@blackbox_ai/blackbox-cli 0.0.9 → 0.8.1

package/dist/src/encrypt/attestation.js

@@ -0,0 +1,100 @@
+import { ENCRYPTION_CONFIG } from './config.js';
+import { fromB64, generateUuid, generateKeyPair, deserializePublicKeyPem, deriveSharedKey } from './crypto-utils.js';
+/**
+ * Basic attestation verification extracted from streaming-client.ts
+ * Validates structure, nonce binding, and key presence.
+ * Internal function - not exported since it's only used within this module.
+ */
+async function verifyAttestationBasic(reportJson, signature, gpuEat, publicKeyPem, nonce) {
+    // Perform minimal structural checks consistent with previous implementation
+    const report = JSON.parse(reportJson);
+    const expectedNonceB64 = btoa(String.fromCharCode.apply(null, Array.from(nonce)));
+    if (report.nonce !== expectedNonceB64) {
+        throw new Error(`Nonce mismatch: expected ${expectedNonceB64}, got ${report.nonce}`);
+    }
+    if (!signature || signature.length === 0) {
+        throw new Error('Missing signature');
+    }
+    if (!publicKeyPem.includes('BEGIN PUBLIC KEY')) {
+        throw new Error('Invalid public key format');
+    }
+}
+/**
+ * Process a single attestation result
+ */
+async function processAttestationResult(result, localKeys) {
+    const { body } = result;
+    // Extract server public key
+    const serverPubPem = body.public_key || body.public_key_worker;
+    if (!serverPubPem) {
+        throw new Error(`Attestation result ${result.id} missing server public key`);
+    }
+    // Extract nonce
+    const nonceB64 = body.nonce_b64 || body.nonceB64 || body.nonce;
+    if (!nonceB64) {
+        throw new Error(`Attestation result ${result.id} missing nonce_b64`);
+    }
+    const nonceBytes = fromB64(nonceB64);
+    // Verify attestation
+    await verifyAttestationBasic(body.report_json, body.signature, body.gpu_eat, serverPubPem, nonceBytes);
+    // Deserialize public key and derive shared key
+    const serverPublicKeySpki = deserializePublicKeyPem(serverPubPem);
+    const sharedKey = await deriveSharedKey(localKeys.ecdhPrivate, serverPublicKeySpki);
+    return {
+        id: result.id,
+        publicKeySpki: serverPublicKeySpki,
+        publicKeyPem: serverPubPem,
+        sharedKey
+    };
+}
+/**
+ * Performs secure attestation and key generation for a new session
+ */
+export const performSecureAttestation = async (systemPrompt) => {
+    // Perform attestation
+    const response = await fetch(ENCRYPTION_CONFIG.attestationUrl);
+    if (!response.ok) {
+        throw new Error(`Attestation request failed: ${response.status}`);
+    }
+    const responseData = await response.json();
+    // Generate local keys once for all attestations
+    const localKeys = await generateKeyPair();
+    const serverPublicKeys = [];
+    const sharedKeys = [];
+    // Process each attestation result
+    for (const result of responseData.results) {
+        try {
+            if (result.status === 200) {
+                const processed = await processAttestationResult(result, localKeys);
+                serverPublicKeys.push({
+                    id: processed.id,
+                    publicKeySpki: processed.publicKeySpki,
+                    publicKeyPem: processed.publicKeyPem
+                });
+                sharedKeys.push({
+                    id: processed.id,
+                    sharedKey: processed.sharedKey
+                });
+            }
+            else {
+                console.warn(`⚠️ Skipping attestation result ${result.id} with status ${result.status}`);
+            }
+        }
+        catch (error) {
+            console.error(`❌ Failed to process attestation result ${result.id}:`, error);
+            // Continue processing other results even if one fails
+        }
+    }
+    if (sharedKeys.length === 0) {
+        throw new Error('No successful attestation results could be processed');
+    }
+    return {
+        sessionId: generateUuid(),
+        nonce: 1000,
+        history: systemPrompt ? [{ role: 'system', content: systemPrompt }] : [],
+        serverPublicKeys,
+        localKeys,
+        sharedKeys,
+    };
+};
+//# sourceMappingURL=attestation.js.map

