@settlemint/dalp-cli 3.1.32-main.42194559254 → 3.1.32-main.42209626311

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@settlemint/dalp-cli",
-  "version": "3.1.32-main.42194559254",
+  "version": "3.1.32-main.42209626311",
   "private": false,
   "description": "CLI for the Digital Asset Lifecycle Platform — manage tokens, identities, compliance, and more from the command line.",
   "homepage": "https://settlemint.com",
@@ -18,6 +18,7 @@
   },
   "files": [
     "dist",
+    "src",
     "README.md",
     "LICENSE"
   ],
@@ -28,28 +29,34 @@
       "types": "./dist/dalp.d.ts",
       "import": "./dist/dalp.js"
     },
-    "./package.json": "./package.json"
+    "./package.json": "./package.json",
+    "./hosted-mcp": {
+      "types": "./src/hosted-mcp.ts",
+      "dalp-source": "./src/hosted-mcp.ts",
+      "default": "./src/hosted-mcp.ts"
+    }
   },
   "scripts": {
     "lint": "taskguard oxlint --deny-warnings .",
     "codegen": "taskguard bun tools/extract-openapi-surface.ts",
     "build": "taskguard sh -c 'rm -rf dist && bun build src/bin.ts --target bun --format esm --no-deprecated-namespace-object-setters --sourcemap=external --outdir dist --entry-naming dalp.js && printf '\\''export {};\n'\\'' > dist/dalp.d.ts && bun dist/dalp.js --help > /dev/null'",
     "publint": "publint run --strict --pack bun",
-    "attw": "archive=$(bun pm pack --destination \"$PWD\" --quiet | tail -n 1) && attw \"$archive\" --ignore-rules cjs-resolves-to-esm; code=$?; rm -f \"$archive\"; exit $code",
+    "attw": "archive=$(bun pm pack --destination \"$PWD\" --quiet | tail -n 1) && attw \"$archive\" --profile esm-only; code=$?; rm -f \"$archive\"; exit $code",
     "publish": "cp ../LICENSE . && bun run --cwd .. publish-if-absent \"$PWD\"",
     "prepack": "cp ../LICENSE .",
     "test": "taskguard bun test --parallel=4 --randomize --preload @testkit/effect-bun-test/preload --conditions dalp-source ./tests/unit",
     "typecheck": "taskguard effect-tsgo tsrs --customConditions dalp-types"
   },
   "dependencies": {
-    "@settlemint/dalp-sdk": "3.1.32-main.42194559254",
+    "@modelcontextprotocol/server": "2.0.0-alpha.4",
+    "@settlemint/dalp-sdk": "3.1.32-main.42209626311",
     "incur": "0.7.1",
     "zod": "4.6.7"
   },
   "devDependencies": {
     "@arethetypeswrong/cli": "0.18.5",
-    "@testkit/effect-bun-test": "3.1.32-main.42194559254",
-    "@tools/typescript-config": "3.1.32-main.42194559254",
+    "@testkit/effect-bun-test": "3.1.32-main.42209626311",
+    "@tools/typescript-config": "3.1.32-main.42209626311",
     "@types/bun": "1.4.4",
     "publint": "0.3.25"
   },

package/src/bin.ts

@@ -0,0 +1,6 @@
+#!/usr/bin/env bun
+
+import "zod/compile";
+import { cli } from "./main.ts";
+
+await cli.serve();

package/src/commands/config.ts

@@ -0,0 +1,73 @@
+import { Cli, z } from "incur";
+import { type DalpConfig, loadGlobalConfig, resolveConfig, saveGlobalConfig } from "../lib/cli-config.ts";
+import { runCommand } from "../lib/run-command.ts";
+import { cliVars } from "../lib/vars.ts";
+
+const CONFIG_KEYS = ["apiUrl", "defaultOrg", "format"] as const;
+export type ConfigKey = (typeof CONFIG_KEYS)[number];
+
+const isConfigKey = (value: string): value is ConfigKey => (CONFIG_KEYS as ReadonlyArray<string>).includes(value);
+
+export const configCommand = Cli.create("config", {
+  description: "Manage CLI configuration",
+  vars: cliVars,
+});
+
+configCommand.command("get", {
+  description: "Get a configuration value (resolved)",
+  args: z.object({
+    key: z.string().describe("Config key: apiUrl | defaultOrg | format"),
+  }),
+  run(c) {
+    return runCommand(
+      c,
+      (async () => {
+        if (!isConfigKey(c.args.key)) {
+          return c.error({
+            code: "INVALID_CONFIG_KEY",
+            message: `Unknown config key '${c.args.key}'. Valid keys: ${CONFIG_KEYS.join(", ")}`,
+          });
+        }
+        const config = await resolveConfig();
+        return { key: c.args.key, value: config[c.args.key] ?? null };
+      })()
+    );
+  },
+});
+
+configCommand.command("set", {
+  description: "Set a global configuration value",
