@corelayer-ai/cli 0.5.1 → 0.5.2

package/README.md

@@ -0,0 +1,17 @@
+# CLI credential security
+
+Browser login requires a user session and issues a key valid for 24 hours. API keys cannot authorize another CLI login. Sign in again when the key expires.
+
+User-owned API keys require a current organization membership on every authentication. Their effective role cannot exceed either the key's stored role or the owner's current role. Removing a user blocks their keys once the membership change reaches Corelayer; demoting an admin immediately limits their keys after synchronization. This also applies to user-owned automation keys. Keys with no user owner retain their existing service-key behavior and require explicit revocation/expiry management.
+
+`corelayer logout` revokes the credential saved in `~/.corelayer/config.json` at its saved API URL before clearing the file. A failed revocation leaves the credential available for retry. `corelayer logout --local-only` explicitly removes the local copy without revoking the remote credential, for offline cleanup or an already expired/revoked key. A key in `CORELAYER_API_KEY` is not revoked by logout; unset that variable to stop using it and revoke it through key management when needed. Revoking a shared saved API key also affects other consumers of that same key.
+
+`corelayer config get` and its JSON output omit the token. Preflight invokes Git without a shell, resolves refs to commit IDs, and disables external diff/text-conversion helpers.
+
+## Deploying the fix
+
+Deploy the platform database service and API server changes before distributing the updated CLI: logout requires the new `cli-auth.logout` operation and `/api/v1/cli/logout` endpoint. No schema migration is required.
+
+Existing CLI keys do not retroactively acquire the new 24-hour expiry. Revoke those old keys through key management and have users log in again. Live membership/role enforcement applies to existing user-owned keys once the server change is deployed. For incident response, explicitly revoke affected keys rather than relying only on local logout or identity-provider synchronization.
+
+These changes address the audited defects. They do not introduce OAuth PKCE, granular read-only/resource scopes, OS-keychain storage, npm provenance, or enterprise SSO-policy configuration; those remain separate enterprise-readiness work.

package/dist/commands/anomalies.js

@@ -0,0 +1,76 @@
+import { CorelayerClient } from "../lib/api-client.js";
+import { readFlag } from "../lib/args.js";
+import { readConfig, resolveApiUrl, resolveToken } from "../lib/config.js";
+import { fail, printJson, printTable } from "../lib/output.js";
+function printHelp() {
+    process.stdout
+        .write(`corelayer anomalies - Inspect configured anomaly monitors
+
+USAGE:
+  corelayer anomalies <subcommand> [options]
+
+SUBCOMMANDS:
+  list                  List anomaly monitors for a group
+  get <configId>        Get one anomaly monitor
+
+OPTIONS:
+  --group <id>          Group ID (or set default-group via 'corelayer config set')
+  --limit <n>           Maximum results (default: 20, max: 100)
+  --offset <n>          Results to skip (default: 0)
+  --json                Output as JSON
+
+EXAMPLES:
+  corelayer anomalies list --group g_123
+  corelayer anomalies list --json
+  corelayer anomalies get 550e8400-e29b-41d4-a716-446655440000
+`);
+}
+export async function runAnomalies(args, ctx) {
+    if (args.includes("--help") || args.includes("-h")) {
+        printHelp();
+        return;
+    }
+    const token = resolveToken();
+    if (!token) {
+        fail("Not authenticated. Set CORELAYER_API_KEY or run: corelayer login");
+    }
+    const client = new CorelayerClient(resolveApiUrl(ctx.apiUrlOverride), token);
+    if (args[0] === "get") {
+        const configId = args[1];
+        if (!configId)
+            fail("Usage: corelayer anomalies get <configId>");
+        const config = await client.anomalies.get(configId);
+        if (ctx.json)
+            return printJson(config);
+        printTable(["ID", "METRIC", "RESOURCE ID", "FREQUENCY", "TIME COLUMN"], [
+            [
+                config.id,
+                config.metric_name || "-",
+                config.resource_id,
+                config.frequency || "-",
+                config.time_column,
+            ],
+        ]);
+        return;
+    }
+    if (args[0] !== "list") {
+        fail("Usage: corelayer anomalies <list|get> [options]");
+    }
+    const groupId = readFlag(args, "--group") || readConfig().defaults?.group;
+    if (!groupId) {
+        fail("Group ID required. Use --group <id> or: corelayer config set default-group <id>");
+    }
+    const limit = Math.min(Math.max(Number.parseInt(readFlag(args, "--limit") || "20", 10) || 20, 1), 100);
+    const offset = Math.max(Number.parseInt(readFlag(args, "--offset") || "0", 10) || 0, 0);
+    const result = await client.anomalies.listOffset(groupId, limit, offset);
+    if (ctx.json)
+        return printJson(result);
+    printTable(["ID", "METRIC", "RESOURCE ID", "FREQUENCY", "PARTITIONS"], result.configs.map((config) => [
+        config.id,
+        config.metric_name || "-",
+        config.resource_id,
+        config.frequency || "-",
+        config.partition_columns.join(", ") || "-",
+    ]));
+    process.stdout.write(`Showing ${result.configs.length} of ${result.total} anomaly monitors\n`);
+}

