space-data-module-sdk 0.3.1 → 0.5.3

package/README.md

@@ -12,7 +12,7 @@ This repository is the source of truth for module-level concerns:
 - standards-aware compliance and capability validation
 - module compilation and protection
 - the `sds.bundle` single-file custom section
-- deployment authorization and encrypted transport envelopes
+- deployment authorization plus SDS publication records (`REC`, `PNM`, `ENC`)
 - the first canonical module hostcall/import ABI surface
 
 <p align="center">
@@ -36,9 +36,11 @@ A module built with this SDK is a `.wasm` artifact with:
   - manifest bytes
   - resolved deployment plans and input bindings
   - deployment authorization
-  - detached signatures
-  - encrypted transport envelopes
   - auxiliary FlatBuffer or raw payloads
+- optional appended SDS `REC` publication trailers carrying:
+  - `PNM` digital-signature/publication metadata
+  - `ENC` encrypted-delivery metadata
+- auxiliary FlatBuffer or raw payloads
 
 The module contract stays the same whether the artifact is loaded directly,
 wrapped in a deployment envelope, or shipped as one bundled `.wasm` file.
@@ -240,8 +242,11 @@ The full contract split is documented in
 ## Single-File Bundles
 
 `sds.bundle` keeps module delivery to one file without changing WebAssembly
-loadability. The SDK appends a standard custom section, not raw trailer bytes,
-so the bundled artifact still compiles as a normal `.wasm` module.
+loadability for the runtime payload itself. The SDK writes the bundle as a
+standard custom section inside the wasm module and, when the artifact is
+signed or encrypted for publication, appends an SDS `REC` trailer after the
+wasm bytes. Loaders must scan and strip that trailer before handing bytes to a
+runtime such as WasmEdge.
 
 The reference path lives in
 [`examples/single-file-bundle`](./examples/single-file-bundle):
@@ -263,8 +268,9 @@ publication descriptor. That descriptor covers:
 
 - standalone module packages
 - attached module artifacts shipped inside another language library
-- discovery of bundled wasm, sidecar signatures, and encrypted transport
-  FlatBuffers
+- discovery of bundled wasm
+- appended `REC` trailers carrying `PNM` and optional `ENC`
+- sidecar `PNM` / `ENC` FlatBuffers when a package does not embed the trailer
 
 The full standard is in
 [`docs/module-publication-standard.md`](./docs/module-publication-standard.md),
@@ -280,8 +286,10 @@ For npm packages, the simplest form is:
 }
 ```
 
-When signature or transport metadata is published in the same file, it belongs
-inside `sds.bundle`, not as raw bytes after the end of the wasm binary.
+When publication metadata is published in the same file, it belongs in an
+appended SDS `REC` trailer. Loaders scan from the end of the protected blob,
+resolve `PNM` / `ENC`, strip or decrypt as needed, and only then instantiate
+the remaining raw wasm bytes.