+  args: z.object({
+    key: z.string().describe("Config key: apiUrl | defaultOrg | format"),
+    value: z.string().describe("Value to store"),
+  }),
+  run(c) {
+    return runCommand(
+      c,
+      (async () => {
+        if (!isConfigKey(c.args.key)) {
+          return c.error({
+            code: "INVALID_CONFIG_KEY",
+            message: `Unknown config key '${c.args.key}'. Valid keys: ${CONFIG_KEYS.join(", ")}`,
+          });
+        }
+        const updates: Partial<DalpConfig> = { [c.args.key]: c.args.value };
+        await saveGlobalConfig(updates);
+        return { key: c.args.key, value: c.args.value };
+      })()
+    );
+  },
+});
+
+configCommand.command("list", {
+  description: "List resolved configuration",
+  run(c) {
+    return runCommand(
+      c,
+      (async () => {
+        const [resolved, global] = await Promise.all([resolveConfig(), loadGlobalConfig()]);
+        return { resolved, global };
+      })()
+    );
+  },
+});

package/src/commands/login.ts

@@ -0,0 +1,453 @@
+import { hostname } from "node:os";
+import { Cli, z } from "incur";
+import { resolveConfig, saveGlobalConfig } from "../lib/cli-config.ts";
+import { revokeOwnApiKey } from "../lib/auth-request.ts";
+import { loadCredentials, saveCredentials, type StoredCredentials } from "../lib/credential-store.ts";
+import { makeCliError } from "../lib/errors.ts";
+import { runCommand } from "../lib/run-command.ts";
+import { promptSecret } from "../lib/secret-prompt.ts";
+import { CLI_USER_AGENT, cliVars } from "../lib/vars.ts";
+
+const deviceCodeSchema = z.object({
+  device_code: z.string(),
+  user_code: z.string(),
+  verification_uri: z.string(),
+  verification_uri_complete: z.string().optional(),
+  expires_in: z.number(),
+  interval: z.number(),
+});
+
+const tokenResponseSchema = z.object({
+  access_token: z.string(),
+  token_type: z.string(),
+  expires_in: z.number(),
+  scope: z.string(),
+});
+
+const tokenErrorSchema = z.object({
+  error: z.string(),
+});
+
+const sessionResponseSchema = z.object({
+  user: z.object({ id: z.string(), email: z.string(), name: z.string() }),
+  session: z.object({ activeOrganizationId: z.string().nullable() }),
+});
+
+const walletFactorTypes = {
+  pincode: "PINCODE",
+  otp: "OTP",
+  "secret-codes": "SECRET_CODES",
+} as const;
+
+const walletFactorPrompts = {
+  pincode: "Wallet PIN: ",
+  otp: "Wallet authenticator code: ",
+  "secret-codes": "Wallet recovery code: ",
+} as const;
+
+type WalletFactor = keyof typeof walletFactorTypes;
+
+const refusalSchema = z.object({ code: z.string().optional(), message: z.string().optional() });
+
+const readWalletCode = async (factor: WalletFactor, fromEnv: string | undefined, agent: boolean): Promise<string> => {
+  if (fromEnv !== undefined && fromEnv !== "") {
+    return fromEnv;
+  }
+  if (agent || process.stdin.isTTY !== true) {
+    throw makeCliError({
+      code: "kit.cli.WALLET_CODE_REQUIRED",
+      message: "Creating the CLI API key needs your wallet verification code, and there is no terminal to ask for it.",
+      why: "DALP asks for a wallet factor before it creates an API key, as it does before signing.",
+      fix: "Set DALP_WALLET_CODE to your wallet PIN (or pass --wallet-factor otp or secret-codes with that code), then run 'dalp login' again.",
+    });
+  }
+  return promptSecret(walletFactorPrompts[factor]);
+};
+
+const apiKeyResponseSchema = z.object({
+  id: z.string(),
+  key: z.string(),
+  name: z.string(),
+});
+
+const MAX_LOGIN_RESPONSE_BYTES = 1024 * 1024;
+
+const CLI_API_KEY_EXPIRES_IN_SECONDS = 90 * 24 * 60 * 60;
+
+const DEVICE_CLIENT_ID = "dalp-cli";
+
+const isLoopbackHost = (host: string) =>
+  host === "localhost" || host === "127.0.0.1" || host === "::1" || host === "[::1]";
+
+export function validateLoginBaseUrl(apiUrl: string): string {
+  let parsed: URL;
+  try {
+    parsed = new URL(apiUrl);
+  } catch {
+    throw makeCliError({
+      code: "kit.cli.INVALID_URL",
+      message: "DALP login URL is not a valid absolute URL.",
+    });
+  }
+  const isLocalhost = isLoopbackHost(parsed.hostname);
+  if (parsed.username !== "" || parsed.password !== "") {
