space-data-module-sdk 0.7.0 → 0.8.0

package/README.md

@@ -11,7 +11,7 @@ This repository is the source of truth for module-level concerns:
 - embedded manifest exports inside `.wasm` modules
 - standards-aware compliance and capability validation
 - module compilation and protection
-- the `sds.bundle` single-file container
+- the REC+MBL single-file container
 - deployment authorization plus SDS publication records (`REC`, `PNM`, `ENC`)
 - the first canonical module hostcall/import ABI surface
 - the canonical runtime-host model for append-only standards rows, host-managed
@@ -80,20 +80,21 @@ A compliant module built with this SDK is always a valid `.wasm` artifact with:
   - `plugin_alloc`
   - `plugin_free`
 - an exported `_start` entry when the artifact supports WASI command mode
-- optional `sds.bundle` custom-section payloads for:
+- optional `MBL` bundle metadata carried in one appended SDS `REC` trailer for:
   - manifest bytes
   - resolved deployment plans and input bindings
   - deployment authorization
   - auxiliary FlatBuffer or raw payloads
-- optional appended SDS FlatBuffer publication records in a trailing `REC`
-  container carrying:
+- optional appended SDS FlatBuffer publication records in that same trailing
+  `REC` container carrying:
+  - `MBL` single-file bundle metadata
   - `PNM` digital-signature/publication metadata
   - `ENC` encrypted-delivery metadata
 
-Single-file bundling does not append arbitrary bytes to the end of the wasm
-module. The one-file module container is `sds.bundle`, stored as a standard
-wasm custom section. Appended bytes are reserved for SDS publication records
-such as `PNM` and `ENC`, wrapped in a trailing `REC` FlatBuffer collection.
+Single-file bundling appends one SDS `REC` trailer to the end of the wasm
+payload. That trailer carries an `MBL` record for the bundle contents and may
+also carry `PNM` / `ENC` publication metadata when the artifact is signed or
+encrypted.
 
 The module contract stays the same whether the artifact is loaded directly,
 wrapped in a deployment envelope, or shipped as one bundled `.wasm` file.
@@ -171,11 +172,8 @@ This repo currently includes:
 
 - the JavaScript reference implementation for manifest, compliance, auth,
   transport, bundle handling, and compilation
-- deterministic `sds.bundle` conformance vectors under
+- deterministic REC+MBL conformance vectors under
   [`examples/single-file-bundle/vectors`](./examples/single-file-bundle/vectors)
-- non-JS bundle reference clients in
-  [`examples/single-file-bundle/go`](./examples/single-file-bundle/go) and
-  [`examples/single-file-bundle/python`](./examples/single-file-bundle/python)
 - reference Node and browser hosts plus the legacy sync `sdn_host` bridge for
   sync-safe guest hostcalls
 
@@ -385,20 +383,18 @@ This repo exposes that deployment surface from
 
 - validate resolved protocol installations
 - describe input and publication bindings by declared `interfaceId`
-- attach a deployment plan to `sds.bundle`
+- attach a deployment plan to the bundle `MBL` record
 
 The full contract split is documented in
 [`docs/protocol-installation.md`](./docs/protocol-installation.md).
 
 ## Single-File Bundles
 
-`sds.bundle` keeps module delivery to one file without changing WebAssembly
-loadability for the runtime payload itself. The SDK writes the bundle as a
-standard custom section inside the wasm module. When the artifact is signed or
-encrypted for publication, SDS appends FlatBuffer publication records after the
-wasm bytes in a trailing `REC` container. Loaders must scan from the end,
-resolve `PNM` / `ENC`, strip or decrypt as needed, and only then hand the
-remaining raw wasm bytes to a runtime such as WasmEdge.
+REC+MBL keeps module delivery to one file without changing the runtime payload
+itself. The SDK appends one trailing `REC` container after the wasm bytes.
+Loaders must scan from the end, resolve `MBL` / `PNM` / `ENC`, strip or decrypt
+as needed, and only then hand the remaining raw wasm bytes to a runtime such as
+WasmEdge.
 