 
 ## Host ABI
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "space-data-module-sdk",
-  "version": "0.3.1",
+  "version": "0.5.3",
   "description": "Module SDK for building, validating, signing, and deploying WebAssembly modules on the Space Data Network.",
   "type": "module",
   "types": "./src/index.d.ts",
@@ -12,8 +12,16 @@
     "space-data-module": "bin/space-data-module.js"
   },
   "exports": {
-    ".": "./src/index.js",
-    "./manifest": "./src/manifest/index.js",
+    ".": {
+      "browser": "./src/browser.js",
+      "default": "./src/index.js"
+    },
+    "./manifest": {
+      "browser": "./src/manifest/browser.js",
+      "default": "./src/manifest/index.js"
+    },
+    "./embedded-manifest": "./src/embeddedManifest.js",
+    "./capabilities": "./src/capabilities.js",
     "./compliance": "./src/compliance/index.js",
     "./auth": "./src/auth/index.js",
     "./transport": "./src/transport/index.js",
@@ -46,7 +54,7 @@
     "flatbuffers": "^25.9.23",
     "hd-wallet-wasm": "1.6.0",
     "sdn-emception": "1.0.0",
-    "spacedatastandards.org": "23.3.3-0.3.4"
+    "spacedatastandards.org": "git+https://github.com/DigitalArsenal/spacedatastandards.org.git#09af351a1"
   },
   "devDependencies": {
     "express": "^4.21.2",

package/src/browser.js

@@ -0,0 +1,8 @@
+export * from "./manifest/browser.js";
+export * from "./auth/index.js";
+export * from "./transport/index.js";
+export * from "./bundle/index.js";
+export * from "./capabilities.js";
+export * from "./deployment/index.js";
+export * from "./invoke/index.js";
+export * from "./runtime/index.js";

package/src/bundle/constants.js

@@ -9,3 +9,8 @@ export const SDS_DEPLOYMENT_SECTION_NAME = "sds.deployment";
 export const SDS_DEPLOYMENT_ENTRY_ID = "deployment-plan";
 export const SDS_DEPLOYMENT_MEDIA_TYPE =
   "application/vnd.space-data.module.deployment+json";
+export const SDS_GUEST_LINK_OBJECT_ENTRY_ID = "guest-link-object";
+export const SDS_GUEST_LINK_METADATA_ENTRY_ID = "guest-link-metadata";
+export const SDS_GUEST_LINK_SECTION_NAME = "sds.guest-link";
+export const SDS_GUEST_LINK_MEDIA_TYPE =
+  "application/vnd.space-data.module.guest-link+json";

package/src/bundle/wasm.js

@@ -20,6 +20,7 @@ import {
   moduleBundleEncodingToName,
   moduleBundleRoleToName,
 } from "./codec.js";
+import { extractPublicationRecordCollection } from "../transport/records.js";
 
 const textDecoder = new TextDecoder();
 const textEncoder = new TextEncoder();
@@ -86,7 +87,11 @@ export function decodeUnsignedLeb128(bytes, offset = 0) {
 }
 
 export function parseWasmModuleSections(bytes) {
-  const wasmBytes = normalizeBytes(bytes, "wasm bytes");
+  const protectedArtifact = extractPublicationRecordCollection(bytes);
+  const wasmBytes = normalizeBytes(
+    protectedArtifact?.payloadBytes ?? bytes,
+    "wasm bytes",
+  );
   if (wasmBytes.length < 8) {
     throw new Error("WASM module is truncated.");
   }
@@ -345,10 +350,12 @@ export async function computeCanonicalModuleHash(
   bytes,
   options = {},
 ) {
+  const protectedArtifact = extractPublicationRecordCollection(bytes);
+  const candidateBytes = protectedArtifact?.payloadBytes ?? bytes;
   const prefix = String(
     options.customSectionPrefix ?? SDS_CUSTOM_SECTION_PREFIX,
   );
-  const canonicalWasmBytes = stripWasmCustomSections(bytes, (section) =>
+  const canonicalWasmBytes = stripWasmCustomSections(candidateBytes, (section) =>
     section.name.startsWith(prefix),
   );
   const hashBytes = await sha256Bytes(canonicalWasmBytes);
@@ -360,7 +367,11 @@ export async function computeCanonicalModuleHash(
