@fungi.computer/seam 0.0.1 → 0.2.0

package/README.md

@@ -6,6 +6,13 @@ replay/signature tests retain their original behavior. Keys remain with the
 operator; no keys are stored in this package. The package ships the protocol and
 replay guard; hosts own key provisioning.
 
+`@fungi.computer/seam/machine-link-protocol` owns the shared machine-link
+audience/dial URL, bounded read/leave and Agent-operation grammar, Agent mail
+address schema, and `createMachineLinkPostChannel`. The channel carries ordinary
+Carrier Post envelopes and receipts; Carrier retains retries. Hosts own live
+authorization, socket lifetime and durable replay storage. Delegation request
+keys and execution policy remain with the delegation engine, not Seam.
+
 Run `pnpm --filter @fungi.computer/seam test` for signature, audience, body and
 replay laws. Computer and game-server host tests exercise its real consumers.
 
@@ -28,8 +35,13 @@ import { SeamReplayGuard } from "@fungi.computer/seam";
 
 const replay = new SeamReplayGuard();
 const now = Date.now();
-console.log(replay.admit("00112233445566778899aabbccddeeff", now));
-console.log(replay.admit("00112233445566778899aabbccddeeff", now));
+const record = {
+  nonce: "00112233445566778899aabbccddeeff",
+  now,
+  expiresAt: now + 120_000,
+};
+console.log(replay.admit(record)); // admitted
+console.log(replay.admit(record)); // replayed
 ```
 
 ## Core concepts
@@ -38,6 +50,20 @@ The sender signs method, audience, path, timestamp, nonce and payload digest.
 The receiver checks the signature, freshness and replay guard against its pinned
 keys.
 
+`verifySeamRequest` accepts one `SeamReplayStore`. It verifies the signature
+before awaiting atomic admission, and supplies a deadline covering the complete
+freshness window, including its last instant. The store must preserve that
+deadline, record before reporting success, and refuse at its finite capacity
+rather than evict still-live nonces. Its closed decisions are `admitted`,
+`replayed`, `at-capacity`, and `unavailable`; all refusals fail verification.
+
+`SeamReplayGuard` is the process-local implementation, with a private
+10,000-record ceiling. It is not persistent. A durable receiver must bind one
+store to its reconstruction-stable receiver namespace; storage and numeric
+capacity are host implementation decisions. There is no memory fallback on
+persistence failure. A record remains live when `expiresAt === now`; prune only
+strictly older deadlines, without assuming insertion order is expiry order.
+
 ## Examples and checks
 
 The packed runtime fixture at `test/stranger/runtime.mjs` exercises the public

package/dist/index.d.ts

@@ -17,11 +17,16 @@
  * This module is plain Web Crypto so the Worker and the Node.js host share it.
  */
 export declare const seamHeader = "x-fungi-seam";
+/** Digest sentinel for a body whose integrity is supplied by its transport. */
 export declare const unsignedPayload = "UNSIGNED-PAYLOAD";
+/** Sender identity and private Ed25519 key used to sign seam requests. */
 export type SeamSigner = Readonly<{
+    /** Key identifier included in the signed bytes and the request header. */
     keyId: string;
+    /** Private Ed25519 key with signing usage; custody stays with the sender. */
     key: CryptoKey;
 }>;
+/** Receiver-pinned public Ed25519 verification keys, indexed by sender key ID. */
 export type SeamVerifiers = ReadonlyMap<string, CryptoKey>;
 /** `keyId:base64(pkcs8)`, the form a Worker secret or key file holds. */
 export declare function importSeamSigner(secret: string): Promise<SeamSigner>;
@@ -31,15 +36,41 @@ export declare function importSeamVerifiers(publicKeys: Readonly<Record<string,
 export declare function seamBodyDigest(body: ArrayBuffer | Uint8Array<ArrayBuffer> | null): Promise<string>;
 /** The `x-fungi-seam` header value for one request. */
 export declare function signSeamRequest(signer: SeamSigner, audience: string, method: string, url: string, digest: string, now?: number): Promise<string>;
-/** Nonces seen inside the skew window, bounded. */
-export declare class SeamReplayGuard {
+/** An atomic admission decision; refusal never discards still-live history. */
+export type SeamReplayAdmission = "admitted" | "replayed" | "at-capacity" | "unavailable";
+/** Seam supplies the retention deadline, inclusive of its last fresh instant. */
+export type SeamReplayRecord = Readonly<{
+    /** Authenticated request nonce, unique within this logical receiver's history. */
+    nonce: string;
+    /** Receiver's current time in Unix epoch milliseconds. */
+    now: number;
+    /**
+     * Inclusive retention deadline in Unix epoch milliseconds.
