@cello-protocol/protocol-types 0.0.7 → 0.0.8

package/dist/index.d.ts

@@ -7,6 +7,8 @@ export type { SessionAssignment, SessionAssignmentFrost, SessionAssignmentSingle
 export type { MlDsaKeyProvider, MlDsaVerifier, PseudonymBinding, Endorsement, Attestation, ConnectionPackage, EndorsementValidationStatus, AttestationValidationStatus, ValidatedEndorsement, ValidatedAttestation, PackageValidationResult, BuildPseudonymBindingResult, SignalCondition, SignalRequirement, ConnectionPolicy, DirectoryContext, } from "./connection-package.js";
 export { MAX_PSEUDONYM_LABEL_BYTES, ML_DSA_PUBKEY_BYTES, ML_DSA_SIGNATURE_BYTES, buildPseudonymBinding, verifyPseudonymBinding, verifyEndorsement, verifyAttestation, validateConnectionPackage, encodeConnectionPackage, decodeConnectionPackage, } from "./connection-package.js";
 export type { RegisterRequest, DkgComplete, DkgReady, RegisterSuccess, RegisterError, RegisterErrorReason, AgentProfile, RegistrationState, } from "./registration.js";
+export { buildAgentRevocationTbs, AGENT_REVOCATION_DOMAIN } from "./revocation.js";
+export type { RevokeAgentRequest, AgentRevocationAck, AgentRevocationError, AgentRevocationErrorReason, } from "./revocation.js";
 export type { ConnectionRequest, ConnectionRequestInbound, ConnectionResponse, ConnectionResponseVerdict, ConnectionEstablished, ConnectionRejected, ConnectionInsufficient, ConnectionRequestError, ConnectionRequestErrorReason, DisclosureRequest, DisclosureRequestItem, DisclosureRequestInbound, DisclosureResponse, DisclosureResponseInbound, ConnectionRecord, PendingConnectionRequest, ClientConnectionRecord, SessionRequestM3, SessionRequestM3ErrorReason, } from "./connection-request.js";
 export type { DkgRound1Broadcast, DkgRound2Share, FrostDkgRound1Request, FrostDkgRound1Response, FrostDkgRound2Request, FrostDkgRound2Response, FrostDkgRound3Request, FrostDkgRound3Response, FrostDkgRequest, FrostDkgResponse, } from "./frost-dkg.js";
 export type { ConsortiumManifest, ConsortiumNode, OfficerSignature, ManifestError, } from "./manifest.js";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,YAAY,EACV,eAAe,EACf,iBAAiB,EACjB,aAAa,EACb,WAAW,EACX,aAAa,EACb,cAAc,EACd,gBAAgB,EAChB,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,iBAAiB,EACjB,aAAa,EACb,iBAAiB,EACjB,mBAAmB,EACnB,gBAAgB,EAChB,eAAe,EACf,mBAAmB,EACnB,qBAAqB,EACrB,kBAAkB,EAClB,iBAAiB,GAClB,MAAM,eAAe,CAAC;AAEvB,YAAY,EAAE,kBAAkB,EAAE,UAAU,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAC7F,OAAO,EACL,oBAAoB,EACpB,eAAe,EACf,gBAAgB,EAChB,wBAAwB,EACxB,yBAAyB,GAC1B,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,4BAA4B,EAAE,YAAY,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAC;AACjK,YAAY,EACV,iBAAiB,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,eAAe,EAAE,iBAAiB,EAAE,WAAW,EACnH,gBAAgB,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,aAAa,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,YAAY,EAChI,eAAe,EAAE,cAAc,EAAE,yBAAyB,EAAE,0BAA0B,GACvF,MAAM,cAAc,CAAC;AAEtB,YAAY,EACV,gBAAgB,EAChB,aAAa,EACb,gBAAgB,EAChB,WAAW,EACX,WAAW,EACX,iBAAiB,EACjB,2BAA2B,EAC3B,2BAA2B,EAC3B,oBAAoB,EACpB,oBAAoB,EACpB,uBAAuB,EACvB,2BAA2B,EAC3B,eAAe,EACf,iBAAiB,EACjB,gBAAgB,EAChB,gBAAgB,GACjB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EACL,yBAAyB,EACzB,mBAAmB,EACnB,sBAAsB,EACtB,qBAAqB,EACrB,sBAAsB,EACtB,iBAAiB,EACjB,iBAAiB,EACjB,yBAAyB,EACzB,uBAAuB,EACvB,uBAAuB,GACxB,MAAM,yBAAyB,CAAC;AAGjC,YAAY,EACV,eAAe,EACf,WAAW,EACX,QAAQ,EACR,eAAe,EACf,aAAa,EACb,mBAAmB,EACnB,YAAY,EACZ,iBAAiB,GAClB,MAAM,mBAAmB,CAAC;AAE3B,YAAY,EACV,iBAAiB,EACjB,wBAAwB,EACxB,kBAAkB,EAClB,yBAAyB,EACzB,qBAAqB,EACrB,kBAAkB,EAClB,sBAAsB,EACtB,sBAAsB,EACtB,4BAA4B,EAC5B,iBAAiB,EACjB,qBAAqB,EACrB,wBAAwB,EACxB,kBAAkB,EAClB,yBAAyB,EACzB,gBAAgB,EAChB,wBAAwB,EACxB,sBAAsB,EACtB,gBAAgB,EAChB,2BAA2B,GAC5B,MAAM,yBAAyB,CAAC;AAEjC,YAAY,EACV,kBAAkB,EAClB,cAAc,EACd,qBAAqB,EACrB,sBAAsB,EACtB,qBAAqB,EACrB,sBAAsB,EACtB,qBAAqB,EACrB,sBAAsB,EACtB,eAAe,EACf,gBAAgB,GACjB,MAAM,gBAAgB,CAAC;AAGxB,YAAY,EACV,kBAAkB,EAClB,cAAc,EACd,gBAAgB,EAChB,aAAa,GACd,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,0BAA0B,EAC1B,yBAAyB,EACzB,gBAAgB,GACjB,MAAM,eAAe,CAAC;AAGvB,YAAY,EACV,mBAAmB,EACnB,sBAAsB,EACtB,kBAAkB,EAClB,wBAAwB,EACxB,uBAAuB,EACvB,+BAA+B,GAChC,MAAM,uBAAuB,CAAC;AAG/B,YAAY,EACV,eAAe,EACf,kBAAkB,EAClB,oBAAoB,EACpB,kBAAkB,EAClB,qBAAqB,EACrB,iBAAiB,EACjB,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,4BAA4B,EAC5B,wBAAwB,EACxB,wBAAwB,EACxB,uBAAuB,EACvB,oBAAoB,EACpB,sBAAsB,EACtB,oBAAoB,GACrB,MAAM,uBAAuB,CAAC;AAE/B,YAAY,EACV,eAAe,EACf,oBAAoB,EACpB,uBAAuB,GACxB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,0BAA0B,EAC1B,0BAA0B,EAC1B,6BAA6B,EAC7B,6BAA6B,GAC9B,MAAM,uBAAuB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,YAAY,EACV,eAAe,EACf,iBAAiB,EACjB,aAAa,EACb,WAAW,EACX,aAAa,EACb,cAAc,EACd,gBAAgB,EAChB,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,iBAAiB,EACjB,aAAa,EACb,iBAAiB,EACjB,mBAAmB,EACnB,gBAAgB,EAChB,eAAe,EACf,mBAAmB,EACnB,qBAAqB,EACrB,kBAAkB,EAClB,iBAAiB,GAClB,MAAM,eAAe,CAAC;AAEvB,YAAY,EAAE,kBAAkB,EAAE,UAAU,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAC7F,OAAO,EACL,oBAAoB,EACpB,eAAe,EACf,gBAAgB,EAChB,wBAAwB,EACxB,yBAAyB,GAC1B,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,4BAA4B,EAAE,YAAY,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAC;AACjK,YAAY,EACV,iBAAiB,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,eAAe,EAAE,iBAAiB,EAAE,WAAW,EACnH,gBAAgB,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,aAAa,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,YAAY,EAChI,eAAe,EAAE,cAAc,EAAE,yBAAyB,EAAE,0BAA0B,GACvF,MAAM,cAAc,CAAC;AAEtB,YAAY,EACV,gBAAgB,EAChB,aAAa,EACb,gBAAgB,EAChB,WAAW,EACX,WAAW,EACX,iBAAiB,EACjB,2BAA2B,EAC3B,2BAA2B,EAC3B,oBAAoB,EACpB,oBAAoB,EACpB,uBAAuB,EACvB,2BAA2B,EAC3B,eAAe,EACf,iBAAiB,EACjB,gBAAgB,EAChB,gBAAgB,GACjB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EACL,yBAAyB,EACzB,mBAAmB,EACnB,sBAAsB,EACtB,qBAAqB,EACrB,sBAAsB,EACtB,iBAAiB,EACjB,iBAAiB,EACjB,yBAAyB,EACzB,uBAAuB,EACvB,uBAAuB,GACxB,MAAM,yBAAyB,CAAC;AAGjC,YAAY,EACV,eAAe,EACf,WAAW,EACX,QAAQ,EACR,eAAe,EACf,aAAa,EACb,mBAAmB,EACnB,YAAY,EACZ,iBAAiB,GAClB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,uBAAuB,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAC;AACnF,YAAY,EACV,kBAAkB,EAClB,kBAAkB,EAClB,oBAAoB,EACpB,0BAA0B,GAC3B,MAAM,iBAAiB,CAAC;AAEzB,YAAY,EACV,iBAAiB,EACjB,wBAAwB,EACxB,kBAAkB,EAClB,yBAAyB,EACzB,qBAAqB,EACrB,kBAAkB,EAClB,sBAAsB,EACtB,sBAAsB,EACtB,4BAA4B,EAC5B,iBAAiB,EACjB,qBAAqB,EACrB,wBAAwB,EACxB,kBAAkB,EAClB,yBAAyB,EACzB,gBAAgB,EAChB,wBAAwB,EACxB,sBAAsB,EACtB,gBAAgB,EAChB,2BAA2B,GAC5B,MAAM,yBAAyB,CAAC;AAEjC,YAAY,EACV,kBAAkB,EAClB,cAAc,EACd,qBAAqB,EACrB,sBAAsB,EACtB,qBAAqB,EACrB,sBAAsB,EACtB,qBAAqB,EACrB,sBAAsB,EACtB,eAAe,EACf,gBAAgB,GACjB,MAAM,gBAAgB,CAAC;AAGxB,YAAY,EACV,kBAAkB,EAClB,cAAc,EACd,gBAAgB,EAChB,aAAa,GACd,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,0BAA0B,EAC1B,yBAAyB,EACzB,gBAAgB,GACjB,MAAM,eAAe,CAAC;AAGvB,YAAY,EACV,mBAAmB,EACnB,sBAAsB,EACtB,kBAAkB,EAClB,wBAAwB,EACxB,uBAAuB,EACvB,+BAA+B,GAChC,MAAM,uBAAuB,CAAC;AAG/B,YAAY,EACV,eAAe,EACf,kBAAkB,EAClB,oBAAoB,EACpB,kBAAkB,EAClB,qBAAqB,EACrB,iBAAiB,EACjB,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,4BAA4B,EAC5B,wBAAwB,EACxB,wBAAwB,EACxB,uBAAuB,EACvB,oBAAoB,EACpB,sBAAsB,EACtB,oBAAoB,GACrB,MAAM,uBAAuB,CAAC;AAE/B,YAAY,EACV,eAAe,EACf,oBAAoB,EACpB,uBAAuB,GACxB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,0BAA0B,EAC1B,0BAA0B,EAC1B,6BAA6B,EAC7B,6BAA6B,GAC9B,MAAM,uBAAuB,CAAC"}