 }
 
 export async function createSingleFileBundle(options = {}) {
-  const wasmBytes = normalizeBytes(options.wasmBytes, "wasmBytes");
+  const protectedArtifact = extractPublicationRecordCollection(options.wasmBytes);
+  const wasmBytes = normalizeBytes(
+    protectedArtifact?.payloadBytes ?? options.wasmBytes,
+    "wasmBytes",
+  );
   const manifestBytes =
     options.manifestBytes !== undefined
       ? normalizeBytes(options.manifestBytes, "manifestBytes")
@@ -422,7 +433,11 @@ export async function createSingleFileBundle(options = {}) {
 }
 
 export async function parseSingleFileBundle(bytes, options = {}) {
-  const wasmBytes = normalizeBytes(bytes, "wasm bytes");
+  const protectedArtifact = extractPublicationRecordCollection(bytes);
+  const wasmBytes = normalizeBytes(
+    protectedArtifact?.payloadBytes ?? bytes,
+    "wasm bytes",
+  );
   const customSections = listWasmCustomSections(wasmBytes);
   const bundleSectionName = String(
     options.bundleSectionName ?? SDS_BUNDLE_SECTION_NAME,
@@ -462,6 +477,8 @@ export async function parseSingleFileBundle(bytes, options = {}) {
     ) ?? null;
   return {
     wasmBytes,
+    protectedArtifactBytes: protectedArtifact?.protectedBytes ?? null,
+    publicationRecords: protectedArtifact ?? null,
     bundleBytes,
     bundle,
     entries: parsedEntries,

package/src/capabilities.js

@@ -0,0 +1,46 @@
+export const RecommendedCapabilityIds = Object.freeze([
+  "clock",
+  "random",
+  "logging",
+  "timers",
+  "schedule_cron",
+  "http",
+  "tls",
+  "websocket",
+  "mqtt",
+  "tcp",
+  "udp",
+  "network",
+  "filesystem",
+  "pipe",
+  "pubsub",
+  "protocol_handle",
+  "protocol_dial",
+  "database",
+  "storage_adapter",
+  "storage_query",
+  "storage_write",
+  "context_read",
+  "context_write",
+  "process_exec",
+  "crypto_hash",
+  "crypto_sign",
+  "crypto_verify",
+  "crypto_encrypt",
+  "crypto_decrypt",
+  "crypto_key_agreement",
+  "crypto_kdf",
+  "wallet_sign",
+  "ipfs",
+  "scene_access",
+  "entity_access",
+  "render_hooks",
+]);
+
+export const StandaloneWasiCapabilityIds = Object.freeze([
+  "logging",
+  "clock",
+  "random",
+  "filesystem",
+  "pipe",
+]);

package/src/compiler/compileModule.js

@@ -26,10 +26,25 @@ import { runWithEmceptionLock } from "./emceptionNode.js";
 import { encodePluginManifest, toEmbeddedPluginManifest } from "../manifest/index.js";
 import { DefaultInvokeExports, InvokeSurface } from "../runtime/constants.js";
 import {
-  encryptJsonForRecipient,
+  appendPublicationRecordCollection,
+  createEncryptedEnvelopePayload,
+  createPublicationNotice,
+  encodePublicationRecordCollection,
+  encryptBytesForRecipient,
+  extractPublicationRecordCollection,
   generateX25519Keypair,
 } from "../transport/index.js";
 import { createSingleFileBundle } from "../bundle/index.js";
+import {
+  SDS_GUEST_LINK_MEDIA_TYPE,
+  SDS_GUEST_LINK_METADATA_ENTRY_ID,
+  SDS_GUEST_LINK_OBJECT_ENTRY_ID,
+  SDS_GUEST_LINK_SECTION_NAME,
+} from "../bundle/constants.js";
+import {
+  decodeUnsignedLeb128,
+  parseWasmModuleSections,
+} from "../bundle/wasm.js";
 import {
   base64ToBytes,
   bytesToBase64,
@@ -76,6 +91,201 @@ function buildCompilerArgs(exportedSymbols, options = {}) {
   return args;
 }
 
+function guestLinkSymbolPrefix(pluginId) {
+  const normalized = String(pluginId ?? "module");
+  const ascii = Array.from(new TextEncoder().encode(normalized))
+    .map((byte) => byte.toString(16).padStart(2, "0"))
+    .join("")
+    .slice(0, 24);
+  return `sdm_guest_${ascii}_`;
+}
+
+function parseStrongDefinedIdentifiers(nmOutput = "") {
