@skrr-ai/cli 0.1.47 → 0.1.48

package/dist/commands/machines/dedicated/service/exec.d.ts

@@ -0,0 +1,26 @@
+import { DedicatedServiceCommand } from '../../../../lib/dedicated-service-command';
+/**
+ * `skrr machines dedicated service exec` — a one-off command inside a
+ * service's context (phase 2).
+ *
+ * The spawn carries the service's cwd, env and cgroup scope, so it lands in
+ * the service's process tree and shares its fate — the honest way to debug a
+ * service whose environment the daemon holds. A daemon that predates the
+ * extension refuses cleanly; `machines dedicated exec` is the always-there
+ * fallback for ad-hoc commands.
+ */
+export default class DedicatedServiceExec extends DedicatedServiceCommand {
+    static summary: string;
+    static examples: string[];
+    static usage: string;
+    static args: {
+        lease: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+        name: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+        command: import("@oclif/core/lib/interfaces").Arg<string[] | undefined, Record<string, unknown>>;
+    };
+    static flags: {
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+        timeout: import("@oclif/core/lib/interfaces").OptionFlag<number | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/machines/dedicated/service/exec.js

@@ -0,0 +1,92 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const dedicated_service_command_1 = require("../../../../lib/dedicated-service-command");
+const exec_1 = require("../../hosted/exec");
+/**
+ * `skrr machines dedicated service exec` — a one-off command inside a
+ * service's context (phase 2).
+ *
+ * The spawn carries the service's cwd, env and cgroup scope, so it lands in
+ * the service's process tree and shares its fate — the honest way to debug a
+ * service whose environment the daemon holds. A daemon that predates the
+ * extension refuses cleanly; `machines dedicated exec` is the always-there
+ * fallback for ad-hoc commands.
+ */
+class DedicatedServiceExec extends dedicated_service_command_1.DedicatedServiceCommand {
+    static summary = 'Run a one-off command in a service’s context (phase 2)';
+    static examples = [
+        '<%= config.bin %> machines dedicated service exec <lease-id> <name> -- printenv',
+        '<%= config.bin %> machines dedicated service exec <lease-id> <name> -- cat /workspace/services/name/state.json',
+    ];
+    static usage = 'machines dedicated service exec <lease-id> <name> -- <command...>';
+    static args = {
+        lease: core_1.Args.string({
+            description: dedicated_service_command_1.SERVICE_LEASE_ARG_DESCRIPTION,
+            required: true,
+            ignoreStdin: true,
+        }),
+        name: core_1.Args.string({ description: 'Service name', required: true, ignoreStdin: true }),
+        command: core_1.Args.string({
+            description: 'The command and its arguments, after --',
+            multiple: true,
+            required: false,
+            ignoreStdin: true,
+        }),
+    };
+    static flags = {
+        json: core_1.Flags.boolean({ description: 'Output the result as JSON' }),
+        timeout: core_1.Flags.integer({
+            description: 'Seconds the command may run on the machine (1-600, default 300)',
+            min: 1,
+            max: 600,
+        }),
+    };
+    async run() {
+        this.requireAuth();
+        const { head, tail } = (0, exec_1.splitExecArgv)(this.argv);
+        const { args, flags } = await this.parse(DedicatedServiceExec, head);
+        const argv = tail ?? args.command ?? [];
+        if (argv.length === 0) {
+            this.error('Command is required — pass it after --.', { exit: 2 });
+        }
+        const leaseId = await this.resolveLeaseArg(args.lease);
+        // Phase-2 verb: `dedicated:service:exec {leaseId, name, argv}`. A daemon
+        // without the extension answers with the unsupported path — the command
+        // degrades, it does not improvise.
+        const timeoutSeconds = flags.timeout ?? 300;
+        const result = await this.callService('exec', {
+            leaseId,
+            name: args.name,
+            argv,
+            timeoutSeconds,
+            ...this.scopeFrom(flags),
+        }, 
+        // The relay waits timeoutSeconds+30s; the caller must outlive that or a
+        // legitimately long exec reports a false connectivity failure.
+        (timeoutSeconds + 45) * 1000);
+        this.closeServiceChannel();
+        if (flags.json) {
+            this.log(JSON.stringify(result ?? {}, null, 2));
+        }
+        else {
+            // Binary-safe: the wire contract is base64 — write the decoded bytes
+            // verbatim; a debug verb that utf8-mangles or appends newlines lies
+            // about what the service emitted.
+            const stdout = result?.stdoutBase64
+                ? Buffer.from(result.stdoutBase64, 'base64')
+                : Buffer.from(result?.stdout ?? '', 'utf8');
+            const stderr = result?.stderrBase64
+                ? Buffer.from(result.stderrBase64, 'base64')
+                : Buffer.from(result?.stderr ?? '', 'utf8');
+            if (stdout.length > 0)
+                process.stdout.write(stdout);
+            if (stderr.length > 0)
+                process.stderr.write(stderr);
+        }
+        const exitCode = typeof result?.exitCode === 'number' ? result.exitCode : 0;
+        if (exitCode !== 0)
+            this.exit(exitCode);
+    }
+}
+exports.default = DedicatedServiceExec;

