t2em 0.6.0__tar.gz

t2em-0.6.0/.gitignore

@@ -0,0 +1,67 @@
+# Logs
+logs
+*.log
+npm-debug.log*
+yarn-debug.log*
+yarn-error.log*
+lerna-debug.log*
+
+# Diagnostic reports (https://nodejs.org/api/report.html)
+report.[0-9]*.[0-9]*.[0-9]*.[0-9]*.json
+
+# Runtime data
+pids
+*.pid
+*.seed
+*.pid.lock
+
+# Coverage directory
+coverage
+*.lcov
+.nyc_output
+
+# Dependency directories
+node_modules/
+
+# TypeScript cache
+*.tsbuildinfo
+
+# Optional npm cache directory
+.npm
+
+# Optional eslint cache
+.eslintcache
+
+# REPL history
+.node_repl_history
+
+# Output of 'npm pack'
+*.tgz
+
+# dotenv environment variable files — NEVER commit secrets
+# (Upstash REST tokens, Wrangler secrets live here in development)
+.env
+.env.*
+!.env.example
+
+# Build output
+dist
+.output
+
+# Wrangler / Cloudflare local state
+.wrangler/
+
+# pnpm
+.pnpm-store
+
+# Vite files
+vite.config.js.timestamp-*
+vite.config.ts.timestamp-*
+.vite/
+
+# NOTE: unlike me2em-protocol, docs/ is NOT ignored here:
+# docs/ holds the source TZ documents (TZ_t2em.md, TZ_we2em.md).
+
+# Python bytecode
+__pycache__/
+*.pyc

t2em-0.6.0/PKG-INFO

@@ -0,0 +1,99 @@
+Metadata-Version: 2.5
+Name: t2em
+Version: 0.6.0
+Summary: Python SDK for t2em.com — zero-knowledge secret drops (Blind Relay) for LangGraph / CrewAI / AutoGen pipelines
+Project-URL: Homepage, https://t2em.com
+Project-URL: Documentation, https://t2em.com/docs/python-sdk.md
+Project-URL: Source, https://github.com/me2em-org/t2em
+Author: Me2eM ecosystem
+License: Apache-2.0
+Keywords: aes-gcm,agents,e2ee,secrets,x25519,zero-knowledge
+Classifier: Development Status :: 4 - Beta
+Classifier: Intended Audience :: Developers
+Classifier: License :: OSI Approved :: Apache Software License
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Topic :: Security :: Cryptography
+Classifier: Typing :: Typed
+Requires-Python: >=3.10
+Requires-Dist: cryptography>=41.0
+Provides-Extra: dev
+Requires-Dist: pytest>=8; extra == 'dev'
+Description-Content-Type: text/markdown
+
+# t2em — Python SDK (PyPI)
+
+Python client for [t2em.com](https://t2em.com) for LangGraph / CrewAI /
+AutoGen pipelines (ТЗ `docs/TZ_t2em.md` §8.3).
+
+**Status: implemented (Этап 4 done).** Zero-knowledge secret drops —
+the relay stores only an AES-256-GCM envelope and can never derive the
+key.
+
+## Install
+
+```bash
+pip install t2em          # from PyPI (when published)
+pip install -e .          # from this repo (editable, dev)
+```
+
+## Usage (the ТЗ §8.3 contract)
+
+```python
+from t2em import T2emClient, generate_x25519_keypair
+
+client = T2emClient("https://t2em.com")
+
+# Mode B (symmetric — key rides in the URL #fragment, never sent to the server)
+drop = client.push(secret="sk-live-...", ttl=300)
+print(drop.url)        # https://t2em.com/s/abc123#xyz789
+print(drop.delete_token)
+secret = client.pull_text(drop.url)
+
+# Mode A (asymmetric — sealed to the recipient's X25519 pubkey)
+keys = generate_x25519_keypair()
+drop = client.push(secret="sk-live-...", recipient_pubkey=keys.public_key, ttl=300)
+secret = client.pull_text(drop.url, recipient_privkey=keys.private_key)
+
+# Delete before TTL expiry
+client.delete(drop.id, drop.delete_token)
+
+# Keyfile — same JSON format as the TS CLI (`t2em-cli keygen`)
+from t2em import write_keyfile, load_keyfile
+pubkey = write_keyfile("./agent.key")            # 0600, returns b64url pubkey
+key = load_keyfile("./agent.key")                # LoadedKey(private_key, public_key)
+```
+
+## Guarantees
+
+- Python ≥ 3.10, full type hints (`py.typed`).
+- Networking: stdlib `urllib` only (no `requests`/`httpx`) — §8.3.
+- Crypto: PyCA `cryptography` as the single crypto dependency
+  (hand-rolled crypto is forbidden, §11.2); HKDF strictly per RFC 5869.
+- Bit-compatible with the TypeScript protocol `@me2em/protocol`:
+  verified against `vectors/t2em-drop.v1.json` (unpack AND deterministic
+  re-encryption, both modes) plus TS↔Python cross-pack/unpack checks.
+- Transport is injectable (`T2emClient(base_url, transport=...)`) for
+  testing without sockets.
+- Error taxonomy mirrors §4.5: branch on `ProtocolError.code`
+  (`MALFORMED` / `UNSUPPORTED_VERSION` / `DECRYPT_FAILED`), `UsageError`,
+  `HttpError` (status / code / retry_after).
+
+## Layout
+
+```
+python-sdk/
+├── src/t2em/           # package (py.typed)
+│   ├── protocol.py     # constants: version, TTL bounds, HKDF info (freeze §4.5)
+│   ├── base64url.py    # strict RFC 4648 §5 unpadded codec
+│   ├── envelope.py     # v1 envelope validation (mirror of @me2em/protocol)
+│   ├── mode_b.py       # pack/unpack sym (AES-256-GCM, 12B IV)
+│   ├── mode_a.py       # pack/unpack X25519 ECDH + HKDF-SHA256
+│   ├── fingerprint.py  # 8-char pubkey fingerprint (§4.2.1)
+│   ├── keyfile.py      # t2em-x25519-key-v1 JSON keyfile (0600)
+│   └── client.py       # T2emClient: push / pull_text / pull_bytes / delete
+└── tests/              # pytest: vectors bit-compat, client journeys, keyfile
+```

