1id 0.1.0 → 0.2.0

package/README.md

@@ -42,12 +42,14 @@ console.log(`I am ${me.handle} (tier: ${me.trust_tier})`);
 
 ## Trust Tiers
 
-| Tier | Hardware | Sybil Resistance |
-|------|----------|-----------------|
-| `sovereign` | TPM (discrete/firmware) | Highest — manufacturer-attested |
-| `sovereign-portable` | YubiKey / Nitrokey | High — manufacturer-attested |
-| `virtual` | VMware/Hyper-V vTPM | Medium — hypervisor-attested |
-| `declared` | None (software keys) | Lowest — self-asserted |
+| Tier | Hardware | Sybil Resistant | Trust Level |
+|------|----------|-----------------|-------------|
+| `sovereign` | TPM (Intel, AMD, Infineon) with valid cert | Yes | Highest |
+| `sovereign-portable` | YubiKey / Nitrokey / Feitian with attestation | Yes | Highest |
+| `legacy` | Hardware TPM or security key with expired cert | Yes | High |
+| `virtual` | VMware / Hyper-V / QEMU vTPM | No | Verified Hardware |
+| `enclave` | Apple Secure Enclave (TOFU) | No | Verified Hardware |
+| `declared` | None (software keys) | No | Software |
 
 **CRITICAL**: `request_tier` is a REQUIREMENT, not a preference. You get exactly what you ask for, or an exception. No silent fallbacks.
 

package/dist/cli.d.ts

@@ -0,0 +1,17 @@
+#!/usr/bin/env node
+/**
+ * Command-line interface for the 1id.com SDK (Node.js).
+ *
+ * Usage:
+ *     oneid whoami          -- Show enrolled identity info
+ *     oneid token           -- Print a fresh bearer token (for scripting)
+ *     oneid enroll          -- Enroll this machine
+ *     oneid status          -- Check if enrolled
+ *
+ * Examples:
+ *     oneid enroll --tier declared --email owner@example.com
+ *     TOKEN=$(oneid token)
+ *     curl -H "Authorization: Bearer $TOKEN" https://api.example.com/
+ */
+export {};
+//# sourceMappingURL=cli.d.ts.map

