1id 0.1.0

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAE,kBAAkB,EAAE,SAAS,EAAE,qBAAqB,EAAE,MAAM,WAAW,CAAC;AACjF,OAAO,EAAE,iBAAiB,EAAoB,MAAM,kBAAkB,CAAC;AACvE,OAAO,EAAE,MAAM,EAAE,KAAK,aAAa,EAAE,MAAM,aAAa,CAAC;AACzD,OAAO,EAAE,+BAA+B,EAAE,MAAM,WAAW,CAAC;AAC5D,OAAO,EACL,qBAAqB,EACrB,OAAO,EACP,KAAK,QAAQ,EACb,YAAY,EACZ,KAAK,KAAK,EACV,SAAS,EACT,8BAA8B,EAC9B,iCAAiC,EACjC,iCAAiC,EAClC,MAAM,eAAe,CAAC;AAGvB,OAAO,EACL,UAAU,EACV,eAAe,EACf,UAAU,EACV,cAAc,EACd,cAAc,EACd,oBAAoB,EACpB,gBAAgB,EAChB,kBAAkB,EAClB,kBAAkB,EAClB,mBAAmB,EACnB,YAAY,EACZ,gBAAgB,EAChB,mBAAmB,EACnB,sBAAsB,GACvB,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EACL,SAAS,EACT,YAAY,EACZ,OAAO,EACP,qBAAqB,EACrB,KAAK,QAAQ,EACb,KAAK,KAAK,EACV,KAAK,aAAa,EAClB,8BAA8B,EAC9B,iCAAiC,EACjC,iCAAiC,GAClC,CAAC;AAGF,OAAO,EACL,MAAM,EACN,SAAS,IAAI,QAAQ,EACrB,SAAS,EACT,kBAAkB,EAClB,qBAAqB,EACrB,iBAAiB,EACjB,+BAA+B,GAChC,CAAC;AAEF,0BAA0B;AAC1B,eAAO,MAAM,OAAO,UAAU,CAAC;AAE/B;;;;;;;GAOG;AACH,wBAAgB,MAAM,IAAI,QAAQ,CAkDjC;AAED;;;;;GAKG;AACH,wBAAgB,OAAO,IAAI,IAAI,CAE9B;AAGD,QAAA,MAAM,KAAK;;;;;;;;;;;;;;;CAeV,CAAC;AAEF,eAAe,KAAK,CAAC"}

