@drm3/sdk 0.1.2

package/dist/x402/index.js

@@ -0,0 +1,41 @@
+/**
+ * @drm3/sdk/x402 - the ONE shared DRM3 x402 payment gateway core.
+ *
+ * x402 agent micropayments (https://www.x402.org) - the "exact" scheme on Base.
+ * This is the studio model applied to x402: like one Stripe is one gateway for
+ * every checkout, this is one x402 gateway library for every DRM3 app. Every app
+ * (except MorScan, which stays its own animal with its own wallet + commerce
+ * seam) imports THIS to advertise a 402 and verify the signed EIP-3009 payment
+ * that follows, and every app points at the ONE shared DRM3 x402 gateway wallet
+ * (the funded `X402_PAY_TO`). The payTo, the price, and the storage (the replay
+ * gate / settlement ledger) are the caller's app-specific config; the crypto,
+ * the verification, and the 402 envelope live here, once.
+ *
+ * What this module is:
+ *  - the secp256k1 / keccak256 primitives (`keccak256`, `ecrecover`, hex helpers),
+ *  - the EIP-712 / EIP-3009 `TransferWithAuthorization` digest + full server-side
+ *    verification of an `X-PAYMENT` header (`verifyX402Payment`), and
+ *  - the spec-shaped 402 envelope + offers-menu builder (`x402Requirements`,
+ *    `x402Body`).
+ *
+ * What this module is NOT: it holds no signing key, touches no database, and
+ * broadcasts nothing on-chain. `verifyX402Payment` here is pure and synchronous
+ * (envelope structure, scheme/network, payTo, amount, validity window, and the
+ * EIP-712 signature recovering the payer). The nonce-replay gate, the per-payer
+ * abuse cap, and settlement are storage-specific and stay in the calling app
+ * (Newsboy runs them against Postgres, for example). The verification here is
+ * byte-identical to MorScan's reference implementation: DO NOT relax any check.
+ *
+ * Zero runtime deps beyond @noble; Workers, Bun, and Node.
+ *
+ * This file is a thin barrel: the implementation lives in sibling modules split
+ * by concern - `crypto.ts` (secp/keccak/hex), `chain.ts` (asset/chain config),
+ * `eip712.ts` (the TransferWithAuthorization digest), `envelope.ts` (the 402
+ * envelope), and `verify.ts` (X-PAYMENT decoding + verification).
+ */
+export { bytesToBigInt, bytesToHex, ecrecover, hexToBytes, keccak256 } from "./crypto.js";
+export { BASE_CHAIN_ID, BASE_NETWORK, DEFAULT_GRACE_SECONDS, DEFAULT_MAX_TIMEOUT_SECONDS, USDC_DOMAIN_NAME, USDC_DOMAIN_VERSION, X402_ASSET_USDC_BASE, } from "./chain.js";
+export { transferAuthDigest } from "./eip712.js";
+export { x402Body, x402Requirements, } from "./envelope.js";
+export { decodePaymentHeader, verifyX402Payment, } from "./verify.js";
+//# sourceMappingURL=index.js.map

package/dist/x402/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/x402/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAC1F,OAAO,EACL,aAAa,EACb,YAAY,EACZ,qBAAqB,EACrB,2BAA2B,EAC3B,gBAAgB,EAChB,mBAAmB,EACnB,oBAAoB,GAErB,MAAM,YAAY,CAAC;AACpB,OAAO,EAA0B,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACzE,OAAO,EAGL,QAAQ,EACR,gBAAgB,GACjB,MAAM,eAAe,CAAC;AACvB,OAAO,EAEL,mBAAmB,EAInB,iBAAiB,GAClB,MAAM,aAAa,CAAC"}

