@sentinel-atl/revocation 0.1.1

package/README.md

@@ -0,0 +1,64 @@
+# @sentinel-atl/revocation
+
+DID and VC revocation, key rotation, and emergency kill switch for the Agent Trust Layer.
+
+## Features
+
+- **VC revocation** — revoke individual credentials with signed proof
+- **DID revocation** — revoke an entire agent identity
+- **Key rotation** — dual-signature rotation with automatic DID resolution
+- **Kill switch** — emergency cascade termination with signed evidence
+- **Signed revocation lists** — publishable, verifiable revocation state
+
+## Install
+
+```bash
+npm install @sentinel-atl/revocation
+```
+
+## Quick Start
+
+```ts
+import { RevocationManager } from '@sentinel-atl/revocation';
+import { AuditLog } from '@sentinel-atl/audit';
+
+const auditLog = new AuditLog({ logPath: './audit.jsonl' });
+const revMgr = new RevocationManager(auditLog);
+
+// Revoke a credential
+await revMgr.revokeVC(keyProvider, keyId, issuerDid, vcId, 'policy_violation', 'Unauthorized access');
+
+// Check revocation
+revMgr.isVCRevoked(vcId); // true
+
+// Emergency kill switch
+await revMgr.killSwitch(keyProvider, keyId, issuerDid, targetDid, 'Data breach', { cascade: true });
+
+// Key rotation
+const rotation = await revMgr.rotateKey(oldKP, oldKeyId, newKP, newKeyId, oldDid, newDid);
+revMgr.resolveCurrentDid(oldDid); // returns newDid
+
+// Publish signed revocation list
+const list = await revMgr.publishRevocationList(keyProvider, keyId, issuerDid);
+```
+
+## API
+
+| Method | Description |
+|---|---|
+| `revokeVC(...)` | Revoke a Verifiable Credential |
+| `revokeDID(...)` | Revoke an entire DID |
+| `isVCRevoked(vcId)` | Check if a VC is revoked |
+| `isTrusted(did)` | Check if a DID is trusted |
+| `killSwitch(...)` | Emergency kill switch |
+| `verifyKillSwitch(event)` | Verify kill switch signature |
+| `rotateKey(...)` | Rotate agent key pair |
+| `verifyKeyRotation(notice)` | Verify key rotation |
+| `resolveCurrentDid(did)` | Resolve to latest DID after rotation |
+| `publishRevocationList(...)` | Publish signed revocation list |
+| `verifyRevocationList(list)` | Verify revocation list |
+| `getStats()` | Get revocation statistics |
+
+## License
+
+MIT

package/dist/__tests__/revocation.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=revocation.test.d.ts.map

package/dist/__tests__/revocation.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"revocation.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/revocation.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/revocation.test.js

@@ -0,0 +1,230 @@
+import { describe, it, expect, beforeEach } from 'vitest';
+import { RevocationManager } from '../index.js';
+import { InMemoryKeyProvider, publicKeyToDid, } from '@sentinel-atl/core';
+async function makeIdentity(keyProvider, name) {
+    await keyProvider.generate(name);
+    const pubKey = await keyProvider.getPublicKey(name);
+    const did = publicKeyToDid(pubKey);
+    return { keyId: name, did };
+}
+describe('@sentinel-atl/revocation', () => {
+    let keyProvider;
+    let manager;
+    let admin;
+    let agentA;
+    let agentB;
+    beforeEach(async () => {
+        keyProvider = new InMemoryKeyProvider();
+        manager = new RevocationManager();
+        admin = await makeIdentity(keyProvider, 'admin');
+        agentA = await makeIdentity(keyProvider, 'agentA');
+        agentB = await makeIdentity(keyProvider, 'agentB');
+    });
+    // ─── VC Revocation ────────────────────────────────────────────────
+    describe('VC revocation', () => {
+        it('revokes a VC and detects it', async () => {
+            const credId = 'urn:uuid:test-vc-1';
+            expect(manager.isVCRevoked(credId)).toBe(false);
+            const entry = await manager.revokeVC(keyProvider, admin.keyId, admin.did, credId, 'policy_violation', 'Used outside scope');
+            expect(entry.credentialId).toBe(credId);
+            expect(entry.reason).toBe('policy_violation');
+            expect(entry.details).toBe('Used outside scope');
+            expect(manager.isVCRevoked(credId)).toBe(true);
+        });
+        it('returns revocation details', async () => {
+            const credId = 'urn:uuid:test-vc-2';
+            await manager.revokeVC(keyProvider, admin.keyId, admin.did, credId, 'key_compromise');
+            const rev = manager.getVCRevocation(credId);
+            expect(rev).toBeDefined();
+            expect(rev.reason).toBe('key_compromise');
+            expect(rev.revokedAt).toBeDefined();
+        });
+        it('returns undefined for non-revoked VC', () => {
+            expect(manager.getVCRevocation('urn:uuid:not-revoked')).toBeUndefined();
+        });
+    });
+    // ─── Signed Revocation List ───────────────────────────────────────
+    describe('signed revocation list', () => {
+        it('publishes and verifies a signed revocation list', async () => {
+            await manager.revokeVC(keyProvider, admin.keyId, admin.did, 'urn:uuid:vc-1', 'manual');
+            await manager.revokeVC(keyProvider, admin.keyId, admin.did, 'urn:uuid:vc-2', 'scope_violation');
+            const list = await manager.publishRevocationList(keyProvider, admin.keyId, admin.did);
+            expect(list.version).toBe(1);
+            expect(list.issuerDid).toBe(admin.did);
+            expect(list.entries).toHaveLength(2);
+            expect(list.signature).toBeDefined();
+            const result = await manager.verifyRevocationList(list);
+            expect(result.valid).toBe(true);
+        });
+        it('detects tampered revocation list', async () => {
+            await manager.revokeVC(keyProvider, admin.keyId, admin.did, 'urn:uuid:vc-tamper', 'manual');
+            const list = await manager.publishRevocationList(keyProvider, admin.keyId, admin.did);
+            // Tamper: add a fake entry
+            list.entries.push({
+                credentialId: 'urn:uuid:injected',
+                revokedAt: new Date().toISOString(),
+                reason: 'manual',
+            });
+            const result = await manager.verifyRevocationList(list);
+            expect(result.valid).toBe(false);
+        });
+        it('increments version on each publish', async () => {
+            const list1 = await manager.publishRevocationList(keyProvider, admin.keyId, admin.did);
+            const list2 = await manager.publishRevocationList(keyProvider, admin.keyId, admin.did);
+            expect(list1.version).toBe(1);
+            expect(list2.version).toBe(2);
+        });
+        it('imports revocation list entries', async () => {
+            // Manager 1 publishes a list
+            const manager1 = new RevocationManager();
+            await manager1.revokeVC(keyProvider, admin.keyId, admin.did, 'urn:uuid:import-vc-1', 'manual');
+            const list = await manager1.publishRevocationList(keyProvider, admin.keyId, admin.did);
+            // Manager 2 imports it
+            const manager2 = new RevocationManager();
+            expect(manager2.isVCRevoked('urn:uuid:import-vc-1')).toBe(false);
+            const imported = manager2.importRevocationList(list);
+            expect(imported).toBe(1);
+            expect(manager2.isVCRevoked('urn:uuid:import-vc-1')).toBe(true);
+            // Importing again doesn't duplicate
+            const imported2 = manager2.importRevocationList(list);
+            expect(imported2).toBe(0);
+        });
+    });
+    // ─── DID Revocation ───────────────────────────────────────────────
+    describe('DID revocation', () => {
+        it('revokes a DID and detects it', async () => {
+            expect(manager.isDIDRevoked(agentA.did)).toBe(false);
+            const revocation = await manager.revokeDID(keyProvider, admin.keyId, admin.did, agentA.did, 'agent_decommissioned', 'Agent replaced');
+            expect(revocation.did).toBe(agentA.did);
+            expect(revocation.revokedBy).toBe(admin.did);
+            expect(revocation.reason).toBe('agent_decommissioned');
+            expect(manager.isDIDRevoked(agentA.did)).toBe(true);
+        });
+        it('verifies a DID revocation signature', async () => {
+            const revocation = await manager.revokeDID(keyProvider, admin.keyId, admin.did, agentA.did, 'policy_violation');
+            const result = await manager.verifyDIDRevocation(revocation);
+            expect(result.valid).toBe(true);
+        });
+        it('detects tampered DID revocation', async () => {
+            const revocation = await manager.revokeDID(keyProvider, admin.keyId, admin.did, agentA.did, 'policy_violation');
+            // Tamper: change the reason
+            revocation.reason = 'emergency';