+  const identifiers = new Set();
+  for (const line of String(nmOutput).split(/\r?\n/)) {
+    const match = line.match(/^\S+\s+([A-Za-z])\s+(.+)$/);
+    if (!match) {
+      continue;
+    }
+    const symbolType = match[1];
+    if (!"TDBCGRSV".includes(symbolType)) {
+      continue;
+    }
+    const demangled = match[2].trim();
+    const baseName = demangled
+      .replace(/\(.*$/, "")
+      .split("::")
+      .at(-1)
+      ?.trim();
+    if (!C_IDENTIFIER.test(baseName ?? "")) {
+      continue;
+    }
+    identifiers.add(baseName);
+  }
+  return Array.from(identifiers).sort();
+}
+
+const WASM_SYM_BINDING_WEAK = 0x01;
+const WASM_SYM_BINDING_LOCAL = 0x02;
+const WASM_SYM_UNDEFINED = 0x10;
+const WASM_SYM_EXPLICIT_NAME = 0x40;
+const WASM_SYMBOL_KIND_FUNCTION = 0;
+const WASM_SYMBOL_KIND_DATA = 1;
+const WASM_SYMBOL_KIND_GLOBAL = 2;
+const WASM_SYMBOL_KIND_SECTION = 3;
+const WASM_SYMBOL_KIND_EVENT = 4;
+const WASM_SYMBOL_KIND_TABLE = 5;
+const LINKING_SYMBOL_TABLE_SUBSECTION_ID = 8;
+const textDecoder = new TextDecoder();
+
+function decodeWasmName(bytes, offset) {
+  const lengthInfo = decodeUnsignedLeb128(bytes, offset);
+  const nameStart = lengthInfo.nextOffset;
+  const nameEnd = nameStart + lengthInfo.value;
+  if (nameEnd > bytes.length) {
+    throw new Error("WASM name extends past end of symbol payload.");
+  }
+  return {
+    value: textDecoder.decode(bytes.subarray(nameStart, nameEnd)),
+    nextOffset: nameEnd,
+  };
+}
+
+function parseDefinedLinkSymbolsFromObjectBytes(objectBytes) {
+  const parsed = parseWasmModuleSections(objectBytes);
+  const linkingSection = parsed.sections.find(
+    (section) => section.id === 0 && section.name === "linking",
+  );
+  if (!linkingSection) {
+    throw new Error("Guest-link object is missing a linking custom section.");
+  }
+  const payload = linkingSection.dataBytes;
+  let offset = decodeUnsignedLeb128(payload, 0).nextOffset;
+  const identifiers = new Set();
+  while (offset < payload.length) {
+    const subsectionId = payload[offset++];
+    const sizeInfo = decodeUnsignedLeb128(payload, offset);
+    offset = sizeInfo.nextOffset;
+    const subsectionEnd = offset + sizeInfo.value;
+    if (subsectionEnd > payload.length) {
+      throw new Error("Linking subsection extends past end of payload.");
+    }
+    if (subsectionId !== LINKING_SYMBOL_TABLE_SUBSECTION_ID) {
+      offset = subsectionEnd;
+      continue;
+    }
+    let cursor = offset;
+    const countInfo = decodeUnsignedLeb128(payload, cursor);
+    cursor = countInfo.nextOffset;
+    for (let symbolIndex = 0; symbolIndex < countInfo.value; symbolIndex += 1) {
+      const kind = payload[cursor++];
+      const flagsInfo = decodeUnsignedLeb128(payload, cursor);
+      const flags = flagsInfo.value;
+      cursor = flagsInfo.nextOffset;
+      let name = "";
+      if (
+        kind === WASM_SYMBOL_KIND_FUNCTION ||
+        kind === WASM_SYMBOL_KIND_GLOBAL ||
+        kind === WASM_SYMBOL_KIND_EVENT ||
+        kind === WASM_SYMBOL_KIND_TABLE
+      ) {
+        cursor = decodeUnsignedLeb128(payload, cursor).nextOffset;
+        if (
+          (flags & WASM_SYM_UNDEFINED) === 0 ||
+          (flags & WASM_SYM_EXPLICIT_NAME) !== 0
+        ) {
+          const nameInfo = decodeWasmName(payload, cursor);
+          name = nameInfo.value;
+          cursor = nameInfo.nextOffset;
+        }
+      } else if (kind === WASM_SYMBOL_KIND_DATA) {
+        const nameInfo = decodeWasmName(payload, cursor);
+        name = nameInfo.value;
+        cursor = nameInfo.nextOffset;