package/dist/index.js

@@ -0,0 +1,124 @@
+/**
+ * 1id.com SDK -- Hardware-anchored identity for AI agents.
+ *
+ * Quick start:
+ *
+ *     import oneid from "1id";
+ *
+ *     // Enroll at declared tier (no HSM, always works)
+ *     const identity = await oneid.enroll({ request_tier: "declared" });
+ *     console.log(`Enrolled as ${identity.handle}`);
+ *
+ *     // Get an OAuth2 token for authentication
+ *     const token = await oneid.getToken();
+ *     console.log(`Bearer ${token.access_token}`);
+ *
+ *     // Check current identity
+ *     const me = oneid.whoami();
+ *
+ * Trust tiers (request_tier parameter):
+ *     'sovereign'          -- TPM hardware, manufacturer-attested
+ *     'sovereign-portable' -- YubiKey/Nitrokey, manufacturer-attested
+ *     'declared'           -- Software keys, no hardware proof
+ *
+ * CRITICAL: request_tier is a REQUIREMENT, not a preference.
+ * You get exactly what you ask for, or an exception. No fallbacks.
+ */
+import { clear_cached_token, get_token, authenticate_with_tpm } from "./auth.js";
+import { credentials_exist, load_credentials } from "./credentials.js";
+import { enroll } from "./enroll.js";
+import { sign_challenge_with_private_key } from "./keys.js";
+import { DEFAULT_KEY_ALGORITHM, HSMType, KeyAlgorithm, TrustTier, this_token_has_not_yet_expired, format_authorization_header_value, format_identity_as_display_string, } from "./identity.js";
+// Re-export all exception classes
+export { OneIDError, EnrollmentError, NoHSMError, UACDeniedError, HSMAccessError, AlreadyEnrolledError, HandleTakenError, HandleInvalidError, HandleRetiredError, AuthenticationError, NetworkError, NotEnrolledError, BinaryNotFoundError, RateLimitExceededError, } from "./exceptions.js";
+// Re-export types and enums
+export { TrustTier, KeyAlgorithm, HSMType, DEFAULT_KEY_ALGORITHM, this_token_has_not_yet_expired, format_authorization_header_value, format_identity_as_display_string, };
+// Re-export core functions
+export { enroll, get_token as getToken, get_token, clear_cached_token, authenticate_with_tpm, credentials_exist, sign_challenge_with_private_key, };
+/** SDK version string. */
+export const VERSION = "0.1.0";
+/**
+ * Check the current enrolled identity.
+ *
+ * Reads the local credentials file and returns the identity information
+ * stored during enrollment. Does NOT make a network request.
+ *
+ * @throws NotEnrolledError if no credentials exist.
+ */
+export function whoami() {
+    const creds = load_credentials();
+    // Resolve trust tier
+    let trust_tier;
+    const valid_tiers = Object.values(TrustTier);
+    if (valid_tiers.includes(creds.trust_tier)) {
+        trust_tier = creds.trust_tier;
+    }
+    else {
+        trust_tier = TrustTier.DECLARED;
+    }
+    // Resolve key algorithm
+    let key_algorithm;
+    const valid_algorithms = Object.values(KeyAlgorithm);
+    if (valid_algorithms.includes(creds.key_algorithm)) {
+        key_algorithm = creds.key_algorithm;
+    }
+    else {
+        key_algorithm = DEFAULT_KEY_ALGORITHM;
+    }
+    // Parse enrolled_at
+    let enrolled_at;
+    try {
+        enrolled_at = creds.enrolled_at ? new Date(creds.enrolled_at) : new Date();
+    }
+    catch {
+        enrolled_at = new Date();
+    }
+    const internal_id = creds.client_id;
+    const handle = internal_id.startsWith("@") ? internal_id : `@${internal_id}`;
+    // Determine HSM type from credentials
+    let hsm_type = null;
+    if (creds.private_key_pem != null) {
+        hsm_type = HSMType.SOFTWARE;
+    }
+    else if (creds.hsm_key_reference != null) {
+        hsm_type = HSMType.TPM;
+    }
+    return {
+        internal_id,
+        handle,
+        trust_tier,
+        hsm_type,
+        hsm_manufacturer: null,
+        enrolled_at,
+        device_count: creds.hsm_key_reference ? 1 : 0,
+        key_algorithm,
+    };
+}
+/**
+ * Force-refresh the cached OAuth2 token.
+ *
+ * Discards the in-memory cached token and fetches a new one
+ * on the next getToken() call.
+ */
+export function refresh() {
+    clear_cached_token();
+}
+// -- Default export for convenience --
+const oneid = {
+    enroll,
+    getToken: get_token,
+    get_token,
+    whoami,
+    refresh,
+    credentials_exist,
+    authenticate_with_tpm,
+    sign_challenge_with_private_key,
+    clear_cached_token,
+    VERSION,
+    TrustTier,
+    KeyAlgorithm,
+    HSMType,
+    DEFAULT_KEY_ALGORITHM,
+};
+export default oneid;
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAE,kBAAkB,EAAE,SAAS,EAAE,qBAAqB,EAAE,MAAM,WAAW,CAAC;AACjF,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACvE,OAAO,EAAE,MAAM,EAAsB,MAAM,aAAa,CAAC;AACzD,OAAO,EAAE,+BAA+B,EAAE,MAAM,WAAW,CAAC;AAC5D,OAAO,EACL,qBAAqB,EACrB,OAAO,EAEP,YAAY,EAEZ,SAAS,EACT,8BAA8B,EAC9B,iCAAiC,EACjC,iCAAiC,GAClC,MAAM,eAAe,CAAC;AAEvB,kCAAkC;AAClC,OAAO,EACL,UAAU,EACV,eAAe,EACf,UAAU,EACV,cAAc,EACd,cAAc,EACd,oBAAoB,EACpB,gBAAgB,EAChB,kBAAkB,EAClB,kBAAkB,EAClB,mBAAmB,EACnB,YAAY,EACZ,gBAAgB,EAChB,mBAAmB,EACnB,sBAAsB,GACvB,MAAM,iBAAiB,CAAC;AAEzB,4BAA4B;AAC5B,OAAO,EACL,SAAS,EACT,YAAY,EACZ,OAAO,EACP,qBAAqB,EAIrB,8BAA8B,EAC9B,iCAAiC,EACjC,iCAAiC,GAClC,CAAC;AAEF,2BAA2B;AAC3B,OAAO,EACL,MAAM,EACN,SAAS,IAAI,QAAQ,EACrB,SAAS,EACT,kBAAkB,EAClB,qBAAqB,EACrB,iBAAiB,EACjB,+BAA+B,GAChC,CAAC;AAEF,0BAA0B;AAC1B,MAAM,CAAC,MAAM,OAAO,GAAG,OAAO,CAAC;AAE/B;;;;;;;GAOG;AACH,MAAM,UAAU,MAAM;IACpB,MAAM,KAAK,GAAG,gBAAgB,EAAE,CAAC;IAEjC,qBAAqB;IACrB,IAAI,UAAqB,CAAC;IAC1B,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,SAAS,CAAa,CAAC;IACzD,IAAI,WAAW,CAAC,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;QAC3C,UAAU,GAAG,KAAK,CAAC,UAAuB,CAAC;IAC7C,CAAC;SAAM,CAAC;QACN,UAAU,GAAG,SAAS,CAAC,QAAQ,CAAC;IAClC,CAAC;IAED,wBAAwB;IACxB,IAAI,aAA2B,CAAC;IAChC,MAAM,gBAAgB,GAAG,MAAM,CAAC,MAAM,CAAC,YAAY,CAAa,CAAC;IACjE,IAAI,gBAAgB,CAAC,QAAQ,CAAC,KAAK,CAAC,aAAa,CAAC,EAAE,CAAC;QACnD,aAAa,GAAG,KAAK,CAAC,aAA6B,CAAC;IACtD,CAAC;SAAM,CAAC;QACN,aAAa,GAAG,qBAAqB,CAAC;IACxC,CAAC;IAED,oBAAoB;IACpB,IAAI,WAAiB,CAAC;IACtB,IAAI,CAAC;QACH,WAAW,GAAG,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;IAC7E,CAAC;IAAC,MAAM,CAAC;QACP,WAAW,GAAG,IAAI,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED,MAAM,WAAW,GAAG,KAAK,CAAC,SAAS,CAAC;IACpC,MAAM,MAAM,GAAG,WAAW,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC;IAE7E,sCAAsC;IACtC,IAAI,QAAQ,GAAmB,IAAI,CAAC;IACpC,IAAI,KAAK,CAAC,eAAe,IAAI,IAAI,EAAE,CAAC;QAClC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;IAC9B,CAAC;SAAM,IAAI,KAAK,CAAC,iBAAiB,IAAI,IAAI,EAAE,CAAC;QAC3C,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC;IACzB,CAAC;IAED,OAAO;QACL,WAAW;QACX,MAAM;QACN,UAAU;QACV,QAAQ;QACR,gBAAgB,EAAE,IAAI;QACtB,WAAW;QACX,YAAY,EAAE,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7C,aAAa;KACd,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,OAAO;IACrB,kBAAkB,EAAE,CAAC;AACvB,CAAC;AAED,uCAAuC;AACvC,MAAM,KAAK,GAAG;IACZ,MAAM;IACN,QAAQ,EAAE,SAAS;IACnB,SAAS;IACT,MAAM;IACN,OAAO;IACP,iBAAiB;IACjB,qBAAqB;IACrB,+BAA+B;IAC/B,kBAAkB;IAClB,OAAO;IACP,SAAS;IACT,YAAY;IACZ,OAAO;IACP,qBAAqB;CACtB,CAAC;AAEF,eAAe,KAAK,CAAC"}