+            const result = await manager.verifyDIDRevocation(revocation);
+            expect(result.valid).toBe(false);
+        });
+    });
+    // ─── Key Rotation ─────────────────────────────────────────────────
+    describe('key rotation', () => {
+        it('rotates keys with dual-signature notice', async () => {
+            const newKeyProvider = new InMemoryKeyProvider();
+            const newAgent = await makeIdentity(newKeyProvider, 'agentA-v2');
+            const notice = await manager.rotateKey(keyProvider, agentA.keyId, agentA.did, newKeyProvider, newAgent.keyId, newAgent.did);
+            expect(notice.oldDid).toBe(agentA.did);
+            expect(notice.newDid).toBe(newAgent.did);
+            expect(notice.oldKeySignature).toBeDefined();
+            expect(notice.newKeySignature).toBeDefined();
+        });
+        it('verifies a valid key rotation', async () => {
+            const newKeyProvider = new InMemoryKeyProvider();
+            const newAgent = await makeIdentity(newKeyProvider, 'agentA-v2');
+            const notice = await manager.rotateKey(keyProvider, agentA.keyId, agentA.did, newKeyProvider, newAgent.keyId, newAgent.did);
+            const result = await manager.verifyKeyRotation(notice);
+            expect(result.valid).toBe(true);
+        });
+        it('marks old DID as revoked after rotation', async () => {
+            const newKeyProvider = new InMemoryKeyProvider();
+            const newAgent = await makeIdentity(newKeyProvider, 'agentA-v2');
+            await manager.rotateKey(keyProvider, agentA.keyId, agentA.did, newKeyProvider, newAgent.keyId, newAgent.did);
+            expect(manager.isDIDRevoked(agentA.did)).toBe(true);
+            expect(manager.isDIDRevoked(newAgent.did)).toBe(false);
+        });
+        it('resolves current DID through rotation chain', async () => {
+            const kp2 = new InMemoryKeyProvider();
+            const agent2 = await makeIdentity(kp2, 'v2');
+            const kp3 = new InMemoryKeyProvider();
+            const agent3 = await makeIdentity(kp3, 'v3');
+            // Rotate A → 2, then 2 → 3
+            await manager.rotateKey(keyProvider, agentA.keyId, agentA.did, kp2, agent2.keyId, agent2.did);
+            await manager.rotateKey(kp2, agent2.keyId, agent2.did, kp3, agent3.keyId, agent3.did);
+            // Resolve from original DID should land on v3
+            expect(manager.resolveCurrentDid(agentA.did)).toBe(agent3.did);
+            expect(manager.resolveCurrentDid(agent2.did)).toBe(agent3.did);
+            expect(manager.resolveCurrentDid(agent3.did)).toBe(agent3.did);
+        });
+    });
+    // ─── Kill Switch ──────────────────────────────────────────────────
+    describe('kill switch', () => {
+        it('revokes target DID immediately', async () => {
+            const event = await manager.killSwitch(keyProvider, admin.keyId, admin.did, agentA.did, 'Agent producing harmful output');
+            expect(event.targetDid).toBe(agentA.did);
+            expect(event.activatedBy).toBe(admin.did);
+            expect(manager.isDIDRevoked(agentA.did)).toBe(true);
+        });
+        it('cascades to downstream agents', async () => {
+            const event = await manager.killSwitch(keyProvider, admin.keyId, admin.did, agentA.did, 'Compromised key — cascade to dependents', { cascade: true, downstreamDids: [agentB.did] });
+            expect(event.cascade).toBe(true);
+            expect(event.cascadedDids).toContain(agentB.did);
+            expect(manager.isDIDRevoked(agentA.did)).toBe(true);
+            expect(manager.isDIDRevoked(agentB.did)).toBe(true);
+        });
+        it('verifies kill switch event signature', async () => {
+            const event = await manager.killSwitch(keyProvider, admin.keyId, admin.did, agentA.did, 'Test kill');
+            const result = await manager.verifyKillSwitch(event);
+            expect(result.valid).toBe(true);
+        });
+        it('detects tampered kill switch event', async () => {
+            const event = await manager.killSwitch(keyProvider, admin.keyId, admin.did, agentA.did, 'Test kill');
+            // Tamper: change the target
+            event.targetDid = agentB.did;
+            const result = await manager.verifyKillSwitch(event);
+            expect(result.valid).toBe(false);
+        });
+        it('records kill events in history', async () => {
+            await manager.killSwitch(keyProvider, admin.keyId, admin.did, agentA.did, 'Kill 1');
+            await manager.killSwitch(keyProvider, admin.keyId, admin.did, agentB.did, 'Kill 2');
+            const events = manager.getKillEvents();
+            expect(events).toHaveLength(2);
+            expect(events[0].reason).toBe('Kill 1');
+            expect(events[1].reason).toBe('Kill 2');
+        });
+    });
+    // ─── Comprehensive Trust Check ────────────────────────────────────
+    describe('isTrusted', () => {
+        it('trusts unrevoked DID + VC', () => {
+            const result = manager.isTrusted(agentA.did, 'urn:uuid:valid-vc');
+            expect(result.trusted).toBe(true);
+        });
+        it('rejects revoked DID', async () => {
+            await manager.revokeDID(keyProvider, admin.keyId, admin.did, agentA.did, 'emergency');
+            const result = manager.isTrusted(agentA.did);
+            expect(result.trusted).toBe(false);
+            expect(result.reason).toContain('DID revoked');
+        });
+        it('rejects revoked VC even if DID is fine', async () => {
+            const credId = 'urn:uuid:revoked-vc';
+            await manager.revokeVC(keyProvider, admin.keyId, admin.did, credId, 'scope_violation');
+            const result = manager.isTrusted(agentA.did, credId);
+            expect(result.trusted).toBe(false);
+            expect(result.reason).toContain('VC revoked');
+        });
+    });
+    // ─── Stats ─────────────────────────────────────────────────────────
+    describe('stats', () => {
+        it('reports correct stats', async () => {
+            expect(manager.getStats()).toEqual({
+                revokedVCs: 0,
+                revokedDIDs: 0,
+                rotations: 0,
+                killEvents: 0,
+            });
+            await manager.revokeVC(keyProvider, admin.keyId, admin.did, 'urn:uuid:s1', 'manual');
+            await manager.revokeDID(keyProvider, admin.keyId, admin.did, agentA.did, 'emergency');
+            await manager.killSwitch(keyProvider, admin.keyId, admin.did, agentB.did, 'Test');
+            const stats = manager.getStats();
+            expect(stats.revokedVCs).toBe(1);
+            expect(stats.revokedDIDs).toBeGreaterThanOrEqual(2); // agentA + agentB (from kill)
+            expect(stats.killEvents).toBe(1);
+        });
+    });
+});
+//# sourceMappingURL=revocation.test.js.map

package/dist/__tests__/revocation.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"revocation.test.js","sourceRoot":"","sources":["../../src/__tests__/revocation.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAC1D,OAAO,EAAE,iBAAiB,EAAyB,MAAM,aAAa,CAAC;AACvE,OAAO,EAEL,mBAAmB,EACnB,cAAc,GACf,MAAM,oBAAoB,CAAC;AAE5B,KAAK,UAAU,YAAY,CAAC,WAAgC,EAAE,IAAY;IACxE,MAAM,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACjC,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IACpD,MAAM,GAAG,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;IACnC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;AAC9B,CAAC;AAED,QAAQ,CAAC,0BAA0B,EAAE,GAAG,EAAE;IACxC,IAAI,WAAgC,CAAC;IACrC,IAAI,OAA0B,CAAC;IAC/B,IAAI,KAAqC,CAAC;IAC1C,IAAI,MAAsC,CAAC;IAC3C,IAAI,MAAsC,CAAC;IAE3C,UAAU,CAAC,KAAK,IAAI,EAAE;QACpB,WAAW,GAAG,IAAI,mBAAmB,EAAE,CAAC;QACxC,OAAO,GAAG,IAAI,iBAAiB,EAAE,CAAC;QAClC,KAAK,GAAG,MAAM,YAAY,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QACjD,MAAM,GAAG,MAAM,YAAY,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;QACnD,MAAM,GAAG,MAAM,YAAY,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;IAEH,qEAAqE;IAErE,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE;QAC7B,EAAE,CAAC,6BAA6B,EAAE,KAAK,IAAI,EAAE;YAC3C,MAAM,MAAM,GAAG,oBAAoB,CAAC;YACpC,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAEhD,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,QAAQ,CAClC,WAAW,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,EACnC,MAAM,EAAE,kBAAkB,EAAE,oBAAoB,CACjD,CAAC;YAEF,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACxC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;YAC9C,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;YACjD,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,4BAA4B,EAAE,KAAK,IAAI,EAAE;YAC1C,MAAM,MAAM,GAAG,oBAAoB,CAAC;