@hsuite/smart-engines-cli 1.0.0

package/dist/libs/infrastructure/src/messaging/event-bus.service.js

@@ -0,0 +1,797 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var EventBusService_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EventBusService = void 0;
+const common_1 = require("@nestjs/common");
+const nats_1 = require("nats");
+const nats_acl_service_1 = require("../nats/nats-acl.service");
+const nats_mesh_service_1 = require("../nats/nats-mesh.service");
+const message_sequence_service_1 = require("./message-sequence.service");
+const crypto = __importStar(require("crypto"));
+const fs = __importStar(require("fs"));
+let EventBusService = EventBusService_1 = class EventBusService {
+    natsAcl;
+    messageSequence;
+    meshService;
+    logger = new common_1.Logger(EventBusService_1.name);
+    nc;
+    js;
+    jsm;
+    serviceName;
+    nodeId;
+    encryptionKey;
+    encryptedSubjects = ['security-stream', 'dkg-stream'];
+    meshBroadcastEnabled;
+    connectionReady;
+    resolveConnection;
+    rejectConnection;
+    constructor(natsAcl, messageSequence, meshService) {
+        this.natsAcl = natsAcl;
+        this.messageSequence = messageSequence;
+        this.meshService = meshService;
+        this.serviceName = process.env.SERVICE_NAME || 'smart-validator';
+        this.nodeId = process.env.NODE_ID || `validator-${crypto.randomBytes(8).toString('hex')}`;
+        const encryptionKey = process.env.EVENT_BUS_ENCRYPTION_KEY;
+        if (encryptionKey) {
+            this.encryptionKey = this.normalizeEncryptionKey(encryptionKey);
+            this.logger.log('Event bus encryption enabled for sensitive subjects');
+        }
+        this.meshBroadcastEnabled = process.env.NATS_MESH_BROADCAST !== 'false';
+        this.connectionReady = new Promise((resolve, reject) => {
+            this.resolveConnection = resolve;
+            this.rejectConnection = reject;
+        });
+        this.connectionReady.catch(() => undefined);
+        this.logger.log('Event bus running in MESH mode - connecting immediately...');
+        this.connectImmediate();
+    }
+    connectImmediate() {
+        (async () => {
+            try {
+                if (this.meshService) {
+                    await this.waitForMeshService();
+                }
+                await this.connect();
+                this.logger.log('✓ EventBusService connected successfully in constructor');
+                this.resolveConnection();
+            }
+            catch (err) {
+                this.logger.error(`Failed to connect in constructor: ${err.message}`);
+                this.rejectConnection(err);
+            }
+        })();
+    }
+    async onModuleInit() {
+        this.logger.debug('EventBusService.onModuleInit() START');
+        await this.connectionReady;
+        this.logger.debug('EventBusService.onModuleInit() END');
+    }
+    async waitForConnection() {
+        return this.connectionReady;
+    }
+    async waitForMeshService() {
+        this.logger.log('Waiting for NatsMeshService to connect...');
+        if (!this.meshService) {
+            throw new Error('NatsMeshService not available');
+        }
+        try {
+            await this.meshService.waitForConnection();
+            this.logger.log('✓ NatsMeshService is connected');
+        }
+        catch (error) {
+            const err = error;
+            throw new Error(`NatsMeshService failed to connect: ${err.message}. Ensure NATS server is running at ` +
+                (process.env.NATS_SERVERS || 'nats://localhost:4222'));
+        }
+    }
+    async onModuleDestroy() {
+        await this.disconnect();
+    }
+    async connect() {
+        try {
+            if (this.meshService) {
+                this.logger.log('Using mesh service for NATS connection...');
+                if (this.meshService.isLocalConnected()) {
+                    this.nc = this.meshService.getLocalConnection();
+                    this.js = this.meshService.getLocalJetStream();
+                    this.jsm = this.meshService.getLocalJetStreamManager();
+                    this.logger.log('✓ Using mesh service NATS connection');
+                    await this.setupStreams();