package/dist/keys.d.ts

@@ -0,0 +1,56 @@
+/**
+ * Cryptographic key generation for the 1id.com Node.js SDK.
+ *
+ * Uses Node.js built-in `crypto` module -- zero external dependencies.
+ *
+ * Supports multiple key algorithms for declared-tier software keys:
+ *   - Ed25519:     128-bit security, smallest keys, fastest. Default.
+ *   - ECDSA P-256: 128-bit security, widely compatible (NIST curve).
+ *   - ECDSA P-384: 192-bit security, higher security NIST curve.
+ *   - RSA-2048:    112-bit security, legacy compatibility.
+ *   - RSA-4096:    128-bit security, higher security RSA.
+ *
+ * For TPM tiers, key generation happens inside the TPM hardware via
+ * the Go binary. This module is only used for declared-tier enrollment.
+ */
+import { KeyAlgorithm } from "./identity.js";
+/**
+ * A generated keypair: private key PEM + public key PEM.
+ */
+export interface GeneratedKeypair {
+    /** PEM-encoded PKCS#8 private key. */
+    private_key_pem: string;
+    /** PEM-encoded SPKI public key. */
+    public_key_pem: string;
+}
+/**
+ * Generate a new keypair for declared-tier enrollment.
+ *
+ * The private key is stored locally in the credentials file. The public
+ * key is sent to the 1id.com server during enrollment. The private key
+ * is used later for challenge-response signing by relying parties.
+ *
+ * @param algorithm Which key algorithm to use. Default: Ed25519.
+ * @returns The generated keypair as PEM strings.
+ * @throws Error if the algorithm is not supported.
+ */
+export declare function generate_keypair(algorithm?: KeyAlgorithm): GeneratedKeypair;
+/**
+ * Sign a challenge nonce using the stored private key.
+ *
+ * Used for relying-party live re-verification: the relying party
+ * sends a nonce via 1id.com, the SDK signs it with the agent's
+ * private key, and 1id.com verifies the signature against the
+ * stored public key.
+ *
+ * The signing algorithm is determined automatically from the key type:
+ * - Ed25519: EdDSA (no hash selection needed)
+ * - ECDSA: SHA-256 (P-256) or SHA-384 (P-384)
+ * - RSA: SHA-256 with PKCS1v15
+ *
+ * @param private_key_pem PEM-encoded private key.
+ * @param challenge_bytes The raw bytes of the challenge nonce to sign.
+ * @returns The signature as a Buffer.
+ */
+export declare function sign_challenge_with_private_key(private_key_pem: string, challenge_bytes: Buffer): Buffer;
+//# sourceMappingURL=keys.d.ts.map

package/dist/keys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"keys.d.ts","sourceRoot":"","sources":["../src/keys.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAGH,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAE7C;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,sCAAsC;IACtC,eAAe,EAAE,MAAM,CAAC;IACxB,mCAAmC;IACnC,cAAc,EAAE,MAAM,CAAC;CACxB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAAC,SAAS,GAAE,YAAmC,GAAG,gBAAgB,CAqCjG;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,+BAA+B,CAC7C,eAAe,EAAE,MAAM,EACvB,eAAe,EAAE,MAAM,GACtB,MAAM,CAmBR"}

package/dist/keys.js

@@ -0,0 +1,105 @@
+/**
+ * Cryptographic key generation for the 1id.com Node.js SDK.
+ *
+ * Uses Node.js built-in `crypto` module -- zero external dependencies.
+ *
+ * Supports multiple key algorithms for declared-tier software keys:
+ *   - Ed25519:     128-bit security, smallest keys, fastest. Default.
+ *   - ECDSA P-256: 128-bit security, widely compatible (NIST curve).
+ *   - ECDSA P-384: 192-bit security, higher security NIST curve.
+ *   - RSA-2048:    112-bit security, legacy compatibility.
+ *   - RSA-4096:    128-bit security, higher security RSA.
+ *
+ * For TPM tiers, key generation happens inside the TPM hardware via
+ * the Go binary. This module is only used for declared-tier enrollment.
+ */
+import * as crypto from "node:crypto";
+import { KeyAlgorithm } from "./identity.js";
+/**
+ * Generate a new keypair for declared-tier enrollment.
+ *
+ * The private key is stored locally in the credentials file. The public
+ * key is sent to the 1id.com server during enrollment. The private key
+ * is used later for challenge-response signing by relying parties.
+ *
+ * @param algorithm Which key algorithm to use. Default: Ed25519.
+ * @returns The generated keypair as PEM strings.
+ * @throws Error if the algorithm is not supported.
+ */
+export function generate_keypair(algorithm = KeyAlgorithm.ED25519) {
+    let key_pair;
+    if (algorithm === KeyAlgorithm.ED25519) {
+        key_pair = crypto.generateKeyPairSync("ed25519");
+    }
+    else if (algorithm === KeyAlgorithm.ECDSA_P256) {
+        key_pair = crypto.generateKeyPairSync("ec", { namedCurve: "P-256" });
+    }
+    else if (algorithm === KeyAlgorithm.ECDSA_P384) {
+        key_pair = crypto.generateKeyPairSync("ec", { namedCurve: "P-384" });
+    }
+    else if (algorithm === KeyAlgorithm.RSA_2048) {
+        key_pair = crypto.generateKeyPairSync("rsa", {
+            modulusLength: 2048,
+            publicExponent: 65537,
+        });
+    }
+    else if (algorithm === KeyAlgorithm.RSA_4096) {
+        key_pair = crypto.generateKeyPairSync("rsa", {
+            modulusLength: 4096,
+            publicExponent: 65537,
+        });
+    }
+    else {
+        const valid_algorithms = Object.values(KeyAlgorithm).join(", ");
+        throw new Error(`Unsupported key algorithm: ${algorithm}. Supported: ${valid_algorithms}`);
+    }
+    const private_key_pem = key_pair.privateKey.export({
+        type: "pkcs8",
+        format: "pem",
+    });
+    const public_key_pem = key_pair.publicKey.export({
+        type: "spki",
+        format: "pem",
+    });
+    return { private_key_pem, public_key_pem };
+}
+/**
+ * Sign a challenge nonce using the stored private key.
+ *
+ * Used for relying-party live re-verification: the relying party
+ * sends a nonce via 1id.com, the SDK signs it with the agent's
+ * private key, and 1id.com verifies the signature against the
+ * stored public key.
+ *
+ * The signing algorithm is determined automatically from the key type:
+ * - Ed25519: EdDSA (no hash selection needed)
+ * - ECDSA: SHA-256 (P-256) or SHA-384 (P-384)
+ * - RSA: SHA-256 with PKCS1v15
+ *
+ * @param private_key_pem PEM-encoded private key.
+ * @param challenge_bytes The raw bytes of the challenge nonce to sign.
+ * @returns The signature as a Buffer.
+ */
+export function sign_challenge_with_private_key(private_key_pem, challenge_bytes) {
+    const private_key_object = crypto.createPrivateKey(private_key_pem);
+    const key_type = private_key_object.asymmetricKeyType;
+    if (key_type === "ed25519") {
+        return crypto.sign(null, challenge_bytes, private_key_object);
+    }
+    else if (key_type === "ec") {
+        // Determine hash from curve: P-384 uses SHA-384, others use SHA-256
+        const key_details = private_key_object.asymmetricKeyDetails;
+        const hash_algorithm = key_details?.namedCurve === "P-384" ? "sha384" : "sha256";
+        return crypto.sign(hash_algorithm, challenge_bytes, private_key_object);
+    }
+    else if (key_type === "rsa") {
+        return crypto.sign("sha256", challenge_bytes, {
+            key: private_key_object,
+            padding: crypto.constants.RSA_PKCS1_PADDING,
+        });
+    }
+    else {
+        throw new Error(`Unsupported key type for signing: ${key_type}`);
+    }
+}
+//# sourceMappingURL=keys.js.map

