Method notify_server

atomic-cli/src/commands/identity/agent/revoke.rs:170–209

Tell the server: bump the epoch, then deny-list each known grant. The epoch first, because it is the part that actually stops the agent and covers grants nobody has a copy of. Deny-listing the ones we do know is the audit trail on top.

(
        &self,
        agent: &atomic_identity::Identity,
        revoked: &[(String, atomic_identity::Identity, serde_json::Value)],
    )

    /// and covers grants nobody has a copy of. Deny-listing the ones we do know
    /// is the audit trail on top.
    async fn notify_server(
        &self,
        agent: &atomic_identity::Identity,
        revoked: &[(String, atomic_identity::Identity, serde_json::Value)],
    ) {
        let Some((_, delegator, _)) = revoked.first() else {
            return;
        };

        let Ok((client, url)) =
            crate::commands::client::build_apex_client_as(delegator, self.server.as_deref()).await
        else {
            print_warning(
                "Revoked locally, but no server could be reached. Outstanding grants stay \
                 valid until the server is told.\n  \
                 Retry with:  atomic identity agent revoke <name>",
            );
            return;
        };

        match self.bump_epoch(&client, agent).await {
            Ok(()) => println!("  Epoch bumped  {url} — every outstanding grant is now dead"),
            Err(e) => print_warning(&format!(
                "Could not bump the epoch at {url}: {e}\n  \
                 Grants this machine has never seen REMAIN VALID until it succeeds.\n  \
                 Retry with:  atomic identity agent revoke {}",
                agent.name
            )),
        }

        for (urn, _, revocation) in revoked {
            let request = RevokeDelegationRequest {
                revocation: revocation.clone(),
            };
            match client.revoke_delegation(urn, &request).await {
                Ok(_) => println!("  Deny-listed   {urn}"),
                Err(e) => print_warning(&format!("Could not deny-list {urn}: {e}")),
            }
        }
    }

    /// Find the agent's server-side id and bump its epoch.
    ///