up

src/StellaOps.Cli/Commands/CommandFactory.cs

@@ -262,10 +262,51 @@ internal static class CommandFactory
             return CommandHandlers.HandleAuthWhoAmIAsync(services, options, verbose, cancellationToken);
         });
 
+        var revoke = new Command("revoke", "Manage revocation exports.");
+        var export = new Command("export", "Export the revocation bundle and signature to disk.");
+        var outputOption = new Option<string?>("--output")
+        {
+            Description = "Directory to write exported revocation files (defaults to current directory)."
+        };
+        export.Add(outputOption);
+        export.SetAction((parseResult, _) =>
+        {
+            var output = parseResult.GetValue(outputOption);
+            var verbose = parseResult.GetValue(verboseOption);
+            return CommandHandlers.HandleAuthRevokeExportAsync(services, options, output, verbose, cancellationToken);
+        });
+        revoke.Add(export);
+        var verify = new Command("verify", "Verify a revocation bundle against a detached JWS signature.");
+        var bundleOption = new Option<string>("--bundle")
+        {
+            Description = "Path to the revocation-bundle.json file."
+        };
+        var signatureOption = new Option<string>("--signature")
+        {
+            Description = "Path to the revocation-bundle.json.jws file."
+        };
+        var keyOption = new Option<string>("--key")
+        {
+            Description = "Path to the PEM-encoded public/private key used for verification."
+        };
+        verify.Add(bundleOption);
+        verify.Add(signatureOption);
+        verify.Add(keyOption);
+        verify.SetAction((parseResult, _) =>
+        {
+            var bundlePath = parseResult.GetValue(bundleOption) ?? string.Empty;
+            var signaturePath = parseResult.GetValue(signatureOption) ?? string.Empty;
+            var keyPath = parseResult.GetValue(keyOption) ?? string.Empty;
+            var verbose = parseResult.GetValue(verboseOption);
+            return CommandHandlers.HandleAuthRevokeVerifyAsync(bundlePath, signaturePath, keyPath, verbose, cancellationToken);
+        });
+        revoke.Add(verify);
+
         auth.Add(login);
         auth.Add(logout);
         auth.Add(status);
         auth.Add(whoami);
+        auth.Add(revoke);
         return auth;
     }