@skrr-ai/cli 0.1.47 → 0.1.49

package/dist/commands/enterprise/profile.js

@@ -0,0 +1,38 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const base_command_1 = require("../../base-command");
+const enterprise_commerce_1 = require("../../lib/enterprise-commerce");
+const commerce_command_1 = require("../../lib/commerce-command");
+/**
+ * `skrr enterprise profile <workspace-id>` — the workspace's enterprise profile.
+ *
+ * A PUT, so this replaces the profile rather than patching it. The command
+ * says so in its description instead of pretending to merge, because a
+ * partial body sent to a replacing endpoint silently drops whatever it omits.
+ */
+class EnterpriseProfile extends base_command_1.BaseCommand {
+    static description = "Replace a workspace's enterprise profile (admin). This is a full replace, not a merge — anything your body omits is dropped.";
+    static examples = [
+        '<%= config.bin %> enterprise profile <workspace-id> --file ./profile.json',
+    ];
+    static args = {
+        workspace: core_1.Args.string({ description: 'Workspace id', required: true, ignoreStdin: true }),
+    };
+    static flags = { ...commerce_command_1.jsonBodyFlags };
+    async run() {
+        this.requireAuth();
+        const { args, flags } = await this.parse(EnterpriseProfile);
+        const body = await (0, commerce_command_1.jsonBodyFrom)(this, flags.file);
+        let result;
+        try {
+            result = await (0, enterprise_commerce_1.upsertEnterpriseProfile)(args.workspace, body);
+        }
+        catch (error) {
+            this.handleApiError(error);
+            return;
+        }
+        this.log(JSON.stringify(result, null, 2));
+    }
+}
+exports.default = EnterpriseProfile;

package/dist/commands/login.d.ts

@@ -66,4 +66,17 @@ export default class Login extends BaseCommand {
      * only when the client can locally confirm the alphabet is wrong.
      */
     private runRecoveryCodeLogin;
+    /**
+     * C3 step 2 — the server accepted the recovery code and staged a
+     * Redis-backed OTP challenge, emailing the code to the account address.
+     * Prompt for it and complete the redemption; /redeem/confirm is the only
+     * endpoint that mints the token pair.
+     */
+    private confirmRecoveryChallenge;
+    /**
+     * A credential-minting flow may persist only a response that carries a
+     * credential. Asserts the token-bearing contract before writeToBackend so
+     * a successful-but-tokenless answer can never clobber the stored bundle.
+     */
+    private assertRedeemResult;
 }