package/dist/keys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"keys.js","sourceRoot":"","sources":["../src/keys.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAY7C;;;;;;;;;;GAUG;AACH,MAAM,UAAU,gBAAgB,CAAC,YAA0B,YAAY,CAAC,OAAO;IAC7E,IAAI,QAAuC,CAAC;IAE5C,IAAI,SAAS,KAAK,YAAY,CAAC,OAAO,EAAE,CAAC;QACvC,QAAQ,GAAG,MAAM,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC;IACnD,CAAC;SAAM,IAAI,SAAS,KAAK,YAAY,CAAC,UAAU,EAAE,CAAC;QACjD,QAAQ,GAAG,MAAM,CAAC,mBAAmB,CAAC,IAAI,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC;IACvE,CAAC;SAAM,IAAI,SAAS,KAAK,YAAY,CAAC,UAAU,EAAE,CAAC;QACjD,QAAQ,GAAG,MAAM,CAAC,mBAAmB,CAAC,IAAI,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC;IACvE,CAAC;SAAM,IAAI,SAAS,KAAK,YAAY,CAAC,QAAQ,EAAE,CAAC;QAC/C,QAAQ,GAAG,MAAM,CAAC,mBAAmB,CAAC,KAAK,EAAE;YAC3C,aAAa,EAAE,IAAI;YACnB,cAAc,EAAE,KAAK;SACtB,CAAC,CAAC;IACL,CAAC;SAAM,IAAI,SAAS,KAAK,YAAY,CAAC,QAAQ,EAAE,CAAC;QAC/C,QAAQ,GAAG,MAAM,CAAC,mBAAmB,CAAC,KAAK,EAAE;YAC3C,aAAa,EAAE,IAAI;YACnB,cAAc,EAAE,KAAK;SACtB,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,MAAM,gBAAgB,GAAG,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChE,MAAM,IAAI,KAAK,CACb,8BAA8B,SAAS,gBAAgB,gBAAgB,EAAE,CAC1E,CAAC;IACJ,CAAC;IAED,MAAM,eAAe,GAAG,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC;QACjD,IAAI,EAAE,OAAO;QACb,MAAM,EAAE,KAAK;KACd,CAAW,CAAC;IAEb,MAAM,cAAc,GAAG,QAAQ,CAAC,SAAS,CAAC,MAAM,CAAC;QAC/C,IAAI,EAAE,MAAM;QACZ,MAAM,EAAE,KAAK;KACd,CAAW,CAAC;IAEb,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,CAAC;AAC7C,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,+BAA+B,CAC7C,eAAuB,EACvB,eAAuB;IAEvB,MAAM,kBAAkB,GAAG,MAAM,CAAC,gBAAgB,CAAC,eAAe,CAAC,CAAC;IACpE,MAAM,QAAQ,GAAG,kBAAkB,CAAC,iBAAiB,CAAC;IAEtD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,eAAe,EAAE,kBAAkB,CAAC,CAAC;IAChE,CAAC;SAAM,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QAC7B,oEAAoE;QACpE,MAAM,WAAW,GAAG,kBAAkB,CAAC,oBAAoB,CAAC;QAC5D,MAAM,cAAc,GAAG,WAAW,EAAE,UAAU,KAAK,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC;QACjF,OAAO,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,eAAe,EAAE,kBAAkB,CAAC,CAAC;IAC1E,CAAC;SAAM,IAAI,QAAQ,KAAK,KAAK,EAAE,CAAC;QAC9B,OAAO,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,eAAe,EAAE;YAC5C,GAAG,EAAE,kBAAkB;YACvB,OAAO,EAAE,MAAM,CAAC,SAAS,CAAC,iBAAiB;SAC5C,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,KAAK,CAAC,qCAAqC,QAAQ,EAAE,CAAC,CAAC;IACnE,CAAC;AACH,CAAC"}

package/dist/test/test_declared_enrollment.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Integration and unit tests for the 1id.com Node.js SDK.
+ *
+ * Tests include:
+ * 1. Offline tests (key generation, credential storage, whoami, error hierarchy)
+ * 2. Live enrollment test against 1id.com (may fail if server is down)
+ *
+ * Run with: node --test dist/test/test_declared_enrollment.js
+ */
+export {};
+//# sourceMappingURL=test_declared_enrollment.d.ts.map

package/dist/test/test_declared_enrollment.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"test_declared_enrollment.d.ts","sourceRoot":"","sources":["../../src/test/test_declared_enrollment.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG"}

