@openlfcp/shared-objects 0.2.2 → 0.3.1

package/dist/identity/schema.js

@@ -0,0 +1,271 @@
+import { UINT64_MAX } from "@openlfcp/core";
+import { pointerToken } from "../validate.js";
+import { isPrincipalRef, isReverseDomain, isUtcTimestamp, principalRef } from "../values.js";
+import { IdentityReader } from "./reader.js";
+import { IDENTITY_PROFILE_ID, isIdentityDescriptor, isResourceRef, } from "./values.js";
+export const IDENTITY_DIAGNOSTIC_ORDER = Object.freeze([
+    "INVALID_ROOT",
+    "MISSING_REQUIRED_FIELD",
+    "INVALID_FIELD_TYPE",
+    "INVALID_RESOURCE_REF",
+    "INVALID_PRINCIPAL_REF",
+    "INVALID_DESCRIPTOR",
+    "INVALID_ENUM_VALUE",
+    "INVALID_TIMESTAMP",
+    "INVALID_EXTENSION_NAMESPACE",
+]);
+const at = (base, key) => `${base}/${pointerToken(String(key))}`;
+const uint = ([type, value]) => type === "uint" &&
+    ((typeof value === "number" && Number.isSafeInteger(value) && value >= 0) ||
+        (typeof value === "bigint" && value >= 0n && value <= UINT64_MAX));
+const epochOrder = (a, b) => (a < b ? -1 : a > b ? 1 : 0);
+const textOrder = (a, b) => (a < b ? -1 : a > b ? 1 : 0);
+class Fields {
+    reader;
+    problems = new Map();
+    conflicts = new Set();
+    constructor(reader) {
+        this.reader = reader;
+    }
+    fail(diagnostic, pointer) {
+        const previous = this.problems.get(pointer);
+        if (previous !== undefined &&
+            IDENTITY_DIAGNOSTIC_ORDER.indexOf(previous.diagnostic) <=
+                IDENTITY_DIAGNOSTIC_ORDER.indexOf(diagnostic))
+            return;
+        this.problems.set(pointer, Object.freeze({
+            code: "PROFILE_INVALID",
+            diagnostic,
+            pointer,
+            message: `IDENTITY-PROFILE-01 §4: ${diagnostic} at ${pointer || "/"}`,
+        }));
+    }
+    field(obj, key, base, required, request) {
+        const values = this.reader.all(obj, key);
+        if (required && values.length === 0)
+            this.fail("MISSING_REQUIRED_FIELD", at(base, key));
+        if (request && values.length > 1)
+            this.conflicts.add(at(base, key));
+        return values;
+    }
+    finishEntry(base) {
+        const belongs = (p) => p === base || p.startsWith(`${base}/`);
+        // §4 rule 2: report invalid values first. A conflict is INVALID_FIELD_TYPE
+        // only when every concurrent value is valid on its own (including maps).
+        if ([...this.problems.keys()].some(belongs))
+            return;
+        for (const pointer of this.conflicts)
+            if (belongs(pointer))
+                this.fail("INVALID_FIELD_TYPE", pointer);
+    }
+    scalar(values, type, pointer, validate, diagnostic = "INVALID_FIELD_TYPE") {
+        for (const value of values) {
+            if (value[0] !== type)
+                this.fail("INVALID_FIELD_TYPE", pointer);
+            else if (validate !== undefined && !validate(value[1]))
+                this.fail(diagnostic, pointer);
+        }
+        return values[0]?.[1];
+    }
+    list(values, pointer, type, request, resource = false) {
+        const lists = [];
+        for (const [kind, id] of values) {
+            if (kind !== "list") {
+                this.fail("INVALID_FIELD_TYPE", pointer);
+                continue;
+            }
+            const result = [];
+            for (const [i, entries] of this.reader.list(String(id)).entries()) {
+                const pos = at(pointer, i);
+                if (request && entries.length > 1)
+                    this.conflicts.add(pos);
+                for (const entry of entries) {
+                    if (entry[0] !== type || (type === "uint" && !uint(entry)))
+                        this.fail("INVALID_FIELD_TYPE", pos);
+                    else if (resource && !isResourceRef(entry[1]))
+                        this.fail("INVALID_RESOURCE_REF", pos);
+                }
+                result.push(entries[0]?.[1]);
+            }
+            if (resource &&
+                (result.length === 0 || result.length > 64 || new Set(result).size !== result.length))
+                this.fail("INVALID_FIELD_TYPE", pointer);
+            lists.push(result);
+        }
+        return lists[0] ?? [];
+    }
+    entry(obj, key, table) {
+        const base = at(`/${table}`, key);
+        const request = table === "requests";
+        const roster = table === "roster";
