space-data-module-sdk 0.4.1 → 0.5.3

package/README.md

@@ -12,7 +12,7 @@ This repository is the source of truth for module-level concerns:
 - standards-aware compliance and capability validation
 - module compilation and protection
 - the `sds.bundle` single-file custom section
-- deployment authorization and encrypted transport envelopes
+- deployment authorization plus SDS publication records (`REC`, `PNM`, `ENC`)
 - the first canonical module hostcall/import ABI surface
 
 <p align="center">
@@ -36,9 +36,11 @@ A module built with this SDK is a `.wasm` artifact with:
   - manifest bytes
   - resolved deployment plans and input bindings
   - deployment authorization
-  - detached signatures
-  - encrypted transport envelopes
   - auxiliary FlatBuffer or raw payloads
+- optional appended SDS `REC` publication trailers carrying:
+  - `PNM` digital-signature/publication metadata
+  - `ENC` encrypted-delivery metadata
+- auxiliary FlatBuffer or raw payloads
 
 The module contract stays the same whether the artifact is loaded directly,
 wrapped in a deployment envelope, or shipped as one bundled `.wasm` file.
@@ -240,8 +242,11 @@ The full contract split is documented in
 ## Single-File Bundles
 
 `sds.bundle` keeps module delivery to one file without changing WebAssembly
-loadability. The SDK appends a standard custom section, not raw trailer bytes,
-so the bundled artifact still compiles as a normal `.wasm` module.
+loadability for the runtime payload itself. The SDK writes the bundle as a
+standard custom section inside the wasm module and, when the artifact is
+signed or encrypted for publication, appends an SDS `REC` trailer after the
+wasm bytes. Loaders must scan and strip that trailer before handing bytes to a
+runtime such as WasmEdge.
 
 The reference path lives in
 [`examples/single-file-bundle`](./examples/single-file-bundle):
@@ -263,8 +268,9 @@ publication descriptor. That descriptor covers:
 
 - standalone module packages
 - attached module artifacts shipped inside another language library
-- discovery of bundled wasm, sidecar signatures, and encrypted transport
-  FlatBuffers
+- discovery of bundled wasm
+- appended `REC` trailers carrying `PNM` and optional `ENC`
+- sidecar `PNM` / `ENC` FlatBuffers when a package does not embed the trailer
 
 The full standard is in
 [`docs/module-publication-standard.md`](./docs/module-publication-standard.md),
@@ -280,8 +286,10 @@ For npm packages, the simplest form is:
 }
 ```
 
-When signature or transport metadata is published in the same file, it belongs
-inside `sds.bundle`, not as raw bytes after the end of the wasm binary.
+When publication metadata is published in the same file, it belongs in an
+appended SDS `REC` trailer. Loaders scan from the end of the protected blob,
+resolve `PNM` / `ENC`, strip or decrypt as needed, and only then instantiate
+the remaining raw wasm bytes.
 
 ## Host ABI
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "space-data-module-sdk",
-  "version": "0.4.1",
+  "version": "0.5.3",
   "description": "Module SDK for building, validating, signing, and deploying WebAssembly modules on the Space Data Network.",
   "type": "module",
   "types": "./src/index.d.ts",
@@ -12,8 +12,16 @@
     "space-data-module": "bin/space-data-module.js"
   },
   "exports": {
-    ".": "./src/index.js",
-    "./manifest": "./src/manifest/index.js",
+    ".": {
+      "browser": "./src/browser.js",
+      "default": "./src/index.js"
+    },
+    "./manifest": {
+      "browser": "./src/manifest/browser.js",
+      "default": "./src/manifest/index.js"
+    },
+    "./embedded-manifest": "./src/embeddedManifest.js",
+    "./capabilities": "./src/capabilities.js",
     "./compliance": "./src/compliance/index.js",
     "./auth": "./src/auth/index.js",
