space-data-module-sdk 0.8.14 → 0.8.16

package/docs/protect-and-sign.md

@@ -0,0 +1,120 @@
+# Protect and sign
+
+Once a module passes conformance and the parity gate, it is protected
+(optionally encrypted, with its manifest attached), signed, and verified. All
+three verbs are implemented today in `space-data-module`.
+
+## Artifact layout
+
+A protected, published artifact is a single file:
+
+```
+protected-payload-bytes || REC-flatbuffer-bytes || uint32le(REC length) || "$REC"
+```
+
+The trailer is appended after the payload, so a consumer reads the last four
+bytes for the `$REC` magic, then the preceding little-endian `uint32` length,
+then the record. The record types themselves (`REC`, `MBL`, `PNM`, `ENC`) are
+Space Data Standards messages; this SDK consumes the generated classes, it does
+not define them. See the
+[module publication standard](module-publication-standard.html).
+
+## Protect
+
+`protect` attaches the manifest to the artifact and, when a recipient key is
+supplied, encrypts the payload for that recipient.
+
+```sh
+space-data-module protect \
+  --manifest ./manifest.json \
+  --wasm ./dist/module.wasm \
+  --json
+```
+
+```sh
+# encrypted for a specific recipient
+space-data-module protect \
+  --manifest ./manifest.json \
+  --wasm ./dist/module.wasm \
+  --recipient-public-key <hex> \
+  --out ./dist/module.wasm.enc
+```
+
+```sh
+# single-file bundle
+space-data-module protect \
+  --manifest ./manifest.json \
+  --wasm ./dist/module.wasm \
+  --single-file-bundle \
+  --out ./dist/module.bundle.wasm
+```
+
+| Flag | Required | Meaning |
+| --- | --- | --- |
+| `--manifest <path>` | yes | Module manifest JSON |
+| `--wasm <path>` | yes | The compiled artifact |
+| `--recipient-public-key <hex>` | no | Encrypt the payload for this recipient |
+| `--mnemonic <words>` | no | Key material for the protecting identity |
+| `--single-file-bundle` | no | Emit one self-contained bundle artifact |
+| `--out <path>` | no | Output path; otherwise reported on stdout |
+| `--json` | no | Machine-readable result |
+
+Non-JSON output reports `artifactId`, `signingPublicKeyHex`, `encrypted`,
+`wasmBase64Length`, and `protectedArtifactBytes`.
+
+## Sign
+
+```sh
+space-data-module sign \
+  --wasm ./dist/module.wasm \
+  --key ./keys/module-signing-keypair.json \
+  --out ./dist/module.signed.wasm
+```
+
+| Flag | Required | Meaning |
+| --- | --- | --- |
+| `--wasm <path>` | yes | Artifact to sign |
+| `--key <path>` | yes | Keypair JSON; must contain `privateKeySeedHex` |
+| `--out <path>` | no | Output path; otherwise the input is signed in place |
+
+The key file must carry `privateKeySeedHex` or the command refuses. Output
+reports `signed`, `keyId`, `publicKeyHex`, and `canonicalModuleHashHex` — the
+canonical hash is what a verifier recomputes, so it is stable across the
+appended trailer.
+
+## Verify
+
+```sh
+space-data-module verify \
+  --wasm ./dist/module.wasm \
+  --trusted <pubKeyHex>[,<pubKeyHex>...] \
+  --require-signature
+```
+
+```sh
+space-data-module verify \
+  --wasm ./dist/module.wasm \
+  --key ./keys/module-signing-keypair.json
+```
+
+`--trusted` takes a comma-separated list of trusted public keys; `--key` reads
+`publicKeyHex` out of a keypair JSON instead. Signature requirement defaults to
+true. Output reports `verified`, `signed`, `keyId`, `publicKeyHex`, and the
+process exits non-zero unless verification succeeded.
+
+## Key custody
+
+Signing keys are HD-derived from a node's root identity by default; supplying an
+external key is an explicit opt-in. Never commit a private key or a mnemonic to
+a repository, and never paste one into a build log. The dev keypairs that appear
+in the SDK's own test fixtures are test material and are not valid for a
+published module.
+
+## Honest gaps
+
+- There is no `license` CLI verb. A `src/licensing/` module exists in the tree
+  and is used programmatically, but it is not wired to a `space-data-module`
+  subcommand.
+- `protect`, `sign` and `verify` are artifact-level primitives. There is no
+  single end-to-end "release this module" command; see
+  [Publication and listing](publication-submission.html).