+                    return;
+                }
+                else {
+                    throw new Error('Mesh service unexpectedly disconnected');
+                }
+            }
+            const servers = process.env.NATS_SERVERS?.split(',') || ['nats://localhost:4222'];
+            const tlsEnabled = process.env.NATS_TLS_ENABLED === 'true';
+            this.logger.log(`Connecting to NATS servers: ${servers.join(', ')}${tlsEnabled ? ' (TLS enabled)' : ''}`);
+            const connectOptions = {
+                servers,
+                name: this.serviceName,
+                token: process.env.NATS_TOKEN,
+                timeout: 10000,
+            };
+            if (tlsEnabled) {
+                const tlsCAFile = process.env.NATS_TLS_CA_FILE;
+                const tlsCertFile = process.env.NATS_TLS_CERT_FILE;
+                const tlsKeyFile = process.env.NATS_TLS_KEY_FILE;
+                const tlsOptions = {};
+                if (tlsCAFile && fs.existsSync(tlsCAFile)) {
+                    tlsOptions.caFile = tlsCAFile;
+                    this.logger.debug(`Using NATS CA file: ${tlsCAFile}`);
+                }
+                if (tlsCertFile && tlsKeyFile) {
+                    if (fs.existsSync(tlsCertFile) && fs.existsSync(tlsKeyFile)) {
+                        tlsOptions.certFile = tlsCertFile;
+                        tlsOptions.keyFile = tlsKeyFile;
+                        this.logger.debug(`Using NATS client cert: ${tlsCertFile}`);
+                    }
+                }
+                connectOptions.tls = tlsOptions;
+                this.logger.log('NATS TLS enabled');
+            }
+            this.nc = await (0, nats_1.connect)(connectOptions);
+            this.js = this.nc.jetstream();
+            this.jsm = await this.nc.jetstreamManager();
+            this.logger.log('Connected to NATS JetStream');
+            await this.setupStreams();
+        }
+        catch (error) {
+            const err = error;
+            this.logger.error('Failed to connect to NATS:', err.message);
+            throw new Error(`NATS connection required for event bus: ${err.message}`);
+        }
+    }
+    async setupStreams() {
+        const streams = [
+            {
+                name: 'multi-chain-stream',
+                subjects: ['multi-chain.>', 'multi-chain-stream.>'],
+                description: 'Cross-chain transaction coordination events',
+            },
+            {
+                name: 'networking-stream',
+                subjects: ['networking.>', 'networking-stream.>'],
+                description: 'Validator discovery and membership events',
+            },
+            {
+                name: 'security-stream',
+                subjects: ['security.>', 'security-stream.>'],
+                description: 'Security and signature verification events',
+            },
+            {
+                name: 'dkg-stream',
+                subjects: ['dkg.>', 'dkg-stream.>'],
+                description: 'Distributed Key Generation and threshold signature events',
+            },
+            {
+                name: 'genesis-stream',
+                subjects: ['genesis.>', 'genesis-stream.>'],
+                description: 'Genesis bootstrap and multi-chain genesis events',
+            },
+            {
+                name: 'governance-stream',
+                subjects: ['governance.>', 'governance-stream.>'],
+                description: 'Validator governance and registry events',
+            },
+            {
+                name: 'xrpl-stream',
+                subjects: ['xrpl.>', 'xrpl-stream.>'],
+                description: 'XRPL multi-sig signature coordination events',
+            },
+            {
+                name: 'hedera-stream',
+                subjects: ['hedera.>', 'hedera-stream.>'],
+                description: 'Hedera TSS/MPC signing coordination events',
+            },
+            {
+                name: 'polkadot-stream',
+                subjects: ['polkadot.>', 'polkadot-stream.>'],
+                description: 'Polkadot pallet_multisig auto-watcher + approval coordination events',
+            },
+            {
+                name: 'membership-stream',
