1id 0.4.0 → 0.5.0

package/README.md

@@ -42,13 +42,13 @@ console.log(`I am ${me.handle} (tier: ${me.trust_tier})`);
 
 ## Trust Tiers
 
+RFC: `draft-drake-email-hardware-attestation-00` Section 3.
+
 | Tier | Hardware | Sybil Resistant | Trust Level |
 |------|----------|-----------------|-------------|
 | `sovereign` | TPM (Intel, AMD, Infineon) with valid cert | Yes | Highest |
-| `sovereign-portable` | YubiKey / Nitrokey / Feitian with attestation | Yes | Highest |
-| `legacy` | Hardware TPM or security key with expired cert | Yes | High |
+| `portable` | YubiKey / Nitrokey / Feitian with PIV attestation | Yes | High |
 | `virtual` | VMware / Hyper-V / QEMU vTPM | No | Verified Hardware |
-| `enclave` | Apple Secure Enclave (TOFU) | No | Verified Hardware |
 | `declared` | None (software keys) | No | Software |
 
 **CRITICAL**: `request_tier` is a REQUIREMENT, not a preference. You get exactly what you ask for, or an exception. No silent fallbacks.

package/dist/cli.js

@@ -16,7 +16,7 @@
 import { credentials_exist, load_credentials, get_credentials_file_path, delete_credentials } from "./credentials.js";
 import { enroll } from "./enroll.js";
 import { get_token } from "./auth.js";
-const VERSION = "0.2.0";
+const VERSION = "0.5.0";
 function print_help() {
     console.log(`oneid ${VERSION} -- 1id.com identity for AI agents
 

package/dist/client.d.ts

@@ -32,11 +32,11 @@ export declare class OneIDAPIClient {
      */
     enroll_declared(software_key_pem: string, key_algorithm: string, operator_email?: string | null, requested_handle?: string | null): Promise<Record<string, unknown>>;
     /**
-     * Begin TPM/HSM-based enrollment (sovereign/sovereign-portable tiers).
+     * Begin TPM/HSM-based enrollment (sovereign/virtual tiers).
      */
     enroll_begin(ek_certificate_pem: string, ak_public_key_pem: string, ak_tpmt_public_b64?: string, ek_public_key_pem?: string, ek_certificate_chain_pem?: string[], hsm_type?: string, operator_email?: string | null, requested_handle?: string | null): Promise<Record<string, unknown>>;
     /**
-     * Begin PIV-based enrollment (sovereign-portable tier).
+     * Begin PIV-based enrollment (portable tier).
      *
      * Sends the PIV attestation certificate, chain, and signing public key
      * to the PIV-specific server endpoint. The server validates the chain

package/dist/client.js

@@ -19,7 +19,7 @@ import { DEFAULT_API_BASE_URL } from "./credentials.js";
 import { EnrollmentError, NetworkError, raise_from_server_error_response, } from "./exceptions.js";
 // -- HTTP client configuration --
 const DEFAULT_HTTP_TIMEOUT_MILLISECONDS = 30_000;
-const USER_AGENT = "oneid-sdk-node/0.3.0";
+const USER_AGENT = "oneid-sdk-node/0.5.0";
 /**
  * Make a raw HTTP(S) request and return the parsed JSON body.
  * Uses only Node.js built-in modules.
@@ -119,7 +119,7 @@ export class OneIDAPIClient {
         return this._make_request("POST", "/api/v1/enroll/declared", request_body);
     }
     /**
-     * Begin TPM/HSM-based enrollment (sovereign/sovereign-portable tiers).
+     * Begin TPM/HSM-based enrollment (sovereign/virtual tiers).
      */
     async enroll_begin(ek_certificate_pem, ak_public_key_pem, ak_tpmt_public_b64 = "", ek_public_key_pem = "", ek_certificate_chain_pem, hsm_type = "tpm", operator_email, requested_handle) {
         const request_body = {
@@ -141,7 +141,7 @@ export class OneIDAPIClient {
         return this._make_request("POST", "/api/v1/enroll/begin", request_body);
     }
     /**
-     * Begin PIV-based enrollment (sovereign-portable tier).
+     * Begin PIV-based enrollment (portable tier).
      *
      * Sends the PIV attestation certificate, chain, and signing public key
      * to the PIV-specific server endpoint. The server validates the chain

package/dist/credentials.d.ts

@@ -42,6 +42,14 @@ export interface StoredCredentials {
     hsm_key_reference?: string | null;
     /** ISO 8601 timestamp of enrollment. */
     enrolled_at?: string | null;
+    /** Friendly name chosen by the agent (e.g., "Clawdia", "Sparky"). */
+    display_name?: string | null;
+    /** Agent Identity URN (e.g., 'urn:aid:1id.com:1id-a7b3c9d2'), or null if not yet assigned. */
+    agent_identity_urn?: string | null;
+    /** ISO 8601 timestamp of when the user consented to privacy implications. */
+    privacy_consent_given_at?: string | null;
+    /** The user's chosen default attestation mode: 'sd-jwt' or 'direct'. */
+    default_attestation_mode?: string | null;
 }
 /**
  * Return the platform-appropriate directory for storing credentials.

package/dist/credentials.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../src/credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAQH,eAAO,MAAM,oBAAoB,oBAAoB,CAAC;AACtD,eAAO,MAAM,sBAAsB,gEAAgE,CAAC;AAKpG;;;;;GAKG;AACH,MAAM,WAAW,iBAAiB;IAChC,4EAA4E;IAC5E,SAAS,EAAE,MAAM,CAAC;IAClB,+CAA+C;IAC/C,aAAa,EAAE,MAAM,CAAC;IACtB,+CAA+C;IAC/C,cAAc,EAAE,MAAM,CAAC;IACvB,+CAA+C;IAC/C,YAAY,EAAE,MAAM,CAAC;IACrB,6CAA6C;IAC7C,UAAU,EAAE,MAAM,CAAC;IACnB,kDAAkD;IAClD,aAAa,EAAE,MAAM,CAAC;IACtB,mEAAmE;IACnE,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,qFAAqF;IACrF,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,wCAAwC;IACxC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,IAAI,MAAM,CAelD;AAED;;GAEG;AACH,wBAAgB,yBAAyB,IAAI,MAAM,CAElD;AAgBD;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,WAAW,EAAE,iBAAiB,GAAG,MAAM,CA4BvE;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,IAAI,iBAAiB,CAkCpD;AAED;;GAEG;AACH,wBAAgB,iBAAiB,IAAI,OAAO,CAE3C;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,IAAI,OAAO,CAO5C"}
+{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../src/credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAQH,eAAO,MAAM,oBAAoB,oBAAoB,CAAC;AACtD,eAAO,MAAM,sBAAsB,gEAAgE,CAAC;AAKpG;;;;;GAKG;AACH,MAAM,WAAW,iBAAiB;IAChC,4EAA4E;IAC5E,SAAS,EAAE,MAAM,CAAC;IAClB,+CAA+C;IAC/C,aAAa,EAAE,MAAM,CAAC;IACtB,+CAA+C;IAC/C,cAAc,EAAE,MAAM,CAAC;IACvB,+CAA+C;IAC/C,YAAY,EAAE,MAAM,CAAC;IACrB,6CAA6C;IAC7C,UAAU,EAAE,MAAM,CAAC;IACnB,kDAAkD;IAClD,aAAa,EAAE,MAAM,CAAC;IACtB,mEAAmE;IACnE,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,qFAAqF;IACrF,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,wCAAwC;IACxC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,qEAAqE;IACrE,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,8FAA8F;IAC9F,kBAAkB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,6EAA6E;IAC7E,wBAAwB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzC,wEAAwE;IACxE,wBAAwB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1C;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,IAAI,MAAM,CAelD;AAED;;GAEG;AACH,wBAAgB,yBAAyB,IAAI,MAAM,CAElD;AAgBD;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,WAAW,EAAE,iBAAiB,GAAG,MAAM,CAwCvE;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,IAAI,iBAAiB,CAsCpD;AAED;;GAEG;AACH,wBAAgB,iBAAiB,IAAI,OAAO,CAE3C;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,IAAI,OAAO,CAO5C"}

package/dist/credentials.js

@@ -96,6 +96,18 @@ export function save_credentials(credentials) {
     if (credentials.hsm_key_reference != null) {
         credentials_dict["hsm_key_reference"] = credentials.hsm_key_reference;
     }
+    if (credentials.display_name != null) {
+        credentials_dict["display_name"] = credentials.display_name;
+    }
+    if (credentials.agent_identity_urn != null) {
+        credentials_dict["agent_identity_urn"] = credentials.agent_identity_urn;
+    }
+    if (credentials.privacy_consent_given_at != null) {
+        credentials_dict["privacy_consent_given_at"] = credentials.privacy_consent_given_at;
+    }
+    if (credentials.default_attestation_mode != null) {
+        credentials_dict["default_attestation_mode"] = credentials.default_attestation_mode;
+    }
     fs.writeFileSync(credentials_file_path, JSON.stringify(credentials_dict, null, 2) + "\n", "utf-8");
     set_owner_only_permissions(credentials_file_path);
     return credentials_file_path;
@@ -131,6 +143,10 @@ export function load_credentials() {
         private_key_pem: credentials_dict["private_key_pem"] ?? null,
         hsm_key_reference: credentials_dict["hsm_key_reference"] ?? null,
         enrolled_at: credentials_dict["enrolled_at"] ?? null,
+        display_name: credentials_dict["display_name"] ?? null,
+        agent_identity_urn: credentials_dict["agent_identity_urn"] ?? null,
+        privacy_consent_given_at: credentials_dict["privacy_consent_given_at"] ?? null,
+        default_attestation_mode: credentials_dict["default_attestation_mode"] ?? null,
     };
 }
 /**