package/dist/cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;GAaG"}

package/dist/cli.js

@@ -0,0 +1,201 @@
+#!/usr/bin/env node
+/**
+ * Command-line interface for the 1id.com SDK (Node.js).
+ *
+ * Usage:
+ *     oneid whoami          -- Show enrolled identity info
+ *     oneid token           -- Print a fresh bearer token (for scripting)
+ *     oneid enroll          -- Enroll this machine
+ *     oneid status          -- Check if enrolled
+ *
+ * Examples:
+ *     oneid enroll --tier declared --email owner@example.com
+ *     TOKEN=$(oneid token)
+ *     curl -H "Authorization: Bearer $TOKEN" https://api.example.com/
+ */
+import { credentials_exist, load_credentials, get_credentials_file_path, delete_credentials } from "./credentials.js";
+import { enroll } from "./enroll.js";
+import { get_token } from "./auth.js";
+const VERSION = "0.2.0";
+function print_help() {
+    console.log(`oneid ${VERSION} -- 1id.com identity for AI agents
+
+Usage: oneid <command> [options]
+
+Commands:
+  whoami              Show enrolled identity info
+  token               Print a fresh bearer token
+  enroll              Enroll this machine with 1id.com
+  status              Check enrollment status
+
+Enroll options:
+  --tier <tier>       Trust tier: sovereign, declared, etc. (default: declared)
+  --email <email>     Operator email for handle purchases
+  --handle <name>     Requested vanity handle
+  --force             Re-enroll even if already enrolled
+
+Token options:
+  --json              Output as JSON (includes expiry)
+  --refresh           Force token refresh
+
+Whoami options:
+  --json              Output as JSON
+
+Global:
+  --version           Show version
+  --help              Show this help`);
+}
+function parse_named_argument(args, flag_name) {
+    const flag_index = args.indexOf(flag_name);
+    if (flag_index !== -1 && flag_index + 1 < args.length) {
+        return args[flag_index + 1];
+    }
+    return undefined;
+}
+function has_flag(args, flag_name) {
+    return args.includes(flag_name);
+}
+async function command_whoami(args) {
+    const output_as_json = has_flag(args, "--json");
+    if (!credentials_exist()) {
+        console.error("Not enrolled. Run: oneid enroll");
+        return 1;
+    }
+    try {
+        const credentials = load_credentials();
+        const info = {
+            internal_id: credentials.client_id,
+            trust_tier: credentials.trust_tier,
+            key_algorithm: credentials.key_algorithm,
+            enrolled_at: credentials.enrolled_at || null,
+        };
+        if (output_as_json) {
+            console.log(JSON.stringify(info, null, 2));
+        }
+        else {
+            console.log(`Identity:   ${info.internal_id}`);
+            console.log(`Trust tier: ${info.trust_tier}`);
+            console.log(`Algorithm:  ${info.key_algorithm}`);
+            if (info.enrolled_at) {
+                console.log(`Enrolled:   ${info.enrolled_at}`);
+            }
+        }
+        return 0;
+    }
+    catch (error) {
+        console.error(`Error: ${error.message}`);
+        return 1;
+    }
+}
+async function command_token(args) {
+    const output_as_json = has_flag(args, "--json");
+    const force_refresh = has_flag(args, "--refresh");
+    if (!credentials_exist()) {
+        console.error("Not enrolled. Run: oneid enroll");
+        return 1;
+    }
+    try {
+        const token = await get_token(force_refresh);
+        if (output_as_json) {
+            console.log(JSON.stringify({
+                access_token: token.access_token,
+                token_type: token.token_type,
+                expires_at: token.expires_at.toISOString(),
+            }, null, 2));
+        }
+        else {
+            // Raw token for scripting: $(oneid token)
+            console.log(token.access_token);
+        }
+        return 0;
+    }
+    catch (error) {
+        console.error(`Authentication failed: ${error.message}`);
+        return 1;
+    }
+}
+async function command_enroll(args) {
+    const request_tier = parse_named_argument(args, "--tier") || "declared";
+    const operator_email = parse_named_argument(args, "--email");
+    const requested_handle = parse_named_argument(args, "--handle");
+    const force_reenroll = has_flag(args, "--force");
+    if (credentials_exist() && !force_reenroll) {
+        console.error("Already enrolled. Use --force to re-enroll (replaces current identity).");
+        return 1;
+    }
+    if (force_reenroll && credentials_exist()) {
+        delete_credentials();
+    }
+    try {
+        const identity = await enroll({
+            request_tier: request_tier,
+            operator_email: operator_email,
+            requested_handle: requested_handle,
+        });
+        console.log("Enrolled successfully!");
+        console.log(`Identity:   ${identity.internal_id}`);
+        console.log(`Handle:     ${identity.handle}`);
+        console.log(`Trust tier: ${identity.trust_tier}`);
+        return 0;
+    }
+    catch (error) {
+        console.error(`Enrollment failed: ${error.message}`);
+        return 1;
+    }
+}
+async function command_status(_args) {
+    const credentials_file_path = get_credentials_file_path();
+    if (credentials_exist()) {
+        console.log("Enrolled: yes");
+        console.log(`Credentials: ${credentials_file_path}`);
+        try {
+            const credentials = load_credentials();
+            console.log(`Identity: ${credentials.client_id}`);
+            console.log(`Tier: ${credentials.trust_tier}`);
+        }
+        catch {
+            console.log("Identity: (unable to read)");
+        }
+        return 0;
+    }
+    else {
+        console.log("Enrolled: no");
+        console.log(`Expected credentials at: ${credentials_file_path}`);
+        return 1;
+    }
+}
+async function main() {
+    const args = process.argv.slice(2);
+    if (args.length === 0 || has_flag(args, "--help") || has_flag(args, "-h")) {
+        print_help();
+        process.exit(0);
+    }
+    if (has_flag(args, "--version") || has_flag(args, "-v")) {
+        console.log(`oneid ${VERSION}`);
+        process.exit(0);
+    }
+    const command = args[0];
+    const command_args = args.slice(1);
+    let exit_code;
+    switch (command) {
+        case "whoami":
+            exit_code = await command_whoami(command_args);
+            break;
+        case "token":
+            exit_code = await command_token(command_args);
+            break;
+        case "enroll":
+            exit_code = await command_enroll(command_args);
+            break;
+        case "status":
+            exit_code = await command_status(command_args);
+            break;
+        default:
+            console.error(`Unknown command: ${command}`);
+            print_help();
+            exit_code = 1;
+    }
+    process.exit(exit_code);
+}
+main();
+//# sourceMappingURL=cli.js.map

