Provenance SDK details

Install It

The SDK is published, MIT licensed, and installable today. Browser and Workers use the WASM package; Node and Bun use the native binding; Rust consumers take the signed release from GitHub.

Packages: @drm3labs-oss/provenance and @drm3labs-oss/provenance-node on npm. Verify what you install: every release is signed, and the receipt is published beside the download.

How It Works

Say you have a workflow that fetches three search results, summarizes them with an AI prompt, then stores the output in a database. Each step signs over its inputs and outputs. The receipt from step 1 becomes the parent of step 2. The receipt from step 2 becomes the parent of step 3. A consumer who reads the database gets the final receipt and can walk the chain backward to verify every step.

const fetchKey = SigningKey.load('myapp/fetch');

const receipt = Receipt.create('search.fetch')
  .inputs({ query: 'morpheus AI inference', sources: 3 })
  .outputs({ results, _meta: { service: 'myapp', signer: 'myapp/fetch' } })
  .sign(fetchKey);
// receipt.id → rcpt_a1b2c3...

const aiKey = SigningKey.load('myapp/ai');

const summary = Receipt.create('ai.summarize')
  .inputs({ model: 'llama-3.3-70b', prompt_hash: '...' })
  .outputs({ summary: text, tokens: 847, _meta: { ... } })
  .parent(receipt.id())   // ← chains to the fetch receipt
  .sign(aiKey);

const storeKey = SigningKey.load('myapp/store');

const stored = Receipt.create('db.insert')
  .inputs({ table: 'summaries', row_id: 'sum_001' })
  .outputs({ row_hash: '...', _meta: { ... } })
  .parent(summary.id())  // ← chains to the AI receipt
  .sign(storeKey);

Three steps, three receipts, one chain. A consumer who reads the stored summary gets stored and can walk backward: store → summarize → fetch. Every step independently verifiable. The data stays with you. The receipts travel with it.

Merkle Rollup

When you sign thousands of entities (the signals pipeline signs 500+ per NASDAQ listings fetch), row-level receipts roll up into a Merkle tree. One tree root proves the entire batch. Prove any single entity without revealing the others.

// Build Merkle tree from row receipts
let chain = Chain.create();
for (const r of rowReceipts) {
  chain = chain.add(Receipt.fromJson(r));
}
const tree = chain.build();
const root = tree.merkleRoot();  // sha256:7a1f3e...

// Prove entity #42 is in the batch
const proof = tree.merkleProof(42);
proof.verify(rowReceipts[42].hash(), root);  // ✓

Verify Against the Registry

Every DRM3 signer is published. Fetch the public key registry, match the receipt's public_key to a known signer, and verify the Ed25519 signature yourself, right in your browser. Every key is public. Check any signature.

// Fetch the signer registry
const keys = await fetch('https://status.drm3.network/.well-known/drm3-keys.json');
const registry = await keys.json();

// Find the signer
const signer = registry.keys.find(k => k.public_key === receipt.public_key);
// → { path: "connor/worker", product: "Connor", algorithm: "Ed25519" }

// Verify the signature
const valid = Receipt.fromJson(receiptJson).verify();  // ✓ or throws