json-chamber 1.4.0__py3-none-any.whl

json_chamber/__init__.py

@@ -0,0 +1,61 @@
+"""json-chamber — JSON sealing protocol.
+
+Cloak (seal new JSON) requires a live cloak license.
+Open of an already-sealed blob is keys-only: no license, no clock.
+TruGame and other engines still use require_alive() as a running-engine gate.
+"""
+
+from .api import cloak_json, open_json, cloak_bytes, open_bytes
+from .core import WORDLIST
+from .license import (
+    LicenseError,
+    PRODUCTS,
+    apply_entitlement,
+    create_entitlement,
+    license_status,
+    require_alive,
+    require_cloak,
+    reset_for_testing,
+    verifieddr_check,
+    verify_entitlement,
+)
+from .benefit import (
+    benefit_check,
+    tru8_benefit_check,
+    group_then_pack,
+    group_then_compress,
+    delta_transform_positions,
+    delta_transform_bytes,
+    chunk_dedup,
+    benefit_report,
+)
+
+__all__ = [
+    # Sealing
+    "cloak_json",
+    "open_json",
+    "cloak_bytes",
+    "open_bytes",
+    "WORDLIST",
+    # Shared Black Box control plane
+    "LicenseError",
+    "PRODUCTS",
+    "require_alive",
+    "require_cloak",
+    "license_status",
+    "apply_entitlement",
+    "create_entitlement",
+    "verify_entitlement",
+    "verifieddr_check",
+    "reset_for_testing",
+    # Optimizer / benefit
+    "benefit_check",
+    "tru8_benefit_check",
+    "group_then_pack",
+    "group_then_compress",
+    "delta_transform_positions",
+    "delta_transform_bytes",
+    "chunk_dedup",
+    "benefit_report",
+]
+__version__ = "1.4.0"

json_chamber/api.py

@@ -0,0 +1,46 @@
+"""
+High-level and low-level Chamber APIs.
+"""
+
+from __future__ import annotations
+
+import hashlib
+import json
+import os
+from typing import Any
+
+from . import core
+from .license import require_cloak
+
+
+def _master() -> bytes:
+    raw = (
+        os.environ.get("CHAMBER_MASTER_SECRET")
+        or os.environ.get("JSON_CHAMBER_MASTER")
+        or os.environ.get("TRU8_MASTER_SECRET", "chamber-demo-master-secret-32b!!")
+    )
+    b = raw.encode("utf-8")
+    if len(b) < 32:
+        b = hashlib.sha256(b).digest()
+    return b
+
+
+def cloak_bytes(data: bytes) -> dict:
+    """Seal bytes. Requires a live cloak license (24h try, then month/year)."""
+    require_cloak("json-chamber")
+    return core.seal_aont(data, _master())
+
+
+def open_bytes(sealed: dict) -> bytes:
+    """Open a sealed blob. Keys only — no license, no clock, no kill switch."""
+    return core.open_sealed(sealed, _master())
+
+
+def cloak_json(obj: Any) -> dict:
+    raw = json.dumps(obj, separators=(",", ":"), ensure_ascii=False).encode("utf-8")
+    return cloak_bytes(raw)
+
+
+def open_json(sealed: dict) -> Any:
+    raw = open_bytes(sealed)
+    return json.loads(raw.decode("utf-8"))

json_chamber/benefit.py

@@ -0,0 +1,289 @@
+"""
+benefit.py — public-safe optimizer for the $99 → $1,900 funnel.
+
+NO TRU8 residual engine here.
+  • benefit_check / tru8_benefit_check  – entropy + zero-bit bias + pair entropy
+  • group_then_pack / group_then_compress – create structure across tiny files
+  • delta_transform_positions           – mesh/position structure before coding
+  • chunk_dedup                         – cross-file repeat report (analysis only)
+
+$99 path (json-chamber) always works via cloak_json / cloak_bytes.