t2em-0.6.0/README.md

@@ -0,0 +1,73 @@
+# t2em — Python SDK (PyPI)
+
+Python client for [t2em.com](https://t2em.com) for LangGraph / CrewAI /
+AutoGen pipelines (ТЗ `docs/TZ_t2em.md` §8.3).
+
+**Status: implemented (Этап 4 done).** Zero-knowledge secret drops —
+the relay stores only an AES-256-GCM envelope and can never derive the
+key.
+
+## Install
+
+```bash
+pip install t2em          # from PyPI (when published)
+pip install -e .          # from this repo (editable, dev)
+```
+
+## Usage (the ТЗ §8.3 contract)
+
+```python
+from t2em import T2emClient, generate_x25519_keypair
+
+client = T2emClient("https://t2em.com")
+
+# Mode B (symmetric — key rides in the URL #fragment, never sent to the server)
+drop = client.push(secret="sk-live-...", ttl=300)
+print(drop.url)        # https://t2em.com/s/abc123#xyz789
+print(drop.delete_token)
+secret = client.pull_text(drop.url)
+
+# Mode A (asymmetric — sealed to the recipient's X25519 pubkey)
+keys = generate_x25519_keypair()
+drop = client.push(secret="sk-live-...", recipient_pubkey=keys.public_key, ttl=300)
+secret = client.pull_text(drop.url, recipient_privkey=keys.private_key)
+
+# Delete before TTL expiry
+client.delete(drop.id, drop.delete_token)
+
+# Keyfile — same JSON format as the TS CLI (`t2em-cli keygen`)
+from t2em import write_keyfile, load_keyfile
+pubkey = write_keyfile("./agent.key")            # 0600, returns b64url pubkey
+key = load_keyfile("./agent.key")                # LoadedKey(private_key, public_key)
+```
+
+## Guarantees
+
+- Python ≥ 3.10, full type hints (`py.typed`).
+- Networking: stdlib `urllib` only (no `requests`/`httpx`) — §8.3.
+- Crypto: PyCA `cryptography` as the single crypto dependency
+  (hand-rolled crypto is forbidden, §11.2); HKDF strictly per RFC 5869.
+- Bit-compatible with the TypeScript protocol `@me2em/protocol`:
+  verified against `vectors/t2em-drop.v1.json` (unpack AND deterministic
+  re-encryption, both modes) plus TS↔Python cross-pack/unpack checks.
+- Transport is injectable (`T2emClient(base_url, transport=...)`) for
+  testing without sockets.
+- Error taxonomy mirrors §4.5: branch on `ProtocolError.code`
+  (`MALFORMED` / `UNSUPPORTED_VERSION` / `DECRYPT_FAILED`), `UsageError`,
+  `HttpError` (status / code / retry_after).
+
+## Layout
+
+```
+python-sdk/
+├── src/t2em/           # package (py.typed)
+│   ├── protocol.py     # constants: version, TTL bounds, HKDF info (freeze §4.5)
+│   ├── base64url.py    # strict RFC 4648 §5 unpadded codec
+│   ├── envelope.py     # v1 envelope validation (mirror of @me2em/protocol)
+│   ├── mode_b.py       # pack/unpack sym (AES-256-GCM, 12B IV)
+│   ├── mode_a.py       # pack/unpack X25519 ECDH + HKDF-SHA256
+│   ├── fingerprint.py  # 8-char pubkey fingerprint (§4.2.1)
+│   ├── keyfile.py      # t2em-x25519-key-v1 JSON keyfile (0600)
+│   └── client.py       # T2emClient: push / pull_text / pull_bytes / delete
+└── tests/              # pytest: vectors bit-compat, client journeys, keyfile
+```