package/dist/src/encrypt/attestation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"attestation.js","sourceRoot":"","sources":["../../../src/encrypt/attestation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAEhD,OAAO,EACL,OAAO,EACP,YAAY,EACZ,eAAe,EACf,uBAAuB,EACvB,eAAe,EAEhB,MAAM,mBAAmB,CAAC;AAE3B;;;;GAIG;AACH,KAAK,UAAU,sBAAsB,CACnC,UAAkB,EAClB,SAAiB,EACjB,MAAc,EACd,YAAoB,EACpB,KAAiB;IAEjB,4EAA4E;IAC5E,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAEtC,MAAM,gBAAgB,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAClF,IAAI,MAAM,CAAC,KAAK,KAAK,gBAAgB,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CAAC,4BAA4B,gBAAgB,SAAS,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;IACvF,CAAC;IAED,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;IACvC,CAAC;IACD,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IAC/C,CAAC;AACH,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,wBAAwB,CACrC,MAAyB,EACzB,SAAwB;IAOxB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC;IAExB,4BAA4B;IAC5B,MAAM,YAAY,GAAG,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,iBAAiB,CAAC;IAC/D,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,sBAAsB,MAAM,CAAC,EAAE,4BAA4B,CAAC,CAAC;IAC/E,CAAC;IAED,gBAAgB;IAChB,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,KAAK,CAAC;IAC/D,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,sBAAsB,MAAM,CAAC,EAAE,oBAAoB,CAAC,CAAC;IACvE,CAAC;IACD,MAAM,UAAU,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAErC,qBAAqB;IACrB,MAAM,sBAAsB,CAC1B,IAAI,CAAC,WAAW,EAChB,IAAI,CAAC,SAAS,EACd,IAAI,CAAC,OAAO,EACZ,YAAY,EACZ,UAAU,CACX,CAAC;IAEF,+CAA+C;IAC/C,MAAM,mBAAmB,GAAG,uBAAuB,CAAC,YAAY,CAAC,CAAC;IAClE,MAAM,SAAS,GAAG,MAAM,eAAe,CAAC,SAAS,CAAC,WAAW,EAAE,mBAAmB,CAAC,CAAC;IAEpF,OAAO;QACL,EAAE,EAAE,MAAM,CAAC,EAAE;QACb,aAAa,EAAE,mBAAmB;QAClC,YAAY,EAAE,YAAY;QAC1B,SAAS;KACV,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,KAAK,EAAE,YAAqB,EAAqC,EAAE;IACzG,sBAAsB;IACtB,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,iBAAiB,CAAC,cAAc,CAAC,CAAC;IAC/D,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,+BAA+B,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IACpE,CAAC;IAED,MAAM,YAAY,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IAE3C,gDAAgD;IAChD,MAAM,SAAS,GAAG,MAAM,eAAe,EAAE,CAAC;IAC1C,MAAM,gBAAgB,GAA4E,EAAE,CAAC;IACrG,MAAM,UAAU,GAAkD,EAAE,CAAC;IAErE,kCAAkC;IAClC,KAAK,MAAM,MAAM,IAAI,YAAY,CAAC,OAAO,EAAE,CAAC;QAC1C,IAAI,CAAC;YACH,IAAI,MAAM,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAC1B,MAAM,SAAS,GAAG,MAAM,wBAAwB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;gBAEpE,gBAAgB,CAAC,IAAI,CAAC;oBACpB,EAAE,EAAE,SAAS,CAAC,EAAE;oBAChB,aAAa,EAAE,SAAS,CAAC,aAAa;oBACtC,YAAY,EAAE,SAAS,CAAC,YAAY;iBACrC,CAAC,CAAC;gBAEH,UAAU,CAAC,IAAI,CAAC;oBACd,EAAE,EAAE,SAAS,CAAC,EAAE;oBAChB,SAAS,EAAE,SAAS,CAAC,SAAS;iBAC/B,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,IAAI,CAAC,kCAAkC,MAAM,CAAC,EAAE,gBAAgB,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;YAC3F,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,0CAA0C,MAAM,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;YAC7E,sDAAsD;QACxD,CAAC;IACH,CAAC;IAED,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO;QACL,SAAS,EAAE,YAAY,EAAE;QACzB,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE;QACxE,gBAAgB;QAChB,SAAS;QACT,UAAU;KACX,CAAC;AACJ,CAAC,CAAC"}