+     * Prune only when this deadline is strictly earlier than `now`.
+     */
+    expiresAt: number;
+}>;
+/**
+ * One logical receiver's bounded replay history. A durable host must reopen
+ * the same receiver namespace after reconstruction, never fall back to memory.
+ * Admission atomically prunes expired records, checks nonce uniqueness and the
+ * implementation's finite capacity, then records the nonce before answering
+ * `admitted`. Persist before success; never shorten Seam's inclusive deadline.
+ * Storage mechanics and the numeric capacity belong to the implementation.
+ */
+export type SeamReplayStore = Readonly<{
+    /** Atomically admit one nonce or refuse it; commit before reporting admission. */
+    admit: (record: SeamReplayRecord) => SeamReplayAdmission | Promise<SeamReplayAdmission>;
+}>;
+/** Bounded process-local history; deliberately not durable across reconstruction. */
+export declare class SeamReplayGuard implements SeamReplayStore {
     #private;
-    /** Record `nonce`; false if it was already seen and is still live. */
-    admit(nonce: string, now: number): boolean;
+    /** Record one nonce, refusing capacity rather than evicting live history. */
+    admit({ nonce, now, expiresAt }: SeamReplayRecord): SeamReplayAdmission;
 }
 /**
  * Verify one request's seam header. `digest` is the receiver's own digest of
  * the buffered body, or `null` when the route accepts an unsigned stream.
  * Answers the sender's key id.
  */
-export declare function verifySeamRequest(verifiers: SeamVerifiers, audience: string, method: string, url: string, header: string | null, digest: string | null, replay: SeamReplayGuard, now?: number): Promise<string>;
+export declare function verifySeamRequest(verifiers: SeamVerifiers, audience: string, method: string, url: string, header: string | null, digest: string | null, replay: SeamReplayStore, now?: number): Promise<string>;

package/dist/index.js

@@ -17,6 +17,7 @@
  * This module is plain Web Crypto so the Worker and the Node.js host share it.
  */
 export const seamHeader = "x-fungi-seam";
+/** Digest sentinel for a body whose integrity is supplied by its transport. */
 export const unsignedPayload = "UNSIGNED-PAYLOAD";
 const version = "fungi-seam-v1";
 const maximumSkewMs = 60_000;
@@ -104,32 +105,27 @@ export async function signSeamRequest(signer, audience, method, url, digest, now
     const signature = await crypto.subtle.sign({ name: "Ed25519" }, signer.key, canonical(audience, signer.keyId, method, pathAndQueryOf(url), now, nonce, digest));
     return `v1 key=${signer.keyId} ts=${String(now)} nonce=${nonce} body=${digest} sig=${base64url(signature)}`;
 }
-/** Nonces seen inside the skew window, bounded. */
+/** Bounded process-local history; deliberately not durable across reconstruction. */
 export class SeamReplayGuard {
     #seen = new Map();
-    /** Record `nonce`; false if it was already seen and is still live. */
-    admit(nonce, now) {
+    /** Record one nonce, refusing capacity rather than evicting live history. */
+    admit({ nonce, now, expiresAt }) {
         this.#prune(now);
         if (this.#seen.has(nonce))
-            return false;
-        this.#makeRoom();
-        this.#seen.set(nonce, now + 2 * maximumSkewMs);
-        return true;
+            return "replayed";
+        if (this.#seen.size >= maximumNonces)
+            return "at-capacity";
+        this.#seen.set(nonce, expiresAt);
+        return "admitted";
     }
     #prune(now) {
         for (const [seen, expires] of this.#seen) {
-            if (expires > now)
-                break;
-            this.#seen.delete(seen);
+            // Freshness accepts the boundary instant. Clock steps also mean Map
+            // insertion order need not be expiry order: inspect every bounded entry.