package/docs/protocol-installation.html

@@ -0,0 +1,296 @@
+<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="utf-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1" />
+    <meta name="description" content="This SDK now separates protocol identity from deployment-time routing." />
+    <title>Protocol installation — Space Data Module SDK</title>
+    <link rel="stylesheet" href="./styles.css" />
+    <!-- SDN_CONSUMER_ASSETS_START -->
+<link rel="stylesheet" href="https://static.spacedatanetwork.org/assets/hd-wallet-ui/2.0.28/sdn-wallet-public-client.c3f68d1cfd88478f10d836a5e829d1dfc6a10157972cf0f7d4d319d0636f2cc4.css" integrity="sha384-fICuhN4I9xqOK1F5vGGzl26opuO+xQIvTZXMSV76lWTBiQ6AfzztMGLLDw8yRT8i" crossorigin="anonymous">
+<script defer src="https://static.spacedatanetwork.org/assets/hd-wallet-ui/2.0.28/sdn-wallet-public-client.f611e7e151a3b5c38384272f8894a4c6634f0a29bf925b0e02e0e27f8db0bfff.js" integrity="sha384-R+QqsKoWJIS7iWrtPmgJ49DVnb1hSGjZokupbLInJd1PLp8RwQhtF/hnaerc33ci" crossorigin="anonymous" data-sdn-wallet-public-client="v1"></script>
+<script defer src="https://static.spacedatanetwork.org/assets/sdn-stack-nav/1.0.0/sdn-stack-nav.52fde607eee38ffa116188201f50258ed50bd18c9f06c1af9678f763147a8fe5.js" integrity="sha384-dgeojhJ8vTszHXIbv7O7nZcEzqD10oUYYJjBmPrV7+kLQEUlXLQD4ek5Q7HOFiO5" crossorigin="anonymous" data-nav-style-url="https://static.spacedatanetwork.org/assets/sdn-stack-nav/1.0.0/sdn-stack-nav.36a36359ce18322185e9ff179f88175bab67d5ad84a14d9c08a54f2ff27267e7.css" data-nav-style-integrity="sha384-c4M8Fg+kYaeOYYtJVr7jJsde24IhSWkWaRyAOHEZU9jozhRck089aw+mnHwxymds" data-wallet-client-url="https://static.spacedatanetwork.org/assets/hd-wallet-ui/2.0.28/sdn-wallet-public-client.f611e7e151a3b5c38384272f8894a4c6634f0a29bf925b0e02e0e27f8db0bfff.js" data-wallet-client-integrity="sha384-R+QqsKoWJIS7iWrtPmgJ49DVnb1hSGjZokupbLInJd1PLp8RwQhtF/hnaerc33ci" data-wallet-style-url="https://static.spacedatanetwork.org/assets/hd-wallet-ui/2.0.28/sdn-wallet-public-client.c3f68d1cfd88478f10d836a5e829d1dfc6a10157972cf0f7d4d319d0636f2cc4.css" data-wallet-style-integrity="sha384-fICuhN4I9xqOK1F5vGGzl26opuO+xQIvTZXMSV76lWTBiQ6AfzztMGLLDw8yRT8i" data-wallet-client-id="sdn-module-sdk-pages-v1" data-wallet-callback-uri="https://digitalarsenal.github.io/space-data-module-sdk/wallet-callback.html" data-wallet-registry-sha256="e1ce6fe903c9700484a8a87d96581c8cad97063dabf63030b4518a31a3bdaa93"></script>
+<!-- SDN_CONSUMER_ASSETS_END -->
+  </head>
+  <body>
+    <a class="skip-link" href="#main">Skip to content</a>
+    <sdn-stack-nav active="module-sdk"></sdn-stack-nav>
+    <header class="site-header">
+      <a class="site-brand" href="./">Space Data Module SDK</a>
+      <nav class="header-links" aria-label="Site">
+        <a href="./byo-wasm-quickstart.html">Quickstart</a>
+        <a href="./conformance.html">Conformance</a>
+        <a href="https://github.com/DigitalArsenal/space-data-module-sdk">GitHub</a>
+        <a class="stack-button" href="#stack">Stack</a>
+      </nav>
+    </header>
+    <div class="shell">
+      <nav class="sidebar" id="sidebar" aria-label="Documentation">
+<h2>Start here</h2><ul>
+<li><a href="./index.html"><span>Harness family matrix</span></a></li>
+<li><a href="./byo-wasm-quickstart.html"><span>BYO-wasm quickstart</span></a></li>
+<li><a href="./conformance.html"><span>Conformance kit</span></a></li>
+<li><a href="./protect-and-sign.html"><span>Protect and sign</span></a></li>
+<li><a href="./publication-submission.html"><span>Publication and listing</span></a></li>
+</ul>
+<h2>Dynamics</h2><ul>
+<li><a href="./families/propagator.html"><span>Propagator</span><span class="tag tag-shipped">shipped</span></a></li>
+<li><a href="./families/maneuver.html"><span>Maneuver</span><span class="tag tag-experimental">experimental</span></a></li>
+<li><a href="./families/propulsion.html"><span>Propulsion</span><span class="tag tag-planned">planned</span></a></li>
+<li><a href="./families/attitude.html"><span>Attitude</span><span class="tag tag-planned">planned</span></a></li>
+<li><a href="./families/gnc.html"><span>GNC</span><span class="tag tag-planned">planned</span></a></li>
+</ul>
+<h2>Environment and interaction</h2><ul>
+<li><a href="./families/rf.html"><span>RF</span><span class="tag tag-designed">designed</span></a></li>
+<li><a href="./families/sensor.html"><span>Sensor</span><span class="tag tag-planned">planned</span></a></li>
+<li><a href="./families/signature.html"><span>Signature</span><span class="tag tag-planned">planned</span></a></li>