package/dist/x402/verify.d.ts

@@ -0,0 +1,51 @@
+/**
+ * @drm3/sdk/x402 - X-PAYMENT decoding + full server-side verification.
+ *
+ * `verifyX402Payment` is pure and synchronous: envelope structure,
+ * scheme/network, payTo, amount, validity window, and the EIP-712 signature
+ * recovering the payer. It holds no key, touches no database, and broadcasts
+ * nothing on-chain. The nonce-replay gate, per-payer cap, and settlement are
+ * storage-specific and stay in the calling app. Byte-identical to MorScan's
+ * reference implementation: DO NOT relax any check.
+ */
+import { type X402Authorization } from "./eip712.js";
+import type { X402GatewayConfig } from "./envelope.js";
+export interface X402Payment {
+    signature: string;
+    authorization: X402Authorization;
+}
+export interface DecodedPaymentHeader {
+    x402Version?: number;
+    scheme?: string;
+    network?: string;
+    payload?: X402Payment;
+}
+/** Decode the base64 X-PAYMENT header. Returns null when malformed. */
+export declare function decodePaymentHeader(header: string): DecodedPaymentHeader | null;
+export type X402VerifyResult = {
+    ok: true;
+    payment: X402Payment;
+    payer: string;
+} | {
+    ok: false;
+    error: string;
+};
+/** Config for `verifyX402Payment`: the gateway (payTo + price) plus optional chain overrides + grace. */
+export interface X402VerifyConfig extends X402GatewayConfig {
+    /** In-flight grace (seconds) subtracted from the near-expiry check. Default 6n. */
+    graceSeconds?: bigint;
+}
+/**
+ * Full CRYPTOGRAPHIC verification of an X-PAYMENT header: envelope structure,
+ * scheme/network, payTo, amount, validity window, and the EIP-712 signature
+ * recovering the payer. The signature is bound to the asset + chain by the
+ * EIP-712 domain (verifyingContract + chainId), so a signature for any other
+ * asset or chain cannot verify.
+ *
+ * This is pure and synchronous: it does NOT check nonce-replay or any per-payer
+ * cap - those are storage-specific and belong to the caller (run them against
+ * your ledger AFTER this returns `ok`, e.g. a UNIQUE(payer, nonce) gate). On
+ * success returns the decoded payment and the lowercase payer address.
+ */
+export declare function verifyX402Payment(header: string, config: X402VerifyConfig): X402VerifyResult;
+//# sourceMappingURL=verify.d.ts.map

package/dist/x402/verify.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../../src/x402/verify.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAIH,OAAO,EAAE,KAAK,iBAAiB,EAAsB,MAAM,aAAa,CAAC;AACzE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAIvD,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,iBAAiB,CAAC;CAClC;AAED,MAAM,WAAW,oBAAoB;IACnC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,WAAW,CAAC;CACvB;AAED,uEAAuE;AACvE,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,oBAAoB,GAAG,IAAI,CAQ/E;AAED,MAAM,MAAM,gBAAgB,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,WAAW,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEhH,yGAAyG;AACzG,MAAM,WAAW,gBAAiB,SAAQ,iBAAiB;IACzD,mFAAmF;IACnF,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,gBAAgB,GAAG,gBAAgB,CAoE5F"}