     "./transport": "./src/transport/index.js",
@@ -46,7 +54,7 @@
     "flatbuffers": "^25.9.23",
     "hd-wallet-wasm": "1.6.0",
     "sdn-emception": "1.0.0",
-    "spacedatastandards.org": "23.3.3-0.3.4"
+    "spacedatastandards.org": "git+https://github.com/DigitalArsenal/spacedatastandards.org.git#09af351a1"
   },
   "devDependencies": {
     "express": "^4.21.2",

package/src/browser.js

@@ -0,0 +1,8 @@
+export * from "./manifest/browser.js";
+export * from "./auth/index.js";
+export * from "./transport/index.js";
+export * from "./bundle/index.js";
+export * from "./capabilities.js";
+export * from "./deployment/index.js";
+export * from "./invoke/index.js";
+export * from "./runtime/index.js";

package/src/bundle/wasm.js

@@ -20,6 +20,7 @@ import {
   moduleBundleEncodingToName,
   moduleBundleRoleToName,
 } from "./codec.js";
+import { extractPublicationRecordCollection } from "../transport/records.js";
 
 const textDecoder = new TextDecoder();
 const textEncoder = new TextEncoder();
@@ -86,7 +87,11 @@ export function decodeUnsignedLeb128(bytes, offset = 0) {
 }
 
 export function parseWasmModuleSections(bytes) {
-  const wasmBytes = normalizeBytes(bytes, "wasm bytes");
+  const protectedArtifact = extractPublicationRecordCollection(bytes);
+  const wasmBytes = normalizeBytes(
+    protectedArtifact?.payloadBytes ?? bytes,
+    "wasm bytes",
+  );
   if (wasmBytes.length < 8) {
     throw new Error("WASM module is truncated.");
   }
@@ -345,10 +350,12 @@ export async function computeCanonicalModuleHash(
   bytes,
   options = {},
 ) {
+  const protectedArtifact = extractPublicationRecordCollection(bytes);
+  const candidateBytes = protectedArtifact?.payloadBytes ?? bytes;
   const prefix = String(
     options.customSectionPrefix ?? SDS_CUSTOM_SECTION_PREFIX,
   );
-  const canonicalWasmBytes = stripWasmCustomSections(bytes, (section) =>
+  const canonicalWasmBytes = stripWasmCustomSections(candidateBytes, (section) =>
     section.name.startsWith(prefix),
   );
   const hashBytes = await sha256Bytes(canonicalWasmBytes);
@@ -360,7 +367,11 @@ export async function computeCanonicalModuleHash(
 }
 
 export async function createSingleFileBundle(options = {}) {
-  const wasmBytes = normalizeBytes(options.wasmBytes, "wasmBytes");
+  const protectedArtifact = extractPublicationRecordCollection(options.wasmBytes);
+  const wasmBytes = normalizeBytes(
+    protectedArtifact?.payloadBytes ?? options.wasmBytes,
+    "wasmBytes",
+  );
   const manifestBytes =
     options.manifestBytes !== undefined
       ? normalizeBytes(options.manifestBytes, "manifestBytes")
@@ -422,7 +433,11 @@ export async function createSingleFileBundle(options = {}) {
 }
 
 export async function parseSingleFileBundle(bytes, options = {}) {
-  const wasmBytes = normalizeBytes(bytes, "wasm bytes");
+  const protectedArtifact = extractPublicationRecordCollection(bytes);
+  const wasmBytes = normalizeBytes(
+    protectedArtifact?.payloadBytes ?? bytes,
+    "wasm bytes",
+  );
   const customSections = listWasmCustomSections(wasmBytes);
   const bundleSectionName = String(
     options.bundleSectionName ?? SDS_BUNDLE_SECTION_NAME,
@@ -462,6 +477,8 @@ export async function parseSingleFileBundle(bytes, options = {}) {
     ) ?? null;
   return {
     wasmBytes,
+    protectedArtifactBytes: protectedArtifact?.protectedBytes ?? null,
+    publicationRecords: protectedArtifact ?? null,
     bundleBytes,
     bundle,
     entries: parsedEntries,

package/src/capabilities.js

@@ -0,0 +1,46 @@
+export const RecommendedCapabilityIds = Object.freeze([
+  "clock",
+  "random",
+  "logging",
+  "timers",
+  "schedule_cron",
+  "http",
+  "tls",
+  "websocket",
+  "mqtt",
+  "tcp",
+  "udp",
+  "network",
+  "filesystem",
+  "pipe",