+                subjects: ['membership.>', 'membership-stream.>'],
+                description: 'Validator membership and deposit wallet events',
+            },
+            {
+                name: 'subscription-stream',
+                subjects: ['subscription.>', 'subscription-stream.>'],
+                description: 'Smart app subscription events',
+            },
+            {
+                name: 'entity-registry-stream',
+                subjects: ['entity-registry.>', 'entity-registry-stream.>'],
+                description: 'Entity-validator binding lifecycle events (Mongo + NATS + IPFS distribution layer)',
+            },
+            {
+                name: 'smart-app-stream',
+                subjects: ['smart-app.>', 'smart-app-stream.>'],
+                description: 'Smart-app deployment lifecycle events',
+            },
+            {
+                name: 'ipfs-stream',
+                subjects: ['ipfs.>', 'ipfs-stream.>'],
+                description: 'IPFS pin propagation and cluster sync events',
+            },
+            {
+                name: 'host-mesh-stream',
+                subjects: ['host-mesh.>', 'host-mesh-stream.>'],
+                description: 'Smart Host network coordination events',
+            },
+            {
+                name: 'agent-lifecycle-stream',
+                subjects: ['agent-lifecycle.>', 'agent.>'],
+                description: 'Smart Agent lifecycle events',
+            },
+        ];
+        for (const stream of streams) {
+            try {
+                await this.jsm.streams.info(stream.name);
+                this.logger.debug(`Stream ${stream.name} already exists`);
+            }
+            catch (error) {
+                try {
+                    await this.jsm.streams.add({
+                        name: stream.name,
+                        subjects: stream.subjects,
+                        max_age: 24 * 60 * 60 * 1e9,
+                    });
+                    this.logger.log(`Created stream: ${stream.name}`);
+                }
+                catch (createError) {
+                    const err = createError;
+                    this.logger.warn(`Failed to create stream ${stream.name}: ${err.message}`);
+                }
+            }
+        }
+    }
+    async disconnect() {
+        if (this.meshService) {
+            this.logger.log('NATS disconnection handled by mesh service');
+            this.nc = undefined;
+            this.js = undefined;
+            this.jsm = undefined;
+            return;
+        }
+        if (this.nc) {
+            await this.nc.drain();
+            await this.nc.close();
+            this.logger.log('Disconnected from NATS');
+        }
+    }
+    async publishEvent(streamName, eventType, data) {
+        if (!this.nc || !this.js) {
+            this.logger.debug(`Waiting for NATS connection before publishing to ${streamName}...`);
+            try {
+                await this.connectionReady;
+            }
+            catch (error) {
+                const err = error;
+                this.logger.error(`NATS connection failed, cannot publish to ${streamName}: ${err.message}`);
+                throw new Error(`NATS connection required for publishing: ${err.message}`);
+            }
+        }
+        if (!this.nc || !this.js) {
+            throw new Error(`NATS connection not established after waiting - cannot publish`);
+        }
+        const subject = `${streamName}.${eventType}`;
+        const aclCheck = this.natsAcl.canPublish(this.nodeId, subject);
+        if (!aclCheck.allowed) {
+            this.logger.error(`🚨 ACL VIOLATION: Node ${this.nodeId} denied publishing to ${subject}\n` +
+                `  Reason: ${aclCheck.reason}`);
+            throw new Error(`ACL violation: ${aclCheck.reason}`);
+        }
+        const sequence = this.messageSequence.getNextSequence(this.nodeId);
+        const event = {
+            eventId: crypto.randomUUID(),
+            eventType,
+            source: this.serviceName,
+            sourceNode: this.nodeId,
+            sequence,
+            timestamp: new Date(),
+            data,
+        };
+        const payload = this.encodePayload(subject, event);