package/dist/commands/api-keys.js

@@ -1,12 +1,7 @@
 import { CorelayerClient } from "../lib/api-client.js";
+import { readFlag } from "../lib/args.js";
 import { resolveApiUrl, resolveToken } from "../lib/config.js";
 import { fail, printJson } from "../lib/output.js";
-function readFlag(args, flag) {
-    const index = args.indexOf(flag);
-    if (index === -1)
-        return undefined;
-    return args[index + 1];
-}
 function printHelp() {
     process.stdout.write(`corelayer api-keys - Manage Corelayer API keys
 

package/dist/commands/config.js

@@ -34,11 +34,12 @@ export async function runConfig(args, ctx) {
         const key = args[1];
         const config = readConfig();
         if (!key) {
+            const { token: _token, ...publicConfig } = config;
             if (ctx.json) {
-                printJson(config);
+                printJson(publicConfig);
             }
             else {
-                process.stdout.write(`${JSON.stringify(config, null, 2)}\n`);
+                process.stdout.write(`${JSON.stringify(publicConfig, null, 2)}\n`);
             }
             return;
         }

package/dist/commands/integrations.js

@@ -1,12 +1,7 @@
 import { CorelayerClient } from "../lib/api-client.js";
-import { readConfig, resolveToken, resolveApiUrl } from "../lib/config.js";
+import { readFlag } from "../lib/args.js";
+import { readConfig, resolveApiUrl, resolveToken } from "../lib/config.js";
 import { fail, printJson, printTable } from "../lib/output.js";
-function readFlag(args, flag) {
-    const index = args.indexOf(flag);
-    if (index === -1)
-        return undefined;
-    return args[index + 1];
-}
 function printHelp() {
     process.stdout.write(`corelayer integrations - List integrations for a group
 
@@ -48,7 +43,7 @@ export async function runIntegrations(args, ctx) {
         printJson(result);
         return;
     }
-    const rows = result.accounts.map(account => [
+    const rows = result.accounts.map((account) => [
         account.id,
         account.provider_code,
         String(account.resources?.length || 0),