+        if ((flags & WASM_SYM_UNDEFINED) === 0) {
+          cursor = decodeUnsignedLeb128(payload, cursor).nextOffset;
+          cursor = decodeUnsignedLeb128(payload, cursor).nextOffset;
+          cursor = decodeUnsignedLeb128(payload, cursor).nextOffset;
+        }
+      } else if (kind === WASM_SYMBOL_KIND_SECTION) {
+        cursor = decodeUnsignedLeb128(payload, cursor).nextOffset;
+      } else {
+        throw new Error(`Unsupported WASM linking symbol kind: ${kind}`);
+      }
+      if ((flags & WASM_SYM_UNDEFINED) !== 0) {
+        continue;
+      }
+      if ((flags & WASM_SYM_BINDING_LOCAL) !== 0) {
+        continue;
+      }
+      if ((flags & WASM_SYM_BINDING_WEAK) !== 0) {
+        continue;
+      }
+      if (!C_IDENTIFIER.test(name)) {
+        continue;
+      }
+      identifiers.add(name);
+    }
+    return Array.from(identifiers).sort();
+  }
+  throw new Error("Guest-link object is missing a symbol table subsection.");
+}
+
+function deriveGuestLinkRenameArgs({
+  objectBytes,
+  pluginId,
+  methodIds = [],
+} = {}) {
+  const identifiers = parseDefinedLinkSymbolsFromObjectBytes(objectBytes);
+  const prefix = guestLinkSymbolPrefix(pluginId);
+  const renamedIdentifiers = Array.from(
+    new Set([...identifiers, ...methodIds.filter((value) => C_IDENTIFIER.test(value))]),
+  ).sort();
+  return {
+    prefix,
+    identifiers: renamedIdentifiers,
+    renameArgs: renamedIdentifiers.map(
+      (identifier) => `-D${identifier}=${prefix}${identifier}`,
+    ),
+    methodSymbols: Object.fromEntries(
+      methodIds.map((methodId) => [methodId, `${prefix}${methodId}`]),
+    ),
+  };
+}
+
+function createGuestLinkBundleEntries(guestLink) {
+  if (!guestLink?.objectBytes || guestLink.objectBytes.length === 0) {
+    return [];
+  }
+  return [
+    {
+      entryId: SDS_GUEST_LINK_OBJECT_ENTRY_ID,
+      role: "auxiliary",
+      sectionName: SDS_GUEST_LINK_SECTION_NAME,
+      payloadEncoding: "raw-bytes",
+      mediaType: "application/wasm",
+      payload: guestLink.objectBytes,
+      description: "Prefixed guest-link wasm object for monolithic flow linking.",
+    },
+    {
+      entryId: SDS_GUEST_LINK_METADATA_ENTRY_ID,
+      role: "auxiliary",
+      sectionName: SDS_GUEST_LINK_SECTION_NAME,
+      payloadEncoding: "json-utf8",
+      mediaType: SDS_GUEST_LINK_MEDIA_TYPE,
+      payload: {
+        version: 1,
+        format: "wasm-object",
+        symbolPrefix: guestLink.symbolPrefix,
+        methodSymbols: guestLink.methodSymbols,
+        methodIds: Object.keys(guestLink.methodSymbols ?? {}),
+        language: guestLink.language,
+      },
+      description: "Guest-link metadata for monolithic flow linking.",
+    },
+  ];
+}
+
 async function getInvokeCppSupportFiles() {
   const [runtimeHeaders, schemaHeaders] = await Promise.all([
     getFlatbuffersCppRuntimeHeaders(),
@@ -114,6 +324,8 @@ function removeEmceptionDirectory(emception, directoryPath) {
 
 async function compileWithEmception(options = {}) {
   const {
+    manifest,
+    language,
     sourceCompilerCommand,
     sourceExtension,
     sourceCode,
@@ -140,6 +352,7 @@ async function compileWithEmception(options = {}) {
       const invokeHeaderPath = path.posix.join(workDir, "space_data_module_invoke.h");
       const invokeSourcePath = path.posix.join(workDir, "plugin-invoke-bridge.cpp");
       const sourceObjectPath = path.posix.join(workDir, "module.o");
+      const linkObjectPath = path.posix.join(workDir, "module-link.o");
       const manifestObjectPath = path.posix.join(workDir, "plugin-manifest-exports.o");