package/dist/commands/login.js

@@ -12,6 +12,7 @@ const login_1 = require("../lib/login");
 const device_code_1 = require("../lib/device-code");
 const api_fetch_1 = require("../lib/api-fetch");
 const auth_storage_1 = require("../lib/auth-storage");
+const prompt_1 = require("../lib/prompt");
 /**
  * `skrr login`
  *
@@ -337,6 +338,18 @@ class Login extends base_command_1.BaseCommand {
             }
             this.handleApiError(err);
         }
+        // C3 step 2 — a challenge-shaped answer means the server staged an OTP
+        // and emailed it to the account address; complete the redemption with
+        // POST /redeem/confirm, the only endpoint that mints tokens.
+        if (typeof result.challengeId === 'string' && result.challengeId.length > 0) {
+            result = await this.confirmRecoveryChallenge(result.challengeId);
+        }
+        // Persist only a response that actually carries a credential. A
+        // tokenless body (an unexpected shape, or a challenge we could not
+        // complete) must never reach writeToBackend — writing undefined token
+        // fields destroys the stored credential (Keychain delete-all on macOS,
+        // an origin-only cli-auth.json elsewhere) and redeems nothing.
+        this.assertRedeemResult(result);
         // Persist via the CLI's canonical token-save path (Keychain on macOS, file elsewhere).
         (0, auth_storage_1.writeToBackend)({
             token: result.token,
@@ -351,5 +364,69 @@ class Login extends base_command_1.BaseCommand {
             `${(0, config_1.describeDeployment)(this.cliConfig.baseURL)}.`);
         this.log(`Run \`${this.config.bin} whoami\` to confirm your identity.`);
     }
+    /**
+     * C3 step 2 — the server accepted the recovery code and staged a
+     * Redis-backed OTP challenge, emailing the code to the account address.
+     * Prompt for it and complete the redemption; /redeem/confirm is the only
+     * endpoint that mints the token pair.
+     */
+    async confirmRecoveryChallenge(challengeId) {
+        if (!process.stdin.isTTY) {
+            this.error('This server requires a confirmation code that was emailed to the account ' +
+                'address, and there is no terminal to enter it. Run this command ' +
+                'interactively. No credentials were changed.', { exit: 1 });
+        }
+        const otp = await (0, prompt_1.prompt)('Enter the recovery confirmation code from your email: ', {
+            hidden: true,
+        });
+        if (!otp) {
+            this.error('No confirmation code entered; recovery aborted. No credentials were changed.', {
+                exit: 1,
+            });
+        }
+        try {
+            return await (0, api_fetch_1.apiFetch)('/api/auth/recovery/redeem/confirm', {
+                method: 'POST',
+                // Recovery redeem is public — no credential needed.
+                body: { challengeId, otp },
+            });
+        }
+        catch (err) {
+            if (err instanceof api_fetch_1.ApiFetchError) {
+                if (err.status === 401) {
+                    this.error('Confirmation code is incorrect. The challenge was consumed — ' +
+                        'run the command again with the recovery code to receive a new one.', { exit: 1 });
+                }
+                if (err.status === 410) {
+                    this.error('Recovery challenge expired. Run the command again to restart.', { exit: 1 });
+                }
+                if (err.status === 429) {
+                    this.error('Too many recovery attempts. Please wait 15 minutes before trying again.', {
+                        exit: 1,
+                    });
+                }
+            }
+            this.handleApiError(err);
+        }
+    }
+    /**
+     * A credential-minting flow may persist only a response that carries a
+     * credential. Asserts the token-bearing contract before writeToBackend so
+     * a successful-but-tokenless answer can never clobber the stored bundle.
+     */
+    assertRedeemResult(result) {
+        const candidate = result;
+        if (!candidate ||
+            typeof candidate.token !== 'string' ||
+            candidate.token.length === 0 ||
+            typeof candidate.refreshToken !== 'string' ||
+            candidate.refreshToken.length === 0 ||
+            !candidate.user ||
+            typeof candidate.user.email !== 'string' ||
+            candidate.user.email.length === 0) {
+            this.error('Recovery did not return a session — the server answered with an unexpected ' +
+                'response shape. No credentials were changed. Update the skrr CLI if this persists.', { exit: 1 });
+        }
+    }
 }
 exports.default = Login;

package/dist/commands/machines/dedicated/index.js

@@ -28,6 +28,8 @@ class DedicatedMachines extends core_1.Command {
         '<%= config.bin %> machines dedicated spending-limit <lease-id> --cents 30000',
         '<%= config.bin %> machines dedicated health-check <lease-id>',
         '<%= config.bin %> machines dedicated incident-close <lease-id>',
+        '<%= config.bin %> machines dedicated service create <lease-id> --name worker -- node dist/worker.js',
+        '<%= config.bin %> machines dedicated service ls <lease-id>',
         '<%= config.bin %> machines dedicated destroy <lease-id>',
     ];
     async run() {
@@ -51,6 +53,7 @@ class DedicatedMachines extends core_1.Command {
             ['spending-limit', 'change the monthly spending cap'],
             ['health-check', 'probe daemon and disk liveness'],
             ['incident-close', 'close AZ-recovery evidence hold'],
+            ['service', 'declare workloads the machine keeps running'],
             ['destroy', 'stop compute; keep or purge the workspace disk'],
         ];
         this.log('skrr Dedicated Runtime commands:');

package/dist/commands/machines/dedicated/service/apply.d.ts

@@ -0,0 +1,23 @@
+import { DedicatedServiceCommand } from '../../../../lib/dedicated-service-command';
+/**
+ * `skrr machines dedicated service apply` — the git-ops verb: make the
+ * machine's declaration match the file.
+ *
+ * `create` refuses a name that exists; `apply` is idempotent — it reads the
+ * current spec (for its CAS `revision`), then updates or creates so a
+ * checked-in `service.json` can be re-applied any number of times. There is
+ * deliberately no watcher: the file is input, not a live mirror.
+ */
+export default class DedicatedServiceApply extends DedicatedServiceCommand {
+    static summary: string;
+    static description: string;
+    static examples: string[];
+    static args: {
+        lease: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        file: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/machines/dedicated/service/apply.js