+            if (expires < now)
+                this.#seen.delete(seen);
         }
     }
-    #makeRoom() {
-        if (this.#seen.size < maximumNonces)
-            return;
-        const oldest = this.#seen.keys().next();
-        if (!oldest.done)
-            this.#seen.delete(oldest.value);
-    }
 }
 function seamFields(value) {
     const fields = new Map();
@@ -187,9 +183,24 @@ export async function verifySeamRequest(verifiers, audience, method, url, header
     const valid = await crypto.subtle.verify({ name: "Ed25519" }, key, bytesFromBase64url(parsed.signature), canonical(audience, parsed.keyId, method, pathAndQueryOf(url), parsed.timestamp, parsed.nonce, parsed.digest));
     if (!valid)
         throw new SeamAuthError("bad signature");
-    if (!replay.admit(parsed.nonce, now))
-        throw new SeamAuthError("replayed nonce");
-    return parsed.keyId;
+    const admission = await replay.admit({
+        nonce: parsed.nonce,
+        now,
+        // A timestamp first admitted at ts-skew remains fresh through ts+skew.
+        expiresAt: now + 2 * maximumSkewMs,
+    });
+    switch (admission) {
+        case "admitted":
+            return parsed.keyId;
+        case "replayed":
+            throw new SeamAuthError("replayed nonce");
+        case "at-capacity":
+            throw new SeamAuthError("replay capacity reached");
+        case "unavailable":
+            throw new SeamAuthError("replay store unavailable");
+        default:
+            throw new SeamAuthError("replay store unavailable");
+    }
 }
 function assertSeamFreshness(parsed, digest, now) {
     if (Math.abs(now - parsed.timestamp) > maximumSkewMs)

package/dist/machine-link-post.d.ts

@@ -0,0 +1,38 @@
+import { type PostDeliveryResult, type PostEnvelope } from "@fungi.computer/carrier/post";
+declare const MachineLinkPostUnavailable_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "MachineLinkPostUnavailable";
+} & Readonly<A>;
+/** No receiver receipt was obtained. Carrier, not Seam, retains retries. */
+export declare class MachineLinkPostUnavailable extends MachineLinkPostUnavailable_base<{
+    /** Transient transport failure; none of these asserts command refusal. */
+    readonly reason: "closed" | "busy" | "timed_out" | "send_failed";
+    /** The native send failure, when the platform supplied one. */
+    readonly cause?: unknown;
+}> {
+}
+/**
+ * One connection's bounded Post I/O, without an outbox, dedupe store or RPC
+ * capability table. Native socket ownership and authentication stay with the
+ * host. Reconstruct after hibernation when idle; close on disconnect/restart
+ * and let the existing Carrier outbox retry the same frozen envelope.
+ *
+ * Receipt payloads remain opaque. The Agent mail route still requires a real
+ * Shiitake Accepted receipt; a generic Post acknowledgment is not one.
+ */
+export declare function createMachineLinkPostChannel(options: {
+    send: (frame: string) => void | Promise<void>;
+    receive: (envelope: PostEnvelope) => Promise<PostDeliveryResult>;
+    limits: {
+        maxInFlight: number;
+        maxFrameBytes: number;
+        acknowledgmentMs: number;
+    };
+}): {
+    /** Send now; never acknowledge custody before the receiver replies. */
+    deliver: (envelope: PostEnvelope) => Promise<PostDeliveryResult>;
+    /** Called only for a host-authenticated, current native socket. */
+    receive: (text: string) => Promise<void>;
+    /** Forget only pending I/O. The durable sender still owns undelivered work. */
+    close: () => void;
+};
+export {};

package/dist/machine-link-post.js

@@ -0,0 +1,129 @@
+import * as Data from "effect/Data";
+import * as Schema from "effect/Schema";
+import { PostDeliveryResultSchema, PostEnvelopeSchema, } from "@fungi.computer/carrier/post";
+const identitySchema = Schema.Struct({
+    key: PostEnvelopeSchema.fields.key,
+    kind: PostEnvelopeSchema.fields.kind,
+    address: PostEnvelopeSchema.fields.address,
+});
+const frameSchema = Schema.Union([
+    Schema.Struct({
+        type: Schema.Literal("post"),
+        envelope: PostEnvelopeSchema,
+    }),
+    Schema.Struct({
+        type: Schema.Literal("receipt"),
+        identity: identitySchema,
+        result: PostDeliveryResultSchema,
+    }),
+]);
+const positiveInteger = Schema.Int.check(Schema.isGreaterThanOrEqualTo(1), Schema.isLessThanOrEqualTo(Number.MAX_SAFE_INTEGER));
+const limitsSchema = Schema.Struct({
+    maxInFlight: positiveInteger,
+    maxFrameBytes: positiveInteger,
+    acknowledgmentMs: Schema.Int.check(Schema.isGreaterThanOrEqualTo(1), 
+    // The maintained platform timer cannot represent a larger delay.
