@openlfcp/storage-node 0.2.2 → 0.3.1

package/README.md

@@ -5,7 +5,9 @@ Durable Node.js storage for LFCP clients (LFCP-035):
 - `SqliteLfcpStorage`, the `LfcpStorage` interface of `@openlfcp/storage` on
   SQLite through [better-sqlite3](https://github.com/WiseLibs/better-sqlite3)
   13.0.3;
-- `FileSecretStore`, a `SecretStore` in a local directory.
+- `FileSecretStore`, a `SecretStore` in a local directory;
+- `lfcp-node pair`, the headless pairing of a service device (a bridge or a
+  bot), on that storage and `@openlfcp/client`.
 
 **This package is Node only.** It is meant for headless Node clients, the CLI,
 the examples and tests. It is the only sdk-ts package allowed to use `node:*`
@@ -58,6 +60,48 @@ The driver ships prebuilt Node-API binaries for macOS, Linux (glibc and musl)
 and Windows on x64 and arm64. Installing needs no compiler and no install
 script, and the same binary loads in Electron's main process.
 
+## Headless pairing: `lfcp-node pair`
+
+A bridge or bot joins its human as a **service device** (IDENTITY-PROFILE-01
+§5.3 "Headless installation", §10): its own Principal and secret store,
+certificate kind 1, mask `{1, 2}` (the Service preset: read and write), only
+in the sections its human chose and the managing device approved. It never
+reads the Identity Resource's roster or device list and cannot invite,
+revoke, rotate, publish Snapshots, add devices or create Resources.
+
+```sh
+# The managing device shows a link ("Add my other device…"); pipe it in, so it
+# stays out of the shell history and the process list.
+lfcp-node pair - --state /var/lib/notes-bridge --label "notes bridge" \
+  --section "Notes" --section "Tasks" < link.txt
+```
+
+```text
+Fingerprint: bicr-ikmc-oec2-llzz
+Compare it with the fingerprint the approving device shows before approving.
+Requested: "notes bridge" (service) asks to join Notes, Tasks; access: read and write.
+Waiting for the approval on the managing device…
+Approved: Service (service device).
+  Notes: ready
+  Tasks: not granted
+```
+
+- `--state <dir>` holds this installation: `lfcp.sqlite`, `secrets/` and
+  `installation.json` (its Principal ID; the keys are in `secrets/`, created on
+  the first run). One directory is one installation: never copy it (W §7.1).
+- `--section <name>` (repeatable) names a section by its roster name; a name
+  that is not in the roster, or names several Resources, writes no request
+  (exit 4, with the names it may ask for). `--personal` pairs a personal
+  device instead (the approver picks its preset).
+- The approver compares the fingerprint, may remove sections (never add any),
+  and approves. The result comes from the chain alone: `--wait <seconds>`
+  (default 600) bounds how long the command waits, and a timeout is never a
+  decision. Run the same command again to resume: the request is journaled,
+  and after the approval the link is no longer needed.
+- Exit codes: 0 approved and every section ready or not granted; 1 the link
+  is rejected or the request refused; 2 rejected by the managing device; 3
+  still waiting; 4 unknown sections; 64 usage.
+
 ## Secrets
 
 ```ts

package/dist/cli.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=cli.d.ts.map

package/dist/cli.js

@@ -0,0 +1,9 @@
+#!/usr/bin/env node
+// lfcp-node: the headless commands of @openlfcp/storage-node. `pair` pairs
+// this installation as a service device (IDENTITY-PROFILE-01 §5.3).
+import { main, readStdin } from "./pair.js";
+process.exitCode = await main(process.argv.slice(2), {
+    out: (line) => process.stdout.write(`${line}\n`),
+    stdin: readStdin,
+});
+//# sourceMappingURL=cli.js.map

package/dist/identity-document.d.ts

@@ -0,0 +1,4 @@
+import type { IdentityDocumentFactory } from "@openlfcp/client";
+/** A fresh document of Identity Resource `resource` owned by `root`, for one flow. */
+export declare const identityDocument: IdentityDocumentFactory;
+//# sourceMappingURL=identity-document.d.ts.map

package/dist/identity-document.js

@@ -0,0 +1,28 @@
+// The Identity Resource document (IDENTITY-PROFILE-01 §§2–4) for the
+// headless identity flows: @openlfcp/client's IdentityDocumentPort over
+// @openlfcp/shared-objects' IdentityReplica, the same document every
+// identity-aware client reads and writes.