package/dist/src/encrypt/bridge.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Bridge module to register the encryption service globally
+ * so the core package can access it without direct imports
+ */
+import { sendMessageStream } from './client.js';
+/**
+ * Interface for the encryption service bridge
+ */
+interface EncryptionServiceBridge {
+    sendMessageStream: typeof sendMessageStream;
+}
+/**
+ * Extended global interface to include our encryption service
+ */
+declare global {
+    var blackboxEncryptionService: EncryptionServiceBridge | undefined;
+}
+/**
+ * Register the encryption service globally for use by the core package
+ */
+export declare function registerEncryptionService(): void;
+/**
+ * Unregister the encryption service
+ */
+export declare function unregisterEncryptionService(): void;
+/**
+ * Check if the encryption service is registered
+ */
+export declare function isEncryptionServiceRegistered(): boolean;
+export {};

package/dist/src/encrypt/bridge.js

@@ -0,0 +1,32 @@
+/**
+ * Bridge module to register the encryption service globally
+ * so the core package can access it without direct imports
+ */
+import { sendMessageStream } from './client.js';
+/**
+ * Register the encryption service globally for use by the core package
+ */
+export function registerEncryptionService() {
+    if (typeof globalThis !== 'undefined') {
+        const bridge = {
+            sendMessageStream
+        };
+        globalThis.blackboxEncryptionService = bridge;
+    }
+}
+/**
+ * Unregister the encryption service
+ */
+export function unregisterEncryptionService() {
+    if (typeof globalThis !== 'undefined') {
+        delete globalThis.blackboxEncryptionService;
+    }
+}
+/**
+ * Check if the encryption service is registered
+ */
+export function isEncryptionServiceRegistered() {
+    return typeof globalThis !== 'undefined' &&
+        globalThis.blackboxEncryptionService !== undefined;
+}
+//# sourceMappingURL=bridge.js.map

package/dist/src/encrypt/bridge.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bridge.js","sourceRoot":"","sources":["../../../src/encrypt/bridge.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAiBhD;;GAEG;AACH,MAAM,UAAU,yBAAyB;IACvC,IAAI,OAAO,UAAU,KAAK,WAAW,EAAE,CAAC;QACtC,MAAM,MAAM,GAA4B;YACtC,iBAAiB;SAClB,CAAC;QAEF,UAAU,CAAC,yBAAyB,GAAG,MAAM,CAAC;IAChD,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,2BAA2B;IACzC,IAAI,OAAO,UAAU,KAAK,WAAW,EAAE,CAAC;QACtC,OAAO,UAAU,CAAC,yBAAyB,CAAC;IAC9C,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,6BAA6B;IAC3C,OAAO,OAAO,UAAU,KAAK,WAAW;QACjC,UAAU,CAAC,yBAAyB,KAAK,SAAS,CAAC;AAC5D,CAAC"}

package/dist/src/encrypt/client.d.ts

@@ -0,0 +1,14 @@
+import { type FileData } from './types.js';
+/**
+ * Sends a message through the encrypted stream using the StreamingClient.
+ * Now supports both sessionId and chatId for backward compatibility.
+ *
+ * @param sessionIdOrChatId - The session or chat ID
+ * @param userText - The current user message text
+ * @param fullMessageHistory - Optional full conversation history for proper context in followup messages
+ * @param fileData - Optional file data (images, PDFs, etc.)
+ */
+export declare const sendMessageStream: (sessionIdOrChatId: string, userText: string, fullMessageHistory?: Array<{
+    role: "system" | "user" | "assistant";
+    content: string;
+}>, fileData?: FileData) => Promise<ReadableStream<Uint8Array>>;

