Metadata-Version: 2.4
Name: zerobyte
Version: 1.0.0
Summary: Python SDK for 0byte — the origin protocol for AI content
Author: 0byte
License: MIT
Project-URL: Homepage, https://0byte.tech
Project-URL: Source, https://github.com/0byte-lab/0byte
Keywords: ai,provenance,verification,content-authenticity,fingerprint
Requires-Python: >=3.9
Description-Content-Type: text/markdown
License-File: LICENSE
Requires-Dist: httpx>=0.24
Dynamic: license-file

# 0byte Python SDK

The official Python SDK for **0byte** — the origin protocol for AI content.

A thin wrapper over the REST API (the OpenAPI contract is served at
`GET /v1/openapi.yaml`). Any language can integrate with plain HTTP — this
package is convenience, never a requirement.

## What It Does

- **Stamps** AI-generated content: a signed C2PA manifest embedded in the
  file (Content Credentials) plus a perceptual fingerprint anchored in a
  public, append-only transparency log — proof that survives screenshots,
  re-encoding, and stripped metadata
- **Verifies** any content, evidence-first: manifests + registry, one
  verdict with cited evidence — never a probability

## Installation

```bash
pip install zerobyte
```

## Quickstart

```python
from zerobyte import Client

client = Client(api_key="0b_key_...")

# Stamp AI-generated content — with your brand on it
result = client.stamp(
    content=image_bytes,
    content_type="image/png",
    provider="acme-ai",
    model="imagen-x",
    creator={"name": "Acme Studios", "url": "https://acme.example"},
)

print(result.binding)     # "manifest+registry" — always disclosed
print(result.verify_url)  # public proof page

# Publish the stamped file — IT carries the Content Credentials:
if result.stamped_bytes:
    open("out.png", "wb").write(result.stamped_bytes)

# Verify any content — free, no API key needed
check = Client().verify(content=some_image_bytes)
print(check.verdict)         # verified_origin | provenance_untrusted |
                             # provenance_invalid | no_provenance_found
print(check.origin_sources)  # which signals prove it: ["registry", "manifest"]
print(check.evidence)        # per-signal detail, statuses always disclosed
```

## Fetch the proof material

Every proof is anchored in an RFC 6962-style transparency log, and the SDK
fetches everything an independent verifier needs:

```python
head = client.get_tree_head()               # signed root (Ed25519)
proof = client.get_inclusion_proof("0b_…")  # Merkle audit path + signed head
keys = client.get_signing_keys()            # every key that ever signed
```

Fetching is not verifying: to check the math yourself, recompute the Merkle
inclusion path (RFC 9162 §2.1.3.2) against `root_hash` and verify the
Ed25519 signature over `sth:v1:{key_id}:{tree_size}:{root_hash}` with the
matching public key. The SDK deliberately ships no crypto — a worked
~20-line verifier example lives in the docs at https://0byte.tech/docs.

## Signing in from a terminal

Instead of copying a key out of a web page, pair the terminal with your account:

```bash
zerobyte login
```

It prints a URL and an eight-character code, opens your browser, and waits. Sign
in, check that the code on the page matches the one in your terminal, and approve.
The key is written to `~/.0byte/credentials` with mode `0600` — never printed, so
it does not end up in scrollback or a screenshare.

```text
Open this URL to authorize:  https://0byte.tech/cli?code=DK5X-88T7
Code: DK5X-88T7
Waiting for approval...
Signed in. Key saved to /Users/you/.0byte/credentials
```

Options:

- `--endpoint <url>` — point at another environment (or set `ZEROBYTE_ENDPOINT`).
- `--no-browser` — print the URL instead of opening it. Useful over SSH.

Comparing the code is the point, not a formality: it is what stops someone else
starting a pairing and talking you into approving *their* terminal. Nothing is
authorized by opening the URL — only by pressing the button.

The key appears in your account as `CLI login` and can be revoked like any other.