package/dist/commands/machines/dedicated/service/export.d.ts

@@ -0,0 +1,29 @@
+import { DedicatedServiceCommand } from '../../../../lib/dedicated-service-command';
+/** Shape written by `service export` and accepted by `service apply --file`. */
+export declare const SERVICE_SPEC_EXPORT_VERSION = 1;
+/**
+ * `skrr machines dedicated service export` — the stored spec as a repo
+ * `service.json` (phase 2).
+ *
+ * The artifact is the apply-able document: the daemon's bookkeeping
+ * (`revision`, `createdBy`, timestamps) is stripped, forward fields are kept
+ * verbatim, so `--output service.json` is exactly what
+ * `service apply --file service.json` takes on this machine or another one.
+ * Like every export verb it asks for a destination — `--summary`,
+ * `--output <path>` or `--output -` for deliberate stdout — rather than
+ * spilling a spec onto the terminal because a flag was forgotten.
+ */
+export default class DedicatedServiceExport extends DedicatedServiceCommand {
+    static summary: string;
+    static examples: string[];
+    static args: {
+        lease: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+        name: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        summary: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+        output: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/machines/dedicated/service/export.js

@@ -0,0 +1,106 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SERVICE_SPEC_EXPORT_VERSION = void 0;
+const core_1 = require("@oclif/core");
+const dedicated_service_command_1 = require("../../../../lib/dedicated-service-command");
+const dedicated_service_1 = require("../../../../lib/dedicated-service");
+const artifact_export_1 = require("../../../../lib/artifact-export");
+/** Shape written by `service export` and accepted by `service apply --file`. */
+exports.SERVICE_SPEC_EXPORT_VERSION = 1;
+/**
+ * `skrr machines dedicated service export` — the stored spec as a repo
+ * `service.json` (phase 2).
+ *
+ * The artifact is the apply-able document: the daemon's bookkeeping
+ * (`revision`, `createdBy`, timestamps) is stripped, forward fields are kept
+ * verbatim, so `--output service.json` is exactly what
+ * `service apply --file service.json` takes on this machine or another one.
+ * Like every export verb it asks for a destination — `--summary`,
+ * `--output <path>` or `--output -` for deliberate stdout — rather than
+ * spilling a spec onto the terminal because a flag was forgotten.
+ */
+class DedicatedServiceExport extends dedicated_service_command_1.DedicatedServiceCommand {
+    static summary = 'Export a stored spec in the repo service.json form';
+    static examples = [
+        '<%= config.bin %> machines dedicated service export <lease-id> <name> --output service.json',
+        '<%= config.bin %> machines dedicated service export <lease-id> <name> --output - | jq .',
+        '<%= config.bin %> machines dedicated service export <lease-id> <name> --summary',
+    ];
+    static args = {
+        lease: core_1.Args.string({
+            description: dedicated_service_command_1.SERVICE_LEASE_ARG_DESCRIPTION,
+            required: true,
+            ignoreStdin: true,
+        }),
+        name: core_1.Args.string({ description: 'Service name', required: true, ignoreStdin: true }),
+    };
+    static flags = {