package/dist/cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,yBAAyB,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACtH,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAGtC,MAAM,OAAO,GAAG,OAAO,CAAC;AAExB,SAAS,UAAU;IACjB,OAAO,CAAC,GAAG,CAAC,SAAS,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;qCAyBO,CAAC,CAAC;AACvC,CAAC;AAED,SAAS,oBAAoB,CAAC,IAAc,EAAE,SAAiB;IAC7D,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC3C,IAAI,UAAU,KAAK,CAAC,CAAC,IAAI,UAAU,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QACtD,OAAO,IAAI,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC;IAC9B,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,QAAQ,CAAC,IAAc,EAAE,SAAiB;IACjD,OAAO,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;AAClC,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,IAAc;IAC1C,MAAM,cAAc,GAAG,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAEhD,IAAI,CAAC,iBAAiB,EAAE,EAAE,CAAC;QACzB,OAAO,CAAC,KAAK,CAAC,iCAAiC,CAAC,CAAC;QACjD,OAAO,CAAC,CAAC;IACX,CAAC;IAED,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,gBAAgB,EAAE,CAAC;QACvC,MAAM,IAAI,GAAG;YACX,WAAW,EAAE,WAAW,CAAC,SAAS;YAClC,UAAU,EAAE,WAAW,CAAC,UAAU;YAClC,aAAa,EAAE,WAAW,CAAC,aAAa;YACxC,WAAW,EAAE,WAAW,CAAC,WAAW,IAAI,IAAI;SAC7C,CAAC;QAEF,IAAI,cAAc,EAAE,CAAC;YACnB,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAC7C,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;YAC/C,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;YAC9C,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC;YACjD,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;gBACrB,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;YACjD,CAAC;QACH,CAAC;QACD,OAAO,CAAC,CAAC;IACX,CAAC;IAAC,OAAO,KAAU,EAAE,CAAC;QACpB,OAAO,CAAC,KAAK,CAAC,UAAU,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QACzC,OAAO,CAAC,CAAC;IACX,CAAC;AACH,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,IAAc;IACzC,MAAM,cAAc,GAAG,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAChD,MAAM,aAAa,GAAG,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IAElD,IAAI,CAAC,iBAAiB,EAAE,EAAE,CAAC;QACzB,OAAO,CAAC,KAAK,CAAC,iCAAiC,CAAC,CAAC;QACjD,OAAO,CAAC,CAAC;IACX,CAAC;IAED,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,aAAa,CAAC,CAAC;QAE7C,IAAI,cAAc,EAAE,CAAC;YACnB,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC;gBACzB,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,UAAU,EAAE,KAAK,CAAC,UAAU,CAAC,WAAW,EAAE;aAC3C,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QACf,CAAC;aAAM,CAAC;YACN,0CAA0C;YAC1C,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QAClC,CAAC;QACD,OAAO,CAAC,CAAC;IACX,CAAC;IAAC,OAAO,KAAU,EAAE,CAAC;QACpB,OAAO,CAAC,KAAK,CAAC,0BAA0B,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QACzD,OAAO,CAAC,CAAC;IACX,CAAC;AACH,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,IAAc;IAC1C,MAAM,YAAY,GAAG,oBAAoB,