+$1,900 path is only advertised when compress=True.
+"""
+
+from __future__ import annotations
+
+import hashlib
+import io
+import math
+import struct
+import tarfile
+import zlib
+from collections import Counter
+from typing import Iterable, List, Mapping, Sequence, Tuple, Union
+
+
+def _undress(data: bytes) -> List[int]:
+    bits: List[int] = []
+    for b in data:
+        for i in range(7, -1, -1):
+            bits.append((b >> i) & 1)
+    return bits
+
+
+def shannon_entropy(data: bytes) -> float:
+    if not data:
+        return 0.0
+    n = len(data)
+    counts = Counter(data)
+    return -sum((v / n) * math.log2(v / n) for v in counts.values())
+
+
+def _pair_entropy(bits: List[int]) -> float:
+    if len(bits) < 2:
+        return 0.0
+    pairs = [(bits[i], bits[i + 1]) for i in range(0, len(bits) - 1)]
+    n = len(pairs)
+    c = Counter(pairs)
+    return -sum((v / n) * math.log2(v / n) for v in c.values())
+
+
+def benefit_check(data: bytes, *, min_bytes: int = 1024) -> dict:
+    if data is None or len(data) == 0:
+        return {
+            "compress": False,
+            "reason": "empty payload",
+            "action": "json-chamber",
+            "recommend": "json-chamber",
+            "entropy": 0.0,
+            "bias": 0.5,
+            "pair_entropy": 0.0,
+            "size": 0,
+            "est_saving": 0.0,
+            "price_hint": 99,
+        }
+
+    n = len(data)
+    if n < min_bytes:
+        return {
+            "compress": False,
+            "reason": f"tiny <{min_bytes}B - use json-chamber only ($99 tier); or group_then_pack first",
+            "action": "json-chamber",
+            "recommend": "group-first",
+            "entropy": shannon_entropy(data),
+            "bias": 0.5,
+            "pair_entropy": 0.0,
+            "size": n,
+            "est_saving": 0.0,
+            "price_hint": 99,
+        }
+
+    entropy = shannon_entropy(data)
+    sample = data[:8192]
+    bits = _undress(sample)
+    zeros = bits.count(0)
+    bias = (zeros / len(bits)) if bits else 0.5
+    pair_entropy = _pair_entropy(bits)
+
+    if entropy > 7.8:
+        return {
+            "compress": False,
+            "reason": f"high entropy {entropy:.2f}/8.0 - already compressed/encrypted/random",
+            "action": "json-chamber only + chunk dedup",
+            "recommend": "json-chamber",
+            "entropy": round(entropy, 4),
+            "bias": round(bias, 4),
+            "pair_entropy": round(pair_entropy, 4),
+            "size": n,
+            "est_saving": 0.0,
+            "price_hint": 99,
+        }
+
+    est_saving = max(0.0, (8.0 - entropy) / 8.0)
+    bias_boost = abs(bias - 0.5) * 0.4
+    est_saving = min(0.95, est_saving + bias_boost)
+
+    if est_saving < 0.08 and entropy > 7.0:
+        return {
+            "compress": False,
+            "reason": f"low structure - entropy {entropy:.2f}, bias {bias:.3f}, est {est_saving*100:.1f}%",
+            "action": "json-chamber",
+            "recommend": "json-chamber",
+            "entropy": round(entropy, 4),
+            "bias": round(bias, 4),
+            "pair_entropy": round(pair_entropy, 4),
+            "size": n,
+            "est_saving": round(est_saving, 4),
+            "price_hint": 99,
+        }
+
+    return {
+        "compress": True,
+        "reason": (
+            f"good candidate - entropy {entropy:.2f}, bias {bias:.3f}, "
+            f"est {est_saving*100:.1f}% saving"
+        ),
+        "action": "tru8-chamber $1900 tier",
+        "recommend": "tru8-chamber",
+        "entropy": round(entropy, 4),
+        "bias": round(bias, 4),
+        "pair_entropy": round(pair_entropy, 4),