+        ...(0, artifact_export_1.standardExportFlags)(),
+    };
+    async run() {
+        this.requireAuth();
+        const { args, flags } = await this.parse(DedicatedServiceExport);
+        let selection;
+        try {
+            selection = (0, artifact_export_1.resolveExportSelection)(flags);
+        }
+        catch (err) {
+            if (err instanceof artifact_export_1.ExportContractError) {
+                this.failWithCliError({
+                    message: err.message,
+                    code: err.code,
+                    exit: 2,
+                    retryable: false,
+                });
+            }
+            throw err;
+        }
+        const leaseId = await this.resolveLeaseArg(args.lease);
+        const result = await this.callService('get', {
+            leaseId,
+            name: args.name,
+            ...this.scopeFrom(flags),
+        });
+        this.closeServiceChannel();
+        if (!result?.spec) {
+            this.error(`No service named ${args.name} on ${leaseId}.`, { exit: 1 });
+        }
+        if (selection.summary) {
+            const summary = (0, artifact_export_1.contentFreeSummary)({
+                command: 'machines dedicated service export',
+                artifactSchemaVersion: exports.SERVICE_SPEC_EXPORT_VERSION,
+                itemCount: 1,
+                counts: { services: 1 },
+            });
+            this.log(selection.json ? JSON.stringify(summary, null, 2) : (0, artifact_export_1.humanExportSummary)(summary));
+            return;
+        }
+        const serialized = (0, artifact_export_1.serializedArtifact)((0, dedicated_service_1.specExportDocument)(result.spec));
+        if (selection.output === '-') {
+            this.log(serialized.trimEnd());
+            return;
+        }
+        let receipt;
+        try {
+            receipt = await (0, artifact_export_1.writeExportArtifact)({
+                command: 'machines dedicated service export',
+                artifactSchemaVersion: exports.SERVICE_SPEC_EXPORT_VERSION,
+                format: 'json',
+                output: selection.output,
+                content: serialized,
+                itemCount: 1,
+            });
+        }
+        catch (err) {
+            this.failWithCliError({
+                message: `Could not write ${selection.output}: ${err.message}`,
+                code: 'SERVICE_SPEC_EXPORT_WRITE_FAILED',
+                exit: 1,
+                retryable: false,
+                details: { path: selection.output },
+            });
+        }
+        this.log(selection.json ? JSON.stringify(receipt, null, 2) : (0, artifact_export_1.humanExportReceipt)(receipt));
+    }
+}
+exports.default = DedicatedServiceExport;

package/dist/commands/machines/dedicated/service/index.d.ts

@@ -0,0 +1,14 @@
+import { Command } from '@oclif/core';
+/**
+ * `skrr machines dedicated service` — declared, always-on workloads.
+ *
+ * A detached process dies at every machine boundary; a declared service is
+ * restarted by the machine's daemon across crashes, daemon restarts,
+ * checkpoints, stop→start and instance replacement. This topic is how the
+ * owner declares them.
+ */
+export default class DedicatedMachinesService extends Command {
+    static description: string;
+    static examples: string[];
+    run(): Promise<void>;
+}