+<li><a href="./families/environment.html"><span>Environment</span><span class="tag tag-planned">planned</span></a></li>
+<li><a href="./families/obstruction.html"><span>Obstruction</span><span class="tag tag-designed">designed</span></a></li>
+</ul>
+<h2>Event physics</h2><ul>
+<li><a href="./families/breakup.html"><span>Breakup</span><span class="tag tag-planned">planned</span></a></li>
+<li><a href="./families/reentry.html"><span>Reentry</span><span class="tag tag-planned">planned</span></a></li>
+<li><a href="./families/conjunction.html"><span>Conjunction</span><span class="tag tag-designed">designed</span></a></li>
+<li><a href="./families/effects.html"><span>Effects</span><span class="tag tag-planned">planned</span></a></li>
+</ul>
+<h2>Estimation, data and logic</h2><ul>
+<li><a href="./families/estimation.html"><span>Estimation</span><span class="tag tag-experimental">experimental</span></a></li>
+<li><a href="./families/data-source.html"><span>Data source</span><span class="tag tag-shipped">shipped</span></a></li>
+<li><a href="./families/analytics.html"><span>Analytics</span><span class="tag tag-experimental">experimental</span></a></li>
+<li><a href="./families/scheduler.html"><span>Scheduler</span><span class="tag tag-planned">planned</span></a></li>
+<li><a href="./families/behavior.html"><span>Behavior</span><span class="tag tag-planned">planned</span></a></li>
+</ul>
+<h2>Runtime contract</h2><ul>
+<li><a href="./events-abi.html"><span>Event locator ABI</span></a></li>
+<li><a href="./module-publication-standard.html"><span>Module publication standard</span></a></li>
+<li><a href="./browser-wasmedge-isomorphic.html"><span>Browser / WasmEdge isomorphism</span></a></li>
+<li><a href="./isomorphic-pthreads.html"><span>Isomorphic pthreads</span></a></li>
+<li><a href="./tri-runtime-parity.html"><span>Tri-runtime parity</span></a></li>
+<li><a href="./tri-runtime-parity-gate.html"><span>Tri-runtime parity gate</span></a></li>
+<li><a href="./testing-harness.html"><span>Testing harness</span></a></li>
+<li><a href="./language-runtime-matrix.html"><span>Language and runtime matrix</span></a></li>
+</ul>
+<h2>Host surfaces</h2><ul>
+<li><a href="./flatsql-host-contract.html"><span>FlatSQL host contract</span></a></li>
+<li><a href="./flatsql-streaming-standard.html"><span>FlatSQL streaming standard</span></a></li>
+<li><a href="./secrets-capability.html"><span>Credential lanes</span></a></li>
+<li><a href="./protocol-installation.html" aria-current="page"><span>Protocol installation</span></a></li>
+<li><a href="./gpu-module-abi.html"><span>GPU module ABI</span></a></li>
+<li><a href="./module-bundle-runtime-plan.html"><span>Module bundle runtime</span></a></li>
+<li><a href="./isomorphic-sdn-runtime-plan.html"><span>Isomorphic SDN runtime</span></a></li>
+<li><a href="./node-red-default-node-parity.html"><span>Node-RED node parity</span></a></li>
+</ul>
+      </nav>
+      <main class="doc" id="main">
+        <h1>Protocol installation</h1>
+<p>This SDK now separates protocol identity from deployment-time routing.</p>
+<p>That split matters because module artifacts are portable, compiled, and signable, while deployment endpoints are environment-specific.</p>
+<h2 id="canonical-manifest"><a class="anchor" href="#canonical-manifest" aria-hidden="true">#</a>Canonical Manifest</h2>
+<p>Hosted protocol declarations belong in <code>manifest.protocols</code>.</p>
+<p>Those declarations describe what a module can host or dial:</p>
+<ul>
+<li><code>protocolId</code></li>
+<li><code>methodId</code></li>
+<li><code>inputPortId</code></li>
+<li><code>outputPortId</code></li>
+<li><code>wireId</code></li>
+<li><code>transportKind</code></li>
+<li><code>role</code></li>
+<li><code>specUri</code></li>
+<li><code>autoInstall</code></li>
+<li><code>advertise</code></li>
+<li><code>discoveryKey</code></li>
+<li><code>defaultPort</code></li>
+<li><code>requireSecureTransport</code></li>
+</ul>
+<p>These fields are embedded in the compiled <code>PluginManifest.fbs</code> bytes and are part of the canonical module contract.</p>
+<h2 id="deployment-metadata"><a class="anchor" href="#deployment-metadata" aria-hidden="true">#</a>Deployment Metadata</h2>
+<p>Concrete deployment routing does <strong>not</strong> belong in the canonical manifest.</p>
+<p>Examples:</p>
+<ul>
+<li>concrete multiaddrs</li>
+<li>resolved listen ports</li>
+<li>selected peer IDs</li>
+<li>deployment URLs</li>
+<li>interface-keyed input bindings</li>