package/dist/commands/issues.js

@@ -1,14 +1,9 @@
 import { stdin as input, stdout as output } from "node:process";
 import { createInterface } from "node:readline/promises";
 import { CorelayerClient } from "../lib/api-client.js";
+import { readFlag } from "../lib/args.js";
 import { readConfig, resolveApiUrl, resolveToken } from "../lib/config.js";
 import { fail, formatDate, printJson, printTable } from "../lib/output.js";
-function readFlag(args, flag) {
-    const index = args.indexOf(flag);
-    if (index === -1)
-        return undefined;
-    return args[index + 1];
-}
 function hasFlag(args, flag) {
     return args.includes(flag);
 }
@@ -112,208 +107,202 @@ function parseDuration(value) {
         return Math.round(n * 24 * 60 * 60 * 1000);
     return null;
 }
-export async function runIssues(args, ctx) {
-    if (args.includes("--help") || args.includes("-h")) {
-        printHelp();
-        return;
+function resolveGroupId(args, config) {
+    const groupId = readFlag(args, "--group") || config.defaults?.group;
+    if (!groupId) {
+        fail("groupId is required. Use --group <groupId> or set default-group via corelayer config set default-group <groupId>");
     }
-    const sub = args[0];
-    const config = readConfig();
-    const token = resolveToken();
-    if (!token) {
-        fail("Not authenticated. Set CORELAYER_API_KEY or run: corelayer login");
+    return groupId;
+}
+async function runGetIssue(client, commandArgs, ctx) {
+    const issueIdentifier = commandArgs[0];
+    if (!issueIdentifier) {
+        fail("Usage: corelayer issues get <issueId|slug>");
     }
-    const apiUrl = resolveApiUrl(ctx.apiUrlOverride);
-    const client = new CorelayerClient(apiUrl, token);
-    const commandArgs = removeFlags(args.slice(1));
-    if (sub === "list") {
-        const groupId = readFlag(args, "--group") || config.defaults?.group;
-        if (!groupId) {
-            fail("groupId is required. Use --group <groupId> or set default-group via corelayer config set default-group <groupId>");
-        }
-        const result = await client.listIssues(groupId, {
-            status: readFlag(args, "--status"),
-            severity: readFlag(args, "--severity"),
-            limit: readFlag(args, "--limit"),
-            page: readFlag(args, "--page"),
-        });
-        if (ctx.json) {
-            printJson(result);
-            return;
-        }
-        const rows = result.issues.map((issue) => [
-            issue.id,
-            issue.slug || "-",
-            issue.severity || "-",
-            issue.status || "-",
-            issue.title || "-",
-            formatDate(issue.last_seen_at || issue.lastSeenAt),
-        ]);
-        printTable(["ID", "SLUG", "SEVERITY", "STATUS", "TITLE", "LAST SEEN"], rows);
-        if (!ctx.quiet) {
-            process.stdout.write(`Showing ${result.issues.length} of ${result.total} issues\n`);
-        }
+    const issue = await client.getIssue(issueIdentifier);
+    if (ctx.json) {
+        printJson(issue);
         return;
     }
-    if (sub === "get") {
-        const issueIdentifier = commandArgs[0];
-        if (!issueIdentifier) {
-            fail("Usage: corelayer issues get <issueId|slug>");
-        }
-        const issue = await client.getIssue(issueIdentifier);
-        if (ctx.json) {
-            printJson(issue);
-            return;
-        }
-        process.stdout.write(`Issue ${issue.slug || issue.id}: ${issue.title || ""}\n`);
-        process.stdout.write(`Status: ${issue.status || "-"}\n`);
-        process.stdout.write(`Severity: ${issue.severity || "-"}\n`);
-        process.stdout.write(`Created: ${formatDate(issue.createdAt || issue.created_at)}\n`);
-        process.stdout.write(`Last seen: ${formatDate(issue.lastSeenAt || issue.last_seen_at)}\n`);
-        process.stdout.write(`Events: ${issue.event_count || 0}\n`);
-        if (issue.whatHappened) {
-            process.stdout.write(`\nWhat happened:\n${issue.whatHappened}\n`);
-        }
-        if (issue.rootCause) {
-            process.stdout.write(`\nRoot cause:\n${issue.rootCause}\n`);
-        }
-        if (issue.nextSteps) {
-            process.stdout.write(`\nNext steps:\n${issue.nextSteps}\n`);
-        }
+    process.stdout.write(`Issue ${issue.slug || issue.id}: ${issue.title || ""}\n`);
+    process.stdout.write(`Status: ${issue.status || "-"}\n`);
+    process.stdout.write(`Severity: ${issue.severity || "-"}\n`);
+    process.stdout.write(`Created: ${formatDate(issue.createdAt || issue.created_at)}\n`);
+    process.stdout.write(`Last seen: ${formatDate(issue.lastSeenAt || issue.last_seen_at)}\n`);
+    process.stdout.write(`Events: ${issue.event_count || 0}\n`);
+    if (issue.whatHappened) {
+        process.stdout.write(`\nWhat happened:\n${issue.whatHappened}\n`);
+    }
+    if (issue.rootCause) {
+        process.stdout.write(`\nRoot cause:\n${issue.rootCause}\n`);
+    }
+    if (issue.nextSteps) {
+        process.stdout.write(`\nNext steps:\n${issue.nextSteps}\n`);
+    }
+}
+function issueRows(issues) {
+    return issues.map((issue) => [
+        issue.id,
+        issue.slug || "-",
+        issue.severity || "-",
+        issue.status || "-",
+        issue.title || "-",
+        formatDate(issue.last_seen_at || issue.lastSeenAt),
+    ]);
+}
+async function runListIssues({ args, client, config, ctx, }) {
+    const groupId = resolveGroupId(args, config);
+    const result = await client.listIssues(groupId, {
+        status: readFlag(args, "--status"),