+        "size": n,
+        "est_saving": round(est_saving, 4),
+        "price_hint": 1900,
+        "note": "TRU8 engine is proprietary — contact license@slidphilabs.com",
+    }
+
+
+tru8_benefit_check = benefit_check
+
+
+def delta_transform_positions(
+    positions: Sequence[float],
+    *,
+    quantize: float = 1e-4,
+) -> bytes:
+    if not positions:
+        return b""
+    quantized = [int(round(p / quantize)) for p in positions]
+    deltas = [quantized[0]]
+    for i in range(1, len(quantized)):
+        deltas.append(quantized[i] - quantized[i - 1])
+    out = io.BytesIO()
+    for d in deltas:
+        zz = (d << 1) ^ (d >> 63) if d < 0 else (d << 1)
+        while zz >= 0x80:
+            out.write(bytes([(zz & 0x7F) | 0x80]))
+            zz >>= 7
+        out.write(bytes([zz & 0x7F]))
+    return out.getvalue()
+
+
+def delta_transform_bytes(raw: bytes, *, stride: int = 4, fmt: str = "<f") -> bytes:
+    size = struct.calcsize(fmt)
+    n = len(raw) // size
+    if n == 0:
+        return raw
+    vals = list(struct.unpack("%d%s" % (n, fmt[-1] if fmt[-1] in "fd" else "f"), raw[: n * size]))
+    return delta_transform_positions(vals)
+
+
+def group_then_pack(
+    files: Union[Mapping[str, bytes], Sequence[Tuple[str, bytes]]],
+    *,
+    mode: str = "tar",
+) -> bytes:
+    if isinstance(files, Mapping):
+        items = list(files.items())
+    else:
+        items = list(files)
+    if mode == "tar":
+        buf = io.BytesIO()
+        with tarfile.open(fileobj=buf, mode="w") as tar:
+            for name, payload in items:
+                info = tarfile.TarInfo(name=str(name).replace("\\", "/").lstrip("/"))
+                info.size = len(payload)
+                tar.addfile(info, io.BytesIO(payload))
+        return buf.getvalue()
+    buf = io.BytesIO()
+    for name, data in items:
+        name_b = str(name).encode("utf-8")
+        buf.write(struct.pack("<I", len(name_b)))
+        buf.write(name_b)
+        buf.write(struct.pack("<I", len(data)))
+        buf.write(data)
+    return buf.getvalue()
+
+
+def group_then_compress(
+    files: Union[Mapping[str, bytes], Sequence[Tuple[str, bytes]]],
+) -> dict:
+    if isinstance(files, Mapping):
+        items = list(files.items())
+    else:
+        items = list(files)
+    total_raw = sum(len(d) for _, d in items)
+    grouped_bytes = group_then_pack(items, mode="tar")
+    check = benefit_check(grouped_bytes)
+    compressed = zlib.compress(grouped_bytes, level=9)
+    group_saving = 1.0 - (len(compressed) / len(grouped_bytes)) if grouped_bytes else 0.0
+    individual_saving = []
+    for _, data in items:
+        if not data:
+            individual_saving.append(0.0)
+            continue
+        c = zlib.compress(data, level=9)
+        individual_saving.append(1.0 - (len(c) / len(data)))
+    avg_individual = sum(individual_saving) / len(individual_saving) if individual_saving else 0.0
+    return {
+        "total_files": len(items),
+        "total_raw": total_raw,
+        "grouped_raw": len(grouped_bytes),
+        "compressed": len(compressed),
+        "group_saving": round(group_saving, 4),
+        "avg_individual_saving": round(avg_individual, 4),
+        "gain_from_grouping": round(group_saving - avg_individual, 4),
+        "benefit_check": check,
+        "recommendation": (
+            f"Grouping created {(group_saving - avg_individual)*100:.1f}% extra saving"
+            if group_saving > avg_individual
+            else "Grouping did not beat per-file baseline"
+        ),
+        "note": "zlib baseline only — TRU8 residual engine is proprietary ($1,900 tier)",
+    }
+
+
+def chunk_dedup(files: Sequence[bytes], chunk_size: int = 4096) -> dict:
+    seen = {}
+    total_chunks = 0
+    dup_chunks = 0
+    for data in files:
+        for i in range(0, len(data), chunk_size):
+            chunk = data[i : i + chunk_size]
+            h = hashlib.blake2b(chunk, digest_size=16).hexdigest()
+            total_chunks += 1
+            if h in seen:
+                dup_chunks += 1
+            else:
+                seen[h] = True
+    dedup_ratio = (dup_chunks / total_chunks) if total_chunks else 0.0
+    return {
+        "total_chunks": total_chunks,
+        "unique_chunks": len(seen),
+        "dup_chunks": dup_chunks,
+        "dedup_saving": round(dedup_ratio, 4),
+        "reason": (
+            f"{dup_chunks}/{total_chunks} chunks duplicate - "
+            f"{dedup_ratio*100:.1f}% saving via dedup even if entropy high"
+        ),
+        "action": "use chunk dedup + json-chamber for high entropy bundles",
+        "note": "analysis only — production dedup packer is $1,900 tier",
+    }
+
+
+def benefit_report(*blobs: bytes, names: Sequence[str] | None = None) -> dict:
+    per_file = []
+    for i, b in enumerate(blobs):
+        label = names[i] if names and i < len(names) else f"file_{i}"
+        r = benefit_check(b)
+        r["name"] = label
+        per_file.append(r)
+    grouped = None
+    if len(blobs) >= 2:
+        packed = group_then_pack({r["name"]: blobs[i] for i, r in enumerate(per_file)})
+        grouped = benefit_check(packed)
+        grouped["name"] = "__grouped__"
+        grouped["packed_bytes"] = len(packed)
+    any_compress = any(r.get("compress") for r in per_file) or (
+        grouped.get("compress") if grouped else False
+    )
+    return {
+        "files": per_file,
+        "grouped": grouped,
+        "any_compress_candidate": bool(any_compress),
+        "funnel": (
+            "tru8-chamber ($1,900/project/year)"
+            if any_compress
+            else "json-chamber ($99) — seal only"
+        ),
+    }

json_chamber/core.py

@@ -0,0 +1,200 @@
+"""
+Chamber core – φ-split + keyword lock.
+
+A 32-byte session key is derived, then split with a simple 2-of-2
+φ-inspired share (XOR + golden-ratio bit rotation) into two 16-byte
+halves.  Each half is rendered as a space-separated word list drawn
+from a curated chamber vocabulary.  The sealed object ships both
+word lists + nonce + tag + ciphertext; neither list alone can
+reconstruct the key.  Opening requires both lists + the master secret
+(used as an additional KDF salt) + a live license.
+"""
+
+from __future__ import annotations
+
+import hashlib
+import hmac
+import os
+from typing import Sequence
+
+from cryptography.hazmat.primitives.ciphers.aead import AESGCM
+
+# Curated chamber vocabulary (64 words → 6 bits each, clean encoding)
+_WORDS: tuple[str, ...] = (
+    "ward", "veil", "spire", "lock", "oath", "cloak", "shard", "mark",
+    "rune", "gate", "seal", "vault", "cipher", "glyph", "prism", "echo",
+    "aegis", "sigil", "forge", "anchor", "tide", "ember", "frost", "bloom",
+    "thorn", "quill", "mirror", "hollow", "crown", "blade", "root", "star",
+    "mist", "iron", "glass", "stone", "flame", "shade", "pulse", "nexus",
+    "orbit", "vector", "lattice", "helix", "core", "rim", "axis", "node",
+    "flux", "phase", "drift", "spark", "void", "bound", "link", "key",
+    "guard", "watch", "keep", "hold", "bind", "cast", "form", "rise",
+)
+
+assert len(_WORDS) == 64
+WORDLIST = _WORDS
+
+# φ ≈ 1.6180339887 – used for a deterministic bit rotation amount
+_PHI_ROT = 21  # round(32 * (φ - 1)) ≈ 19.4 → pick 21 for nice mix
+
+
+def _bytes_to_words(data: bytes) -> str:
+    """Encode exact bytes as space-separated words (6 bits per word)."""