t2em-0.6.0/pyproject.toml

@@ -0,0 +1,45 @@
+[build-system]
+requires = ["hatchling"]
+build-backend = "hatchling.build"
+
+[project]
+name = "t2em"
+version = "0.6.0"
+description = "Python SDK for t2em.com — zero-knowledge secret drops (Blind Relay) for LangGraph / CrewAI / AutoGen pipelines"
+readme = "README.md"
+requires-python = ">=3.10"
+license = { text = "Apache-2.0" }
+authors = [{ name = "Me2eM ecosystem" }]
+keywords = ["secrets", "zero-knowledge", "e2ee", "agents", "x25519", "aes-gcm"]
+classifiers = [
+    "Development Status :: 4 - Beta",
+    "Intended Audience :: Developers",
+    "License :: OSI Approved :: Apache Software License",
+    "Operating System :: OS Independent",
+    "Programming Language :: Python :: 3",
+    "Programming Language :: Python :: 3.10",
+    "Programming Language :: Python :: 3.11",
+    "Programming Language :: Python :: 3.12",
+    "Topic :: Security :: Cryptography",
+    "Typing :: Typed",
+]
+# ТЗ §8.3: zero external NETWORK deps — stdlib urllib only.
+# Crypto: PyCA cryptography as the single crypto dependency (§11.2:
+# hand-rolled crypto is forbidden).
+dependencies = ["cryptography>=41.0"]
+
+[project.optional-dependencies]
+dev = ["pytest>=8"]
+
+[project.urls]
+Homepage = "https://t2em.com"
+Documentation = "https://t2em.com/docs/python-sdk.md"
+Source = "https://github.com/me2em-org/t2em"
+
+[tool.hatch.build.targets.wheel]
+packages = ["src/t2em"]
+
+[tool.pytest.ini_options]
+testpaths = ["tests"]
+pythonpath = ["src"]
+addopts = "-q"