+<li>scheduler bindings</li>
+<li>hosted service bindings</li>
+<li>request-time auth policy</li>
+<li>publication, pinning, retention, and archive policy</li>
+</ul>
+<p>Those values vary per environment and should not change the identity of a signed <code>.wasm</code> artifact.</p>
+<p>Instead, attach them as a deployment-plan payload inside the bundle <code>MBL</code> record carried by the appended <code>REC</code> trailer.</p>
+<p>Deployment plans should use <code>protocolId</code> as the required identifier for a resolved protocol installation. <code>wireId</code> is optional deployment metadata for legacy transports that still expose it, not a required routing key.</p>
+<p>Deployment input and publication bindings should reference <code>manifest.externalInterfaces[].interfaceId</code>. That keeps deployment routing tied to the declared module contract instead of transport-specific <code>topic</code> or <code>wireId</code> hints.</p>
+<p>The standard bundle entry is:</p>
+<ul>
+<li><code>entryId</code>: <code>deployment-plan</code></li>
+<li><code>sectionName</code>: <code>sds.deployment</code></li>
+<li><code>payloadEncoding</code>: <code>json-utf8</code></li>
+<li><code>mediaType</code>: <code>application/vnd.space-data.module.deployment+json</code></li>
+</ul>
+<h2 id="public-helpers"><a class="anchor" href="#public-helpers" aria-hidden="true">#</a>Public Helpers</h2>
+<p>Use <code>space-data-module-sdk/deployment</code> to work with that payload:</p>
+<ul>
+<li><code>normalizeDeploymentPlan(...)</code></li>
+<li><code>validateDeploymentPlan(...)</code></li>
+<li><code>createDeploymentPlanBundleEntry(...)</code></li>
+<li><code>findDeploymentPlanEntry(...)</code></li>
+<li><code>readDeploymentPlanFromBundle(...)</code></li>
+</ul>
+<h2 id="example-manifest-protocol"><a class="anchor" href="#example-manifest-protocol" aria-hidden="true">#</a>Example Manifest Protocol</h2>
+<div class="codeblock"><div class="codeblock-head">json</div><pre><code>{
+  &quot;protocols&quot;: [
+    {
+      &quot;protocolId&quot;: &quot;sgp4-stream&quot;,
+      &quot;methodId&quot;: &quot;propagate&quot;,
+      &quot;inputPortId&quot;: &quot;request&quot;,
+      &quot;outputPortId&quot;: &quot;state&quot;,
+      &quot;wireId&quot;: &quot;/sdn/sgp4/1.0.0&quot;,
+      &quot;transportKind&quot;: &quot;libp2p&quot;,
+      &quot;role&quot;: &quot;handle&quot;,
+      &quot;specUri&quot;: &quot;https://spacedatastandards.org/#/schemas/PNM&quot;,
+      &quot;autoInstall&quot;: true,
+      &quot;advertise&quot;: true,
+      &quot;discoveryKey&quot;: &quot;sgp4-stream&quot;,
+      &quot;defaultPort&quot;: 443,
+      &quot;requireSecureTransport&quot;: true
+    }
+  ]
+}</code></pre></div>
+<h2 id="example-deployment-plan"><a class="anchor" href="#example-deployment-plan" aria-hidden="true">#</a>Example Deployment Plan</h2>
+<div class="codeblock"><div class="codeblock-head">json</div><pre><code>{
+  &quot;formatVersion&quot;: 1,
+  &quot;pluginId&quot;: &quot;com.example.sgp4&quot;,
+  &quot;version&quot;: &quot;1.2.3&quot;,
+  &quot;protocolInstallations&quot;: [
+    {
+      &quot;protocolId&quot;: &quot;sgp4-stream&quot;,
+      &quot;transportKind&quot;: &quot;libp2p&quot;,
+      &quot;role&quot;: &quot;handle&quot;,
+      &quot;peerId&quot;: &quot;12D3KooW...&quot;,
+      &quot;listenMultiaddrs&quot;: [
+        &quot;/ip4/127.0.0.1/tcp/14080/ws/p2p/12D3KooW...&quot;
+      ],
+      &quot;advertisedMultiaddrs&quot;: [
+        &quot;/dns4/sgp4.example.test/tcp/443/wss/p2p/12D3KooW...&quot;
+      ],
+      &quot;nodeInfoUrl&quot;: &quot;https://sgp4.example.test/api/node/info&quot;
+    }
+  ],
+  &quot;inputBindings&quot;: [
+    {
+      &quot;bindingId&quot;: &quot;catalog-feed&quot;,
+      &quot;interfaceId&quot;: &quot;catalog-pubsub&quot;,
+      &quot;targetMethodId&quot;: &quot;propagate&quot;,
+      &quot;targetInputPortId&quot;: &quot;request&quot;,
+      &quot;sourceKind&quot;: &quot;pubsub&quot;
+    }
+  ],
+  &quot;scheduleBindings&quot;: [
+    {
+      &quot;scheduleId&quot;: &quot;poll-upstream&quot;,
+      &quot;bindingMode&quot;: &quot;local&quot;,
+      &quot;targetMethodId&quot;: &quot;propagate&quot;,
+      &quot;targetInputPortId&quot;: &quot;request&quot;,
+      &quot;scheduleKind&quot;: &quot;cron&quot;,
+      &quot;cron&quot;: &quot;*/15 * * * *&quot;
+    }
+  ],
+  &quot;serviceBindings&quot;: [
+    {
+      &quot;serviceId&quot;: &quot;https-query&quot;,
+      &quot;bindingMode&quot;: &quot;delegated&quot;,