+import { IdentityReplica, identityCodec, } from "@openlfcp/shared-objects/identity";
+/** A fresh document of Identity Resource `resource` owned by `root`, for one flow. */
+export const identityDocument = (resource, root) => {
+    const replica = IdentityReplica.empty({ resource, root });
+    const writer = (a) => ({
+        signer: a.signer,
+        actorSeq: a.actorSeq,
+        writerClass: a.writerClass,
+    });
+    const map = (o) => new Map(Object.entries(o));
+    return {
+        write: (author, intents) => identityCodec.encode(replica.write(writer(author), intents)),
+        receive: (plaintext, author) => {
+            const r = replica.receive(plaintext, writer(author));
+            return r.admitted.length + r.duplicates.length > 0;
+        },
+        initialized: () => replica.validate().usable && replica.heads().length > 0,
+        roster: () => map(replica.validate().roster),
+        devices: () => map(replica.validate().devices),
+        requests: () => map(replica.validate().requests),
+        origins: (table, key) => replica.origins(table, key),
+    };
+};
+//# sourceMappingURL=identity-document.js.map

package/dist/index.d.ts

@@ -2,9 +2,13 @@
  * Durable Node.js storage for LFCP clients (LFCP-035): LfcpStorage on
  * SQLite and a file SecretStore. Node only: for headless Node, the CLI,
  * examples and tests. Obsidian uses its own adapter (LFCP-059), which runs
- * the same contract suite.
+ * the same contract suite. Also the headless `lfcp-node pair` command of a
+ * service device (IDENTITY-PROFILE-01 §5.3, LFCP-04-412).
  */
 export declare const PACKAGE = "@openlfcp/storage-node";
+export { identityDocument } from "./identity-document.js";
+export { openInstallation } from "./installation.js";
+export { main, PAIR_EXIT, PAIR_USAGE, type PairArguments, type PairEnvironment, pair, parsePairArguments, } from "./pair.js";
 export { MIGRATIONS, migrate, SCHEMA_VERSION, schemaVersion } from "./schema.js";
 export { FileSecretStore } from "./secrets.js";
 export { SqliteLfcpStorage, type SqliteLocalState, type SqliteStorageOptions, } from "./sqlite.js";

package/dist/index.js

@@ -2,9 +2,13 @@
  * Durable Node.js storage for LFCP clients (LFCP-035): LfcpStorage on
  * SQLite and a file SecretStore. Node only: for headless Node, the CLI,
  * examples and tests. Obsidian uses its own adapter (LFCP-059), which runs
- * the same contract suite.
+ * the same contract suite. Also the headless `lfcp-node pair` command of a
+ * service device (IDENTITY-PROFILE-01 §5.3, LFCP-04-412).
  */
 export const PACKAGE = "@openlfcp/storage-node";
+export { identityDocument } from "./identity-document.js";
+export { openInstallation } from "./installation.js";
+export { main, PAIR_EXIT, PAIR_USAGE, pair, parsePairArguments, } from "./pair.js";
 export { MIGRATIONS, migrate, SCHEMA_VERSION, schemaVersion } from "./schema.js";
 export { FileSecretStore } from "./secrets.js";
 export { SqliteLfcpStorage, } from "./sqlite.js";

package/dist/installation.d.ts

@@ -0,0 +1,5 @@
+import type { Installation } from "@openlfcp/client";
+import { type SecretStore } from "@openlfcp/storage";
+/** This state directory's installation, created on first use. */
+export declare function openInstallation(dir: string, secrets: SecretStore): Promise<Installation>;
+//# sourceMappingURL=installation.d.ts.map

package/dist/installation.js

@@ -0,0 +1,57 @@
+// The installation's own Principal for a headless client (LFCP-04-412): its
+// Ed25519 and X25519 keys in the SecretStore (principalKeySecretRef), its
+// public Principal ID in <state>/installation.json. Created once, on the
+// first run; a copied state directory is a misconfiguration (a Principal
+// has exactly one writing installation, W §7.1).