package/dist/test/test_declared_enrollment.js

@@ -0,0 +1,256 @@
+/**
+ * Integration and unit tests for the 1id.com Node.js SDK.
+ *
+ * Tests include:
+ * 1. Offline tests (key generation, credential storage, whoami, error hierarchy)
+ * 2. Live enrollment test against 1id.com (may fail if server is down)
+ *
+ * Run with: node --test dist/test/test_declared_enrollment.js
+ */
+import { describe, it, before, after } from "node:test";
+import * as assert from "node:assert/strict";
+import * as fs from "node:fs";
+import * as crypto from "node:crypto";
+import { enroll, whoami, credentials_exist, TrustTier, KeyAlgorithm, HSMType, VERSION, OneIDError, EnrollmentError, NoHSMError, NetworkError, NotEnrolledError, sign_challenge_with_private_key, } from "../index.js";
+import { get_credentials_file_path, delete_credentials, save_credentials, load_credentials, } from "../credentials.js";
+import { generate_keypair } from "../keys.js";
+// -- Test configuration --
+const BACKUP_SUFFIX = ".test-backup";
+// =====================================================================
+// OFFLINE UNIT TESTS (no network required)
+// =====================================================================
+describe("Key generation (offline)", () => {
+    it("should generate Ed25519 keypair", () => {
+        const kp = generate_keypair(KeyAlgorithm.ED25519);
+        assert.ok(kp.private_key_pem.includes("BEGIN PRIVATE KEY"), "should contain PEM private key header");
+        assert.ok(kp.public_key_pem.includes("BEGIN PUBLIC KEY"), "should contain PEM public key header");
+    });
+    it("should generate ECDSA P-256 keypair", () => {
+        const kp = generate_keypair(KeyAlgorithm.ECDSA_P256);
+        assert.ok(kp.private_key_pem.includes("BEGIN PRIVATE KEY"));
+        assert.ok(kp.public_key_pem.includes("BEGIN PUBLIC KEY"));
+    });
+    it("should generate ECDSA P-384 keypair", () => {
+        const kp = generate_keypair(KeyAlgorithm.ECDSA_P384);
+        assert.ok(kp.private_key_pem.includes("BEGIN PRIVATE KEY"));
+        assert.ok(kp.public_key_pem.includes("BEGIN PUBLIC KEY"));
+    });
+    it("should generate RSA-2048 keypair", () => {
+        const kp = generate_keypair(KeyAlgorithm.RSA_2048);
+        assert.ok(kp.private_key_pem.includes("BEGIN PRIVATE KEY"));
+        assert.ok(kp.public_key_pem.includes("BEGIN PUBLIC KEY"));
+    });
+    it("should generate RSA-4096 keypair", () => {
+        const kp = generate_keypair(KeyAlgorithm.RSA_4096);
+        assert.ok(kp.private_key_pem.includes("BEGIN PRIVATE KEY"));
+        assert.ok(kp.public_key_pem.includes("BEGIN PUBLIC KEY"));
+    });
+});
+describe("Challenge signing (offline)", () => {
+    it("should sign and verify with Ed25519", () => {
+        const kp = generate_keypair(KeyAlgorithm.ED25519);
+        const challenge = crypto.randomBytes(32);
+        const signature = sign_challenge_with_private_key(kp.private_key_pem, challenge);
+        assert.ok(signature.length > 0, "signature should be non-empty");
+        // Verify the signature using Node.js crypto
+        const public_key = crypto.createPublicKey(kp.public_key_pem);
+        const is_valid = crypto.verify(null, challenge, public_key, signature);
+        assert.ok(is_valid, "Ed25519 signature should verify correctly");
+    });
+    it("should sign and verify with ECDSA P-256", () => {
+        const kp = generate_keypair(KeyAlgorithm.ECDSA_P256);
+        const challenge = crypto.randomBytes(32);
+        const signature = sign_challenge_with_private_key(kp.private_key_pem, challenge);
+        assert.ok(signature.length > 0);
+        const public_key = crypto.createPublicKey(kp.public_key_pem);
+        const is_valid = crypto.verify("sha256", challenge, public_key, signature);
+        assert.ok(is_valid, "ECDSA P-256 signature should verify correctly");
+    });
+    it("should sign and verify with RSA-2048", () => {
+        const kp = generate_keypair(KeyAlgorithm.RSA_2048);
+        const challenge = crypto.randomBytes(32);
+        const signature = sign_challenge_with_private_key(kp.private_key_pem, challenge);
+        assert.ok(signature.length > 0);
+        const public_key = crypto.createPublicKey(kp.public_key_pem);
+        const is_valid = crypto.verify("sha256", challenge, {
+            key: public_key,
+            padding: crypto.constants.RSA_PKCS1_PADDING,
+        }, signature);
+        assert.ok(is_valid, "RSA-2048 signature should verify correctly");
+    });
+});
+describe("Credential storage (offline)", () => {
+    const credentials_file_path = get_credentials_file_path();
+    const backup_path = credentials_file_path + ".unit-test-backup";
+    let had_existing_credentials = false;
+    before(() => {
+        if (fs.existsSync(credentials_file_path)) {
+            fs.copyFileSync(credentials_file_path, backup_path);
+            had_existing_credentials = true;
+            fs.unlinkSync(credentials_file_path);
+        }
+    });
+    after(() => {
+        // Restore original credentials
+        if (had_existing_credentials && fs.existsSync(backup_path)) {
+            if (fs.existsSync(credentials_file_path)) {
+                fs.unlinkSync(credentials_file_path);
+            }
+            fs.renameSync(backup_path, credentials_file_path);
+        }
+        else if (fs.existsSync(credentials_file_path)) {
+            // Clean up test credentials
+            fs.unlinkSync(credentials_file_path);
+        }
+    });
+    it("should save and load credentials", () => {
+        const test_credentials = {
+            client_id: "1id_test1234",
+            client_secret: "secret_abc123",
+            token_endpoint: "https://1id.com/realms/agents/protocol/openid-connect/token",
+            api_base_url: "https://1id.com",
+            trust_tier: "declared",
+            key_algorithm: "ed25519",
+            private_key_pem: "-----BEGIN PRIVATE KEY-----\nTEST\n-----END PRIVATE KEY-----",
+            enrolled_at: "2026-02-11T00:00:00Z",
+        };
+        save_credentials(test_credentials);
+        assert.ok(credentials_exist(), "credentials should exist after save");
+        const loaded = load_credentials();
+        assert.equal(loaded.client_id, "1id_test1234");
+        assert.equal(loaded.client_secret, "secret_abc123");
+        assert.equal(loaded.trust_tier, "declared");
+        assert.equal(loaded.key_algorithm, "ed25519");
+        assert.ok(loaded.private_key_pem?.includes("TEST"));
+    });
+    it("should handle whoami() with saved credentials", () => {
+        // Credentials from previous test should still exist
+        const identity = whoami();
+        assert.equal(identity.internal_id, "1id_test1234");
+        assert.equal(identity.handle, "@1id_test1234");
+        assert.equal(identity.trust_tier, TrustTier.DECLARED);
+        assert.equal(identity.hsm_type, HSMType.SOFTWARE);
+        assert.equal(identity.key_algorithm, KeyAlgorithm.ED25519);
+    });
+    it("should throw NotEnrolledError when no credentials exist", () => {
+        delete_credentials();
+        assert.throws(() => whoami(), (error) => {
+            assert.ok(error instanceof NotEnrolledError);
+            return true;
+        });
+    });
+});
+describe("Exception hierarchy (offline)", () => {
+    it("should have correct inheritance chain", () => {
+        const enrollment_error = new EnrollmentError("test");
+        assert.ok(enrollment_error instanceof OneIDError, "EnrollmentError should extend OneIDError");
+        assert.ok(enrollment_error instanceof Error, "EnrollmentError should extend Error");
+        const no_hsm_error = new NoHSMError("test");
+        assert.ok(no_hsm_error instanceof EnrollmentError, "NoHSMError should extend EnrollmentError");
+        assert.ok(no_hsm_error instanceof OneIDError, "NoHSMError should extend OneIDError");
+        const network_error = new NetworkError("test");
+        assert.ok(network_error instanceof OneIDError, "NetworkError should extend OneIDError");
+        assert.ok(!(network_error instanceof EnrollmentError), "NetworkError should NOT extend EnrollmentError");
+    });
+    it("should preserve error codes", () => {
+        const error = new NoHSMError("no tpm found");
+        assert.equal(error.error_code, "NO_HSM_FOUND");
+        assert.equal(error.message, "no tpm found");
+        assert.equal(error.name, "NoHSMError");
+    });
+});
+describe("SDK version and types (offline)", () => {
+    it("should report correct SDK version", () => {
+        assert.equal(VERSION, "0.1.0");
+    });
+    it("should have all trust tiers", () => {
+        assert.equal(TrustTier.SOVEREIGN, "sovereign");
+        assert.equal(TrustTier.SOVEREIGN_PORTABLE, "sovereign-portable");
+        assert.equal(TrustTier.LEGACY, "legacy");
+        assert.equal(TrustTier.VIRTUAL, "virtual");
+        assert.equal(TrustTier.ENCLAVE, "enclave");
+        assert.equal(TrustTier.DECLARED, "declared");
+    });
+    it("should have all key algorithms", () => {
+        assert.equal(KeyAlgorithm.ED25519, "ed25519");
+        assert.equal(KeyAlgorithm.ECDSA_P256, "ecdsa-p256");
+        assert.equal(KeyAlgorithm.ECDSA_P384, "ecdsa-p384");
+        assert.equal(KeyAlgorithm.RSA_2048, "rsa-2048");
+        assert.equal(KeyAlgorithm.RSA_4096, "rsa-4096");
+    });
+});
+describe("Input validation (offline)", () => {
+    it("should reject invalid trust tier", async () => {
+        await assert.rejects(() => enroll({ request_tier: "nonexistent-tier" }), (error) => {
+            assert.ok(error.message.includes("Invalid trust tier"));
+            return true;
+        });
+    });
+    it("should reject invalid key algorithm", async () => {
+        await assert.rejects(() => enroll({ request_tier: "declared", key_algorithm: "bogus-algo" }), (error) => {
+            assert.ok(error.message.includes("Invalid key algorithm"));
+            return true;
+        });
+    });
+});
+// =====================================================================
+// LIVE ENROLLMENT TEST (requires network + working server)
+// =====================================================================
+describe("Live declared-tier enrollment (requires server)", () => {
+    let backed_up_credentials_exist = false;
+    const credentials_file_path = get_credentials_file_path();
+    const backup_path = credentials_file_path + BACKUP_SUFFIX;
+    before(() => {
+        if (fs.existsSync(credentials_file_path)) {
+            fs.copyFileSync(credentials_file_path, backup_path);
+            backed_up_credentials_exist = true;
+            fs.unlinkSync(credentials_file_path);
+        }
+    });
+    after(() => {
+        if (backed_up_credentials_exist && fs.existsSync(backup_path)) {
+            if (fs.existsSync(credentials_file_path)) {
+                fs.unlinkSync(credentials_file_path);
+            }
+            fs.renameSync(backup_path, credentials_file_path);
+        }
+    });
+    it("should enroll at declared tier with ed25519 key", async () => {
+        if (credentials_exist()) {
+            delete_credentials();
+        }
+        let identity;
+        try {
+            identity = await enroll({
+                request_tier: "declared",
+                key_algorithm: "ed25519",
+            });
+        }
+        catch (error) {
+            if (error instanceof NetworkError || (error instanceof Error && error.message.includes("500"))) {
+                console.log("  SKIPPED: Server unavailable or returned 500. This is a server issue, not an SDK issue.");
+                return; // Skip test gracefully
+            }
+            throw error;
+        }
+        // Verify the identity object
+        assert.ok(identity.internal_id, "internal_id should be non-empty");
+        assert.ok(identity.internal_id.startsWith("1id_"), `internal_id should start with '1id_', got: ${identity.internal_id}`);
+        assert.ok(identity.handle, "handle should be non-empty");
+        assert.ok(identity.handle.startsWith("@"), `handle should start with '@', got: ${identity.handle}`);
+        assert.equal(identity.trust_tier, TrustTier.DECLARED);
+        assert.equal(identity.hsm_type, HSMType.SOFTWARE);
+        assert.equal(identity.key_algorithm, KeyAlgorithm.ED25519);
+        assert.ok(identity.enrolled_at instanceof Date, "enrolled_at should be a Date");
+        assert.equal(identity.device_count, 0, "declared tier should have device_count 0");
+        console.log(`  Enrolled: ${identity.handle} (${identity.internal_id})`);
+        console.log(`  Trust tier: ${identity.trust_tier}`);
+        console.log(`  Key algorithm: ${identity.key_algorithm}`);
+        // Verify whoami works with the live enrollment
+        const me = whoami();
+        assert.ok(me.internal_id.startsWith("1id_"));
+        assert.equal(me.trust_tier, TrustTier.DECLARED);
+        console.log(`  whoami(): ${me.handle}`);
+    });
+});
+//# sourceMappingURL=test_declared_enrollment.js.map