+    Schema.isLessThanOrEqualTo(2_147_483_647)),
+});
+/** No receiver receipt was obtained. Carrier, not Seam, retains retries. */
+export class MachineLinkPostUnavailable extends Data.TaggedError("MachineLinkPostUnavailable") {
+}
+function identity(envelope) {
+    return {
+        key: envelope.key,
+        kind: envelope.kind,
+        address: envelope.address,
+    };
+}
+/**
+ * One connection's bounded Post I/O, without an outbox, dedupe store or RPC
+ * capability table. Native socket ownership and authentication stay with the
+ * host. Reconstruct after hibernation when idle; close on disconnect/restart
+ * and let the existing Carrier outbox retry the same frozen envelope.
+ *
+ * Receipt payloads remain opaque. The Agent mail route still requires a real
+ * Shiitake Accepted receipt; a generic Post acknowledgment is not one.
+ */
+export function createMachineLinkPostChannel(options) {
+    const limits = Schema.decodeUnknownSync(limitsSchema)(options.limits);
+    const decode = Schema.decodeUnknownSync(Schema.fromJsonString(frameSchema), {
+        onExcessProperty: "error",
+    });
+    const pending = new Map();
+    let closed = false;
+    let receiving = 0;
+    function checkSize(text) {
+        if (new TextEncoder().encode(text).byteLength > limits.maxFrameBytes)
+            throw new RangeError("Machine link Post frame exceeds its byte ceiling");
+    }
+    async function send(text) {
+        if (closed)
+            throw new MachineLinkPostUnavailable({ reason: "closed" });
+        checkSize(text);
+        await options.send(text);
+    }
+    function take(key) {
+        const entry = pending.get(key);
+        if (entry !== undefined) {
+            pending.delete(key);
+            clearTimeout(entry.timer);
+        }
+        return entry;
+    }
+    return {
+        /** Send now; never acknowledge custody before the receiver replies. */
+        deliver: async (envelope) => {
+            if (closed)
+                throw new MachineLinkPostUnavailable({ reason: "closed" });
+            const key = JSON.stringify(identity(envelope));
+            if (pending.has(key) || pending.size >= limits.maxInFlight)
+                throw new MachineLinkPostUnavailable({ reason: "busy" });
+            const text = JSON.stringify({ type: "post", envelope });
+            checkSize(text);
+            return new Promise((resolve, reject) => {
+                const timer = setTimeout(() => {
+                    take(key)?.reject(new MachineLinkPostUnavailable({ reason: "timed_out" }));
+                }, limits.acknowledgmentMs);
+                pending.set(key, { resolve, reject, timer });
+                void send(text).catch((cause) => {
+                    take(key)?.reject(new MachineLinkPostUnavailable({
+                        reason: "send_failed",
+                        cause,
+                    }));
+                });
+            });
+        },
+        /** Called only for a host-authenticated, current native socket. */
+        receive: async (text) => {
+            if (closed)
+                throw new MachineLinkPostUnavailable({ reason: "closed" });
+            checkSize(text);
+            const frame = decode(text);
+            if (frame.type === "receipt") {
+                // Late receipts cannot create custody or a future successful send.
