blindvault-sdk 0.1.0rc1__tar.gz

blindvault_sdk-0.1.0rc1/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2025 BlindVault
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.

blindvault_sdk-0.1.0rc1/MANIFEST.in

@@ -0,0 +1,3 @@
+prune generated
+prune tests
+global-exclude __pycache__ *.py[cod]

blindvault_sdk-0.1.0rc1/PKG-INFO

@@ -0,0 +1,25 @@
+Metadata-Version: 2.4
+Name: blindvault-sdk
+Version: 0.1.0rc1
+Summary: BlindVault local encryption and API SDK
+Author-email: BlindVault <devops@blindvault.com>
+License-Expression: MIT
+Project-URL: Homepage, https://blindvault.com
+Project-URL: Repository, https://gitlab.com/blindvault/blindvault-sdk
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: blindvault-sdk-api==0.1.0rc1
+Requires-Dist: cryptography<49,>=46
+Dynamic: license-file
+
+# BlindVault SDK
+
+Prerelease 0.1.0-rc.1. Local encryption, key wrapping and encrypted Library API operations.
+
+This package requires a BlindVault account and backend access for network operations.
+TEST/DEV require VPN access. Keys remain under application control.
+
+Source and usage guide: https://gitlab.com/blindvault/blindvault-sdk
+
+Contact: devops@blindvault.com

blindvault_sdk-0.1.0rc1/README.md

@@ -0,0 +1,10 @@
+# BlindVault SDK
+
+Prerelease 0.1.0-rc.1. Local encryption, key wrapping and encrypted Library API operations.
+
+This package requires a BlindVault account and backend access for network operations.
+TEST/DEV require VPN access. Keys remain under application control.
+
+Source and usage guide: https://gitlab.com/blindvault/blindvault-sdk
+
+Contact: devops@blindvault.com

blindvault_sdk-0.1.0rc1/pyproject.toml

@@ -0,0 +1,19 @@
+[build-system]
+requires = ["setuptools>=77"]
+build-backend = "setuptools.build_meta"
+[project]
+readme = "README.md"
+description = "BlindVault local encryption and API SDK"
+license-files = ["LICENSE"]
+name = "blindvault-sdk"
+version = "0.1.0rc1"
+requires-python = ">=3.10"
+dependencies = ["blindvault-sdk-api==0.1.0rc1", "cryptography>=46,<49"]
+authors = [{name="BlindVault",email="devops@blindvault.com"}]
+license = "MIT"
+[tool.setuptools.packages.find]
+where = ["src"]
+
+[project.urls]
+Homepage = "https://blindvault.com"
+Repository = "https://gitlab.com/blindvault/blindvault-sdk"

blindvault_sdk-0.1.0rc1/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+

blindvault_sdk-0.1.0rc1/src/blindvault_sdk/__init__.py

@@ -0,0 +1,3 @@
+from blindvault_sdk_api import ApiClient, Configuration
+from .crypto import *
+from .library import LibraryClient

