@skrr-ai/cli 0.1.46 → 0.1.48

package/dist/commands/machines/dedicated/service/ls.d.ts

@@ -0,0 +1,20 @@
+import { DedicatedServiceCommand } from '../../../../lib/dedicated-service-command';
+/**
+ * `skrr machines dedicated service ls` — what the machine is keeping alive,
+ * and what agents have asked it to keep alive.
+ *
+ * Agent proposals are printed as their own section rather than as ordinary
+ * rows: a proposed service runs nothing until the owner approves it, and a
+ * table that listed it beside running work would lie by adjacency.
+ */
+export default class DedicatedServiceLs extends DedicatedServiceCommand {
+    static summary: string;
+    static examples: string[];
+    static args: {
+        lease: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/machines/dedicated/service/ls.js

@@ -0,0 +1,80 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const dedicated_service_command_1 = require("../../../../lib/dedicated-service-command");
+const format_1 = require("../../../../lib/format");
+/**
+ * `skrr machines dedicated service ls` — what the machine is keeping alive,
+ * and what agents have asked it to keep alive.
+ *
+ * Agent proposals are printed as their own section rather than as ordinary
+ * rows: a proposed service runs nothing until the owner approves it, and a
+ * table that listed it beside running work would lie by adjacency.
+ */
+class DedicatedServiceLs extends dedicated_service_command_1.DedicatedServiceCommand {
+    static summary = 'List declared services and pending agent proposals';
+    static examples = [
+        '<%= config.bin %> machines dedicated service ls <lease-id>',
+        '<%= config.bin %> machines dedicated service ls <lease-id> --json',
+    ];
+    static args = {
+        lease: core_1.Args.string({
+            description: dedicated_service_command_1.SERVICE_LEASE_ARG_DESCRIPTION,
+            required: true,
+            ignoreStdin: true,
+        }),
+    };
+    static flags = {
+        json: core_1.Flags.boolean({ description: 'Output as JSON' }),
+    };
+    async run() {
+        this.requireAuth();
+        const { args, flags } = await this.parse(DedicatedServiceLs);
+        const leaseId = await this.resolveLeaseArg(args.lease);
+        const result = await this.callService('list', {
+            leaseId,
+            ...this.scopeFrom(flags),
+        });
+        this.closeServiceChannel();
+        if (flags.json) {
+            this.log(JSON.stringify(result ?? { services: [] }, null, 2));
+            return;
+        }
+        const services = result?.services ?? [];
+        const proposals = result?.proposals ?? [];
+        if (services.length === 0 && proposals.length === 0) {
+            this.log(`No declared services on ${leaseId}.`);
+            this.log(`Declare one with \`${this.config.bin} machines dedicated service create ${leaseId} --name <name> -- <command>\`.`);
+            return;
+        }
+        if (services.length > 0) {
+            (0, format_1.renderTable)(services.map((svc) => ({
+                name: (0, format_1.formatCell)(svc.name ?? svc.spec?.name),
+                status: (0, format_1.formatCell)(svc.status ?? 'unknown'),
+                restart: (0, format_1.formatCell)(svc.restart ?? svc.spec?.restart),
+                createdBy: (0, format_1.formatCell)(svc.createdBy ?? svc.spec?.createdBy),
+            })), [
+                { key: 'name', header: 'NAME', verbatim: true },
+                { key: 'status', header: 'STATUS' },
+                { key: 'restart', header: 'RESTART' },
+                { key: 'createdBy', header: 'CREATED BY' },
+            ], (line) => this.log(line));
+        }
+        if (proposals.length > 0) {
+            if (services.length > 0)
+                this.log('');
+            this.log('Pending proposals — nothing runs until you approve:');
+            (0, format_1.renderTable)(proposals.map((p) => ({
+                name: (0, format_1.formatCell)(p.name ?? p.spec?.name),
+                proposedBy: (0, format_1.formatCell)(p.createdBy),
+                command: (0, format_1.formatCell)(Array.isArray(p.spec?.command) ? p.spec.command.join(' ') : (p.spec?.shell ?? ''), '-'),
+            })), [
+                { key: 'name', header: 'NAME', verbatim: true },
+                { key: 'proposedBy', header: 'PROPOSED BY' },
+                { key: 'command', header: 'COMMAND', maxWidth: 60 },
+            ], (line) => this.log(line));
+            this.log(`Approve with \`${this.config.bin} machines dedicated service approve ${leaseId} <name>\` (add --reject to refuse).`);
+        }
+    }
+}
+exports.default = DedicatedServiceLs;

package/dist/commands/machines/dedicated/service/restart.d.ts

@@ -0,0 +1,14 @@
+import { DedicatedServiceCommand } from '../../../../lib/dedicated-service-command';
+/** `skrr machines dedicated service restart` — bounce it now; also re-arms a `failed` service. */
+export default class DedicatedServiceRestart extends DedicatedServiceCommand {
+    static summary: string;
+    static examples: string[];
+    static args: {
+        lease: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+        name: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/machines/dedicated/service/restart.js