package/dist/credentials.js.map

@@ -1 +1 @@
-{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../src/credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAE/D,iCAAiC;AACjC,MAAM,CAAC,MAAM,oBAAoB,GAAG,iBAAiB,CAAC;AACtD,MAAM,CAAC,MAAM,sBAAsB,GAAG,6DAA6D,CAAC;AAEpG,6BAA6B;AAC7B,MAAM,oBAAoB,GAAG,kBAAkB,CAAC;AA6BhD;;;;;;GAMG;AACH,MAAM,UAAU,yBAAyB;IACvC,MAAM,eAAe,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC;IACtC,IAAI,eAAe,KAAK,OAAO,EAAE,CAAC;QAChC,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACvC,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACrC,CAAC;QACD,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IAChE,CAAC;SAAM,CAAC;QACN,MAAM,eAAe,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;QACvD,IAAI,eAAe,EAAE,CAAC;YACpB,OAAO,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;QAC7C,CAAC;QACD,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IACrD,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,yBAAyB;IACvC,OAAO,IAAI,CAAC,IAAI,CAAC,yBAAyB,EAAE,EAAE,oBAAoB,CAAC,CAAC;AACtE,CAAC;AAED;;;GAGG;AACH,SAAS,0BAA0B,CAAC,SAAiB;IACnD,IAAI,EAAE,CAAC,QAAQ,EAAE,KAAK,OAAO,EAAE,CAAC;QAC9B,IAAI,CAAC;YACH,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QACjC,CAAC;QAAC,MAAM,CAAC;YACP,+CAA+C;QACjD,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAAC,WAA8B;IAC7D,MAAM,qBAAqB,GAAG,yBAAyB,EAAE,CAAC;IAC1D,EAAE,CAAC,SAAS,CAAC,qBAAqB,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAEzD,MAAM,qBAAqB,GAAG,IAAI,CAAC,IAAI,CAAC,qBAAqB,EAAE,oBAAoB,CAAC,CAAC;IAErF,gEAAgE;IAChE,MAAM,gBAAgB,GAA4B;QAChD,SAAS,EAAE,WAAW,CAAC,SAAS;QAChC,aAAa,EAAE,WAAW,CAAC,aAAa;QACxC,cAAc,EAAE,WAAW,CAAC,cAAc;QAC1C,YAAY,EAAE,WAAW,CAAC,YAAY;QACtC,UAAU,EAAE,WAAW,CAAC,UAAU;QAClC,aAAa,EAAE,WAAW,CAAC,aAAa;QACxC,WAAW,EAAE,WAAW,CAAC,WAAW,IAAI,IAAI;KAC7C,CAAC;IAEF,IAAI,WAAW,CAAC,eAAe,IAAI,IAAI,EAAE,CAAC;QACxC,gBAAgB,CAAC,iBAAiB,CAAC,GAAG,WAAW,CAAC,eAAe,CAAC;IACpE,CAAC;IACD,IAAI,WAAW,CAAC,iBAAiB,IAAI,IAAI,EAAE,CAAC;QAC1C,gBAAgB,CAAC,mBAAmB,CAAC,GAAG,WAAW,CAAC,iBAAiB,CAAC;IACxE,CAAC;IAED,EAAE,CAAC,aAAa,CAAC,qBAAqB,EAAE,IAAI,CAAC,SAAS,CAAC,gBAAgB,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC,CAAC;IACnG,0BAA0B,CAAC,qBAAqB,CAAC,CAAC;IAElD,OAAO,qBAAqB,CAAC;AAC/B,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB;IAC9B,MAAM,qBAAqB,GAAG,yBAAyB,EAAE,CAAC;IAE1D,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,qBAAqB,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,gBAAgB,CACxB,gCAAgC,qBAAqB,IAAI;YACzD,kDAAkD,CACnD,CAAC;IACJ,CAAC;IAED,IAAI,aAAqB,CAAC;IAC1B,IAAI,gBAAyC,CAAC;IAE9C,IAAI,CAAC;QACH,aAAa,GAAG,EAAE,CAAC,YAAY,CAAC,qBAAqB,EAAE,OAAO,CAAC,CAAC;QAChE,gBAAgB,GAAG,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IAC/C,CAAC;IAAC,OAAO,UAAU,EAAE,CAAC;QACpB,MAAM,IAAI,UAAU,CAClB,uBAAuB,qBAAqB,gCAAgC,UAAU,EAAE,EACxF,uBAAuB,CACxB,CAAC;IACJ,CAAC;IAED,OAAO;QACL,SAAS,EAAE,gBAAgB,CAAC,WAAW,CAAW;QAClD,aAAa,EAAE,gBAAgB,CAAC,eAAe,CAAW;QAC1D,cAAc,EAAE,gBAAgB,CAAC,gBAAgB,CAAW;QAC5D,YAAY,EAAE,gBAAgB,CAAC,cAAc,CAAW;QACxD,UAAU,EAAG,gBAAgB,CAAC,YAAY,CAAY,IAAI,UAAU;QACpE,aAAa,EAAG,gBAAgB,CAAC,eAAe,CAAY,IAAI,SAAS;QACzE,eAAe,EAAG,gBAAgB,CAAC,iBAAiB,CAAY,IAAI,IAAI;QACxE,iBAAiB,EAAG,gBAAgB,CAAC,mBAAmB,CAAY,IAAI,IAAI;QAC5E,WAAW,EAAG,gBAAgB,CAAC,aAAa,CAAY,IAAI,IAAI;KACjE,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB;IAC/B,OAAO,EAAE,CAAC,UAAU,CAAC,yBAAyB,EAAE,CAAC,CAAC;AACpD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB;IAChC,MAAM,qBAAqB,GAAG,yBAAyB,EAAE,CAAC;IAC1D,IAAI,EAAE,CAAC,UAAU,CAAC,qBAAqB,CAAC,EAAE,CAAC;QACzC,EAAE,CAAC,UAAU,CAAC,qBAAqB,CAAC,CAAC;QACrC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}
+{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../src/credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAE/D,iCAAiC;AACjC,MAAM,CAAC,MAAM,oBAAoB,GAAG,iBAAiB,CAAC;AACtD,MAAM,CAAC,MAAM,sBAAsB,GAAG,6DAA6D,CAAC;AAEpG,6BAA6B;AAC7B,MAAM,oBAAoB,GAAG,kBAAkB,CAAC;AAqChD;;;;;;GAMG;AACH,MAAM,UAAU,yBAAyB;IACvC,MAAM,eAAe,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC;IACtC,IAAI,eAAe,KAAK,OAAO,EAAE,CAAC;QAChC,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACvC,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACrC,CAAC;QACD,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IAChE,CAAC;SAAM,CAAC;QACN,MAAM,eAAe,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;QACvD,IAAI,eAAe,EAAE,CAAC;YACpB,OAAO,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;QAC7C,CAAC;QACD,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IACrD,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,yBAAyB;IACvC,OAAO,IAAI,CAAC,IAAI,CAAC,yBAAyB,EAAE,EAAE,oBAAoB,CAAC,CAAC;AACtE,CAAC;AAED;;;GAGG;AACH,SAAS,0BAA0B,CAAC,SAAiB;IACnD,IAAI,EAAE,CAAC,QAAQ,EAAE,KAAK,OAAO,EAAE,CAAC;QAC9B,IAAI,CAAC;YACH,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QACjC,CAAC;QAAC,MAAM,CAAC;YACP,+CAA+C;QACjD,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAAC,WAA8B;IAC7D,MAAM,qBAAqB,GAAG,yBAAyB,EAAE,CAAC;IAC1D,EAAE,CAAC,SAAS,CAAC,qBAAqB,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAEzD,MAAM,qBAAqB,GAAG,IAAI,CAAC,IAAI,CAAC,qBAAqB,EAAE,oBAAoB,CAAC,CAAC;IAErF,gEAAgE;IAChE,MAAM,gBAAgB,GAA4B;QAChD,SAAS,EAAE,WAAW,CAAC,SAAS;QAChC,aAAa,EAAE,WAAW,CAAC,aAAa;QACxC,cAAc,EAAE,WAAW,CAAC,cAAc;QAC1C,YAAY,EAAE,WAAW,CAAC,YAAY;QACtC,UAAU,EAAE,WAAW,CAAC,UAAU;QAClC,aAAa,EAAE,WAAW,CAAC,aAAa;QACxC,WAAW,EAAE,WAAW,CAAC,WAAW,IAAI,IAAI;KAC7C,CAAC;IAEF,IAAI,WAAW,CAAC,eAAe,IAAI,IAAI,EAAE,CAAC;QACxC,gBAAgB,CAAC,iBAAiB,CAAC,GAAG,WAAW,CAAC,eAAe,CAAC;IACpE,CAAC;IACD,IAAI,WAAW,CAAC,iBAAiB,IAAI,IAAI,EAAE,CAAC;QAC1C,gBAAgB,CAAC,mBAAmB,CAAC,GAAG,WAAW,CAAC,iBAAiB,CAAC;IACxE,CAAC;IACD,IAAI,WAAW,CAAC,YAAY,IAAI,IAAI,EAAE,CAAC;QACrC,gBAAgB,CAAC,cAAc,CAAC,GAAG,WAAW,CAAC,YAAY,CAAC;IAC9D,CAAC;IACD,IAAI,WAAW,CAAC,kBAAkB,IAAI,IAAI,EAAE,CAAC;QAC3C,gBAAgB,CAAC,oBAAoB,CAAC,GAAG,WAAW,CAAC,kBAAkB,CAAC;IAC1E,CAAC;IACD,IAAI,WAAW,CAAC,wBAAwB,IAAI,IAAI,EAAE,CAAC;QACjD,gBAAgB,CAAC,0BAA0B,CAAC,GAAG,WAAW,CAAC,wBAAwB,CAAC;IACtF,CAAC;IACD,IAAI,WAAW,CAAC,wBAAwB,IAAI,IAAI,EAAE,CAAC;QACjD,gBAAgB,CAAC,0BAA0B,CAAC,GAAG,WAAW,CAAC,wBAAwB,CAAC;IACtF,CAAC;IAED,EAAE,CAAC,aAAa,CAAC,qBAAqB,EAAE,IAAI,CAAC,SAAS,CAAC,gBAAgB,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC,CAAC;IACnG,0BAA0B,CAAC,qBAAqB,CAAC,CAAC;IAElD,OAAO,qBAAqB,CAAC;AAC/B,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB;IAC9B,MAAM,qBAAqB,GAAG,yBAAyB,EAAE,CAAC;IAE1D,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,qBAAqB,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,gBAAgB,CACxB,gCAAgC,qBAAqB,IAAI;YACzD,kDAAkD,CACnD,CAAC;IACJ,CAAC;IAED,IAAI,aAAqB,CAAC;IAC1B,IAAI,gBAAyC,CAAC;IAE9C,IAAI,CAAC;QACH,aAAa,GAAG,EAAE,CAAC,YAAY,CAAC,qBAAqB,EAAE,OAAO,CAAC,CAAC;QAChE,gBAAgB,GAAG,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IAC/C,CAAC;IAAC,OAAO,UAAU,EAAE,CAAC;QACpB,MAAM,IAAI,UAAU,CAClB,uBAAuB,qBAAqB,gCAAgC,UAAU,EAAE,EACxF,uBAAuB,CACxB,CAAC;IACJ,CAAC;IAED,OAAO;QACL,SAAS,EAAE,gBAAgB,CAAC,WAAW,CAAW;QAClD,aAAa,EAAE,gBAAgB,CAAC,eAAe,CAAW;QAC1D,cAAc,EAAE,gBAAgB,CAAC,gBAAgB,CAAW;QAC5D,YAAY,EAAE,gBAAgB,CAAC,cAAc,CAAW;QACxD,UAAU,EAAG,gBAAgB,CAAC,YAAY,CAAY,IAAI,UAAU;QACpE,aAAa,EAAG,gBAAgB,CAAC,eAAe,CAAY,IAAI,SAAS;QACzE,eAAe,EAAG,gBAAgB,CAAC,iBAAiB,CAAY,IAAI,IAAI;QACxE,iBAAiB,EAAG,gBAAgB,CAAC,mBAAmB,CAAY,IAAI,IAAI;QAC5E,WAAW,EAAG,gBAAgB,CAAC,aAAa,CAAY,IAAI,IAAI;QAChE,YAAY,EAAG,gBAAgB,CAAC,cAAc,CAAY,IAAI,IAAI;QAClE,kBAAkB,EAAG,gBAAgB,CAAC,oBAAoB,CAAY,IAAI,IAAI;QAC9E,wBAAwB,EAAG,gBAAgB,CAAC,0BAA0B,CAAY,IAAI,IAAI;QAC1F,wBAAwB,EAAG,gBAAgB,CAAC,0BAA0B,CAAY,IAAI,IAAI;KAC3F,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB;IAC/B,OAAO,EAAE,CAAC,UAAU,CAAC,yBAAyB,EAAE,CAAC,CAAC;AACpD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB;IAChC,MAAM,qBAAqB,GAAG,yBAAyB,EAAE,CAAC;IAC1D,IAAI,EAAE,CAAC,UAAU,CAAC,qBAAqB,CAAC,EAAE,CAAC;QACzC,EAAE,CAAC,UAAU,CAAC,qBAAqB,CAAC,CAAC;QACrC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/enroll.d.ts