 The reference path lives in
 [`examples/single-file-bundle`](./examples/single-file-bundle):
@@ -407,8 +403,6 @@ The reference path lives in
   bundled module
 - [`generate-vectors.mjs`](./examples/single-file-bundle/generate-vectors.mjs)
   regenerates the checked-in conformance vectors
-- the `go` and `python` directories show non-JS readers against the same
-  bundle contract
 
 Standard bundle payloads now include the optional `deployment-plan` JSON entry
 for resolved protocol installations and producer input bindings.
@@ -419,7 +413,6 @@ Digital signature and encrypted-delivery metadata are publication-layer
 extensions, not a second module format. The canonical module is still:
 
 - valid `.wasm`
-- optionally carrying `sds.bundle` as a wasm custom section
 - optionally carrying one appended SDS `REC` trailer after the wasm bytes
 
 That trailing `REC` FlatBuffer is the standards-backed container for

package/bin/space-data-module.js

@@ -6,13 +6,15 @@ import { readFile, writeFile } from "node:fs/promises";
 
 import {
   compileModuleFromSource,
-  loadComplianceConfig,
   protectModuleArtifact,
+} from "../src/compiler/index.js";
+import {
+  loadComplianceConfig,
+  loadManifestFromFile,
   resolveManifestFiles,
   validateArtifactWithStandards,
   validateManifestWithStandards,
-  loadManifestFromFile,
-} from "../src/index.js";
+} from "../src/compliance/index.js";
 import { bytesToBase64 } from "../src/utils/encoding.js";
 
 async function main(argv) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "space-data-module-sdk",
-  "version": "0.7.0",
+  "version": "0.8.0",
   "description": "Module SDK for building, validating, signing, and deploying WebAssembly modules on the Space Data Network.",
   "type": "module",
   "types": "./src/index.d.ts",
@@ -72,7 +72,7 @@
     "flatsql": "^0.4.0",
     "hd-wallet-wasm": "1.6.0",
     "sdn-emception": "1.0.0",
-    "spacedatastandards.org": "git+https://github.com/DigitalArsenal/spacedatastandards.org.git#c43c766bf4e8b18af125ed73b993e79c6ce20b24"
+    "spacedatastandards.org": "1.85.0"
   },
   "devDependencies": {
     "express": "^4.21.2"

package/src/AGENTS.md

@@ -11,7 +11,7 @@ the SDK source, not a prompt to edit SDK internals by default.
   and `src/auth/AGENTS.md` provide narrower rules for those owners.
 - `src/compiler`: compile flow, manifest embedding, runtime targets, toolchains,
   and artifact layout.
-- `src/bundle`: `sds.bundle`, wasm custom sections, and vector compatibility.
+- `src/bundle`: REC+MBL single-file packaging, wasm section handling, and vector compatibility.
 - `src/host`: Node host, browser shims, `sdn_host`, WasmEdge runners, and
   isomorphic loaders.
 - `src/runtime-host`: FlatSQL-backed runtime host, row/region identity, and

package/src/bundle/AGENTS.md

@@ -1,13 +1,14 @@
 # AGENTS
 
-This directory is the reference implementation for `sds.bundle` and wasm
-custom-section packaging.
+This directory is the reference implementation for REC+MBL single-file module
+packaging and wasm section handling.
 
 ## What Authors Should Use It For
 
-- `sds.bundle` is the single-file delivery format.
-- Put bundle data in a wasm custom section; do not append raw bytes after the
-  wasm binary.
+- Single-file delivery uses one appended `REC` trailer carrying an `MBL`
+  record.
+- Keep the runtime payload canonical `.wasm`; publication/container metadata
+  lives in the REC trailer.
 - Use the public bundle helpers and CLI from this repo rather than inventing a
   custom one-file format.
 

package/src/bundle/codec.js

@@ -2,13 +2,12 @@ import * as flatbuffers from "flatbuffers/mjs/flatbuffers.js";
 
 import {
   CanonicalizationRuleT,
-  ModuleBundle,
+  MBL,
+  MBLT,
   ModuleBundleEntryRole,
   ModuleBundleEntryT,
-  ModuleBundleT,
   ModulePayloadEncoding,
-} from "../generated/orbpro/module.js";
-import { FlatBufferTypeRefT } from "../generated/orbpro/stream/flat-buffer-type-ref.js";
+} from "spacedatastandards.org/lib/js/MBL/main.js";
 import { canonicalBytes } from "../auth/canonicalize.js";
 import { toUint8Array as toBufferLikeUint8Array } from "../runtime/bufferLike.js";
 import {
@@ -16,10 +15,11 @@ import {
   DEFAULT_MANIFEST_EXPORT_SYMBOL,
   DEFAULT_MANIFEST_SIZE_SYMBOL,
   DEFAULT_MODULE_FORMAT,
-  SDS_BUNDLE_SECTION_NAME,
   SDS_CUSTOM_SECTION_PREFIX,
+  SDS_MBL_CONTAINER_NAME,
 } from "./constants.js";
 