+        const output = {};
+        if (roster ? !isResourceRef(key) : !isPrincipalRef(key))
+            this.fail(roster ? "INVALID_RESOURCE_REF" : "INVALID_PRINCIPAL_REF", base);
+        const required = roster
+            ? ["profile", "endpoints", "coordinator"]
+            : request
+                ? ["descriptor", "pairing", "label", "kind"]
+                : ["label", "kind"];
+        const strings = roster
+            ? ["profile", "coordinator", "name"]
+            : request
+                ? ["descriptor", "pairing", "label", "platform", "requested_at"]
+                : ["label", "platform", "added_at"];
+        const field = (name) => this.field(obj, name, base, required.includes(name), request);
+        for (const name of strings) {
+            const values = field(name);
+            if (values.length === 0)
+                continue;
+            const pointer = at(base, name);
+            output[name] = this.scalar(values, "str", pointer);
+            for (const [type, value] of values) {
+                if (type !== "str")
+                    continue;
+                if (name === "pairing" && !isPrincipalRef(value))
+                    this.fail("INVALID_PRINCIPAL_REF", pointer);
+                if (name === "descriptor" && !isIdentityDescriptor(String(value), key))
+                    this.fail("INVALID_DESCRIPTOR", pointer);
+                if ((name === "added_at" || name === "requested_at") && !isUtcTimestamp(value))
+                    this.fail("INVALID_TIMESTAMP", pointer);
+            }
+        }
+        if (roster)
+            output.endpoints = this.list(field("endpoints"), at(base, "endpoints"), "str", false);
+        else {
+            const kinds = field("kind");
+            if (kinds.length > 1)
+                this.conflicts.add(at(base, "kind"));
+            output.kind = this.scalar(kinds, "uint", at(base, "kind"), (v) => v === 0 || v === 1, "INVALID_ENUM_VALUE");
+            if (request) {
+                const scope = this.field(obj, "scope", base, kinds.some((v) => v[1] === 1), true);
+                if (scope.length > 0) {
+                    if (kinds.some((v) => v[1] === 0))
+                        this.fail("INVALID_FIELD_TYPE", at(base, "scope"));
+                    output.scope = this.list(scope, at(base, "scope"), "str", true, true);
+                }
+            }
+        }
+        const bool = roster ? "archived" : "revoked";
+        if (!request) {
+            const values = field(bool);
+            if (values.length > 0)
+                output[bool] = this.scalar(values, "boolean", at(base, bool));
+        }
+        if (table === "devices") {
+            const values = field("missing_keys");
+            const union = new Map();
+            for (const [type, id] of values) {
+                if (type !== "map") {
+                    this.fail("INVALID_FIELD_TYPE", at(base, "missing_keys"));
+                    continue;
+                }
+                for (const resource of this.reader.keys(String(id))) {
+                    const pointer = at(at(base, "missing_keys"), resource);
+                    if (!isResourceRef(resource))
+                        this.fail("INVALID_RESOURCE_REF", pointer);
+                    const epochs = union.get(resource) ?? new Set();
+                    for (const list of this.reader.all(String(id), resource)) {
+                        this.list([list], pointer, "uint", false);
+                        if (list[0] === "list")
+                            for (const items of this.reader.list(String(list[1])))
+                                for (const item of items)
+                                    if (uint(item))
+                                        epochs.add(item[1]);
+                    }
+                    union.set(resource, epochs);
+                }
+            }
+            if (values.length > 0)
+                output.missing_keys = Object.freeze(Object.fromEntries([...union]
+                    .sort(([a], [b]) => textOrder(a, b))
+                    .map(([k, v]) => [k, Object.freeze([...v].sort(epochOrder))])));
+        }
+        // Unknown request fields are preserved/ignored too, but any conflict invalidates a request.
+        if (request)
+            for (const name of this.reader.keys(obj))
+                if (this.reader.all(obj, name).length > 1)