package/dist/src/encrypt/client.js

@@ -0,0 +1,133 @@
+import { ENCRYPTION_CONFIG } from './config.js';
+import { getHydratedSessionByChatId, initializeSecureSession } from './sessions.js';
+import { StreamingClient } from './streaming-client.js';
+import {} from './types.js';
+/**
+ * Sends a message through the encrypted stream using the StreamingClient.
+ * Now supports both sessionId and chatId for backward compatibility.
+ *
+ * @param sessionIdOrChatId - The session or chat ID
+ * @param userText - The current user message text
+ * @param fullMessageHistory - Optional full conversation history for proper context in followup messages
+ * @param fileData - Optional file data (images, PDFs, etc.)
+ */
+export const sendMessageStream = async (sessionIdOrChatId, userText, fullMessageHistory, fileData) => {
+    // Validate input parameters
+    if (!sessionIdOrChatId || sessionIdOrChatId.trim().length === 0) {
+        throw new Error('Session ID or Chat ID cannot be empty');
+    }
+    if (!userText || userText.trim().length === 0) {
+        throw new Error('User message cannot be empty');
+    }
+    // Try to get hydrated session by chatId first (includes crypto keys)
+    let session = await getHydratedSessionByChatId(sessionIdOrChatId);
+    // If no session exists, create a new one
+    if (!session || !session.initialized) {
+        const systemPrompt = fullMessageHistory?.find((m) => m.role === 'system')?.content;
+        session = await initializeSecureSession(sessionIdOrChatId, systemPrompt);
+    }
+    try {
+        // Use provided message history or fall back to session history
+        // Ensure we always have a valid array
+        const messageHistory = fullMessageHistory && fullMessageHistory.length > 0
+            ? fullMessageHistory
+            : session.history || [];
+        // Create a streaming client for this session (system prompt from message history)
+        const systemPrompt = messageHistory.find((m) => m.role === 'system')?.content;
+        const client = new StreamingClient(ENCRYPTION_CONFIG.baseUrl, ENCRYPTION_CONFIG.attestationUrl, systemPrompt);
+        // Initialize from existing session data to avoid re-attestation
+        if (session.attestationData) {
+            client.initializeFromSession({
+                sessionId: session.sessionId,
+                nonce: session.nonce,
+                history: messageHistory,
+                attestationData: session.attestationData
+            });
+        }
+        // Send the message and get the encrypted stream
+        const encryptedStream = await client.sendMessageStream(userText, fileData);
+        // Update session history with the new user message
+        // If fullMessageHistory was provided, sync session.history with it
+        if (fullMessageHistory && fullMessageHistory.length > 0) {
+            session.history = [...fullMessageHistory];
+        }
+        else {
+            // Ensure session.history is initialized
+            if (!session.history) {
+                session.history = [];
+            }
+            session.history.push({ role: 'user', content: userText });
+        }
+        session.nonce += 1;
+        // Update the session in sessionStorage with crypto materials
+        try {
+            // Import toB64 helper from crypto-utils
+            const { toB64 } = await import('./crypto-utils.js');
+            const attestationData = session.attestationData;
+            if (!attestationData) {
+                throw new Error('No attestation data available for storage update');
+            }
+            // Store multi-attestation data
+            const serverPublicKeysB64 = attestationData.serverPublicKeys.map((key) => ({
+                id: key.id,
+                publicKeySpki_b64: toB64(key.publicKeySpki),
+                publicKeyPem: key.publicKeyPem
+            }));
+            const sharedKeysB64 = attestationData.sharedKeys.map((key) => ({
+                id: key.id,
+                sharedKey_b64: toB64(key.sharedKey)
+            }));
+            const ecdsaPrivPkcs8 = await crypto.subtle.exportKey('pkcs8', attestationData.localKeys.ecdsaPrivate);
+            const ecdsaPrivB64 = toB64(new Uint8Array(ecdsaPrivPkcs8));
+            const ecdsaPubSpki = await crypto.subtle.exportKey('spki', attestationData.localKeys.ecdsaPublic);
+            const ecdsaPubB64 = toB64(new Uint8Array(ecdsaPubSpki));
+            const sessionFilePath = `${process.env['HOME'] || process.env['USERPROFILE']}/.blackboxcli/sessions/blackbox_secure_session_${sessionIdOrChatId}.json`;
+            const storedObj = {
+                sessionId: session.sessionId,
+                initialized: session.initialized,
+                nonce: session.nonce,
+                history: session.history,
+                createdAt: session.createdAt,
+                serverPublicKeys_b64: serverPublicKeysB64,
+                sharedKeys_b64: sharedKeysB64,
+                ecdsaPrivatePkcs8_b64: ecdsaPrivB64,
+                ecdsaPublicSpki_b64: ecdsaPubB64
+            };
+            // Import fs for file operations
+            const fs = await import('node:fs');
+            const path = await import('node:path');
+            // Ensure directory exists
+            const sessionDir = path.dirname(sessionFilePath);
+            if (!fs.existsSync(sessionDir)) {
+                fs.mkdirSync(sessionDir, { recursive: true });
+            }
+            fs.writeFileSync(sessionFilePath, JSON.stringify(storedObj));
+        }
+        catch (storageError) {
+            console.warn('⚠️ Failed to update session in storage:', storageError);
+        }
+        return encryptedStream;
+    }
+    catch (error) {
+        console.error('❌ Failed to send encrypted message:', error);
+        // Instead of creating a fake fallback response, throw the actual error
+        // This allows the model to learn from real errors and users to see actual issues
+        if (error instanceof Error) {
+            // Enhance the error with additional context for better debugging
+            const enhancedError = new Error(`Encryption service failed: ${error.message}\n` +
+                `Session ID: ${sessionIdOrChatId}\n` +
+                `Error Type: ${error.constructor.name}\n` +
+                `Timestamp: ${new Date().toISOString()}`);
+            enhancedError.stack = error.stack;
+            enhancedError.cause = error;
+            throw enhancedError;
+        }
+        else {
+            // Handle non-Error objects
+            throw new Error(`Encryption service failed with unknown error: ${String(error)}\n` +
+                `Session ID: ${sessionIdOrChatId}\n` +
+                `Timestamp: ${new Date().toISOString()}`);
+        }
+    }
+};
+//# sourceMappingURL=client.js.map