YACpC,MAAM,OAAO,CAAC,QAAQ,CACpB,WAAW,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,EACnC,MAAM,EAAE,gBAAgB,CACzB,CAAC;YAEF,MAAM,GAAG,GAAG,OAAO,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;YAC5C,MAAM,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;YAC1B,MAAM,CAAC,GAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;YAC3C,MAAM,CAAC,GAAI,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,CAAC;QACvC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,sCAAsC,EAAE,GAAG,EAAE;YAC9C,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,sBAAsB,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;QAC1E,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,qEAAqE;IAErE,QAAQ,CAAC,wBAAwB,EAAE,GAAG,EAAE;QACtC,EAAE,CAAC,iDAAiD,EAAE,KAAK,IAAI,EAAE;YAC/D,MAAM,OAAO,CAAC,QAAQ,CACpB,WAAW,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,EACnC,eAAe,EAAE,QAAQ,CAC1B,CAAC;YACF,MAAM,OAAO,CAAC,QAAQ,CACpB,WAAW,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,EACnC,eAAe,EAAE,iBAAiB,CACnC,CAAC;YAEF,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,qBAAqB,CAC9C,WAAW,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CACpC,CAAC;YAEF,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAC7B,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACvC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;YACrC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,CAAC;YAErC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC;YACxD,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,kCAAkC,EAAE,KAAK,IAAI,EAAE;YAChD,MAAM,OAAO,CAAC,QAAQ,CACpB,WAAW,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,EACnC,oBAAoB,EAAE,QAAQ,CAC/B,CAAC;YAEF,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,qBAAqB,CAC9C,WAAW,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CACpC,CAAC;YAEF,2BAA2B;YAC3B,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;gBAChB,YAAY,EAAE,mBAAmB;gBACjC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBACnC,MAAM,EAAE,QAAQ;aACjB,CAAC,CAAC;YAEH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC;YACxD,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,oCAAoC,EAAE,KAAK,IAAI,EAAE;YAClD,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,qBAAqB,CAC/C,WAAW,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CACpC,CAAC;YACF,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,qBAAqB,CAC/C,WAAW,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CACpC,CAAC;YAEF,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAC9B,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAChC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,iCAAiC,EAAE,KAAK,IAAI,EAAE;YAC/C,6BAA6B;YAC7B,MAAM,QAAQ,GAAG,IAAI,iBAAiB,EAAE,CAAC;YACzC,MAAM,QAAQ,CAAC,QAAQ,CACrB,WAAW,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,EACnC,sBAAsB,EAAE,QAAQ,CACjC,CAAC;YACF,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,qBAAqB,CAC/C,WAAW,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CACpC,CAAC;YAEF,uBAAuB;YACvB,MAAM,QAAQ,GAAG,IAAI,iBAAiB,EAAE,CAAC;YACzC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,sBAAsB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACjE,MAAM,QAAQ,GAAG,QAAQ,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC;YACrD,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACzB,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,sBAAsB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAEhE,oCAAoC;YACpC,MAAM,SAAS,GAAG,QAAQ,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC;YACtD,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC5B,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,qEAAqE;IAErE,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;QAC9B,EAAE,CAAC,8BAA8B,EAAE,KAAK,IAAI,EAAE;YAC5C,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAErD,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,SAAS,CACxC,WAAW,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,EACnC,MAAM,CAAC,GAAG,EAAE,sBAAsB,EAAE,gBAAgB,CACrD,CAAC;YAEF,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACxC,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC7C,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;YACvD,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,qCAAqC,EAAE,KAAK,IAAI,EAAE;YACnD,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,SAAS,CACxC,WAAW,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,EACnC,MAAM,CAAC,GAAG,EAAE,kBAAkB,CAC/B,CAAC;YAEF,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,mBAAmB,CAAC,UAAU,CAAC,CAAC;YAC7D,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,iCAAiC,EAAE,KAAK,IAAI,EAAE;YAC/C,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,SAAS,CACxC,WAAW,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,EACnC,MAAM,CAAC,GAAG,EAAE,kBAAkB,CAC/B,CAAC;YAEF,4BAA4B;YAC5B,UAAU,CAAC,MAAM,GAAG,WAAW,CAAC;YAEhC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,mBAAmB,CAAC,UAAU,CAAC,CAAC;YAC7D,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,qEAAqE;IAErE,QAAQ,CAAC,cAAc,EAAE,GAAG,EAAE;QAC5B,EAAE,CAAC,yCAAyC,EAAE,KAAK,IAAI,EAAE;YACvD,MAAM,cAAc,GAAG,IAAI,mBAAmB,EAAE,CAAC;YACjD,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;YAEjE,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,SAAS,CACpC,WAAW,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,EACrC,cAAc,EAAE,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,CAC7C,CAAC;YAEF,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACvC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YACzC,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,WAAW,EAAE,CAAC;YAC7C,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,WAAW,EAAE,CAAC;QAC/C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,+BAA+B,EAAE,KAAK,IAAI,EAAE;YAC7C,MAAM,cAAc,GAAG,IAAI,mBAAmB,EAAE,CAAC;YACjD,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;YAEjE,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,SAAS,CACpC,WAAW,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,EACrC,cAAc,EAAE,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,CAC7C,CAAC;YAEF,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;YACvD,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,yCAAyC,EAAE,KAAK,IAAI,EAAE;YACvD,MAAM,cAAc,GAAG,IAAI,mBAAmB,EAAE,CAAC;YACjD,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;YAEjE,MAAM,OAAO,CAAC,SAAS,CACrB,WAAW,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,EACrC,cAAc,EAAE,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,CAC7C,CAAC;YAEF,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACpD,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACzD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,6CAA6C,EAAE,KAAK,IAAI,EAAE;YAC3D,MAAM,GAAG,GAAG,IAAI,mBAAmB,EAAE,CAAC;YACtC,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YAC7C,MAAM,GAAG,GAAG,IAAI,mBAAmB,EAAE,CAAC;YACtC,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YAE7C,2BAA2B;YAC3B,MAAM,OAAO,CAAC,SAAS,CACrB,WAAW,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,EACrC,GAAG,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,CAC9B,CAAC;YACF,MAAM,OAAO,CAAC,SAAS,CACrB,GAAG,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,EAC7B,GAAG,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,CAC9B,CAAC;YAEF,8CAA8C;YAC9C,MAAM,CAAC,OAAO,CAAC,iBAAiB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC/D,MAAM,CAAC,OAAO,CAAC,iBAAiB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC/D,MAAM,CAAC,OAAO,CAAC,iBAAiB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,qEAAqE;IAErE,QAAQ,CAAC,aAAa,EAAE,GAAG,EAAE;QAC3B,EAAE,CAAC,gCAAgC,EAAE,KAAK,IAAI,EAAE;YAC9C,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,UAAU,CACpC,WAAW,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,EACnC,MAAM,CAAC,GAAG,EACV,gCAAgC,CACjC,CAAC;YAEF,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACzC,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC1C,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,+BAA+B,EAAE,KAAK,IAAI,EAAE;YAC7C,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,UAAU,CACpC,WAAW,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,EACnC,MAAM,CAAC,GAAG,EACV,yCAAyC,EACzC,EAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAChD,CAAC;YAEF,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACjC,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACjD,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACpD,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,sCAAsC,EAAE,KAAK,IAAI,EAAE;YACpD,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,UAAU,CACpC,WAAW,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,EACnC,MAAM,CAAC,GAAG,EAAE,WAAW,CACxB,CAAC;YAEF,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;YACrD,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