+                    this.conflicts.add(at(base, name));
+        for (const value of Object.values(output))
+            if (Array.isArray(value))
+                Object.freeze(value);
+        return Object.freeze(output);
+    }
+}
+/** §4: validate every concurrent value; return only usable entries, never request winners. */
+export function validateIdentity(doc, root) {
+    const r = new IdentityReader(doc);
+    const f = new Fields(r);
+    const profiles = r.all("_root", "profile");
+    if (profiles.length !== 1 || profiles[0]?.[0] !== "str" || profiles[0][1] !== IDENTITY_PROFILE_ID)
+        f.fail("INVALID_ROOT", "/profile");
+    for (const key of ["identity", "roster", "devices", "requests", "extensions"])
+        if (r.map("_root", key) === undefined)
+            f.fail("INVALID_ROOT", at("", key));
+    const identity = r.map("_root", "identity");
+    if (identity !== undefined) {
+        const roots = r.all(identity, "root");
+        if (roots.length !== 1 || roots[0]?.[0] !== "str" || roots[0][1] !== principalRef(root))
+            f.fail("INVALID_ROOT", "/identity/root");
+    }
+    const usable = ![...f.problems.values()].some((p) => p.diagnostic === "INVALID_ROOT");
+    const extensions = r.map("_root", "extensions");
+    if (extensions !== undefined)
+        for (const key of r.keys(extensions))
+            if (!isReverseDomain(key))
+                f.fail("INVALID_EXTENSION_NAMESPACE", at("/extensions", key));
+    const tables = {};
+    for (const table of ["roster", "devices", "requests"]) {
+        const entries = [];
+        const container = r.map("_root", table);
+        if (container !== undefined)
+            for (const key of r.keys(container)) {
+                const base = at(`/${table}`, key);
+                const values = r.all(container, key);
+                if (table === "requests" && values.length > 1)
+                    f.conflicts.add(base);
+                const projections = [];
+                for (const [type, id] of values) {
+                    if (type !== "map")
+                        f.fail("INVALID_FIELD_TYPE", base);
+                    else
+                        projections.push(f.entry(String(id), key, table));
+                }
+                // Concurrent device maps also cannot disagree about kind; hints union across maps.
+                if (table === "devices" && new Set(projections.map((p) => p.kind)).size > 1)
+                    f.conflicts.add(at(base, "kind"));
+                f.finishEntry(base);
+                if (usable && ![...f.problems.keys()].some((p) => p === base || p.startsWith(`${base}/`))) {
+                    const first = projections[0];
+                    if (first !== undefined) {
+                        if (table === "devices" && projections.some((p) => p.missing_keys !== undefined)) {
+                            const union = new Map();
+                            for (const p of projections)
+                                for (const [ref, epochs] of Object.entries((p.missing_keys ?? {})))
+                                    union.set(ref, new Set([...(union.get(ref) ?? []), ...epochs]));
+                            entries.push([
+                                key,
+                                Object.freeze({
+                                    ...first,
+                                    missing_keys: Object.freeze(Object.fromEntries([...union]
+                                        .sort(([a], [b]) => textOrder(a, b))
+                                        .map(([k, v]) => [k, Object.freeze([...v].sort(epochOrder))]))),
+                                }),
+                            ]);
+                        }
+                        else
+                            entries.push([key, first]);
+                    }
+                }
+            }
+        tables[table] = Object.freeze(Object.fromEntries(entries));
+    }
+    return Object.freeze({
+        usable,
+        problems: Object.freeze([...f.problems.values()].sort((a, b) => IDENTITY_DIAGNOSTIC_ORDER.indexOf(a.diagnostic) -
+            IDENTITY_DIAGNOSTIC_ORDER.indexOf(b.diagnostic) || textOrder(a.pointer, b.pointer))),
+        roster: tables.roster,
+        devices: tables.devices,
+        requests: tables.requests,
+    });
+}
+//# sourceMappingURL=schema.js.map