package/dist/index.js

@@ -2,6 +2,7 @@ export { MAX_CONTENT_BYTES, buildEnvelope, serializeEnvelope, deserializeEnvelop
 export { SCAN_RESULT_SENTINEL, buildStructure2, encodeStructure2, encodeScanResultSentinel, verifyStructure2Signature, } from "./structure2.js";
 export { computeGenesisPrevRoot, encodeSealPayload, decodeSealPayload, buildSessionEstablishmentTbs, buildSealTbs, SEAL_RECEIPT_DISCLAIMER } from "./session.js";
 export { MAX_PSEUDONYM_LABEL_BYTES, ML_DSA_PUBKEY_BYTES, ML_DSA_SIGNATURE_BYTES, buildPseudonymBinding, verifyPseudonymBinding, verifyEndorsement, verifyAttestation, validateConnectionPackage, encodeConnectionPackage, decodeConnectionPackage, } from "./connection-package.js";
+export { buildAgentRevocationTbs, AGENT_REVOCATION_DOMAIN } from "./revocation.js";
 export { MANIFEST_SIGNATURE_INVALID, MANIFEST_VERSION_ROLLBACK, MANIFEST_EXPIRED, } from "./manifest.js";
 export { IT_LENGTH_PREFIX_DEFAULT_MAX, CONTENT_PARK_PROTOCOL_ID, CONTENT_PARK_AUTH_DOMAIN, buildContentParkAuthMsg, isContentDeliveryAck, isContentResendRequest, isContentParkDeposit, } from "./content-delivery.js";
 export { encodeSessionLivenessQuery, decodeSessionLivenessQuery, encodeSessionLivenessResponse, decodeSessionLivenessResponse, } from "./session-liveness.js";