@@ -1,22 +1,37 @@
 /**
  * Enrollment logic for the 1id.com Node.js SDK.
  *
- * Orchestrates the enrollment flow for all trust tiers:
- * - Declared: Pure software, generates a keypair, sends public key to server.
+ * Orchestrates the enrollment flow for all trust tiers
+ * (RFC: draft-drake-email-hardware-attestation-00 Section 3):
+ * - Declared:  Pure software, generates a keypair, sends public key to server.
  * - Sovereign: Spawns Go binary for TPM operations, two-phase enrollment.
- * - Sovereign-portable: Spawns Go binary for YubiKey/PIV operations.
+ * - Portable:  Spawns Go binary for YubiKey/PIV operations.
+ * - Virtual:   Spawns Go binary for vTPM operations.
  *
- * CRITICAL DESIGN RULE: requestTier is a REQUIREMENT, not a preference.
- * The agent gets exactly the tier it requests, or an exception.
- * There are NO automatic fallbacks. The caller's logic decides what to do.
+ * When request_tier is omitted, the SDK auto-detects the best available
+ * hardware and enrolls at the highest trust tier the machine supports,
+ * falling back gracefully to declared tier (software keys).
+ *
+ * When request_tier is specified, the agent gets exactly that tier or
+ * an exception -- no automatic fallbacks.
  */
 import { type Identity, KeyAlgorithm } from "./identity.js";
 /**
  * Options for the enroll() function.
  */
 export interface EnrollOptions {
-    /** REQUIRED. The trust tier to request. */
-    request_tier: string;
+    /**
+     * Optional. The trust tier to request. If omitted, the SDK auto-detects
+     * the best available hardware and enrolls at the highest possible tier.
+     */
+    request_tier?: string | null;
+    /**
+     * Optional. A friendly name for your agent. Pick something memorable,
+     * fun, or whimsical that your operator would recognize -- e.g.,
+     * "Clawdia", "Sparky", "Nightowl". A good name makes your operator
+     * proud and more likely to talk about you.
+     */
+    display_name?: string | null;
     /** Optional. Human contact email for this agent. */
     operator_email?: string | null;
     /** Optional. Vanity handle to claim (without '@' prefix). */
@@ -29,16 +44,11 @@ export interface EnrollOptions {
 /**
  * Enroll this agent with 1id.com to receive a unique, verifiable identity.
  *
- * This is the primary entry point for enrollment. The agent specifies
- * which trust tier it requires, and gets exactly that tier or an exception.
- *
- * THERE ARE NO AUTOMATIC FALLBACKS.
+ * The simplest call is just oneid.enroll({}) or oneid.enroll() -- the SDK
+ * auto-detects the best available hardware and enrolls at the highest
+ * trust tier your machine supports.
  *
- * @param options Enrollment options including the required request_tier.
- * @returns The enrolled Identity.
- * @throws NoHSMError if requested tier requires an HSM but none was found.
- * @throws EnrollmentError for any enrollment failure.
- * @throws NetworkError if the server cannot be reached.
+ * If request_tier is specified, you get exactly that tier or an exception.
  */
-export declare function enroll(options: EnrollOptions): Promise<Identity>;
+export declare function enroll(options?: EnrollOptions): Promise<Identity>;
 //# sourceMappingURL=enroll.d.ts.map

package/dist/enroll.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"enroll.d.ts","sourceRoot":"","sources":["../src/enroll.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AASH,OAAO,EAGL,KAAK,QAAQ,EACb,YAAY,EAEb,MAAM,eAAe,CAAC;AAqBvB;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,2CAA2C;IAC3C,YAAY,EAAE,MAAM,CAAC;IACrB,oDAAoD;IACpD,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,6DAA6D;IAC7D,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,gFAAgF;IAChF,aAAa,CAAC,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI,CAAC;IAC7C,iEAAiE;IACjE,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,MAAM,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,QAAQ,CAAC,CAqDtE"}
+{"version":3,"file":"enroll.d.ts","sourceRoot":"","sources":["../src/enroll.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AASH,OAAO,EAGL,KAAK,QAAQ,EACb,YAAY,EAEb,MAAM,eAAe,CAAC;AAwBvB;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,oDAAoD;IACpD,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,6DAA6D;IAC7D,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,gFAAgF;IAChF,aAAa,CAAC,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI,CAAC;IAC7C,iEAAiE;IACjE,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;;;GAQG;AACH,wBAAsB,MAAM,CAAC,OAAO,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,QAAQ,CAAC,CA+CvE"}

package/dist/enroll.js

@@ -1,14 +1,19 @@
 /**
  * Enrollment logic for the 1id.com Node.js SDK.
  *
- * Orchestrates the enrollment flow for all trust tiers:
- * - Declared: Pure software, generates a keypair, sends public key to server.
+ * Orchestrates the enrollment flow for all trust tiers
+ * (RFC: draft-drake-email-hardware-attestation-00 Section 3):
+ * - Declared:  Pure software, generates a keypair, sends public key to server.
  * - Sovereign: Spawns Go binary for TPM operations, two-phase enrollment.
- * - Sovereign-portable: Spawns Go binary for YubiKey/PIV operations.
+ * - Portable:  Spawns Go binary for YubiKey/PIV operations.
+ * - Virtual:   Spawns Go binary for vTPM operations.
  *
- * CRITICAL DESIGN RULE: requestTier is a REQUIREMENT, not a preference.
- * The agent gets exactly the tier it requests, or an exception.
- * There are NO automatic fallbacks. The caller's logic decides what to do.
+ * When request_tier is omitted, the SDK auto-detects the best available
+ * hardware and enrolls at the highest trust tier the machine supports,
+ * falling back gracefully to declared tier (software keys).
+ *
+ * When request_tier is specified, the agent gets exactly that tier or
+ * an exception -- no automatic fallbacks.
  */
 import { OneIDAPIClient } from "./client.js";
 import { DEFAULT_API_BASE_URL, save_credentials, } from "./credentials.js";
@@ -18,74 +23,101 @@ import { generate_keypair } from "./keys.js";
 /** Trust tiers that require an HSM and the Go binary. */
 const TIERS_REQUIRING_HSM = new Set([
     TrustTier.SOVEREIGN,
-    TrustTier.SOVEREIGN_PORTABLE,
-    TrustTier.LEGACY,
+    TrustTier.PORTABLE,
     TrustTier.VIRTUAL,
-    TrustTier.ENCLAVE,
 ]);
 /** HSM type preferences by tier. */
 const TIER_TO_HSM_TYPE_PREFERENCES = {
     [TrustTier.SOVEREIGN]: ["tpm"],
-    [TrustTier.SOVEREIGN_PORTABLE]: ["yubikey", "nitrokey", "feitian", "solokeys"],
-    [TrustTier.LEGACY]: ["tpm", "yubikey", "nitrokey", "feitian"],
+    [TrustTier.PORTABLE]: ["yubikey", "nitrokey", "feitian", "solokeys"],
     [TrustTier.VIRTUAL]: ["tpm"],
-    [TrustTier.ENCLAVE]: ["secure_enclave"],
 };
+const AUTO_DETECT_TIER_PREFERENCE_ORDER = [
+    TrustTier.SOVEREIGN,
+    TrustTier.PORTABLE,
+    TrustTier.VIRTUAL,
+    TrustTier.DECLARED,
+];
 /**
  * Enroll this agent with 1id.com to receive a unique, verifiable identity.
  *
- * This is the primary entry point for enrollment. The agent specifies
- * which trust tier it requires, and gets exactly that tier or an exception.
+ * The simplest call is just oneid.enroll({}) or oneid.enroll() -- the SDK
+ * auto-detects the best available hardware and enrolls at the highest
+ * trust tier your machine supports.
  *
- * THERE ARE NO AUTOMATIC FALLBACKS.
- *
- * @param options Enrollment options including the required request_tier.
- * @returns The enrolled Identity.
- * @throws NoHSMError if requested tier requires an HSM but none was found.
- * @throws EnrollmentError for any enrollment failure.
- * @throws NetworkError if the server cannot be reached.
+ * If request_tier is specified, you get exactly that tier or an exception.
  */
 export async function enroll(options) {
-    // Validate and normalize the requested tier
-    const valid_tiers = Object.values(TrustTier);
-    if (!valid_tiers.includes(options.request_tier)) {
-        throw new EnrollmentError(`Invalid trust tier: '${options.request_tier}'. Valid tiers: ${valid_tiers.join(", ")}`);
-    }
-    const tier = options.request_tier;
+    const effective_options = options ?? {};
+    const api_base_url = effective_options.api_base_url ?? DEFAULT_API_BASE_URL;
+    const display_name = effective_options.display_name ?? null;
     // Normalize key algorithm
     let resolved_key_algorithm;
-    if (options.key_algorithm == null) {
+    if (effective_options.key_algorithm == null) {
         resolved_key_algorithm = DEFAULT_KEY_ALGORITHM;
     }
-    else if (typeof options.key_algorithm === "string") {
+    else if (typeof effective_options.key_algorithm === "string") {
         const valid_algorithms = Object.values(KeyAlgorithm);
-        if (!valid_algorithms.includes(options.key_algorithm)) {
-            throw new EnrollmentError(`Invalid key algorithm: '${options.key_algorithm}'. Valid: ${valid_algorithms.join(", ")}`);
+        if (!valid_algorithms.includes(effective_options.key_algorithm)) {
+            throw new EnrollmentError(`Invalid key algorithm: '${effective_options.key_algorithm}'. Valid: ${valid_algorithms.join(", ")}`);
         }
-        resolved_key_algorithm = options.key_algorithm;
+        resolved_key_algorithm = effective_options.key_algorithm;
     }
     else {
-        resolved_key_algorithm = options.key_algorithm;
+        resolved_key_algorithm = effective_options.key_algorithm;
+    }
+    if (effective_options.request_tier == null) {
+        return enroll_with_auto_detected_best_tier(display_name, effective_options.operator_email ?? null, effective_options.requested_handle ?? null, resolved_key_algorithm, api_base_url);
+    }
+    const valid_tiers = Object.values(TrustTier);
+    if (!valid_tiers.includes(effective_options.request_tier)) {