+const textDecoder = new TextDecoder();
 const textEncoder = new TextEncoder();
 
 const ROLE_NAME_TO_ENUM = new Map([
@@ -66,6 +66,15 @@ function normalizeString(value, fallback = null) {
   return String(value);
 }
 
+function firstDefined(...values) {
+  for (const value of values) {
+    if (value !== undefined) {
+      return value;
+    }
+  }
+  return undefined;
+}
+
 function normalizePayloadWireFormat(value) {
   if (value === 1) {
     return "aligned-binary";
@@ -131,24 +140,47 @@ function normalizePayloadEncoding(value) {
   );
 }
 
-function normalizeTypeRef(value) {
-  if (!value) {
+function stringifyTypeRef(value) {
+  if (value === undefined || value === null) {
     return null;
   }
-  if (value instanceof FlatBufferTypeRefT) {
+  if (typeof value === "string") {
     return value;
   }
-  return new FlatBufferTypeRefT(
-    normalizeString(value.schemaName),
-    normalizeString(value.fileIdentifier),
-    normalizeByteArray(value.schemaHash),
-    Boolean(value.acceptsAnyFlatbuffer),
-    normalizePayloadWireFormat(value.wireFormat),
-    normalizeString(value.rootTypeName),
-    normalizeUnsignedInteger(value.fixedStringLength),
-    normalizeUnsignedInteger(value.byteLength),
-    normalizeUnsignedInteger(value.requiredAlignment),
-  );
+  const bytes = toBufferLikeUint8Array(value);
+  if (bytes) {
+    return textDecoder.decode(bytes);
+  }
+  return textDecoder.decode(canonicalBytes(value));
+}
+
+function parseTypeRef(value) {
+  if (value && typeof value === "object" && !Array.isArray(value)) {
+    return {
+      ...value,
+      wireFormat: normalizePayloadWireFormat(value.wireFormat),
+      fixedStringLength: normalizeUnsignedInteger(value.fixedStringLength),
+      byteLength: normalizeUnsignedInteger(value.byteLength),
+      requiredAlignment: normalizeUnsignedInteger(value.requiredAlignment),
+    };
+  }
+  const normalized = normalizeString(value);
+  if (!normalized) {
+    return null;
+  }
+  try {
+    const parsed = JSON.parse(normalized);
+    if (parsed && typeof parsed === "object") {
+      return {
+        ...parsed,
+        wireFormat: normalizePayloadWireFormat(parsed.wireFormat),
+        fixedStringLength: normalizeUnsignedInteger(parsed.fixedStringLength),
+        byteLength: normalizeUnsignedInteger(parsed.byteLength),
+        requiredAlignment: normalizeUnsignedInteger(parsed.requiredAlignment),
+      };
+    }
+  } catch {}
+  return normalized;
 }
 
 function normalizeCanonicalization(value = {}) {
@@ -161,7 +193,7 @@ function normalizeCanonicalization(value = {}) {
       value.strippedCustomSectionPrefix,
       SDS_CUSTOM_SECTION_PREFIX,
     ),
-    normalizeString(value.bundleSectionName, SDS_BUNDLE_SECTION_NAME),
+    normalizeString(value.bundleSectionName, SDS_MBL_CONTAINER_NAME),
     normalizeString(value.hashAlgorithm, DEFAULT_HASH_ALGORITHM),
   );
 }
@@ -175,7 +207,7 @@ function normalizeEntry(value = {}) {
     normalizeString(value.entryId),
     normalizeRole(value.role),
     normalizeString(value.sectionName),
-    normalizeTypeRef(value.typeRef),
+    stringifyTypeRef(value.typeRef),
     payloadEncoding,
     normalizeString(value.mediaType),
     Number(value.flags ?? 0),
@@ -185,38 +217,122 @@ function normalizeEntry(value = {}) {
   );
 }
 