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAYA,OAAO,EACL,iBAAiB,EACjB,aAAa,EACb,iBAAiB,EACjB,mBAAmB,EACnB,gBAAgB,EAChB,eAAe,EACf,mBAAmB,EACnB,qBAAqB,EACrB,kBAAkB,EAClB,iBAAiB,GAClB,MAAM,eAAe,CAAC;AAGvB,OAAO,EACL,oBAAoB,EACpB,eAAe,EACf,gBAAgB,EAChB,wBAAwB,EACxB,yBAAyB,GAC1B,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,4BAA4B,EAAE,YAAY,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAC;AA0BjK,OAAO,EACL,yBAAyB,EACzB,mBAAmB,EACnB,sBAAsB,EACtB,qBAAqB,EACrB,sBAAsB,EACtB,iBAAiB,EACjB,iBAAiB,EACjB,yBAAyB,EACzB,uBAAuB,EACvB,uBAAuB,GACxB,MAAM,yBAAyB,CAAC;AAyDjC,OAAO,EACL,0BAA0B,EAC1B,yBAAyB,EACzB,gBAAgB,GACjB,MAAM,eAAe,CAAC;AAuBvB,OAAO,EACL,4BAA4B,EAC5B,wBAAwB,EACxB,wBAAwB,EACxB,uBAAuB,EACvB,oBAAoB,EACpB,sBAAsB,EACtB,oBAAoB,GACrB,MAAM,uBAAuB,CAAC;AAO/B,OAAO,EACL,0BAA0B,EAC1B,0BAA0B,EAC1B,6BAA6B,EAC7B,6BAA6B,GAC9B,MAAM,uBAAuB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAYA,OAAO,EACL,iBAAiB,EACjB,aAAa,EACb,iBAAiB,EACjB,mBAAmB,EACnB,gBAAgB,EAChB,eAAe,EACf,mBAAmB,EACnB,qBAAqB,EACrB,kBAAkB,EAClB,iBAAiB,GAClB,MAAM,eAAe,CAAC;AAGvB,OAAO,EACL,oBAAoB,EACpB,eAAe,EACf,gBAAgB,EAChB,wBAAwB,EACxB,yBAAyB,GAC1B,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,4BAA4B,EAAE,YAAY,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAC;AA0BjK,OAAO,EACL,yBAAyB,EACzB,mBAAmB,EACnB,sBAAsB,EACtB,qBAAqB,EACrB,sBAAsB,EACtB,iBAAiB,EACjB,iBAAiB,EACjB,yBAAyB,EACzB,uBAAuB,EACvB,uBAAuB,GACxB,MAAM,yBAAyB,CAAC;AAcjC,OAAO,EAAE,uBAAuB,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAC;AAmDnF,OAAO,EACL,0BAA0B,EAC1B,yBAAyB,EACzB,gBAAgB,GACjB,MAAM,eAAe,CAAC;AAuBvB,OAAO,EACL,4BAA4B,EAC5B,wBAAwB,EACxB,wBAAwB,EACxB,uBAAuB,EACvB,oBAAoB,EACpB,sBAAsB,EACtB,oBAAoB,GACrB,MAAM,uBAAuB,CAAC;AAO/B,OAAO,EACL,0BAA0B,EAC1B,0BAA0B,EAC1B,6BAA6B,EAC7B,6BAA6B,GAC9B,MAAM,uBAAuB,CAAC"}