       const invokeObjectPath = path.posix.join(workDir, "plugin-invoke-bridge.o");
       const wasmOutputPath = path.posix.join(workDir, "module.wasm");
@@ -165,6 +378,43 @@ async function compileWithEmception(options = {}) {
             "-o",
             sourceObjectPath,
           ],
+        ];
+
+        for (const command of commands) {
+          const result = emception.run(command.join(" "));
+          if (result.returncode !== 0) {
+            throw new Error(
+              `Compilation failed with ${command[0]} (emception): ${result.stderr || result.stdout}`,
+            );
+          }
+        }
+
+        const sourceObjectBytes = new Uint8Array(emception.readFile(sourceObjectPath));
+        const guestLink = deriveGuestLinkRenameArgs({
+          objectBytes: sourceObjectBytes,
+          pluginId: manifest?.pluginId,
+          methodIds: Array.isArray(manifest?.methods)
+            ? manifest.methods.map((method) => String(method?.methodId ?? ""))
+            : [],
+        });
+
+        const linkCompileCommand = [
+          sourceCompilerCommand,
+          "-c",
+          sourcePath,
+          `-I${workDir}`,
+          ...guestLink.renameArgs,
+          "-o",
+          linkObjectPath,
+        ];
+        const linkCompileResult = emception.run(linkCompileCommand.join(" "));
+        if (linkCompileResult.returncode !== 0) {
+          throw new Error(
+            `Compilation failed with ${linkCompileCommand[0]} (emception): ${linkCompileResult.stderr || linkCompileResult.stdout}`,
+          );
+        }
+
+        const remainingCommands = [
           [
             "em++",
             "-c",
@@ -195,8 +445,7 @@ async function compileWithEmception(options = {}) {
             wasmOutputPath,
           ],
         ];
-
-        for (const command of commands) {
+        for (const command of remainingCommands) {
           const result = emception.run(command.join(" "));
           if (result.returncode !== 0) {
             throw new Error(
@@ -206,8 +455,20 @@ async function compileWithEmception(options = {}) {
         }
 
         const wasmBytes = new Uint8Array(emception.readFile(wasmOutputPath));
+        const linkObjectBytes = new Uint8Array(emception.readFile(linkObjectPath));
         await writeFile(resolvedOutputPath, wasmBytes);
-        return { wasmBytes, outputPath: resolvedOutputPath, tempDir };
+        return {
+          wasmBytes,
+          outputPath: resolvedOutputPath,
+          tempDir,
+          guestLink: {
+            format: "wasm-object",
+            language,
+            symbolPrefix: guestLink.prefix,
+            methodSymbols: guestLink.methodSymbols,
+            objectBytes: linkObjectBytes,
+          },
+        };
       } finally {
         try {
           removeEmceptionDirectory(emception, workDir);
@@ -275,6 +536,8 @@ export async function compileModuleFromSource(options = {}) {
     noEntry: includeCommandMain !== true,
   };
   const result = await compileWithEmception({
+    manifest,
+    language: compiler.language,
     sourceCompilerCommand: compiler.command,
     sourceExtension: compiler.extension,
     sourceCode,
@@ -301,6 +564,7 @@ export async function compileModuleFromSource(options = {}) {
     outputPath: resolvedOutputPath,
     tempDir,
     wasmBytes,
+    guestLink: result.guestLink,
     manifestWarnings: warnings,
     report,
   };
@@ -383,35 +647,100 @@ export async function protectModuleArtifact(options = {}) {
     authorization: signedAuthorization,
   };
 
-  let encryptedEnvelope = null;
-  if (options.recipientPublicKeyHex) {
