AMP Key Revocation List (lib/amp-revocation.ts)

Maintains an AMP public-key fingerprint revocation list to reject compromised or rotated agent keys.

// Source: https://github.com/23blocks-OS/ai-maestro | License: MIT | Copyright 2025 Juan Peláez / 23blocks
// Provided via justclaw.it.com; keep this notice with the code.
/**
 * AMP key revocation list (AMP spec 07-security §Key Revocation).
 *
 * Providers MUST maintain a revocation list of public-key fingerprints and MUST
 * reject messages signed with a revoked key (`key_revoked`, HTTP 403). A key is
 * revoked when it is rotated (superseded) or explicitly revoked on compromise.
 * Entries are retained for at least 90 days. Together with rotation-with-proof
 * (rotateKeypair) this makes a compromised key actually killable — the missing
 * half of the rotation story.
 */
import fs from 'node:fs'
import os from 'node:os'
import path from 'node:path'

export type RevocationReason = 'key_

... (truncated -- full source via MCP)