@skrr-ai/cli 0.1.46 → 0.1.48

package/dist/commands/machines/dedicated/service/edit.js

@@ -0,0 +1,146 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const node_fs_1 = require("node:fs");
+const node_os_1 = require("node:os");
+const node_path_1 = __importDefault(require("node:path"));
+const node_child_process_1 = require("node:child_process");
+const core_1 = require("@oclif/core");
+const dedicated_service_command_1 = require("../../../../lib/dedicated-service-command");
+const dedicated_service_1 = require("../../../../lib/dedicated-service");
+/** How many times a CAS conflict re-seeds the editor before giving up. */
+const EDIT_CONFLICT_ROUNDS = 3;
+/**
+ * `skrr machines dedicated service edit` — change a running declaration in
+ * $EDITOR, applied as a compare-and-swap update.
+ *
+ * The round-trip is honest about the race it cannot hide: the daemon owns the
+ * spec and increments `revision` on every write, so an edit made against a
+ * stale read is refused `conflict`, never merged. When that happens your edit
+ * is saved to a named file, the editor re-opens on the CURRENT spec, and you
+ * re-apply — three rounds, then the command gives up with the file named.
+ */
+class DedicatedServiceEdit extends dedicated_service_command_1.DedicatedServiceCommand {
+    static summary = 'Edit a service spec in $EDITOR and apply it (CAS update)';
+    static examples = [
+        '<%= config.bin %> machines dedicated service edit <lease-id> <name>',
+    ];
+    static args = {
+        lease: core_1.Args.string({
+            description: dedicated_service_command_1.SERVICE_LEASE_ARG_DESCRIPTION,
+            required: true,
+            ignoreStdin: true,
+        }),
+        name: core_1.Args.string({ description: 'Service name', required: true, ignoreStdin: true }),
+    };
+    static flags = {
+        editor: core_1.Flags.string({ description: 'Editor to use (default $VISUAL, $EDITOR, then vi)' }),
+        json: core_1.Flags.boolean({ description: 'Output the updated spec as JSON' }),
+    };
+    async run() {
+        this.requireAuth();
+        const { args, flags } = await this.parse(DedicatedServiceEdit);
+        const leaseId = await this.resolveLeaseArg(args.lease);
+        const editor = flags.editor ?? process.env.VISUAL ?? process.env.EDITOR ?? 'vi';
+        const channel = await this.serviceChannel();
+        const dir = (0, node_fs_1.mkdtempSync)(node_path_1.default.join((0, node_os_1.tmpdir)(), 'skrr-svc-edit-'));
+        const file = node_path_1.default.join(dir, `${args.name}.json`);
+        // Set on every path that NAMES the temp file for the user — an error that
+        // says "your edit is at <file>" must leave the file standing.
+        let keepDir = false;
+        try {
+            for (let round = 1; round <= EDIT_CONFLICT_ROUNDS; round += 1) {
+                const { result } = await channel.call('get', {
+                    leaseId,
+                    name: args.name,
+                    ...this.scopeFrom(flags),
+                });
+                const spec = result?.spec;
+                if (!spec) {
+                    this.error(`No service named ${args.name} on ${leaseId}.`, { exit: 1 });
+                }
+                const baseRevision = typeof spec.revision === 'number' ? spec.revision : undefined;
+                (0, node_fs_1.writeFileSync)(file, `${JSON.stringify(spec, null, 2)}\n`);
+                const edited = await this.editFile(file, editor);
+                if (edited === null) {
+                    this.log('Unchanged — nothing applied.');
+                    return;
+                }
+                let next;
+                try {
+                    next = (0, dedicated_service_1.parseServiceSpecDocument)(edited, file);
