diff --git a/package-lock.json b/package-lock.json
index fbb7c9f..de0e48b 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -16,15 +16,19 @@
         "@ipld/dag-ucan": "^3.4.0",
         "@ucanto/client": "^9.0.1",
         "@ucanto/core": "^10.0.1",
+        "@ucanto/principal": "^9.0.1",
         "@ucanto/transport": "^9.1.1",
         "@web3-storage/access": "^20.0.0",
+        "@web3-storage/capabilities": "^17.2.0",
         "@web3-storage/data-segment": "^5.0.0",
         "@web3-storage/did-mailto": "^2.1.0",
         "@web3-storage/w3up-client": "^14.1.1",
         "ansi-escapes": "^6.2.0",
         "chalk": "^5.3.0",
+        "crypto-random-string": "^5.0.0",
         "files-from-path": "^1.0.4",
         "fr32-sha2-256-trunc254-padded-binary-tree-multihash": "^3.3.0",
+        "multiformats": "^13.1.3",
         "open": "^9.1.0",
         "ora": "^7.0.1",
         "pretty-tree": "^1.0.0",
@@ -39,15 +43,12 @@
       "devDependencies": {
         "@types/update-notifier": "^6.0.5",
         "@ucanto/interface": "^10.0.1",
-        "@ucanto/principal": "^9.0.1",
         "@ucanto/server": "^10.0.0",
         "@web-std/blob": "^3.0.5",
-        "@web3-storage/capabilities": "17.1.1",
         "@web3-storage/eslint-config-w3up": "^1.0.0",
         "@web3-storage/sigv4": "^1.0.2",
         "@web3-storage/upload-api": "^17.0.0",
         "entail": "^2.1.1",
-        "multiformats": "^13.1.1",
         "npm-run-all": "^4.1.5",
         "prettier": "^3.0.3",
         "typescript": "^5.2.2"
@@ -1705,9 +1706,9 @@
       }
     },
     "node_modules/@web3-storage/capabilities": {
-      "version": "17.1.1",
-      "resolved": "https://registry.npmjs.org/@web3-storage/capabilities/-/capabilities-17.1.1.tgz",
-      "integrity": "sha512-zmDGBN7/HMt8FUZhg+hdc7CHrYBzV2PaRJToPN0mA496EH1rbNY7c1a8eYxqhM1OugoWohCKH6YOdS3V+Eyxig==",
+      "version": "17.2.0",
+      "resolved": "https://registry.npmjs.org/@web3-storage/capabilities/-/capabilities-17.2.0.tgz",
+      "integrity": "sha512-hnJGIQcCAMBbR8sfgkEwnjBVcpNpNRBnzSEB2E/wKkKIjHKimw3ClsVznu6jjFExCXFaKHd6r1eAU4NcTYsueg==",
       "dependencies": {
         "@ucanto/core": "^10.0.1",
         "@ucanto/interface": "^10.0.1",
@@ -1985,39 +1986,6 @@
         "varint": "^6.0.0"
       }
     },
-    "node_modules/@web3-storage/upload-client/node_modules/@web3-storage/capabilities": {
-      "version": "17.2.0",
-      "resolved": "https://registry.npmjs.org/@web3-storage/capabilities/-/capabilities-17.2.0.tgz",
-      "integrity": "sha512-hnJGIQcCAMBbR8sfgkEwnjBVcpNpNRBnzSEB2E/wKkKIjHKimw3ClsVznu6jjFExCXFaKHd6r1eAU4NcTYsueg==",
-      "dependencies": {
-        "@ucanto/core": "^10.0.1",
-        "@ucanto/interface": "^10.0.1",
-        "@ucanto/principal": "^9.0.1",
-        "@ucanto/transport": "^9.1.1",
-        "@ucanto/validator": "^9.0.2",
-        "@web3-storage/data-segment": "^3.2.0",
-        "uint8arrays": "^5.0.3"
-      }
-    },