+import { existsSync, readFileSync, renameSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { fromHex, principalId, toHex } from "@openlfcp/core";
+import { exportSecretKeyBytes, generateAgreementKeyPair, generateSigningKeyPair, importAgreementKey, importSigningKey, } from "@openlfcp/crypto";
+import { principalKeySecretRef } from "@openlfcp/storage";
+import { principalDescriptorFromKeys } from "@openlfcp/wire";
+const FILE = "installation.json";
+/** This state directory's installation, created on first use. */
+export async function openInstallation(dir, secrets) {
+    const path = join(dir, FILE);
+    if (existsSync(path)) {
+        const { principal } = JSON.parse(readFileSync(path, "utf8"));
+        const id = principalId(fromHex(principal));
+        const seed = await secrets.get(principalKeySecretRef(id, "signing"));
+        const scalar = await secrets.get(principalKeySecretRef(id, "agreement"));
+        if (seed === undefined || scalar === undefined)
+            throw new Error(`the keys of installation ${principal} are missing`);
+        try {
+            const key = importSigningKey(seed);
+            const agreement = importAgreementKey(scalar);
+            const descriptor = principalDescriptorFromKeys(key, agreement);
+            if (toHex(descriptor.principalId) !== principal)
+                throw new Error(`the keys do not derive installation ${principal}`);
+            return { signer: { key, descriptor }, agreement };
+        }
+        finally {
+            seed.fill(0);
+            scalar.fill(0);
+        }
+    }
+    const key = generateSigningKeyPair();
+    const agreement = generateAgreementKeyPair();
+    const descriptor = principalDescriptorFromKeys(key, agreement);
+    const id = descriptor.principalId;
+    for (const [which, k] of [
+        ["signing", key],
+        ["agreement", agreement],
+    ]) {
+        const bytes = exportSecretKeyBytes(k);
+        try {
+            await secrets.put(principalKeySecretRef(id, which), bytes);
+        }
+        finally {
+            bytes.fill(0);
+        }
+    }
+    // The keys are durable before the ID names them.
+    writeFileSync(`${path}.tmp`, `${JSON.stringify({ principal: toHex(id) })}\n`, { mode: 0o600 });
+    renameSync(`${path}.tmp`, path);
+    return { signer: { key, descriptor }, agreement };
+}
+//# sourceMappingURL=installation.js.map

package/dist/pair.d.ts

@@ -0,0 +1,51 @@
+import { type IdentityNetwork } from "@openlfcp/client";
+/** Exit codes of `lfcp-node pair`. */
+export declare const PAIR_EXIT: Readonly<{
+    /** Approved, and every requested section is ready or not granted. */
+    readonly DONE: 0;
+    /** An error: the link is rejected, the request refused, the state unusable. */
+    readonly FAILED: 1;
+    /** The session was cancelled by the managing device: rejected (final). */
+    readonly REJECTED: 2;
+    /** Still waiting (approval, registration or keys) when --wait ran out: run again to resume. */
+    readonly WAITING: 3;
+    /** A requested section is not in the roster, or names several Resources. */
+    readonly UNKNOWN_SECTIONS: 4;
+    /** Bad arguments. */
+    readonly USAGE: 64;
+}>;
+export interface PairArguments {
+    /** The pairing link, or "-" to read it from standard input (never from the shell history). */
+    readonly link: string;
+    /** The state directory: SQLite storage, secrets and the installation's Principal. */
+    readonly state: string;
+    readonly label: string;
+    /** 1 service (the default), 0 personal. */
+    readonly kind: 0 | 1;
+    /** Service: the requested sections by roster name. */
+    readonly sections: readonly string[];
+    readonly platform: string;
+    /** Seconds to wait for the result before exiting with WAITING; 0 sends the request only. */
+    readonly wait: number;
+    /** Seconds between two checks of the result. */
+    readonly poll: number;
+}
+export declare const PAIR_USAGE = "usage: lfcp-node pair <link|-> --state <dir> --label <label>\n                      [--section <roster name>]... [--personal]\n                      [--platform <name>] [--wait <seconds>] [--poll <seconds>]\n\nPairs this installation as a service device of the human whose managing\ndevice shows the link (IDENTITY-PROFILE-01 \u00A75.3). Prints the fingerprint to\ncompare with that device's screen, then waits for the approval. \"-\" reads the\nlink from standard input. Run the same command again to resume.";
+/** Parses the arguments after "pair"; a string is the usage error. */
+export declare function parsePairArguments(argv: readonly string[]): PairArguments | string;
+export interface PairEnvironment {
+    /** One line of output for the human (never the link). */
+    readonly out: (line: string) => void;
+    /** Standard input, for a link given as "-". */
+    readonly stdin?: () => string;
+    readonly network?: IdentityNetwork;
+    readonly now?: () => number;
+    readonly sleep?: (ms: number) => Promise<void>;
+}
+/** Runs `lfcp-node pair` with parsed arguments; returns its exit code. */
+export declare function pair(args: PairArguments, env: PairEnvironment): Promise<number>;
+/** `lfcp-node <command> ...`: the entry point of the bin; returns the exit code. */
+export declare function main(argv: readonly string[], env: PairEnvironment): Promise<number>;
+/** Standard input as text (for "-"). */
+export declare const readStdin: () => string;
+//# sourceMappingURL=pair.d.ts.map

package/dist/pair.js

@@ -0,0 +1,260 @@
+// `lfcp-node pair`: headless pairing of a new installation, the service
+// device of a bridge or bot (IDENTITY-PROFILE-01 §5.3 "Headless
+// installation", §10 service devices, decision I6). The label and the
+// requested sections (by roster name) are arguments, the fingerprint is
+// printed for the human to compare with the approving device's screen,
+// and the result is learned from the chain alone (§5.3 step 8); a timeout
+// is never a decision, and a rerun resumes from the journal.