package/dist/src/encrypt/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../../../src/encrypt/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EAAE,0BAA0B,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAC;AACpF,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAoE,MAAM,YAAY,CAAC;AAE9F;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,KAAK,EACpC,iBAAyB,EACzB,QAAgB,EAChB,kBAAsF,EACtF,QAAmB,EACkB,EAAE;IACvC,4BAA4B;IAC5B,IAAI,CAAC,iBAAiB,IAAI,iBAAiB,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC3D,CAAC;IAED,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;IAClD,CAAC;IAED,qEAAqE;IACrE,IAAI,OAAO,GAAG,MAAM,0BAA0B,CAAC,iBAAiB,CAAC,CAAC;IAElE,yCAAyC;IACzC,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;QACrC,MAAM,YAAY,GAAG,kBAAkB,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,EAAE,OAAO,CAAC;QACnF,OAAO,GAAG,MAAM,uBAAuB,CAAC,iBAAiB,EAAE,YAAY,CAAC,CAAC;IAC3E,CAAC;IAED,IAAI,CAAC;QACH,+DAA+D;QAC/D,sCAAsC;QACtC,MAAM,cAAc,GAAG,kBAAkB,IAAI,kBAAkB,CAAC,MAAM,GAAG,CAAC;YACxE,CAAC,CAAC,kBAAkB;YACpB,CAAC,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC;QAE1B,kFAAkF;QAClF,MAAM,YAAY,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,EAAE,OAAO,CAAC;QAC9E,MAAM,MAAM,GAAG,IAAI,eAAe,CAChC,iBAAiB,CAAC,OAAO,EACzB,iBAAiB,CAAC,cAAc,EAChC,YAAY,CACb,CAAC;QAEF,gEAAgE;QAChE,IAAK,OAA0E,CAAC,eAAe,EAAE,CAAC;YAChG,MAAM,CAAC,qBAAqB,CAAC;gBAC3B,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,OAAO,EAAE,cAAc;gBACvB,eAAe,EAAG,OAAyE,CAAC,eAAe;aAC5G,CAAC,CAAC;QACL,CAAC;QAED,gDAAgD;QAChD,MAAM,eAAe,GAAG,MAAM,MAAM,CAAC,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAE3E,mDAAmD;QACnD,mEAAmE;QACnE,IAAI,kBAAkB,IAAI,kBAAkB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxD,OAAO,CAAC,OAAO,GAAG,CAAC,GAAG,kBAAkB,CAAC,CAAC;QAC5C,CAAC;aAAM,CAAC;YACN,wCAAwC;YACxC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;gBACrB,OAAO,CAAC,OAAO,GAAG,EAAE,CAAC;YACvB,CAAC;YACD,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC5D,CAAC;QACD,OAAO,CAAC,KAAK,IAAI,CAAC,CAAC;QAEnB,6DAA6D;QAC7D,IAAI,CAAC;YACH,wCAAwC;YACxC,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;YAEpD,MAAM,eAAe,GAAI,OAA0E,CAAC,eAAe,CAAC;YACpH,IAAI,CAAC,eAAe,EAAE,CAAC;gBACrB,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;YACtE,CAAC;YAED,+BAA+B;YAC/B,MAAM,mBAAmB,GAAG,eAAe,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;gBACzE,EAAE,EAAE,GAAG,CAAC,EAAE;gBACV,iBAAiB,EAAE,