+    throw makeCliError({
+      code: "kit.cli.INVALID_URL",
+      message: "DALP login URLs must not contain embedded credentials.",
+    });
+  }
+  if (parsed.protocol !== "https:" && !(parsed.protocol === "http:" && isLocalhost)) {
+    throw makeCliError({
+      code: "kit.cli.INVALID_URL",
+      message: "DALP login requires HTTPS. HTTP is allowed only for localhost development.",
+    });
+  }
+  if (parsed.search !== "" || parsed.hash !== "") {
+    throw makeCliError({
+      code: "kit.cli.INVALID_URL",
+      message: "DALP login URLs must not contain a query string or fragment.",
+    });
+  }
+  return parsed.href.replace(/\/+$/u, "");
+}
+
+async function readBoundedJson<T>(response: Response, schema: z.ZodType<T>): Promise<T> {
+  const buffer = await response.arrayBuffer();
+  if (buffer.byteLength > MAX_LOGIN_RESPONSE_BYTES) {
+    throw makeCliError({
+      code: "kit.cli.LOGIN_RESPONSE_TOO_LARGE",
+      message: `Login response exceeded the ${MAX_LOGIN_RESPONSE_BYTES}-byte limit.`,
+    });
+  }
+  const body: unknown = JSON.parse(new TextDecoder().decode(buffer));
+  return schema.parse(body);
+}
+
+async function postJson(url: string, body: unknown, headers: Record<string, string> = {}): Promise<Response> {
+  return fetch(url, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+      "User-Agent": CLI_USER_AGENT,
+      ...headers,
+    },
+    body: JSON.stringify(body),
+  });
+}
+
+export async function requestDeviceCode(apiUrl: string): Promise<z.infer<typeof deviceCodeSchema>> {
+  const baseUrl = validateLoginBaseUrl(apiUrl);
+  const response = await postJson(`${baseUrl}/api/auth/device/code`, { client_id: DEVICE_CLIENT_ID });
+  if (response.ok) {
+    return readBoundedJson(response, deviceCodeSchema);
+  }
+  const refusal = await readBoundedJson(response, tokenErrorSchema).catch(() => null);
+  if (refusal?.error === "invalid_client") {
+    throw makeCliError({
+      code: "kit.cli.DEVICE_CLIENT_REJECTED",
+      message: `The DALP server at ${baseUrl} does not accept this CLI for device login.`,
+      why: `The server refused the device client id '${DEVICE_CLIENT_ID}'.`,
+      fix: "Check that the URL points at a DALP instance, and use a CLI version that instance supports.",
+    });
+  }
+  throw makeCliError({
+    code: "DEVICE_CODE_FAILED",
+    message: `Failed to request device code from ${apiUrl}. Check that the URL is correct and the server is running.`,
+    retryable: true,
+  });
+}
+
+export async function pollForToken(
+  apiUrl: string,
+  deviceCode: string,
+  intervalSeconds: number,
+  expiresInSeconds: number,
+  sleep: (ms: number) => Promise<void> = (ms) =>
+    new Promise((resolve) => {
+      setTimeout(resolve, ms);
+    }),
+  now: () => number = () => Date.now()
+): Promise<z.infer<typeof tokenResponseSchema>> {
+  const baseUrl = validateLoginBaseUrl(apiUrl);
+  const deadline = now() + expiresInSeconds * 1000;
+  let pollInterval = intervalSeconds * 1000;
+
+  while (now() < deadline) {
+    await sleep(pollInterval);
+    const response = await postJson(`${baseUrl}/api/auth/device/token`, {
+      grant_type: "urn:ietf:params:oauth:grant-type:device_code",
+      device_code: deviceCode,
+      client_id: DEVICE_CLIENT_ID,
+    });
+
+    if (response.ok) {
+      return readBoundedJson(response, tokenResponseSchema);
+    }
+
+    const errorBody = await readBoundedJson(response, tokenErrorSchema);
+    if (errorBody.error === "slow_down") {
+      pollInterval = Math.min(pollInterval + 5000, 60_000);
+      continue;
+    }
+    if (errorBody.error === "authorization_pending") {
+      continue;
+    }
+    if (errorBody.error === "expired_token") {
+      throw makeCliError({
+        code: "kit.cli.DEVICE_AUTHORIZATION_TIMEOUT",
+        message: "Device code expired. Run 'dalp login' again.",
+        retryable: true,
+        why: "The device authorization grant was not completed before its server-issued deadline.",
+        fix: "Run 'dalp login' again and approve the displayed device code before it expires.",
+      });
+    }
+    if (errorBody.error === "access_denied") {
