF,CAAC;IACJ,CAAC;IAMD,KAAK,CAAC,mBAAmB,CAAC,IAAY,EAAE,WAAmB;QACzD,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAE1D,IAAI,CAAC,aAAa,IAAI,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChE,MAAM,IAAI,KAAK,CAAC,qCAAqC,WAAW,EAAE,CAAC,CAAC;QACtE,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QAChD,CAAC;QAGD,MAAM,kBAAkB,GAAG,IAAI,CAAC,gBAAgB,CAAC,IAAI,EAAE,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAGrF,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,CAAC;YAC/C,IAAI,CAAC;gBACH,OAAO,MAAM,IAAI,CAAC,cAAc,CAAC,kBAAkB,CAAC,CAAC;YACvD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,oDAAqD,KAAe,CAAC,OAAO,EAAE,CAC/E,CAAC;YACJ,CAAC;QACH,CAAC;QAGD,OAAO;YACL,mBAAmB,EAAE,MAAM,CAAC,IAAI,CAAC,kBAAkB,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAC/E,cAAc,EAAE,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;SAC1D,CAAC;IACJ,CAAC;IAKO,gBAAgB,CAAC,IAAY,EAAE,gBAAwB;QAC7D,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAC1C,CAAC;QAED,MAAM,aAAa,GAAG,MAAM,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;QACrD,aAAa,CAAC,YAAY,EAAE,CAAC;QAE7B,MAAM,YAAY,GAAG,aAAa,CAAC,aAAa,CAAC,gBAAgB,CAAC,CAAC;QAEnE,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CACxB,IAAA,eAAM,EAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAA,eAAM,EAAC,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,CAC/F,CAAC;QAEF,MAAM,EAAE,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QAClC,MAAM,MAAM,GAAG,MAAM,CAAC,cAAc,CAAC,aAAa,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;QAEhE,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC5C,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QAC7E,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QAEhC,MAAM,QAAQ,GAAG;YACf,aAAa,CAAC,YAAY,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAC/C,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC;YACrB,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC;YACtB,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC;SAC9B,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAEZ,OAAO,QAAQ,CAAC;IAClB,CAAC;IAKO,KAAK,CAAC,cAAc,CAAC,IAAY;QACvC,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,EAAE,CAAC;YAClD,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;QAC7C,CAAC;QAED,MAAM,YAAY,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QAC5C,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QAErC,MAAM,MAAM,GAAG,MAAM,CAAC,cAAc,CAAC,aAAa,EAAE,YAAY,EAAE,KAAK,CAAC,CAAC;QACzE,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC5C,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QAC7E,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QAEhC,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC,CAAC;QACzD,MAAM,YAAY,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;QAE7F,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,sCAAsC,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC;QAC/E,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC;YAC7B,YAAY;YACZ,KAAK;YACL,GAAG;YACH,UAAU;YACV,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC;SACpC,CAAC,CAAC;QAEH,OAAO;YACL,mBAAmB,EAAE,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAChD,cAAc,EAAE,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC;SACzC,CAAC;IACJ,CAAC;IAKD,KAAK,CAAC,iBAAiB,CAAC,QAA+B,EAAE,QAAgB;QACvE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAC1C,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACpD,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CAAC,uBAAuB,QAAQ,EAAE,CAAC,CAAC;QACrD,CAAC;QAED,IAAI,CAAC;YAEH,IAAI,IAAI,CAAC,SAAS,IAAI,UAAU,CAAC,SAAS,EAAE,CAAC;gBAC3C,IAAI,CAAC;oBACH,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,UAAU,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;oBAC1F,MAAM,SAAS,GAAG,IAAI,CAAC,gBAAgB,CAAC,aAAa,CAAC,CAAC;oBACvD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,wBAAwB,QAAQ,6BAA6B,CAAC,CAAC;oBACjF,OAAO,SAAS,CAAC;gBACnB,CAAC;gBAAC,OAAO,YAAY,EAAE,CAAC;oBACtB,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,gDAAiD,YAAsB,CAAC,OAAO,EAAE,CAClF,CAAC;gBACJ,CAAC;YACH,CAAC;YAGD,MAAM,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,mBAAmB,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YAG3F,IAAI,aAAa,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBAChC,MAAM,SAAS,GAAG,IAAI,CAAC,gBAAgB,CAAC,aAAa,CAAC,CAAC;gBACvD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,wBAAwB,QAAQ,mBAAmB,CAAC,CAAC;gBACvE,OAAO,SAAS,CAAC;YACnB,CAAC;YAED,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;QAChE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,gCAAgC,QAAQ,KAAK,KAAK,EAAE,CAAC,CAAC;YACxE,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAKO,gBAAgB,CAAC,QAAgB;QACvC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAC1C,CAAC;QAED,MAAM,CAAC,kBAAkB,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAE/E,MAAM,kBAAkB,GAAG,MAAM,CAAC,IAAI,CAAC,kBAAkB,EAAE,QAAQ,CAAC,CAAC;QACrE,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QACxC,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAC1C,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;QAExD,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;QAC5C,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACnD,MAAM,YAAY,GAAG,IAAI,CAAC,aAAa,CAAC,kBAAkB,CAAC,CAAC;QAE5D,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CACxB,IAAA,eAAM,EAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAA,eAAM,EAAC,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,CAC/F,CAAC;QAEF,MAAM,QAAQ,GAAG,MAAM,CAAC,gBAAgB,CAAC,aAAa,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;QACpE,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QAEzB,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QAEjF,OAAO,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACpC,CAAC;IAKO,KAAK,CAAC,cAAc,CAC1B,QAA+B,EAC/B,kBAA8B;QAE9B,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;QAC7C,CAAC;QAED,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,mBAAmB,EAAE,QAAQ,CAAC,CAAC;QAE3E,MAAM,YAAY,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACjD,MAAM,KAAK,GAAG,cAAc,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QAC3C,MAAM,GAAG,GAAG,cAAc,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QACzC,MAAM,eAAe,GAAG,IAAI,CAAC;QAC7B,MAAM,UAAU,GAAG,cAAc,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,CAAC;QAC9D,MAAM,SAAS,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC,eAAe,CAAC,CAAC;QAEzD,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC,CAAC;QACzD,MAAM,YAAY,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,SAAS,EAAE,WAAW,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC;QAE1F,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;QAC7D,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,CAAC,gBAAgB,CAAC,aAAa,EAAE,YAAY,EAAE,KAAK,CAAC,CAAC;QAC7E,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QAEzB,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QAEjF,OAAO,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACpC,CAAC;IAKD,SAAS;QAMP,MAAM,YAAY,GAAG,IAAA,kDAAwB,GAAE,CAAC;QAChD,OAAO;YACL,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,SAAS;YAC7B,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS;YAC3C,cAAc,EAAE,YAAY,CAAC,KAAK;YAClC,cAAc,EAAE,IAAI,CAAC,aAAa,CAAC,IAAI;SACxC,CAAC;IACJ,CAAC;IAED,iBAAiB;QACf,OAAO,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC;IACjC,CAAC;IAED,gBAAgB,CAAC,WAAmB;QAClC,OAAO,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAC7C,CAAC;CACF,CAAA;AAtXY,8EAAiC;4CAAjC,iCAAiC;IAD7C,IAAA,mBAAU,GAAE;;GACA,iCAAiC,CAsX7C"}