+                }
+                catch (err) {
+                    keepDir = true;
+                    // Keep the file so the person can fix it by hand and apply it.
+                    this.error(`${err instanceof Error ? err.message : err}\nYour edit is still at ${file} — fix it and run \`${this.config.bin} machines dedicated service apply ${leaseId} --file ${file}\`, or re-run edit.`, { exit: 2 });
+                }
+                try {
+                    const { result: updated } = await channel.call('update', {
+                        leaseId,
+                        name: args.name,
+                        patch: (0, dedicated_service_1.specPayload)(next),
+                        baseRevision,
+                        ...this.scopeFrom(flags),
+                    });
+                    this.closeServiceChannel();
+                    if (flags.json) {
+                        this.log(JSON.stringify(updated ?? (0, dedicated_service_1.specPayload)(next), null, 2));
+                        return;
+                    }
+                    this.log(`Service ${args.name} updated on ${leaseId}.`);
+                    return;
+                }
+                catch (err) {
+                    if (!(err instanceof dedicated_service_1.DedicatedServiceError && err.code === 'conflict')) {
+                        this.reportServiceError(err);
+                    }
+                    // CAS lost: preserve the edit, say where, and re-seed the editor
+                    // with the spec as it actually is now.
+                    const rejected = `${file}.rejected-${round}.json`;
+                    (0, node_fs_1.writeFileSync)(rejected, edited);
+                    if (round === EDIT_CONFLICT_ROUNDS) {
+                        keepDir = true;
+                        this.error(`The spec changed underneath the edit ${EDIT_CONFLICT_ROUNDS} times in a row. ` +
+                            `Your last edit is at ${rejected} — apply it by hand with \`${this.config.bin} machines dedicated service apply ${leaseId} --file ${rejected}\` once the machine settles.`, { exit: 1 });
+                    }
+                    keepDir = true;
+                    process.stderr.write(`[edit] the spec changed since you opened it; your edit is saved at ${rejected} and the editor re-opens on the current spec.\n`);
+                }
+            }
+        }
+        finally {
+            if (!keepDir) {
+                try {
+                    (0, node_fs_1.rmSync)(dir, { recursive: true, force: true });
+                }
+                catch {
+                    /* a file the user still needs is worth more than a clean tmpdir */
+                }
+            }
+        }
+    }
+    /**
+     * Run the editor over the temp file. Returns the new contents, or null when
+     * the file is byte-identical — an unopened or untouched edit applies
+     * nothing, which is the honest answer to "I looked and left".
+     */
+    async editFile(file, editor) {
+        const before = (0, node_fs_1.readFileSync)(file, 'utf8');
+        // sh -c so "code --wait" and friends work as one flag value.
+        const spawned = (0, node_child_process_1.spawnSync)('sh', ['-c', `${editor} "$1"`, 'sh', file], {
+            stdio: 'inherit',
+        });
+        if (spawned.error) {
+            this.error(`Could not run ${editor}: ${spawned.error.message}`, { exit: 1 });
+        }
+        if (spawned.status !== 0) {
+            this.error(`${editor} exited ${spawned.status}; nothing was applied.`, { exit: 1 });
+        }
+        const after = (0, node_fs_1.readFileSync)(file, 'utf8');
+        return after === before ? null : after;
+    }
+}
+exports.default = DedicatedServiceEdit;