package/dist/commands/machines/dedicated/service/index.js

@@ -0,0 +1,49 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+/**
+ * `skrr machines dedicated service` — declared, always-on workloads.
+ *
+ * A detached process dies at every machine boundary; a declared service is
+ * restarted by the machine's daemon across crashes, daemon restarts,
+ * checkpoints, stop→start and instance replacement. This topic is how the
+ * owner declares them.
+ */
+class DedicatedMachinesService extends core_1.Command {
+    static description = 'Declared services on a Dedicated Runtime — workloads the machine keeps running across restarts, checkpoints and replacements';
+    static examples = [
+        '<%= config.bin %> machines dedicated service create <lease-id> --name worker --cwd /workspace/repos/app -- node dist/worker.js',
+        '<%= config.bin %> machines dedicated service apply <lease-id> --file service.json',
+        '<%= config.bin %> machines dedicated service ls <lease-id>',
+        '<%= config.bin %> machines dedicated service status <lease-id> <name>',
+        '<%= config.bin %> machines dedicated service logs <lease-id> <name> -f',
+        '<%= config.bin %> machines dedicated service approve <lease-id> <name>',
+    ];
+    async run() {
+        const rows = [
+            ['create', 'declare a service (argv after --, or --file service.json)'],
+            ['apply', 'create or update a service from a spec file, idempotently'],
+            ['ls', 'list services and pending agent proposals'],
+            ['status', 'one service: spec, computed status and recent exits'],
+            ['edit', 'edit the spec in $EDITOR and apply it (CAS update)'],
+            ['logs', 'print a service log; -f follows'],
+            ['start', 'set desired state to running'],
+            ['stop', 'set desired state to stopped; survives machine restarts'],
+            ['restart', 'restart the service now'],
+            ['rm', 'remove the declaration'],
+            ['approve', 'approve (--reject to refuse) an agent-proposed service'],
+            ['exec', 'run a one-off command inside a service’s context (phase 2)'],
+            ['top', 'per-service cpu/mem/pids (phase 2)'],
+            ['export', 'print the repo service.json form of a stored spec'],
+            ['secret', 'set or remove a secret a spec can reference (phase 2)'],
+        ];
+        this.log('skrr machines dedicated service commands:');
+        for (const [name, summary] of rows) {
+            this.log(`  skrr machines dedicated service ${name.padEnd(8)} ${summary}`);
+        }
+        this.log('');
+        this.log('Every command takes a lease id (or `self` on the machine) and --json. ' +
+            'Agents on the machine propose services instead: `skrr service propose`.');
+    }
+}
+exports.default = DedicatedMachinesService;

package/dist/commands/machines/dedicated/service/logs.d.ts

@@ -0,0 +1,33 @@
+import { DedicatedServiceCommand } from '../../../../lib/dedicated-service-command';
+/**
+ * `skrr machines dedicated service logs` — tail the service's log, or follow it.
+ *
+ * The daemon rotates a bounded `current` log per service; `logs` replays a
+ * byte tail of it and `-f` keeps the stream open on live
+ * `dedicated:service:log` frames. Ctrl-C ends the follow cleanly — the
+ * stream is closed with `logs:stop`, the service keeps running.
+ *
+ * While a follow is open, an agent proposal arriving on the same channel is
+ * surfaced on stderr: the owner watching logs is exactly the owner who can
+ * approve it.
+ */
+export default class DedicatedServiceLogs extends DedicatedServiceCommand {
+    static summary: string;
+    static examples: string[];
+    static args: {
+        lease: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+        name: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        follow: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+        tail: import("@oclif/core/lib/interfaces").OptionFlag<number | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+    /**
+     * The machine-readable follow: each log frame is one JSON line. An ack's
+     * refusal surfaces through the same channel.call error path as every other
+     * verb (a `--json` caller reads the CLI error envelope).
+     */
+    private followJson;
+}