@@ -0,0 +1,29 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const dedicated_service_command_1 = require("../../../../lib/dedicated-service-command");
+/** `skrr machines dedicated service restart` — bounce it now; also re-arms a `failed` service. */
+class DedicatedServiceRestart extends dedicated_service_command_1.DedicatedServiceCommand {
+    static summary = 'Restart a service now (re-arms a failed one)';
+    static examples = [
+        '<%= config.bin %> machines dedicated service restart <lease-id> <name>',
+    ];
+    static args = {
+        lease: core_1.Args.string({
+            description: dedicated_service_command_1.SERVICE_LEASE_ARG_DESCRIPTION,
+            required: true,
+            ignoreStdin: true,
+        }),
+        name: core_1.Args.string({ description: 'Service name', required: true, ignoreStdin: true }),
+    };
+    static flags = {
+        json: core_1.Flags.boolean({ description: 'Output the result as JSON' }),
+    };
+    async run() {
+        this.requireAuth();
+        const { args, flags } = await this.parse(DedicatedServiceRestart);
+        const leaseId = await this.resolveLeaseArg(args.lease);
+        await this.runServiceAction(leaseId, args.name, 'restart', flags);
+    }
+}
+exports.default = DedicatedServiceRestart;

package/dist/commands/machines/dedicated/service/rm.d.ts

@@ -0,0 +1,20 @@
+import { DedicatedServiceCommand } from '../../../../lib/dedicated-service-command';
+/**
+ * `skrr machines dedicated service rm` — delete the declaration.
+ *
+ * The only way a declared service does not come back short of destroying the
+ * lease: the spec file is dropped, the scope is killed, and the reconciler
+ * forgets it.
+ */
+export default class DedicatedServiceRm extends DedicatedServiceCommand {
+    static summary: string;
+    static examples: string[];
+    static args: {
+        lease: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+        name: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/machines/dedicated/service/rm.js

@@ -0,0 +1,33 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const dedicated_service_command_1 = require("../../../../lib/dedicated-service-command");
+/**
+ * `skrr machines dedicated service rm` — delete the declaration.
+ *
+ * The only way a declared service does not come back short of destroying the
+ * lease: the spec file is dropped, the scope is killed, and the reconciler
+ * forgets it.
+ */
+class DedicatedServiceRm extends dedicated_service_command_1.DedicatedServiceCommand {
+    static summary = 'Remove a service declaration';
+    static examples = ['<%= config.bin %> machines dedicated service rm <lease-id> <name>'];
+    static args = {
+        lease: core_1.Args.string({
+            description: dedicated_service_command_1.SERVICE_LEASE_ARG_DESCRIPTION,
+            required: true,
+            ignoreStdin: true,
+        }),
+        name: core_1.Args.string({ description: 'Service name', required: true, ignoreStdin: true }),
+    };
+    static flags = {
+        json: core_1.Flags.boolean({ description: 'Output the result as JSON' }),
+    };
+    async run() {
+        this.requireAuth();
+        const { args, flags } = await this.parse(DedicatedServiceRm);
+        const leaseId = await this.resolveLeaseArg(args.lease);
+        await this.runServiceAction(leaseId, args.name, 'remove', flags);
+    }
+}
+exports.default = DedicatedServiceRm;

package/dist/commands/machines/dedicated/service/secret/index.d.ts

@@ -0,0 +1,14 @@
+import { Command } from '@oclif/core';
+/**
+ * `skrr machines dedicated service secret` — values a spec references as
+ * `secret://<name>` (phase 2).
+ *
+ * The daemon resolves the reference at spawn; the spec and every status
+ * surface carry only the name. Mutation is owner-channel only and names —
+ * never values — reach the audit log.
+ */
+export default class DedicatedServiceSecret extends Command {
+    static description: string;
+    static examples: string[];
+    run(): Promise<void>;
+}