@@ -0,0 +1,99 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const node_fs_1 = require("node:fs");
+const core_1 = require("@oclif/core");
+const prompt_1 = require("../../../../lib/prompt");
+const dedicated_service_command_1 = require("../../../../lib/dedicated-service-command");
+const dedicated_service_1 = require("../../../../lib/dedicated-service");
+/**
+ * `skrr machines dedicated service apply` — the git-ops verb: make the
+ * machine's declaration match the file.
+ *
+ * `create` refuses a name that exists; `apply` is idempotent — it reads the
+ * current spec (for its CAS `revision`), then updates or creates so a
+ * checked-in `service.json` can be re-applied any number of times. There is
+ * deliberately no watcher: the file is input, not a live mirror.
+ */
+class DedicatedServiceApply extends dedicated_service_command_1.DedicatedServiceCommand {
+    static summary = 'Create or update a service from a spec file, idempotently';
+    static description = 'Applies service.json to the machine: creates the service when absent, updates it ' +
+        'against the stored spec’s revision when present (CAS — a spec that changed since the ' +
+        'read is reported as a conflict, never silently merged). Re-running it is safe.';
+    static examples = [
+        '<%= config.bin %> machines dedicated service apply <lease-id> --file service.json',
+    ];
+    static args = {
+        lease: core_1.Args.string({
+            description: dedicated_service_command_1.SERVICE_LEASE_ARG_DESCRIPTION,
+            required: true,
+            ignoreStdin: true,
+        }),
+    };
+    static flags = {
+        file: core_1.Flags.string({
+            description: 'The service.json to apply',
+            required: true,
+        }),
+        json: core_1.Flags.boolean({ description: 'Output the result as JSON' }),
+    };
+    async run() {
+        this.requireAuth();
+        const { args, flags } = await this.parse(DedicatedServiceApply);
+        const leaseId = await this.resolveLeaseArg(args.lease);
+        let raw;
+        try {
+            raw = flags.file === '-' ? await (0, prompt_1.readStdin)() : (0, node_fs_1.readFileSync)(flags.file, 'utf8');
+        }
+        catch (err) {
+            this.error(`Cannot read ${flags.file}: ${err instanceof Error ? err.message : err}`, {
+                exit: 2,
+            });
+        }
+        let spec;
+        try {
+            spec = (0, dedicated_service_1.parseServiceSpecDocument)(raw, flags.file);
+        }
+        catch (err) {
+            this.reportServiceError(err);
+        }
+        // Upsert: read the current spec for its revision, then choose create or
+        // CAS update. `get` failing with not_found is the create path — read the
+        // raw ack here rather than through callService, which exits on refusals.
+        let verb = 'create';
+        let baseRevision;
+        try {
+            const channel = await this.serviceChannel();
+            const { result } = await channel.call('get', {
+                leaseId,
+                name: spec.name,
+                ...this.scopeFrom(flags),
+            });
+            if (result?.spec) {
+                verb = 'update';
+                baseRevision = typeof result.spec.revision === 'number' ? result.spec.revision : undefined;
+            }
+        }
+        catch (err) {
+            if (!(err instanceof dedicated_service_1.DedicatedServiceError && err.code === 'not_found')) {
+                this.reportServiceError(err);
+            }
+        }
+        const payload = verb === 'update'
+            ? {
+                leaseId,
+                name: spec.name,
+                patch: (0, dedicated_service_1.specPayload)(spec),
+                baseRevision,
+                ...this.scopeFrom(flags),
+            }
+            : { leaseId, spec: (0, dedicated_service_1.specPayload)(spec), ...this.scopeFrom(flags) };
+        const result = await this.callService(verb, payload);
+        this.closeServiceChannel();
+        if (flags.json) {
+            this.log(JSON.stringify(result ?? { name: spec.name, applied: verb }, null, 2));
+            return;
+        }
+        this.log(`Service ${spec.name} ${verb === 'create' ? 'created' : 'updated'} on ${leaseId}.`);
+    }
+}
+exports.default = DedicatedServiceApply;