+                take(JSON.stringify(identity(frame.identity)))?.resolve(frame.result);
+                return;
+            }
+            if (receiving >= limits.maxInFlight)
+                throw new MachineLinkPostUnavailable({ reason: "busy" });
+            receiving += 1;
+            try {
+                const result = Schema.decodeUnknownSync(PostDeliveryResultSchema)(await options.receive(frame.envelope));
+                await send(JSON.stringify({
+                    type: "receipt",
+                    identity: identity(frame.envelope),
+                    result,
+                }));
+            }
+            finally {
+                receiving -= 1;
+            }
+        },
+        /** Forget only pending I/O. The durable sender still owns undelivered work. */
+        close: () => {
+            closed = true;
+            for (const key of pending.keys())
+                take(key)?.reject(new MachineLinkPostUnavailable({ reason: "closed" }));
+        },
+    };
+}

package/dist/machine-link-protocol.d.ts

@@ -0,0 +1,88 @@
+import * as Schema from "effect/Schema";
+export { createMachineLinkPostChannel, MachineLinkPostUnavailable, } from "./machine-link-post.js";
+/** Shared signature audience; neither names nor private Local selectors enter it. */
+export declare function machineLinkAudience(teamId: string, deviceId: string): string;
+/** One wire contract for the signed machine dial; no older-version fallback. */
+export declare const machineLinkProtocolVersion = "1";
+/** The exact GET path signed by Local and verified by its receiving link. */
+export declare function machineLinkDialUrl(issuer: string, teamId: string, deviceId: string): URL;
+/** Post destination only; delegation keys and admission belong to their engine. */
+export type AgentMailAddress = {
+    /** Owning Team or standalone scope, a nonempty identity of at most 256 characters. */
+    readonly scopeId: string;
+    /** Destination Agent, a nonempty identity of at most 256 characters. */
+    readonly agentId: string;
+};
+/** Maintained decoder for the shared Post address, not delegation authority. */
+export declare const agentMailAddressSchema: Schema.Codec<AgentMailAddress>;
+/** Idempotent Session creation requested through an authorized machine link. */
+export type MachineAgentCreateSession = {
+    /** Finite operation discriminator. */
+    readonly type: "createSession";
+    /** Caller-owned creation intent, a nonempty identity of at most 256 characters. */
+    readonly requestId: string;
+};
+/** Read the destination owner's outcome for one previously accepted command. */
+export type MachineAgentSettlement = {
+    /** Finite operation discriminator. */
+    readonly type: "settlement";
+    /** Requesting Agent; the receiver still checks its relationship to the command. */
+    readonly requesterAgentId: string;
+    /** Recipient Session identity, nonempty and at most 256 characters. */
+    readonly sessionId: string;
+    /** Original Accepted command identity, nonempty and at most 256 characters. */
+    readonly commandId: string;
+};
+/** Finite Agent operations, not an arbitrary HTTP/RPC tunnel. */
+export type MachineAgentOperation = MachineAgentCreateSession | MachineAgentSettlement;
+/** Decode operation grammar without granting access to an Agent or Session. */
+export declare const machineAgentOperationSchema: Schema.Codec<MachineAgentOperation>;
+/** An operation plus its host-derived caller, still subject to receiver admission. */
+export type MachineAgentRequest = {
+    /** Calling Agent identity; syntax alone never authenticates this field. */
+    readonly actorAgentId: string;
+    /** The finite operation to admit at the destination. */
+    readonly operation: MachineAgentOperation;
+};
+/** Decode the request representation, not caller authority. */
+export declare const machineAgentRequestSchema: Schema.Codec<MachineAgentRequest>;
+/** One public Agent directory entry, without a private Local selector or path. */
+export type MachineDirectoryAgent = {
+    /** Team Agent identity, nonempty and at most 256 characters. */
+    readonly agentId: string;
+    /** Display label of at most 256 characters. */
+    readonly name: string;
+};
+/** Bounded directory representation sent by an enrolled machine. */
+export type MachineDirectory = {
+    /** At most 256 public Agent entries; the host checks their enrollment. */
+    readonly agents: readonly MachineDirectoryAgent[];
+};
+/** Decode the bounded directory representation without admitting its entries. */
+export declare const machineDirectorySchema: Schema.Codec<MachineDirectory>;
+/** Ask the owner to remove one enrolled Team Agent projection. */
+export type MachineLinkLeaveFrame = {
+    /** Finite control discriminator. */
+    readonly type: "leave";
+    /** Team Agent identity, nonempty and at most 256 characters. */
+    readonly agentId: string;