package/dist/test/test_declared_enrollment.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"test_declared_enrollment.js","sourceRoot":"","sources":["../../src/test/test_declared_enrollment.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AACxD,OAAO,KAAK,MAAM,MAAM,oBAAoB,CAAC;AAC7C,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AAEtC,OAAO,EACL,MAAM,EACN,MAAM,EACN,iBAAiB,EACjB,SAAS,EACT,YAAY,EACZ,OAAO,EACP,OAAO,EACP,UAAU,EACV,eAAe,EACf,UAAU,EACV,YAAY,EACZ,gBAAgB,EAChB,+BAA+B,GAChC,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,yBAAyB,EACzB,kBAAkB,EAClB,gBAAgB,EAChB,gBAAgB,GAEjB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAE9C,2BAA2B;AAC3B,MAAM,aAAa,GAAG,cAAc,CAAC;AAErC,wEAAwE;AACxE,2CAA2C;AAC3C,wEAAwE;AAExE,QAAQ,CAAC,0BAA0B,EAAE,GAAG,EAAE;IACxC,EAAE,CAAC,iCAAiC,EAAE,GAAG,EAAE;QACzC,MAAM,EAAE,GAAG,gBAAgB,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;QAClD,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,eAAe,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,uCAAuC,CAAC,CAAC;QACrG,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,sCAAsC,CAAC,CAAC;IACpG,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qCAAqC,EAAE,GAAG,EAAE;QAC7C,MAAM,EAAE,GAAG,gBAAgB,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC;QACrD,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,eAAe,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAC,CAAC;QAC5D,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qCAAqC,EAAE,GAAG,EAAE;QAC7C,MAAM,EAAE,GAAG,gBAAgB,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC;QACrD,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,eAAe,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAC,CAAC;QAC5D,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kCAAkC,EAAE,GAAG,EAAE;QAC1C,MAAM,EAAE,GAAG,gBAAgB,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;QACnD,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,eAAe,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAC,CAAC;QAC5D,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kCAAkC,EAAE,GAAG,EAAE;QAC1C,MAAM,EAAE,GAAG,gBAAgB,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;QACnD,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,eAAe,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAC,CAAC;QAC5D,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,6BAA6B,EAAE,GAAG,EAAE;IAC3C,EAAE,CAAC,qCAAqC,EAAE,GAAG,EAAE;QAC7C,MAAM,EAAE,GAAG,gBAAgB,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;QAClD,MAAM,SAAS,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QACzC,MAAM,SAAS,GAAG,+BAA+B,CAAC,EAAE,CAAC,eAAe,EAAE,SAAS,CAAC,CAAC;QACjF,MAAM,CAAC,EAAE,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,+BAA+B,CAAC,CAAC;QAEjE,4CAA4C;QAC5C,MAAM,UAAU,GAAG,MAAM,CAAC,eAAe,CAAC,EAAE,CAAC,cAAc,CAAC,CAAC;QAC7D,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;QACvE,MAAM,CAAC,EAAE,CAAC,QAAQ,EAAE,2CAA2C,CAAC,CAAC;IACnE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yCAAyC,EAAE,GAAG,EAAE;QACjD,MAAM,EAAE,GAAG,gBAAgB,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC;QACrD,MAAM,SAAS,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QACzC,MAAM,SAAS,GAAG,+BAA+B,CAAC,EAAE,CAAC,eAAe,EAAE,SAAS,CAAC,CAAC;QACjF,MAAM,CAAC,EAAE,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAEhC,MAAM,UAAU,GAAG,MAAM,CAAC,eAAe,CAAC,EAAE,CAAC,cAAc,CAAC,CAAC;QAC7D,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;QAC3E,MAAM,CAAC,EAAE,CAAC,QAAQ,EAAE,+CAA+C,CAAC,CAAC;IACvE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sCAAsC,EAAE,GAAG,EAAE;QAC9C,MAAM,EAAE,GAAG,gBAAgB,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;QACnD,MAAM,SAAS,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QACzC,MAAM,SAAS,GAAG,+BAA+B,CAAC,EAAE,CAAC,eAAe,EAAE,SAAS,CAAC,CAAC;QACjF,MAAM,CAAC,EAAE,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAEhC,MAAM,UAAU,GAAG,MAAM,CAAC,eAAe,CAAC,EAAE,CAAC,cAAc,CAAC,CAAC;QAC7D,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,SAAS,EAAE;YAClD,GAAG,EAAE,UAAU;YACf,OAAO,EAAE,MAAM,CAAC,SAAS,CAAC,iBAAiB;SAC5C,EAAE,SAAS,CAAC,CAAC;QACd,MAAM,CAAC,EAAE,CAAC,QAAQ,EAAE,4CAA4C,CAAC,CAAC;IACpE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,8BAA8B,EAAE,GAAG,EAAE;IAC5C,MAAM,qBAAqB,GAAG,yBAAyB,EAAE,CAAC;IAC1D,MAAM,WAAW,GAAG,qBAAqB,GAAG,mBAAmB,CAAC;IAChE,IAAI,wBAAwB,GAAG,KAAK,CAAC;IAErC,MAAM,CAAC,GAAG,EAAE;QACV,IAAI,EAAE,CAAC,UAAU,CAAC,qBAAqB,CAAC,EAAE,CAAC;YACzC,EAAE,CAAC,YAAY,CAAC,qBAAqB,EAAE,WAAW,CAAC,CAAC;YACpD,wBAAwB,GAAG,IAAI,CAAC;YAChC,EAAE,CAAC,UAAU,CAAC,qBAAqB,CAAC,CAAC;QACvC,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,KAAK,CAAC,GAAG,EAAE;QACT,+BAA+B;QAC/B,IAAI,wBAAwB,IAAI,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;YAC3D,IAAI,EAAE,CAAC,UAAU,CAAC,qBAAqB,CAAC,EAAE,CAAC;gBACzC,EAAE,CAAC,UAAU,CAAC,qBAAqB,CAAC,CAAC;YACvC,CAAC;YACD,EAAE,CAAC,UAAU,CAAC,WAAW,EAAE,qBAAqB,CAAC,CAAC;QACpD,CAAC;aAAM,IAAI,EAAE,CAAC,UAAU,CAAC,qBAAqB,CAAC,EAAE,CAAC;YAChD,4BAA4B;YAC5B,EAAE,CAAC,UAAU,CAAC,qBAAqB,CAAC,CAAC;QACvC,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kCAAkC,EAAE,GAAG,EAAE;QAC1C,MAAM,gBAAgB,GAAsB;YAC1C,SAAS,EAAE,cAAc;YACzB,aAAa,EAAE,eAAe;YAC9B,cAAc,EAAE,6DAA6D;YAC7E,YAAY,EAAE,iBAAiB;YAC/B,UAAU,EAAE,UAAU;YACtB,aAAa,EAAE,SAAS;YACxB,eAAe,EAAE,8DAA8D;YAC/E,WAAW,EAAE,sBAAsB;SACpC,CAAC;QAEF,gBAAgB,CAAC,gBAAgB,CAAC,CAAC;QACnC,MAAM,CAAC,EAAE,CAAC,iBAAiB,EAAE,EAAE,qCAAqC,CAAC,CAAC;QAEtE,MAAM,MAAM,GAAG,gBAAgB,EAAE,CAAC;QAClC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;QAC/C,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,aAAa,EAAE,eAAe,CAAC,CAAC;QACpD,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;QAC5C,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC;QAC9C,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,eAAe,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;QACvD,oDAAoD;QACpD,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC;QAC1B,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC;QACnD,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;QAC/C,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC,QAAQ,CAAC,CAAC;QACtD,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;QAClD,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,aAAa,EAAE,YAAY,CAAC,OAAO,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yDAAyD,EAAE,GAAG,EAAE;QACjE,kBAAkB,EAAE,CAAC;QACrB,MAAM,CAAC,MAAM,CACX,GAAG,EAAE,CAAC,MAAM,EAAE,EACd,CAAC,KAAY,EAAE,EAAE;YACf,MAAM,CAAC,EAAE,CAAC,KAAK,YAAY,gBAAgB,CAAC,CAAC;YAC7C,OAAO,IAAI,CAAC;QACd,CAAC,CACF,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,+BAA+B,EAAE,GAAG,EAAE;IAC7C,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;QAC/C,MAAM,gBAAgB,GAAG,IAAI,eAAe,CAAC,MAAM,CAAC,CAAC;QACrD,MAAM,CAAC,EAAE,CAAC,gBAAgB,YAAY,UAAU,EAAE,0CAA0C,CAAC,CAAC;QAC9F,MAAM,CAAC,EAAE,CAAC,gBAAgB,YAAY,KAAK,EAAE,qCAAqC,CAAC,CAAC;QAEpF,MAAM,YAAY,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;QAC5C,MAAM,CAAC,EAAE,CAAC,YAAY,YAAY,eAAe,EAAE,0CAA0C,CAAC,CAAC;QAC/F,MAAM,CAAC,EAAE,CAAC,YAAY,YAAY,UAAU,EAAE,qCAAqC,CAAC,CAAC;QAErF,MAAM,aAAa,GAAG,IAAI,YAAY,CAAC,MAAM,CAAC,CAAC;QAC/C,MAAM,CAAC,EAAE,CAAC,aAAa,YAAY,UAAU,EAAE,uCAAuC,CAAC,CAAC;QACxF,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa,YAAY,eAAe,CAAC,EAAE,gDAAgD,CAAC,CAAC;IAC3G,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6BAA6B,EAAE,GAAG,EAAE;QACrC,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,cAAc,CAAC,CAAC;QAC7C,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC;QAC/C,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;QAC5C,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,iCAAiC,EAAE,GAAG,EAAE;IAC/C,EAAE,CAAC,mCAAmC,EAAE,GAAG,EAAE;QAC3C,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6BAA6B,EAAE,GAAG,EAAE;QACrC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;QAC/C,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,kBAAkB,EAAE,oBAAoB,CAAC,CAAC;QACjE,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QACzC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QAC3C,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QAC3C,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gCAAgC,EAAE,GAAG,EAAE;QACxC,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QAC9C,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;QACpD,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;QACpD,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAChD,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,4BAA4B,EAAE,GAAG,EAAE;IAC1C,EAAE,CAAC,kCAAkC,EAAE,KAAK,IAAI,EAAE;QAChD,MAAM,MAAM,CAAC,OAAO,CAClB,GAAG,EAAE,CAAC,MAAM,CAAC,EAAE,YAAY,EAAE,kBAAkB,EAAE,CAAC,EAClD,CAAC,KAAY,EAAE,EAAE;YACf,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAC,CAAC,CAAC;YACxD,OAAO,IAAI,CAAC;QACd,CAAC,CACF,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qCAAqC,EAAE,KAAK,IAAI,EAAE;QACnD,MAAM,MAAM,CAAC,OAAO,CAClB,GAAG,EAAE,CAAC,MAAM,CAAC,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,YAAY,EAAE,CAAC,EACvE,CAAC,KAAY,EAAE,EAAE;YACf,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,uBAAuB,CAAC,CAAC,CAAC;YAC3D,OAAO,IAAI,CAAC;QACd,CAAC,CACF,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,wEAAwE;AACxE,2DAA2D;AAC3D,wEAAwE;AAExE,QAAQ,CAAC,iDAAiD,EAAE,GAAG,EAAE;IAC/D,IAAI,2BAA2B,GAAG,KAAK,CAAC;IACxC,MAAM,qBAAqB,GAAG,yBAAyB,EAAE,CAAC;IAC1D,MAAM,WAAW,GAAG,qBAAqB,GAAG,aAAa,CAAC;IAE1D,MAAM,CAAC,GAAG,EAAE;QACV,IAAI,EAAE,CAAC,UAAU,CAAC,qBAAqB,CAAC,EAAE,CAAC;YACzC,EAAE,CAAC,YAAY,CAAC,qBAAqB,EAAE,WAAW,CAAC,CAAC;YACpD,2BAA2B,GAAG,IAAI,CAAC;YACnC,EAAE,CAAC,UAAU,CAAC,qBAAqB,CAAC,CAAC;QACvC,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,KAAK,CAAC,GAAG,EAAE;QACT,IAAI,2BAA2B,IAAI,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;YAC9D,IAAI,EAAE,CAAC,UAAU,CAAC,qBAAqB,CAAC,EAAE,CAAC;gBACzC,EAAE,CAAC,UAAU,CAAC,qBAAqB,CAAC,CAAC;YACvC,CAAC;YACD,EAAE,CAAC,UAAU,CAAC,WAAW,EAAE,qBAAqB,CAAC,CAAC;QACpD,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iDAAiD,EAAE,KAAK,IAAI,EAAE;QAC/D,IAAI,iBAAiB,EAAE,EAAE,CAAC;YACxB,kBAAkB,EAAE,CAAC;QACvB,CAAC;QAED,IAAI,QAAQ,CAAC;QACb,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,MAAM,CAAC;gBACtB,YAAY,EAAE,UAAU;gBACxB,aAAa,EAAE,SAAS;aACzB,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,YAAY,IAAI,CAAC,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;gBAC/F,OAAO,CAAC,GAAG,CAAC,0FAA0F,CAAC,CAAC;gBACxG,OAAO,CAAC,uBAAuB;YACjC,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;QAED,6BAA6B;QAC7B,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,WAAW,EAAE,iCAAiC,CAAC,CAAC;QACnE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,8CAA8C,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;QACzH,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,4BAA4B,CAAC,CAAC;QACzD,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,sCAAsC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QACpG,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC,QAAQ,CAAC,CAAC;QACtD,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;QAClD,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,aAAa,EAAE,YAAY,CAAC,OAAO,CAAC,CAAC;QAC3D,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,WAAW,YAAY,IAAI,EAAE,8BAA8B,CAAC,CAAC;QAChF,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,YAAY,EAAE,CAAC,EAAE,0CAA0C,CAAC,CAAC;QAEnF,OAAO,CAAC,GAAG,CAAC,eAAe,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,WAAW,GAAG,CAAC,CAAC;QACxE,OAAO,CAAC,GAAG,CAAC,iBAAiB,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC;QACpD,OAAO,CAAC,GAAG,CAAC,oBAAoB,QAAQ,CAAC,aAAa,EAAE,CAAC,CAAC;QAE1D,+CAA+C;QAC/C,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC;QACpB,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,WAAW,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;QAC7C,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,UAAU,EAAE,SAAS,CAAC,QAAQ,CAAC,CAAC;QAChD,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/package.json