package/dist/revocation.d.ts

@@ -0,0 +1,59 @@
+/**
+ * CELLO-M7-REMOVE-001 (DOD-REMOVE-2) — agent revocation wire shapes + canonical TBS.
+ *
+ * Removal is recorded at the directory as an APPEND-ONLY, SELF-SIGNED revocation fact (design log
+ * §5 removal = revocation-not-erasure; §13 guardrail #5). The agent signs a canonical "to-be-signed"
+ * byte string with its OWN K_local (Ed25519, RFC 8032); the directory verifies it against the agent's
+ * registered K_local before appending, and the signature is stored so ANY sovereign node can
+ * re-verify the fact independently (AC-002).
+ *
+ * The TBS is keyed by the DIRECTORY-known agent_id (agent_profiles.agent_id), never a pubkey
+ * (guardrail #1 — pubkeys rotate). The k_local_pubkey bound in the TBS is the directory-RESOLVED
+ * registered key (the verifier never trusts a client-supplied key).
+ *
+ * Cross-repo (M7-WIRE-001 convention): the directory keeps a BYTE-IDENTICAL local copy of
+ * buildAgentRevocationTbs until a publish ships this helper to it; a drift-guard test + the live spine
+ * (sign here / verify there) catch any divergence.
+ */
+/** Domain separation tag — bound as the first TBS field so a revocation signature can never be
+ *  replayed as any other CELLO signature (and vice-versa). */
+export declare const AGENT_REVOCATION_DOMAIN = "CELLO-REVOKE-v1";
+/**
+ * Canonical to-be-signed bytes for an agent revocation. Field order is LOAD-BEARING — both the
+ * signer (daemon) and the verifier (directory, and any re-verifying node) must produce identical
+ * bytes. All fields are recoverable from the stored agent_revocations row + agent_profiles, so the
+ * fact stays re-verifiable forever.
+ */
+export declare function buildAgentRevocationTbs(agentId: string, kLocalPubkeyHex: string, epochId: string, reason: string, revokedAt: number | bigint): Uint8Array;
+/**
+ * Client asks the directory to record a revocation of its OWN agent. Sent on the K_local-authenticated
+ * signaling stream; `signature` is over buildAgentRevocationTbs(agent_id, <registered k_local_pubkey>,
+ * epoch_id ?? "", reason ?? "", revoked_at), signed by the agent's K_local.
+ */
+export interface RevokeAgentRequest {
+    type: "revoke_agent";
+    /** The DIRECTORY-assigned agent_id (agent_profiles.agent_id) being revoked. */
+    agent_id: string;
+    /** Optional key-epoch id (nullable in the agent_revocations row). */
+    epoch_id?: string;
+    /** Optional informational reason (e.g. "voluntary"). Never carries secrets. */
+    reason?: string;
+    /** Revocation timestamp (ms since epoch) — stored as BIGINT revoked_at. */
+    revoked_at: number;
+    /** Hex Ed25519 signature over the canonical TBS, by the agent's own K_local. */
+    signature: string;
+}
+/** Directory confirms the revocation was verified and appended (idempotent — also returned if it was
+ *  already recorded). */
+export interface AgentRevocationAck {
+    type: "agent_revocation_ack";
+    agent_id: string;
+}
+/** Directory refuses to record the revocation. Nothing is written (SI-001). */
+export interface AgentRevocationError {
+    type: "agent_revocation_error";
+    reason: AgentRevocationErrorReason;
+    agent_id?: string;
+}
+export type AgentRevocationErrorReason = "unknown_agent" | "not_self_authorized" | "signature_invalid" | "malformed" | "persist_failed";
+//# sourceMappingURL=revocation.d.ts.map

package/dist/revocation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"revocation.d.ts","sourceRoot":"","sources":["../src/revocation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAQH;8DAC8D;AAC9D,eAAO,MAAM,uBAAuB,oBAAoB,CAAC;AAEzD;;;;;GAKG;AACH,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,MAAM,EACf,eAAe,EAAE,MAAM,EACvB,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,GAAG,MAAM,GACzB,UAAU,CAUZ;AAID;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,cAAc,CAAC;IACrB,+EAA+E;IAC/E,QAAQ,EAAE,MAAM,CAAC;IACjB,qEAAqE;IACrE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,+EAA+E;IAC/E,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,2EAA2E;IAC3E,UAAU,EAAE,MAAM,CAAC;IACnB,gFAAgF;IAChF,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;yBACyB;AACzB,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,sBAAsB,CAAC;IAC7B,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,+EAA+E;AAC/E,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,wBAAwB,CAAC;IAC/B,MAAM,EAAE,0BAA0B,CAAC;IACnC,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,MAAM,0BAA0B,GAClC,eAAe,GACf,qBAAqB,GACrB,mBAAmB,GACnB,WAAW,GACX,gBAAgB,CAAC"}