+        let meshTag;
+        if (!this.meshBroadcastEnabled) {
+            meshTag = '[mesh disabled]';
+        }
+        else {
+            try {
+                const peerCount = await this.meshService.broadcastToPeers(subject, payload);
+                meshTag = `[mesh broadcast: ${peerCount} peers]`;
+            }
+            catch (err) {
+                const e = err;
+                this.logger.warn(`Mesh broadcast failed for ${subject}: ${e.message} — local publish still proceeding`);
+                meshTag = `[mesh broadcast failed: ${e.message}]`;
+            }
+        }
+        try {
+            if (subject.startsWith('tss.') || subject.includes('proposal.')) {
+                this.nc.publish(subject, payload);
+                this.logger.debug(`✅ Published event via core NATS: ${subject} (ACL verified) ${meshTag}`);
+            }
+            else {
+                await this.js.publish(subject, payload);
+                this.logger.debug(`✅ Published event: ${subject} (ACL verified) ${meshTag}`);
+            }
+        }
+        catch (error) {
+            const err = error;
+            this.logger.error(`Failed to publish event to ${subject}: ${err.message}`);
+            throw error;
+        }
+    }
+    async subscribeToEvents(subject, handler) {
+        if (!this.nc || !this.js) {
+            this.logger.debug(`Waiting for NATS connection before subscribing to ${subject}...`);
+            try {
+                await this.connectionReady;
+            }
+            catch (error) {
+                const err = error;
+                this.logger.error(`NATS connection failed, cannot subscribe to ${subject}: ${err.message}`);
+                throw new Error(`NATS connection required for subscription: ${err.message}`);
+            }
+        }
+        if (!this.nc || !this.js) {
+            throw new Error(`NATS connection not established after waiting - cannot subscribe to ${subject}`);
+        }
+        const aclCheck = this.natsAcl.canSubscribe(this.nodeId, subject);
+        if (!aclCheck.allowed) {
+            this.logger.error(`🚨 ACL VIOLATION: Node ${this.nodeId} denied subscription to ${subject}\n` +
+                `  Reason: ${aclCheck.reason}\n` +
+                `  **POSSIBLE EAVESDROPPING ATTEMPT**`);
+            throw new Error(`ACL violation: ${aclCheck.reason}`);
+        }
+        if (subject.startsWith('tss.') || subject.includes('proposal.')) {
+            this.logger.log(`Subscribing to ${subject} via core NATS (real-time)`);
+            const sub = this.nc.subscribe(subject);
+            (async () => {
+                for await (const msg of sub) {
+                    try {
+                        const event = JSON.parse(msg.data.toString());
+                        handler(event).catch((handlerErr) => {
+                            this.logger.error(`Handler error on ${subject}: ${handlerErr}`);
+                        });
+                    }
+                    catch (parseErr) {
+                        this.logger.error(`Failed to parse message on ${subject}: ${parseErr}`);
+                    }
+                }
+            })().catch((err) => {
+                this.logger.error(`Subscription error on ${subject}: ${err}`);
+            });
+            this.logger.log(`✓ Subscribed to ${subject} (core NATS - real-time)`);
+            return;
+        }
+        const sanitizedSubject = subject.replace(/\./g, '-').replace(/\*/g, 'STAR').replace(/>/g, 'GT');
+        const durableName = `${this.serviceName}-${this.nodeId}-${sanitizedSubject}`;
+        const deliverySubject = `_INBOX.${durableName}`;
+        const opts = (0, nats_1.consumerOpts)()
+            .durable(durableName)
+            .deliverTo(deliverySubject)
+            .deliverAll()
+            .ackExplicit()
+            .maxDeliver(10);
+        const attemptSubscription = async () => {
+            const sub = await this.js.subscribe(subject, opts);
+            this.logger.log(`Subscribed to: ${subject}`);
+            this.processMessages(sub, handler);
+        };
+        try {
+            await attemptSubscription();
+        }
+        catch (error) {
+            const err = error;