package/dist/libs/infrastructure/src/security/share-encryption.service.d.ts

@@ -0,0 +1,27 @@
+export interface EncryptedShare {
+    encryptedData: string;
+    ephemeralPublicKey: string;
+    iv: string;
+    tag: string;
+}
+export interface ValidatorKeyPair {
+    publicKey: Buffer;
+    privateKey: Buffer;
+}
+export declare class ShareEncryptionService {
+    private readonly logger;
+    private validatorKeys;
+    private myKeyPair?;
+    private nodeId;
+    constructor();
+    private initializeMyKeys;
+    getMyPublicKey(): Buffer;
+    registerValidatorPublicKey(validatorId: string, publicKey: Buffer): void;
+    encryptForRecipient(data: string, recipientId: string): EncryptedShare;
+    decryptFromSender(envelope: EncryptedShare, senderId: string): string;
+    private deriveAESKey;
+    getValidatorCount(): number;
+    hasValidatorKey(validatorId: string): boolean;
+    exportPublicKeys(): Record<string, string>;
+}
+//# sourceMappingURL=share-encryption.service.d.ts.map

package/dist/libs/infrastructure/src/security/share-encryption.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"share-encryption.service.d.ts","sourceRoot":"","sources":["../../../../../../../libs/infrastructure/src/security/share-encryption.service.ts"],"names":[],"mappings":"AAOA,MAAM,WAAW,cAAc;IAC7B,aAAa,EAAE,MAAM,CAAC;IACtB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,GAAG,EAAE,MAAM,CAAC;CACb;AAKD,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;CACpB;AAeD,qBACa,sBAAsB;IACjC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA2C;IAClE,OAAO,CAAC,aAAa,CAA4C;IACjE,OAAO,CAAC,SAAS,CAAC,CAAmB;IACrC,OAAO,CAAC,MAAM,CAAS;;IAUvB,OAAO,CAAC,gBAAgB;IAmBxB,cAAc,IAAI,MAAM;IAaxB,0BAA0B,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI;IAkBxE,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,cAAc;IA4CtE,iBAAiB,CAAC,QAAQ,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM;IAyCrE,OAAO,CAAC,YAAY;IAiBpB,iBAAiB,IAAI,MAAM;IAS3B,eAAe,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO;IAO7C,gBAAgB,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;CAS3C"}

package/dist/libs/infrastructure/src/security/share-encryption.service.js

@@ -0,0 +1,156 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var ShareEncryptionService_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ShareEncryptionService = void 0;
+const common_1 = require("@nestjs/common");
+const crypto = __importStar(require("crypto"));
+const sha256_1 = require("@noble/hashes/sha256");
+let ShareEncryptionService = ShareEncryptionService_1 = class ShareEncryptionService {
+    logger = new common_1.Logger(ShareEncryptionService_1.name);
+    validatorKeys = new Map();
+    myKeyPair;
+    nodeId;
+    constructor() {
+        this.nodeId = process.env.NODE_ID || 'unknown';
+        this.initializeMyKeys();
+    }
+    initializeMyKeys() {
+        const ecdh = crypto.createECDH('secp256k1');
+        ecdh.generateKeys();
+        this.myKeyPair = {
+            publicKey: ecdh.getPublicKey(),
+            privateKey: ecdh.getPrivateKey(),
+        };
+        this.logger.log(`Initialized encryption keys for ${this.nodeId} ` +
+            `(public key: ${this.myKeyPair.publicKey.toString('hex').substring(0, 16)}...)`);
+    }
+    getMyPublicKey() {
+        if (!this.myKeyPair) {
+            throw new Error('Key pair not initialized');
+        }
+        return this.myKeyPair.publicKey;
+    }
+    registerValidatorPublicKey(validatorId, publicKey) {
+        this.validatorKeys.set(validatorId, {
+            publicKey,
+            privateKey: Buffer.alloc(0),
+        });