blindvault_sdk-0.1.0rc1/src/blindvault_sdk/crypto.py

@@ -0,0 +1,63 @@
+"""BlindVault AES-GCM/RSA-OAEP wire format. Raw key exports must be protected by callers."""
+import base64
+import re
+import secrets
+from cryptography.hazmat.primitives import hashes, serialization
+from cryptography.hazmat.primitives.asymmetric import rsa, padding
+from cryptography.hazmat.primitives.ciphers.aead import AESGCM
+from cryptography.hazmat.primitives.kdf.pbkdf2 import PBKDF2HMAC
+__all__ = ['to_base64','from_base64','generate_content_key','encrypt','decrypt','encrypt_text','decrypt_text','encrypt_file','decrypt_file','derive_passphrase_key','generate_identity','import_public_jwk','export_public_jwk','wrap_content_key','unwrap_content_key','protect_private_key','unlock_private_key','EncryptedContentClient']
+def to_base64(value): return base64.b64encode(value).decode('ascii')
+def from_base64(value):
+    if not isinstance(value,str) or not re.fullmatch(r'[A-Za-z0-9+/_-]*={0,2}',value): raise ValueError('Invalid base64')
+    normalized = value.replace('-','+').replace('_','/').rstrip('=')
+    if len(normalized)%4==1: raise ValueError('Invalid base64')
+    raw = base64.b64decode(normalized+'='*((-len(normalized))%4),validate=True)
+    if to_base64(raw).rstrip('=') != normalized: raise ValueError('Non-canonical base64')
+    return raw
+def _size(value,n):
+    if len(value)!=n: raise ValueError(f'Expected {n} bytes')
+    return value
+def generate_content_key(): return secrets.token_bytes(32)
+def encrypt(data,key):
+    iv=secrets.token_bytes(12)
+    return {'ciphertext':to_base64(AESGCM(_size(key,32)).encrypt(iv,data,None)),'iv':to_base64(iv)}
+def decrypt(value,key):
+    data=from_base64(value['ciphertext'])
+    if len(data)<16: raise ValueError('Ciphertext is missing its authentication tag')
+    return AESGCM(_size(key,32)).decrypt(_size(from_base64(value['iv']),12),data,None)
+def encrypt_text(text,key): return encrypt(text.encode('utf-8'),key)
+def decrypt_text(value,key): return decrypt(value,key).decode('utf-8')
+def encrypt_file(data,filename,key): return {'content':encrypt(data,key),'filename':encrypt_text(filename,key)}
+def decrypt_file(value,key): return {'data':decrypt(value['content'],key),'filename':decrypt_text(value['filename'],key)}
+def derive_passphrase_key(passphrase,salt):
+    return PBKDF2HMAC(algorithm=hashes.SHA256(),length=32,salt=_size(salt,16),iterations=100000).derive(passphrase.encode('utf-8'))
+def _rsa(key):
+    if not isinstance(key,(rsa.RSAPublicKey,rsa.RSAPrivateKey)) or key.key_size<2048: raise ValueError('RSA key must be at least 2048 bits')
+    return key
+def _private(der): return _rsa(serialization.load_der_private_key(der,password=None))
+def generate_identity():
+    key=rsa.generate_private_key(public_exponent=65537,key_size=2048)
+    return {'publicKeySpki':key.public_key().public_bytes(serialization.Encoding.DER,serialization.PublicFormat.SubjectPublicKeyInfo),'privateKeyPkcs8':key.private_bytes(serialization.Encoding.DER,serialization.PrivateFormat.PKCS8,serialization.NoEncryption())}
+def import_public_jwk(jwk):
+    if jwk.get('kty')!='RSA': raise ValueError('RSA public JWK required')
+    key=_rsa(rsa.RSAPublicNumbers(int.from_bytes(from_base64(jwk['e']),'big'),int.from_bytes(from_base64(jwk['n']),'big')).public_key())
+    return key.public_bytes(serialization.Encoding.DER,serialization.PublicFormat.SubjectPublicKeyInfo)
+def export_public_jwk(spki):
+    numbers=_rsa(serialization.load_der_public_key(spki)).public_numbers()
+    encode=lambda n: to_base64(n.to_bytes((n.bit_length()+7)//8,'big')).rstrip('=').replace('+','-').replace('/','_')
+    return {'kty':'RSA','n':encode(numbers.n),'e':encode(numbers.e),'alg':'RSA-OAEP-256','ext':True,'key_ops':['encrypt']}
+def _oaep(): return padding.OAEP(mgf=padding.MGF1(hashes.SHA256()),algorithm=hashes.SHA256(),label=None)
+def wrap_content_key(key,spki): return to_base64(_rsa(serialization.load_der_public_key(spki)).encrypt(_size(key,32),_oaep()))
+def unwrap_content_key(wrapped,pkcs8): return _size(_private(pkcs8).decrypt(from_base64(wrapped),_oaep()),32)
+def protect_private_key(pkcs8,passphrase):
+    _private(pkcs8)
+    salt=secrets.token_bytes(16); envelope=encrypt(pkcs8,derive_passphrase_key(passphrase,salt))
+    return {'encryptedPrivateKey':envelope['ciphertext'],'salt':to_base64(salt),'iv':envelope['iv']}
+def unlock_private_key(value,passphrase):
+    der=decrypt({'ciphertext':value['encryptedPrivateKey'],'iv':value['iv']},derive_passphrase_key(passphrase,from_base64(value['salt'])))
+    _private(der)
+    return der
+class EncryptedContentClient:
+    def encrypt_and_upload(self,data,filename,key,upload): return upload(encrypt_file(data,filename,key))
+    def download_and_decrypt(self,key,download): return decrypt_file(download(),key)