+            const errMessage = err.message?.toLowerCase() || '';
+            const isNoStreamError = errMessage.includes('no stream matches subject') || errMessage.includes('stream not found');
+            if (isNoStreamError) {
+                this.logger.warn(`Stream not found for ${subject} - subscription skipped. ` +
+                    `Stream may be created later during bootstrap.`);
+                return;
+            }
+            const isNoResponders = errMessage === '503' ||
+                err.message === '503' ||
+                errMessage.includes('no responders') ||
+                errMessage.includes('503');
+            if (isNoResponders) {
+                this.logger.warn(`JetStream subscription to ${subject} returned 503 (no responders / ` +
+                    `meta-leader unavailable). Retrying in background with exponential backoff...`);
+                void (async () => {
+                    const retryDelays = [1000, 2000, 5000, 10000, 20000, 30000, 60000, 120000, 300000];
+                    for (let i = 0; i < retryDelays.length; i++) {
+                        await new Promise((resolve) => setTimeout(resolve, retryDelays[i]));
+                        try {
+                            await attemptSubscription();
+                            this.logger.log(`✓ JetStream subscription to ${subject} succeeded on retry ${i + 1} after ` +
+                                `${retryDelays.slice(0, i + 1).reduce((a, b) => a + b, 0) / 1000}s of backoff.`);
+                            return;
+                        }
+                        catch (retryErr) {
+                            const retryMsg = retryErr.message?.toLowerCase() || '';
+                            const stillNoResponders = retryMsg === '503' ||
+                                retryMsg.includes('no responders') ||
+                                retryMsg.includes('503');
+                            if (!stillNoResponders) {
+                                this.logger.error(`JetStream subscription to ${subject} failed on retry ${i + 1} with new ` +
+                                    `error: ${retryErr.message}. Giving up.`);
+                                return;
+                            }
+                            this.logger.debug(`JetStream subscription to ${subject} retry ${i + 1} still 503 — backing off further.`);
+                        }
+                    }
+                    this.logger.error(`JetStream subscription to ${subject} still 503 after ${retryDelays.length} retries ` +
+                        `(~${retryDelays.reduce((a, b) => a + b, 0) / 1000}s total). Subscription skipped.`);
+                })();
+                return;
+            }
+            const isDuplicateSubscription = errMessage.includes('duplicate subscription') || errMessage.includes('already bound');
+            if (isDuplicateSubscription && this.jsm) {
+                const streamName = this.resolveStreamName(subject);
+                this.logger.warn(`Duplicate subscription detected for ${subject} (durable ${durableName}). ` +
+                    `Removing stale consumer from stream ${streamName} and retrying...`);
+                try {
+                    await this.jsm.consumers.delete(streamName, durableName);
+                    await attemptSubscription();
+                    return;
+                }
+                catch (cleanupError) {
+                    const cleanupErr = cleanupError;
+                    this.logger.error(`Failed to clean up stale consumer ${durableName} on stream ${streamName}: ${cleanupErr.message}`);
+                }
+            }
+            this.logger.error(`Failed to subscribe to ${subject}: ${err.message}`);
+            throw error;
+        }
+    }
+    async processMessages(subscription, handler) {
+        (async () => {
+            for await (const msg of subscription) {
+                try {
+                    const event = this.decodePayload(msg.subject, msg.data);
+                    const isOwnMessage = event.sourceNode === this.nodeId;
+                    if (!isOwnMessage) {
+                        const sequenceCheck = this.messageSequence.verifyMessage(event.eventId, event.sourceNode, event.sequence, new Date(event.timestamp));
