Add command to check rotation key validity

[Copilot]

Adds fair-tools did rotation-key check to verify if a rotation key is valid for DID operations. Valid rotation keys exist in the latest operation of the DID log, not the DID document.

Changes

• getRotationPublicKeyDidKey() in keys.ts: Parses rotation keys from multiple formats (did:key, multibase, PEM, hex) and returns normalized did:key format
• checkRotationKey() in verify.ts: Fetches DID operation log and validates key against latest operation's rotationKeys array
• CLI command did-rotation-key-check.ts: Exposes check functionality with --key and --key-file options, matching verification-key-check interface
• Shared constants: Exported key format constants from did-validation.ts to eliminate duplication

Usage

# Check with public key
fair-tools did rotation-key check --did did:plc:xxx --key did:key:zQ3sh...

# Check with private key file (any format)
fair-tools did rotation-key check --did did:plc:xxx --key-file ./rotation-key.pem

Exit codes: 0 (valid), 1 (invalid), 2 (error)

Accepted formats match #42: did:key, multibase, PEM, hex.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• plc.directory
  • Triggering command: /usr/local/bin/node node dist/src/cli/fair-tools.js did rotation-key check --did did:plc:q2afge25l63iz553aumeqi3w --key did:key:zQ3shZc2QzJE5VLjPRhMgwg7JXjHKhqLmUxGPGBbhq3yuU3oR (dns block)
  • Triggering command: /usr/local/bin/node node dist/src/cli/fair-tools.js did rotation-key check --did did:plc:q2afge25l63iz553aumeqi3w --key zQ3shZc2QzJE5VLjPRhMgwg7JXjHKhqLmUxGPGBbhq3yuU3oR (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

Original prompt

---

This section details on the original issue you should resolve

<issue_title>Add command to check validity of a rotation key</issue_title>
<issue_description>Given a rotation key or keypair, FAIR Tools should provide a command that verifies whether it's currently valid to use as a rotation key.

Valid rotation keys are present in the latest operation in the DID log, not in the DID document.

Accepted key formats should match #42.</issue_description>

<agent_instructions>Implement this issue. Use PR 42 as a model for how to do the implementation. Minimise new code by thoroughly checking for existing functions in the repo and checking for what the project dependencies provide. Ensure test coverage.</agent_instructions>

Comments on the Issue (you are @copilot in this section)

• Fixes Add command to check validity of a rotation key #41

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.