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,UAAU,CAAC;IACxE,MAAM,cAAc,GAAG,oBAAoB,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAC7D,MAAM,gBAAgB,GAAG,oBAAoB,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IAChE,MAAM,cAAc,GAAG,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAEjD,IAAI,iBAAiB,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC;QAC3C,OAAO,CAAC,KAAK,CAAC,yEAAyE,CAAC,CAAC;QACzF,OAAO,CAAC,CAAC;IACX,CAAC;IAED,IAAI,cAAc,IAAI,iBAAiB,EAAE,EAAE,CAAC;QAC1C,kBAAkB,EAAE,CAAC;IACvB,CAAC;IAED,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC;YAC5B,YAAY,EAAE,YAAyB;YACvC,cAAc,EAAE,cAAc;YAC9B,gBAAgB,EAAE,gBAAgB;SACnC,CAAC,CAAC;QAEH,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;QACtC,OAAO,CAAC,GAAG,CAAC,eAAe,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;QACnD,OAAO,CAAC,GAAG,CAAC,eAAe,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QAC9C,OAAO,CAAC,GAAG,CAAC,eAAe,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC;QAClD,OAAO,CAAC,CAAC;IACX,CAAC;IAAC,OAAO,KAAU,EAAE,CAAC;QACpB,OAAO,CAAC,KAAK,CAAC,sBAAsB,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QACrD,OAAO,CAAC,CAAC;IACX,CAAC;AACH,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,KAAe;IAC3C,MAAM,qBAAqB,GAAG,yBAAyB,EAAE,CAAC;IAE1D,IAAI,iBAAiB,EAAE,EAAE,CAAC;QACxB,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QAC7B,OAAO,CAAC,GAAG,CAAC,gBAAgB,qBAAqB,EAAE,CAAC,CAAC;QACrD,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,gBAAgB,EAAE,CAAC;YACvC,OAAO,CAAC,GAAG,CAAC,aAAa,WAAW,CAAC,SAAS,EAAE,CAAC,CAAC;YAClD,OAAO,CAAC,GAAG,CAAC,SAAS,WAAW,CAAC,UAAU,EAAE,CAAC,CAAC;QACjD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAC;QAC5C,CAAC;QACD,OAAO,CAAC,CAAC;IACX,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QAC5B,OAAO,CAAC,GAAG,CAAC,4BAA4B,qBAAqB,EAAE,CAAC,CAAC;QACjE,OAAO,CAAC,CAAC;IACX,CAAC;AACH,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAEnC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;QAC1E,UAAU,EAAE,CAAC;QACb,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,IAAI,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC,IAAI,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;QACxD,OAAO,CAAC,GAAG,CAAC,SAAS,OAAO,EAAE,CAAC,CAAC;QAChC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACxB,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAEnC,IAAI,SAAiB,CAAC;IACtB,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,QAAQ;YACX,SAAS,GAAG,MAAM,cAAc,CAAC,YAAY,CAAC,CAAC;YAC/C,MAAM;QACR,KAAK,OAAO;YACV,SAAS,GAAG,MAAM,aAAa,CAAC,YAAY,CAAC,CAAC;YAC9C,MAAM;QACR,KAAK,QAAQ;YACX,SAAS,GAAG,MAAM,cAAc,CAAC,YAAY,CAAC,CAAC;YAC/C,MAAM;QACR,KAAK,QAAQ;YACX,SAAS,GAAG,MAAM,cAAc,CAAC,YAAY,CAAC,CAAC;YAC/C,MAAM;QACR;YACE,OAAO,CAAC,KAAK,CAAC,oBAAoB,OAAO,EAAE,CAAC,CAAC;YAC7C,UAAU,EAAE,CAAC;YACb,SAAS,GAAG,CAAC,CAAC;IAClB,CAAC;IAED,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;AAC1B,CAAC;AAED,IAAI,EAAE,CAAC"}