+                        if (!sequenceCheck.isValid) {
+                            this.logger.error(`🚨 INVALID MESSAGE SEQUENCE - REJECTING\n` +
+                                `  Event: ${event.eventType}\n` +
+                                `  Source: ${event.sourceNode}\n` +
+                                `  Reason: ${sequenceCheck.reason}`);
+                            msg.ack();
+                            continue;
+                        }
+                    }
+                    else {
+                        this.logger.debug(`⤴️  Skipping sequence validation for own message: ${event.eventType} (seq ${event.sequence})`);
+                    }
+                    await handler(event);
+                    msg.ack();
+                }
+                catch (error) {
+                    const err = error;
+                    this.logger.error(`Error processing message: ${err.message}`);
+                    msg.nak();
+                }
+            }
+        })();
+    }
+    isConnected() {
+        if (this.meshService) {
+            return this.meshService.isLocalConnected();
+        }
+        return this.nc ? !this.nc.isClosed() : false;
+    }
+    getMode() {
+        return 'mesh';
+    }
+    getMeshService() {
+        return this.meshService;
+    }
+    getConnectedPeerCount() {
+        if (this.meshService) {
+            return this.meshService.getConnectedPeerCount();
+        }
+        return 0;
+    }
+    grantCeremonyAccess(ceremonyId, participants, durationMs = 3600000) {
+        this.natsAcl.grantCeremonyAccess(ceremonyId, participants, durationMs);
+        this.logger.log(`✅ Granted NATS access for ceremony ${ceremonyId} to ${participants.length} participants`);
+    }
+    getAclService() {
+        return this.natsAcl;
+    }
+    getNodeId() {
+        return this.nodeId;
+    }
+    resolveStreamName(subject) {
+        if (subject.startsWith('networking-stream.') || subject.startsWith('networking.')) {
+            return 'networking-stream';
+        }
+        if (subject.startsWith('multi-chain-stream.') || subject.startsWith('multi-chain.')) {
+            return 'multi-chain-stream';
+        }
+        if (subject.startsWith('security-stream.') || subject.startsWith('security.')) {
+            return 'security-stream';
+        }
+        if (subject.startsWith('dkg-stream.') || subject.startsWith('dkg.')) {
+            return 'dkg-stream';
+        }
+        if (subject.startsWith('smart-app-stream.') || subject.startsWith('smart-app.')) {
+            return 'smart-app-stream';
+        }
+        if (subject.startsWith('entity-registry-stream.') || subject.startsWith('entity-registry.')) {
+            return 'entity-registry-stream';
+        }
+        if (subject.startsWith('agent-lifecycle-stream.') || subject.startsWith('agent-lifecycle.') || subject.startsWith('agent.')) {
+            return 'agent-lifecycle-stream';
+        }
+        return subject.split('.')[0];
+    }
+    shouldEncryptSubject(subject) {
+        return (!!this.encryptionKey &&
+            this.encryptedSubjects.some((prefix) => subject === prefix || subject.startsWith(`${prefix}.`)));
+    }
+    encodePayload(subject, event) {
+        if (!this.shouldEncryptSubject(subject)) {
+            return Buffer.from(JSON.stringify(event));
+        }
+        const envelope = this.encryptEvent(event);
+        return Buffer.from(JSON.stringify(envelope));
+    }
+    decodePayload(subject, payload) {
+        const raw = Buffer.from(payload).toString();
+        if (!this.shouldEncryptSubject(subject)) {
+            return JSON.parse(raw);
+        }
+        const envelope = JSON.parse(raw);
+        if (!envelope.__enc) {
+            return envelope;
+        }
+        const decrypted = this.decryptEvent(envelope);
+        return JSON.parse(decrypted);
+    }
+    encryptEvent(event) {
+        const iv = crypto.randomBytes(12);
+        const cipher = crypto.createCipheriv('aes-256-gcm', this.encryptionKey, iv);
+        const plaintext = Buffer.from(JSON.stringify(event), 'utf8');
+        const ciphertext = Buffer.concat([cipher.update(plaintext), cipher.final()]);