-    encryptedEnvelope = await encryptJsonForRecipient({
-      payload,
-      recipientPublicKey: hexToBytes(options.recipientPublicKeyHex),
-      context: "space-data-module-sdk/package",
-    });
-  }
-
   let singleFileBundle = null;
   if (options.singleFileBundle === true) {
+    const additionalEntries = [
+      ...(Array.isArray(options.bundleEntries) ? options.bundleEntries : []),
+      ...createGuestLinkBundleEntries(options.guestLink),
+    ];
     singleFileBundle = await createSingleFileBundle({
       wasmBytes,
       manifest,
       authorization: signedAuthorization,
-      transportEnvelope: encryptedEnvelope,
-      entries: options.bundleEntries,
+      entries: additionalEntries,
     });
   }
 
+  const bundleBytes = singleFileBundle?.wasmBytes ?? wasmBytes;
+  let publicationNotice = null;
+  let publicationRecordsBytes = null;
+  let protectedArtifactBytes = null;
+  let encryptedEnvelope = null;
+
+  if (options.recipientPublicKeyHex) {
+    const encryptedBase = await encryptBytesForRecipient({
+      plaintext: bundleBytes,
+      recipientPublicKey: hexToBytes(options.recipientPublicKeyHex),
+      context: "space-data-module-sdk/package",
+      rootType: "WASM",
+    });
+    const encryptedBaseBytes = base64ToBytes(encryptedBase.protectedBlobBase64);
+    const parsedEncryptedBase = extractPublicationRecordCollection(encryptedBaseBytes);
+    publicationNotice = await createPublicationNotice({
+      payloadBytes: parsedEncryptedBase.payloadBytes,
+      artifactId,
+      programId,
+      fileName: `${artifactId}.wasm`,
+      fileId: programId,
+      signer,
+    });
+    publicationRecordsBytes = encodePublicationRecordCollection({
+      enc: parsedEncryptedBase.enc,
+      pnm: publicationNotice,
+    });
+    protectedArtifactBytes = appendPublicationRecordCollection(
+      parsedEncryptedBase.payloadBytes,
+      publicationRecordsBytes,
+    );
+    encryptedEnvelope = createEncryptedEnvelopePayload({
+      protectedBlobBytes: protectedArtifactBytes,
+      parsedProtectedBlob: {
+        payloadBytes: parsedEncryptedBase.payloadBytes,
+        recordCollectionBytes: publicationRecordsBytes,
+        enc: parsedEncryptedBase.enc,
+        pnm: publicationNotice,
+      },
+      enc: parsedEncryptedBase.enc,
+      context: parsedEncryptedBase.enc?.context,
+    });
+  } else {
+    publicationNotice = await createPublicationNotice({
+      payloadBytes: bundleBytes,
+      artifactId,
+      programId,
+      fileName: `${artifactId}.wasm`,
+      fileId: programId,
+      signer,
+    });
+    publicationRecordsBytes = encodePublicationRecordCollection({
+      pnm: publicationNotice,
+    });
+    protectedArtifactBytes = appendPublicationRecordCollection(
+      bundleBytes,
+      publicationRecordsBytes,
+    );
+  }
+
+  if (singleFileBundle) {
+    singleFileBundle = {
+      ...singleFileBundle,
+      wasmBytes: protectedArtifactBytes,
+    };
+  }
+
   return {
     mnemonic: identity.mnemonic,
     signingPublicKeyHex: bytesToHex(identity.signingKey.publicKey),
     signingPath: identity.signingKey.path,
     payload,
-    encrypted: Boolean(encryptedEnvelope),
+    publicationNotice,
+    publicationRecordsBytes,
+    protectedArtifactBytes,
+    protectedArtifactBase64: bytesToBase64(protectedArtifactBytes),
+    encrypted: Boolean(options.recipientPublicKeyHex),
     encryptedEnvelope,
     singleFileBundle,
-    bundledWasmBytes: singleFileBundle?.wasmBytes ?? null,
+    bundledWasmBytes: singleFileBundle?.wasmBytes ?? protectedArtifactBytes,
   };
 }