+      &quot;serviceKind&quot;: &quot;http-server&quot;,
+      &quot;routePath&quot;: &quot;/api/sgp4&quot;,
+      &quot;method&quot;: &quot;GET&quot;,
+      &quot;remoteUrl&quot;: &quot;https://gateway.example.test/api/sgp4&quot;,
+      &quot;authPolicyId&quot;: &quot;approved-keys&quot;
+    }
+  ],
+  &quot;authPolicies&quot;: [
+    {
+      &quot;policyId&quot;: &quot;approved-keys&quot;,
+      &quot;bindingMode&quot;: &quot;delegated&quot;,
+      &quot;targetKind&quot;: &quot;service&quot;,
+      &quot;targetId&quot;: &quot;https-query&quot;,
+      &quot;walletProfileId&quot;: &quot;orbpro-default&quot;,
+      &quot;trustMapId&quot;: &quot;approved-operators&quot;,
+      &quot;allowServerKeys&quot;: [&quot;ed25519:...&quot;]
+    }
+  ],
+  &quot;publicationBindings&quot;: [
+    {
+      &quot;publicationId&quot;: &quot;state-catalog&quot;,
+      &quot;interfaceId&quot;: &quot;state-catalog-pubsub&quot;,
+      &quot;bindingMode&quot;: &quot;local&quot;,
+      &quot;sourceKind&quot;: &quot;method-output&quot;,
+      &quot;sourceMethodId&quot;: &quot;propagate&quot;,
+      &quot;sourceOutputPortId&quot;: &quot;state&quot;,
+      &quot;schemaName&quot;: &quot;CAT.fbs&quot;,
+      &quot;emitPnm&quot;: true,
+      &quot;emitFlatbufferArchive&quot;: true,
+      &quot;archivePath&quot;: &quot;/data/catalog/cat.bin&quot;,
+      &quot;queryInterfaceId&quot;: &quot;state-query-api&quot;,
+      &quot;recordRangeStartField&quot;: &quot;startIndex&quot;,
+      &quot;recordRangeStopField&quot;: &quot;stopIndex&quot;
+    }
+  ]
+}</code></pre></div>
+<h2 id="identity-rules"><a class="anchor" href="#identity-rules" aria-hidden="true">#</a>Identity Rules</h2>
+<ul>
+<li><code>wireId</code> identifies the network protocol.</li>
+<li><code>specUri</code> identifies the message or schema contract.</li>
+<li>multiaddrs identify one deployment instance of that protocol.</li>
+<li><code>interfaceId</code> identifies the declared module boundary used by deployment input/publication bindings.</li>
+<li>deployment plans should resolve installed protocol surfaces by <code>protocolId</code>; include <code>wireId</code> only when a host integration still needs that legacy hint.</li>
+</ul>
+<p>Do not treat those as interchangeable.</p>
+
+        <p class="doc-footer">
+          Source of truth for this page:
+          <code>docs/protocol-installation.md</code>. Regenerate with
+          <code>npm run build:docs</code>.
+        </p>
+      </main>
+<nav class="rail" aria-label="On this page"><h2>On this page</h2><ul><li><a class="depth-2" href="#canonical-manifest">Canonical Manifest</a></li>
+<li><a class="depth-2" href="#deployment-metadata">Deployment Metadata</a></li>
+<li><a class="depth-2" href="#public-helpers">Public Helpers</a></li>
+<li><a class="depth-2" href="#example-manifest-protocol">Example Manifest Protocol</a></li>
+<li><a class="depth-2" href="#example-deployment-plan">Example Deployment Plan</a></li>
+<li><a class="depth-2" href="#identity-rules">Identity Rules</a></li></ul></nav>
+    </div>
+    <section id="stack" class="section" aria-labelledby="stack-title">
+      <div class="section-head">
+        <p class="eyebrow">SDN Stack</p>
+        <h2 id="stack-title">Connected sites</h2>
+      </div>
+      <div class="link-list">
+        <a href="https://spacedatastandards.org/">
+          <span>Standards</span>
+          <small>Canonical schemas, record contracts, and generated bindings.</small>
+        </a>
+        <a href="https://digitalarsenal.github.io/flatbuffers/">
+          <span>FlatBuffers</span>
+          <small>Binary encoding, schema tooling, and runtime documentation.</small>
+        </a>
+        <a href="https://digitalarsenal.github.io/flatsql/">
+          <span>FlatSQL</span>
+          <small>SQL-style queries over FlatBuffer-backed datasets and streams.</small>
+        </a>
+        <a href="https://spacedatanetwork.org/">
+          <span>SDN</span>
+          <small>Distributed publication, discovery, delivery, and marketplace infrastructure.</small>
+        </a>
+        <a href="https://digitalarsenal.github.io/space-data-module-sdk/" class="active">
+          <span>Module SDK</span>
+          <small>WASM module packaging, validation, and host compatibility tooling.</small>
+        </a>
+      </div>
+    </section>
+    <footer class="site-footer">
+      Space Data Module SDK — Apache-2.0. Every ABI page renders a Markdown
+      source in <code>docs/</code>; edit the Markdown, never the HTML.