package/dist/commands/machines/dedicated/service/secret/index.js

@@ -0,0 +1,25 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+/**
+ * `skrr machines dedicated service secret` — values a spec references as
+ * `secret://<name>` (phase 2).
+ *
+ * The daemon resolves the reference at spawn; the spec and every status
+ * surface carry only the name. Mutation is owner-channel only and names —
+ * never values — reach the audit log.
+ */
+class DedicatedServiceSecret extends core_1.Command {
+    static description = 'Secrets a service spec can reference as secret://<name> — daemon-held, never in the spec (phase 2)';
+    static examples = [
+        '<%= config.bin %> machines dedicated service secret set <lease-id> <name> < secret.txt',
+        '<%= config.bin %> machines dedicated service secret set <lease-id> <name> --from-file .env.production',
+        '<%= config.bin %> machines dedicated service secret rm <lease-id> <name>',
+    ];
+    async run() {
+        this.log('skrr machines dedicated service secret commands:');
+        this.log('  skrr machines dedicated service secret set  store a secret a spec can reference');
+        this.log('  skrr machines dedicated service secret rm   remove one (--force if referenced)');
+    }
+}
+exports.default = DedicatedServiceSecret;

package/dist/commands/machines/dedicated/service/secret/rm.d.ts

@@ -0,0 +1,22 @@
+import { DedicatedServiceCommand } from '../../../../../lib/dedicated-service-command';
+/**
+ * `skrr machines dedicated service secret rm` — drop a stored secret.
+ *
+ * Removing a name a spec still references is refused unless forced — the
+ * daemon answers with the referencing services, and `--force` is the caller
+ * saying they know. Rotation stays manual on purpose: `secret set` +
+ * `service restart`, never a silent restart channel.
+ */
+export default class DedicatedServiceSecretRm extends DedicatedServiceCommand {
+    static summary: string;
+    static examples: string[];
+    static args: {
+        lease: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+        name: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        force: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/machines/dedicated/service/secret/rm.js

@@ -0,0 +1,54 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const dedicated_service_command_1 = require("../../../../../lib/dedicated-service-command");
+const dedicated_service_1 = require("../../../../../lib/dedicated-service");
+/**
+ * `skrr machines dedicated service secret rm` — drop a stored secret.
+ *
+ * Removing a name a spec still references is refused unless forced — the
+ * daemon answers with the referencing services, and `--force` is the caller
+ * saying they know. Rotation stays manual on purpose: `secret set` +
+ * `service restart`, never a silent restart channel.
+ */
+class DedicatedServiceSecretRm extends dedicated_service_command_1.DedicatedServiceCommand {
+    static summary = 'Remove a stored secret (--force when services still reference it)';
+    static examples = [
+        '<%= config.bin %> machines dedicated service secret rm <lease-id> <name>',
+        '<%= config.bin %> machines dedicated service secret rm <lease-id> <name> --force',
+    ];
+    static args = {
+        lease: core_1.Args.string({
+            description: dedicated_service_command_1.SERVICE_LEASE_ARG_DESCRIPTION,
+            required: true,
+            ignoreStdin: true,
+        }),
+        name: core_1.Args.string({ description: 'Secret name', required: true, ignoreStdin: true }),
+    };
+    static flags = {
+        force: core_1.Flags.boolean({ description: 'Remove even when services still reference the name' }),
+        json: core_1.Flags.boolean({ description: 'Output the result as JSON' }),
+    };
+    async run() {
+        this.requireAuth();
+        const { args, flags } = await this.parse(DedicatedServiceSecretRm);
+        const leaseId = await this.resolveLeaseArg(args.lease);
+        if (!dedicated_service_1.SERVICE_SECRET_NAME_PATTERN.test(args.name)) {
+            this.error(`Invalid secret name ${args.name} — must start with a letter or _ and use only letters, digits, _, ., - (max 128).`, { exit: 2 });
+        }
+        const result = await this.callService('secret', {
+            leaseId,
+            op: 'rm',
+            name: args.name,
+            ...(flags.force ? { force: true } : {}),
+            ...this.scopeFrom(flags),
+        });
+        this.closeServiceChannel();
+        if (flags.json) {
+            this.log(JSON.stringify(result ?? { name: args.name, op: 'rm' }, null, 2));
+            return;
+        }
+        this.log(`Secret ${args.name} removed.`);
+    }
+}
+exports.default = DedicatedServiceSecretRm;