+//
+// Public @openlfcp/client API only: requestPairing, completePairing and
+// the operation journal, over SQLite storage and a file SecretStore.
+import { mkdirSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+import { completePairing, connectionNetwork, MASK_PRESETS, OperationJournal, PairingLinkText, requestPairing, } from "@openlfcp/client";
+import { toBase64url } from "@openlfcp/core";
+import { DEVICE_KIND, deviceFingerprint } from "@openlfcp/wire";
+import { identityDocument } from "./identity-document.js";
+import { openInstallation } from "./installation.js";
+import { FileSecretStore } from "./secrets.js";
+import { SqliteLfcpStorage } from "./sqlite.js";
+/** Exit codes of `lfcp-node pair`. */
+export const PAIR_EXIT = Object.freeze({
+    /** Approved, and every requested section is ready or not granted. */
+    DONE: 0,
+    /** An error: the link is rejected, the request refused, the state unusable. */
+    FAILED: 1,
+    /** The session was cancelled by the managing device: rejected (final). */
+    REJECTED: 2,
+    /** Still waiting (approval, registration or keys) when --wait ran out: run again to resume. */
+    WAITING: 3,
+    /** A requested section is not in the roster, or names several Resources. */
+    UNKNOWN_SECTIONS: 4,
+    /** Bad arguments. */
+    USAGE: 64,
+});
+export const PAIR_USAGE = `usage: lfcp-node pair <link|-> --state <dir> --label <label>
+                      [--section <roster name>]... [--personal]
+                      [--platform <name>] [--wait <seconds>] [--poll <seconds>]
+
+Pairs this installation as a service device of the human whose managing
+device shows the link (IDENTITY-PROFILE-01 §5.3). Prints the fingerprint to
+compare with that device's screen, then waits for the approval. "-" reads the
+link from standard input. Run the same command again to resume.`;
+/** Parses the arguments after "pair"; a string is the usage error. */
+export function parsePairArguments(argv) {
+    let link;
+    let state;
+    let label;
+    let kind = 1;
+    let platform = "server";
+    let wait = 600;
+    let poll = 5;
+    const sections = [];
+    const seconds = (name, v) => {
+        const n = Number(v);
+        return v !== undefined && Number.isInteger(n) && n >= 0 ? n : `${name} needs whole seconds`;
+    };
+    for (let i = 0; i < argv.length; i++) {
+        const a = argv[i];
+        const value = () => argv[++i];
+        switch (a) {
+            case "--state":
+                state = value();
+                break;
+            case "--label":
+                label = value();
+                break;
+            case "--section": {
+                const s = value();
+                if (s === undefined || s === "")
+                    return "--section needs a roster name";
+                sections.push(s);
+                break;
+            }
+            case "--personal":
+                kind = 0;
+                break;
+            case "--platform": {
+                const p = value();
+                if (p === undefined || p === "")
+                    return "--platform needs a name";
+                platform = p;
+                break;
+            }
+            case "--wait": {
+                const n = seconds("--wait", value());
+                if (typeof n === "string")
+                    return n;
+                wait = n;
+                break;
+            }
+            case "--poll": {
+                const n = seconds("--poll", value());
+                if (typeof n === "string")
+                    return n;
+                if (n === 0)
+                    return "--poll needs at least one second";
+                poll = n;
+                break;
+            }
+            default:
+                if (a.startsWith("--"))
+                    return `unknown option ${a}`;
+                if (link !== undefined)
+                    return "one link only";
+                link = a;
+        }
+    }
+    if (link === undefined)
+        return "the pairing link is missing";
+    if (state === undefined || state === "")
+        return "--state is missing";