package/dist/revocation.js

@@ -0,0 +1,42 @@
+/**
+ * CELLO-M7-REMOVE-001 (DOD-REMOVE-2) — agent revocation wire shapes + canonical TBS.
+ *
+ * Removal is recorded at the directory as an APPEND-ONLY, SELF-SIGNED revocation fact (design log
+ * §5 removal = revocation-not-erasure; §13 guardrail #5). The agent signs a canonical "to-be-signed"
+ * byte string with its OWN K_local (Ed25519, RFC 8032); the directory verifies it against the agent's
+ * registered K_local before appending, and the signature is stored so ANY sovereign node can
+ * re-verify the fact independently (AC-002).
+ *
+ * The TBS is keyed by the DIRECTORY-known agent_id (agent_profiles.agent_id), never a pubkey
+ * (guardrail #1 — pubkeys rotate). The k_local_pubkey bound in the TBS is the directory-RESOLVED
+ * registered key (the verifier never trusts a client-supplied key).
+ *
+ * Cross-repo (M7-WIRE-001 convention): the directory keeps a BYTE-IDENTICAL local copy of
+ * buildAgentRevocationTbs until a publish ships this helper to it; a drift-guard test + the live spine
+ * (sign here / verify there) catch any divergence.
+ */
+import { Encoder } from "cbor-x";
+// Same config as session.ts buildSessionEstablishmentTbs — tagUint8Array:false so byte strings encode
+// as definite-length CBOR byte strings (stable, encoder-independent layout).
+const CBOR_ENC = new Encoder({ tagUint8Array: false });
+/** Domain separation tag — bound as the first TBS field so a revocation signature can never be
+ *  replayed as any other CELLO signature (and vice-versa). */
+export const AGENT_REVOCATION_DOMAIN = "CELLO-REVOKE-v1";
+/**
+ * Canonical to-be-signed bytes for an agent revocation. Field order is LOAD-BEARING — both the
+ * signer (daemon) and the verifier (directory, and any re-verifying node) must produce identical
+ * bytes. All fields are recoverable from the stored agent_revocations row + agent_profiles, so the
+ * fact stays re-verifiable forever.
+ */
+export function buildAgentRevocationTbs(agentId, kLocalPubkeyHex, epochId, reason, revokedAt) {
+    const tsEncoded = typeof revokedAt === "bigint" || revokedAt > 0xffffffff ? BigInt(revokedAt) : revokedAt;
+    return CBOR_ENC.encode([
+        AGENT_REVOCATION_DOMAIN,
+        agentId,
+        kLocalPubkeyHex,
+        epochId,
+        reason,
+        tsEncoded,
+    ]);
+}
+//# sourceMappingURL=revocation.js.map

package/dist/revocation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"revocation.js","sourceRoot":"","sources":["../src/revocation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,QAAQ,CAAC;AAEjC,sGAAsG;AACtG,6EAA6E;AAC7E,MAAM,QAAQ,GAAG,IAAI,OAAO,CAAC,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,CAAC;AAEvD;8DAC8D;AAC9D,MAAM,CAAC,MAAM,uBAAuB,GAAG,iBAAiB,CAAC;AAEzD;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CACrC,OAAe,EACf,eAAuB,EACvB,OAAe,EACf,MAAc,EACd,SAA0B;IAE1B,MAAM,SAAS,GAAG,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,GAAG,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1G,OAAO,QAAQ,CAAC,MAAM,CAAC;QACrB,uBAAuB;QACvB,OAAO;QACP,eAAe;QACf,OAAO;QACP,MAAM;QACN,SAAS;KACV,CAAe,CAAC;AACnB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cello-protocol/protocol-types",
-  "version": "0.0.7",
+  "version": "0.0.8",
   "private": false,
   "type": "module",
   "engines": {
@@ -23,7 +23,7 @@
   ],
   "dependencies": {
     "cbor-x": "^1.6.4",
-    "@cello-protocol/crypto": "0.0.10"
+    "@cello-protocol/crypto": "0.0.11"
   },
   "devDependencies": {
     "@claude-flow/testing": "3.0.0-alpha.6",