+      throw makeCliError({
+        code: "kit.cli.AUTHORIZATION_DENIED",
+        message: "Authorization denied by user.",
+      });
+    }
+    throw makeCliError({
+      code: "kit.cli.DEVICE_TOKEN_FAILED",
+      message: `Unexpected error: ${errorBody.error}`,
+    });
+  }
+
+  throw makeCliError({
+    code: "kit.cli.DEVICE_AUTHORIZATION_TIMEOUT",
+    message: "Device code expired. Run 'dalp login' again.",
+    retryable: true,
+  });
+}
+
+export function makeVerificationOpenCommand(
+  platform: NodeJS.Platform,
+  completeUri: string
+): { readonly command: string; readonly args: ReadonlyArray<string> } {
+  const parsedUrl = new URL(completeUri);
+  const isLocalhost = isLoopbackHost(parsedUrl.hostname);
+  if (parsedUrl.username !== "" || parsedUrl.password !== "") {
+    throw new Error("Verification URLs must not contain embedded credentials.");
+  }
+  if (parsedUrl.protocol !== "https:" && !(parsedUrl.protocol === "http:" && isLocalhost)) {
+    throw new Error("HTTPS required. Use http://localhost for local development only.");
+  }
+  const safeUri = parsedUrl.toString();
+  if (platform === "darwin") {
+    return { command: "open", args: [safeUri] };
+  }
+  if (platform === "win32") {
+    return { command: "explorer.exe", args: [safeUri] };
+  }
+  return { command: "xdg-open", args: [safeUri] };
+}
+
+async function openVerificationUrl(completeUri: string): Promise<void> {
+  try {
+    const { command, args } = makeVerificationOpenCommand(process.platform, completeUri);
+    const proc = Bun.spawn([command, ...args], { stdout: "ignore", stderr: "ignore" });
+    await proc.exited;
+  } catch {}
+}
+
+export const loginCommand = Cli.create("login", {
+  description: "Authenticate with your DALP instance via browser",
+  vars: cliVars,
+  options: z.object({
+    url: z.string().optional().describe("DALP instance URL"),
+    walletFactor: z
+      .enum(["pincode", "otp", "secret-codes"])
+      .default("pincode")
+      .describe("Wallet factor that confirms the new API key"),
+  }),
+  env: z.object({
+    DALP_URL: z.string().optional().describe("DALP instance URL"),
+    DALP_WALLET_CODE: z
+      .string()
+      .optional()
+      .describe("Wallet PIN, authenticator code or recovery code that confirms the new API key"),
+  }),
+  examples: [
+    { description: "Login to configured instance" },
+    { options: { url: "https://dalp.example.com" }, description: "Login to specific instance" },
+  ],
+  run(c) {
+    return runCommand(
+      c,
+      (async () => {
+        const previous = await loadCredentials();
+        const config = await resolveConfig();
+        const apiUrl = c.options.url ?? c.env.DALP_URL ?? c.var.apiUrl ?? config.apiUrl;
+
+        if (apiUrl === undefined || apiUrl === "") {
+          return c.error({
+            code: "NO_URL",
+            message:
+              "No DALP instance URL configured. Provide --url, set DALP_URL, or run 'dalp config set apiUrl <url>'.",
+            retryable: true,
+          });
+        }
+
+        const baseUrl = validateLoginBaseUrl(apiUrl);
+        const deviceCode = await requestDeviceCode(apiUrl);
+
+        if (c.agent !== true) {
+          const verificationBase = deviceCode.verification_uri.startsWith("http")
+            ? deviceCode.verification_uri
+            : `${baseUrl}${deviceCode.verification_uri}`;
+          const completeUri =
+            deviceCode.verification_uri_complete ?? `${verificationBase}?code=${deviceCode.user_code}`;
+          process.stdout.write(`\nOpen this URL in your browser:\n  ${completeUri}\n\n`);
+          process.stdout.write(`Or go to ${verificationBase} and enter code:\n  ${deviceCode.user_code}\n\n`);
+          process.stdout.write("Waiting for authorization...\n");
+          await openVerificationUrl(completeUri);
+        }
+
+        const sessionToken = await pollForToken(
+          baseUrl,
+          deviceCode.device_code,
+          deviceCode.interval,
+          deviceCode.expires_in
+        );
+
+        const sessionBearer = `Bearer ${sessionToken.access_token}`;