+        this.logger.debug(`Registered public key for ${validatorId}: ${publicKey.toString('hex').substring(0, 16)}...`);
+    }
+    encryptForRecipient(data, recipientId) {
+        const recipientKeys = this.validatorKeys.get(recipientId);
+        if (!recipientKeys || recipientKeys.publicKey.length === 0) {
+            throw new Error(`No public key registered for recipient: ${recipientId}`);
+        }
+        if (!this.myKeyPair) {
+            throw new Error('My key pair not initialized');
+        }
+        const ephemeralECDH = crypto.createECDH('secp256k1');
+        ephemeralECDH.generateKeys();
+        const sharedSecret = ephemeralECDH.computeSecret(recipientKeys.publicKey);
+        const aesKey = this.deriveAESKey(sharedSecret);
+        const iv = crypto.randomBytes(12);
+        const cipher = crypto.createCipheriv('aes-256-gcm', aesKey, iv);
+        const plaintext = Buffer.from(data, 'utf8');
+        const ciphertext = Buffer.concat([cipher.update(plaintext), cipher.final()]);
+        const tag = cipher.getAuthTag();
+        return {
+            encryptedData: ciphertext.toString('base64'),
+            ephemeralPublicKey: ephemeralECDH.getPublicKey().toString('base64'),
+            iv: iv.toString('base64'),
+            tag: tag.toString('base64'),
+        };
+    }
+    decryptFromSender(envelope, senderId) {
+        if (!this.myKeyPair) {
+            throw new Error('My key pair not initialized');
+        }
+        try {
+            const ciphertext = Buffer.from(envelope.encryptedData, 'base64');
+            const ephemeralPublicKey = Buffer.from(envelope.ephemeralPublicKey, 'base64');
+            const iv = Buffer.from(envelope.iv, 'base64');
+            const tag = Buffer.from(envelope.tag, 'base64');
+            const ecdh = crypto.createECDH('secp256k1');
+            ecdh.setPrivateKey(this.myKeyPair.privateKey);
+            const sharedSecret = ecdh.computeSecret(ephemeralPublicKey);
+            const aesKey = this.deriveAESKey(sharedSecret);
+            const decipher = crypto.createDecipheriv('aes-256-gcm', aesKey, iv);
+            decipher.setAuthTag(tag);
+            const decrypted = Buffer.concat([decipher.update(ciphertext), decipher.final()]);
+            this.logger.debug(`Decrypted share from ${senderId}`);
+            return decrypted.toString('utf8');
+        }
+        catch (error) {
+            this.logger.error(`Failed to decrypt share from ${senderId}: ${error}`);
+            throw new Error(`Decryption failed: ${error}`);
+        }
+    }
+    deriveAESKey(sharedSecret) {
+        const salt = Buffer.alloc(32);
+        const info = Buffer.from('tss-share-encryption', 'utf8');
+        const prk = (0, sha256_1.sha256)(Buffer.concat([salt, sharedSecret]));
+        const okm = (0, sha256_1.sha256)(Buffer.concat([Buffer.from(prk), info, Buffer.from([0x01])]));
+        return Buffer.from(okm);
+    }
+    getValidatorCount() {
+        return this.validatorKeys.size;
+    }
+    hasValidatorKey(validatorId) {
+        return this.validatorKeys.has(validatorId);
+    }
+    exportPublicKeys() {
+        const keys = {};
+        for (const [validatorId, keyPair] of this.validatorKeys.entries()) {
+            keys[validatorId] = keyPair.publicKey.toString('hex');
+        }
+        return keys;
+    }
+};
+exports.ShareEncryptionService = ShareEncryptionService;
+exports.ShareEncryptionService = ShareEncryptionService = ShareEncryptionService_1 = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [])
+], ShareEncryptionService);
+//# sourceMappingURL=share-encryption.service.js.map

