Metadata-Version: 2.4
Name: bluefox-edge
Version: 0.0.3
Summary: BlueFox Edge for Python: today, the published offline receipt checker as an installable module; the API client follows.
Author-email: BlueFox AI <ethan@bluefoxedge.ai>
License: MIT
Project-URL: Homepage, https://www.bluefoxedge.ai
Project-URL: Documentation, https://www.bluefoxedge.ai/docs/sdk/python
Project-URL: Verify a receipt, https://www.bluefoxedge.ai/docs/verify-a-receipt
Project-URL: Published checker, https://api.bluefoxedge.ai/verify_receipt.py
Project-URL: Contact, https://www.bluefoxedge.ai/contact
Project-URL: Security, https://www.bluefoxedge.ai/.well-known/security.txt
Keywords: bluefox,receipt,verification,ed25519,rfc8785,jcs,offline,agents
Classifier: Development Status :: 2 - Pre-Alpha
Classifier: Intended Audience :: Developers
Classifier: License :: OSI Approved :: MIT License
Classifier: Programming Language :: Python :: 3
Classifier: Programming Language :: Python :: 3 :: Only
Classifier: Operating System :: OS Independent
Classifier: Topic :: Security :: Cryptography
Requires-Python: >=3.8
Description-Content-Type: text/markdown
License-File: LICENSE
Dynamic: license-file

# bluefox-edge (Python)

**0.0.3 — re-vendored from the street.** It installs the published BlueFox Edge
offline receipt checker so you can pin it with pip instead of fetching a file:

```bash
pip install bluefox-edge
bluefox-edge-verify-receipt my-receipt.json
```

That command runs the exact bytes the street served at
<https://api.bluefoxedge.ai/verify_receipt.py> on 2026-09-15 (sha256 `239c3634…f1337`,
42,797 B — the bytes it has served since the API's 2026-09-14 deploy). The served copy may
move ahead of this package again — compare <https://api.bluefoxedge.ai/verify_receipt.py.sha256>
with `bluefox_edge.checker_sha256()` any time. Same steps, same order, same one-sentence
verdicts; every passing run prints the ten `NOT VERIFIED by this run` lines before the pass
sentence, and `--bind-record my-record.json` also checks that the receipt names your record.
Exit 0 means the check passed.

## What it checks

A BlueFox Edge receipt is a signed record of one API answer: the envelope is
canonicalized (RFC 8785 / JCS), hashed (SHA-256), chained, and signed (Ed25519) with a
published key. The checker recomputes every signed field from the file's own bytes and
refuses — in a sentence, never a traceback — on any disagreement. It reads the key set
from the published JWKS, or fully offline from a file you saved:

```bash
curl -sSo pinned-jwks.json https://api.bluefoxedge.ai/.well-known/jwks.json
bluefox-edge-verify-receipt --jwks pinned-jwks.json my-receipt.json
```

The receipt never names its own key source; the `--jwks` flag is the operator's hand.
How to read what a receipt does and does not say: <https://www.bluefoxedge.ai/docs/verify-a-receipt>.

## What is coming

The BlueFox Edge API client for Python (`BlueFoxClient`, sync and async) is written and
tested in the repository at version 0.6.0. It arrives on PyPI under this name once its
handling of the keyless x402 payment quote (HTTP 402) is cured — until then a 0.0.x
release does not talk to the API for you. Docs: <https://www.bluefoxedge.ai/docs/sdk/python>.

## Why a 0.0.x at all

The repository's docs and both SDK READMEs already print
`pip install bluefox-edge`. Publishing a real, working checker under the name closes
the gap between what the docs say and what the registry has, without pretending the
client is here.

## Also on npm

The JavaScript twin of the checker is `npx bluefox-verify-receipt`, and `bluefox-edge`
on npm re-exports it.

## What changed since 0.0.1

- **0.0.3 (this release).** The vendored checker is re-vendored from the street. 0.0.1 shipped
  the bytes served on 2026-09-12 (sha256 `50dd2124…711d8`, 24,801 B); the API's 2026-09-14 deploy
  moved the served file to `239c3634…f1337` (42,797 B), which prints what a run did not verify
  and takes `--bind-record`. 0.0.3 ships those served bytes, so `bluefox_edge.checker_sha256()`
  and the street's `.sha256` agree again on the day of release. The command's usage line names
  `--bind-record`. Nothing else changes.
- **0.0.2 (staged 2026-09-13, never reached PyPI; its changes ride here).** The 0.0.1 bytes
  carried an internal review banner in this README and in the `bluefox_edge` module docstring,
  and their repository metadata pointed at a private repository that answers 404 to anyone
  outside the house. Both are gone; `Contact` and `Security` project URLs are present.

License: MIT. Author: BlueFox AI (Format Dynamics, Inc.). Questions and issues:
<support@bluefoxedge.ai> · <https://www.bluefoxedge.ai/contact> · security reports per
<https://www.bluefoxedge.ai/.well-known/security.txt>.