t2em-0.6.0/src/t2em/__init__.py

@@ -0,0 +1,74 @@
+"""t2em — Python SDK for t2em.com (ТЗ docs/TZ_t2em.md §8.3).
+
+Zero-knowledge secret drops over a Blind Relay: the server stores only
+an AES-256-GCM envelope and can never derive the key. Bit-compatible
+with the TypeScript protocol `@t2em/protocol` — verified against
+`vectors/t2em-drop.v1.json`.
+
+Typical use::
+
+    from t2em import T2emClient, generate_x25519_keypair
+
+    client = T2emClient("https://t2em.com")
+
+    # Mode B (symmetric, key lives in the URL #fragment)
+    drop = client.push(secret="sk-live-...", ttl=300)
+    secret = client.pull_text(drop.url)
+
+    # Mode A (asymmetric, sealed to the recipient's X25519 pubkey)
+    keys = generate_x25519_keypair()
+    drop = client.push(secret="sk-live-...", recipient_pubkey=keys.public_key, ttl=300)
+    secret = client.pull_text(drop.url, recipient_privkey=keys.private_key)
+"""
+
+from .base64url import b64u_decode, b64u_encode, is_b64u_of_length
+from ._meta import SDK_VERSION, SDK_USER_AGENT
+from .client import CreatedDrop, ShareUrl, T2emClient
+from .envelope import Envelope, ModeAEnvelope, ModeBEnvelope, validate_envelope
+from .exceptions import HttpError, ProtocolError, T2emError, UsageError
+from .facade import pack_drop, unpack_drop
+from .fingerprint import fingerprint_pubkey, generate_fingerprint
+from .keyfile import KEYFILE_KIND, KEYFILE_TYPE, KEYFILE_VERSION, load_keyfile, write_keyfile
+from .keys import X25519KeyPair, generate_x25519_keypair
+from .protocol import (
+    HKDF_INFO_DROP_V1,
+    MAX_TTL_SECONDS,
+    MIN_TTL_SECONDS,
+    T2EM_PROTOCOL_VERSION,
+)
+
+__version__ = SDK_VERSION
+
+__all__ = [
+    "CreatedDrop",
+    "Envelope",
+    "HKDF_INFO_DROP_V1",
+    "KEYFILE_KIND",
+    "KEYFILE_TYPE",
+    "KEYFILE_VERSION",
+    "MAX_TTL_SECONDS",
+    "MIN_TTL_SECONDS",
+    "ModeAEnvelope",
+    "ModeBEnvelope",
+    "ProtocolError",
+    "HttpError",
+    "SDK_USER_AGENT",
+    "SDK_VERSION",
+    "ShareUrl",
+    "T2EM_PROTOCOL_VERSION",
+    "T2emClient",
+    "T2emError",
+    "UsageError",
+    "X25519KeyPair",
+    "b64u_decode",
+    "b64u_encode",
+    "fingerprint_pubkey",
+    "generate_fingerprint",
+    "generate_x25519_keypair",
+    "is_b64u_of_length",
+    "load_keyfile",
+    "pack_drop",
+    "unpack_drop",
+    "validate_envelope",
+    "write_keyfile",
+]

t2em-0.6.0/src/t2em/_meta.py

@@ -0,0 +1,8 @@
+"""SDK identity metadata — single source of the version string."""
+
+SDK_VERSION = "0.6.0"
+
+#: Identifying User-Agent (Cloudflare browser-integrity checks reject
+#: the bare `Python-urllib` default; the ecosystem is agent-friendly,
+#: so clients identify themselves — ТЗ §5.5, §8.6).
+SDK_USER_AGENT = f"t2em-python-sdk/{SDK_VERSION}"

t2em-0.6.0/src/t2em/base64url.py

@@ -0,0 +1,45 @@
+"""Base64URL helpers (RFC 4648 §5, no padding) — ТЗ §4.1.
+
+Strict mirror of `@t2em/protocol` `base64url.ts`: the same alphabet,
+the same rejection rules, so every wire string produced here is
+byte-identical to the TypeScript implementation.
+"""
+
+from __future__ import annotations
+
+import base64
+import re
+
+from .exceptions import ProtocolError
+
+_B64URL_ALPHABET = re.compile(r"^[A-Za-z0-9\-_]+$")
+
+
+def b64u_encode(data: bytes) -> str:
+    """Encode bytes to unpadded base64url."""
+    return base64.urlsafe_b64encode(data).decode("ascii").rstrip("=")
+
+
+def b64u_decode(text: str) -> bytes:
+    """Throwing strict decoder: rejects any non-base64url alphabet or padding."""
+    if not isinstance(text, str) or len(text) == 0:
+        raise ProtocolError("MALFORMED", "base64url string must be non-empty")
+    if not _B64URL_ALPHABET.match(text):
+        raise ProtocolError("MALFORMED", "not base64url (RFC 4648 §5, unpadded)")
+    if len(text) % 4 == 1:
+        raise ProtocolError("MALFORMED", "invalid base64url length")
+    pad = "=" * (-len(text) % 4)
+    try:
+        return base64.urlsafe_b64decode(text + pad)
+    except Exception as exc:  # binascii.Error and friends
+        raise ProtocolError("MALFORMED", f"invalid base64url: {exc}") from exc
+
+
+def is_b64u_of_length(text: object, byte_length: int) -> bool:
+    """True when `text` is valid base64url decoding to exactly `byte_length` bytes."""
+    if not isinstance(text, str):
+        return False
+    try:
+        return len(b64u_decode(text)) == byte_length
+    except ProtocolError:
+        return False