+    </footer>
+  </body>
+</html>

package/docs/publication-submission.html

@@ -0,0 +1,158 @@
+<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="utf-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1" />
+    <meta name="description" content="The last step of the integrator path: turn a signed artifact into something a" />
+    <title>Publication and listing — Space Data Module SDK</title>
+    <link rel="stylesheet" href="./styles.css" />
+    <!-- SDN_CONSUMER_ASSETS_START -->
+<link rel="stylesheet" href="https://static.spacedatanetwork.org/assets/hd-wallet-ui/2.0.28/sdn-wallet-public-client.c3f68d1cfd88478f10d836a5e829d1dfc6a10157972cf0f7d4d319d0636f2cc4.css" integrity="sha384-fICuhN4I9xqOK1F5vGGzl26opuO+xQIvTZXMSV76lWTBiQ6AfzztMGLLDw8yRT8i" crossorigin="anonymous">
+<script defer src="https://static.spacedatanetwork.org/assets/hd-wallet-ui/2.0.28/sdn-wallet-public-client.f611e7e151a3b5c38384272f8894a4c6634f0a29bf925b0e02e0e27f8db0bfff.js" integrity="sha384-R+QqsKoWJIS7iWrtPmgJ49DVnb1hSGjZokupbLInJd1PLp8RwQhtF/hnaerc33ci" crossorigin="anonymous" data-sdn-wallet-public-client="v1"></script>
+<script defer src="https://static.spacedatanetwork.org/assets/sdn-stack-nav/1.0.0/sdn-stack-nav.52fde607eee38ffa116188201f50258ed50bd18c9f06c1af9678f763147a8fe5.js" integrity="sha384-dgeojhJ8vTszHXIbv7O7nZcEzqD10oUYYJjBmPrV7+kLQEUlXLQD4ek5Q7HOFiO5" crossorigin="anonymous" data-nav-style-url="https://static.spacedatanetwork.org/assets/sdn-stack-nav/1.0.0/sdn-stack-nav.36a36359ce18322185e9ff179f88175bab67d5ad84a14d9c08a54f2ff27267e7.css" data-nav-style-integrity="sha384-c4M8Fg+kYaeOYYtJVr7jJsde24IhSWkWaRyAOHEZU9jozhRck089aw+mnHwxymds" data-wallet-client-url="https://static.spacedatanetwork.org/assets/hd-wallet-ui/2.0.28/sdn-wallet-public-client.f611e7e151a3b5c38384272f8894a4c6634f0a29bf925b0e02e0e27f8db0bfff.js" data-wallet-client-integrity="sha384-R+QqsKoWJIS7iWrtPmgJ49DVnb1hSGjZokupbLInJd1PLp8RwQhtF/hnaerc33ci" data-wallet-style-url="https://static.spacedatanetwork.org/assets/hd-wallet-ui/2.0.28/sdn-wallet-public-client.c3f68d1cfd88478f10d836a5e829d1dfc6a10157972cf0f7d4d319d0636f2cc4.css" data-wallet-style-integrity="sha384-fICuhN4I9xqOK1F5vGGzl26opuO+xQIvTZXMSV76lWTBiQ6AfzztMGLLDw8yRT8i" data-wallet-client-id="sdn-module-sdk-pages-v1" data-wallet-callback-uri="https://digitalarsenal.github.io/space-data-module-sdk/wallet-callback.html" data-wallet-registry-sha256="e1ce6fe903c9700484a8a87d96581c8cad97063dabf63030b4518a31a3bdaa93"></script>
+<!-- SDN_CONSUMER_ASSETS_END -->
+  </head>
+  <body>
+    <a class="skip-link" href="#main">Skip to content</a>
+    <sdn-stack-nav active="module-sdk"></sdn-stack-nav>
+    <header class="site-header">
+      <a class="site-brand" href="./">Space Data Module SDK</a>
+      <nav class="header-links" aria-label="Site">
+        <a href="./byo-wasm-quickstart.html">Quickstart</a>
+        <a href="./conformance.html">Conformance</a>
+        <a href="https://github.com/DigitalArsenal/space-data-module-sdk">GitHub</a>
+        <a class="stack-button" href="#stack">Stack</a>
+      </nav>
+    </header>
+    <div class="shell">
+      <nav class="sidebar" id="sidebar" aria-label="Documentation">
+<h2>Start here</h2><ul>
+<li><a href="./index.html"><span>Harness family matrix</span></a></li>
+<li><a href="./byo-wasm-quickstart.html"><span>BYO-wasm quickstart</span></a></li>
+<li><a href="./conformance.html"><span>Conformance kit</span></a></li>
+<li><a href="./protect-and-sign.html"><span>Protect and sign</span></a></li>
+<li><a href="./publication-submission.html" aria-current="page"><span>Publication and listing</span></a></li>
+</ul>
+<h2>Dynamics</h2><ul>
+<li><a href="./families/propagator.html"><span>Propagator</span><span class="tag tag-shipped">shipped</span></a></li>
+<li><a href="./families/maneuver.html"><span>Maneuver</span><span class="tag tag-experimental">experimental</span></a></li>
+<li><a href="./families/propulsion.html"><span>Propulsion</span><span class="tag tag-planned">planned</span></a></li>
+<li><a href="./families/attitude.html"><span>Attitude</span><span class="tag tag-planned">planned</span></a></li>
+<li><a href="./families/gnc.html"><span>GNC</span><span class="tag tag-planned">planned</span></a></li>
+</ul>
+<h2>Environment and interaction</h2><ul>
+<li><a href="./families/rf.html"><span>RF</span><span class="tag tag-designed">designed</span></a></li>
+<li><a href="./families/sensor.html"><span>Sensor</span><span class="tag tag-planned">planned</span></a></li>
+<li><a href="./families/signature.html"><span>Signature</span><span class="tag tag-planned">planned</span></a></li>
+<li><a href="./families/environment.html"><span>Environment</span><span class="tag tag-planned">planned</span></a></li>
+<li><a href="./families/obstruction.html"><span>Obstruction</span><span class="tag tag-designed">designed</span></a></li>
+</ul>
+<h2>Event physics</h2><ul>