package/dist/commands/machines/dedicated/service/logs.js

@@ -0,0 +1,148 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const dedicated_service_command_1 = require("../../../../lib/dedicated-service-command");
+const dedicated_service_1 = require("../../../../lib/dedicated-service");
+/**
+ * `skrr machines dedicated service logs` — tail the service's log, or follow it.
+ *
+ * The daemon rotates a bounded `current` log per service; `logs` replays a
+ * byte tail of it and `-f` keeps the stream open on live
+ * `dedicated:service:log` frames. Ctrl-C ends the follow cleanly — the
+ * stream is closed with `logs:stop`, the service keeps running.
+ *
+ * While a follow is open, an agent proposal arriving on the same channel is
+ * surfaced on stderr: the owner watching logs is exactly the owner who can
+ * approve it.
+ */
+class DedicatedServiceLogs extends dedicated_service_command_1.DedicatedServiceCommand {
+    static summary = 'Print a service’s log; -f follows live output';
+    static examples = [
+        '<%= config.bin %> machines dedicated service logs <lease-id> <name>',
+        '<%= config.bin %> machines dedicated service logs <lease-id> <name> -f',
+        '<%= config.bin %> machines dedicated service logs <lease-id> <name> --tail 65536',
+    ];
+    static args = {
+        lease: core_1.Args.string({
+            description: dedicated_service_command_1.SERVICE_LEASE_ARG_DESCRIPTION,
+            required: true,
+            ignoreStdin: true,
+        }),
+        name: core_1.Args.string({ description: 'Service name', required: true, ignoreStdin: true }),
+    };
+    static flags = {
+        follow: core_1.Flags.boolean({
+            description: 'Keep the stream open on live log frames (Ctrl-C ends the follow, not the service)',
+            char: 'f',
+        }),
+        tail: core_1.Flags.integer({
+            description: 'Bytes from the end of the stored log to print first (daemon rotates at 8 MiB)',
+            min: 0,
+        }),
+        json: core_1.Flags.boolean({ description: 'Emit log frames as JSON objects' }),
+    };
+    async run() {
+        this.requireAuth();
+        const { args, flags } = await this.parse(DedicatedServiceLogs);
+        const leaseId = await this.resolveLeaseArg(args.lease);
+        if (flags.json) {
+            // --json emits one frame per line — a follow a program can consume.
+            // Proposals surface as frames too rather than stderr prose.
+            const code = await this.followJson(leaseId, args.name, flags);
+            if (code !== 0)
+                this.exit(code);
+            return;
+        }
+        let code;
+        try {
+            code = await (0, dedicated_service_1.streamServiceLogs)({
+                baseURL: this.cliConfig.baseURL,
+                token: this.resolvedCredential.token,
+                leaseId,
+                name: args.name,
+                follow: flags.follow,
+                tailBytes: flags.tail,
+                output: process.stdout,
+                errorOutput: process.stderr,
+            });
+        }
+        catch (err) {
+            this.reportServiceError(err);
+        }
+        if (code !== 0)
+            this.exit(code);
+    }
+    /**
+     * The machine-readable follow: each log frame is one JSON line. An ack's
+     * refusal surfaces through the same channel.call error path as every other
+     * verb (a `--json` caller reads the CLI error envelope).
+     */
+    async followJson(leaseId, name, flags) {
+        const channel = new dedicated_service_1.DedicatedServiceChannel({
+            baseURL: this.cliConfig.baseURL,
+            token: this.resolvedCredential.token,
+        });
+        return new Promise((resolve, reject) => {
+            let streamId = null;
+            let finished = false;
+            let closedByServer = false;
+            const onSigint = () => finish(0);
+            const finish = (code) => {
+                if (finished)
+                    return;
+                finished = true;
+                process.off('SIGINT', onSigint);
+                if (streamId && flags.follow && !closedByServer) {
+                    channel.send(dedicated_service_1.DEDICATED_SERVICE_EVENTS.logsStop, { leaseId, name, streamId });
+                }
+                channel.close();
+                resolve(code);
+            };
+            channel.setOnDead(() => finish(1));
+            channel
+                .open()
+                .then(async () => {
+                process.on('SIGINT', onSigint);
+                channel.on(dedicated_service_1.DEDICATED_SERVICE_EVENTS.log, (frame) => {
+                    if (streamId && frame.streamId && frame.streamId !== streamId)
+                        return;
+                    if (frame.name && frame.name !== name)
+                        return;
+                    this.log(JSON.stringify({ type: 'log', ...frame }));
+                });
+                channel.on(dedicated_service_1.DEDICATED_SERVICE_EVENTS.logClosed, (frame) => {
+                    if (streamId && frame.streamId && frame.streamId !== streamId)
+                        return;
+                    closedByServer = true;
+                    this.log(JSON.stringify({ type: 'closed', ...frame }));
+                    finish(0);
+                });
+                channel.on(dedicated_service_1.DEDICATED_SERVICE_EVENTS.proposed, (frame) => {
+                    this.log(JSON.stringify({ type: 'proposed', ...frame }));
+                });
+                const { result } = await channel.call('logs', {
+                    leaseId,
+                    name,
+                    follow: flags.follow,
+                    ...(flags.tail !== undefined ? { tailBytes: flags.tail } : {}),
+                    ...this.scopeFrom(flags),
+                });
+                streamId = typeof result?.streamId === 'string' ? result.streamId : null;
+                if (typeof result?.data === 'string' && result.data.length > 0) {
+                    this.log(JSON.stringify({ type: 'tail', name, data: result.data }));
+                }
+                if (!flags.follow)
+                    finish(0);
+            })
+                .catch((err) => {
+                // Reject BEFORE closing — disconnect() fires onDead → finish(1),
+                // which would otherwise win the settlement race and mask the refusal.
+                finished = true;
+                process.off('SIGINT', onSigint);
+                reject(err);
+                channel.close();
+            });
+        });
+    }
+}
+exports.default = DedicatedServiceLogs;