package/dist/commands/machines/dedicated/service/exec.d.ts

@@ -0,0 +1,26 @@
+import { DedicatedServiceCommand } from '../../../../lib/dedicated-service-command';
+/**
+ * `skrr machines dedicated service exec` — a one-off command inside a
+ * service's context (phase 2).
+ *
+ * The spawn carries the service's cwd, env and cgroup scope, so it lands in
+ * the service's process tree and shares its fate — the honest way to debug a
+ * service whose environment the daemon holds. A daemon that predates the
+ * extension refuses cleanly; `machines dedicated exec` is the always-there
+ * fallback for ad-hoc commands.
+ */
+export default class DedicatedServiceExec extends DedicatedServiceCommand {
+    static summary: string;
+    static examples: string[];
+    static usage: string;
+    static args: {
+        lease: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+        name: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+        command: import("@oclif/core/lib/interfaces").Arg<string[] | undefined, Record<string, unknown>>;
+    };
+    static flags: {
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+        timeout: import("@oclif/core/lib/interfaces").OptionFlag<number | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/machines/dedicated/service/exec.js

@@ -0,0 +1,92 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const dedicated_service_command_1 = require("../../../../lib/dedicated-service-command");
+const exec_1 = require("../../hosted/exec");
+/**
+ * `skrr machines dedicated service exec` — a one-off command inside a
+ * service's context (phase 2).
+ *
+ * The spawn carries the service's cwd, env and cgroup scope, so it lands in
+ * the service's process tree and shares its fate — the honest way to debug a
+ * service whose environment the daemon holds. A daemon that predates the
+ * extension refuses cleanly; `machines dedicated exec` is the always-there
+ * fallback for ad-hoc commands.
+ */
+class DedicatedServiceExec extends dedicated_service_command_1.DedicatedServiceCommand {
+    static summary = 'Run a one-off command in a service’s context (phase 2)';
+    static examples = [
+        '<%= config.bin %> machines dedicated service exec <lease-id> <name> -- printenv',
+        '<%= config.bin %> machines dedicated service exec <lease-id> <name> -- cat /workspace/services/name/state.json',
+    ];
+    static usage = 'machines dedicated service exec <lease-id> <name> -- <command...>';
+    static args = {
+        lease: core_1.Args.string({
+            description: dedicated_service_command_1.SERVICE_LEASE_ARG_DESCRIPTION,
+            required: true,
+            ignoreStdin: true,
+        }),
+        name: core_1.Args.string({ description: 'Service name', required: true, ignoreStdin: true }),
+        command: core_1.Args.string({
+            description: 'The command and its arguments, after --',
+            multiple: true,
+            required: false,
+            ignoreStdin: true,
+        }),
+    };
+    static flags = {
+        json: core_1.Flags.boolean({ description: 'Output the result as JSON' }),
+        timeout: core_1.Flags.integer({
+            description: 'Seconds the command may run on the machine (1-600, default 300)',
+            min: 1,
+            max: 600,
+        }),
+    };
+    async run() {
+        this.requireAuth();
+        const { head, tail } = (0, exec_1.splitExecArgv)(this.argv);
+        const { args, flags } = await this.parse(DedicatedServiceExec, head);
+        const argv = tail ?? args.command ?? [];
+        if (argv.length === 0) {
+            this.error('Command is required — pass it after --.', { exit: 2 });
+        }
+        const leaseId = await this.resolveLeaseArg(args.lease);
+        // Phase-2 verb: `dedicated:service:exec {leaseId, name, argv}`. A daemon
+        // without the extension answers with the unsupported path — the command
+        // degrades, it does not improvise.
+        const timeoutSeconds = flags.timeout ?? 300;
+        const result = await this.callService('exec', {
+            leaseId,
+            name: args.name,
+            argv,
+            timeoutSeconds,
+            ...this.scopeFrom(flags),
+        }, 
+        // The relay waits timeoutSeconds+30s; the caller must outlive that or a
+        // legitimately long exec reports a false connectivity failure.
+        (timeoutSeconds + 45) * 1000);
+        this.closeServiceChannel();
+        if (flags.json) {
+            this.log(JSON.stringify(result ?? {}, null, 2));
+        }
+        else {
+            // Binary-safe: the wire contract is base64 — write the decoded bytes
+            // verbatim; a debug verb that utf8-mangles or appends newlines lies
+            // about what the service emitted.
+            const stdout = result?.stdoutBase64
+                ? Buffer.from(result.stdoutBase64, 'base64')
+                : Buffer.from(result?.stdout ?? '', 'utf8');
+            const stderr = result?.stderrBase64
+                ? Buffer.from(result.stderrBase64, 'base64')
+                : Buffer.from(result?.stderr ?? '', 'utf8');
+            if (stdout.length > 0)
+                process.stdout.write(stdout);
+            if (stderr.length > 0)
+                process.stderr.write(stderr);
+        }
+        const exitCode = typeof result?.exitCode === 'number' ? result.exitCode : 0;
+        if (exitCode !== 0)
+            this.exit(exitCode);
+    }
+}
+exports.default = DedicatedServiceExec;