+<li><a href="./families/breakup.html"><span>Breakup</span><span class="tag tag-planned">planned</span></a></li>
+<li><a href="./families/reentry.html"><span>Reentry</span><span class="tag tag-planned">planned</span></a></li>
+<li><a href="./families/conjunction.html"><span>Conjunction</span><span class="tag tag-designed">designed</span></a></li>
+<li><a href="./families/effects.html"><span>Effects</span><span class="tag tag-planned">planned</span></a></li>
+</ul>
+<h2>Estimation, data and logic</h2><ul>
+<li><a href="./families/estimation.html"><span>Estimation</span><span class="tag tag-experimental">experimental</span></a></li>
+<li><a href="./families/data-source.html"><span>Data source</span><span class="tag tag-shipped">shipped</span></a></li>
+<li><a href="./families/analytics.html"><span>Analytics</span><span class="tag tag-experimental">experimental</span></a></li>
+<li><a href="./families/scheduler.html"><span>Scheduler</span><span class="tag tag-planned">planned</span></a></li>
+<li><a href="./families/behavior.html"><span>Behavior</span><span class="tag tag-planned">planned</span></a></li>
+</ul>
+<h2>Runtime contract</h2><ul>
+<li><a href="./events-abi.html"><span>Event locator ABI</span></a></li>
+<li><a href="./module-publication-standard.html"><span>Module publication standard</span></a></li>
+<li><a href="./browser-wasmedge-isomorphic.html"><span>Browser / WasmEdge isomorphism</span></a></li>
+<li><a href="./isomorphic-pthreads.html"><span>Isomorphic pthreads</span></a></li>
+<li><a href="./tri-runtime-parity.html"><span>Tri-runtime parity</span></a></li>
+<li><a href="./tri-runtime-parity-gate.html"><span>Tri-runtime parity gate</span></a></li>
+<li><a href="./testing-harness.html"><span>Testing harness</span></a></li>
+<li><a href="./language-runtime-matrix.html"><span>Language and runtime matrix</span></a></li>
+</ul>
+<h2>Host surfaces</h2><ul>
+<li><a href="./flatsql-host-contract.html"><span>FlatSQL host contract</span></a></li>
+<li><a href="./flatsql-streaming-standard.html"><span>FlatSQL streaming standard</span></a></li>
+<li><a href="./secrets-capability.html"><span>Credential lanes</span></a></li>
+<li><a href="./protocol-installation.html"><span>Protocol installation</span></a></li>
+<li><a href="./gpu-module-abi.html"><span>GPU module ABI</span></a></li>
+<li><a href="./module-bundle-runtime-plan.html"><span>Module bundle runtime</span></a></li>
+<li><a href="./isomorphic-sdn-runtime-plan.html"><span>Isomorphic SDN runtime</span></a></li>
+<li><a href="./node-red-default-node-parity.html"><span>Node-RED node parity</span></a></li>
+</ul>
+      </nav>
+      <main class="doc" id="main">
+        <h1>Publication and listing</h1>
+<p>The last step of the integrator path: turn a signed artifact into something a consumer can discover, fetch and load. Part of this is implemented and part of it is still being built, and this page separates the two explicitly.</p>
+<h2 id="what-is-implemented-today"><a class="anchor" href="#what-is-implemented-today" aria-hidden="true">#</a>What is implemented today</h2>
+<p><strong>The published artifact layout.</strong> A protected artifact carries its records in a trailer:</p>
+<div class="codeblock"><pre><code>protected-payload-bytes || REC-flatbuffer-bytes || uint32le(REC length) || &quot;$REC&quot;</code></pre></div>
+<p><code>REC</code>, <code>MBL</code>, <code>PNM</code> and <code>ENC</code> are Space Data Standards FlatBuffer record types. The SDK consumes the generated message classes; the schemas are ratified at <code>spacedatastandards.org</code>. The full contract — which record carries the manifest, which carries the bundle metadata, which carries the publication notice, and which carries the encryption envelope — is the <a href="./module-publication-standard.html">module publication standard</a>.</p>
+<p><strong>The artifact primitives.</strong> <code>protect</code>, <code>sign</code> and <code>verify</code> are real commands with real flags. See <a href="./protect-and-sign.html">Protect and sign</a>.</p>
+<p><strong>Post-publication loadability is gated.</strong> The tri-runtime parity gate carries a fixture for the <em>published</em> form of a module — the same artifact after its signature and manifest records have been appended as a trailing custom section — so the record-stripping and instantiation path is exercised by the gate, not assumed. See the <a href="./tri-runtime-parity-gate.html">parity gate</a>.</p>
+<p><strong>Package distribution.</strong> The publication standard also covers delivery through conventional package ecosystems (npm, PyPI, Maven Central, NuGet, Go modules, crates.io, Swift Package Manager) for the language bindings that accompany a module.</p>
+<h2 id="what-is-still-being-built"><a class="anchor" href="#what-is-still-being-built" aria-hidden="true">#</a>What is still being built</h2>
+<p>These are checked absences in the SDK today, not roadmap decoration:</p>
+<ul>