package/dist/commands/machines/dedicated/service/ls.d.ts

@@ -0,0 +1,20 @@
+import { DedicatedServiceCommand } from '../../../../lib/dedicated-service-command';
+/**
+ * `skrr machines dedicated service ls` — what the machine is keeping alive,
+ * and what agents have asked it to keep alive.
+ *
+ * Agent proposals are printed as their own section rather than as ordinary
+ * rows: a proposed service runs nothing until the owner approves it, and a
+ * table that listed it beside running work would lie by adjacency.
+ */
+export default class DedicatedServiceLs extends DedicatedServiceCommand {
+    static summary: string;
+    static examples: string[];
+    static args: {
+        lease: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/machines/dedicated/service/ls.js

@@ -0,0 +1,80 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const dedicated_service_command_1 = require("../../../../lib/dedicated-service-command");
+const format_1 = require("../../../../lib/format");
+/**
+ * `skrr machines dedicated service ls` — what the machine is keeping alive,
+ * and what agents have asked it to keep alive.
+ *
+ * Agent proposals are printed as their own section rather than as ordinary
+ * rows: a proposed service runs nothing until the owner approves it, and a
+ * table that listed it beside running work would lie by adjacency.
+ */
+class DedicatedServiceLs extends dedicated_service_command_1.DedicatedServiceCommand {
+    static summary = 'List declared services and pending agent proposals';
+    static examples = [
+        '<%= config.bin %> machines dedicated service ls <lease-id>',
+        '<%= config.bin %> machines dedicated service ls <lease-id> --json',
+    ];
+    static args = {
+        lease: core_1.Args.string({
+            description: dedicated_service_command_1.SERVICE_LEASE_ARG_DESCRIPTION,
+            required: true,
+            ignoreStdin: true,
+        }),
+    };
+    static flags = {
+        json: core_1.Flags.boolean({ description: 'Output as JSON' }),
+    };
+    async run() {
+        this.requireAuth();
+        const { args, flags } = await this.parse(DedicatedServiceLs);
+        const leaseId = await this.resolveLeaseArg(args.lease);
+        const result = await this.callService('list', {
+            leaseId,
+            ...this.scopeFrom(flags),
+        });
+        this.closeServiceChannel();
+        if (flags.json) {
+            this.log(JSON.stringify(result ?? { services: [] }, null, 2));
+            return;
+        }
+        const services = result?.services ?? [];
+        const proposals = result?.proposals ?? [];
+        if (services.length === 0 && proposals.length === 0) {
+            this.log(`No declared services on ${leaseId}.`);
+            this.log(`Declare one with \`${this.config.bin} machines dedicated service create ${leaseId} --name <name> -- <command>\`.`);
+            return;
+        }
+        if (services.length > 0) {
+            (0, format_1.renderTable)(services.map((svc) => ({
+                name: (0, format_1.formatCell)(svc.name ?? svc.spec?.name),
+                status: (0, format_1.formatCell)(svc.status ?? 'unknown'),
+                restart: (0, format_1.formatCell)(svc.restart ?? svc.spec?.restart),