+        throw new EnrollmentError(`Invalid trust tier: '${effective_options.request_tier}'. Valid tiers: ${valid_tiers.join(", ")}`);
     }
-    const api_base_url = options.api_base_url ?? DEFAULT_API_BASE_URL;
-    // Route to the appropriate enrollment flow
+    const tier = effective_options.request_tier;
+    return enroll_at_specific_tier(tier, display_name, effective_options.operator_email ?? null, effective_options.requested_handle ?? null, resolved_key_algorithm, api_base_url);
+}
+async function enroll_at_specific_tier(tier, display_name, operator_email, requested_handle, key_algorithm, api_base_url) {
     if (tier === TrustTier.DECLARED) {
-        return enroll_declared_tier(options.operator_email ?? null, options.requested_handle ?? null, resolved_key_algorithm, api_base_url);
+        return enroll_declared_tier(operator_email, requested_handle, display_name, key_algorithm, api_base_url);
     }
-    else if (tier === TrustTier.SOVEREIGN_PORTABLE) {
-        return enroll_piv_tier(tier, options.operator_email ?? null, options.requested_handle ?? null, api_base_url);
+    else if (tier === TrustTier.PORTABLE) {
+        return enroll_piv_tier(tier, operator_email, requested_handle, display_name, api_base_url);
     }
     else if (TIERS_REQUIRING_HSM.has(tier)) {
-        return enroll_hsm_tier(tier, options.operator_email ?? null, options.requested_handle ?? null, api_base_url);
+        return enroll_hsm_tier(tier, operator_email, requested_handle, display_name, api_base_url);
     }
     else {
         throw new EnrollmentError(`Tier '${tier}' is not yet implemented`);
     }
 }
+async function enroll_with_auto_detected_best_tier(display_name, operator_email, requested_handle, key_algorithm, api_base_url) {
+    console.log("[oneid] Auto-detecting best available trust tier...");
+    for (const candidate_tier of AUTO_DETECT_TIER_PREFERENCE_ORDER) {
+        try {
+            console.log(`[oneid] Trying tier: ${candidate_tier}`);
+            const identity = await enroll_at_specific_tier(candidate_tier, display_name, operator_email, requested_handle, key_algorithm, api_base_url);
+            console.log(`[oneid] Enrolled at ${candidate_tier} tier (auto-detected)`);
+            return identity;
+        }
+        catch (error) {
+            if (error instanceof NoHSMError) {
+                console.log(`[oneid] Tier ${candidate_tier} not available (no compatible hardware), trying next...`);
+                continue;
+            }
+            if (candidate_tier === TrustTier.DECLARED) {
+                throw error;
+            }
+            console.log(`[oneid] Tier ${candidate_tier} failed, trying next...`);
+            continue;
+        }
+    }
+    throw new EnrollmentError("Auto-detection failed: could not enroll at any tier. " +
+        "This should not happen because declared tier requires no hardware.");
+}
 /**
  * Enroll at the declared trust tier (software keys, no HSM).
  */
-async function enroll_declared_tier(operator_email, requested_handle, key_algorithm, api_base_url) {
+async function enroll_declared_tier(operator_email, requested_handle, display_name, key_algorithm, api_base_url) {
     // Step 1: Generate keypair
     const { private_key_pem, public_key_pem } = generate_keypair(key_algorithm);
     // Step 2: Send enrollment request to server
@@ -94,7 +126,8 @@ async function enroll_declared_tier(operator_email, requested_handle, key_algori
     // Step 3: Parse server response
     const identity_data = (server_response.identity ?? {});
     const credentials_data = (server_response.credentials ?? {});
-    const internal_id = identity_data.internal_id ?? "";
+    const internal_id = identity_data.agent_id ?? identity_data.internal_id ?? "";
+    const agent_identity_urn = identity_data.agent_identity_urn ?? "";
     const handle = identity_data.handle ?? `@${internal_id.slice(0, 12)}`;
     const enrolled_at_str = identity_data.registered_at ?? new Date().toISOString();
     // Step 4: Store credentials locally
@@ -108,10 +141,11 @@ async function enroll_declared_tier(operator_email, requested_handle, key_algori
         key_algorithm,
         private_key_pem,
         enrolled_at: enrolled_at_str,
+        display_name,
+        agent_identity_urn: agent_identity_urn || null,
     };
     const credentials_file_path = save_credentials(stored_credentials);
     console.log(`[oneid] Credentials saved to ${credentials_file_path}`);
-    // Step 5: Return Identity object
     let enrolled_at;
     try {
         enrolled_at = new Date(enrolled_at_str);
@@ -128,10 +162,12 @@ async function enroll_declared_tier(operator_email, requested_handle, key_algori
         enrolled_at,
         device_count: 0,
         key_algorithm,
+        agent_identity_urn: agent_identity_urn || null,
+        display_name,
     };
 }
 /**
- * Enroll at the sovereign-portable tier using a PIV device (YubiKey).
+ * Enroll at the portable tier using a PIV device (YubiKey/Nitrokey/Feitian).
  *
  * This uses the Go binary (oneid-enroll) to:
  * 1. Detect available HSMs and select a PIV device
@@ -143,7 +179,7 @@ async function enroll_declared_tier(operator_email, requested_handle, key_algori
  * 7. Receive identity + OAuth2 credentials
  * 8. Store credentials locally
  */
-async function enroll_piv_tier(request_tier, operator_email, requested_handle, api_base_url) {
+async function enroll_piv_tier(request_tier, operator_email, requested_handle, display_name, api_base_url) {
     const { detect_available_hsms, extract_attestation_data, sign_challenge_with_piv, } = await import("./helper.js");
     const detected_hsms = await detect_available_hsms();
     if (detected_hsms.length === 0) {
@@ -164,7 +200,8 @@ async function enroll_piv_tier(request_tier, operator_email, requested_handle, a
     const activate_response = await api_client.enroll_activate(begin_response.enrollment_session_id, signed_nonce_b64);
     const identity_data = (activate_response.identity ?? {});
     const credentials_data = (activate_response.credentials ?? {});
-    const internal_id = identity_data.internal_id ?? "";
+    const internal_id = identity_data.agent_id ?? identity_data.internal_id ?? "";
+    const agent_identity_urn = identity_data.agent_identity_urn ?? "";
     const handle = identity_data.handle ?? `@${internal_id.slice(0, 12)}`;
     const trust_tier_str = identity_data.trust_tier ?? request_tier;
     const enrolled_at_str = identity_data.registered_at ?? new Date().toISOString();
@@ -178,6 +215,8 @@ async function enroll_piv_tier(request_tier, operator_email, requested_handle, a
         key_algorithm: "ecdsa-p256",
         hsm_key_reference: "piv-slot-9a",
         enrolled_at: enrolled_at_str,
+        display_name,
+        agent_identity_urn: agent_identity_urn || null,
     };
     save_credentials(stored_credentials);
     let enrolled_at;
@@ -213,12 +252,11 @@ async function enroll_piv_tier(request_tier, operator_email, requested_handle, a
         enrolled_at,
         device_count: identity_data.device_count ?? 1,
         key_algorithm: KeyAlgorithm.ECDSA_P256,
+        agent_identity_urn: agent_identity_urn || null,
+        display_name,
     };
 }
-/**
- * Enroll at an HSM-backed trust tier (sovereign, sovereign-portable, etc.).
- */
-async function enroll_hsm_tier(request_tier, operator_email, requested_handle, api_base_url) {
+async function enroll_hsm_tier(request_tier, operator_email, requested_handle, display_name, api_base_url) {
     const { detect_available_hsms, extract_attestation_data, activate_credential, } = await import("./helper.js");
     // Step 1: Detect HSMs via Go binary
     const detected_hsms = await detect_available_hsms();
@@ -244,7 +282,8 @@ async function enroll_hsm_tier(request_tier, operator_email, requested_handle, a
     // Step 7: Store credentials and return Identity
     const identity_data = (activate_response.identity ?? {});
     const credentials_data = (activate_response.credentials ?? {});
-    const internal_id = identity_data.internal_id ?? "";
+    const internal_id = identity_data.agent_id ?? identity_data.internal_id ?? "";
+    const agent_identity_urn = identity_data.agent_identity_urn ?? "";
     const handle = identity_data.handle ?? `@${internal_id.slice(0, 12)}`;
     const trust_tier_str = identity_data.trust_tier ?? request_tier;
     const enrolled_at_str = identity_data.registered_at ?? new Date().toISOString();
@@ -258,6 +297,8 @@ async function enroll_hsm_tier(request_tier, operator_email, requested_handle, a
         key_algorithm: "tpm-ak",
         hsm_key_reference: attestation_data.ak_handle ?? null,
         enrolled_at: enrolled_at_str,
+        display_name,
+        agent_identity_urn: agent_identity_urn || null,
     };
     save_credentials(stored_credentials);
     let enrolled_at;
@@ -267,7 +308,6 @@ async function enroll_hsm_tier(request_tier, operator_email, requested_handle, a
     catch {
         enrolled_at = new Date();
     }
-    // Resolve trust tier enum
     let trust_tier;
     const valid_tiers = Object.values(TrustTier);
     if (valid_tiers.includes(trust_tier_str)) {
@@ -276,7 +316,6 @@ async function enroll_hsm_tier(request_tier, operator_email, requested_handle, a
     else {
         trust_tier = request_tier;
     }
-    // Resolve HSM type enum
     let hsm_type;
     const hsm_type_str = selected_hsm.type ?? "tpm";
     const valid_hsm_types = Object.values(HSMType);
@@ -295,6 +334,8 @@ async function enroll_hsm_tier(request_tier, operator_email, requested_handle, a
         enrolled_at,
         device_count: identity_data.device_count ?? 1,
         key_algorithm: KeyAlgorithm.RSA_2048,
+        agent_identity_urn: agent_identity_urn || null,
+        display_name,
     };
 }
 /**