package/dist/commands/machines/dedicated/service/secret/set.d.ts

@@ -0,0 +1,22 @@
+import { DedicatedServiceCommand } from '../../../../../lib/dedicated-service-command';
+/**
+ * `skrr machines dedicated service secret set` — store a value the daemon
+ * resolves at spawn when a spec's env carries `secret://<name>` (phase 2).
+ *
+ * The value travels the admitted channel once; after that only the name is
+ * ever spoken — in the spec, in status output, in the audit entry.
+ */
+export default class DedicatedServiceSecretSet extends DedicatedServiceCommand {
+    static summary: string;
+    static examples: string[];
+    static args: {
+        lease: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+        name: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        value: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        'from-file': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/machines/dedicated/service/secret/set.js

@@ -0,0 +1,93 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const node_fs_1 = require("node:fs");
+const core_1 = require("@oclif/core");
+const dedicated_service_command_1 = require("../../../../../lib/dedicated-service-command");
+const dedicated_service_1 = require("../../../../../lib/dedicated-service");
+/** Read the secret's bytes: --value, --from-file, or piped stdin. */
+async function readSecretValue(command, flags) {
+    if (flags.value !== undefined && flags['from-file']) {
+        command.error('Give the secret once: --value or --from-file, not both.', { exit: 2 });
+    }
+    if (flags['from-file']) {
+        try {
+            return (0, node_fs_1.readFileSync)(flags['from-file'], 'utf8');
+        }
+        catch (err) {
+            command.error(`Cannot read ${flags['from-file']}: ${err instanceof Error ? err.message : err}`, { exit: 2 });
+        }
+    }
+    if (flags.value !== undefined)
+        return flags.value;
+    if (process.stdin.isTTY) {
+        command.error('No secret value given. Pipe it on stdin, or pass --value / --from-file.', {
+            exit: 2,
+        });
+    }
+    const chunks = [];
+    for await (const chunk of process.stdin) {
+        chunks.push(typeof chunk === 'string' ? Buffer.from(chunk) : chunk);
+    }
+    const value = Buffer.concat(chunks).toString('utf8');
+    if (!value) {
+        command.error('The secret value on stdin was empty.', { exit: 2 });
+    }
+    return value;
+}
+/**
+ * `skrr machines dedicated service secret set` — store a value the daemon
+ * resolves at spawn when a spec's env carries `secret://<name>` (phase 2).
+ *
+ * The value travels the admitted channel once; after that only the name is
+ * ever spoken — in the spec, in status output, in the audit entry.
+ */
+class DedicatedServiceSecretSet extends dedicated_service_command_1.DedicatedServiceCommand {
+    static summary = 'Store a secret a service spec can reference as secret://<name>';
+    static examples = [
+        'echo "$TOKEN" | <%= config.bin %> machines dedicated service secret set <lease-id> registry-token',
+        '<%= config.bin %> machines dedicated service secret set <lease-id> app-env --from-file .env.production',
+    ];
+    static args = {
+        lease: core_1.Args.string({
+            description: dedicated_service_command_1.SERVICE_LEASE_ARG_DESCRIPTION,
+            required: true,
+            ignoreStdin: true,
+        }),
+        name: core_1.Args.string({
+            description: 'Secret name the spec references',
+            required: true,
+            ignoreStdin: true,
+        }),
+    };
+    static flags = {
+        value: core_1.Flags.string({
+            description: 'The secret value (prefer stdin — flags show in shell history)',
+        }),
+        'from-file': core_1.Flags.string({ description: 'Read the secret value from a file' }),
+        json: core_1.Flags.boolean({ description: 'Output the result as JSON' }),
+    };
+    async run() {
+        this.requireAuth();
+        const { args, flags } = await this.parse(DedicatedServiceSecretSet);
+        const leaseId = await this.resolveLeaseArg(args.lease);
+        if (!dedicated_service_1.SERVICE_SECRET_NAME_PATTERN.test(args.name)) {
+            this.error(`Invalid secret name ${args.name} — must start with a letter or _ and use only letters, digits, _, ., - (max 128).`, { exit: 2 });
+        }
+        const value = await readSecretValue(this, flags);
+        const result = await this.callService('secret', {
+            leaseId,
+            op: 'set',
+            name: args.name,
+            value,
+            ...this.scopeFrom(flags),
+        });
+        this.closeServiceChannel();
+        if (flags.json) {
+            this.log(JSON.stringify(result ?? { name: args.name, op: 'set' }, null, 2));
+            return;
+        }
+        this.log(`Secret ${args.name} stored. Reference it in a spec as "secret://${args.name}" in an env value, ` +
+            'then `service restart` the referencing services.');
+    }
+}
+exports.default = DedicatedServiceSecretSet;