+        const tag = cipher.getAuthTag();
+        return {
+            __enc: true,
+            alg: 'aes-256-gcm',
+            iv: iv.toString('base64'),
+            tag: tag.toString('base64'),
+            data: ciphertext.toString('base64'),
+        };
+    }
+    async publishSignedEvent(streamName, eventType, data, signingKey, publicKey) {
+        if (!this.nc || !this.js) {
+            this.logger.debug(`Waiting for NATS connection before publishing signed event to ${streamName}...`);
+            try {
+                await this.connectionReady;
+            }
+            catch (error) {
+                const err = error;
+                this.logger.error(`NATS connection failed, cannot publish signed event: ${err.message}`);
+                throw new Error(`NATS connection required for signed event publishing: ${err.message}`);
+            }
+        }
+        if (!this.nc || !this.js) {
+            throw new Error(`NATS connection not established after waiting - cannot publish signed event`);
+        }
+        const subject = `${streamName}.${eventType}`;
+        const aclCheck = this.natsAcl.canPublish(this.nodeId, subject);
+        if (!aclCheck.allowed) {
+            this.logger.error(`🚨 ACL VIOLATION: Node ${this.nodeId} denied publishing to ${subject}\n` +
+                `  Reason: ${aclCheck.reason}`);
+            throw new Error(`ACL violation: ${aclCheck.reason}`);
+        }
+        const sequence = this.messageSequence.getNextSequence(this.nodeId);
+        const nonce = crypto.randomBytes(16).toString('hex');
+        const eventId = crypto.randomUUID();
+        const timestamp = new Date();
+        const signaturePayload = JSON.stringify({
+            eventId,
+            eventType,
+            sourceNode: this.nodeId,
+            sequence,
+            timestamp: timestamp.toISOString(),
+            nonce,
+            data,
+        });
+        const key = signingKey || process.env.VALIDATOR_SIGNING_KEY || process.env.HEDERA_PRIVATE_KEY;
+        const pubKey = publicKey || process.env.VALIDATOR_PUBLIC_KEY || process.env.HEDERA_PUBLIC_KEY;
+        if (!key || !pubKey) {
+            throw new Error('Signing key not configured for signed events');
+        }
+        const signature = this.createSignature(signaturePayload, key);
+        const event = {
+            eventId,
+            eventType,
+            source: this.serviceName,
+            sourceNode: this.nodeId,
+            sequence,
+            timestamp,
+            data,
+            nonce,
+            signature: {
+                signature,
+                publicKey: pubKey,
+                algorithm: 'hmac-sha256',
+                chain: process.env.HEDERA_ENABLED === 'true' ? 'hedera' : 'xrpl',
+            },
+        };
+        const payload = this.encodePayload(subject, event);
+        try {
+            if (subject.startsWith('tss.') || subject.includes('proposal.')) {
+                this.nc.publish(subject, payload);
+                this.logger.debug(`✅ Published signed event via core NATS: ${subject}`);
+            }
+            else {
+                await this.js.publish(subject, payload);
+                this.logger.debug(`✅ Published signed event: ${subject}`);
+            }
+        }
+        catch (error) {
+            const err = error;
+            this.logger.error(`Failed to publish signed event to ${subject}: ${err.message}`);
+            throw error;
+        }
+    }
+    verifyEventSignature(event) {
+        if (!event.signature) {
+            return { valid: false, reason: 'No signature present' };
+        }
+        if (!event.nonce) {
+            return { valid: false, reason: 'No nonce present' };
+        }
+        try {
+            const signaturePayload = JSON.stringify({
+                eventId: event.eventId,
+                eventType: event.eventType,
+                sourceNode: event.sourceNode,
+                sequence: event.sequence,
+                timestamp: event.timestamp instanceof Date ? event.timestamp.toISOString() : event.timestamp,
+                nonce: event.nonce,
+                data: event.data,
+            });