package/dist/credentials.d.ts

@@ -24,7 +24,7 @@ export declare const DEFAULT_TOKEN_ENDPOINT = "https://1id.com/realms/agents/pro
  * without re-enrolling.
  */
 export interface StoredCredentials {
-    /** The 1id internal ID (e.g., '1id_a7b3c9d2'), used as OAuth2 client_id. */
+    /** The 1id internal ID (e.g., '1id-a7b3c9d2'), used as OAuth2 client_id. */
     client_id: string;
     /** OAuth2 client secret issued by Keycloak. */
     client_secret: string;

package/dist/identity.d.ts

@@ -53,9 +53,9 @@ export declare enum HSMType {
  * Returned by enroll() and whoami(). All fields are readonly.
  */
 export interface Identity {
-    /** Permanent unique identifier (e.g., '1id_a7b3c9d2'). Never changes. */
+    /** Permanent unique identifier (e.g., '1id-a7b3c9d2'). Never changes. */
     readonly internal_id: string;
-    /** Display name (e.g., '@clawdia' or '@1id_a7b3c9d2'). */
+    /** Display name (e.g., '@clawdia' or '@1id-a7b3c9d2'). */
     readonly handle: string;
     /** The trust level assigned based on hardware attestation. */
     readonly trust_tier: TrustTier;

package/dist/test/test_declared_enrollment.js

@@ -105,7 +105,7 @@ describe("Credential storage (offline)", () => {
     });
     it("should save and load credentials", () => {
         const test_credentials = {
-            client_id: "1id_test1234",
+            client_id: "1id-test1234",
             client_secret: "secret_abc123",
             token_endpoint: "https://1id.com/realms/agents/protocol/openid-connect/token",
             api_base_url: "https://1id.com",
@@ -117,7 +117,7 @@ describe("Credential storage (offline)", () => {
         save_credentials(test_credentials);
         assert.ok(credentials_exist(), "credentials should exist after save");
         const loaded = load_credentials();
-        assert.equal(loaded.client_id, "1id_test1234");
+        assert.equal(loaded.client_id, "1id-test1234");
         assert.equal(loaded.client_secret, "secret_abc123");
         assert.equal(loaded.trust_tier, "declared");
         assert.equal(loaded.key_algorithm, "ed25519");
@@ -126,8 +126,8 @@ describe("Credential storage (offline)", () => {
     it("should handle whoami() with saved credentials", () => {
         // Credentials from previous test should still exist
         const identity = whoami();
-        assert.equal(identity.internal_id, "1id_test1234");
-        assert.equal(identity.handle, "@1id_test1234");
+        assert.equal(identity.internal_id, "1id-test1234");
+        assert.equal(identity.handle, "@1id-test1234");
         assert.equal(identity.trust_tier, TrustTier.DECLARED);
         assert.equal(identity.hsm_type, HSMType.SOFTWARE);
         assert.equal(identity.key_algorithm, KeyAlgorithm.ED25519);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "1id",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "Hardware-anchored identity SDK for AI agents -- 1id.com",
   "keywords": [
     "identity",
@@ -32,6 +32,9 @@
       "types": "./dist/index.d.ts"
     }
   },
+  "bin": {
+    "oneid": "./dist/cli.js"
+  },
   "files": [
     "dist",
     "LICENSE",
@@ -41,7 +44,7 @@
     "node": ">=18.0.0"
   },
   "scripts": {
-    "build": "tsc",
+    "build": "npx tsc",
     "clean": "node -e \"const fs=require('fs'); fs.rmSync('dist',{recursive:true,force:true})\"",
     "prepublishOnly": "npm run clean && npm run build",
     "test": "node --test dist/test/test_declared_enrollment.js",