package/dist/commands/machines/dedicated/service/approve.d.ts

@@ -0,0 +1,23 @@
+import { DedicatedServiceCommand } from '../../../../lib/dedicated-service-command';
+/**
+ * `skrr machines dedicated service approve` — the owner's answer to an
+ * agent-proposed service.
+ *
+ * Agents on the machine propose services through `skrr service propose`; a
+ * proposal is inert — nothing runs — until the owner answers it here.
+ * Approving turns the proposal into a live declaration with the agent's
+ * provenance preserved; rejecting drops it.
+ */
+export default class DedicatedServiceApprove extends DedicatedServiceCommand {
+    static summary: string;
+    static examples: string[];
+    static args: {
+        lease: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+        name: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        reject: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/machines/dedicated/service/approve.js

@@ -0,0 +1,52 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const dedicated_service_command_1 = require("../../../../lib/dedicated-service-command");
+/**
+ * `skrr machines dedicated service approve` — the owner's answer to an
+ * agent-proposed service.
+ *
+ * Agents on the machine propose services through `skrr service propose`; a
+ * proposal is inert — nothing runs — until the owner answers it here.
+ * Approving turns the proposal into a live declaration with the agent's
+ * provenance preserved; rejecting drops it.
+ */
+class DedicatedServiceApprove extends dedicated_service_command_1.DedicatedServiceCommand {
+    static summary = 'Approve or reject an agent-proposed service';
+    static examples = [
+        '<%= config.bin %> machines dedicated service approve <lease-id> <name>',
+        '<%= config.bin %> machines dedicated service approve <lease-id> <name> --reject',
+    ];
+    static args = {
+        lease: core_1.Args.string({
+            description: dedicated_service_command_1.SERVICE_LEASE_ARG_DESCRIPTION,
+            required: true,
+            ignoreStdin: true,
+        }),
+        name: core_1.Args.string({ description: 'Proposed service name', required: true, ignoreStdin: true }),
+    };
+    static flags = {
+        reject: core_1.Flags.boolean({ description: 'Reject the proposal instead of approving it' }),
+        json: core_1.Flags.boolean({ description: 'Output the result as JSON' }),
+    };
+    async run() {
+        this.requireAuth();
+        const { args, flags } = await this.parse(DedicatedServiceApprove);
+        const leaseId = await this.resolveLeaseArg(args.lease);
+        const result = await this.callService('approve', {
+            leaseId,
+            name: args.name,
+            approve: !flags.reject,
+            ...this.scopeFrom(flags),
+        });
+        this.closeServiceChannel();
+        if (flags.json) {
+            this.log(JSON.stringify(result ?? { name: args.name, approved: !flags.reject }, null, 2));
+            return;
+        }
+        this.log(flags.reject
+            ? `Proposal ${args.name} rejected — nothing runs.`
+            : `Proposal ${args.name} approved — the service is now declared and starts.`);
+    }
+}
+exports.default = DedicatedServiceApprove;