+    pad = (3 - len(data) % 3) % 3
+    buf = data + b"\x00" * pad
+    words: list[str] = []
+    for i in range(0, len(buf), 3):
+        n = (buf[i] << 16) | (buf[i + 1] << 8) | buf[i + 2]
+        for shift in (18, 12, 6, 0):
+            words.append(_WORDS[(n >> shift) & 0x3F])
+    return " ".join(words)
+
+
+def _words_to_bytes(text: str, expected_len: int) -> bytes:
+    """Decode word list back to bytes, truncate to expected_len."""
+    tokens = text.strip().lower().split()
+    idx = {_WORDS[i]: i for i in range(64)}
+    out = bytearray()
+    for i in range(0, len(tokens), 4):
+        chunk = tokens[i : i + 4]
+        if len(chunk) < 4:
+            break
+        n = 0
+        for w in chunk:
+            if w not in idx:
+                raise ValueError(f"unknown chamber word: {w!r}")
+            n = (n << 6) | idx[w]
+        out.append((n >> 16) & 0xFF)
+        out.append((n >> 8) & 0xFF)
+        out.append(n & 0xFF)
+    return bytes(out[:expected_len])
+
+
+def _phi_split(key32: bytes) -> tuple[bytes, bytes]:
+    """
+    2-of-2 φ-split.
+    k = first 16 bytes rotated by φ amount
+    r = second 16 bytes XOR k
+    Reconstruct: r XOR k → second half, un-rotate → full key.
+    """
+    if len(key32) != 32:
+        raise ValueError("key must be 32 bytes")
+    left = bytearray(key32[:16])
+    right = bytearray(key32[16:])
+    bits = int.from_bytes(left, "big")
+    rot = ((bits << _PHI_ROT) | (bits >> (128 - _PHI_ROT))) & ((1 << 128) - 1)
+    k = rot.to_bytes(16, "big")
+    r = bytes(a ^ b for a, b in zip(right, k))
+    return k, r
+
+
+def _phi_join(k: bytes, r: bytes) -> bytes:
+    if len(k) != 16 or len(r) != 16:
+        raise ValueError("shares must be 16 bytes each")
+    right = bytes(a ^ b for a, b in zip(r, k))
+    bits = int.from_bytes(k, "big")
+    unrot = ((bits >> _PHI_ROT) | (bits << (128 - _PHI_ROT))) & ((1 << 128) - 1)
+    left = unrot.to_bytes(16, "big")
+    return left + right
+
+
+def _derive_session_key(master: bytes, salt: bytes = b"chamber-phi-v1") -> bytes:
+    return hashlib.pbkdf2_hmac("sha256", master, salt, iterations=120_000, dklen=32)
+
+
+def _bind_key(msg_key: bytes, ct: bytes) -> bytes:
+    """AONT bind: message key XOR repeating SHA-256 of ciphertext."""
+    h = hashlib.sha256(ct).digest()
+    return bytes(msg_key[i] ^ h[i % 32] for i in range(32))
+
+
+def seal(plaintext: bytes, master: bytes) -> dict:
+    """v1 seal — both word lists required. Kept so already-sealed blobs still open."""