blindvault_sdk-0.1.0rc1/src/blindvault_sdk/library.py

@@ -0,0 +1,16 @@
+"""Library API adapter using the agent's versioned filename envelope."""
+import json
+from .crypto import encrypt_file, decrypt_file, from_base64
+class LibraryClient:
+    def __init__(self,library_api,encrypted_file_api):
+        self.library=library_api; self.files=encrypted_file_api
+    def encrypt_and_upload(self,collection_id,data,filename,key,content_type='application/octet-stream'):
+        value=encrypt_file(data,filename,key)
+        return self.library.upload_file(collection_id=collection_id,file=('encrypted-file.bin',from_base64(value['content']['ciphertext'])),encrypted_filename=json.dumps({'version':1,**value['filename']},separators=(',',':')),iv=value['content']['iv'],content_type=content_type,filename='encrypted-file.bin')
+    def download_and_decrypt(self,file_id,iv,encrypted_filename,key):
+        if encrypted_filename.startswith('{'):
+            filename=json.loads(encrypted_filename)
+            if filename.get('version')!=1 or not isinstance(filename.get('iv'),str) or not isinstance(filename.get('ciphertext'),str): raise ValueError('Unsupported filename envelope')
+        else: filename={'iv':iv,'ciphertext':encrypted_filename}
+        ciphertext=self.files.download_encrypted_file_by_query(file_id)
+        return decrypt_file({'content':{'iv':iv,'ciphertext':ciphertext},'filename':filename},key)

blindvault_sdk-0.1.0rc1/src/blindvault_sdk.egg-info/PKG-INFO

@@ -0,0 +1,25 @@
+Metadata-Version: 2.4
+Name: blindvault-sdk
+Version: 0.1.0rc1
+Summary: BlindVault local encryption and API SDK
+Author-email: BlindVault <devops@blindvault.com>
+License-Expression: MIT
+Project-URL: Homepage, https://blindvault.com
+Project-URL: Repository, https://gitlab.com/blindvault/blindvault-sdk
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: blindvault-sdk-api==0.1.0rc1
+Requires-Dist: cryptography<49,>=46
+Dynamic: license-file
+
+# BlindVault SDK
+
+Prerelease 0.1.0-rc.1. Local encryption, key wrapping and encrypted Library API operations.
+
+This package requires a BlindVault account and backend access for network operations.
+TEST/DEV require VPN access. Keys remain under application control.
+
+Source and usage guide: https://gitlab.com/blindvault/blindvault-sdk
+
+Contact: devops@blindvault.com

blindvault_sdk-0.1.0rc1/src/blindvault_sdk.egg-info/SOURCES.txt

@@ -0,0 +1,12 @@
+LICENSE
+MANIFEST.in
+README.md
+pyproject.toml
+src/blindvault_sdk/__init__.py
+src/blindvault_sdk/crypto.py
+src/blindvault_sdk/library.py
+src/blindvault_sdk.egg-info/PKG-INFO
+src/blindvault_sdk.egg-info/SOURCES.txt
+src/blindvault_sdk.egg-info/dependency_links.txt
+src/blindvault_sdk.egg-info/requires.txt
+src/blindvault_sdk.egg-info/top_level.txt

blindvault_sdk-0.1.0rc1/src/blindvault_sdk.egg-info/dependency_links.txt

@@ -0,0 +1 @@
+

blindvault_sdk-0.1.0rc1/src/blindvault_sdk.egg-info/requires.txt

@@ -0,0 +1,2 @@
+blindvault-sdk-api==0.1.0rc1
+cryptography<49,>=46

blindvault_sdk-0.1.0rc1/src/blindvault_sdk.egg-info/top_level.txt

@@ -0,0 +1 @@
+blindvault_sdk