package/dist/commands/machines/dedicated/service/create.d.ts

@@ -0,0 +1,55 @@
+import { DedicatedServiceCommand } from '../../../../lib/dedicated-service-command';
+/**
+ * `skrr machines dedicated service create` — declare a workload the machine
+ * keeps running.
+ *
+ * The spec arrives one of three ways, never mixed:
+ *
+ *   argv        `service create <lease> --name devin -- <argv…>`
+ *   file        `service create <lease> --file service.json`
+ *   template    `service create <lease> --template worker --param repo=x`
+ *
+ * A template is a spec with `${param}` holes resolved locally
+ * (`~/.skrr/templates/<name>.json`, then the API gallery) — what reaches the
+ * daemon is always a concrete spec, so nothing downstream ever learns that
+ * templates exist. `--print` shows that merged spec instead of creating.
+ */
+export default class DedicatedServiceCreate extends DedicatedServiceCommand {
+    static summary: string;
+    static description: string;
+    static examples: string[];
+    static usage: string;
+    static args: {
+        lease: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+        command: import("@oclif/core/lib/interfaces").Arg<string[] | undefined, Record<string, unknown>>;
+    };
+    static flags: {
+        file: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        template: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        param: import("@oclif/core/lib/interfaces").OptionFlag<string[] | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        print: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+        name: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        cwd: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        env: import("@oclif/core/lib/interfaces").OptionFlag<string[] | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        restart: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        notify: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+        'stop-timeout': import("@oclif/core/lib/interfaces").OptionFlag<number | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        'limit-memory': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        'limit-cpu': import("@oclif/core/lib/interfaces").OptionFlag<number | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        'limit-pids': import("@oclif/core/lib/interfaces").OptionFlag<number | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+    };
+    run(): Promise<void>;
+    /**
+     * The one spec this invocation means — flags+argv, --file, or --template.
+     * Mixing sources is refused rather than merged: "which spec won" is a
+     * question only the caller can answer.
+     */
+    private resolveSpec;
+    /**
+     * `~/.skrr/templates/<name>.json` first, then the API gallery. A missing
+     * local file is a fall-through, a broken one is an error; a gallery miss
+     * names both places looked.
+     */
+    private resolveTemplate;
+}