+  "pubsub",
+  "protocol_handle",
+  "protocol_dial",
+  "database",
+  "storage_adapter",
+  "storage_query",
+  "storage_write",
+  "context_read",
+  "context_write",
+  "process_exec",
+  "crypto_hash",
+  "crypto_sign",
+  "crypto_verify",
+  "crypto_encrypt",
+  "crypto_decrypt",
+  "crypto_key_agreement",
+  "crypto_kdf",
+  "wallet_sign",
+  "ipfs",
+  "scene_access",
+  "entity_access",
+  "render_hooks",
+]);
+
+export const StandaloneWasiCapabilityIds = Object.freeze([
+  "logging",
+  "clock",
+  "random",
+  "filesystem",
+  "pipe",
+]);

package/src/compiler/compileModule.js

@@ -26,7 +26,12 @@ import { runWithEmceptionLock } from "./emceptionNode.js";
 import { encodePluginManifest, toEmbeddedPluginManifest } from "../manifest/index.js";
 import { DefaultInvokeExports, InvokeSurface } from "../runtime/constants.js";
 import {
-  encryptJsonForRecipient,
+  appendPublicationRecordCollection,
+  createEncryptedEnvelopePayload,
+  createPublicationNotice,
+  encodePublicationRecordCollection,
+  encryptBytesForRecipient,
+  extractPublicationRecordCollection,
   generateX25519Keypair,
 } from "../transport/index.js";
 import { createSingleFileBundle } from "../bundle/index.js";
@@ -642,15 +647,6 @@ export async function protectModuleArtifact(options = {}) {
     authorization: signedAuthorization,
   };
 
-  let encryptedEnvelope = null;
-  if (options.recipientPublicKeyHex) {
-    encryptedEnvelope = await encryptJsonForRecipient({
-      payload,
-      recipientPublicKey: hexToBytes(options.recipientPublicKeyHex),
-      context: "space-data-module-sdk/package",
-    });
-  }
-
   let singleFileBundle = null;
   if (options.singleFileBundle === true) {
     const additionalEntries = [
@@ -661,20 +657,90 @@ export async function protectModuleArtifact(options = {}) {
       wasmBytes,
       manifest,
       authorization: signedAuthorization,
-      transportEnvelope: encryptedEnvelope,
       entries: additionalEntries,
     });
   }
 
+  const bundleBytes = singleFileBundle?.wasmBytes ?? wasmBytes;
+  let publicationNotice = null;
+  let publicationRecordsBytes = null;
+  let protectedArtifactBytes = null;
+  let encryptedEnvelope = null;
+
+  if (options.recipientPublicKeyHex) {
+    const encryptedBase = await encryptBytesForRecipient({
+      plaintext: bundleBytes,
+      recipientPublicKey: hexToBytes(options.recipientPublicKeyHex),
+      context: "space-data-module-sdk/package",
+      rootType: "WASM",
+    });
+    const encryptedBaseBytes = base64ToBytes(encryptedBase.protectedBlobBase64);
+    const parsedEncryptedBase = extractPublicationRecordCollection(encryptedBaseBytes);
+    publicationNotice = await createPublicationNotice({
+      payloadBytes: parsedEncryptedBase.payloadBytes,
+      artifactId,
+      programId,
+      fileName: `${artifactId}.wasm`,
+      fileId: programId,
+      signer,
+    });
+    publicationRecordsBytes = encodePublicationRecordCollection({
+      enc: parsedEncryptedBase.enc,
+      pnm: publicationNotice,
+    });
+    protectedArtifactBytes = appendPublicationRecordCollection(
+      parsedEncryptedBase.payloadBytes,
+      publicationRecordsBytes,
+    );
+    encryptedEnvelope = createEncryptedEnvelopePayload({
+      protectedBlobBytes: protectedArtifactBytes,
+      parsedProtectedBlob: {
+        payloadBytes: parsedEncryptedBase.payloadBytes,
+        recordCollectionBytes: publicationRecordsBytes,
+        enc: parsedEncryptedBase.enc,
+        pnm: publicationNotice,
+      },
+      enc: parsedEncryptedBase.enc,
+      context: parsedEncryptedBase.enc?.context,
+    });
+  } else {
+    publicationNotice = await createPublicationNotice({
+      payloadBytes: bundleBytes,
+      artifactId,
+      programId,
+      fileName: `${artifactId}.wasm`,