,oCAAoC,EAAE,KAAK,IAAI,EAAE;YAClD,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,UAAU,CACpC,WAAW,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,EACnC,MAAM,CAAC,GAAG,EAAE,WAAW,CACxB,CAAC;YAEF,4BAA4B;YAC5B,KAAK,CAAC,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC;YAE7B,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;YACrD,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,gCAAgC,EAAE,KAAK,IAAI,EAAE;YAC9C,MAAM,OAAO,CAAC,UAAU,CACtB,WAAW,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,EACnC,MAAM,CAAC,GAAG,EAAE,QAAQ,CACrB,CAAC;YACF,MAAM,OAAO,CAAC,UAAU,CACtB,WAAW,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,EACnC,MAAM,CAAC,GAAG,EAAE,QAAQ,CACrB,CAAC;YAEF,MAAM,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC;YACvC,MAAM,CAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;YAC/B,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACxC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC1C,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,qEAAqE;IAErE,QAAQ,CAAC,WAAW,EAAE,GAAG,EAAE;QACzB,EAAE,CAAC,2BAA2B,EAAE,GAAG,EAAE;YACnC,MAAM,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;YAClE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,qBAAqB,EAAE,KAAK,IAAI,EAAE;YACnC,MAAM,OAAO,CAAC,SAAS,CACrB,WAAW,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,EACnC,MAAM,CAAC,GAAG,EAAE,WAAW,CACxB,CAAC;YACF,MAAM,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC7C,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACnC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;QACjD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,wCAAwC,EAAE,KAAK,IAAI,EAAE;YACtD,MAAM,MAAM,GAAG,qBAAqB,CAAC;YACrC,MAAM,OAAO,CAAC,QAAQ,CACpB,WAAW,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,EACnC,MAAM,EAAE,iBAAiB,CAC1B,CAAC;YAEF,MAAM,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YACrD,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACnC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;QAChD,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,sEAAsE;IAEtE,QAAQ,CAAC,OAAO,EAAE,GAAG,EAAE;QACrB,EAAE,CAAC,uBAAuB,EAAE,KAAK,IAAI,EAAE;YACrC,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC;gBACjC,UAAU,EAAE,CAAC;gBACb,WAAW,EAAE,CAAC;gBACd,SAAS,EAAE,CAAC;gBACZ,UAAU,EAAE,CAAC;aACd,CAAC,CAAC;YAEH,MAAM,OAAO,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,EAAE,aAAa,EAAE,QAAQ,CAAC,CAAC;YACrF,MAAM,OAAO,CAAC,SAAS,CAAC,WAAW,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;YACtF,MAAM,OAAO,CAAC,UAAU,CAAC,WAAW,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YAElF,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC;YACjC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACjC,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC,CAAC,8BAA8B;YACnF,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACnC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,200 @@
+/**
+ * @sentinel-atl/revocation — DID & VC Revocation, Key Rotation, Kill Switch
+ *
+ * When things go wrong — compromised keys, rogue agents, policy violations —
+ * you need to revoke trust FAST. This module provides:
+ *
+ * 1. **VC Revocation List (VRL):** Signed list of revoked credential IDs.
+ *    Any verifier checks the VRL before trusting a VC.
+ *
+ * 2. **DID Revocation:** Mark an entire agent identity as revoked.
+ *    All VCs issued by or to that DID become untrusted.
+ *
+ * 3. **Key Rotation:** Generate a new keypair and publish a signed rotation
+ *    notice linking old DID → new DID. Verifiers follow the chain.
+ *
+ * 4. **Emergency Kill Switch:** Immediately revoke an agent + all downstream
+ *    delegations. Logged to audit with highest priority.
+ *
+ * All revocation decisions are signed by the revoker to prevent spoofing,
+ * and every action is audit-logged.
+ */
+import { type KeyProvider } from '@sentinel-atl/core';
+import { AuditLog } from '@sentinel-atl/audit';
+export interface RevocationEntry {
+    /** The revoked VC's ID (urn:uuid:...) */
+    credentialId: string;
+    /** When it was revoked */
+    revokedAt: string;
+    /** Why it was revoked */
+    reason: RevocationReason;
+    /** Optional human-readable explanation */
+    details?: string;
+}
+export type RevocationReason = 'key_compromise' | 'credential_expired_early' | 'policy_violation' | 'scope_violation' | 'agent_decommissioned' | 'emergency' | 'key_rotation' | 'manual';
+export interface SignedRevocationList {
+    /** List version — monotonically increasing */
+    version: number;
+    /** DID of the entity that published this list */
+    issuerDid: string;
+    /** When this list was published */
+    publishedAt: string;
+    /** Revoked credentials */
+    entries: RevocationEntry[];
+    /** Ed25519 signature over the canonical list (base64url) */
+    signature: string;
+}
+export interface DIDRevocation {
+    /** The revoked DID */
+    did: string;
+    /** Who revoked it */
+    revokedBy: string;
+    /** When */
+    revokedAt: string;
+    /** Why */
+    reason: RevocationReason;
+    details?: string;
+    /** Signature by the revoker (base64url) */
+    signature: string;
+}
+export interface KeyRotationNotice {
+    /** The old DID being rotated away from */
+    oldDid: string;
+    /** The new DID to use going forward */
+    newDid: string;
+    /** When the rotation happened */
+    rotatedAt: string;
+    /** Signature by the OLD key (proves control) */
+    oldKeySignature: string;
+    /** Signature by the NEW key (proves ownership) */
+    newKeySignature: string;
+}
+export interface KillSwitchEvent {
+    /** The agent DID being killed */
+    targetDid: string;
+    /** Who activated the kill switch */
+    activatedBy: string;
+    /** When */
+    activatedAt: string;
+    /** Why */
+    reason: string;
+    /** Whether to cascade to all downstream delegations */
+    cascade: boolean;
+    /** DIDs of downstream agents also revoked (if cascade=true) */
+    cascadedDids: string[];
+    /** Signature by the activator (base64url) */
+    signature: string;
+}
+export declare class RevocationManager {
+    private revokedVCs;
+    private revokedDIDs;
+    private rotations;
+    private killEvents;
+    private listVersion;
+    private auditLog?;
+    constructor(auditLog?: AuditLog);
+    /**
+     * Revoke a Verifiable Credential.
+     * The revoker signs the revocation entry to prevent spoofing.
+     */
+    revokeVC(keyProvider: KeyProvider, revokerKeyId: string, revokerDid: string, credentialId: string, reason: RevocationReason, details?: string): Promise<RevocationEntry>;
+    /**
+     * Check if a VC is revoked.
+     */
+    isVCRevoked(credentialId: string): boolean;
+    /**
+     * Get the revocation entry for a VC (if revoked).
+     */
+    getVCRevocation(credentialId: string): RevocationEntry | undefined;
+    /**
+     * Publish a signed revocation list.
+     */
+    publishRevocationList(keyProvider: KeyProvider, issuerKeyId: string, issuerDid: string): Promise<SignedRevocationList>;
+    /**
+     * Verify a signed revocation list.
+     */
+    verifyRevocationList(list: SignedRevocationList): Promise<{
+        valid: boolean;
+        error?: string;
+    }>;
+    /**
+     * Import a verified revocation list (merge entries).
+     */
+    importRevocationList(list: SignedRevocationList): number;
+    /**
+     * Revoke a DID. Signs the revocation with the revoker's key.
+     */
+    revokeDID(keyProvider: KeyProvider, revokerKeyId: string, revokerDid: string, targetDid: string, reason: RevocationReason, details?: string): Promise<DIDRevocation>;
+    /**
+     * Check if a DID is revoked.
+     */
+    isDIDRevoked(did: string): boolean;
+    /**
+     * Verify a DID revocation notice.
+     */
+    verifyDIDRevocation(revocation: DIDRevocation): Promise<{
+        valid: boolean;
+        error?: string;
+    }>;
+    /**
+     * Rotate an agent's key. Both old and new keys sign the rotation notice.
+     * This proves: "I own the old key AND the new key, and I'm switching."
+     */
+    rotateKey(oldKeyProvider: KeyProvider, oldKeyId: string, oldDid: string, newKeyProvider: KeyProvider, newKeyId: string, newDid: string): Promise<KeyRotationNotice>;
+    /**
+     * Verify a key rotation notice (both signatures must be valid).
+     */
+    verifyKeyRotation(notice: KeyRotationNotice): Promise<{
+        valid: boolean;
+        error?: string;
+    }>;
+    /**
+     * Resolve the current DID for an agent (follows rotation chain).
+     */
+    resolveCurrentDid(did: string): string;
+    /**
+     * Emergency kill switch — immediately revoke an agent and optionally
+     * cascade to all downstream delegations.