package/dist/commands/machines/dedicated/service/start.d.ts

@@ -0,0 +1,14 @@
+import { DedicatedServiceCommand } from '../../../../lib/dedicated-service-command';
+/** `skrr machines dedicated service start` — desired state back to running. */
+export default class DedicatedServiceStart extends DedicatedServiceCommand {
+    static summary: string;
+    static examples: string[];
+    static args: {
+        lease: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+        name: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/machines/dedicated/service/start.js

@@ -0,0 +1,29 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const dedicated_service_command_1 = require("../../../../lib/dedicated-service-command");
+/** `skrr machines dedicated service start` — desired state back to running. */
+class DedicatedServiceStart extends dedicated_service_command_1.DedicatedServiceCommand {
+    static summary = 'Set a service’s desired state to running';
+    static examples = [
+        '<%= config.bin %> machines dedicated service start <lease-id> <name>',
+    ];
+    static args = {
+        lease: core_1.Args.string({
+            description: dedicated_service_command_1.SERVICE_LEASE_ARG_DESCRIPTION,
+            required: true,
+            ignoreStdin: true,
+        }),
+        name: core_1.Args.string({ description: 'Service name', required: true, ignoreStdin: true }),
+    };
+    static flags = {
+        json: core_1.Flags.boolean({ description: 'Output the result as JSON' }),
+    };
+    async run() {
+        this.requireAuth();
+        const { args, flags } = await this.parse(DedicatedServiceStart);
+        const leaseId = await this.resolveLeaseArg(args.lease);
+        await this.runServiceAction(leaseId, args.name, 'start', flags);
+    }
+}
+exports.default = DedicatedServiceStart;

package/dist/commands/machines/dedicated/service/status.d.ts

@@ -0,0 +1,21 @@
+import { DedicatedServiceCommand } from '../../../../lib/dedicated-service-command';
+/**
+ * `skrr machines dedicated service status` — one service, as the machine
+ * computes it right now: the spec it reconciles, the state it derived, and
+ * the exits it has seen.
+ *
+ * Status is computed from `spec + live children`, never stored — so what
+ * prints here is what the reconciler believes, not a record that can drift.
+ */
+export default class DedicatedServiceStatus extends DedicatedServiceCommand {
+    static summary: string;
+    static examples: string[];
+    static args: {
+        lease: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+        name: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/machines/dedicated/service/status.js