+      fileId: programId,
+      signer,
+    });
+    publicationRecordsBytes = encodePublicationRecordCollection({
+      pnm: publicationNotice,
+    });
+    protectedArtifactBytes = appendPublicationRecordCollection(
+      bundleBytes,
+      publicationRecordsBytes,
+    );
+  }
+
+  if (singleFileBundle) {
+    singleFileBundle = {
+      ...singleFileBundle,
+      wasmBytes: protectedArtifactBytes,
+    };
+  }
+
   return {
     mnemonic: identity.mnemonic,
     signingPublicKeyHex: bytesToHex(identity.signingKey.publicKey),
     signingPath: identity.signingKey.path,
     payload,
-    encrypted: Boolean(encryptedEnvelope),
+    publicationNotice,
+    publicationRecordsBytes,
+    protectedArtifactBytes,
+    protectedArtifactBase64: bytesToBase64(protectedArtifactBytes),
+    encrypted: Boolean(options.recipientPublicKeyHex),
     encryptedEnvelope,
     singleFileBundle,
-    bundledWasmBytes: singleFileBundle?.wasmBytes ?? null,
+    bundledWasmBytes: singleFileBundle?.wasmBytes ?? protectedArtifactBytes,
   };
 }
 

package/src/compliance/index.js

@@ -4,12 +4,14 @@ import {
   getWasmExportNamesFromFile,
   loadManifestFromFile,
   loadComplianceConfig,
-  RecommendedCapabilityIds,
-  StandaloneWasiCapabilityIds,
   resolveManifestFiles,
   validatePluginArtifact,
   validatePluginManifest,
 } from "./pluginCompliance.js";
+import {
+  RecommendedCapabilityIds,
+  StandaloneWasiCapabilityIds,
+} from "../capabilities.js";
 import { validateManifestAgainstStandardsCatalog } from "../standards/index.js";
 
 function mergeReport(baseReport, issues) {

package/src/compliance/pluginCompliance.js

@@ -12,53 +12,10 @@ import {
   ProtocolTransportKind,
   RuntimeTarget,
 } from "../runtime/constants.js";
-
-export const RecommendedCapabilityIds = Object.freeze([
-  "clock",
-  "random",
-  "logging",
-  "timers",
-  "schedule_cron",
-  "http",
-  "tls",
-  "websocket",
-  "mqtt",
-  "tcp",
-  "udp",
-  "network",
-  "filesystem",
-  "pipe",
-  "pubsub",
-  "protocol_handle",
-  "protocol_dial",
-  "database",
-  "storage_adapter",
-  "storage_query",
-  "storage_write",
-  "context_read",
-  "context_write",
-  "process_exec",
-  "crypto_hash",
-  "crypto_sign",
-  "crypto_verify",
-  "crypto_encrypt",
-  "crypto_decrypt",
-  "crypto_key_agreement",
-  "crypto_kdf",
-  "wallet_sign",
-  "ipfs",
-  "scene_access",
-  "entity_access",
-  "render_hooks",
-]);
-
-export const StandaloneWasiCapabilityIds = Object.freeze([
-  "logging",
-  "clock",
-  "random",
-  "filesystem",
-  "pipe",
-]);
+import {
+  RecommendedCapabilityIds,
+  StandaloneWasiCapabilityIds,
+} from "../capabilities.js";
 
 const RecommendedCapabilitySet = new Set(RecommendedCapabilityIds);
 const StandaloneWasiCapabilitySet = new Set(StandaloneWasiCapabilityIds);

package/src/index.d.ts

@@ -380,14 +380,69 @@ export interface X25519Keypair {
   privateKey: Uint8Array;
 }
 
+export interface EncRecord {
+  version: number;
+  keyExchange: string;
+  symmetric: string;
+  keyDerivation: string;
+  ephemeralPublicKey: Uint8Array | null;
+  nonceStart: Uint8Array | null;
+  recipientKeyId: Uint8Array | null;
+  context: string | null;
+  schemaHash: Uint8Array | null;
+  rootType: string | null;
+  timestamp: number;
+}
+
+export interface PublicationNotice {
+  multiformatAddress: string | null;
+  publishTimestamp: string | null;
+  cid: string | null;
+  fileName: string | null;
+  fileId: string | null;
+  signature: string | null;
+  timestampSignature: string | null;
+  signatureType: string | null;
+  timestampSignatureType: string | null;
+}
+
+export interface PublicationRecordEntry {
+  standard: string | null;
+  recordType: number;
+  value: EncRecord | PublicationNotice | unknown;
+}
+