+     *
+     * This is the "big red button." Use when an agent is:
+     * - Compromised
+     * - Producing harmful output
+     * - Violating scope
+     * - Otherwise untrustworthy
+     */
+    killSwitch(keyProvider: KeyProvider, activatorKeyId: string, activatorDid: string, targetDid: string, reason: string, options?: {
+        cascade?: boolean;
+        downstreamDids?: string[];
+    }): Promise<KillSwitchEvent>;
+    /**
+     * Verify a kill switch event signature.
+     */
+    verifyKillSwitch(event: KillSwitchEvent): Promise<{
+        valid: boolean;
+        error?: string;
+    }>;
+    /**
+     * Get all kill switch events.
+     */
+    getKillEvents(): KillSwitchEvent[];
+    /**
+     * Full trust check: is this DID + credential ID currently trusted?
+     *
+     * Returns false if the DID is revoked, the VC is revoked,
+     * or the agent has been killed.
+     */
+    isTrusted(did: string, credentialId?: string): {
+        trusted: boolean;
+        reason?: string;
+    };
+    /**
+     * Get summary stats.
+     */
+    getStats(): {
+        revokedVCs: number;
+        revokedDIDs: number;
+        rotations: number;
+        killEvents: number;
+    };
+}
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAUL,KAAK,WAAW,EACjB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAI/C,MAAM,WAAW,eAAe;IAC9B,yCAAyC;IACzC,YAAY,EAAE,MAAM,CAAC;IACrB,0BAA0B;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,yBAAyB;IACzB,MAAM,EAAE,gBAAgB,CAAC;IACzB,0CAA0C;IAC1C,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,MAAM,gBAAgB,GACxB,gBAAgB,GAChB,0BAA0B,GAC1B,kBAAkB,GAClB,iBAAiB,GACjB,sBAAsB,GACtB,WAAW,GACX,cAAc,GACd,QAAQ,CAAC;AAEb,MAAM,WAAW,oBAAoB;IACnC,8CAA8C;IAC9C,OAAO,EAAE,MAAM,CAAC;IAChB,iDAAiD;IACjD,SAAS,EAAE,MAAM,CAAC;IAClB,mCAAmC;IACnC,WAAW,EAAE,MAAM,CAAC;IACpB,0BAA0B;IAC1B,OAAO,EAAE,eAAe,EAAE,CAAC;IAC3B,4DAA4D;IAC5D,SAAS,EAAE,MAAM,CAAC;CACnB;AAID,MAAM,WAAW,aAAa;IAC5B,sBAAsB;IACtB,GAAG,EAAE,MAAM,CAAC;IACZ,qBAAqB;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU;IACV,MAAM,EAAE,gBAAgB,CAAC;IACzB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,2CAA2C;IAC3C,SAAS,EAAE,MAAM,CAAC;CACnB;AAID,MAAM,WAAW,iBAAiB;IAChC,0CAA0C;IAC1C,MAAM,EAAE,MAAM,CAAC;IACf,uCAAuC;IACvC,MAAM,EAAE,MAAM,CAAC;IACf,iCAAiC;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,gDAAgD;IAChD,eAAe,EAAE,MAAM,CAAC;IACxB,kDAAkD;IAClD,eAAe,EAAE,MAAM,CAAC;CACzB;AAID,MAAM,WAAW,eAAe;IAC9B,iCAAiC;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,oCAAoC;IACpC,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU;IACV,MAAM,EAAE,MAAM,CAAC;IACf,uDAAuD;IACvD,OAAO,EAAE,OAAO,CAAC;IACjB,+DAA+D;IAC/D,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,6CAA6C;IAC7C,SAAS,EAAE,MAAM,CAAC;CACnB;AAsBD,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,UAAU,CAAsC;IACxD,OAAO,CAAC,WAAW,CAAoC;IACvD,OAAO,CAAC,SAAS,CAAwC;IACzD,OAAO,CAAC,UAAU,CAAyB;IAC3C,OAAO,CAAC,WAAW,CAAK;IACxB,OAAO,CAAC,QAAQ,CAAC,CAAW;gBAEhB,QAAQ,CAAC,EAAE,QAAQ;IAM/B;;;OAGG;IACG,QAAQ,CACZ,WAAW,EAAE,WAAW,EACxB,YAAY,EAAE,MAAM,EACpB,UAAU,EAAE,MAAM,EAClB,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,gBAAgB,EACxB,OAAO,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,eAAe,CAAC;IAoB3B;;OAEG;IACH,WAAW,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO;IAI1C;;OAEG;IACH,eAAe,CAAC,YAAY,EAAE,MAAM,GAAG,eAAe,GAAG,SAAS;IAIlE;;OAEG;IACG,qBAAqB,CACzB,WAAW,EAAE,WAAW,EACxB,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,oBAAoB,CAAC;IAmBhC;;OAEG;IACG,oBAAoB,CAAC,IAAI,EAAE,oBAAoB,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAanG;;OAEG;IACH,oBAAoB,CAAC,IAAI,EAAE,oBAAoB,GAAG,MAAM;IAaxD;;OAEG;IACG,SAAS,CACb,WAAW,EAAE,WAAW,EACxB,YAAY,EAAE,MAAM,EACpB,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,gBAAgB,EACxB,OAAO,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,aAAa,CAAC;IA8BzB;;OAEG;IACH,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAIlC;;OAEG;IACG,mBAAmB,CAAC,UAAU,EAAE,aAAa,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAejG;;;OAGG;IACG,SAAS,CACb,cAAc,EAAE,WAAW,EAC3B,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EACd,cAAc,EAAE,WAAW,EAC3B,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,iBAAiB,CAAC;IAwC7B;;OAEG;IACG,iBAAiB,CAAC,MAAM,EAAE,iBAAiB,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAwB/F;;OAEG;IACH,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM;IAatC;;;;;;;;;OASG;IACG,UAAU,CACd,WAAW,EAAE,WAAW,EACxB,cAAc,EAAE,MAAM,EACtB,YAAY,EAAE,MAAM,EACpB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,OAAO,GAAE;QACP,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;KACtB,GACL,OAAO,CAAC,eAAe,CAAC;IA+D3B;;OAEG;IACG,gBAAgB,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAa3F;;OAEG;IACH,aAAa,IAAI,eAAe,EAAE;IAMlC;;;;;OAKG;IACH,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,GAAG;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE;IAgBpF;;OAEG;IACH,QAAQ,IAAI;QACV,UAAU,EAAE,MAAM,CAAC;QACnB,WAAW,EAAE,MAAM,CAAC;QACpB,SAAS,EAAE,MAAM,CAAC;QAClB,UAAU,EAAE,MAAM,CAAC;KACpB;CAQF"}

package/dist/index.js

@@ -0,0 +1,371 @@
+/**
+ * @sentinel-atl/revocation — DID & VC Revocation, Key Rotation, Kill Switch
+ *
+ * When things go wrong — compromised keys, rogue agents, policy violations —
+ * you need to revoke trust FAST. This module provides:
+ *
+ * 1. **VC Revocation List (VRL):** Signed list of revoked credential IDs.
+ *    Any verifier checks the VRL before trusting a VC.
+ *
+ * 2. **DID Revocation:** Mark an entire agent identity as revoked.
+ *    All VCs issued by or to that DID become untrusted.
+ *
+ * 3. **Key Rotation:** Generate a new keypair and publish a signed rotation
+ *    notice linking old DID → new DID. Verifiers follow the chain.
+ *
+ * 4. **Emergency Kill Switch:** Immediately revoke an agent + all downstream
+ *    delegations. Logged to audit with highest priority.
+ *
+ * All revocation decisions are signed by the revoker to prevent spoofing,
+ * and every action is audit-logged.
+ */
+import { toBase64Url, fromBase64Url, textToBytes, verify, didToPublicKey, } from '@sentinel-atl/core';
+// ─── Canonicalization ────────────────────────────────────────────────
+function sortDeep(value) {
+    if (Array.isArray(value))
+        return value.map(sortDeep);
+    if (value !== null && typeof value === 'object') {
+        const sorted = {};
+        for (const key of Object.keys(value).sort()) {
+            sorted[key] = sortDeep(value[key]);
+        }
+        return sorted;
+    }
+    return value;
+}
+function canonicalize(obj) {
+    return textToBytes(JSON.stringify(sortDeep(obj)));
+}
+// ─── Revocation Manager ─────────────────────────────────────────────
+export class RevocationManager {
+    revokedVCs = new Map();
+    revokedDIDs = new Map();
+    rotations = new Map();
+    killEvents = [];
+    listVersion = 0;
+    auditLog;
+    constructor(auditLog) {
+        this.auditLog = auditLog;
+    }
+    // ─── VC Revocation ───────────────────────────────────────────────
+    /**
+     * Revoke a Verifiable Credential.