+    session = _derive_session_key(master)
+    msg_key = os.urandom(32)
+    k, r = _phi_split(msg_key)
+
+    aesgcm = AESGCM(msg_key)
+    nonce = os.urandom(12)
+    ct = aesgcm.encrypt(nonce, plaintext, associated_data=b"chamber-v1")
+
+    tag = hashlib.sha256(k + r + nonce).digest()[:16]
+    _ = session
+
+    return {
+        "v": 1,
+        "algo": "chamber-aes256gcm-phi",
+        "k_words": _bytes_to_words(k),
+        "r_words": _bytes_to_words(r),
+        "nonce": nonce.hex(),
+        "tag": tag.hex(),
+        "ct": ct.hex(),
+        "orig_len": len(plaintext),
+    }
+
+
+def seal_aont(plaintext: bytes, master: bytes) -> dict:
+    """v2: encrypt, bind the key to the ciphertext, then φ-split the bound key.
+
+    One share plus the blob is not enough to recover the message key.
+    Lab-owned AONT, not a Shamir library wrap.
+    """
+    _ = _derive_session_key(master)
+    msg_key = os.urandom(32)
+    aesgcm = AESGCM(msg_key)
+    nonce = os.urandom(12)
+    ct = aesgcm.encrypt(nonce, plaintext, associated_data=b"chamber-v2")
+    package_key = _bind_key(msg_key, ct)
+    k, r = _phi_split(package_key)
+    tag = hashlib.sha256(k + r + nonce + ct[:16]).digest()[:16]
+    return {
+        "v": 2,
+        "algo": "chamber-aes256gcm-phi-aont",
+        "k_words": _bytes_to_words(k),
+        "r_words": _bytes_to_words(r),
+        "nonce": nonce.hex(),
+        "tag": tag.hex(),
+        "ct": ct.hex(),
+        "orig_len": len(plaintext),
+    }
+
+
+def open_sealed(sealed: dict, master: bytes) -> bytes:
+    """Reconstruct key from both word lists and decrypt. v1 and v2."""
+    ver = sealed.get("v")
+    if ver == 1:
+        if sealed.get("algo") != "chamber-aes256gcm-phi":
+            raise ValueError("algo mismatch")
+        k = _words_to_bytes(sealed["k_words"], 16)
+        r = _words_to_bytes(sealed["r_words"], 16)
+        nonce = bytes.fromhex(sealed["nonce"])
+        expected_tag = hashlib.sha256(k + r + nonce).digest()[:16]
+        if not hmac_compare(expected_tag, bytes.fromhex(sealed["tag"])):
+            raise ValueError("share integrity tag mismatch – possible tamper")
+        msg_key = _phi_join(k, r)
+        _ = _derive_session_key(master)
+        aesgcm = AESGCM(msg_key)
+        ct = bytes.fromhex(sealed["ct"])
+        return aesgcm.decrypt(nonce, ct, associated_data=b"chamber-v1")
+    if ver == 2:
+        if sealed.get("algo") != "chamber-aes256gcm-phi-aont":
+            raise ValueError("algo mismatch")
+        k = _words_to_bytes(sealed["k_words"], 16)
+        r = _words_to_bytes(sealed["r_words"], 16)
+        nonce = bytes.fromhex(sealed["nonce"])
+        ct = bytes.fromhex(sealed["ct"])
+        expected_tag = hashlib.sha256(k + r + nonce + ct[:16]).digest()[:16]
+        if not hmac_compare(expected_tag, bytes.fromhex(sealed["tag"])):
+            raise ValueError("share integrity tag mismatch – possible tamper")
+        package_key = _phi_join(k, r)
+        msg_key = _bind_key(package_key, ct)
+        _ = _derive_session_key(master)
+        aesgcm = AESGCM(msg_key)
+        return aesgcm.decrypt(nonce, ct, associated_data=b"chamber-v2")
+    raise ValueError(f"unsupported chamber version: {ver}")
+
+
+def hmac_compare(a: bytes, b: bytes) -> bool:
+    if len(a) != len(b):
+        return False
+    return hmac.compare_digest(a, b)