+export interface PublicationRecordCollection {
+  version: string;
+  records: PublicationRecordEntry[];
+  enc: EncRecord | null;
+  pnm: PublicationNotice | null;
+  recordCollectionBytes: Uint8Array;
+}
+
+export interface ExtractedPublicationRecordCollection
+  extends PublicationRecordCollection {
+  payloadBytes: Uint8Array;
+  protectedBytes: Uint8Array;
+  footerBytes: Uint8Array;
+  footerMagic: string;
+  recordCollectionLength: number;
+}
+
 export interface EncryptedEnvelope {
   version: number;
   scheme: string;
   context: string;
-  senderPublicKeyBase64: string;
-  saltBase64: string;
-  ivBase64: string;
-  ciphertextBase64: string;
+  protectedBlobBase64?: string | null;
+  recordCollectionBase64?: string | null;
+  ciphertextBase64?: string | null;
+  senderPublicKeyBase64?: string | null;
+  nonceStartBase64?: string | null;
+  recipientKeyIdBase64?: string | null;
+  encRecordBase64?: string | null;
+  pnmRecordBase64?: string | null;
+  saltBase64?: string | null;
+  ivBase64?: string | null;
 }
 
 export function generateX25519Keypair(): Promise<X25519Keypair>;
@@ -397,8 +452,16 @@ export function encryptBytesForRecipient(options: {
   recipientPublicKey: Uint8Array | string;
   context?: string;
   senderKeyPair?: X25519Keypair;
+  recipientKeyId?: Uint8Array | ArrayBuffer | string | null;
+  schemaHash?: Uint8Array | ArrayBuffer | string | null;
+  rootType?: string | null;
 }): Promise<EncryptedEnvelope>;
 
+export function decryptProtectedBytes(options: {
+  protectedBytes: Uint8Array | ArrayBuffer;
+  recipientPrivateKey: Uint8Array | string;
+}): Promise<Uint8Array>;
+
 export function decryptBytesFromEnvelope(options: {
   envelope: EncryptedEnvelope;
   recipientPrivateKey: Uint8Array | string;
@@ -416,6 +479,78 @@ export function decryptJsonFromEnvelope(options: {
   recipientPrivateKey: Uint8Array | string;
 }): Promise<unknown>;
 
+export function decryptPublicationRecordCollection(options: {
+  protectedBytes: Uint8Array | ArrayBuffer;
+  recipientPrivateKey: Uint8Array | string;
+}): Promise<{
+  payloadBytes: Uint8Array;
+  decryptedBytes: Uint8Array;
+  publication: ExtractedPublicationRecordCollection | null;
+}>;
+
+export const TRAILER_MAGIC_TEXT: string;
+export const TRAILER_FOOTER_LENGTH: number;
+
+export function createCidV1Raw(
+  payloadBytes: Uint8Array | ArrayBuffer,
+): Promise<string>;
+
+export function encodeEncRecord(record?: Partial<EncRecord>): Uint8Array;
+export function decodeEncRecord(
+  bytes: Uint8Array | ArrayBuffer | ArrayBufferView,
+): EncRecord;
+export function encodePnmRecord(
+  record?: Partial<PublicationNotice>,
+): Uint8Array;
+export function decodePnmRecord(
+  bytes: Uint8Array | ArrayBuffer | ArrayBufferView,
+): PublicationNotice;
+export function encodePublicationRecordCollection(options: {
+  version?: string;
+  enc?: Partial<EncRecord> | null;
+  pnm?: Partial<PublicationNotice> | null;
+}): Uint8Array;
+export function decodePublicationRecordCollection(
+  bytes: Uint8Array | ArrayBuffer | ArrayBufferView,
+): PublicationRecordCollection;
+export function appendPublicationRecordCollection(
+  payloadBytes: Uint8Array | ArrayBuffer,
+  recordCollectionBytes: Uint8Array | ArrayBuffer,
+): Uint8Array;
+export function extractPublicationRecordCollection(
+  bytes: Uint8Array | ArrayBuffer | ArrayBufferView,
+): ExtractedPublicationRecordCollection | null;
+export function stripPublicationRecordCollection(
+  bytes: Uint8Array | ArrayBuffer | ArrayBufferView,
+): Uint8Array;
+export function createPublicationNotice(options: {
+  payloadBytes: Uint8Array | ArrayBuffer;
+  cid?: string | null;
+  publishTimestamp?: string | null;
+  publishTimestampMs?: number;
+  fileName?: string | null;
+  fileId?: string | null;
+  artifactId?: string | null;