+        const sessionResponse = await fetch(`${baseUrl}/api/auth/get-session`, {
+          headers: { Authorization: sessionBearer, "User-Agent": CLI_USER_AGENT },
+        });
+        if (!sessionResponse.ok) {
+          return c.error({
+            code: "SESSION_FAILED",
+            message: "Authorized but failed to fetch session. Try 'dalp login' again.",
+            retryable: true,
+          });
+        }
+
+        const session = await readBoundedJson(sessionResponse, sessionResponseSchema);
+        const activeOrgId = session.session.activeOrganizationId;
+        if (activeOrgId === null || activeOrgId === "") {
+          throw makeCliError({
+            code: "kit.cli.NO_ACTIVE_ORGANIZATION",
+            message: "You signed in, but your session has no active organization, so no API key was created.",
+            why: "A CLI key acts in one organization, and the session that approved the sign-in had none selected.",
+            fix: "Open the Console, select an organization, then run 'dalp login' again.",
+          });
+        }
+
+        const { walletFactor } = c.options;
+        const walletCode = await readWalletCode(walletFactor, c.env.DALP_WALLET_CODE, c.agent === true);
+        const apiKeyName = `dalp-cli (${hostname()})`;
+        const apiKeyResponse = await postJson(
+          `${baseUrl}/api/auth/api-key/create`,
+          {
+            name: apiKeyName,
+            expiresIn: CLI_API_KEY_EXPIRES_IN_SECONDS,
+            metadata: { organizationId: activeOrgId, scope: "read-write" },
+            walletVerification: {
+              secretVerificationCode: walletCode,
+              verificationType: walletFactorTypes[walletFactor],
+            },
+          },
+          { Authorization: sessionBearer }
+        );
+        if (!apiKeyResponse.ok) {
+          const refusal = await readBoundedJson(apiKeyResponse, refusalSchema).catch(() => ({
+            code: undefined,
+            message: undefined,
+          }));
+          const refusalCode = refusal.code ?? "";
+          if (refusalCode.startsWith("WALLET_")) {
+            return c.error({
+              code: refusalCode,
+              message: `Authorized, but the API key was not created: ${refusal.message ?? refusalCode}`,
+              retryable: refusalCode !== "WALLET_STEP_UP_UNAVAILABLE",
+            });
+          }
+          return c.error({
+            code: "API_KEY_FAILED",
+            message: "Authorized but failed to create API key. Check your permissions or try 'dalp login' again.",
+            retryable: true,
+          });
+        }
+
+        const apiKey = await readBoundedJson(apiKeyResponse, apiKeyResponseSchema);
+        const credentials: StoredCredentials = {
+          apiKey: apiKey.key,
+          apiKeyId: apiKey.id,
+          userEmail: session.user.email,
+          userId: session.user.id,
+          apiUrl: baseUrl,
+          activeOrgId,
+        };
+
+        if (previous !== undefined) {
+          const revocation = await revokeOwnApiKey(previous);
+          if (revocation._tag === "Unconfirmed") {
+            const rollback = await revokeOwnApiKey(credentials);
+            const retry = `Run 'dalp login' again. If it keeps failing, revoke the key in the Console on ${previous.apiUrl} under API keys, then run 'dalp logout' and 'dalp login'.`;
+            const newKey = `'${apiKeyName}' (${credentials.apiKeyId})`;
+            throw makeCliError({
+              code: "kit.cli.API_KEY_REVOKE_FAILED",
+              retryable: true,
+              ...(rollback._tag === "Revoked"
+                ? {
+                    message: `Could not revoke the previous CLI key on ${previous.apiUrl}, so the login was undone and the previous credentials were kept.`,
+                    why: "The server that issued the previous key did not confirm its revocation.",
+                    fix: retry,
+                    cause: revocation.cause,
+                  }
+                : {
+                    message: `Could not revoke the previous CLI key on ${previous.apiUrl}, and could not revoke the new key ${newKey} on ${baseUrl}. The previous credentials were kept.`,