+    if (label === undefined || label === "")
+        return "--label is missing";
+    if (kind === 1 && sections.length === 0)
+        return "a service device needs at least one --section (or --personal)";
+    if (kind === 0 && sections.length > 0)
+        return "--section is for a service device only";
+    return { link, state, label, kind, sections, platform, wait, poll };
+}
+const defaultSleep = (ms) => new Promise((r) => setTimeout(r, ms));
+/** A reply timeout that does not keep the process alive once the command is done. */
+const replyTimeout = (ms) => new Promise((r) => {
+    setTimeout(r, ms).unref();
+});
+/** The preset a certificate's kind and mask are, by IDENTITY-PROFILE-01 §5.4. */
+function presetOf(kind, mask) {
+    const same = (a) => a.length === mask.length && a.every((c) => mask.includes(c));
+    for (const [name, p] of Object.entries(MASK_PRESETS))
+        if (p.kind === kind && same(p.mask))
+            return `${name[0]?.toUpperCase()}${name.slice(1)}`;
+    return `kind ${kind}, mask {${[...mask].sort((a, b) => (a < b ? -1 : 1)).join(", ")}}`;
+}
+const STATUS = {
+    ready: "ready",
+    "waiting-for-keys": "waiting for keys",
+    "pending-registration": "pending registration",
+    "not-granted": "not granted",
+    unproven: "approval not provable here",
+    unreachable: "unreachable, retrying",
+    unsupported: "on a server without device support",
+};
+const FINAL = new Set(["ready", "not-granted"]);
+/** Runs `lfcp-node pair` with parsed arguments; returns its exit code. */
+export async function pair(args, env) {
+    const out = env.out;
+    const now = env.now ?? (() => Date.now());
+    const sleep = env.sleep ?? defaultSleep;
+    const network = env.network ?? connectionNetwork({ now, timeout: () => replyTimeout(30_000) });
+    mkdirSync(args.state, { recursive: true, mode: 0o700 });
+    const secrets = new FileSecretStore(join(args.state, "secrets"));
+    const storage = SqliteLfcpStorage.open(join(args.state, "lfcp.sqlite"));
+    try {
+        const installation = await openInstallation(args.state, secrets);
+        const flow = { installation, storage, secrets, network, now, document: identityDocument };
+        const fingerprint = deviceFingerprint(installation.signer.descriptor.principalId);
+        const journal = new OperationJournal(storage);
+        // A request already made by this installation is resumed from the journal, link or not.
+        let operation = (await journal.list({ kind: "pairing-request", status: "open" }))[0]?.id;
+        if (operation === undefined) {
+            const text = args.link === "-" ? (env.stdin?.() ?? "").trim() : args.link;
+            const r = await requestPairing({
+                ...flow,
+                link: new PairingLinkText(text),
+                label: args.label,
+                kind: args.kind,
+                ...(args.kind === 1 ? { sections: args.sections } : {}),
+                platform: args.platform,
+                requestedAt: new Date(now()).toISOString().replace(/\.\d{3}Z$/, "Z"),
+            });
+            switch (r.kind) {
+                case "requested":
+                    operation = r.operation;
+                    break;
+                case "unknown-sections":
+                    out(`Not in the roster, or ambiguous: ${r.unknown.join(", ")}`);
+                    out(`Sections this device may ask for: ${r.available.join(", ") || "(none)"}`);
+                    return PAIR_EXIT.UNKNOWN_SECTIONS;
+                case "invalid-link":
+                case "not-a-session":
+                    out(`The link is rejected: ${r.reason}`);
+                    return PAIR_EXIT.FAILED;
+                case "missing-material":
+                    out(`The managing device has not made the session usable yet: ${r.missing.join(", ")}`);
+                    return PAIR_EXIT.FAILED;
+                case "refused":
+                    out(`The request was refused (${r.code}).`);
+                    return PAIR_EXIT.FAILED;
+                case "unavailable":
+                    out(`The server could not be reached: ${r.reason}. Run again to retry.`);