-    "node_modules/@web3-storage/upload-client/node_modules/@web3-storage/capabilities/node_modules/@web3-storage/data-segment": {
-      "version": "3.2.0",
-      "resolved": "https://registry.npmjs.org/@web3-storage/data-segment/-/data-segment-3.2.0.tgz",
-      "integrity": "sha512-SM6eNumXzrXiQE2/J59+eEgCRZNYPxKhRoHX2QvV3/scD4qgcf4g+paWBc3UriLEY1rCboygGoPsnqYJNyZyfA==",
-      "dependencies": {
-        "@ipld/dag-cbor": "^9.0.5",
-        "multiformats": "^11.0.2",
-        "sync-multihash-sha2": "^1.0.0"
-      }
-    },
-    "node_modules/@web3-storage/upload-client/node_modules/@web3-storage/capabilities/node_modules/multiformats": {
-      "version": "11.0.2",
-      "resolved": "https://registry.npmjs.org/multiformats/-/multiformats-11.0.2.tgz",
-      "integrity": "sha512-b5mYMkOkARIuVZCpvijFj9a6m5wMVLC7cf/jIPd5D/ARDOfLC5+IFkbgDXQgcU2goIsTD/O9NY4DI/Mt4OGvlg==",
-      "engines": {
-        "node": ">=16.0.0",
-        "npm": ">=7.0.0"
-      }
-    },
     "node_modules/@web3-storage/upload-client/node_modules/@web3-storage/data-segment": {
       "version": "5.1.0",
       "resolved": "https://registry.npmjs.org/@web3-storage/data-segment/-/data-segment-5.1.0.tgz",
@@ -2046,19 +2014,6 @@
         "npm": ">=7.0.0"
       }
     },
-    "node_modules/@web3-storage/upload-client/node_modules/uint8arrays": {
-      "version": "5.1.0",
-      "resolved": "https://registry.npmjs.org/uint8arrays/-/uint8arrays-5.1.0.tgz",
-      "integrity": "sha512-vA6nFepEmlSKkMBnLBaUMVvAC4G3CTmO58C12y4sq6WPDOR7mOFYOi7GlrQ4djeSbP6JG9Pv9tJDM97PedRSww==",
-      "dependencies": {
-        "multiformats": "^13.0.0"
-      }
-    },
-    "node_modules/@web3-storage/upload-client/node_modules/uint8arrays/node_modules/multiformats": {
-      "version": "13.1.1",
-      "resolved": "https://registry.npmjs.org/multiformats/-/multiformats-13.1.1.tgz",
-      "integrity": "sha512-JiptvwMmlxlzIlLLwhCi/srf/nk409UL0eUBr0kioRJq15hqqKyg68iftrBvhCRjR6Rw4fkNnSc4ZJXJDuta/Q=="
-    },
     "node_modules/@web3-storage/w3up-client": {
       "version": "14.1.1",
       "resolved": "https://registry.npmjs.org/@web3-storage/w3up-client/-/w3up-client-14.1.1.tgz",
@@ -2081,47 +2036,6 @@
         "node": ">=18"
       }
     },
-    "node_modules/@web3-storage/w3up-client/node_modules/@web3-storage/capabilities": {
-      "version": "17.2.0",
-      "resolved": "https://registry.npmjs.org/@web3-storage/capabilities/-/capabilities-17.2.0.tgz",
-      "integrity": "sha512-hnJGIQcCAMBbR8sfgkEwnjBVcpNpNRBnzSEB2E/wKkKIjHKimw3ClsVznu6jjFExCXFaKHd6r1eAU4NcTYsueg==",
-      "dependencies": {
-        "@ucanto/core": "^10.0.1",
-        "@ucanto/interface": "^10.0.1",
-        "@ucanto/principal": "^9.0.1",
-        "@ucanto/transport": "^9.1.1",
-        "@ucanto/validator": "^9.0.2",
-        "@web3-storage/data-segment": "^3.2.0",
-        "uint8arrays": "^5.0.3"
-      }
-    },
-    "node_modules/@web3-storage/w3up-client/node_modules/@web3-storage/data-segment": {