package/dist/libs/infrastructure/src/security/share-encryption.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"share-encryption.service.js","sourceRoot":"","sources":["../../../../../../../libs/infrastructure/src/security/share-encryption.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,2CAAoD;AACpD,+CAAiC;AACjC,iDAA8C;AAkCvC,IAAM,sBAAsB,8BAA5B,MAAM,sBAAsB;IAChB,MAAM,GAAG,IAAI,eAAM,CAAC,wBAAsB,CAAC,IAAI,CAAC,CAAC;IAC1D,aAAa,GAAkC,IAAI,GAAG,EAAE,CAAC;IACzD,SAAS,CAAoB;IAC7B,MAAM,CAAS;IAEvB;QACE,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,SAAS,CAAC;QAC/C,IAAI,CAAC,gBAAgB,EAAE,CAAC;IAC1B,CAAC;IAKO,gBAAgB;QAEtB,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;QAC5C,IAAI,CAAC,YAAY,EAAE,CAAC;QAEpB,IAAI,CAAC,SAAS,GAAG;YACf,SAAS,EAAE,IAAI,CAAC,YAAY,EAAE;YAC9B,UAAU,EAAE,IAAI,CAAC,aAAa,EAAE;SACjC,CAAC;QAEF,IAAI,CAAC,MAAM,CAAC,GAAG,CACb,mCAAmC,IAAI,CAAC,MAAM,GAAG;YAC/C,gBAAgB,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAClF,CAAC;IACJ,CAAC;IAKD,cAAc;QACZ,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;QAC9C,CAAC;QACD,OAAO,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC;IAClC,CAAC;IAQD,0BAA0B,CAAC,WAAmB,EAAE,SAAiB;QAC/D,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,WAAW,EAAE;YAClC,SAAS;YACT,UAAU,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;SAC5B,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,6BAA6B,WAAW,KAAK,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAC7F,CAAC;IACJ,CAAC;IASD,mBAAmB,CAAC,IAAY,EAAE,WAAmB;QACnD,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAE1D,IAAI,CAAC,aAAa,IAAI,aAAa,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3D,MAAM,IAAI,KAAK,CAAC,2CAA2C,WAAW,EAAE,CAAC,CAAC;QAC5E,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;QACjD,CAAC;QAGD,MAAM,aAAa,GAAG,MAAM,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;QACrD,aAAa,CAAC,YAAY,EAAE,CAAC;QAG7B,MAAM,YAAY,GAAG,aAAa,CAAC,aAAa,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC;QAG1E,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC;QAG/C,MAAM,EAAE,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QAClC,MAAM,MAAM,GAAG,MAAM,CAAC,cAAc,CAAC,aAAa,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;QAEhE,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC5C,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QAC7E,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QAEhC,OAAO;YACL,aAAa,EAAE,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAC5C,kBAAkB,EAAE,aAAa,CAAC,YAAY,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC;YACnE,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC;YACzB,GAAG,EAAE,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC;SAC5B,CAAC;IACJ,CAAC;IASD,iBAAiB,CAAC,QAAwB,EAAE,QAAgB;QAC1D,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;QACjD,CAAC;QAED,IAAI,CAAC;YAEH,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;YACjE,MAAM,kBAAkB,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,kBAAkB,EAAE,QAAQ,CAAC,CAAC;YAC9E,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;YAC9C,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;YAGhD,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;YAC5C,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;YAC9C,MAAM,YAAY,GAAG,IAAI,CAAC,aAAa,CAAC,kBAAkB,CAAC,CAAC;YAG5D,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC;YAG/C,MAAM,QAAQ,GAAG,MAAM,CAAC,gBAAgB,CAAC,aAAa,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;YACpE,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YAEzB,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;YAEjF,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,wBAAwB,QAAQ,EAAE,CAAC,CAAC;YAEtD,OAAO,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACpC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,gCAAgC,QAAQ,KAAK,KAAK,EAAE,CAAC,CAAC;YACxE,MAAM,IAAI,KAAK,CAAC,sBAAsB,KAAK,EAAE,CAAC,CAAC;QACjD,CAAC;IACH,CAAC;IAQO,YAAY,CAAC,YAAoB;QAEvC,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC9B,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,sBAAsB,EAAE,MAAM,CAAC,CAAC;QAGzD,MAAM,GAAG,GAAG,IAAA,eAAM,EAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC;QAGxD,MAAM,GAAG,GAAG,IAAA,eAAM,EAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAEjF,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;IAKD,iBAAiB;QACf,OAAO,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC;IACjC,CAAC;IAOD,eAAe,CAAC,WAAmB;QACjC,OAAO,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAC7C,CAAC;IAKD,gBAAgB;QACd,MAAM,IAAI,GAA2B,EAAE,CAAC;QAExC,KAAK,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,EAAE,CAAC;YAClE,IAAI,CAAC,WAAW,CAAC,GAAG,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACxD,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;CACF,CAAA;AA/LY,wDAAsB;iCAAtB,sBAAsB;IADlC,IAAA,mBAAU,GAAE;;GACA,sBAAsB,CA+LlC"}