+                    return PAIR_EXIT.WAITING;
+            }
+            out(`Fingerprint: ${fingerprint}`);
+            out("Compare it with the fingerprint the approving device shows before approving.");
+            out(args.kind === 1
+                ? `Requested: "${args.label}" (service) asks to join ${args.sections.join(", ")}; access: read and write.`
+                : `Requested: "${args.label}" (personal device).`);
+        }
+        else {
+            out(`Fingerprint: ${fingerprint}`);
+            out("Resuming the pairing request of this installation.");
+        }
+        const deadline = now() + args.wait * 1000;
+        let last = "";
+        const say = (line) => {
+            if (line !== last)
+                out(line);
+            last = line;
+        };
+        for (;;) {
+            const r = await completePairing({ ...flow, operation });
+            if (r.kind === "rejected") {
+                say("Rejected: the managing device cancelled the session.");
+                return PAIR_EXIT.REJECTED;
+            }
+            if (r.kind === "waiting")
+                say("Waiting for the approval on the managing device…");
+            else if (r.kind === "unknown" || r.kind === "unavailable")
+                say(`Waiting: ${r.reason} (retrying).`);
+            else if (r.certificate === null)
+                say("Approved, waiting for registration…");
+            else {
+                const leaf = r.certificate.leaf.payload;
+                const lines = [
+                    `Approved: ${presetOf(leaf.kind, leaf.mask)}${leaf.kind === DEVICE_KIND.SERVICE ? " (service device)" : ""}.`,
+                    ...r.candidates.map((c) => `  ${c.name ?? toBase64url(c.resource)}: ${STATUS[c.status] ?? c.status}`),
+                ];
+                if (r.foreignCertificates > 0)
+                    lines.push(`  ${r.foreignCertificates} certificate(s) with another approval: not used.`);
+                say(lines.join("\n"));
+                if (r.candidates.length > 0 && r.candidates.every((c) => FINAL.has(c.status)))
+                    return PAIR_EXIT.DONE;
+            }
+            if (now() >= deadline) {
+                out("Not finished yet; run the same command again to resume.");
+                return PAIR_EXIT.WAITING;
+            }
+            await sleep(args.poll * 1000);
+        }
+    }
+    finally {
+        storage.close();
+    }
+}
+/** `lfcp-node <command> ...`: the entry point of the bin; returns the exit code. */
+export async function main(argv, env) {
+    const [command, ...rest] = argv;
+    if (command !== "pair") {
+        env.out(PAIR_USAGE);
+        return PAIR_EXIT.USAGE;
+    }
+    const args = parsePairArguments(rest);
+    if (typeof args === "string") {
+        env.out(`${args}\n\n${PAIR_USAGE}`);
+        return PAIR_EXIT.USAGE;
+    }
+    return pair(args, env);
+}
+/** Standard input as text (for "-"). */
+export const readStdin = () => readFileSync(0, "utf8");
+//# sourceMappingURL=pair.js.map

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@openlfcp/storage-node",
-  "version": "0.2.2",
-  "description": "Durable Node.js storage for LFCP clients: SQLite (better-sqlite3) and a file secret store. Node only.",
+  "version": "0.3.1",
+  "description": "Durable Node.js storage for LFCP clients: SQLite (better-sqlite3) and a file secret store; the headless `lfcp-node pair` command. Node only.",
   "keywords": [
     "openlfcp",
     "lfcp",
@@ -32,6 +32,9 @@
       "import": "./dist/index.js"
     }
   },
+  "bin": {
+    "lfcp-node": "./dist/cli.js"
+  },
   "files": [
     "dist",
     "!dist/**/*.map",
@@ -43,8 +46,12 @@
   },
   "dependencies": {
     "better-sqlite3": "13.0.3",
-    "@openlfcp/core": "^0.2.2",
-    "@openlfcp/storage": "^0.2.2"
+    "@openlfcp/core": "^0.3.1",
+    "@openlfcp/client": "^0.3.1",
+    "@openlfcp/storage": "^0.3.1",
+    "@openlfcp/crypto": "^0.3.1",
+    "@openlfcp/wire": "^0.3.1",
+    "@openlfcp/shared-objects": "^0.3.1"
   },
   "devDependencies": {
     "@types/better-sqlite3": "9.6.0",