Metadata-Version: 2.4
Name: bluefox-verify-receipt
Version: 0.0.1
Summary: The BlueFox Edge offline receipt checker as a pip-installable package: the exact published bytes, one command, no client, no account.
Author-email: BlueFox AI <ethan@bluefoxedge.ai>
License: MIT
Project-URL: Homepage, https://www.bluefoxedge.ai
Project-URL: Verify a receipt, https://www.bluefoxedge.ai/docs/verify-a-receipt
Project-URL: Published checker, https://api.bluefoxedge.ai/verify_receipt.py
Project-URL: npm twin, https://www.npmjs.com/package/bluefox-verify-receipt
Keywords: bluefox,receipt,verification,ed25519,rfc8785,jcs,offline,agents
Classifier: Development Status :: 2 - Pre-Alpha
Classifier: Intended Audience :: Developers
Classifier: License :: OSI Approved :: MIT License
Classifier: Programming Language :: Python :: 3
Classifier: Programming Language :: Python :: 3 :: Only
Classifier: Operating System :: OS Independent
Classifier: Topic :: Security :: Cryptography
Requires-Python: >=3.8
Description-Content-Type: text/markdown
License-File: LICENSE
Dynamic: license-file

<!-- DRAFT-FOR-CEO-REVIEW · staged dark by jj115 (SS115/D009), re-cut from ff115's bluefox-edge stub · NOT PUBLISHED · every sentence below is proposed public text -->
# bluefox-verify-receipt (Python)

**0.0.1 — the Python twin of the npm checker, installable.** This is the BlueFox Edge
offline receipt checker — the exact bytes served at
<https://api.bluefoxedge.ai/verify_receipt.py> (sha256 `50dd2124…711d8`, 24,801 B; compare
with <https://api.bluefoxedge.ai/verify_receipt.py.sha256> any time) — as a package you can
pin with pip, with one command on PATH:

```bash
pip install bluefox-verify-receipt
bluefox-verify-receipt my-receipt.json
```

Same steps, same order, same one-sentence verdicts as `npx bluefox-verify-receipt` on npm.
Exit 0 means the check passed.

## What it checks

A BlueFox Edge receipt is a signed record of one API answer: the envelope is
canonicalized (RFC 8785 / JCS), hashed (SHA-256), chained, and signed (Ed25519) with a
published key. The checker recomputes every signed field from the file's own bytes and
refuses — in a sentence, never a traceback — on any disagreement. It reads the key set
from the published JWKS, or fully offline from a file you saved:

```bash
curl -sSo pinned-jwks.json https://api.bluefoxedge.ai/.well-known/jwks.json
bluefox-verify-receipt --jwks pinned-jwks.json my-receipt.json
```

The receipt never names its own key source; the `--jwks` flag is the operator's hand.
How to read what a receipt does and does not say: <https://www.bluefoxedge.ai/docs/verify-a-receipt>.

## Relation to `bluefox-edge`

`bluefox-edge` on PyPI ships this same checker under the SDK name and grows the API
client at 0.6+. This package stays what it is: the checker — one file, no client, no
account. Pick this one when all you need is to check a receipt.

License: MIT. Author: BlueFox AI (Format Dynamics, Inc.).