+        severity: readFlag(args, "--severity"),
+        limit: readFlag(args, "--limit"),
+        page: readFlag(args, "--page"),
+    });
+    if (ctx.json) {
+        printJson(result);
         return;
     }
-    if (sub === "close") {
-        const issueIdentifier = commandArgs[0];
-        if (!issueIdentifier) {
-            fail('Usage: corelayer issues close <issueId|slug> [--feedback "..."]');
-        }
-        const feedback = readFlag(args, "--feedback");
-        const issue = await client.getIssue(issueIdentifier);
-        if (!issue.id) {
-            fail("Could not resolve issue identifier to an issue ID.");
-        }
-        await client.closeIssue(issue.id, feedback);
-        if (!ctx.quiet) {
-            process.stdout.write(`Issue ${issue.slug || issue.id} closed.\n`);
-        }
+    printTable(["ID", "SLUG", "SEVERITY", "STATUS", "TITLE", "LAST SEEN"], issueRows(result.issues));
+    if (!ctx.quiet) {
+        process.stdout.write(`Showing ${result.issues.length} of ${result.total} issues\n`);
+    }
+}
+async function runCloseIssue({ args, client, commandArgs, ctx, }) {
+    const issueIdentifier = commandArgs[0];
+    if (!issueIdentifier) {
+        fail('Usage: corelayer issues close <issueId|slug> [--feedback "..."]');
+    }
+    const feedback = readFlag(args, "--feedback");
+    const issue = await client.getIssue(issueIdentifier);
+    if (!issue.id) {
+        fail("Could not resolve issue identifier to an issue ID.");
+    }
+    await client.closeIssue(issue.id, feedback);
+    if (!ctx.quiet) {
+        process.stdout.write(`Issue ${issue.slug || issue.id} closed.\n`);
+    }
+}
+async function runBulkCloseIssues({ args, client, config, ctx, }) {
+    const groupId = resolveGroupId(args, config);
+    const lastSeenBefore = readFlag(args, "--last-seen-before");
+    const lastSeenBeforeOrOn = readFlag(args, "--last-seen-before-or-on");
+    if (!lastSeenBefore && !lastSeenBeforeOrOn) {
+        fail('Usage: corelayer issues bulk-close --group <groupId> (--last-seen-before <date|preset> | --last-seen-before-or-on <date|preset>) [--feedback "..."]');
+    }
+    const feedback = readFlag(args, "--feedback");
+    const result = await client.bulkIssueAction({
+        action: "close",
+        groupId,
+        feedback,
+        filters: {
+            status: readFlag(args, "--status") || "Open",
+            severity: readFlag(args, "--severity"),
+            lastSeenBefore,
+            lastSeenBeforeOrOn,
+        },
+    });
+    if (ctx.json) {
+        printJson(result);
         return;
     }
-    if (sub === "bulk-close") {
-        const groupId = readFlag(args, "--group") || config.defaults?.group;
-        if (!groupId) {
-            fail("groupId is required. Use --group <groupId> or set default-group via corelayer config set default-group <groupId>");
-        }
-        const lastSeenBefore = readFlag(args, "--last-seen-before");
-        const lastSeenBeforeOrOn = readFlag(args, "--last-seen-before-or-on");
-        if (!lastSeenBefore && !lastSeenBeforeOrOn) {
-            fail('Usage: corelayer issues bulk-close --group <groupId> (--last-seen-before <date|preset> | --last-seen-before-or-on <date|preset>) [--feedback "..."]');
-        }
-        const feedback = readFlag(args, "--feedback");
-        const result = await client.bulkIssueAction({
-            action: "close",
-            groupId,
-            feedback,
-            filters: {
-                status: readFlag(args, "--status") || "Open",
-                severity: readFlag(args, "--severity"),
-                lastSeenBefore,
-                lastSeenBeforeOrOn,
-            },
-        });
-        if (ctx.json) {
-            printJson(result);
+    process.stdout.write(`Bulk close complete. Closed ${result.affected} issues`);
+    if (result.skipped > 0) {
+        process.stdout.write(`, skipped ${result.skipped}`);
+    }
+    process.stdout.write(".\n");
+}
+async function runReopenIssue({ client, commandArgs, ctx, }) {
+    const issueId = commandArgs[0];
+    if (!issueId) {
+        fail("Usage: corelayer issues reopen <issueId>");
+    }
+    await client.reopenIssue(issueId);
+    if (!ctx.quiet) {
+        process.stdout.write(`Issue ${issueId} reopened.\n`);
+    }
+}
+async function runDeleteIssue({ args, client, commandArgs, ctx, }) {
+    const issueId = commandArgs[0];
+    if (!issueId) {
+        fail("Usage: corelayer issues delete <issueId> [--yes]");
+    }
+    const yes = hasFlag(args, "--yes");
+    if (!yes) {
+        const confirmed = await confirmDelete();
+        if (!confirmed) {
+            process.stdout.write("Aborted.\n");
             return;
         }
-        process.stdout.write(`Bulk close complete. Closed ${result.affected} issues`);
-        if (result.skipped > 0) {
-            process.stdout.write(`, skipped ${result.skipped}`);
-        }
-        process.stdout.write(".\n");
-        return;
     }
-    if (sub === "reopen") {
-        const issueId = commandArgs[0];
-        if (!issueId) {
-            fail("Usage: corelayer issues reopen <issueId>");
-        }
-        await client.reopenIssue(issueId);
-        if (!ctx.quiet) {
-            process.stdout.write(`Issue ${issueId} reopened.\n`);
-        }
-        return;
+    await client.deleteIssue(issueId);
+    if (!ctx.quiet) {
+        process.stdout.write(`Issue ${issueId} deleted.\n`);
     }
-    if (sub === "delete") {
-        const issueId = commandArgs[0];
-        if (!issueId) {