+<li><strong>No listing-submission command.</strong> There is no <code>publish</code>, <code>submit</code> or <code>list</code> subcommand. The CLI offers artifact-level primitives only.</li>
+<li><strong>No storefront or marketplace workflow in this repository.</strong> A module marketplace is a program in the wider stack; no listing code lives here.</li>
+<li><strong>No manifest injection for foreign-compiled binaries.</strong> A BYO vendor's artifact cannot yet be stamped with a manifest by a tool. See the <a href="./byo-wasm-quickstart.html">BYO-wasm quickstart</a>.</li>
+</ul>
+<h2 id="the-escorted-path-which-works-now"><a class="anchor" href="#the-escorted-path-which-works-now" aria-hidden="true">#</a>The escorted path, which works now</h2>
+<p>Until self-serve submission lands, a vendor can complete the whole path with help:</p>
+<ol>
+<li>The vendor builds <code>module.wasm</code> on the pinned toolchain and supplies the manifest JSON alongside it.</li>
+<li>Conformance and the parity gate are run against the artifact — the vendor can run both themselves and attach the output, or hand over the artifact and have them run.</li>
+<li>The artifact is protected and signed, and <code>verify</code> is run against the published bytes with the intended trusted key set.</li>
+<li>The publication records are attached and the module is listed by hand.</li>
+</ol>
+<p>Nothing in that sequence requires the vendor to have access to a private repository, and every gate in it is a real command whose output is the evidence.</p>
+<h2 id="submission-checklist"><a class="anchor" href="#submission-checklist" aria-hidden="true">#</a>Submission checklist</h2>
+<p>Before handing over an artifact, confirm each of these:</p>
+<div class="table-wrap"><table><thead><tr><th>Check</th><th>Command or evidence</th></tr></thead><tbody><tr><td>Built on the pinned toolchain</td><td>Link flags include <code>-Wl,--shared-memory</code> and <code>-Wl,--max-memory=2147483648</code></td></tr><tr><td>No Emscripten anywhere in the build</td><td>Build log; the parity gate's import classifier will catch it</td></tr><tr><td>Family ABI conformance passes</td><td><code>space-data-module conformance &lt;family&gt; --artifact &lt;path&gt;</code></td></tr><tr><td>Tri-runtime parity passes</td><td><code>space-data-module parity --wasm &lt;path&gt; --fixture &lt;path&gt; --lanes browser,wasmedge,docker-wasmedge</code></td></tr><tr><td>Manifest declares family, invoke surface, runtime targets, record types</td><td>The manifest JSON</td></tr><tr><td>Signed with the intended key</td><td><code>space-data-module verify --wasm &lt;path&gt; --trusted &lt;hex&gt; --require-signature</code></td></tr><tr><td>Teardown does not leak</td><td>The conformance leak cycles reach steady state</td></tr></tbody></table></div>
+
+        <p class="doc-footer">
+          Source of truth for this page:
+          <code>docs/publication-submission.md</code>. Regenerate with
+          <code>npm run build:docs</code>.
+        </p>
+      </main>
+<nav class="rail" aria-label="On this page"><h2>On this page</h2><ul><li><a class="depth-2" href="#what-is-implemented-today">What is implemented today</a></li>
+<li><a class="depth-2" href="#what-is-still-being-built">What is still being built</a></li>
+<li><a class="depth-2" href="#the-escorted-path-which-works-now">The escorted path, which works now</a></li>
+<li><a class="depth-2" href="#submission-checklist">Submission checklist</a></li></ul></nav>
+    </div>
+    <section id="stack" class="section" aria-labelledby="stack-title">
+      <div class="section-head">
+        <p class="eyebrow">SDN Stack</p>
+        <h2 id="stack-title">Connected sites</h2>
+      </div>
+      <div class="link-list">
+        <a href="https://spacedatastandards.org/">
+          <span>Standards</span>
+          <small>Canonical schemas, record contracts, and generated bindings.</small>
+        </a>
+        <a href="https://digitalarsenal.github.io/flatbuffers/">
+          <span>FlatBuffers</span>
+          <small>Binary encoding, schema tooling, and runtime documentation.</small>
+        </a>
+        <a href="https://digitalarsenal.github.io/flatsql/">
+          <span>FlatSQL</span>
+          <small>SQL-style queries over FlatBuffer-backed datasets and streams.</small>
+        </a>
+        <a href="https://spacedatanetwork.org/">
+          <span>SDN</span>
+          <small>Distributed publication, discovery, delivery, and marketplace infrastructure.</small>
+        </a>
+        <a href="https://digitalarsenal.github.io/space-data-module-sdk/" class="active">
+          <span>Module SDK</span>
+          <small>WASM module packaging, validation, and host compatibility tooling.</small>
+        </a>
+      </div>
+    </section>
+    <footer class="site-footer">
+      Space Data Module SDK — Apache-2.0. Every ABI page renders a Markdown
+      source in <code>docs/</code>; edit the Markdown, never the HTML.
+    </footer>
+  </body>
+</html>