@@ -0,0 +1,85 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const dedicated_service_command_1 = require("../../../../lib/dedicated-service-command");
+const format_1 = require("../../../../lib/format");
+const dedicated_service_1 = require("../../../../lib/dedicated-service");
+/**
+ * `skrr machines dedicated service status` — one service, as the machine
+ * computes it right now: the spec it reconciles, the state it derived, and
+ * the exits it has seen.
+ *
+ * Status is computed from `spec + live children`, never stored — so what
+ * prints here is what the reconciler believes, not a record that can drift.
+ */
+class DedicatedServiceStatus extends dedicated_service_command_1.DedicatedServiceCommand {
+    static summary = 'Show one service: spec, computed status and recent exits';
+    static examples = [
+        '<%= config.bin %> machines dedicated service status <lease-id> <name>',
+        '<%= config.bin %> machines dedicated service status <lease-id> <name> --json',
+    ];
+    static args = {
+        lease: core_1.Args.string({
+            description: dedicated_service_command_1.SERVICE_LEASE_ARG_DESCRIPTION,
+            required: true,
+            ignoreStdin: true,
+        }),
+        name: core_1.Args.string({ description: 'Service name', required: true, ignoreStdin: true }),
+    };
+    static flags = {
+        json: core_1.Flags.boolean({ description: 'Output as JSON' }),
+    };
+    async run() {
+        this.requireAuth();
+        const { args, flags } = await this.parse(DedicatedServiceStatus);
+        const leaseId = await this.resolveLeaseArg(args.lease);
+        const result = await this.callService('get', {
+            leaseId,
+            name: args.name,
+            ...this.scopeFrom(flags),
+        });
+        this.closeServiceChannel();
+        if (flags.json) {
+            this.log(JSON.stringify(result ?? {}, null, 2));
+            return;
+        }
+        const spec = result?.spec ?? {};
+        this.log(`service ${args.name} on ${leaseId}`);
+        const row = (label, value) => {
+            const cell = (0, format_1.formatCell)(value);
+            if (cell !== '-')
+                this.log(`  ${label.padEnd(13)}${cell}`);
+        };
+        // The wire's detail is an object (reason/exitCode/signal/restarts/…),
+        // not a string — serviceDetailText renders its fields or the row prints
+        // "[object Object]".
+        const detailText = (0, dedicated_service_1.serviceDetailText)(result?.detail);
+        row('status', [result?.status, detailText].filter(Boolean).join(' — ') || undefined);
+        row('restart', spec.restart);
+        row('command', Array.isArray(spec.command) ? spec.command.join(' ') : spec.shell);
+        row('cwd', spec.cwd);
+        row('created by', spec.createdBy);
+        row('revision', spec.revision);
+        row('notify', spec.notify === undefined ? undefined : String(spec.notify));
+        row('disabled', spec.disabled === undefined ? undefined : String(spec.disabled));
+        row('updated', spec.updatedAt ? (0, format_1.localStamp)(spec.updatedAt) : undefined);
+        const exits = result?.exits ?? [];
+        if (exits.length > 0) {
+            this.log('');
+            this.log('recent exits:');
+            (0, format_1.renderTable)(exits.slice(-10).map((exit) => ({
+                at: (0, format_1.formatCell)(exit.at ? (0, format_1.localStamp)(exit.at) : undefined),
+                code: (0, format_1.formatCell)(exit.exitCode ?? '-'),
+                signal: (0, format_1.formatCell)(exit.signal ?? '-'),
+            })), [
+                { key: 'at', header: 'AT' },
+                { key: 'code', header: 'EXIT' },
+                { key: 'signal', header: 'SIGNAL' },
+            ], (line) => this.log(line));
+        }
+        this.log('');
+        this.log('spec:');
+        this.log(JSON.stringify(spec, null, 2));
+    }
+}
+exports.default = DedicatedServiceStatus;

package/dist/commands/machines/dedicated/service/stop.d.ts

@@ -0,0 +1,20 @@
+import { DedicatedServiceCommand } from '../../../../lib/dedicated-service-command';
+/**
+ * `skrr machines dedicated service stop` — desired state to stopped.
+ *
+ * This is the ONLY durable stop: it changes declared intent, so it survives
+ * the same restarts, checkpoints and replacements the service itself does.
+ * Killing the process is a symptom; stopping the declaration is the act.
+ */
+export default class DedicatedServiceStop extends DedicatedServiceCommand {
+    static summary: string;
+    static examples: string[];
+    static args: {
+        lease: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+        name: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/machines/dedicated/service/stop.js

@@ -0,0 +1,35 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const dedicated_service_command_1 = require("../../../../lib/dedicated-service-command");
+/**
+ * `skrr machines dedicated service stop` — desired state to stopped.
+ *
+ * This is the ONLY durable stop: it changes declared intent, so it survives
+ * the same restarts, checkpoints and replacements the service itself does.
+ * Killing the process is a symptom; stopping the declaration is the act.
+ */
+class DedicatedServiceStop extends dedicated_service_command_1.DedicatedServiceCommand {
+    static summary = 'Set a service’s desired state to stopped (survives machine restarts)';
+    static examples = [
+        '<%= config.bin %> machines dedicated service stop <lease-id> <name>',
+    ];
+    static args = {
+        lease: core_1.Args.string({
+            description: dedicated_service_command_1.SERVICE_LEASE_ARG_DESCRIPTION,
+            required: true,
+            ignoreStdin: true,
+        }),
+        name: core_1.Args.string({ description: 'Service name', required: true, ignoreStdin: true }),
+    };
+    static flags = {
+        json: core_1.Flags.boolean({ description: 'Output the result as JSON' }),
+    };
+    async run() {
+        this.requireAuth();
+        const { args, flags } = await this.parse(DedicatedServiceStop);
+        const leaseId = await this.resolveLeaseArg(args.lease);
+        await this.runServiceAction(leaseId, args.name, 'stop', flags);
+    }
+}
+exports.default = DedicatedServiceStop;