+function normalizeDecodedEntry(entry = {}) {
+  return {
+    entryId: firstDefined(entry.entryId, entry.entry_id) ?? null,
+    role: entry.role ?? ModuleBundleEntryRole.AUXILIARY,
+    sectionName: firstDefined(entry.sectionName, entry.section_name) ?? null,
+    typeRef: parseTypeRef(firstDefined(entry.typeRef, entry.type_ref)),
+    payloadEncoding:
+      firstDefined(entry.payloadEncoding, entry.payload_encoding) ??
+      ModulePayloadEncoding.RAW_BYTES,
+    mediaType: firstDefined(entry.mediaType, entry.media_type) ?? null,
+    flags: Number(entry.flags ?? 0),
+    sha256: normalizeByteArray(entry.sha256),
+    payload: normalizeByteArray(firstDefined(entry.payload, entry.PAYLOAD)),
+    description: entry.description ?? null,
+  };
+}
+
+function normalizeDecodedCanonicalization(canonicalization = null) {
+  if (!canonicalization || typeof canonicalization !== "object") {
+    return null;
+  }
+  return {
+    version: Number(canonicalization.version ?? 1),
+    strippedCustomSectionPrefix: normalizeString(
+      firstDefined(
+        canonicalization.strippedCustomSectionPrefix,
+        canonicalization.stripped_custom_section_prefix,
+      ),
+      SDS_CUSTOM_SECTION_PREFIX,
+    ),
+    bundleSectionName: normalizeString(
+      firstDefined(
+        canonicalization.bundleSectionName,
+        canonicalization.bundle_section_name,
+      ),
+      SDS_MBL_CONTAINER_NAME,
+    ),
+    hashAlgorithm: normalizeString(
+      firstDefined(
+        canonicalization.hashAlgorithm,
+        canonicalization.hash_algorithm,
+      ),
+      DEFAULT_HASH_ALGORITHM,
+    ),
+  };
+}
+
+function normalizeDecodedBundle(bundle = {}) {
+  return {
+    bundleVersion: Number(
+      firstDefined(bundle.bundleVersion, bundle.bundle_version) ?? 1,
+    ),
+    moduleFormat: normalizeString(
+      firstDefined(bundle.moduleFormat, bundle.module_format),
+      DEFAULT_MODULE_FORMAT,
+    ),
+    canonicalization: normalizeDecodedCanonicalization(bundle.canonicalization),
+    canonicalModuleHash: normalizeByteArray(
+      firstDefined(bundle.canonicalModuleHash, bundle.canonical_module_hash),
+    ),
+    manifestHash: normalizeByteArray(
+      firstDefined(bundle.manifestHash, bundle.manifest_hash),
+    ),
+    manifestExportSymbol: normalizeString(
+      firstDefined(bundle.manifestExportSymbol, bundle.manifest_export_symbol),
+      DEFAULT_MANIFEST_EXPORT_SYMBOL,
+    ),
+    manifestSizeSymbol: normalizeString(
+      firstDefined(bundle.manifestSizeSymbol, bundle.manifest_size_symbol),
+      DEFAULT_MANIFEST_SIZE_SYMBOL,
+    ),
+    entries: Array.isArray(bundle.entries)
+      ? bundle.entries.map(normalizeDecodedEntry)
+      : [],
+  };
+}
+
+export function moduleBundleTableFromObject(bundle = {}) {
+  return bundle instanceof MBLT
+    ? bundle
+    : new MBLT(
+        Number(bundle?.bundleVersion ?? 1),
+        normalizeString(bundle?.moduleFormat, DEFAULT_MODULE_FORMAT),
+        normalizeCanonicalization(bundle?.canonicalization),
+        normalizeByteArray(bundle?.canonicalModuleHash),
+        normalizeByteArray(bundle?.manifestHash),
+        normalizeString(
+          bundle?.manifestExportSymbol,
+          DEFAULT_MANIFEST_EXPORT_SYMBOL,
+        ),
+        normalizeString(
+          bundle?.manifestSizeSymbol,
+          DEFAULT_MANIFEST_SIZE_SYMBOL,
+        ),
+        Array.isArray(bundle?.entries)
+          ? bundle.entries.map(normalizeEntry)
+          : [],
+      );
+}
+
 export function decodeModuleBundle(data) {
   const bb = toByteBuffer(data);
-  if (!ModuleBundle.bufferHasIdentifier(bb)) {
+  if (!MBL.bufferHasIdentifier(bb)) {
     throw new Error("Module bundle buffer identifier mismatch.");
   }
-  return ModuleBundle.getRootAsModuleBundle(bb).unpack();
+  return normalizeDecodedBundle(MBL.getRootAsMBL(bb).unpack());
+}
+
+export function decodeModuleBundleTable(table) {
+  return normalizeDecodedBundle(table?.unpack?.() ?? {});
 }
 