package/dist/commands/machines/dedicated/service/export.d.ts

@@ -0,0 +1,29 @@
+import { DedicatedServiceCommand } from '../../../../lib/dedicated-service-command';
+/** Shape written by `service export` and accepted by `service apply --file`. */
+export declare const SERVICE_SPEC_EXPORT_VERSION = 1;
+/**
+ * `skrr machines dedicated service export` — the stored spec as a repo
+ * `service.json` (phase 2).
+ *
+ * The artifact is the apply-able document: the daemon's bookkeeping
+ * (`revision`, `createdBy`, timestamps) is stripped, forward fields are kept
+ * verbatim, so `--output service.json` is exactly what
+ * `service apply --file service.json` takes on this machine or another one.
+ * Like every export verb it asks for a destination — `--summary`,
+ * `--output <path>` or `--output -` for deliberate stdout — rather than
+ * spilling a spec onto the terminal because a flag was forgotten.
+ */
+export default class DedicatedServiceExport extends DedicatedServiceCommand {
+    static summary: string;
+    static examples: string[];
+    static args: {
+        lease: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+        name: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        summary: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+        output: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/machines/dedicated/service/export.js

@@ -0,0 +1,106 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SERVICE_SPEC_EXPORT_VERSION = void 0;
+const core_1 = require("@oclif/core");
+const dedicated_service_command_1 = require("../../../../lib/dedicated-service-command");
+const dedicated_service_1 = require("../../../../lib/dedicated-service");
+const artifact_export_1 = require("../../../../lib/artifact-export");
+/** Shape written by `service export` and accepted by `service apply --file`. */
+exports.SERVICE_SPEC_EXPORT_VERSION = 1;
+/**
+ * `skrr machines dedicated service export` — the stored spec as a repo
+ * `service.json` (phase 2).
+ *
+ * The artifact is the apply-able document: the daemon's bookkeeping
+ * (`revision`, `createdBy`, timestamps) is stripped, forward fields are kept
+ * verbatim, so `--output service.json` is exactly what
+ * `service apply --file service.json` takes on this machine or another one.
+ * Like every export verb it asks for a destination — `--summary`,
+ * `--output <path>` or `--output -` for deliberate stdout — rather than
+ * spilling a spec onto the terminal because a flag was forgotten.
+ */
+class DedicatedServiceExport extends dedicated_service_command_1.DedicatedServiceCommand {
+    static summary = 'Export a stored spec in the repo service.json form';
+    static examples = [
+        '<%= config.bin %> machines dedicated service export <lease-id> <name> --output service.json',
+        '<%= config.bin %> machines dedicated service export <lease-id> <name> --output - | jq .',
+        '<%= config.bin %> machines dedicated service export <lease-id> <name> --summary',
+    ];
+    static args = {
+        lease: core_1.Args.string({
+            description: dedicated_service_command_1.SERVICE_LEASE_ARG_DESCRIPTION,
+            required: true,
+            ignoreStdin: true,
+        }),
+        name: core_1.Args.string({ description: 'Service name', required: true, ignoreStdin: true }),
+    };
+    static flags = {
+        ...(0, artifact_export_1.standardExportFlags)(),
+    };
+    async run() {
+        this.requireAuth();
+        const { args, flags } = await this.parse(DedicatedServiceExport);
+        let selection;
+        try {
+            selection = (0, artifact_export_1.resolveExportSelection)(flags);
+        }
+        catch (err) {
+            if (err instanceof artifact_export_1.ExportContractError) {
+                this.failWithCliError({
+                    message: err.message,
+                    code: err.code,
+                    exit: 2,
+                    retryable: false,
+                });
+            }
+            throw err;
+        }
+        const leaseId = await this.resolveLeaseArg(args.lease);
+        const result = await this.callService('get', {
+            leaseId,
+            name: args.name,
+            ...this.scopeFrom(flags),
+        });
+        this.closeServiceChannel();
+        if (!result?.spec) {
+            this.error(`No service named ${args.name} on ${leaseId}.`, { exit: 1 });
+        }
+        if (selection.summary) {
+            const summary = (0, artifact_export_1.contentFreeSummary)({
+                command: 'machines dedicated service export',
+                artifactSchemaVersion: exports.SERVICE_SPEC_EXPORT_VERSION,
+                itemCount: 1,
+                counts: { services: 1 },
+            });
+            this.log(selection.json ? JSON.stringify(summary, null, 2) : (0, artifact_export_1.humanExportSummary)(summary));
+            return;
+        }
+        const serialized = (0, artifact_export_1.serializedArtifact)((0, dedicated_service_1.specExportDocument)(result.spec));
+        if (selection.output === '-') {
+            this.log(serialized.trimEnd());
+            return;
+        }
+        let receipt;
+        try {
+            receipt = await (0, artifact_export_1.writeExportArtifact)({
+                command: 'machines dedicated service export',
+                artifactSchemaVersion: exports.SERVICE_SPEC_EXPORT_VERSION,
+                format: 'json',
+                output: selection.output,
+                content: serialized,
+                itemCount: 1,
+            });
+        }
+        catch (err) {
+            this.failWithCliError({
+                message: `Could not write ${selection.output}: ${err.message}`,
+                code: 'SERVICE_SPEC_EXPORT_WRITE_FAILED',
+                exit: 1,
+                retryable: false,
+                details: { path: selection.output },
+            });
+        }
+        this.log(selection.json ? JSON.stringify(receipt, null, 2) : (0, artifact_export_1.humanExportReceipt)(receipt));
+    }
+}
+exports.default = DedicatedServiceExport;