package/dist/x402/verify.js

@@ -0,0 +1,110 @@
+/**
+ * @drm3/sdk/x402 - X-PAYMENT decoding + full server-side verification.
+ *
+ * `verifyX402Payment` is pure and synchronous: envelope structure,
+ * scheme/network, payTo, amount, validity window, and the EIP-712 signature
+ * recovering the payer. It holds no key, touches no database, and broadcasts
+ * nothing on-chain. The nonce-replay gate, per-payer cap, and settlement are
+ * storage-specific and stay in the calling app. Byte-identical to MorScan's
+ * reference implementation: DO NOT relax any check.
+ */
+import { DEFAULT_GRACE_SECONDS, resolveChain } from "./chain.js";
+import { ecrecover } from "./crypto.js";
+import { transferAuthDigest } from "./eip712.js";
+/** Decode the base64 X-PAYMENT header. Returns null when malformed. */
+export function decodePaymentHeader(header) {
+    try {
+        const json = atob(header.trim());
+        const parsed = JSON.parse(json);
+        return parsed;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Full CRYPTOGRAPHIC verification of an X-PAYMENT header: envelope structure,
+ * scheme/network, payTo, amount, validity window, and the EIP-712 signature
+ * recovering the payer. The signature is bound to the asset + chain by the
+ * EIP-712 domain (verifyingContract + chainId), so a signature for any other
+ * asset or chain cannot verify.
+ *
+ * This is pure and synchronous: it does NOT check nonce-replay or any per-payer
+ * cap - those are storage-specific and belong to the caller (run them against
+ * your ledger AFTER this returns `ok`, e.g. a UNIQUE(payer, nonce) gate). On
+ * success returns the decoded payment and the lowercase payer address.
+ */
+export function verifyX402Payment(header, config) {
+    const chain = resolveChain(config);
+    const decoded = decodePaymentHeader(header);
+    if (!decoded || !decoded.payload?.authorization || !decoded.payload.signature) {
+        return {
+            ok: false,
+            error: "malformed X-PAYMENT header (expected base64 JSON with payload.signature + payload.authorization)",
+        };
+    }
+    if (decoded.x402Version !== 1)
+        return { ok: false, error: "unsupported x402Version (expected 1)" };
+    if (decoded.scheme !== "exact")
+        return { ok: false, error: "unsupported scheme (expected exact)" };
+    if (decoded.network !== chain.network)
+        return { ok: false, error: `unsupported network (expected ${chain.network})` };
+    const p = decoded.payload;
+    const a = p.authorization;
+    const isAddr = (s) => /^0x[0-9a-fA-F]{40}$/.test(s || "");
+    if (!isAddr(a.from) || !isAddr(a.to))
+        return { ok: false, error: "invalid from/to address" };
+    if (!/^0x[0-9a-fA-F]{64}$/.test(a.nonce || ""))
+        return { ok: false, error: "invalid nonce (expected bytes32 hex)" };
+    // payTo must be OUR configured address.
+    if (a.to.toLowerCase() !== config.payTo.toLowerCase()) {
+        return { ok: false, error: "authorization.to does not match required payTo" };
+    }
+    // Amount: the exact scheme pays the advertised price.
+    let value;
+    try {
+        value = BigInt(a.value);
+    }
+    catch {
+        return { ok: false, error: "invalid value" };
+    }
+    if (value < config.priceAtomic) {
+        return {
+            ok: false,
+            error: `insufficient amount: ${value} < required ${config.priceAtomic} (atomic units)`,
+        };
+    }
+    // Validity window (unix seconds), with a small grace so the authorization
+    // does not expire while the request is in flight.
+    const grace = config.graceSeconds ?? DEFAULT_GRACE_SECONDS;
+    const now = BigInt(Math.floor(Date.now() / 1000));
+    let validAfter;
+    let validBefore;
+    try {
+        validAfter = BigInt(a.validAfter);
+        validBefore = BigInt(a.validBefore);
+    }
+    catch {
+        return { ok: false, error: "invalid validity window" };
+    }
+    if (now < validAfter)
+        return { ok: false, error: "authorization not yet valid (validAfter in the future)" };
+    if (now + grace > validBefore)
+        return { ok: false, error: "authorization expired (validBefore too soon)" };
+    // EIP-712 signature must recover the payer.
+    let recovered;
+    try {
+        recovered = ecrecover(transferAuthDigest(a, chain), p.signature);
+    }
+    catch (e) {
+        return {
+            ok: false,
+            error: `signature verification failed: ${e instanceof Error ? e.message : e}`,
+        };
+    }
+    if (recovered.toLowerCase() !== a.from.toLowerCase()) {
+        return { ok: false, error: "signature does not recover authorization.from" };
+    }
+    return { ok: true, payment: p, payer: a.from.toLowerCase() };
+}
+//# sourceMappingURL=verify.js.map

package/dist/x402/verify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.js","sourceRoot":"","sources":["../../src/x402/verify.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,qBAAqB,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AACjE,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAA0B,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAiBzE,uEAAuE;AACvE,MAAM,UAAU,mBAAmB,CAAC,MAAc;IAChD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QACjC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAA4B,CAAC;QAC3D,OAAO,MAA8B,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAUD;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAc,EAAE,MAAwB;IACxE,MAAM,KAAK,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;IACnC,MAAM,OAAO,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAC5C,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,aAAa,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;QAC9E,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,kGAAkG;SAC1G,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,WAAW,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,sCAAsC,EAAE,CAAC;IACnG,IAAI,OAAO,CAAC,MAAM,KAAK,OAAO;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,qCAAqC,EAAE,CAAC;IACnG,IAAI,OAAO,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,iCAAiC,KAAK,CAAC,OAAO,GAAG,EAAE,CAAC;IAEtH,MAAM,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC;IAC1B,MAAM,CAAC,GAAG,CAAC,CAAC,aAAa,CAAC;IAC1B,MAAM,MAAM,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAClE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC;IAC7F,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,sCAAsC,EAAE,CAAC;IAEpH,wCAAwC;IACxC,IAAI,CAAC,CAAC,EAAE,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;QACtD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,gDAAgD,EAAE,CAAC;IAChF,CAAC;IAED,sDAAsD;IACtD,IAAI,KAAa,CAAC;IAClB,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC;IAC/C,CAAC;IACD,IAAI,KAAK,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;QAC/B,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,wBAAwB,KAAK,eAAe,MAAM,CAAC,WAAW,iBAAiB;SACvF,CAAC;IACJ,CAAC;IAED,0EAA0E;IAC1E,kDAAkD;IAClD,MAAM,KAAK,GAAG,MAAM,CAAC,YAAY,IAAI,qBAAqB,CAAC;IAC3D,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC;IAClD,IAAI,UAAkB,CAAC;IACvB,IAAI,WAAmB,CAAC;IACxB,IAAI,CAAC;QACH,UAAU,GAAG,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;QAClC,WAAW,GAAG,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC;IACzD,CAAC;IACD,IAAI,GAAG,GAAG,UAAU;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,wDAAwD,EAAE,CAAC;IAC5G,IAAI,GAAG,GAAG,KAAK,GAAG,WAAW;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,8CAA8C,EAAE,CAAC;IAE3G,4CAA4C;IAC5C,IAAI,SAAiB,CAAC;IACtB,IAAI,CAAC;QACH,SAAS,GAAG,SAAS,CAAC,kBAAkB,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC;IACnE,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,kCAAkC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE;SAC9E,CAAC;IACJ,CAAC;IACD,IAAI,SAAS,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;QACrD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,+CAA+C,EAAE,CAAC;IAC/E,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;AAC/D,CAAC"}