+            const isValid = this.verifySignature(signaturePayload, event.signature.signature, event.signature.publicKey);
+            if (!isValid) {
+                return { valid: false, reason: 'Signature verification failed' };
+            }
+            return { valid: true };
+        }
+        catch (error) {
+            const errorMsg = error instanceof Error ? error.message : 'Unknown error';
+            return { valid: false, reason: `Verification error: ${errorMsg}` };
+        }
+    }
+    async subscribeToSignedEvents(subject, handler, requireSignature = true) {
+        const verifiedHandler = async (event) => {
+            if (event.signature) {
+                const verification = this.verifyEventSignature(event);
+                if (!verification.valid) {
+                    this.logger.warn(`🚨 Invalid signature on ${event.eventType} from ${event.sourceNode}: ${verification.reason}`);
+                    return;
+                }
+                this.logger.debug(`✅ Signature verified for ${event.eventType} from ${event.sourceNode}`);
+            }
+            else if (requireSignature) {
+                this.logger.warn(`🚨 Missing signature on ${event.eventType} from ${event.sourceNode} - rejecting`);
+                return;
+            }
+            await handler(event);
+        };
+        await this.subscribeToEvents(subject, verifiedHandler);
+    }
+    createSignature(payload, key) {
+        const hmac = crypto.createHmac('sha256', key);
+        hmac.update(payload);
+        return hmac.digest('hex');
+    }
+    verifySignature(payload, signature, _publicKey) {
+        try {
+            if (!/^[0-9a-fA-F]{64}$/.test(signature)) {
+                return false;
+            }
+            const signingKey = process.env.VALIDATOR_SIGNING_KEY || process.env.HEDERA_PRIVATE_KEY;
+            if (!signingKey) {
+                this.logger.warn('No signing key configured - signature verification skipped');
+                return true;
+            }
+            const expectedSignature = this.createSignature(payload, signingKey);
+            const sigBuffer = Buffer.from(signature, 'hex');
+            const expectedBuffer = Buffer.from(expectedSignature, 'hex');
+            if (sigBuffer.length !== expectedBuffer.length) {
+                return false;
+            }
+            return crypto.timingSafeEqual(sigBuffer, expectedBuffer);
+        }
+        catch (error) {
+            this.logger.warn(`Signature verification error: ${error instanceof Error ? error.message : 'Unknown'}`);
+            return false;
+        }
+    }
+    decryptEvent(envelope) {
+        if (!this.encryptionKey) {
+            throw new Error('Encryption key not configured');
+        }
+        const iv = Buffer.from(envelope.iv, 'base64');
+        const tag = Buffer.from(envelope.tag, 'base64');
+        const ciphertext = Buffer.from(envelope.data, 'base64');
+        const decipher = crypto.createDecipheriv('aes-256-gcm', this.encryptionKey, iv);
+        decipher.setAuthTag(tag);
+        const decrypted = Buffer.concat([decipher.update(ciphertext), decipher.final()]);
+        return decrypted.toString('utf8');
+    }
+    normalizeEncryptionKey(value) {
+        const trimmed = value.trim();
+        const looksLikeHex = /^[0-9a-fA-F]+$/.test(trimmed);
+        if (looksLikeHex && trimmed.length === 64) {
+            const hexBuffer = Buffer.from(trimmed, 'hex');
+            if (hexBuffer.length !== 32) {
+                throw new Error('EVENT_BUS_ENCRYPTION_KEY hex value must be 32 bytes (64 hex chars)');
+            }
+            return hexBuffer;
+        }
+        const buffer = Buffer.from(trimmed, 'base64');
+        if (buffer.length !== 32) {
+            throw new Error('EVENT_BUS_ENCRYPTION_KEY must decode to 32 bytes (AES-256 key)');
+        }
+        return buffer;
+    }
+};
+exports.EventBusService = EventBusService;
+exports.EventBusService = EventBusService = EventBusService_1 = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [nats_acl_service_1.NatsAclService,
+        message_sequence_service_1.MessageSequenceService,
+        nats_mesh_service_1.NatsMeshService])
+], EventBusService);
+//# sourceMappingURL=event-bus.service.js.map