-      "version": "3.2.0",
-      "resolved": "https://registry.npmjs.org/@web3-storage/data-segment/-/data-segment-3.2.0.tgz",
-      "integrity": "sha512-SM6eNumXzrXiQE2/J59+eEgCRZNYPxKhRoHX2QvV3/scD4qgcf4g+paWBc3UriLEY1rCboygGoPsnqYJNyZyfA==",
-      "dependencies": {
-        "@ipld/dag-cbor": "^9.0.5",
-        "multiformats": "^11.0.2",
-        "sync-multihash-sha2": "^1.0.0"
-      }
-    },
-    "node_modules/@web3-storage/w3up-client/node_modules/@web3-storage/data-segment/node_modules/multiformats": {
-      "version": "11.0.2",
-      "resolved": "https://registry.npmjs.org/multiformats/-/multiformats-11.0.2.tgz",
-      "integrity": "sha512-b5mYMkOkARIuVZCpvijFj9a6m5wMVLC7cf/jIPd5D/ARDOfLC5+IFkbgDXQgcU2goIsTD/O9NY4DI/Mt4OGvlg==",
-      "engines": {
-        "node": ">=16.0.0",
-        "npm": ">=7.0.0"
-      }
-    },
-    "node_modules/@web3-storage/w3up-client/node_modules/uint8arrays": {
-      "version": "5.1.0",
-      "resolved": "https://registry.npmjs.org/uint8arrays/-/uint8arrays-5.1.0.tgz",
-      "integrity": "sha512-vA6nFepEmlSKkMBnLBaUMVvAC4G3CTmO58C12y4sq6WPDOR7mOFYOi7GlrQ4djeSbP6JG9Pv9tJDM97PedRSww==",
-      "dependencies": {
-        "multiformats": "^13.0.0"
-      }
-    },
     "node_modules/@zxing/text-encoding": {
       "version": "0.9.0",
       "resolved": "https://registry.npmjs.org/@zxing/text-encoding/-/text-encoding-0.9.0.tgz",
@@ -2806,25 +2720,25 @@
       }
     },
     "node_modules/crypto-random-string": {
-      "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/crypto-random-string/-/crypto-random-string-4.0.0.tgz",
-      "integrity": "sha512-x8dy3RnvYdlUcPOjkEHqozhiwzKNSq7GcPuXFbnyMOCHxX8V3OgIg/pYuabl2sbUPfIJaeAQB7PMOK8DFIdoRA==",
+      "version": "5.0.0",
+      "resolved": "https://registry.npmjs.org/crypto-random-string/-/crypto-random-string-5.0.0.tgz",
+      "integrity": "sha512-KWjTXWwxFd6a94m5CdRGW/t82Tr8DoBc9dNnPCAbFI1EBweN6v1tv8y4Y1m7ndkp/nkIBRxUxAzpaBnR2k3bcQ==",
       "dependencies": {
-        "type-fest": "^1.0.1"
+        "type-fest": "^2.12.2"
       },
       "engines": {
-        "node": ">=12"
+        "node": ">=14.16"
       },
       "funding": {
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
     "node_modules/crypto-random-string/node_modules/type-fest": {
-      "version": "1.4.0",
-      "resolved": "https://registry.npmjs.org/type-fest/-/type-fest-1.4.0.tgz",
-      "integrity": "sha512-yGSza74xk0UG8k+pLh5oeoYirvIiWo5t0/o3zHHAO2tRDiZcxWP7fywNlXhqb6/r6sWvwi+RsyQMWhVLe4BVuA==",
+      "version": "2.19.0",
+      "resolved": "https://registry.npmjs.org/type-fest/-/type-fest-2.19.0.tgz",
+      "integrity": "sha512-RAH822pAdBgcNMAfWnCBU3CFZcfZ/i1eZjwFU/dsLKumyuuP3niueg2UAukXYF0E2AAoc82ZSSf9J0WQBinzHA==",
       "engines": {
-        "node": ">=10"
+        "node": ">=12.20"
       },
       "funding": {
         "url": "https://github.com/sponsors/sindresorhus"
@@ -5037,9 +4951,9 @@
       }
     },