package/package.json

@@ -0,0 +1,100 @@
+{
+  "name": "@drm3/sdk",
+  "version": "0.1.2",
+  "license": "SEE LICENSE IN LICENSE",
+  "description": "The DRM3 network SDK. One package to integrate an app or agent with DRM3: identity (offline SSO verify), the user's credit balance, a cross-app switcher, cross-app alerts, an in-browser receipt viewer, partner key management, the x402 payment gateway core, and a non-custodial metering ledger. Ships the `drm3` CLI. Workers, Bun, Node.",
+  "type": "module",
+  "sideEffects": false,
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "bin": {
+    "drm3": "./bin/drm3.js"
+  },
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./sso": {
+      "types": "./dist/sso/index.d.ts",
+      "default": "./dist/sso/index.js"
+    },
+    "./x402": {
+      "types": "./dist/x402/index.d.ts",
+      "default": "./dist/x402/index.js"
+    },
+    "./meter": {
+      "types": "./dist/meter/index.d.ts",
+      "default": "./dist/meter/index.js"
+    },
+    "./switcher": {
+      "types": "./dist/switcher.d.ts",
+      "default": "./dist/switcher.js"
+    },
+    "./receipts": {
+      "types": "./dist/receipts.d.ts",
+      "default": "./dist/receipts.js"
+    },
+    "./receipts/global": "./dist/receipts.global.js",
+    "./receipts/global-text": "./dist/receipts.global.text.js",
+    "./alerts": {
+      "types": "./dist/alerts.d.ts",
+      "default": "./dist/alerts.js"
+    },
+    "./alerts/global": "./dist/alerts.global.js",
+    "./alerts/global-text": "./dist/alerts.global.text.js",
+    "./keys": {
+      "types": "./dist/keys.d.ts",
+      "default": "./dist/keys.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "dist",
+    "bin",
+    "README.md",
+    "LICENSE"
+  ],
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json && npm run build:browser",
+    "build:browser": "esbuild src/receipts.ts --bundle --format=iife --global-name=drm3Receipts --outfile=dist/receipts.global.js --target=es2022 && esbuild src/alerts.ts --bundle --format=iife --global-name=drm3Alerts --outfile=dist/alerts.global.js --target=es2022 && node scripts/wrap-text.mjs",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run",
+    "lint": "biome check src test",
+    "format": "biome check --write src test",
+    "prepublishOnly": "npm run build"
+  },
+  "dependencies": {
+    "@noble/curves": "^2.2.0",
+    "@noble/hashes": "^2.2.0"
+  },
+  "devDependencies": {
+    "@biomejs/biome": "^1.9.4",
+    "@electric-sql/pglite": "^0.5.2",
+    "@types/node": "^22.19.21",
+    "@vitest/coverage-v8": "^2.1.9",
+    "esbuild": "^0.25.0",
+    "fast-check": "^3.0.0",
+    "happy-dom": "^15.11.7",
+    "typescript": "^5.3.0",
+    "vitest": "^2.0.0"
+  },
+  "engines": {
+    "node": ">=20"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/DRM3Labs-OSS/drm3-sdk.git"
+  },
+  "homepage": "https://drm3.network",
+  "keywords": [
+    "drm3",
+    "sso",
+    "x402",
+    "metering",
+    "provenance",
+    "receipts",
+    "agents",
+    "cloudflare-workers"
+  ]
+}