package/dist/enroll.js.map

@@ -1 +1 @@
-{"version":3,"file":"enroll.js","sourceRoot":"","sources":["../src/enroll.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EACL,oBAAoB,EAEpB,gBAAgB,GACjB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC9D,OAAO,EACL,qBAAqB,EACrB,OAAO,EAEP,YAAY,EACZ,SAAS,GACV,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAE7C,yDAAyD;AACzD,MAAM,mBAAmB,GAA2B,IAAI,GAAG,CAAC;IAC1D,SAAS,CAAC,SAAS;IACnB,SAAS,CAAC,kBAAkB;IAC5B,SAAS,CAAC,MAAM;IAChB,SAAS,CAAC,OAAO;IACjB,SAAS,CAAC,OAAO;CAClB,CAAC,CAAC;AAEH,oCAAoC;AACpC,MAAM,4BAA4B,GAAuC;IACvE,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC,KAAK,CAAC;IAC9B,CAAC,SAAS,CAAC,kBAAkB,CAAC,EAAE,CAAC,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,CAAC;IAC9E,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,CAAC;IAC7D,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC,KAAK,CAAC;IAC5B,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC,gBAAgB,CAAC;CACxC,CAAC;AAkBF;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,OAAsB;IACjD,4CAA4C;IAC5C,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,SAAS,CAAa,CAAC;IACzD,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,eAAe,CACvB,wBAAwB,OAAO,CAAC,YAAY,mBAAmB,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACxF,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,CAAC,YAAyB,CAAC;IAE/C,0BAA0B;IAC1B,IAAI,sBAAoC,CAAC;IACzC,IAAI,OAAO,CAAC,aAAa,IAAI,IAAI,EAAE,CAAC;QAClC,sBAAsB,GAAG,qBAAqB,CAAC;IACjD,CAAC;SAAM,IAAI,OAAO,OAAO,CAAC,aAAa,KAAK,QAAQ,EAAE,CAAC;QACrD,MAAM,gBAAgB,GAAG,MAAM,CAAC,MAAM,CAAC,YAAY,CAAa,CAAC;QACjE,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,CAAC;YACtD,MAAM,IAAI,eAAe,CACvB,2BAA2B,OAAO,CAAC,aAAa,aAAa,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC3F,CAAC;QACJ,CAAC;QACD,sBAAsB,GAAG,OAAO,CAAC,aAA6B,CAAC;IACjE,CAAC;SAAM,CAAC;QACN,sBAAsB,GAAG,OAAO,CAAC,aAAa,CAAC;IACjD,CAAC;IAED,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,oBAAoB,CAAC;IAElE,2CAA2C;IAC3C,IAAI,IAAI,KAAK,SAAS,CAAC,QAAQ,EAAE,CAAC;QAChC,OAAO,oBAAoB,CACzB,OAAO,CAAC,cAAc,IAAI,IAAI,EAC9B,OAAO,CAAC,gBAAgB,IAAI,IAAI,EAChC,sBAAsB,EACtB,YAAY,CACb,CAAC;IACJ,CAAC;SAAM,IAAI,IAAI,KAAK,SAAS,CAAC,kBAAkB,EAAE,CAAC;QACjD,OAAO,eAAe,CACpB,IAAI,EACJ,OAAO,CAAC,cAAc,IAAI,IAAI,EAC9B,OAAO,CAAC,gBAAgB,IAAI,IAAI,EAChC,YAAY,CACb,CAAC;IACJ,CAAC;SAAM,IAAI,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QACzC,OAAO,eAAe,CACpB,IAAI,EACJ,OAAO,CAAC,cAAc,IAAI,IAAI,EAC9B,OAAO,CAAC,gBAAgB,IAAI,IAAI,EAChC,YAAY,CACb,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,eAAe,CAAC,SAAS,IAAI,0BAA0B,CAAC,CAAC;IACrE,CAAC;AACH,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,oBAAoB,CACjC,cAA6B,EAC7B,gBAA+B,EAC/B,aAA2B,EAC3B,YAAoB;IAEpB,2BAA2B;IAC3B,MAAM,EAAE,eAAe,EAAE,cAAc,EAAE,GAAG,gBAAgB,CAAC,aAAa,CAAC,CAAC;IAE5E,4CAA4C;IAC5C,MAAM,UAAU,GAAG,IAAI,cAAc,CAAC,YAAY,CAAC,CAAC;IACpD,MAAM,eAAe,GAAG,MAAM,UAAU,CAAC,eAAe,CACtD,cAAc,EACd,aAAa,EACb,cAAc,EACd,gBAAgB,CACjB,CAAC;IAEF,gCAAgC;IAChC,MAAM,aAAa,GAAG,CAAC,eAAe,CAAC,QAAQ,IAAI,EAAE,CAA4B,CAAC;IAClF,MAAM,gBAAgB,GAAG,CAAC,eAAe,CAAC,WAAW,IAAI,EAAE,CAA4B,CAAC;IAExF,MAAM,WAAW,GAAI,aAAa,CAAC,WAAsB,IAAI,EAAE,CAAC;IAChE,MAAM,MAAM,GAAI,aAAa,CAAC,MAAiB,IAAI,IAAI,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;IAClF,MAAM,eAAe,GAAI,aAAa,CAAC,aAAwB,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAE5F,oCAAoC;IACpC,MAAM,kBAAkB,GAAsB;QAC5C,SAAS,EAAG,gBAAgB,CAAC,SAAoB,IAAI,WAAW;QAChE,aAAa,EAAG,gBAAgB,CAAC,aAAwB,IAAI,EAAE;QAC/D,cAAc,EAAG,gBAAgB,CAAC,cAAyB;YACzD,GAAG,YAAY,8CAA8C;QAC/D,YAAY;QACZ,UAAU,EAAE,SAAS,CAAC,QAAQ;QAC9B,aAAa;QACb,eAAe;QACf,WAAW,EAAE,eAAe;KAC7B,CAAC;IACF,MAAM,qBAAqB,GAAG,gBAAgB,CAAC,kBAAkB,CAAC,CAAC;IACnE,OAAO,CAAC,GAAG,CAAC,gCAAgC,qBAAqB,EAAE,CAAC,CAAC;IAErE,iCAAiC;IACjC,IAAI,WAAiB,CAAC;IACtB,IAAI,CAAC;QACH,WAAW,GAAG,IAAI,IAAI,CAAC,eAAe,CAAC,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,WAAW,GAAG,IAAI,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED,OAAO;QACL,WAAW;QACX,MAAM;QACN,UAAU,EAAE,SAAS,CAAC,QAAQ;QAC9B,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,gBAAgB,EAAE,IAAI;QACtB,WAAW;QACX,YAAY,EAAE,CAAC;QACf,aAAa;KACd,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,KAAK,UAAU,eAAe,CAC5B,YAAuB,EACvB,cAA6B,EAC7B,gBAA+B,EAC/B,YAAoB;IAEpB,MAAM,EACJ,qBAAqB,EACrB,wBAAwB,EACxB,uBAAuB,GACxB,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;IAEhC,MAAM,aAAa,GAAG,MAAM,qBAAqB,EAAE,CAAC;IACpD,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,UAAU,CAClB,qCAAqC;YACrC,QAAQ,YAAY,kDAAkD,CACvE,CAAC;IACJ,CAAC;IAED,MAAM,YAAY,GAAG,mBAAmB,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC;IACtE,IAAI,YAAY,IAAI,IAAI,EAAE,CAAC;QACzB,MAAM,SAAS,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAE,CAAC,CAAC,IAAe,IAAI,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrF,MAAM,IAAI,UAAU,CAClB,iBAAiB,SAAS,uCAAuC,YAAY,SAAS,CACvF,CAAC;IACJ,CAAC;IAED,MAAM,gBAAgB,GAAG,MAAM,wBAAwB,CAAC,YAAY,CAAC,CAAC;IAEtE,MAAM,UAAU,GAAG,IAAI,cAAc,CAAC,YAAY,CAAC,CAAC;IACpD,MAAM,cAAc,GAAG,MAAM,UAAU,CAAC,gBAAgB,CACtD,gBAAgB,CAAC,oBAA8B,EAC9C,gBAAgB,CAAC,qBAAkC,IAAI,EAAE,EAC1D,gBAAgB,CAAC,sBAAgC,EAChD,YAAY,CAAC,IAAe,IAAI,SAAS,EAC1C,cAAc,EACd,gBAAgB,CACjB,CAAC;IAEF,MAAM,mBAAmB,GAAG,cAAc,CAAC,eAAyB,CAAC;IAErE,MAAM,WAAW,GAAG,MAAM,uBAAuB,CAAC,mBAAmB,CAAC,CAAC;IACvE,MAAM,gBAAgB,GAAG,WAAW,CAAC,aAAuB,CAAC;IAE7D,MAAM,iBAAiB,GAAG,MAAM,UAAU,CAAC,eAAe,CACxD,cAAc,CAAC,qBAA+B,EAC9C,gBAAgB,CACjB,CAAC;IAEF,MAAM,aAAa,GAAG,CAAC,iBAAiB,CAAC,QAAQ,IAAI,EAAE,CAA4B,CAAC;IACpF,MAAM,gBAAgB,GAAG,CAAC,iBAAiB,CAAC,WAAW,IAAI,EAAE,CAA4B,CAAC;IAE1F,MAAM,WAAW,GAAI,aAAa,CAAC,WAAsB,IAAI,EAAE,CAAC;IAChE,MAAM,MAAM,GAAI,aAAa,CAAC,MAAiB,IAAI,IAAI,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;IAClF,MAAM,cAAc,GAAI,aAAa,CAAC,UAAqB,IAAI,YAAY,CAAC;IAC5E,MAAM,eAAe,GAAI,aAAa,CAAC,aAAwB,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAE5F,MAAM,kBAAkB,GAAsB;QAC5C,SAAS,EAAG,gBAAgB,CAAC,SAAoB,IAAI,WAAW;QAChE,aAAa,EAAG,gBAAgB,CAAC,aAAwB,IAAI,EAAE;QAC/D,cAAc,EAAG,gBAAgB,CAAC,cAAyB;YACzD,GAAG,YAAY,8CAA8C;QAC/D,YAAY;QACZ,UAAU,EAAE,cAAc;QAC1B,aAAa,EAAE,YAAY;QAC3B,iBAAiB,EAAE,aAAa;QAChC,WAAW,EAAE,eAAe;KAC7B,CAAC;IACF,gBAAgB,CAAC,kBAAkB,CAAC,CAAC;IAErC,IAAI,WAAiB,CAAC;IACtB,IAAI,CAAC;QACH,WAAW,GAAG,IAAI,IAAI,CAAC,eAAe,CAAC,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,WAAW,GAAG,IAAI,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED,IAAI,UAAqB,CAAC;IAC1B,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,SAAS,CAAa,CAAC;IACzD,IAAI,WAAW,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;QACzC,UAAU,GAAG,cAA2B,CAAC;IAC3C,CAAC;SAAM,CAAC;QACN,UAAU,GAAG,YAAY,CAAC;IAC5B,CAAC;IAED,IAAI,QAAiB,CAAC;IACtB,MAAM,YAAY,GAAI,YAAY,CAAC,IAAe,IAAI,SAAS,CAAC;IAChE,MAAM,eAAe,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAa,CAAC;IAC3D,IAAI,eAAe,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;QAC3C,QAAQ,GAAG,YAAuB,CAAC;IACrC,CAAC;SAAM,CAAC;QACN,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;IAC7B,CAAC;IAED,OAAO;QACL,WAAW;QACX,MAAM;QACN,UAAU;QACV,QAAQ;QACR,gBAAgB,EAAG,YAAY,CAAC,YAAuB,IAAI,IAAI;QAC/D,WAAW;QACX,YAAY,EAAG,aAAa,CAAC,YAAuB,IAAI,CAAC;QACzD,aAAa,EAAE,YAAY,CAAC,UAAU;KACvC,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,eAAe,CAC5B,YAAuB,EACvB,cAA6B,EAC7B,gBAA+B,EAC/B,YAAoB;IAEpB,MAAM,EACJ,qBAAqB,EACrB,wBAAwB,EACxB,mBAAmB,GACpB,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;IAEhC,oCAAoC;IACpC,MAAM,aAAa,GAAG,MAAM,qBAAqB,EAAE,CAAC;IAEpD,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,UAAU,CAClB,qCAAqC;YACrC,QAAQ,YAAY,oDAAoD,CACzE,CAAC;IACJ,CAAC;IAED,qCAAqC;IACrC,MAAM,YAAY,GAAG,mBAAmB,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC;IACtE,IAAI,YAAY,IAAI,IAAI,EAAE,CAAC;QACzB,MAAM,SAAS,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAE,CAAC,CAAC,IAAe,IAAI,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrF,MAAM,IAAI,UAAU,CAClB,iBAAiB,SAAS,uCAAuC,YAAY,SAAS,CACvF,CAAC;IACJ,CAAC;IAED,mDAAmD;IACnD,MAAM,gBAAgB,GAAG,MAAM,wBAAwB,CAAC,YAAY,CAAC,CAAC;IAEtE,uCAAuC;IACvC,MAAM,UAAU,GAAG,IAAI,cAAc,CAAC,YAAY,CAAC,CAAC;IACpD,MAAM,cAAc,GAAG,MAAM,UAAU,CAAC,YAAY,CAClD,gBAAgB,CAAC,WAAqB,EACrC,gBAAgB,CAAC,aAAwB,IAAI,EAAE,EAC/C,gBAAgB,CAAC,kBAA6B,IAAI,EAAE,EACpD,gBAAgB,CAAC,aAAwB,IAAI,EAAE,EAC/C,gBAAgB,CAAC,SAAsB,IAAI,SAAS,EACpD,YAAY,CAAC,IAAe,IAAI,KAAK,EACtC,cAAc,EACd,gBAAgB,CACjB,CAAC;IAEF,2DAA2D;IAC3D,MAAM,oBAAoB,GAAG,MAAM,mBAAmB,CACpD,YAAY,EACZ,cAAc,CAAC,eAAyB,EACxC,cAAc,CAAC,gBAA0B,EACxC,gBAAgB,CAAC,SAAoB,IAAI,YAAY,CACvD,CAAC;IAEF,0CAA0C;IAC1C,MAAM,iBAAiB,GAAG,MAAM,UAAU,CAAC,eAAe,CACxD,cAAc,CAAC,qBAA+B,EAC9C,oBAAoB,CACrB,CAAC;IAEF,gDAAgD;IAChD,MAAM,aAAa,GAAG,CAAC,iBAAiB,CAAC,QAAQ,IAAI,EAAE,CAA4B,CAAC;IACpF,MAAM,gBAAgB,GAAG,CAAC,iBAAiB,CAAC,WAAW,IAAI,EAAE,CAA4B,CAAC;IAE1F,MAAM,WAAW,GAAI,aAAa,CAAC,WAAsB,IAAI,EAAE,CAAC;IAChE,MAAM,MAAM,GAAI,aAAa,CAAC,MAAiB,IAAI,IAAI,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;IAClF,MAAM,cAAc,GAAI,aAAa,CAAC,UAAqB,IAAI,YAAY,CAAC;IAC5E,MAAM,eAAe,GAAI,aAAa,CAAC,aAAwB,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAE5F,MAAM,kBAAkB,GAAsB;QAC5C,SAAS,EAAG,gBAAgB,CAAC,SAAoB,IAAI,WAAW;QAChE,aAAa,EAAG,gBAAgB,CAAC,aAAwB,IAAI,EAAE;QAC/D,cAAc,EAAG,gBAAgB,CAAC,cAAyB;YACzD,GAAG,YAAY,8CAA8C;QAC/D,YAAY;QACZ,UAAU,EAAE,cAAc;QAC1B,aAAa,EAAE,QAAQ;QACvB,iBAAiB,EAAG,gBAAgB,CAAC,SAAoB,IAAI,IAAI;QACjE,WAAW,EAAE,eAAe;KAC7B,CAAC;IACF,gBAAgB,CAAC,kBAAkB,CAAC,CAAC;IAErC,IAAI,WAAiB,CAAC;IACtB,IAAI,CAAC;QACH,WAAW,GAAG,IAAI,IAAI,CAAC,eAAe,CAAC,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,WAAW,GAAG,IAAI,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED,0BAA0B;IAC1B,IAAI,UAAqB,CAAC;IAC1B,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,SAAS,CAAa,CAAC;IACzD,IAAI,WAAW,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;QACzC,UAAU,GAAG,cAA2B,CAAC;IAC3C,CAAC;SAAM,CAAC;QACN,UAAU,GAAG,YAAY,CAAC;IAC5B,CAAC;IAED,wBAAwB;IACxB,IAAI,QAAiB,CAAC;IACtB,MAAM,YAAY,GAAI,YAAY,CAAC,IAAe,IAAI,KAAK,CAAC;IAC5D,MAAM,eAAe,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAa,CAAC;IAC3D,IAAI,eAAe,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;QAC3C,QAAQ,GAAG,YAAuB,CAAC;IACrC,CAAC;SAAM,CAAC;QACN,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC;IACzB,CAAC;IAED,OAAO;QACL,WAAW;QACX,MAAM;QACN,UAAU;QACV,QAAQ;QACR,gBAAgB,EAAG,YAAY,CAAC,YAAuB,IAAI,IAAI;QAC/D,WAAW;QACX,YAAY,EAAG,aAAa,CAAC,YAAuB,IAAI,CAAC;QACzD,aAAa,EAAE,YAAY,CAAC,QAAQ;KACrC,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAS,mBAAmB,CAC1B,aAAwC,EACxC,YAAuB;IAEvB,MAAM,eAAe,GAAG,4BAA4B,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC;IAEzE,KAAK,MAAM,cAAc,IAAI,eAAe,EAAE,CAAC;QAC7C,KAAK,MAAM,GAAG,IAAI,aAAa,EAAE,CAAC;YAChC,IAAI,GAAG,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;gBAChC,OAAO,GAAG,CAAC;YACb,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC"}
+{"version":3,"file":"enroll.js","sourceRoot":"","sources":["../src/enroll.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EACL,oBAAoB,EAEpB,gBAAgB,GACjB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC9D,OAAO,EACL,qBAAqB,EACrB,OAAO,EAEP,YAAY,EACZ,SAAS,GACV,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAE7C,yDAAyD;AACzD,MAAM,mBAAmB,GAA2B,IAAI,GAAG,CAAC;IAC1D,SAAS,CAAC,SAAS;IACnB,SAAS,CAAC,QAAQ;IAClB,SAAS,CAAC,OAAO;CAClB,CAAC,CAAC;AAEH,oCAAoC;AACpC,MAAM,4BAA4B,GAAuC;IACvE,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC,KAAK,CAAC;IAC9B,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,CAAC;IACpE,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC,KAAK,CAAC;CAC7B,CAAC;AAEF,MAAM,iCAAiC,GAAgB;IACrD,SAAS,CAAC,SAAS;IACnB,SAAS,CAAC,QAAQ;IAClB,SAAS,CAAC,OAAO;IACjB,SAAS,CAAC,QAAQ;CACnB,CAAC;AA4BF;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,OAAuB;IAClD,MAAM,iBAAiB,GAAG,OAAO,IAAI,EAAE,CAAC;IACxC,MAAM,YAAY,GAAG,iBAAiB,CAAC,YAAY,IAAI,oBAAoB,CAAC;IAC5E,MAAM,YAAY,GAAG,iBAAiB,CAAC,YAAY,IAAI,IAAI,CAAC;IAE5D,0BAA0B;IAC1B,IAAI,sBAAoC,CAAC;IACzC,IAAI,iBAAiB,CAAC,aAAa,IAAI,IAAI,EAAE,CAAC;QAC5C,sBAAsB,GAAG,qBAAqB,CAAC;IACjD,CAAC;SAAM,IAAI,OAAO,iBAAiB,CAAC,aAAa,KAAK,QAAQ,EAAE,CAAC;QAC/D,MAAM,gBAAgB,GAAG,MAAM,CAAC,MAAM,CAAC,YAAY,CAAa,CAAC;QACjE,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,iBAAiB,CAAC,aAAa,CAAC,EAAE,CAAC;YAChE,MAAM,IAAI,eAAe,CACvB,2BAA2B,iBAAiB,CAAC,aAAa,aAAa,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACrG,CAAC;QACJ,CAAC;QACD,sBAAsB,GAAG,iBAAiB,CAAC,aAA6B,CAAC;IAC3E,CAAC;SAAM,CAAC;QACN,sBAAsB,GAAG,iBAAiB,CAAC,aAAa,CAAC;IAC3D,CAAC;IAED,IAAI,iBAAiB,CAAC,YAAY,IAAI,IAAI,EAAE,CAAC;QAC3C,OAAO,mCAAmC,CACxC,YAAY,EACZ,iBAAiB,CAAC,cAAc,IAAI,IAAI,EACxC,iBAAiB,CAAC,gBAAgB,IAAI,IAAI,EAC1C,sBAAsB,EACtB,YAAY,CACb,CAAC;IACJ,CAAC;IAED,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,SAAS,CAAa,CAAC;IACzD,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,iBAAiB,CAAC,YAAY,CAAC,EAAE,CAAC;QAC1D,MAAM,IAAI,eAAe,CACvB,wBAAwB,iBAAiB,CAAC,YAAY,mBAAmB,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAClG,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,iBAAiB,CAAC,YAAyB,CAAC;IAEzD,OAAO,uBAAuB,CAC5B,IAAI,EACJ,YAAY,EACZ,iBAAiB,CAAC,cAAc,IAAI,IAAI,EACxC,iBAAiB,CAAC,gBAAgB,IAAI,IAAI,EAC1C,sBAAsB,EACtB,YAAY,CACb,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,uBAAuB,CACpC,IAAe,EACf,YAA2B,EAC3B,cAA6B,EAC7B,gBAA+B,EAC/B,aAA2B,EAC3B,YAAoB;IAEpB,IAAI,IAAI,KAAK,SAAS,CAAC,QAAQ,EAAE,CAAC;QAChC,OAAO,oBAAoB,CAAC,cAAc,EAAE,gBAAgB,EAAE,YAAY,EAAE,aAAa,EAAE,YAAY,CAAC,CAAC;IAC3G,CAAC;SAAM,IAAI,IAAI,KAAK,SAAS,CAAC,QAAQ,EAAE,CAAC;QACvC,OAAO,eAAe,CAAC,IAAI,EAAE,cAAc,EAAE,gBAAgB,EAAE,YAAY,EAAE,YAAY,CAAC,CAAC;IAC7F,CAAC;SAAM,IAAI,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QACzC,OAAO,eAAe,CAAC,IAAI,EAAE,cAAc,EAAE,gBAAgB,EAAE,YAAY,EAAE,YAAY,CAAC,CAAC;IAC7F,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,eAAe,CAAC,SAAS,IAAI,0BAA0B,CAAC,CAAC;IACrE,CAAC;AACH,CAAC;AAED,KAAK,UAAU,mCAAmC,CAChD,YAA2B,EAC3B,cAA6B,EAC7B,gBAA+B,EAC/B,aAA2B,EAC3B,YAAoB;IAEpB,OAAO,CAAC,GAAG,CAAC,qDAAqD,CAAC,CAAC;IAEnE,KAAK,MAAM,cAAc,IAAI,iCAAiC,EAAE,CAAC;QAC/D,IAAI,CAAC;YACH,OAAO,CAAC,GAAG,CAAC,wBAAwB,cAAc,EAAE,CAAC,CAAC;YACtD,MAAM,QAAQ,GAAG,MAAM,uBAAuB,CAC5C,cAAc,EAAE,YAAY,EAAE,cAAc,EAAE,gBAAgB,EAC9D,aAAa,EAAE,YAAY,CAC5B,CAAC;YACF,OAAO,CAAC,GAAG,CAAC,uBAAuB,cAAc,uBAAuB,CAAC,CAAC;YAC1E,OAAO,QAAQ,CAAC;QAClB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,UAAU,EAAE,CAAC;gBAChC,OAAO,CAAC,GAAG,CAAC,gBAAgB,cAAc,yDAAyD,CAAC,CAAC;gBACrG,SAAS;YACX,CAAC;YACD,IAAI,cAAc,KAAK,SAAS,CAAC,QAAQ,EAAE,CAAC;gBAAC,MAAM,KAAK,CAAC;YAAC,CAAC;YAC3D,OAAO,CAAC,GAAG,CAAC,gBAAgB,cAAc,yBAAyB,CAAC,CAAC;YACrE,SAAS;QACX,CAAC;IACH,CAAC;IAED,MAAM,IAAI,eAAe,CACvB,uDAAuD;QACvD,oEAAoE,CACrE,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,oBAAoB,CACjC,cAA6B,EAC7B,gBAA+B,EAC/B,YAA2B,EAC3B,aAA2B,EAC3B,YAAoB;IAEpB,2BAA2B;IAC3B,MAAM,EAAE,eAAe,EAAE,cAAc,EAAE,GAAG,gBAAgB,CAAC,aAAa,CAAC,CAAC;IAE5E,4CAA4C;IAC5C,MAAM,UAAU,GAAG,IAAI,cAAc,CAAC,YAAY,CAAC,CAAC;IACpD,MAAM,eAAe,GAAG,MAAM,UAAU,CAAC,eAAe,CACtD,cAAc,EACd,aAAa,EACb,cAAc,EACd,gBAAgB,CACjB,CAAC;IAEF,gCAAgC;IAChC,MAAM,aAAa,GAAG,CAAC,eAAe,CAAC,QAAQ,IAAI,EAAE,CAA4B,CAAC;IAClF,MAAM,gBAAgB,GAAG,CAAC,eAAe,CAAC,WAAW,IAAI,EAAE,CAA4B,CAAC;IAExF,MAAM,WAAW,GAAI,aAAa,CAAC,QAAmB,IAAK,aAAa,CAAC,WAAsB,IAAI,EAAE,CAAC;IACtG,MAAM,kBAAkB,GAAI,aAAa,CAAC,kBAA6B,IAAI,EAAE,CAAC;IAC9E,MAAM,MAAM,GAAI,aAAa,CAAC,MAAiB,IAAI,IAAI,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;IAClF,MAAM,eAAe,GAAI,aAAa,CAAC,aAAwB,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAE5F,oCAAoC;IACpC,MAAM,kBAAkB,GAAsB;QAC5C,SAAS,EAAG,gBAAgB,CAAC,SAAoB,IAAI,WAAW;QAChE,aAAa,EAAG,gBAAgB,CAAC,aAAwB,IAAI,EAAE;QAC/D,cAAc,EAAG,gBAAgB,CAAC,cAAyB;YACzD,GAAG,YAAY,8CAA8C;QAC/D,YAAY;QACZ,UAAU,EAAE,SAAS,CAAC,QAAQ;QAC9B,aAAa;QACb,eAAe;QACf,WAAW,EAAE,eAAe;QAC5B,YAAY;QACZ,kBAAkB,EAAE,kBAAkB,IAAI,IAAI;KAC/C,CAAC;IACF,MAAM,qBAAqB,GAAG,gBAAgB,CAAC,kBAAkB,CAAC,CAAC;IACnE,OAAO,CAAC,GAAG,CAAC,gCAAgC,qBAAqB,EAAE,CAAC,CAAC;IAErE,IAAI,WAAiB,CAAC;IACtB,IAAI,CAAC;QACH,WAAW,GAAG,IAAI,IAAI,CAAC,eAAe,CAAC,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,WAAW,GAAG,IAAI,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED,OAAO;QACL,WAAW;QACX,MAAM;QACN,UAAU,EAAE,SAAS,CAAC,QAAQ;QAC9B,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,gBAAgB,EAAE,IAAI;QACtB,WAAW;QACX,YAAY,EAAE,CAAC;QACf,aAAa;QACb,kBAAkB,EAAE,kBAAkB,IAAI,IAAI;QAC9C,YAAY;KACb,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,KAAK,UAAU,eAAe,CAC5B,YAAuB,EACvB,cAA6B,EAC7B,gBAA+B,EAC/B,YAA2B,EAC3B,YAAoB;IAEpB,MAAM,EACJ,qBAAqB,EACrB,wBAAwB,EACxB,uBAAuB,GACxB,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;IAEhC,MAAM,aAAa,GAAG,MAAM,qBAAqB,EAAE,CAAC;IACpD,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,UAAU,CAClB,qCAAqC;YACrC,QAAQ,YAAY,kDAAkD,CACvE,CAAC;IACJ,CAAC;IAED,MAAM,YAAY,GAAG,mBAAmB,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC;IACtE,IAAI,YAAY,IAAI,IAAI,EAAE,CAAC;QACzB,MAAM,SAAS,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAE,CAAC,CAAC,IAAe,IAAI,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrF,MAAM,IAAI,UAAU,CAClB,iBAAiB,SAAS,uCAAuC,YAAY,SAAS,CACvF,CAAC;IACJ,CAAC;IAED,MAAM,gBAAgB,GAAG,MAAM,wBAAwB,CAAC,YAAY,CAAC,CAAC;IAEtE,MAAM,UAAU,GAAG,IAAI,cAAc,CAAC,YAAY,CAAC,CAAC;IACpD,MAAM,cAAc,GAAG,MAAM,UAAU,CAAC,gBAAgB,CACtD,gBAAgB,CAAC,oBAA8B,EAC9C,gBAAgB,CAAC,qBAAkC,IAAI,EAAE,EAC1D,gBAAgB,CAAC,sBAAgC,EAChD,YAAY,CAAC,IAAe,IAAI,SAAS,EAC1C,cAAc,EACd,gBAAgB,CACjB,CAAC;IAEF,MAAM,mBAAmB,GAAG,cAAc,CAAC,eAAyB,CAAC;IAErE,MAAM,WAAW,GAAG,MAAM,uBAAuB,CAAC,mBAAmB,CAAC,CAAC;IACvE,MAAM,gBAAgB,GAAG,WAAW,CAAC,aAAuB,CAAC;IAE7D,MAAM,iBAAiB,GAAG,MAAM,UAAU,CAAC,eAAe,CACxD,cAAc,CAAC,qBAA+B,EAC9C,gBAAgB,CACjB,CAAC;IAEF,MAAM,aAAa,GAAG,CAAC,iBAAiB,CAAC,QAAQ,IAAI,EAAE,CAA4B,CAAC;IACpF,MAAM,gBAAgB,GAAG,CAAC,iBAAiB,CAAC,WAAW,IAAI,EAAE,CAA4B,CAAC;IAE1F,MAAM,WAAW,GAAI,aAAa,CAAC,QAAmB,IAAK,aAAa,CAAC,WAAsB,IAAI,EAAE,CAAC;IACtG,MAAM,kBAAkB,GAAI,aAAa,CAAC,kBAA6B,IAAI,EAAE,CAAC;IAC9E,MAAM,MAAM,GAAI,aAAa,CAAC,MAAiB,IAAI,IAAI,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;IAClF,MAAM,cAAc,GAAI,aAAa,CAAC,UAAqB,IAAI,YAAY,CAAC;IAC5E,MAAM,eAAe,GAAI,aAAa,CAAC,aAAwB,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAE5F,MAAM,kBAAkB,GAAsB;QAC5C,SAAS,EAAG,gBAAgB,CAAC,SAAoB,IAAI,WAAW;QAChE,aAAa,EAAG,gBAAgB,CAAC,aAAwB,IAAI,EAAE;QAC/D,cAAc,EAAG,gBAAgB,CAAC,cAAyB;YACzD,GAAG,YAAY,8CAA8C;QAC/D,YAAY;QACZ,UAAU,EAAE,cAAc;QAC1B,aAAa,EAAE,YAAY;QAC3B,iBAAiB,EAAE,aAAa;QAChC,WAAW,EAAE,eAAe;QAC5B,YAAY;QACZ,kBAAkB,EAAE,kBAAkB,IAAI,IAAI;KAC/C,CAAC;IACF,gBAAgB,CAAC,kBAAkB,CAAC,CAAC;IAErC,IAAI,WAAiB,CAAC;IACtB,IAAI,CAAC;QACH,WAAW,GAAG,IAAI,IAAI,CAAC,eAAe,CAAC,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,WAAW,GAAG,IAAI,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED,IAAI,UAAqB,CAAC;IAC1B,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,SAAS,CAAa,CAAC;IACzD,IAAI,WAAW,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;QACzC,UAAU,GAAG,cAA2B,CAAC;IAC3C,CAAC;SAAM,CAAC;QACN,UAAU,GAAG,YAAY,CAAC;IAC5B,CAAC;IAED,IAAI,QAAiB,CAAC;IACtB,MAAM,YAAY,GAAI,YAAY,CAAC,IAAe,IAAI,SAAS,CAAC;IAChE,MAAM,eAAe,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAa,CAAC;IAC3D,IAAI,eAAe,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;QAC3C,QAAQ,GAAG,YAAuB,CAAC;IACrC,CAAC;SAAM,CAAC;QACN,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;IAC7B,CAAC;IAED,OAAO;QACL,WAAW;QACX,MAAM;QACN,UAAU;QACV,QAAQ;QACR,gBAAgB,EAAG,YAAY,CAAC,YAAuB,IAAI,IAAI;QAC/D,WAAW;QACX,YAAY,EAAG,aAAa,CAAC,YAAuB,IAAI,CAAC;QACzD,aAAa,EAAE,YAAY,CAAC,UAAU;QACtC,kBAAkB,EAAE,kBAAkB,IAAI,IAAI;QAC9C,YAAY;KACb,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,eAAe,CAC5B,YAAuB,EACvB,cAA6B,EAC7B,gBAA+B,EAC/B,YAA2B,EAC3B,YAAoB;IAEpB,MAAM,EACJ,qBAAqB,EACrB,wBAAwB,EACxB,mBAAmB,GACpB,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;IAEhC,oCAAoC;IACpC,MAAM,aAAa,GAAG,MAAM,qBAAqB,EAAE,CAAC;IAEpD,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,UAAU,CAClB,qCAAqC;YACrC,QAAQ,YAAY,oDAAoD,CACzE,CAAC;IACJ,CAAC;IAED,qCAAqC;IACrC,MAAM,YAAY,GAAG,mBAAmB,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC;IACtE,IAAI,YAAY,IAAI,IAAI,EAAE,CAAC;QACzB,MAAM,SAAS,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAE,CAAC,CAAC,IAAe,IAAI,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrF,MAAM,IAAI,UAAU,CAClB,iBAAiB,SAAS,uCAAuC,YAAY,SAAS,CACvF,CAAC;IACJ,CAAC;IAED,mDAAmD;IACnD,MAAM,gBAAgB,GAAG,MAAM,wBAAwB,CAAC,YAAY,CAAC,CAAC;IAEtE,uCAAuC;IACvC,MAAM,UAAU,GAAG,IAAI,cAAc,CAAC,YAAY,CAAC,CAAC;IACpD,MAAM,cAAc,GAAG,MAAM,UAAU,CAAC,YAAY,CAClD,gBAAgB,CAAC,WAAqB,EACrC,gBAAgB,CAAC,aAAwB,IAAI,EAAE,EAC/C,gBAAgB,CAAC,kBAA6B,IAAI,EAAE,EACpD,gBAAgB,CAAC,aAAwB,IAAI,EAAE,EAC/C,gBAAgB,CAAC,SAAsB,IAAI,SAAS,EACpD,YAAY,CAAC,IAAe,IAAI,KAAK,EACtC,cAAc,EACd,gBAAgB,CACjB,CAAC;IAEF,2DAA2D;IAC3D,MAAM,oBAAoB,GAAG,MAAM,mBAAmB,CACpD,YAAY,EACZ,cAAc,CAAC,eAAyB,EACxC,cAAc,CAAC,gBAA0B,EACxC,gBAAgB,CAAC,SAAoB,IAAI,YAAY,CACvD,CAAC;IAEF,0CAA0C;IAC1C,MAAM,iBAAiB,GAAG,MAAM,UAAU,CAAC,eAAe,CACxD,cAAc,CAAC,qBAA+B,EAC9C,oBAAoB,CACrB,CAAC;IAEF,gDAAgD;IAChD,MAAM,aAAa,GAAG,CAAC,iBAAiB,CAAC,QAAQ,IAAI,EAAE,CAA4B,CAAC;IACpF,MAAM,gBAAgB,GAAG,CAAC,iBAAiB,CAAC,WAAW,IAAI,EAAE,CAA4B,CAAC;IAE1F,MAAM,WAAW,GAAI,aAAa,CAAC,QAAmB,IAAK,aAAa,CAAC,WAAsB,IAAI,EAAE,CAAC;IACtG,MAAM,kBAAkB,GAAI,aAAa,CAAC,kBAA6B,IAAI,EAAE,CAAC;IAC9E,MAAM,MAAM,GAAI,aAAa,CAAC,MAAiB,IAAI,IAAI,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;IAClF,MAAM,cAAc,GAAI,aAAa,CAAC,UAAqB,IAAI,YAAY,CAAC;IAC5E,MAAM,eAAe,GAAI,aAAa,CAAC,aAAwB,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAE5F,MAAM,kBAAkB,GAAsB;QAC5C,SAAS,EAAG,gBAAgB,CAAC,SAAoB,IAAI,WAAW;QAChE,aAAa,EAAG,gBAAgB,CAAC,aAAwB,IAAI,EAAE;QAC/D,cAAc,EAAG,gBAAgB,CAAC,cAAyB;YACzD,GAAG,YAAY,8CAA8C;QAC/D,YAAY;QACZ,UAAU,EAAE,cAAc;QAC1B,aAAa,EAAE,QAAQ;QACvB,iBAAiB,EAAG,gBAAgB,CAAC,SAAoB,IAAI,IAAI;QACjE,WAAW,EAAE,eAAe;QAC5B,YAAY;QACZ,kBAAkB,EAAE,kBAAkB,IAAI,IAAI;KAC/C,CAAC;IACF,gBAAgB,CAAC,kBAAkB,CAAC,CAAC;IAErC,IAAI,WAAiB,CAAC;IACtB,IAAI,CAAC;QACH,WAAW,GAAG,IAAI,IAAI,CAAC,eAAe,CAAC,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,WAAW,GAAG,IAAI,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED,IAAI,UAAqB,CAAC;IAC1B,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,SAAS,CAAa,CAAC;IACzD,IAAI,WAAW,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;QACzC,UAAU,GAAG,cAA2B,CAAC;IAC3C,CAAC;SAAM,CAAC;QACN,UAAU,GAAG,YAAY,CAAC;IAC5B,CAAC;IAED,IAAI,QAAiB,CAAC;IACtB,MAAM,YAAY,GAAI,YAAY,CAAC,IAAe,IAAI,KAAK,CAAC;IAC5D,MAAM,eAAe,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAa,CAAC;IAC3D,IAAI,eAAe,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;QAC3C,QAAQ,GAAG,YAAuB,CAAC;IACrC,CAAC;SAAM,CAAC;QACN,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC;IACzB,CAAC;IAED,OAAO;QACL,WAAW;QACX,MAAM;QACN,UAAU;QACV,QAAQ;QACR,gBAAgB,EAAG,YAAY,CAAC,YAAuB,IAAI,IAAI;QAC/D,WAAW;QACX,YAAY,EAAG,aAAa,CAAC,YAAuB,IAAI,CAAC;QACzD,aAAa,EAAE,YAAY,CAAC,QAAQ;QACpC,kBAAkB,EAAE,kBAAkB,IAAI,IAAI;QAC9C,YAAY;KACb,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAS,mBAAmB,CAC1B,aAAwC,EACxC,YAAuB;IAEvB,MAAM,eAAe,GAAG,4BAA4B,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC;IAEzE,KAAK,MAAM,cAAc,IAAI,eAAe,EAAE,CAAC;QAC7C,KAAK,MAAM,GAAG,IAAI,aAAa,EAAE,CAAC;YAChC,IAAI,GAAG,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;gBAChC,OAAO,GAAG,CAAC;YACb,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/exceptions.d.ts