+};
+/** Read one bounded transcript page through the Session owner's ordinary cursor. */
+export type MachineLinkReadFrame = {
+    /** Finite control discriminator. */
+    readonly type: "read";
+    /** Correlation identity, nonempty and at most 256 characters. */
+    readonly requestId: string;
+    /** Team Agent identity, nonempty and at most 256 characters. */
+    readonly agentId: string;
+    /** Session identity, nonempty and at most 256 characters. */
+    readonly sessionId: string;
+    /** Opaque older-page cursor from Session.read(), not a transport stream cursor. */
+    readonly before?: string;
+    /** Integer page bound from one through 64. */
+    readonly limit: number;
+};
+/** Non-mail requests, not authenticated membership or admitted Session access. */
+export type MachineLinkControlFrame = MachineLinkLeaveFrame | MachineLinkReadFrame;
+/** Decode JSON only; the host still owns device, member and Agent admission. */
+export declare function decodeMachineLinkControlFrame(text: string): MachineLinkControlFrame;

package/dist/machine-link-protocol.js

@@ -0,0 +1,67 @@
+import * as Schema from "effect/Schema";
+export { createMachineLinkPostChannel, MachineLinkPostUnavailable, } from "./machine-link-post.js";
+/** Shared signature audience; neither names nor private Local selectors enter it. */
+export function machineLinkAudience(teamId, deviceId) {
+    return `fungi-machine-link:${teamId}:${deviceId}`;
+}
+/** One wire contract for the signed machine dial; no older-version fallback. */
+export const machineLinkProtocolVersion = "1";
+/** The exact GET path signed by Local and verified by its receiving link. */
+export function machineLinkDialUrl(issuer, teamId, deviceId) {
+    const url = new URL(`/api/teams/${encodeURIComponent(teamId)}/local/mesh/${encodeURIComponent(deviceId)}/connect`, issuer);
+    url.searchParams.set("version", machineLinkProtocolVersion);
+    return url;
+}
+const identitySchema = Schema.String.check(Schema.isMinLength(1), Schema.isMaxLength(256));
+/** Maintained decoder for the shared Post address, not delegation authority. */
+export const agentMailAddressSchema = Schema.Struct({
+    scopeId: identitySchema,
+    agentId: identitySchema,
+});
+/** Decode operation grammar without granting access to an Agent or Session. */
+export const machineAgentOperationSchema = Schema.Union([
+    Schema.Struct({
+        type: Schema.Literal("createSession"),
+        requestId: identitySchema,
+    }),
+    Schema.Struct({
+        type: Schema.Literal("settlement"),
+        requesterAgentId: identitySchema,
+        sessionId: identitySchema,
+        commandId: identitySchema,
+    }),
+]);
+/** Decode the request representation, not caller authority. */
+export const machineAgentRequestSchema = Schema.Struct({
+    actorAgentId: identitySchema,
+    operation: machineAgentOperationSchema,
+});
+/** Decode the bounded directory representation without admitting its entries. */
+export const machineDirectorySchema = Schema.Struct({
+    agents: Schema.Array(Schema.Struct({
+        agentId: identitySchema,
+        name: Schema.String.check(Schema.isMaxLength(256)),
+    })).check(Schema.isMaxLength(256)),
+});
+const leaveFrameSchema = Schema.Struct({
+    type: Schema.Literal("leave"),
+    agentId: identitySchema,
+});
+const readFrameSchema = Schema.Struct({
+    type: Schema.Literal("read"),
+    requestId: identitySchema,
+    agentId: identitySchema,
+    sessionId: identitySchema,
+    // Session.read() pages before its opaque oldestCursor, not after a stream.
+    before: Schema.optionalKey(Schema.String),
+    limit: Schema.Int.check(Schema.isGreaterThanOrEqualTo(1), Schema.isLessThanOrEqualTo(64)),
+});
+const controlFrameSchema = Schema.Union([leaveFrameSchema, readFrameSchema]);
+/** Decode JSON only; the host still owns device, member and Agent admission. */
+export function decodeMachineLinkControlFrame(text) {
+    if (new TextEncoder().encode(text).byteLength > 512 * 1024)
+        throw new RangeError("Machine link frame exceeds 512 KiB");
+    return Schema.decodeUnknownSync(Schema.fromJsonString(controlFrameSchema), {
+        onExcessProperty: "error",
+    })(text);
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fungi.computer/seam",
-  "version": "0.0.1",
+  "version": "0.2.0",
   "author": "Levi <levi@technomancy.dev>",
   "private": false,
   "description": "Ed25519 authentication between Fungi Hub and on-box hosts",
@@ -9,9 +9,16 @@
     ".": {
       "types": "./dist/index.d.ts",
       "import": "./dist/index.js"
+    },
+    "./machine-link-protocol": {
+      "types": "./dist/machine-link-protocol.d.ts",
+      "import": "./dist/machine-link-protocol.js"
     }
   },
-  "dependencies": {},
+  "dependencies": {
+    "@fungi.computer/carrier": "0.2.0",
+    "effect": "4.0.2"
+  },
   "license": "MIT",
   "repository": {
     "type": "git",