@@ -0,0 +1,53 @@
+{
+  "name": "1id",
+  "version": "0.1.0",
+  "description": "Hardware-anchored identity SDK for AI agents -- 1id.com",
+  "keywords": [
+    "identity",
+    "ai",
+    "agent",
+    "tpm",
+    "hardware",
+    "oidc",
+    "oauth2",
+    "sybil",
+    "1id"
+  ],
+  "homepage": "https://1id.com",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/AuraFriday/oneid-node.git"
+  },
+  "bugs": {
+    "url": "https://github.com/AuraFriday/oneid-node/issues"
+  },
+  "license": "Apache-2.0",
+  "author": "Christopher Drake <chris@1id.com>",
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "import": "./dist/index.js",
+      "types": "./dist/index.d.ts"
+    }
+  },
+  "files": [
+    "dist",
+    "LICENSE",
+    "README.md"
+  ],
+  "engines": {
+    "node": ">=18.0.0"
+  },
+  "scripts": {
+    "build": "tsc",
+    "clean": "node -e \"const fs=require('fs'); fs.rmSync('dist',{recursive:true,force:true})\"",
+    "prepublishOnly": "npm run clean && npm run build",
+    "test": "node --test dist/test/test_declared_enrollment.js",
+    "test:src": "npx tsc && node --test dist/test/test_declared_enrollment.js"
+  },
+  "devDependencies": {
+    "typescript": "^5.4"
+  }
+}