package/dist/commands/machines/dedicated/service/index.d.ts

@@ -0,0 +1,14 @@
+import { Command } from '@oclif/core';
+/**
+ * `skrr machines dedicated service` — declared, always-on workloads.
+ *
+ * A detached process dies at every machine boundary; a declared service is
+ * restarted by the machine's daemon across crashes, daemon restarts,
+ * checkpoints, stop→start and instance replacement. This topic is how the
+ * owner declares them.
+ */
+export default class DedicatedMachinesService extends Command {
+    static description: string;
+    static examples: string[];
+    run(): Promise<void>;
+}

package/dist/commands/machines/dedicated/service/index.js

@@ -0,0 +1,49 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+/**
+ * `skrr machines dedicated service` — declared, always-on workloads.
+ *
+ * A detached process dies at every machine boundary; a declared service is
+ * restarted by the machine's daemon across crashes, daemon restarts,
+ * checkpoints, stop→start and instance replacement. This topic is how the
+ * owner declares them.
+ */
+class DedicatedMachinesService extends core_1.Command {
+    static description = 'Declared services on a Dedicated Runtime — workloads the machine keeps running across restarts, checkpoints and replacements';
+    static examples = [
+        '<%= config.bin %> machines dedicated service create <lease-id> --name worker --cwd /workspace/repos/app -- node dist/worker.js',
+        '<%= config.bin %> machines dedicated service apply <lease-id> --file service.json',
+        '<%= config.bin %> machines dedicated service ls <lease-id>',
+        '<%= config.bin %> machines dedicated service status <lease-id> <name>',
+        '<%= config.bin %> machines dedicated service logs <lease-id> <name> -f',
+        '<%= config.bin %> machines dedicated service approve <lease-id> <name>',
+    ];
+    async run() {
+        const rows = [
+            ['create', 'declare a service (argv after --, or --file service.json)'],
+            ['apply', 'create or update a service from a spec file, idempotently'],
+            ['ls', 'list services and pending agent proposals'],
+            ['status', 'one service: spec, computed status and recent exits'],
+            ['edit', 'edit the spec in $EDITOR and apply it (CAS update)'],
+            ['logs', 'print a service log; -f follows'],
+            ['start', 'set desired state to running'],
+            ['stop', 'set desired state to stopped; survives machine restarts'],
+            ['restart', 'restart the service now'],
+            ['rm', 'remove the declaration'],
+            ['approve', 'approve (--reject to refuse) an agent-proposed service'],
+            ['exec', 'run a one-off command inside a service’s context (phase 2)'],
+            ['top', 'per-service cpu/mem/pids (phase 2)'],
+            ['export', 'print the repo service.json form of a stored spec'],
+            ['secret', 'set or remove a secret a spec can reference (phase 2)'],
+        ];
+        this.log('skrr machines dedicated service commands:');
+        for (const [name, summary] of rows) {
+            this.log(`  skrr machines dedicated service ${name.padEnd(8)} ${summary}`);
+        }
+        this.log('');
+        this.log('Every command takes a lease id (or `self` on the machine) and --json. ' +
+            'Agents on the machine propose services instead: `skrr service propose`.');
+    }
+}
+exports.default = DedicatedMachinesService;