+                createdBy: (0, format_1.formatCell)(svc.createdBy ?? svc.spec?.createdBy),
+            })), [
+                { key: 'name', header: 'NAME', verbatim: true },
+                { key: 'status', header: 'STATUS' },
+                { key: 'restart', header: 'RESTART' },
+                { key: 'createdBy', header: 'CREATED BY' },
+            ], (line) => this.log(line));
+        }
+        if (proposals.length > 0) {
+            if (services.length > 0)
+                this.log('');
+            this.log('Pending proposals — nothing runs until you approve:');
+            (0, format_1.renderTable)(proposals.map((p) => ({
+                name: (0, format_1.formatCell)(p.name ?? p.spec?.name),
+                proposedBy: (0, format_1.formatCell)(p.createdBy),
+                command: (0, format_1.formatCell)(Array.isArray(p.spec?.command) ? p.spec.command.join(' ') : (p.spec?.shell ?? ''), '-'),
+            })), [
+                { key: 'name', header: 'NAME', verbatim: true },
+                { key: 'proposedBy', header: 'PROPOSED BY' },
+                { key: 'command', header: 'COMMAND', maxWidth: 60 },
+            ], (line) => this.log(line));
+            this.log(`Approve with \`${this.config.bin} machines dedicated service approve ${leaseId} <name>\` (add --reject to refuse).`);
+        }
+    }
+}
+exports.default = DedicatedServiceLs;

package/dist/commands/machines/dedicated/service/restart.d.ts

@@ -0,0 +1,14 @@
+import { DedicatedServiceCommand } from '../../../../lib/dedicated-service-command';
+/** `skrr machines dedicated service restart` — bounce it now; also re-arms a `failed` service. */
+export default class DedicatedServiceRestart extends DedicatedServiceCommand {
+    static summary: string;
+    static examples: string[];
+    static args: {
+        lease: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+        name: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/machines/dedicated/service/restart.js

@@ -0,0 +1,29 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const dedicated_service_command_1 = require("../../../../lib/dedicated-service-command");
+/** `skrr machines dedicated service restart` — bounce it now; also re-arms a `failed` service. */
+class DedicatedServiceRestart extends dedicated_service_command_1.DedicatedServiceCommand {
+    static summary = 'Restart a service now (re-arms a failed one)';
+    static examples = [
+        '<%= config.bin %> machines dedicated service restart <lease-id> <name>',
+    ];
+    static args = {
+        lease: core_1.Args.string({
+            description: dedicated_service_command_1.SERVICE_LEASE_ARG_DESCRIPTION,
+            required: true,
+            ignoreStdin: true,
+        }),
+        name: core_1.Args.string({ description: 'Service name', required: true, ignoreStdin: true }),
+    };
+    static flags = {
+        json: core_1.Flags.boolean({ description: 'Output the result as JSON' }),
+    };
+    async run() {
+        this.requireAuth();
+        const { args, flags } = await this.parse(DedicatedServiceRestart);
+        const leaseId = await this.resolveLeaseArg(args.lease);
+        await this.runServiceAction(leaseId, args.name, 'restart', flags);
+    }
+}
+exports.default = DedicatedServiceRestart;