-            fail("Usage: corelayer issues delete <issueId> [--yes]");
-        }
-        const yes = hasFlag(args, "--yes");
-        if (!yes) {
-            const confirmed = await confirmDelete();
-            if (!confirmed) {
-                process.stdout.write("Aborted.\n");
-                return;
-            }
-        }
-        await client.deleteIssue(issueId);
-        if (!ctx.quiet) {
-            process.stdout.write(`Issue ${issueId} deleted.\n`);
-        }
-        return;
+}
+async function runIssueSummary({ args, client, config, }) {
+    const groupId = resolveGroupId(args, config);
+    const summary = await client.getIssueSummary(groupId);
+    printJson(summary);
+}
+function resolveDiffSince(args) {
+    const sinceFlag = readFlag(args, "--since");
+    const durationFlag = readFlag(args, "--duration");
+    if (!sinceFlag && !durationFlag) {
+        fail("One of --since <timestamp|preset> or --duration <duration> is required.\n" +
+            "Examples: --since 2026-06-01T00:00:00Z  --since 24hours  --duration 2hours");
     }
-    if (sub === "summary") {
-        const groupId = readFlag(args, "--group") || config.defaults?.group;
-        if (!groupId) {
-            fail("groupId is required. Use --group <groupId> or set default-group via corelayer config set default-group <groupId>");
-        }
-        const summary = await client.getIssueSummary(groupId);
-        printJson(summary);
+    if (!durationFlag) {
+        return sinceFlag;
+    }
+    const ms = parseDuration(durationFlag);
+    if (ms === null) {
+        fail(`Invalid --duration value: "${durationFlag}". Examples: 30m, 2hours, 4h, 1d, 7days`);
+    }
+    return new Date(Date.now() - ms).toISOString();
+}
+async function runDiffIssues({ args, client, config, ctx, }) {
+    const groupId = resolveGroupId(args, config);
+    const result = await client.diffIssues(groupId, resolveDiffSince(args), {
+        limit: readFlag(args, "--limit"),
+        page: readFlag(args, "--page"),
+    });
+    if (ctx.json) {
+        printJson(result);
         return;
     }
-    if (sub === "diff") {
-        const groupId = readFlag(args, "--group") || config.defaults?.group;
-        if (!groupId) {
-            fail("groupId is required. Use --group <groupId> or set default-group via corelayer config set default-group <groupId>");
-        }
-        const sinceFlag = readFlag(args, "--since");
-        const durationFlag = readFlag(args, "--duration");
-        if (!sinceFlag && !durationFlag) {
-            fail("One of --since <timestamp|preset> or --duration <duration> is required.\n" +
-                "Examples: --since 2026-06-01T00:00:00Z  --since 24hours  --duration 2hours");
-        }
-        let sinceValue;
-        if (durationFlag) {
-            const ms = parseDuration(durationFlag);
-            if (ms === null) {
-                fail(`Invalid --duration value: "${durationFlag}". Examples: 30m, 2hours, 4h, 1d, 7days`);
-            }
-            sinceValue = new Date(Date.now() - ms).toISOString();
-        }
-        else {
-            sinceValue = sinceFlag;
-        }
-        const result = await client.diffIssues(groupId, sinceValue, {
-            limit: readFlag(args, "--limit"),
-            page: readFlag(args, "--page"),
-        });
-        if (ctx.json) {
-            printJson(result);
-            return;
-        }
-        process.stdout.write(`DIFF SINCE ${result.since}\n`);
-        const rows = result.issues.map((issue) => [
-            issue.id,
-            issue.slug || "-",
-            issue.severity || "-",
-            issue.status || "-",
-            issue.title || "-",
-            formatDate(issue.last_seen_at || issue.lastSeenAt),
-        ]);
-        printTable(["ID", "SLUG", "SEVERITY", "STATUS", "TITLE", "LAST SEEN"], rows);
-        if (!ctx.quiet) {
-            process.stdout.write(`${result.total} issue${result.total === 1 ? "" : "s"} changed since ${result.since}\n`);
-        }
+    process.stdout.write(`DIFF SINCE ${result.since}\n`);
+    printTable(["ID", "SLUG", "SEVERITY", "STATUS", "TITLE", "LAST SEEN"], issueRows(result.issues));
+    if (!ctx.quiet) {
+        process.stdout.write(`${result.total} issue${result.total === 1 ? "" : "s"} changed since ${result.since}\n`);
+    }
+}
+const ISSUE_COMMAND_HANDLERS = {
+    "bulk-close": runBulkCloseIssues,
+    close: runCloseIssue,
+    delete: runDeleteIssue,
+    diff: runDiffIssues,
+    get: ({ client, commandArgs, ctx }) => runGetIssue(client, commandArgs, ctx),
+    list: runListIssues,
+    reopen: runReopenIssue,
+    summary: runIssueSummary,
+};
+export async function runIssues(args, ctx) {
+    if (args.includes("--help") || args.includes("-h")) {
+        printHelp();
         return;
     }
-    fail("Usage: corelayer issues <list|get|close|bulk-close|reopen|delete|summary|diff> [options]");
+    const sub = args[0];
+    const config = readConfig();
+    const token = resolveToken();
+    if (!token) {
+        fail("Not authenticated. Set CORELAYER_API_KEY or run: corelayer login");
+    }
+    const apiUrl = resolveApiUrl(ctx.apiUrlOverride);
+    const client = new CorelayerClient(apiUrl, token);
+    const commandArgs = removeFlags(args.slice(1));
+    const handler = ISSUE_COMMAND_HANDLERS[sub];
+    if (!handler) {
+        fail("Usage: corelayer issues <list|get|close|bulk-close|reopen|delete|summary|diff> [options]");
+    }
+    await handler({ args, client, commandArgs, config, ctx });
 }