package/dist/commands/machines/dedicated/service/logs.d.ts

@@ -0,0 +1,33 @@
+import { DedicatedServiceCommand } from '../../../../lib/dedicated-service-command';
+/**
+ * `skrr machines dedicated service logs` — tail the service's log, or follow it.
+ *
+ * The daemon rotates a bounded `current` log per service; `logs` replays a
+ * byte tail of it and `-f` keeps the stream open on live
+ * `dedicated:service:log` frames. Ctrl-C ends the follow cleanly — the
+ * stream is closed with `logs:stop`, the service keeps running.
+ *
+ * While a follow is open, an agent proposal arriving on the same channel is
+ * surfaced on stderr: the owner watching logs is exactly the owner who can
+ * approve it.
+ */
+export default class DedicatedServiceLogs extends DedicatedServiceCommand {
+    static summary: string;
+    static examples: string[];
+    static args: {
+        lease: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+        name: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        follow: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+        tail: import("@oclif/core/lib/interfaces").OptionFlag<number | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+    /**
+     * The machine-readable follow: each log frame is one JSON line. An ack's
+     * refusal surfaces through the same channel.call error path as every other
+     * verb (a `--json` caller reads the CLI error envelope).
+     */
+    private followJson;
+}

package/dist/commands/machines/dedicated/service/logs.js

@@ -0,0 +1,148 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const dedicated_service_command_1 = require("../../../../lib/dedicated-service-command");
+const dedicated_service_1 = require("../../../../lib/dedicated-service");
+/**
+ * `skrr machines dedicated service logs` — tail the service's log, or follow it.
+ *
+ * The daemon rotates a bounded `current` log per service; `logs` replays a
+ * byte tail of it and `-f` keeps the stream open on live
+ * `dedicated:service:log` frames. Ctrl-C ends the follow cleanly — the
+ * stream is closed with `logs:stop`, the service keeps running.
+ *
+ * While a follow is open, an agent proposal arriving on the same channel is
+ * surfaced on stderr: the owner watching logs is exactly the owner who can
+ * approve it.
+ */
+class DedicatedServiceLogs extends dedicated_service_command_1.DedicatedServiceCommand {
+    static summary = 'Print a service’s log; -f follows live output';
+    static examples = [
+        '<%= config.bin %> machines dedicated service logs <lease-id> <name>',
+        '<%= config.bin %> machines dedicated service logs <lease-id> <name> -f',
+        '<%= config.bin %> machines dedicated service logs <lease-id> <name> --tail 65536',
+    ];
+    static args = {
+        lease: core_1.Args.string({
+            description: dedicated_service_command_1.SERVICE_LEASE_ARG_DESCRIPTION,
+            required: true,
+            ignoreStdin: true,
+        }),
+        name: core_1.Args.string({ description: 'Service name', required: true, ignoreStdin: true }),
+    };
+    static flags = {
+        follow: core_1.Flags.boolean({
+            description: 'Keep the stream open on live log frames (Ctrl-C ends the follow, not the service)',
+            char: 'f',
+        }),
+        tail: core_1.Flags.integer({
+            description: 'Bytes from the end of the stored log to print first (daemon rotates at 8 MiB)',
+            min: 0,
+        }),
+        json: core_1.Flags.boolean({ description: 'Emit log frames as JSON objects' }),
+    };
+    async run() {
+        this.requireAuth();
+        const { args, flags } = await this.parse(DedicatedServiceLogs);
+        const leaseId = await this.resolveLeaseArg(args.lease);
+        if (flags.json) {
+            // --json emits one frame per line — a follow a program can consume.
+            // Proposals surface as frames too rather than stderr prose.
+            const code = await this.followJson(leaseId, args.name, flags);
+            if (code !== 0)
+                this.exit(code);