+     * The revoker signs the revocation entry to prevent spoofing.
+     */
+    async revokeVC(keyProvider, revokerKeyId, revokerDid, credentialId, reason, details) {
+        const entry = {
+            credentialId,
+            revokedAt: new Date().toISOString(),
+            reason,
+            details,
+        };
+        this.revokedVCs.set(credentialId, entry);
+        await this.auditLog?.log({
+            eventType: 'vc_revoked',
+            actorDid: revokerDid,
+            result: 'success',
+            metadata: { credentialId, reason },
+        });
+        return entry;
+    }
+    /**
+     * Check if a VC is revoked.
+     */
+    isVCRevoked(credentialId) {
+        return this.revokedVCs.has(credentialId);
+    }
+    /**
+     * Get the revocation entry for a VC (if revoked).
+     */
+    getVCRevocation(credentialId) {
+        return this.revokedVCs.get(credentialId);
+    }
+    /**
+     * Publish a signed revocation list.
+     */
+    async publishRevocationList(keyProvider, issuerKeyId, issuerDid) {
+        this.listVersion++;
+        const listBody = {
+            version: this.listVersion,
+            issuerDid,
+            publishedAt: new Date().toISOString(),
+            entries: Array.from(this.revokedVCs.values()),
+        };
+        const dataToSign = canonicalize(listBody);
+        const sig = await keyProvider.sign(issuerKeyId, dataToSign);
+        return {
+            ...listBody,
+            signature: toBase64Url(sig),
+        };
+    }
+    /**
+     * Verify a signed revocation list.
+     */
+    async verifyRevocationList(list) {
+        try {
+            const publicKey = didToPublicKey(list.issuerDid);
+            const { signature, ...body } = list;
+            const dataToVerify = canonicalize(body);
+            const sig = fromBase64Url(signature);
+            const valid = await verify(sig, dataToVerify, publicKey);
+            return valid ? { valid: true } : { valid: false, error: 'Invalid signature on revocation list' };
+        }
+        catch (e) {
+            return { valid: false, error: `Verification failed: ${e.message}` };
+        }
+    }
+    /**
+     * Import a verified revocation list (merge entries).
+     */
+    importRevocationList(list) {
+        let imported = 0;
+        for (const entry of list.entries) {
+            if (!this.revokedVCs.has(entry.credentialId)) {
+                this.revokedVCs.set(entry.credentialId, entry);
+                imported++;
+            }
+        }
+        return imported;
+    }
+    // ─── DID Revocation ──────────────────────────────────────────────
+    /**
+     * Revoke a DID. Signs the revocation with the revoker's key.
+     */
+    async revokeDID(keyProvider, revokerKeyId, revokerDid, targetDid, reason, details) {
+        const body = {
+            did: targetDid,
+            revokedBy: revokerDid,
+            revokedAt: new Date().toISOString(),
+            reason,
+            details,
+        };
+        const dataToSign = canonicalize(body);
+        const sig = await keyProvider.sign(revokerKeyId, dataToSign);
+        const revocation = {
+            ...body,
+            signature: toBase64Url(sig),
+        };
+        this.revokedDIDs.set(targetDid, revocation);
+        await this.auditLog?.log({
+            eventType: 'emergency_revoke',
+            actorDid: revokerDid,
+            targetDid,
+            result: 'success',
+            metadata: { reason, type: 'did_revocation' },
+        });
+        return revocation;
+    }
+    /**
+     * Check if a DID is revoked.
+     */
+    isDIDRevoked(did) {
+        return this.revokedDIDs.has(did);
+    }
+    /**
+     * Verify a DID revocation notice.
+     */
+    async verifyDIDRevocation(revocation) {
+        try {
+            const publicKey = didToPublicKey(revocation.revokedBy);
+            const { signature, ...body } = revocation;
+            const dataToVerify = canonicalize(body);
+            const sig = fromBase64Url(signature);
+            const valid = await verify(sig, dataToVerify, publicKey);
+            return valid ? { valid: true } : { valid: false, error: 'Invalid signature on DID revocation' };
+        }
+        catch (e) {
+            return { valid: false, error: `Verification failed: ${e.message}` };
+        }
+    }
+    // ─── Key Rotation ────────────────────────────────────────────────
+    /**
+     * Rotate an agent's key. Both old and new keys sign the rotation notice.
+     * This proves: "I own the old key AND the new key, and I'm switching."
+     */
+    async rotateKey(oldKeyProvider, oldKeyId, oldDid, newKeyProvider, newKeyId, newDid) {
+        const rotatedAt = new Date().toISOString();
+        const rotationData = textToBytes(`key-rotation:${oldDid}:${newDid}:${rotatedAt}`);
+        const oldSig = await oldKeyProvider.sign(oldKeyId, rotationData);
+        const newSig = await newKeyProvider.sign(newKeyId, rotationData);
+        const notice = {
+            oldDid,
+            newDid,
+            rotatedAt,
+            oldKeySignature: toBase64Url(oldSig),
+            newKeySignature: toBase64Url(newSig),
+        };
+        this.rotations.set(oldDid, notice);
+        // Also revoke the old DID
+        this.revokedDIDs.set(oldDid, {
+            did: oldDid,
+            revokedBy: oldDid,
+            revokedAt: notice.rotatedAt,
+            reason: 'key_rotation',
+            details: `Rotated to ${newDid}`,
+            signature: notice.oldKeySignature,
+        });
+        await this.auditLog?.log({
+            eventType: 'key_rotated',
+            actorDid: oldDid,
+            targetDid: newDid,
+            result: 'success',
+            metadata: { type: 'key_rotation' },
+        });
+        return notice;
+    }
+    /**
+     * Verify a key rotation notice (both signatures must be valid).
+     */
+    async verifyKeyRotation(notice) {
+        try {
+            const rotationData = textToBytes(`key-rotation:${notice.oldDid}:${notice.newDid}:${notice.rotatedAt}`);
+            const oldPubKey = didToPublicKey(notice.oldDid);
+            const newPubKey = didToPublicKey(notice.newDid);
+            const oldSig = fromBase64Url(notice.oldKeySignature);
+            const newSig = fromBase64Url(notice.newKeySignature);
+            const oldValid = await verify(oldSig, rotationData, oldPubKey);
+            if (!oldValid)
+                return { valid: false, error: 'Old key signature invalid' };
+            const newValid = await verify(newSig, rotationData, newPubKey);
+            if (!newValid)
+                return { valid: false, error: 'New key signature invalid' };
+            return { valid: true };
+        }
+        catch (e) {
+            return { valid: false, error: `Verification failed: ${e.message}` };
+        }
+    }
+    /**
+     * Resolve the current DID for an agent (follows rotation chain).
+     */
+    resolveCurrentDid(did) {
+        let current = did;
+        const seen = new Set();
+        while (this.rotations.has(current)) {
+            if (seen.has(current))
+                break; // Prevent cycles
+            seen.add(current);
+            current = this.rotations.get(current).newDid;
+        }
+        return current;
+    }
+    // ─── Kill Switch ─────────────────────────────────────────────────
+    /**
+     * Emergency kill switch — immediately revoke an agent and optionally
+     * cascade to all downstream delegations.
+     *
+     * This is the "big red button." Use when an agent is:
+     * - Compromised
+     * - Producing harmful output
+     * - Violating scope
+     * - Otherwise untrustworthy
+     */
+    async killSwitch(keyProvider, activatorKeyId, activatorDid, targetDid, reason, options = {}) {
+        const cascade = options.cascade ?? false;
+        const cascadedDids = options.downstreamDids ?? [];
+        const body = {
+            targetDid,
+            activatedBy: activatorDid,
+            activatedAt: new Date().toISOString(),
+            reason,
+            cascade,
+            cascadedDids,
+        };
+        const dataToSign = canonicalize(body);
+        const sig = await keyProvider.sign(activatorKeyId, dataToSign);
+        const event = {
+            ...body,
+            signature: toBase64Url(sig),
+        };
+        this.killEvents.push(event);
+        // Revoke the target DID
+        this.revokedDIDs.set(targetDid, {
+            did: targetDid,
+            revokedBy: activatorDid,
+            revokedAt: event.activatedAt,
+            reason: 'emergency',
+            details: reason,
+            signature: event.signature,
+        });
+        // Cascade if requested
+        if (cascade) {
+            for (const downstream of cascadedDids) {
+                this.revokedDIDs.set(downstream, {
+                    did: downstream,
+                    revokedBy: activatorDid,
+                    revokedAt: event.activatedAt,
+                    reason: 'emergency',
+                    details: `Cascaded from kill switch on ${targetDid}: ${reason}`,
+                    signature: event.signature,
+                });
+            }
+        }
+        await this.auditLog?.log({
+            eventType: 'emergency_revoke',
+            actorDid: activatorDid,
+            targetDid,
+            result: 'success',
+            metadata: {
+                type: 'kill_switch',
+                reason,
+                cascade,
+                cascadedCount: cascadedDids.length,
+            },
+        });
+        return event;
+    }
+    /**
+     * Verify a kill switch event signature.