@@ -48,6 +48,19 @@ export declare class UACDeniedError extends EnrollmentError {
 export declare class HSMAccessError extends EnrollmentError {
     constructor(message?: string);
 }
+/**
+ * TPM is present but TBS (TPM Base Services) access is not configured.
+ *
+ * On Windows, non-admin users cannot access the TPM unless a one-time
+ * registry key is set. This exception signals that the calling application
+ * should display a privacy warning, call oneid.setup_tbs() if the user
+ * consents, call oneid.record_privacy_consent(), and retry enrollment.
+ *
+ * Distinct from NoHSMError (no TPM) and HSMAccessError (TPM broken/locked).
+ */
+export declare class TPMSetupRequiredError extends EnrollmentError {
+    constructor(message?: string);
+}
 /**
  * This HSM is already enrolled with a different identity.
  */

package/dist/exceptions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"exceptions.d.ts","sourceRoot":"","sources":["../src/exceptions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH;;GAEG;AACH,qBAAa,UAAW,SAAQ,KAAK;IACnC,SAAgB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;gBAE9B,OAAO,GAAE,MAA2C,EAAE,UAAU,GAAE,MAAM,GAAG,IAAW;CAOnG;AAED;;GAEG;AACH,qBAAa,eAAgB,SAAQ,UAAU;gBACjC,OAAO,GAAE,MAA4B,EAAE,UAAU,GAAE,MAAM,GAAG,IAAW;CAIpF;AAED;;GAEG;AACH,qBAAa,UAAW,SAAQ,eAAe;gBACjC,OAAO,GAAE,MAA4C;CAIlE;AAED;;GAEG;AACH,qBAAa,cAAe,SAAQ,eAAe;gBACrC,OAAO,GAAE,MAAuC;CAI7D;AAED;;GAEG;AACH,qBAAa,cAAe,SAAQ,eAAe;gBACrC,OAAO,GAAE,MAAsC;CAI5D;AAED;;GAEG;AACH,qBAAa,oBAAqB,SAAQ,eAAe;gBAC3C,OAAO,GAAE,MAAiE;CAIvF;AAED;;GAEG;AACH,qBAAa,gBAAiB,SAAQ,eAAe;gBACvC,OAAO,GAAE,MAA6C;CAInE;AAED;;GAEG;AACH,qBAAa,kBAAmB,SAAQ,eAAe;gBACzC,OAAO,GAAE,MAAiD;CAIvE;AAED;;GAEG;AACH,qBAAa,kBAAmB,SAAQ,eAAe;gBACzC,OAAO,GAAE,MAAgE;CAItF;AAED;;GAEG;AACH,qBAAa,mBAAoB,SAAQ,UAAU;gBACrC,OAAO,GAAE,MAAgC;CAItD;AAED;;GAEG;AACH,qBAAa,YAAa,SAAQ,UAAU;gBAC9B,OAAO,GAAE,MAAkC;CAIxD;AAED;;GAEG;AACH,qBAAa,gBAAiB,SAAQ,UAAU;gBAClC,OAAO,GAAE,MAAoD;CAI1E;AAED;;GAEG;AACH,qBAAa,mBAAoB,SAAQ,UAAU;gBACrC,OAAO,GAAE,MAAoE;CAI1F;AAED;;GAEG;AACH,qBAAa,sBAAuB,SAAQ,eAAe;gBAC7C,OAAO,GAAE,MAA8D;CAIpF;AAcD;;GAEG;AACH,wBAAgB,gCAAgC,CAAC,UAAU,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,KAAK,CAGjG"}
+{"version":3,"file":"exceptions.d.ts","sourceRoot":"","sources":["../src/exceptions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH;;GAEG;AACH,qBAAa,UAAW,SAAQ,KAAK;IACnC,SAAgB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;gBAE9B,OAAO,GAAE,MAA2C,EAAE,UAAU,GAAE,MAAM,GAAG,IAAW;CAOnG;AAED;;GAEG;AACH,qBAAa,eAAgB,SAAQ,UAAU;gBACjC,OAAO,GAAE,MAA4B,EAAE,UAAU,GAAE,MAAM,GAAG,IAAW;CAIpF;AAED;;GAEG;AACH,qBAAa,UAAW,SAAQ,eAAe;gBACjC,OAAO,GAAE,MAA4C;CAIlE;AAED;;GAEG;AACH,qBAAa,cAAe,SAAQ,eAAe;gBACrC,OAAO,GAAE,MAAuC;CAI7D;AAED;;GAEG;AACH,qBAAa,cAAe,SAAQ,eAAe;gBACrC,OAAO,GAAE,MAAsC;CAI5D;AAED;;;;;;;;;GASG;AACH,qBAAa,qBAAsB,SAAQ,eAAe;gBAC5C,OAAO,GAAE,MAA2D;CAIjF;AAED;;GAEG;AACH,qBAAa,oBAAqB,SAAQ,eAAe;gBAC3C,OAAO,GAAE,MAAiE;CAIvF;AAED;;GAEG;AACH,qBAAa,gBAAiB,SAAQ,eAAe;gBACvC,OAAO,GAAE,MAA6C;CAInE;AAED;;GAEG;AACH,qBAAa,kBAAmB,SAAQ,eAAe;gBACzC,OAAO,GAAE,MAAiD;CAIvE;AAED;;GAEG;AACH,qBAAa,kBAAmB,SAAQ,eAAe;gBACzC,OAAO,GAAE,MAAgE;CAItF;AAED;;GAEG;AACH,qBAAa,mBAAoB,SAAQ,UAAU;gBACrC,OAAO,GAAE,MAAgC;CAItD;AAED;;GAEG;AACH,qBAAa,YAAa,SAAQ,UAAU;gBAC9B,OAAO,GAAE,MAAkC;CAIxD;AAED;;GAEG;AACH,qBAAa,gBAAiB,SAAQ,UAAU;gBAClC,OAAO,GAAE,MAAoD;CAI1E;AAED;;GAEG;AACH,qBAAa,mBAAoB,SAAQ,UAAU;gBACrC,OAAO,GAAE,MAAoE;CAI1F;AAED;;GAEG;AACH,qBAAa,sBAAuB,SAAQ,eAAe;gBAC7C,OAAO,GAAE,MAA8D;CAIpF;AAcD;;GAEG;AACH,wBAAgB,gCAAgC,CAAC,UAAU,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,KAAK,CAGjG"}

package/dist/exceptions.js

@@ -66,6 +66,22 @@ export class HSMAccessError extends EnrollmentError {
         this.name = "HSMAccessError";
     }
 }
+/**
+ * TPM is present but TBS (TPM Base Services) access is not configured.
+ *
+ * On Windows, non-admin users cannot access the TPM unless a one-time
+ * registry key is set. This exception signals that the calling application
+ * should display a privacy warning, call oneid.setup_tbs() if the user
+ * consents, call oneid.record_privacy_consent(), and retry enrollment.
+ *
+ * Distinct from NoHSMError (no TPM) and HSMAccessError (TPM broken/locked).
+ */
+export class TPMSetupRequiredError extends EnrollmentError {
+    constructor(message = "TPM found but TBS access requires one-time setup") {
+        super(message, "TBS_ACCESS_DENIED");
+        this.name = "TPMSetupRequiredError";
+    }
+}
 /**
  * This HSM is already enrolled with a different identity.
  */

package/dist/exceptions.js.map

@@ -1 +1 @@
-{"version":3,"file":"exceptions.js","sourceRoot":"","sources":["../src/exceptions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH;;GAEG;AACH,MAAM,OAAO,UAAW,SAAQ,KAAK;IACnB,UAAU,CAAgB;IAE1C,YAAY,UAAkB,kCAAkC,EAAE,aAA4B,IAAI;QAChG,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,YAAY,CAAC;QACzB,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,sFAAsF;QACtF,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACpD,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,eAAgB,SAAQ,UAAU;IAC7C,YAAY,UAAkB,mBAAmB,EAAE,aAA4B,IAAI;QACjF,KAAK,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QAC3B,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;IAChC,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,UAAW,SAAQ,eAAe;IAC7C,YAAY,UAAkB,mCAAmC;QAC/D,KAAK,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;QAC/B,IAAI,CAAC,IAAI,GAAG,YAAY,CAAC;IAC3B,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,cAAe,SAAQ,eAAe;IACjD,YAAY,UAAkB,8BAA8B;QAC1D,KAAK,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;QAC7B,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;IAC/B,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,cAAe,SAAQ,eAAe;IACjD,YAAY,UAAkB,6BAA6B;QACzD,KAAK,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAC;QACnC,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;IAC/B,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,oBAAqB,SAAQ,eAAe;IACvD,YAAY,UAAkB,wDAAwD;QACpF,KAAK,CAAC,OAAO,EAAE,uBAAuB,CAAC,CAAC;QACxC,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,gBAAiB,SAAQ,eAAe;IACnD,YAAY,UAAkB,oCAAoC;QAChE,KAAK,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;QAC/B,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;IACjC,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,kBAAmB,SAAQ,eAAe;IACrD,YAAY,UAAkB,wCAAwC;QACpE,KAAK,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;QACjC,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACnC,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,kBAAmB,SAAQ,eAAe;IACrD,YAAY,UAAkB,uDAAuD;QACnF,KAAK,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;QACjC,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACnC,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,mBAAoB,SAAQ,UAAU;IACjD,YAAY,UAAkB,uBAAuB;QACnD,KAAK,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;QAC9B,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,YAAa,SAAQ,UAAU;IAC1C,YAAY,UAAkB,yBAAyB;QACrD,KAAK,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;QAChC,IAAI,CAAC,IAAI,GAAG,cAAc,CAAC;IAC7B,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,gBAAiB,SAAQ,UAAU;IAC9C,YAAY,UAAkB,2CAA2C;QACvE,KAAK,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;QAC/B,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;IACjC,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,mBAAoB,SAAQ,UAAU;IACjD,YAAY,UAAkB,2DAA2D;QACvF,KAAK,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAC;QACnC,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,sBAAuB,SAAQ,eAAe;IACzD,YAAY,UAAkB,qDAAqD;QACjF,KAAK,CAAC,OAAO,EAAE,qBAAqB,CAAC,CAAC;QACtC,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;IACvC,CAAC;CACF;AAED,iEAAiE;AACjE,MAAM,oCAAoC,GAAwD;IAChG,uBAAuB,EAAE,oBAAoB;IAC7C,iBAAiB,EAAE,eAAe;IAClC,yBAAyB,EAAE,eAAe;IAC1C,cAAc,EAAE,gBAAgB;IAChC,gBAAgB,EAAE,kBAAkB;IACpC,gBAAgB,EAAE,kBAAkB;IACpC,qBAAqB,EAAE,sBAAsB;IAC7C,cAAc,EAAE,sBAAsB;CACvC,CAAC;AAEF;;GAEG;AACH,MAAM,UAAU,gCAAgC,CAAC,UAAkB,EAAE,aAAqB;IACxF,MAAM,cAAc,GAAG,oCAAoC,CAAC,UAAU,CAAC,IAAI,eAAe,CAAC;IAC3F,MAAM,IAAI,cAAc,CAAC,aAAa,CAAC,CAAC;AAC1C,CAAC"}
+{"version":3,"file":"exceptions.js","sourceRoot":"","sources":["../src/exceptions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH;;GAEG;AACH,MAAM,OAAO,UAAW,SAAQ,KAAK;IACnB,UAAU,CAAgB;IAE1C,YAAY,UAAkB,kCAAkC,EAAE,aAA4B,IAAI;QAChG,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,YAAY,CAAC;QACzB,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,sFAAsF;QACtF,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACpD,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,eAAgB,SAAQ,UAAU;IAC7C,YAAY,UAAkB,mBAAmB,EAAE,aAA4B,IAAI;QACjF,KAAK,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QAC3B,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;IAChC,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,UAAW,SAAQ,eAAe;IAC7C,YAAY,UAAkB,mCAAmC;QAC/D,KAAK,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;QAC/B,IAAI,CAAC,IAAI,GAAG,YAAY,CAAC;IAC3B,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,cAAe,SAAQ,eAAe;IACjD,YAAY,UAAkB,8BAA8B;QAC1D,KAAK,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;QAC7B,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;IAC/B,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,cAAe,SAAQ,eAAe;IACjD,YAAY,UAAkB,6BAA6B;QACzD,KAAK,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAC;QACnC,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;IAC/B,CAAC;CACF;AAED;;;;;;;;;GASG;AACH,MAAM,OAAO,qBAAsB,SAAQ,eAAe;IACxD,YAAY,UAAkB,kDAAkD;QAC9E,KAAK,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC;QACpC,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;IACtC,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,oBAAqB,SAAQ,eAAe;IACvD,YAAY,UAAkB,wDAAwD;QACpF,KAAK,CAAC,OAAO,EAAE,uBAAuB,CAAC,CAAC;QACxC,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,gBAAiB,SAAQ,eAAe;IACnD,YAAY,UAAkB,oCAAoC;QAChE,KAAK,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;QAC/B,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;IACjC,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,kBAAmB,SAAQ,eAAe;IACrD,YAAY,UAAkB,wCAAwC;QACpE,KAAK,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;QACjC,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACnC,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,kBAAmB,SAAQ,eAAe;IACrD,YAAY,UAAkB,uDAAuD;QACnF,KAAK,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;QACjC,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACnC,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,mBAAoB,SAAQ,UAAU;IACjD,YAAY,UAAkB,uBAAuB;QACnD,KAAK,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;QAC9B,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,YAAa,SAAQ,UAAU;IAC1C,YAAY,UAAkB,yBAAyB;QACrD,KAAK,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;QAChC,IAAI,CAAC,IAAI,GAAG,cAAc,CAAC;IAC7B,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,gBAAiB,SAAQ,UAAU;IAC9C,YAAY,UAAkB,2CAA2C;QACvE,KAAK,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;QAC/B,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;IACjC,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,mBAAoB,SAAQ,UAAU;IACjD,YAAY,UAAkB,2DAA2D;QACvF,KAAK,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAC;QACnC,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,sBAAuB,SAAQ,eAAe;IACzD,YAAY,UAAkB,qDAAqD;QACjF,KAAK,CAAC,OAAO,EAAE,qBAAqB,CAAC,CAAC;QACtC,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;IACvC,CAAC;CACF;AAED,iEAAiE;AACjE,MAAM,oCAAoC,GAAwD;IAChG,uBAAuB,EAAE,oBAAoB;IAC7C,iBAAiB,EAAE,eAAe;IAClC,yBAAyB,EAAE,eAAe;IAC1C,cAAc,EAAE,gBAAgB;IAChC,gBAAgB,EAAE,kBAAkB;IACpC,gBAAgB,EAAE,kBAAkB;IACpC,qBAAqB,EAAE,sBAAsB;IAC7C,cAAc,EAAE,sBAAsB;CACvC,CAAC;AAEF;;GAEG;AACH,MAAM,UAAU,gCAAgC,CAAC,UAAkB,EAAE,aAAqB;IACxF,MAAM,cAAc,GAAG,oCAAoC,CAAC,UAAU,CAAC,IAAI,eAAe,CAAC;IAC3F,MAAM,IAAI,cAAc,CAAC,aAAa,CAAC,CAAC;AAC1C,CAAC"}