+                    why: "Neither server confirmed the revocation of its key.",
+                    fix: `Remove the new key ${newKey} in the Console on ${baseUrl} under API keys. ${retry}`,
+                    cause: rollback.cause,
+                  }),
+            });
+          }
+        }
+
+        try {
+          await saveCredentials(credentials);
+        } catch (error) {
+          const rollback = await revokeOwnApiKey(credentials);
+          const newKey = `'${apiKeyName}' (${credentials.apiKeyId})`;
+          const previousRevoked =
+            previous === undefined ? "" : ` The previous key on ${previous.apiUrl} was already revoked.`;
+          throw makeCliError({
+            code: "kit.cli.CREDENTIAL_STORE_FAILED",
+            retryable: true,
+            message:
+              rollback._tag === "Revoked"
+                ? `Could not save the new CLI credentials, so the new key was revoked.${previousRevoked}`
+                : `Could not save the new CLI credentials, and could not revoke the new key ${newKey} on ${baseUrl}.${previousRevoked}`,
+            why: "The local credential store refused the write.",
+            fix:
+              rollback._tag === "Revoked"
+                ? "Make the DALP config directory writable (or unlock the keychain), then run 'dalp login' again."
+                : `Remove the new key ${newKey} in the Console on ${baseUrl} under API keys, make the credential store writable, then run 'dalp login' again.`,
+            cause: error,
+          });
+        }
+        await saveGlobalConfig({ apiUrl: baseUrl, defaultOrg: activeOrgId });
+
+        return c.ok(
+          {
+            authenticated: true,
+            user: session.user.email,
+            instance: baseUrl,
+            organizationId: activeOrgId,
+          },
+          {
+            cta: {
+              description: "You're logged in. Try:",
+              commands: [
+                { command: "whoami", description: "View current user" },
+                { command: "org switch", description: "Save the key's organization as active" },
+                { command: "tokens list", description: "List tokens" },
+              ],
+            },
+          }
+        );
+      })()
+    );
+  },
+});

package/src/commands/logout.ts

@@ -0,0 +1,46 @@
+import { Cli } from "incur";
+import { revokeOwnApiKey } from "../lib/auth-request.ts";
+import { deleteCredentials, loadCredentials, type StoredCredentials } from "../lib/credential-store.ts";
+import { makeCliError } from "../lib/errors.ts";
+import { runCommand } from "../lib/run-command.ts";
+import { cliVars } from "../lib/vars.ts";
+
+const revokeUnconfirmed = (detail: string, cause: unknown) =>
+  makeCliError({
+    code: "kit.cli.API_KEY_REVOKE_UNCONFIRMED",
+    message: `Removed the local credentials, but ${detail}`,
+    why: "The CLI revokes its key on the server at logout, and the server did not confirm the revocation.",
+    fix: "Revoke the dalp-cli key for this machine under API keys in the Console.",
+    cause,
+  });
+
+export const logoutCommand = Cli.create("logout", {
+  description: "Revoke this machine's DALP CLI key and remove its stored credentials",
+  vars: cliVars,
+  run(c) {
+    return runCommand(
+      c,
+      (async () => {
+        let stored: StoredCredentials | undefined;
+        try {
+          stored = await loadCredentials();
+        } catch (error) {
+          await deleteCredentials();
+          throw revokeUnconfirmed("they could not be read, so the key was not revoked.", error);
+        }
+        if (stored === undefined) {
+          return { loggedOut: true, revokedKeyId: null };
+        }
+        const revocation = await revokeOwnApiKey(stored);
+        await deleteCredentials();
+        if (revocation._tag === "Unconfirmed") {
+          throw revokeUnconfirmed(
+            `${stored.apiUrl} did not confirm that key ${stored.apiKeyId} was revoked.`,
+            revocation.cause
+          );
+        }
+        return { loggedOut: true, revokedKeyId: stored.apiKeyId };
+      })()
+    );
+  },
+});