package/dist/libs/infrastructure/src/security/vault-key-provider.service.d.ts

@@ -0,0 +1,25 @@
+import { OnModuleInit } from '@nestjs/common';
+export interface IKeyProvider {
+    getKey(keyName: string): Promise<string | null>;
+    isAvailable(): boolean;
+}
+export declare class VaultKeyProviderService implements OnModuleInit, IKeyProvider {
+    private readonly logger;
+    private readonly vaultSecretsPath;
+    private readonly envKeyMapping;
+    private keyCache;
+    private mode;
+    constructor();
+    onModuleInit(): Promise<void>;
+    private detectProvider;
+    isAvailable(): boolean;
+    getProviderMode(): 'vault' | 'env' | 'file';
+    getKey(keyName: string): Promise<string | null>;
+    getWalletMasterKey(): Promise<string>;
+    private getKeyFromVault;
+    private getKeyFromFile;
+    private getKeyFromEnv;
+    clearCache(): void;
+    refreshKey(keyName: string): Promise<string | null>;
+}
+//# sourceMappingURL=vault-key-provider.service.d.ts.map

package/dist/libs/infrastructure/src/security/vault-key-provider.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vault-key-provider.service.d.ts","sourceRoot":"","sources":["../../../../../../../libs/infrastructure/src/security/vault-key-provider.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAsB,YAAY,EAAE,MAAM,gBAAgB,CAAC;AASlE,MAAM,WAAW,YAAY;IAC3B,MAAM,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAChD,WAAW,IAAI,OAAO,CAAC;CACxB;AAkBD,qBACa,uBAAwB,YAAW,YAAY,EAAE,YAAY;IACxE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA4C;IAGnE,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAS;IAG1C,OAAO,CAAC,QAAQ,CAAC,aAAa,CAK5B;IAGF,OAAO,CAAC,QAAQ,CAAkC;IAGlD,OAAO,CAAC,IAAI,CAAmC;;IAOzC,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC;YAOrB,cAAc;IAiC5B,WAAW,IAAI,OAAO;IAOtB,eAAe,IAAI,OAAO,GAAG,KAAK,GAAG,MAAM;IAUrC,MAAM,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAoC/C,kBAAkB,IAAI,OAAO,CAAC,MAAM,CAAC;YAsB7B,eAAe;YAmBf,cAAc;IAwB5B,OAAO,CAAC,aAAa;IAuBrB,UAAU,IAAI,IAAI;IAWZ,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;CAI1D"}