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC;gBAC3C,YAAY,EAAE,GAAG,CAAC,YAAY;aAC/B,CAAC,CAAC,CAAC;YAEJ,MAAM,aAAa,GAAG,eAAe,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;gBAC7D,EAAE,EAAE,GAAG,CAAC,EAAE;gBACV,aAAa,EAAE,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC;aACpC,CAAC,CAAC,CAAC;YAEJ,MAAM,cAAc,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,eAAe,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;YACtG,MAAM,YAAY,GAAG,KAAK,CAAC,IAAI,UAAU,CAAC,cAAc,CAAC,CAAC,CAAC;YAE3D,MAAM,YAAY,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,EAAE,eAAe,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;YAClG,MAAM,WAAW,GAAG,KAAK,CAAC,IAAI,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC;YAExD,MAAM,eAAe,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,kDAAkD,iBAAiB,OAAO,CAAC;YACvJ,MAAM,SAAS,GAAG;gBAChB,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,WAAW,EAAE,OAAO,CAAC,WAAW;gBAChC,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,oBAAoB,EAAE,mBAAmB;gBACzC,cAAc,EAAE,aAAa;gBAC7B,qBAAqB,EAAE,YAAY;gBACnC,mBAAmB,EAAE,WAAW;aACjC,CAAC;YAEF,gCAAgC;YAChC,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;YACnC,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;YAEvC,0BAA0B;YAC1B,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;YACjD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC/B,EAAE,CAAC,SAAS,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAChD,CAAC;YAED,EAAE,CAAC,aAAa,CAAC,eAAe,EAAE,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC;QAC/D,CAAC;QAAC,OAAO,YAAY,EAAE,CAAC;YACtB,OAAO,CAAC,IAAI,CAAC,yCAAyC,EAAE,YAAY,CAAC,CAAC;QACxE,CAAC;QAED,OAAO,eAAe,CAAC;IACzB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,qCAAqC,EAAE,KAAK,CAAC,CAAC;QAE5D,uEAAuE;QACvE,iFAAiF;QACjF,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;YAC3B,iEAAiE;YACjE,MAAM,aAAa,GAAG,IAAI,KAAK,CAC7B,8BAA8B,KAAK,CAAC,OAAO,IAAI;gBAC/C,eAAe,iBAAiB,IAAI;gBACpC,eAAe,KAAK,CAAC,WAAW,CAAC,IAAI,IAAI;gBACzC,cAAc,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CACzC,CAAC;YACF,aAAa,CAAC,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;YAClC,aAAa,CAAC,KAAK,GAAG,KAAK,CAAC;YAC5B,MAAM,aAAa,CAAC;QACtB,CAAC;aAAM,CAAC;YACN,2BAA2B;YAC3B,MAAM,IAAI,KAAK,CACb,iDAAiD,MAAM,CAAC,KAAK,CAAC,IAAI;gBAClE,eAAe,iBAAiB,IAAI;gBACpC,cAAc,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CACzC,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC,CAAC"}