 export function encodeModuleBundle(bundle) {
-  const value =
-    bundle instanceof ModuleBundleT
-      ? bundle
-      : new ModuleBundleT(
-          Number(bundle?.bundleVersion ?? 1),
-          normalizeString(bundle?.moduleFormat, DEFAULT_MODULE_FORMAT),
-          normalizeCanonicalization(bundle?.canonicalization),
-          normalizeByteArray(bundle?.canonicalModuleHash),
-          normalizeByteArray(bundle?.manifestHash),
-          normalizeString(
-            bundle?.manifestExportSymbol,
-            DEFAULT_MANIFEST_EXPORT_SYMBOL,
-          ),
-          normalizeString(
-            bundle?.manifestSizeSymbol,
-            DEFAULT_MANIFEST_SIZE_SYMBOL,
-          ),
-          Array.isArray(bundle?.entries)
-            ? bundle.entries.map(normalizeEntry)
-            : [],
-        );
+  const value = moduleBundleTableFromObject(bundle);
   const builder = new flatbuffers.Builder(1024);
-  ModuleBundle.finishModuleBundleBuffer(builder, value.pack(builder));
+  MBL.finishMBLBuffer(builder, value.pack(builder));
   return builder.asUint8Array();
 }
 
@@ -259,10 +375,9 @@ export function findModuleBundleEntry(bundle, match) {
 
 export {
   CanonicalizationRuleT,
-  FlatBufferTypeRefT,
-  ModuleBundle,
+  MBL,
+  MBLT,
   ModuleBundleEntryRole,
   ModuleBundleEntryT,
-  ModuleBundleT,
   ModulePayloadEncoding,
 };

package/src/bundle/constants.js

@@ -1,5 +1,5 @@
 export const SDS_CUSTOM_SECTION_PREFIX = "sds.";
-export const SDS_BUNDLE_SECTION_NAME = "sds.bundle";
+export const SDS_MBL_CONTAINER_NAME = "rec.mbl";
 export const DEFAULT_MODULE_FORMAT = "space-data-module";
 export const DEFAULT_HASH_ALGORITHM = "sha256";
 export const DEFAULT_MANIFEST_EXPORT_SYMBOL = "plugin_get_manifest_flatbuffer";

package/src/bundle/wasm.js

@@ -7,10 +7,10 @@ import { createDeploymentPlanBundleEntry } from "../deployment/index.js";
 import {
   DEFAULT_MANIFEST_EXPORT_SYMBOL,
   DEFAULT_MANIFEST_SIZE_SYMBOL,
-  SDS_BUNDLE_SECTION_NAME,
   SDS_CUSTOM_SECTION_PREFIX,
   SDS_DEPLOYMENT_ENTRY_ID,
   SDS_DEPLOYMENT_SECTION_NAME,
+  SDS_MBL_CONTAINER_NAME,
 } from "./constants.js";
 import {
   decodeModuleBundle,
@@ -20,7 +20,11 @@ import {
   moduleBundleEncodingToName,
   moduleBundleRoleToName,
 } from "./codec.js";
-import { extractPublicationRecordCollection } from "../transport/records.js";
+import {
+  appendPublicationRecordCollection,
+  encodePublicationRecordCollection,
+  extractPublicationRecordCollection,
+} from "../transport/records.js";
 
 const textDecoder = new TextDecoder();
 const textEncoder = new TextEncoder();
@@ -392,7 +396,7 @@ export async function createSingleFileBundle(options = {}) {
     version: 1,
     strippedCustomSectionPrefix:
       options.customSectionPrefix ?? SDS_CUSTOM_SECTION_PREFIX,
-    bundleSectionName: options.bundleSectionName ?? SDS_BUNDLE_SECTION_NAME,
+    bundleSectionName: options.bundleSectionName ?? SDS_MBL_CONTAINER_NAME,
     hashAlgorithm: "sha256",
   };
   const canonical = await computeCanonicalModuleHash(wasmBytes, {
@@ -415,10 +419,14 @@ export async function createSingleFileBundle(options = {}) {
   const baseWasmBytes = stripWasmCustomSections(wasmBytes, (section) =>
     section.name.startsWith(canonicalization.strippedCustomSectionPrefix),
   );
-  const outputWasmBytes = appendWasmCustomSection(
+  const outputWasmBytes = appendPublicationRecordCollection(
     baseWasmBytes,
-    canonicalization.bundleSectionName,
-    bundleBytes,
+    encodePublicationRecordCollection({
+      version: protectedArtifact?.version,
+      mbl: bundle,
+      enc: protectedArtifact?.enc,
+      pnm: protectedArtifact?.pnm,
+    }),
   );
   return {
     bundle,
@@ -434,25 +442,16 @@ export async function createSingleFileBundle(options = {}) {
 