+     */
+    async verifyKillSwitch(event) {
+        try {
+            const publicKey = didToPublicKey(event.activatedBy);
+            const { signature, ...body } = event;
+            const dataToVerify = canonicalize(body);
+            const sig = fromBase64Url(signature);
+            const valid = await verify(sig, dataToVerify, publicKey);
+            return valid ? { valid: true } : { valid: false, error: 'Invalid kill switch signature' };
+        }
+        catch (e) {
+            return { valid: false, error: `Verification failed: ${e.message}` };
+        }
+    }
+    /**
+     * Get all kill switch events.
+     */
+    getKillEvents() {
+        return [...this.killEvents];
+    }
+    // ─── Comprehensive Trust Check ───────────────────────────────────
+    /**
+     * Full trust check: is this DID + credential ID currently trusted?
+     *
+     * Returns false if the DID is revoked, the VC is revoked,
+     * or the agent has been killed.
+     */
+    isTrusted(did, credentialId) {
+        // Check DID revocation
+        if (this.revokedDIDs.has(did)) {
+            const rev = this.revokedDIDs.get(did);
+            return { trusted: false, reason: `DID revoked: ${rev.reason}` };
+        }
+        // Check VC revocation
+        if (credentialId && this.revokedVCs.has(credentialId)) {
+            const rev = this.revokedVCs.get(credentialId);
+            return { trusted: false, reason: `VC revoked: ${rev.reason}` };
+        }
+        return { trusted: true };
+    }
+    /**
+     * Get summary stats.
+     */
+    getStats() {
+        return {
+            revokedVCs: this.revokedVCs.size,
+            revokedDIDs: this.revokedDIDs.size,
+            rotations: this.rotations.size,
+            killEvents: this.killEvents.length,
+        };
+    }
+}
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAEL,WAAW,EACX,aAAa,EACb,WAAW,EAGX,MAAM,EAEN,cAAc,GAEf,MAAM,oBAAoB,CAAC;AAyF5B,wEAAwE;AAExE,SAAS,QAAQ,CAAC,KAAc;IAC9B,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACrD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,MAAM,MAAM,GAA4B,EAAE,CAAC;QAC3C,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,KAAgC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;YACvE,MAAM,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAE,KAAiC,CAAC,GAAG,CAAC,CAAC,CAAC;QAClE,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,YAAY,CAAC,GAA4B;IAChD,OAAO,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AACpD,CAAC;AAED,uEAAuE;AAEvE,MAAM,OAAO,iBAAiB;IACpB,UAAU,GAAG,IAAI,GAAG,EAA2B,CAAC;IAChD,WAAW,GAAG,IAAI,GAAG,EAAyB,CAAC;IAC/C,SAAS,GAAG,IAAI,GAAG,EAA6B,CAAC;IACjD,UAAU,GAAsB,EAAE,CAAC;IACnC,WAAW,GAAG,CAAC,CAAC;IAChB,QAAQ,CAAY;IAE5B,YAAY,QAAmB;QAC7B,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC3B,CAAC;IAED,oEAAoE;IAEpE;;;OAGG;IACH,KAAK,CAAC,QAAQ,CACZ,WAAwB,EACxB,YAAoB,EACpB,UAAkB,EAClB,YAAoB,EACpB,MAAwB,EACxB,OAAgB;QAEhB,MAAM,KAAK,GAAoB;YAC7B,YAAY;YACZ,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,MAAM;YACN,OAAO;SACR,CAAC;QAEF,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;QAEzC,MAAM,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC;YACvB,SAAS,EAAE,YAAY;YACvB,QAAQ,EAAE,UAAU;YACpB,MAAM,EAAE,SAAS;YACjB,QAAQ,EAAE,EAAE,YAAY,EAAE,MAAM,EAAE;SACnC,CAAC,CAAC;QAEH,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;OAEG;IACH,WAAW,CAAC,YAAoB;QAC9B,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IAC3C,CAAC;IAED;;OAEG;IACH,eAAe,CAAC,YAAoB;QAClC,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IAC3C,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,qBAAqB,CACzB,WAAwB,EACxB,WAAmB,EACnB,SAAiB;QAEjB,IAAI,CAAC,WAAW,EAAE,CAAC;QAEnB,MAAM,QAAQ,GAAG;YACf,OAAO,EAAE,IAAI,CAAC,WAAW;YACzB,SAAS;YACT,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACrC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC;SAC9C,CAAC;QAEF,MAAM,UAAU,GAAG,YAAY,CAAC,QAA8C,CAAC,CAAC;QAChF,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;QAE5D,OAAO;YACL,GAAG,QAAQ;YACX,SAAS,EAAE,WAAW,CAAC,GAAG,CAAC;SAC5B,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,oBAAoB,CAAC,IAA0B;QACnD,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,cAAc,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACjD,MAAM,EAAE,SAAS,EAAE,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC;YACpC,MAAM,YAAY,GAAG,YAAY,CAAC,IAA0C,CAAC,CAAC;YAC9E,MAAM,GAAG,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC;YACrC,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,GAAG,EAAE,YAAY,EAAE,SAAS,CAAC,CAAC;YACzD,OAAO,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,sCAAsC,EAAE,CAAC;QACnG,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,wBAAyB,CAAW,CAAC,OAAO,EAAE,EAAE,CAAC;QACjF,CAAC;IACH,CAAC;IAED;;OAEG;IACH,oBAAoB,CAAC,IAA0B;QAC7C,IAAI,QAAQ,GAAG,CAAC,CAAC;QACjB,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC;gBAC7C,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;gBAC/C,QAAQ,EAAE,CAAC;YACb,CAAC;QACH,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,oEAAoE;IAEpE;;OAEG;IACH,KAAK,CAAC,SAAS,CACb,WAAwB,EACxB,YAAoB,EACpB,UAAkB,EAClB,SAAiB,EACjB,MAAwB,EACxB,OAAgB;QAEhB,MAAM,IAAI,GAAG;YACX,GAAG,EAAE,SAAS;YACd,SAAS,EAAE,UAAU;YACrB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,MAAM;YACN,OAAO;SACR,CAAC;QAEF,MAAM,UAAU,GAAG,YAAY,CAAC,IAA0C,CAAC,CAAC;QAC5E,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;QAE7D,MAAM,UAAU,GAAkB;YAChC,GAAG,IAAI;YACP,SAAS,EAAE,WAAW,CAAC,GAAG,CAAC;SAC5B,CAAC;QAEF,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;QAE5C,MAAM,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC;YACvB,SAAS,EAAE,kBAAkB;YAC7B,QAAQ,EAAE,UAAU;YACpB,SAAS;YACT,MAAM,EAAE,SAAS;YACjB,QAAQ,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,gBAAgB,EAAE;SAC7C,CAAC,CAAC;QAEH,OAAO,UAAU,CAAC;IACpB,CAAC;IAED;;OAEG;IACH,YAAY,CAAC,GAAW;QACtB,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACnC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,mBAAmB,CAAC,UAAyB;QACjD,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,cAAc,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;YACvD,MAAM,EAAE,SAAS,EAAE,GAAG,IAAI,EAAE,GAAG,UAAU,CAAC;YAC1C,MAAM,YAAY,GAAG,YAAY,CAAC,IAA0C,CAAC,CAAC;YAC9E,MAAM,GAAG,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC;YACrC,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,GAAG,EAAE,YAAY,EAAE,SAAS,CAAC,CAAC;YACzD,OAAO,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,qCAAqC,EAAE,CAAC;QAClG,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,wBAAyB,CAAW,CAAC,OAAO,EAAE,EAAE,CAAC;QACjF,CAAC;IACH,CAAC;IAED,oEAAoE;IAEpE;;;OAGG;IACH,KAAK,CAAC,SAAS,CACb,cAA2B,EAC3B,QAAgB,EAChB,MAAc,EACd,cAA2B,EAC3B,