package/dist/identity/values.d.ts

@@ -0,0 +1,56 @@
+import { type PrincipalId } from "@openlfcp/core";
+export declare const IDENTITY_PROFILE_ID = "org.openlfcp.identity.v1";
+export { deriveActorId as deriveIdentityActorId } from "../values.js";
+export type ResourceRef = string & {
+    readonly __resourceRef: true;
+};
+export declare function isResourceRef(value: unknown): value is ResourceRef;
+/** W §7 has exactly one deterministic encoding: a3, then 0/1/2 + bstr32. */
+export declare function isIdentityDescriptor(text: string, key: string): boolean;
+/** Supplied from the verified Identity Resource Control state at control_ref (§2.3). */
+export type IdentityWriterClass = "root" | "personal" | "pairing" | "other";
+export interface IdentityWriter {
+    readonly signer: PrincipalId;
+    /** The LFCP Data Unit actor sequence, not the Automerge sequence. */
+    readonly actorSeq: bigint | number;
+    readonly writerClass: IdentityWriterClass;
+}
+export interface RosterEntry {
+    readonly profile: string;
+    readonly endpoints: readonly string[];
+    readonly coordinator: string;
+    readonly name?: string;
+    readonly archived?: boolean;
+}
+export interface DeviceEntry {
+    readonly label: string;
+    readonly kind: 0 | 1;
+    readonly platform?: string;
+    readonly added_at?: string;
+    readonly revoked?: boolean;
+    /** Safe values are numbers; larger uint64 epochs are lossless bigints. */
+    readonly missing_keys?: Readonly<Record<string, readonly IdentityEpoch[]>>;
+}
+export type IdentityEpoch = bigint | number;
+export interface PairingRequest {
+    readonly descriptor: string;
+    readonly pairing: string;
+    readonly label: string;
+    readonly kind: 0 | 1;
+    readonly scope?: readonly string[];
+    readonly platform?: string;
+    readonly requested_at?: string;
+}
+/** Logical §2.1 document; the engine stores strings as ImmutableString, never Text. */
+export interface IdentityDocument {
+    readonly profile: typeof IDENTITY_PROFILE_ID;
+    readonly identity: {
+        readonly root: string;
+    };
+    readonly roster: Readonly<Record<string, RosterEntry>>;
+    readonly devices: Readonly<Record<string, DeviceEntry>>;
+    readonly requests: Readonly<Record<string, PairingRequest>>;
+    readonly extensions: Readonly<Record<string, unknown>>;
+    readonly [unknownKey: string]: unknown;
+}
+//# sourceMappingURL=values.d.ts.map

package/dist/identity/values.js

@@ -0,0 +1,41 @@
+import { bytesEqual, fromBase64url, toBase64url } from "@openlfcp/core";
+import { isValidEd25519PublicKey, sha256 } from "@openlfcp/crypto";
+export const IDENTITY_PROFILE_ID = "org.openlfcp.identity.v1";
+// IDENTITY-PROFILE-01 §2 inherits SOP §8 without changing its domain.
+export { deriveActorId as deriveIdentityActorId } from "../values.js";
+export function isResourceRef(value) {
+    if (typeof value !== "string" || value.length !== 43)
+        return false;
+    try {
+        return fromBase64url(value).length === 32;
+    }
+    catch {
+        return false;
+    }
+}
+/** W §7 has exactly one deterministic encoding: a3, then 0/1/2 + bstr32. */
+export function isIdentityDescriptor(text, key) {
+    try {
+        const bytes = fromBase64url(text);
+        if (bytes.length !== 106 || bytes[0] !== 0xa3)
+            return false;
+        for (let k = 0; k < 3; k++) {
+            const at = 1 + 35 * k;
+            if (bytes[at] !== k || bytes[at + 1] !== 0x58 || bytes[at + 2] !== 32)
+                return false;
+        }
+        const id = bytes.subarray(4, 36);
+        const ed = bytes.subarray(39, 71);
+        const x = bytes.subarray(74, 106);
+        const domain = Uint8Array.from("LFCP-PRINCIPAL-v1", (c) => c.charCodeAt(0));
+        const input = new Uint8Array(domain.length + 64);
+        input.set(domain);
+        input.set(ed, domain.length);
+        input.set(x, domain.length + 32);
+        return (key === `p:${toBase64url(id)}` && bytesEqual(id, sha256(input)) && isValidEd25519PublicKey(ed));
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=values.js.map