 export async function parseSingleFileBundle(bytes, options = {}) {
   const protectedArtifact = extractPublicationRecordCollection(bytes);
+  if (!protectedArtifact?.mbl) {
+    throw new Error("Missing required REC trailer containing an MBL record.");
+  }
   const wasmBytes = normalizeBytes(
-    protectedArtifact?.payloadBytes ?? bytes,
+    protectedArtifact.payloadBytes,
     "wasm bytes",
   );
   const customSections = listWasmCustomSections(wasmBytes);
-  const bundleSectionName = String(
-    options.bundleSectionName ?? SDS_BUNDLE_SECTION_NAME,
-  );
-  const bundleSections = customSections.filter(
-    (section) => section.name === bundleSectionName,
-  );
-  if (bundleSections.length === 0) {
-    throw new Error(`Missing required custom section "${bundleSectionName}".`);
-  }
-  if (bundleSections.length > 1) {
-    throw new Error(`Expected one "${bundleSectionName}" section, found ${bundleSections.length}.`);
-  }
-  const bundleBytes = bundleSections[0].dataBytes;
-  const bundle = decodeModuleBundle(bundleBytes);
+  const bundle = protectedArtifact.mbl;
+  const bundleBytes = protectedArtifact.mblBytes ?? encodeModuleBundle(bundle);
   const prefix =
     bundle.canonicalization?.strippedCustomSectionPrefix ??
     SDS_CUSTOM_SECTION_PREFIX;
@@ -477,8 +476,8 @@ export async function parseSingleFileBundle(bytes, options = {}) {
     ) ?? null;
   return {
     wasmBytes,
-    protectedArtifactBytes: protectedArtifact?.protectedBytes ?? null,
-    publicationRecords: protectedArtifact ?? null,
+    protectedArtifactBytes: protectedArtifact.protectedBytes,
+    publicationRecords: protectedArtifact,
     bundleBytes,
     bundle,
     entries: parsedEntries,

package/src/compiler/compileModule.js

@@ -894,6 +894,7 @@ export async function protectModuleArtifact(options = {}) {
   };
 
   let singleFileBundle = null;
+  let singleFileBundleRecords = null;
   if (options.singleFileBundle === true) {
     const additionalEntries = [
       ...(Array.isArray(options.bundleEntries) ? options.bundleEntries : []),
@@ -905,9 +906,13 @@ export async function protectModuleArtifact(options = {}) {
       authorization: signedAuthorization,
       entries: additionalEntries,
     });
+    singleFileBundleRecords = extractPublicationRecordCollection(
+      singleFileBundle.wasmBytes,
+    );
   }
 
-  const bundleBytes = singleFileBundle?.wasmBytes ?? wasmBytes;
+  const bundleBytes = singleFileBundleRecords?.payloadBytes ?? wasmBytes;
+  const bundleRecord = singleFileBundleRecords?.mbl ?? null;
   let publicationNotice = null;
   let publicationRecordsBytes = null;
   let protectedArtifactBytes = null;
@@ -931,6 +936,7 @@ export async function protectModuleArtifact(options = {}) {
       signer,
     });
     publicationRecordsBytes = encodePublicationRecordCollection({
+      mbl: bundleRecord,
       enc: parsedEncryptedBase.enc,
       pnm: publicationNotice,
     });
@@ -943,6 +949,7 @@ export async function protectModuleArtifact(options = {}) {
       parsedProtectedBlob: {
         payloadBytes: parsedEncryptedBase.payloadBytes,
         recordCollectionBytes: publicationRecordsBytes,
+        mbl: bundleRecord,
         enc: parsedEncryptedBase.enc,
         pnm: publicationNotice,
       },
@@ -959,6 +966,7 @@ export async function protectModuleArtifact(options = {}) {
       signer,
     });
     publicationRecordsBytes = encodePublicationRecordCollection({
+      mbl: bundleRecord,
       pnm: publicationNotice,
     });
     protectedArtifactBytes = appendPublicationRecordCollection(

package/src/index.d.ts

@@ -937,7 +937,7 @@ export function validateManifestAgainstStandardsCatalog(
 
 // --- Bundle ---
 
-export const SDS_BUNDLE_SECTION_NAME: string;
+export const SDS_MBL_CONTAINER_NAME: string;
 export const DEFAULT_HASH_ALGORITHM: string;
 export const SDS_GUEST_LINK_OBJECT_ENTRY_ID: string;
 export const SDS_GUEST_LINK_METADATA_ENTRY_ID: string;