package/dist/src/encrypt/config.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Encrypted model identifiers - used to detect if a model requires encryption
+ */
+export declare const ENCRYPTED_MODELS: string[];
+/**
+ * Timeout constants for encrypted operations
+ */
+export declare const DEFAULT_ENCRYPTED_TIMEOUT: number;
+export declare const DEFAULT_ENCRYPTED_RETRY_COUNT: number;
+export declare const ATTESTATION_TIMEOUT: number;
+export declare const RETRY_INITIAL_DELAY: number;
+export declare const RETRY_MAX_DELAY: number;
+export declare const RETRY_BACKOFF_MULTIPLIER: number;
+export declare const RETRYABLE_STATUS_CODES: number[];
+export declare const ENCRYPTION_CONFIG: {
+    baseUrl: string;
+    attestationUrl: string;
+    messageStreamUrl: string;
+    streamingTimeout: number;
+    attestationTimeout: number;
+    retryCount: number;
+};
+/**
+ * Detects if the selected model requires encryption
+ */
+export declare const isEncryptedModel: (modelName: string) => boolean;

package/dist/src/encrypt/config.js

@@ -0,0 +1,51 @@
+/**
+ * Encrypted model identifiers - used to detect if a model requires encryption
+ */
+export const ENCRYPTED_MODELS = [
+    'blackboxai/encrypted',
+    'blackboxai/encrypted-pro',
+    'blackboxai/secure-coder',
+    'blackbox/encrypted',
+    'encrypted-gpt-4',
+    'encrypted-claude',
+    'secure-model'
+];
+/**
+ * Timeout constants for encrypted operations
+ */
+export const DEFAULT_ENCRYPTED_TIMEOUT = parseInt(process.env['BLACKBOX_ENCRYPTED_TIMEOUT'] || '1800000', 10);
+export const DEFAULT_ENCRYPTED_RETRY_COUNT = parseInt(process.env['BLACKBOX_ENCRYPTED_RETRY_COUNT'] || '3', 10);
+// Connection timeout for initial attestation
+export const ATTESTATION_TIMEOUT = parseInt(process.env['BLACKBOX_ATTESTATION_TIMEOUT'] || '30000', // 30 seconds
+10);
+// Retry configuration for streaming requests
+export const RETRY_INITIAL_DELAY = parseInt(process.env['BLACKBOX_RETRY_INITIAL_DELAY'] || '1000', // 1 second
+10);
+export const RETRY_MAX_DELAY = parseInt(process.env['BLACKBOX_RETRY_MAX_DELAY'] || '10000', // 10 seconds
+10);
+export const RETRY_BACKOFF_MULTIPLIER = parseFloat(process.env['BLACKBOX_RETRY_BACKOFF_MULTIPLIER'] || '2');
+// HTTP status codes that should trigger a retry
+export const RETRYABLE_STATUS_CODES = [500, 502, 503, 504];
+/**
+ * Configuration for encryption service endpoints
+ */
+// CLI environment - always use direct URL
+const baseUrl = process.env['BLACKBOX_ENCRYPTION_BASE_URL'] || 'https://encrypt.blackboxai.app';
+export const ENCRYPTION_CONFIG = {
+    baseUrl,
+    attestationUrl: `${baseUrl}/attestation`,
+    messageStreamUrl: `${baseUrl}/message_stream`,
+    // Timeout configuration
+    streamingTimeout: DEFAULT_ENCRYPTED_TIMEOUT,
+    attestationTimeout: ATTESTATION_TIMEOUT,
+    retryCount: DEFAULT_ENCRYPTED_RETRY_COUNT,
+};
+/**
+ * Detects if the selected model requires encryption
+ */
+export const isEncryptedModel = (modelName) => {
+    if (!modelName)
+        return false;
+    return ENCRYPTED_MODELS.some(encryptedModel => modelName.toLowerCase().includes(encryptedModel.toLowerCase()));
+};
+//# sourceMappingURL=config.js.map