     "node_modules/multiformats": {
-      "version": "13.1.1",
-      "resolved": "https://registry.npmjs.org/multiformats/-/multiformats-13.1.1.tgz",
-      "integrity": "sha512-JiptvwMmlxlzIlLLwhCi/srf/nk409UL0eUBr0kioRJq15hqqKyg68iftrBvhCRjR6Rw4fkNnSc4ZJXJDuta/Q=="
+      "version": "13.1.3",
+      "resolved": "https://registry.npmjs.org/multiformats/-/multiformats-13.1.3.tgz",
+      "integrity": "sha512-CZPi9lFZCM/+7oRolWYsvalsyWQGFo+GpdaTmjxXXomC+nP/W1Rnxb9sUgjvmNmRZ5bOPqRAl4nuK+Ydw/4tGw=="
     },
     "node_modules/murmurhash3js-revisited": {
       "version": "3.0.0",
@@ -6837,6 +6751,31 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
+    "node_modules/unique-string/node_modules/crypto-random-string": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/crypto-random-string/-/crypto-random-string-4.0.0.tgz",
+      "integrity": "sha512-x8dy3RnvYdlUcPOjkEHqozhiwzKNSq7GcPuXFbnyMOCHxX8V3OgIg/pYuabl2sbUPfIJaeAQB7PMOK8DFIdoRA==",
+      "dependencies": {
+        "type-fest": "^1.0.1"
+      },
+      "engines": {
+        "node": ">=12"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/unique-string/node_modules/type-fest": {
+      "version": "1.4.0",
+      "resolved": "https://registry.npmjs.org/type-fest/-/type-fest-1.4.0.tgz",
+      "integrity": "sha512-yGSza74xk0UG8k+pLh5oeoYirvIiWo5t0/o3zHHAO2tRDiZcxWP7fywNlXhqb6/r6sWvwi+RsyQMWhVLe4BVuA==",
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
     "node_modules/untildify": {
       "version": "4.0.0",
       "resolved": "https://registry.npmjs.org/untildify/-/untildify-4.0.0.tgz",
diff --git a/package.json b/package.json
index faff22d..cdf26a8 100644
--- a/package.json
+++ b/package.json
@@ -33,15 +33,12 @@
   "devDependencies": {
     "@types/update-notifier": "^6.0.5",
     "@ucanto/interface": "^10.0.1",
-    "@ucanto/principal": "^9.0.1",
     "@ucanto/server": "^10.0.0",
     "@web-std/blob": "^3.0.5",
-    "@web3-storage/capabilities": "17.1.1",
     "@web3-storage/eslint-config-w3up": "^1.0.0",
     "@web3-storage/sigv4": "^1.0.2",
     "@web3-storage/upload-api": "^17.0.0",
     "entail": "^2.1.1",
-    "multiformats": "^13.1.1",
     "npm-run-all": "^4.1.5",
     "prettier": "^3.0.3",
     "typescript": "^5.2.2"
@@ -54,15 +51,19 @@
     "@ipld/dag-ucan": "^3.4.0",
     "@ucanto/client": "^9.0.1",
     "@ucanto/core": "^10.0.1",
+    "@ucanto/principal": "^9.0.1",
     "@ucanto/transport": "^9.1.1",
     "@web3-storage/access": "^20.0.0",
+    "@web3-storage/capabilities": "^17.2.0",
     "@web3-storage/data-segment": "^5.0.0",
     "@web3-storage/did-mailto": "^2.1.0",
     "@web3-storage/w3up-client": "^14.1.1",
     "ansi-escapes": "^6.2.0",
     "chalk": "^5.3.0",
+    "crypto-random-string": "^5.0.0",
     "files-from-path": "^1.0.4",
     "fr32-sha2-256-trunc254-padded-binary-tree-multihash": "^3.3.0",
+    "multiformats": "^13.1.3",
     "open": "^9.1.0",
     "ora": "^7.0.1",
     "pretty-tree": "^1.0.0",