package/dist/commands/login.js

@@ -1,12 +1,7 @@
+import { readFlag } from "../lib/args.js";
 import { loginWithBrowser, loginWithCodeDirect } from "../lib/auth.js";
 import { updateConfig } from "../lib/config.js";
 import { fail } from "../lib/output.js";
-function readFlag(args, flag) {
-    const index = args.indexOf(flag);
-    if (index === -1)
-        return undefined;
-    return args[index + 1];
-}
 function hasFlag(args, flag) {
     return args.includes(flag);
 }

package/dist/commands/logout.js

@@ -1,11 +1,14 @@
-import { clearToken } from "../lib/config.js";
+import { CorelayerClient } from "../lib/api-client.js";
+import { clearToken, readConfig } from "../lib/config.js";
 function printHelp() {
-    process.stdout.write(`corelayer logout - Sign out and clear local credentials
+    process.stdout
+        .write(`corelayer logout - Revoke the saved credential and clear it locally
 
 USAGE:
   corelayer logout
 
 OPTIONS:
+  --local-only Clear the saved credential without server revocation
   -h, --help    Print help
 `);
 }
@@ -14,8 +17,23 @@ export async function runLogout(args, ctx) {
         printHelp();
         return;
     }
+    const config = readConfig();
+    if (config.token && !args.includes("--local-only")) {
+        try {
+            await new CorelayerClient(config.apiUrl, config.token).logout();
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : "Request failed";
+            throw new Error(`Could not revoke the saved credential: ${message}. Local credentials were kept. Retry, or use --local-only to clear them without revocation.`);
+        }
+    }
     clearToken();
+    if (process.env.CORELAYER_API_KEY) {
+        process.stderr.write("CORELAYER_API_KEY is still set. Unset it to stop using that credential.\n");
+    }
     if (!ctx.quiet) {
-        process.stdout.write("Logged out.\n");
+        process.stdout.write(args.includes("--local-only")
+            ? "Local credentials cleared; the server credential was not revoked.\n"
+            : "Logged out.\n");
     }
 }