package/dist/src/encrypt/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../../src/encrypt/config.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,sBAAsB;IACtB,0BAA0B;IAC1B,yBAAyB;IACzB,oBAAoB;IACpB,iBAAiB;IACjB,kBAAkB;IAClB,cAAc;CACf,CAAC;AAEF;;GAEG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,QAAQ,CAC/C,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC,IAAI,SAAS,EACtD,EAAE,CACH,CAAC;AAEF,MAAM,CAAC,MAAM,6BAA6B,GAAG,QAAQ,CACnD,OAAO,CAAC,GAAG,CAAC,gCAAgC,CAAC,IAAI,GAAG,EACpD,EAAE,CACH,CAAC;AAEF,6CAA6C;AAC7C,MAAM,CAAC,MAAM,mBAAmB,GAAG,QAAQ,CACzC,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,IAAI,OAAO,EAAE,aAAa;AACrE,EAAE,CACH,CAAC;AAEF,6CAA6C;AAC7C,MAAM,CAAC,MAAM,mBAAmB,GAAG,QAAQ,CACzC,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,IAAI,MAAM,EAAE,WAAW;AAClE,EAAE,CACH,CAAC;AAEF,MAAM,CAAC,MAAM,eAAe,GAAG,QAAQ,CACrC,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC,IAAI,OAAO,EAAE,aAAa;AACjE,EAAE,CACH,CAAC;AAEF,MAAM,CAAC,MAAM,wBAAwB,GAAG,UAAU,CAChD,OAAO,CAAC,GAAG,CAAC,mCAAmC,CAAC,IAAI,GAAG,CACxD,CAAC;AAEF,gDAAgD;AAChD,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;AAE3D;;GAEG;AAEH,0CAA0C;AAC1C,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,IAAI,gCAAgC,CAAC;AAEhG,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,OAAO;IACP,cAAc,EAAE,GAAG,OAAO,cAAc;IACxC,gBAAgB,EAAE,GAAG,OAAO,iBAAiB;IAC7C,wBAAwB;IACxB,gBAAgB,EAAE,yBAAyB;IAC3C,kBAAkB,EAAE,mBAAmB;IACvC,UAAU,EAAE,6BAA6B;CAC1C,CAAC;AAEF;;GAEG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,SAAiB,EAAW,EAAE;IAC7D,IAAI,CAAC,SAAS;QAAE,OAAO,KAAK,CAAC;IAE7B,OAAO,gBAAgB,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,CAC5C,SAAS,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,cAAc,CAAC,WAAW,EAAE,CAAC,CAC/D,CAAC;AACJ,CAAC,CAAC"}

package/dist/src/encrypt/crypto-utils.d.ts

@@ -0,0 +1,57 @@
+/**
+ * Low-level cryptographic utilities extracted from streaming-client.ts
+ */
+export interface CryptoKeyPair {
+    ecdhPrivate: CryptoKey;
+    ecdsaPrivate: CryptoKey;
+    ecdsaPublic: CryptoKey;
+}
+/**
+ * Convert Uint8Array to base64 string
+ */
+export declare const toB64: (u8: Uint8Array) => string;
+/**
+ * Convert base64 string to Uint8Array
+ */
+export declare const fromB64: (b64: string) => Uint8Array;
+/**
+ * Generate a UUID for identification (moved from streaming-client.ts)
+ */
+export declare const generateUuid: () => string;
+/**
+ * Generate a P-384 keypair for both ECDSA and ECDH operations (moved from streaming-client.ts)
+ * Reuses the same key material for both operations (matching Rust behavior)
+ */
+export declare function generateKeyPair(): Promise<CryptoKeyPair>;
+export declare function ecdsaRawToDer(raw: Uint8Array): Uint8Array;
+export declare function ecdsaDerToRaw(der: Uint8Array): Uint8Array;
+/**
+ * Serialize a WebCrypto ECDSA/ECDH public key to PEM (SPKI)
+ */
+export declare function serializePublicKeyPem(publicKey: CryptoKey): Promise<string>;
+/**
+ * Deserialize PEM (SPKI) public key string to Uint8Array bytes
+ */
+export declare function deserializePublicKeyPem(pem: string): Uint8Array;
+/**
+ * Derive a shared key using ECDH + HKDF (SHA-256) from local private key and server public key (SPKI)
+ * Matches the Rust implementation detail (using only X coordinate for HKDF input).
+ */
+export declare function deriveSharedKey(localPrivateKey: CryptoKey, serverPublicKeySpki: Uint8Array): Promise<Uint8Array>;
+/**
+ * Encrypted payload interface (moved from streaming-client.ts)
+ */
+export interface EncryptedPayload {
+    nonce: number;
+    iv: string;
+    ciphertext: string;
+    signature: string;
+}
+/**
+ * Encrypt and sign a message using AES-GCM and ECDSA (moved from streaming-client.ts)
+ */
+export declare function encryptAndSign(plaintext: string, sharedKey: Uint8Array, signingKey: CryptoKey, nonce: number): Promise<EncryptedPayload>;
+/**
+ * Decrypt and verify a message using AES-GCM and ECDSA (moved from streaming-client.ts)
+ */
+export declare function decryptAndVerify(payload: EncryptedPayload, sharedKey: Uint8Array, serverVerifyingKeySpki: Uint8Array): Promise<string>;