package/dist/replica.js

@@ -1,6 +1,6 @@
 import * as A from "@automerge/automerge";
 import { fromHex, LfcpError, toHex, } from "@openlfcp/core";
-import { checkChange, checkSaveHeader, parsedOf, unframeChange, unframeSnapshot, } from "./admission/framing.js";
+import { checkChange, checkSaveHeader, decodedOf, parsedOf, refusedChangeHash, unframeChange, unframeSnapshot, } from "./admission/framing.js";
 import { checkSnapshotExpansion, MAX_DOCUMENT_DEPTH, SNAPSHOT_LIMITS_FLOOR, } from "./admission/limits.js";
 import { referenceHistoryOf } from "./admission/references.js";
 import { admitBatch, admitChange } from "./admission/sequence.js";
@@ -540,7 +540,7 @@ export class SharedObjectsReplica {
         };
     }
     #createdDepths(change, prior) {
-        const decoded = A.decodeChange(change.bytes);
+        const decoded = decodedOf(change);
         const created = new Map();
         decoded.ops.forEach((op, i) => {
             if (!MAKE_ACTIONS.has(op.action))
@@ -577,7 +577,7 @@ export class SharedObjectsReplica {
             return path.length;
         }
         for (const bytes of A.getAllChanges(this.#doc)) {
-            const c = A.decodeChange(bytes);
+            const c = decodedOf(checkChange(bytes));
             c.ops.forEach((op, i) => {
                 if (!MAKE_ACTIONS.has(op.action))
                     return;
@@ -657,7 +657,7 @@ export class SharedObjectsReplica {
      */
     rebuildWithout(exclude) {
         const out = new Set(exclude);
-        const kept = A.getAllChanges(this.#doc).filter((c) => !out.has(A.decodeChange(c).hash));
+        const kept = A.getAllChanges(this.#doc).filter((c) => !out.has(checkChange(c).hash));
         return SharedObjectsReplica.fromChanges(kept, {
             resource: this.resource,
             principal: this.#principal,
@@ -835,8 +835,8 @@ export class SharedObjectsReplica {
         catch (e) {
             // §11.1: a writer never emits a change over the limits. The handle
             // this replica held is outdated by A.change: rebuild it without the change.
-            const hash = A.decodeChange(bytes).hash;
-            this.#doc = A.applyChanges(A.init({ actor: this.#actor }), A.getAllChanges(next).filter((c) => A.decodeChange(c).hash !== hash))[0];
+            const hash = refusedChangeHash(bytes);
+            this.#doc = A.applyChanges(A.init({ actor: this.#actor }), A.getAllChanges(next).filter((c) => refusedChangeHash(c) !== hash))[0];
             this.#refs = null;
             throw new LfcpError("CHANGE_TOO_LARGE", `the transaction "${message}" is larger than one change may be (§11.1: ${e.message}); split it into several (§12)`);
         }

package/dist/sections/dispatch.d.ts

@@ -1,3 +1,4 @@
+import { IDENTITY_PROFILE_ID } from "../identity/values.js";
 import { PROFILE_ID } from "../values.js";
 import { SECTIONS_PROFILE_ID } from "./values.js";
 /**
@@ -9,13 +10,16 @@ import { SECTIONS_PROFILE_ID } from "./values.js";
  * textual shape.
  */
 /** The models this package implements, by Data Profile. */
-export declare const SUPPORTED_DATA_PROFILES: readonly ["org.openlfcp.shared-objects.v1", "org.openlfcp.shared-sections.v1"];
+export declare const SUPPORTED_DATA_PROFILES: readonly ["org.openlfcp.shared-objects.v1", "org.openlfcp.shared-sections.v1", "org.openlfcp.identity.v1"];
 export type ProfileModel = {
     readonly kind: "shared-objects";
     readonly dataProfile: typeof PROFILE_ID;
 } | {
     readonly kind: "shared-sections";
     readonly dataProfile: typeof SECTIONS_PROFILE_ID;
+} | {
+    readonly kind: "identity";
+    readonly dataProfile: typeof IDENTITY_PROFILE_ID;
 }
 /**
  * LFCP-WIRE-01 §62: no model here reads this profile. The Resource is