+            return;
+        }
+        let code;
+        try {
+            code = await (0, dedicated_service_1.streamServiceLogs)({
+                baseURL: this.cliConfig.baseURL,
+                token: this.resolvedCredential.token,
+                leaseId,
+                name: args.name,
+                follow: flags.follow,
+                tailBytes: flags.tail,
+                output: process.stdout,
+                errorOutput: process.stderr,
+            });
+        }
+        catch (err) {
+            this.reportServiceError(err);
+        }
+        if (code !== 0)
+            this.exit(code);
+    }
+    /**
+     * The machine-readable follow: each log frame is one JSON line. An ack's
+     * refusal surfaces through the same channel.call error path as every other
+     * verb (a `--json` caller reads the CLI error envelope).
+     */
+    async followJson(leaseId, name, flags) {
+        const channel = new dedicated_service_1.DedicatedServiceChannel({
+            baseURL: this.cliConfig.baseURL,
+            token: this.resolvedCredential.token,
+        });
+        return new Promise((resolve, reject) => {
+            let streamId = null;
+            let finished = false;
+            let closedByServer = false;
+            const onSigint = () => finish(0);
+            const finish = (code) => {
+                if (finished)
+                    return;
+                finished = true;
+                process.off('SIGINT', onSigint);
+                if (streamId && flags.follow && !closedByServer) {
+                    channel.send(dedicated_service_1.DEDICATED_SERVICE_EVENTS.logsStop, { leaseId, name, streamId });
+                }
+                channel.close();
+                resolve(code);
+            };
+            channel.setOnDead(() => finish(1));
+            channel
+                .open()
+                .then(async () => {
+                process.on('SIGINT', onSigint);
+                channel.on(dedicated_service_1.DEDICATED_SERVICE_EVENTS.log, (frame) => {
+                    if (streamId && frame.streamId && frame.streamId !== streamId)
+                        return;
+                    if (frame.name && frame.name !== name)
+                        return;
+                    this.log(JSON.stringify({ type: 'log', ...frame }));
+                });
+                channel.on(dedicated_service_1.DEDICATED_SERVICE_EVENTS.logClosed, (frame) => {
+                    if (streamId && frame.streamId && frame.streamId !== streamId)
+                        return;
+                    closedByServer = true;
+                    this.log(JSON.stringify({ type: 'closed', ...frame }));
+                    finish(0);
+                });
+                channel.on(dedicated_service_1.DEDICATED_SERVICE_EVENTS.proposed, (frame) => {
+                    this.log(JSON.stringify({ type: 'proposed', ...frame }));
+                });
+                const { result } = await channel.call('logs', {
+                    leaseId,
+                    name,
+                    follow: flags.follow,
+                    ...(flags.tail !== undefined ? { tailBytes: flags.tail } : {}),
+                    ...this.scopeFrom(flags),
+                });
+                streamId = typeof result?.streamId === 'string' ? result.streamId : null;
+                if (typeof result?.data === 'string' && result.data.length > 0) {
+                    this.log(JSON.stringify({ type: 'tail', name, data: result.data }));
+                }
+                if (!flags.follow)
+                    finish(0);
+            })
+                .catch((err) => {
+                // Reject BEFORE closing — disconnect() fires onDead → finish(1),
+                // which would otherwise win the settlement race and mask the refusal.
+                finished = true;
+                process.off('SIGINT', onSigint);
+                reject(err);
+                channel.close();
+            });
+        });
+    }
+}
+exports.default = DedicatedServiceLogs;