+  programId?: string | null;
+  multiformatAddress?: string | null;
+  signature?: string | null;
+  timestampSignature?: string | null;
+  signatureType?: string | null;
+  timestampSignatureType?: string | null;
+  signer?: Signer | null;
+}): Promise<PublicationNotice>;
+export function createEncryptedEnvelopePayload(options: {
+  protectedBlobBytes: Uint8Array | ArrayBuffer;
+  parsedProtectedBlob?: ExtractedPublicationRecordCollection | null;
+  enc?: EncRecord | null;
+  context?: string | null;
+  scheme?: string | null;
+  version?: number;
+}): EncryptedEnvelope;
+export function decodeProtectedBlobBase64(
+  base64: string,
+): ExtractedPublicationRecordCollection | null;
+
 // --- Compiler ---
 
 export interface CompilationResult {
@@ -453,6 +588,10 @@ export interface ProtectedArtifact {
     manifestHashHex: string;
     authorization: SignedEnvelope;
   };
+  publicationNotice: PublicationNotice | null;
+  publicationRecordsBytes: Uint8Array | null;
+  protectedArtifactBytes: Uint8Array;
+  protectedArtifactBase64: string;
   encrypted: boolean;
   encryptedEnvelope: EncryptedEnvelope | null;
   singleFileBundle: { wasmBytes: Uint8Array } | null;
@@ -591,9 +730,24 @@ export function createSingleFileBundle(options: {
   entries?: Array<Record<string, unknown>>;
 }): Promise<{ wasmBytes: Uint8Array }>;
 
+export interface ParsedSingleFileBundle {
+  wasmBytes: Uint8Array;
+  protectedArtifactBytes: Uint8Array | null;
+  publicationRecords: ExtractedPublicationRecordCollection | null;
+  bundleBytes: Uint8Array;
+  bundle: unknown;
+  entries: Array<Record<string, unknown>>;
+  manifest: PluginManifest | null;
+  deploymentPlan: ModuleDeploymentPlan | null;
+  customSections: Array<Record<string, unknown>>;
+  canonicalWasmBytes: Uint8Array;
+  canonicalModuleHash: Uint8Array;
+  canonicalModuleHashHex: string;
+}
+
 export function parseSingleFileBundle(
   wasmBytes: Uint8Array,
-): unknown;
+): Promise<ParsedSingleFileBundle>;
 
 export function parseWasmModuleSections(
   bytes: Uint8Array,

package/src/index.js

@@ -4,6 +4,7 @@ export * from "./auth/index.js";
 export * from "./transport/index.js";
 export * from "./compiler/index.js";
 export * from "./bundle/index.js";
+export * from "./capabilities.js";
 export * from "./standards/index.js";
 export * from "./host/index.js";
 export * from "./invoke/index.js";

package/src/manifest/browser.js

@@ -0,0 +1,15 @@
+export * from "../generated/orbpro/manifest.js";
+export { PayloadWireFormat } from "../generated/orbpro/stream/payload-wire-format.js";
+export {
+  FlatBufferTypeRefT,
+  FlatBufferTypeRefT as PayloadTypeRef,
+} from "../generated/orbpro/stream/flat-buffer-type-ref.js";
+export { decodePluginManifest, encodePluginManifest } from "./codec.js";
+export { toEmbeddedPluginManifest } from "./normalize.js";
+export {
+  clonePayloadTypeRef,
+  getPayloadTypeWireFormat,
+  normalizePayloadWireFormatName,
+  payloadTypeRefsMatch,
+  selectPreferredPayloadTypeRef,
+} from "./typeRefs.js";

package/src/transport/index.js

@@ -1,4 +1,6 @@
 export {
+  decryptProtectedBytes,
+  decryptPublicationRecordCollection,
   decryptBytesFromEnvelope,
   decryptJsonFromEnvelope,
   encryptBytesForRecipient,
@@ -6,3 +8,20 @@ export {
   generateX25519Keypair,
 } from "./pki.js";
 
+export {
+  appendPublicationRecordCollection,
+  createCidV1Raw,
+  createEncryptedEnvelopePayload,
+  createPublicationNotice,
+  decodeEncRecord,
+  decodePnmRecord,
+  decodeProtectedBlobBase64,
+  decodePublicationRecordCollection,
+  encodeEncRecord,
+  encodePnmRecord,
+  encodePublicationRecordCollection,
+  extractPublicationRecordCollection,
+  stripPublicationRecordCollection,
+  TRAILER_FOOTER_LENGTH,
+  TRAILER_MAGIC_TEXT,
+} from "./records.js";