package/dist/sections/dispatch.js

@@ -1,3 +1,4 @@
+import { IDENTITY_PROFILE_ID } from "../identity/values.js";
 import { PROFILE_ID } from "../values.js";
 import { SECTIONS_PROFILE_ID } from "./values.js";
 /**
@@ -9,12 +10,18 @@ import { SECTIONS_PROFILE_ID } from "./values.js";
  * textual shape.
  */
 /** The models this package implements, by Data Profile. */
-export const SUPPORTED_DATA_PROFILES = Object.freeze([PROFILE_ID, SECTIONS_PROFILE_ID]);
+export const SUPPORTED_DATA_PROFILES = Object.freeze([
+    PROFILE_ID,
+    SECTIONS_PROFILE_ID,
+    IDENTITY_PROFILE_ID,
+]);
 /**
  * The model of a Resource whose validated Genesis (its Control Chain state)
  * names `dataProfile`. Exact match only: no prefix, version or case folding.
  */
 export function profileModel(dataProfile) {
+    if (dataProfile === IDENTITY_PROFILE_ID)
+        return Object.freeze({ kind: "identity", dataProfile });
     if (dataProfile === PROFILE_ID)
         return Object.freeze({ kind: "shared-objects", dataProfile });
     if (dataProfile === SECTIONS_PROFILE_ID)
@@ -28,6 +35,12 @@ export function profileModel(dataProfile) {
  * Shared Objects Task.
  */
 export function taskRefModel(resourceDataProfile) {
+    if (resourceDataProfile === IDENTITY_PROFILE_ID)
+        return Object.freeze({
+            kind: "profile-unsupported",
+            code: "PROFILE_UNSUPPORTED",
+            dataProfile: resourceDataProfile,
+        });
     return profileModel(resourceDataProfile);
 }
 //# sourceMappingURL=dispatch.js.map

package/dist/sections/replica.js

@@ -101,7 +101,7 @@ const str = (v) => A.isImmutableString(v) ? v.toString() : typeof v === "string"
 const isListStyle = (s) => typeof s === "string" && LIST_STYLES.includes(s);
 const revisionOf = (doc) => [...A.getHeads(doc)].sort().join(",");
 /** `changes` without those of `batch` (by hash), in their order. */
-const withoutBatch = (changes, batch) => changes.filter((c) => !batch.has(A.decodeChange(c).hash));
+const withoutBatch = (changes, batch) => changes.filter((c) => !batch.has(checkChange(c).hash));
 /** Rebuilds a section document from the changes it held before an aborted apply. */
 function restoreSection(changes, actor, revision) {
     let restored;
@@ -198,7 +198,7 @@ export class SectionReplica {
      */
     rebuildWithout(exclude) {
         const out = new Set(exclude);
-        const kept = A.getAllChanges(this.#doc).filter((c) => !out.has(A.decodeChange(c).hash));
+        const kept = A.getAllChanges(this.#doc).filter((c) => !out.has(checkChange(c).hash));
         return SectionReplica.fromChanges(kept, {
             resource: this.resource,
             principal: this.#principal,
@@ -379,8 +379,7 @@ export class SectionReplica {
     #sequences() {
         if (this.#seqs === undefined) {
             this.#seqs = new Map();
-            for (const bytes of A.getAllChanges(this.#doc)) {
-                const c = A.decodeChange(bytes);
+            for (const c of A.getChangesMetaSince(this.#doc, [])) {
                 if (c.seq > (this.#seqs.get(c.actor) ?? 0))
                     this.#seqs.set(c.actor, c.seq);
             }

package/dist/sections/tree.js

@@ -1,4 +1,5 @@
 import * as A from "@automerge/automerge";
+import { checkChange, decodedOf } from "../admission/framing.js";
 import { distinctValues } from "../concurrent.js";
 import { validateSection } from "./schema.js";
 /** The Task scalar fields whose concurrent values tree() reports. */
@@ -183,7 +184,7 @@ export function deriveTree(doc, validation = validateSection(doc)) {
     });
 }
 const summarise = (bytes) => {
-    const c = A.decodeChange(bytes);
+    const c = decodedOf(checkChange(bytes));
     return {
         hash: c.hash,
         deps: c.deps,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openlfcp/shared-objects",
-  "version": "0.2.2",
+  "version": "0.3.1",
   "description": "SHARED-OBJECTS-PROFILE-01 (org.openlfcp.shared-objects.v1) implementation.",
   "keywords": [
     "openlfcp",
@@ -39,6 +39,10 @@
     "./sections": {
       "types": "./dist/sections/index.d.ts",
       "import": "./dist/sections/index.js"
+    },
+    "./identity": {
+      "types": "./dist/identity/index.d.ts",
+      "import": "./dist/identity/index.js"
     }
   },
   "files": [
@@ -53,8 +57,8 @@
   "dependencies": {
     "@automerge/automerge": "3.5.0",
     "fflate": "0.8.3",
-    "@openlfcp/core": "^0.2.2",
-    "@openlfcp/crypto": "^0.2.2"
+    "@openlfcp/core": "^0.3.1",
+    "@openlfcp/crypto": "^0.3.1"
   },
   "devDependencies": {
     "fast-check": "4.10.2"