QAAgB,EAChB,MAAc;QAEd,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC3C,MAAM,YAAY,GAAG,WAAW,CAC9B,gBAAgB,MAAM,IAAI,MAAM,IAAI,SAAS,EAAE,CAChD,CAAC;QAEF,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;QACjE,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;QAEjE,MAAM,MAAM,GAAsB;YAChC,MAAM;YACN,MAAM;YACN,SAAS;YACT,eAAe,EAAE,WAAW,CAAC,MAAM,CAAC;YACpC,eAAe,EAAE,WAAW,CAAC,MAAM,CAAC;SACrC,CAAC;QAEF,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAEnC,0BAA0B;QAC1B,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,EAAE;YAC3B,GAAG,EAAE,MAAM;YACX,SAAS,EAAE,MAAM;YACjB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,MAAM,EAAE,cAAc;YACtB,OAAO,EAAE,cAAc,MAAM,EAAE;YAC/B,SAAS,EAAE,MAAM,CAAC,eAAe;SAClC,CAAC,CAAC;QAEH,MAAM,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC;YACvB,SAAS,EAAE,aAAa;YACxB,QAAQ,EAAE,MAAM;YAChB,SAAS,EAAE,MAAM;YACjB,MAAM,EAAE,SAAS;YACjB,QAAQ,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE;SACnC,CAAC,CAAC;QAEH,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,iBAAiB,CAAC,MAAyB;QAC/C,IAAI,CAAC;YACH,MAAM,YAAY,GAAG,WAAW,CAC9B,gBAAgB,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,SAAS,EAAE,CACrE,CAAC;YAEF,MAAM,SAAS,GAAG,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAChD,MAAM,SAAS,GAAG,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAEhD,MAAM,MAAM,GAAG,aAAa,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;YACrD,MAAM,MAAM,GAAG,aAAa,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;YAErD,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,MAAM,EAAE,YAAY,EAAE,SAAS,CAAC,CAAC;YAC/D,IAAI,CAAC,QAAQ;gBAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,2BAA2B,EAAE,CAAC;YAE3E,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,MAAM,EAAE,YAAY,EAAE,SAAS,CAAC,CAAC;YAC/D,IAAI,CAAC,QAAQ;gBAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,2BAA2B,EAAE,CAAC;YAE3E,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QACzB,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,wBAAyB,CAAW,CAAC,OAAO,EAAE,EAAE,CAAC;QACjF,CAAC;IACH,CAAC;IAED;;OAEG;IACH,iBAAiB,CAAC,GAAW;QAC3B,IAAI,OAAO,GAAG,GAAG,CAAC;QAClB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YACnC,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC;gBAAE,MAAM,CAAC,iBAAiB;YAC/C,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAClB,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAE,CAAC,MAAM,CAAC;QAChD,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,oEAAoE;IAEpE;;;;;;;;;OASG;IACH,KAAK,CAAC,UAAU,CACd,WAAwB,EACxB,cAAsB,EACtB,YAAoB,EACpB,SAAiB,EACjB,MAAc,EACd,UAGI,EAAE;QAEN,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,KAAK,CAAC;QACzC,MAAM,YAAY,GAAG,OAAO,CAAC,cAAc,IAAI,EAAE,CAAC;QAElD,MAAM,IAAI,GAAG;YACX,SAAS;YACT,WAAW,EAAE,YAAY;YACzB,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACrC,MAAM;YACN,OAAO;YACP,YAAY;SACb,CAAC;QAEF,MAAM,UAAU,GAAG,YAAY,CAAC,IAA0C,CAAC,CAAC;QAC5E,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC;QAE/D,MAAM,KAAK,GAAoB;YAC7B,GAAG,IAAI;YACP,SAAS,EAAE,WAAW,CAAC,GAAG,CAAC;SAC5B,CAAC;QAEF,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAE5B,wBAAwB;QACxB,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,SAAS,EAAE;YAC9B,GAAG,EAAE,SAAS;YACd,SAAS,EAAE,YAAY;YACvB,SAAS,EAAE,KAAK,CAAC,WAAW;YAC5B,MAAM,EAAE,WAAW;YACnB,OAAO,EAAE,MAAM;YACf,SAAS,EAAE,KAAK,CAAC,SAAS;SAC3B,CAAC,CAAC;QAEH,uBAAuB;QACvB,IAAI,OAAO,EAAE,CAAC;YACZ,KAAK,MAAM,UAAU,IAAI,YAAY,EAAE,CAAC;gBACtC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,UAAU,EAAE;oBAC/B,GAAG,EAAE,UAAU;oBACf,SAAS,EAAE,YAAY;oBACvB,SAAS,EAAE,KAAK,CAAC,WAAW;oBAC5B,MAAM,EAAE,WAAW;oBACnB,OAAO,EAAE,gCAAgC,SAAS,KAAK,MAAM,EAAE;oBAC/D,SAAS,EAAE,KAAK,CAAC,SAAS;iBAC3B,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,MAAM,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC;YACvB,SAAS,EAAE,kBAAkB;YAC7B,QAAQ,EAAE,YAAY;YACtB,SAAS;YACT,MAAM,EAAE,SAAS;YACjB,QAAQ,EAAE;gBACR,IAAI,EAAE,aAAa;gBACnB,MAAM;gBACN,OAAO;gBACP,aAAa,EAAE,YAAY,CAAC,MAAM;aACnC;SACF,CAAC,CAAC;QAEH,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,gBAAgB,CAAC,KAAsB;QAC3C,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,cAAc,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;YACpD,MAAM,EAAE,SAAS,EAAE,GAAG,IAAI,EAAE,GAAG,KAAK,CAAC;YACrC,MAAM,YAAY,GAAG,YAAY,CAAC,IAA0C,CAAC,CAAC;YAC9E,MAAM,GAAG,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC;YACrC,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,GAAG,EAAE,YAAY,EAAE,SAAS,CAAC,CAAC;YACzD,OAAO,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,+BAA+B,EAAE,CAAC;QAC5F,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,wBAAyB,CAAW,CAAC,OAAO,EAAE,EAAE,CAAC;QACjF,CAAC;IACH,CAAC;IAED;;OAEG;IACH,aAAa;QACX,OAAO,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC;IAC9B,CAAC;IAED,oEAAoE;IAEpE;;;;;OAKG;IACH,SAAS,CAAC,GAAW,EAAE,YAAqB;QAC1C,uBAAuB;QACvB,IAAI,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAE,CAAC;YACvC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC;QAClE,CAAC;QAED,sBAAsB;QACtB,IAAI,YAAY,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;YACtD,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,YAAY,CAAE,CAAC;YAC/C,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC;QACjE,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED;;OAEG;IACH,QAAQ;QAMN,OAAO;YACL,UAAU,EAAE,IAAI,CAAC,UAAU,CAAC,IAAI;YAChC,WAAW,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI;YAClC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI;YAC9B,UAAU,EAAE,IAAI,CAAC,UAAU,CAAC,MAAM;SACnC,CAAC;IACJ,CAAC;CACF"}

package/package.json

@@ -0,0 +1,52 @@
+{
+  "name": "@sentinel-atl/revocation",
+  "version": "0.1.1",
+  "description": "DID and VC revocation, key rotation, and emergency kill switch for the Agent Trust Layer",
+  "type": "module",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "scripts": {
+    "build": "tsc",
+    "test": "vitest run",
+    "lint": "tsc --noEmit",
+    "clean": "rm -rf dist"
+  },
+  "dependencies": {
+    "@sentinel-atl/core": "*",
+    "@sentinel-atl/audit": "*"
+  },
+  "devDependencies": {
+    "typescript": "^5.7.0",
+    "vitest": "^3.0.0",
+    "@types/node": "^20.0.0"
+  },
+  "license": "Apache-2.0",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/sentinel-atl/project-sentinel.git",
+    "directory": "packages/revocation"
+  },
+  "keywords": [
+    "ai-agent",
+    "trust",
+    "identity",
+    "did",
+    "verifiable-credentials",
+    "mcp",
+    "security"
+  ],
+  "homepage": "https://github.com/sentinel-atl/project-sentinel#readme",
+  "bugs": {
+    "url": "https://github.com/sentinel-atl/project-sentinel/issues"
+  },
+  "files": [
+    "dist",
+    "README.md"
+  ]
+}