package/dist/commands/machines/dedicated/service/create.js

@@ -0,0 +1,222 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const node_fs_1 = require("node:fs");
+const core_1 = require("@oclif/core");
+const prompt_1 = require("../../../../lib/prompt");
+const dedicated_service_command_1 = require("../../../../lib/dedicated-service-command");
+const dedicated_service_1 = require("../../../../lib/dedicated-service");
+const exec_1 = require("../../hosted/exec");
+/**
+ * `skrr machines dedicated service create` — declare a workload the machine
+ * keeps running.
+ *
+ * The spec arrives one of three ways, never mixed:
+ *
+ *   argv        `service create <lease> --name devin -- <argv…>`
+ *   file        `service create <lease> --file service.json`
+ *   template    `service create <lease> --template worker --param repo=x`
+ *
+ * A template is a spec with `${param}` holes resolved locally
+ * (`~/.skrr/templates/<name>.json`, then the API gallery) — what reaches the
+ * daemon is always a concrete spec, so nothing downstream ever learns that
+ * templates exist. `--print` shows that merged spec instead of creating.
+ */
+class DedicatedServiceCreate extends dedicated_service_command_1.DedicatedServiceCommand {
+    static summary = 'Declare an always-on service on a Dedicated Runtime';
+    static description = 'Declares a service the machine keeps running: it restarts on crash, on daemon restart, ' +
+        'after a checkpoint, and on a replacement machine. Give the command after -- as argv, ' +
+        'or a spec with --file service.json, or a --template with --param values. ' +
+        'Combine none of the three — each is a complete spec.';
+    static examples = [
+        '<%= config.bin %> machines dedicated service create <lease-id> --name devin --cwd /workspace/repos/devin -- node dist/worker.js',
+        '<%= config.bin %> machines dedicated service create <lease-id> --file service.json',
+        '<%= config.bin %> machines dedicated service create <lease-id> --name worker --restart on-failure --limit-memory 2G -- node dist/worker.js',
+        '<%= config.bin %> machines dedicated service create <lease-id> --template devin-worker --param repo=/workspace/repos/app',
+        '<%= config.bin %> machines dedicated service create <lease-id> --template devin-worker --param repo=x --print',
+    ];
+    static usage = 'machines dedicated service create <lease-id> [flags] -- <command...>';
+    static args = {
+        lease: core_1.Args.string({
+            description: dedicated_service_command_1.SERVICE_LEASE_ARG_DESCRIPTION,
+            required: true,
+            ignoreStdin: true,
+        }),
+        command: core_1.Args.string({
+            description: 'The service command and its arguments, after --',
+            multiple: true,
+            required: false,
+            ignoreStdin: true,
+        }),
+    };
+    static flags = {
+        ...dedicated_service_command_1.serviceSpecFlags,
+        file: core_1.Flags.string({ description: 'Read the spec from a service.json file instead of flags' }),
+        template: core_1.Flags.string({
+            description: 'Build the spec from a template (~/.skrr/templates/<name>.json, then the API gallery)',
+        }),
+        param: core_1.Flags.string({
+            description: 'Template parameter as name=value; repeat for several',
+            multiple: true,
+        }),
+        print: core_1.Flags.boolean({
+            description: 'Print the spec that would be created without creating it',
+        }),
+        json: core_1.Flags.boolean({ description: 'Output the created service as JSON' }),
+    };
+    async run() {
+        this.requireAuth();
+        const { head, tail } = (0, exec_1.splitExecArgv)(this.argv);
+        const { args, flags } = await this.parse(DedicatedServiceCreate, head);
+        const leaseId = await this.resolveLeaseArg(args.lease);
+        let spec;
+        try {
+            spec = await this.resolveSpec(flags, tail ?? args.command ?? []);
+        }
+        catch (err) {
+            this.reportServiceError(err);
+        }
+        const errors = (0, dedicated_service_1.validateServiceSpec)(spec);
+        if (errors.length > 0) {
+            this.error(`The service spec is not valid:\n${errors.map((e) => `  - ${e}`).join('\n')}`, {
+                exit: 2,
+            });
+        }
+        if (flags.print) {
+            this.log(JSON.stringify((0, dedicated_service_1.specPayload)(spec), null, 2));
+            return;
+        }
+        const result = await this.callService('create', {
+            leaseId,
+            spec: (0, dedicated_service_1.specPayload)(spec),
+            ...this.scopeFrom(flags),
+        });
+        this.closeServiceChannel();
+        if (flags.json) {
+            this.log(JSON.stringify(result ?? { name: spec.name }, null, 2));
+            return;
+        }
+        const name = spec.name ?? result?.name ?? 'service';
+        this.log(`Service ${name} declared on ${leaseId}. It starts now and restarts across crashes, ` +
+            `daemon updates, checkpoints and machine replacement.`);
+        this.log(`Watch it: \`${this.config.bin} machines dedicated service status ${leaseId} ${name}\`, ` +
+            `logs: \`${this.config.bin} machines dedicated service logs ${leaseId} ${name} -f\`.`);
+    }
+    /**
+     * The one spec this invocation means — flags+argv, --file, or --template.
+     * Mixing sources is refused rather than merged: "which spec won" is a
+     * question only the caller can answer.
+     */
+    async resolveSpec(flags, argv) {
+        const file = flags.file;
+        const templateName = flags.template;
+        const flagSpecUsed = Boolean(flags.name ||
+            flags.cwd ||
+            flags.env?.length ||
+            flags.restart ||
+            flags.notify !== undefined ||
+            flags['stop-timeout'] !== undefined ||
+            flags['limit-memory'] ||
+            flags['limit-cpu'] !== undefined ||
+            flags['limit-pids'] !== undefined);
+        if (file && (templateName || flagSpecUsed || argv.length > 0)) {
+            this.error('--file is the whole spec — it cannot be combined with --template, spec flags, or a command after --.', { exit: 2 });
+        }
+        if (templateName && argv.length > 0) {
+            this.error('--template already carries the command — nothing may follow --.', { exit: 2 });
+        }
+        if (file) {
+            // `-` is the repo's stdin convention — a spec is small enough to pipe.
+            let raw;
+            try {
+                raw = file === '-' ? await (0, prompt_1.readStdin)() : (0, node_fs_1.readFileSync)(file, 'utf8');
+            }
+            catch (err) {
+                this.error(`Cannot read ${file}: ${err instanceof Error ? err.message : err}`, {
+                    exit: 2,
+                });
+            }
+            return (0, dedicated_service_1.parseServiceSpecDocument)(raw, file === '-' ? '<stdin>' : file);
+        }
+        if (templateName) {
+            const given = (0, dedicated_service_1.parseParamEntries)(flags.param);
+            const template = await this.resolveTemplate(templateName, flags);
+            const spec = (0, dedicated_service_1.mergeServiceTemplate)(template, given, `template ${templateName}`);
+            // Flag overrides sit over the merged spec — a template sets defaults,
+            // the invocation decides.
+            const fromFlags = (0, dedicated_service_1.specFromFlags)({
+                name: flags.name,
+                cwd: flags.cwd,
+                env: (0, dedicated_service_1.parseEnvEntries)(flags.env),
+                restart: flags.restart,
+                notify: flags.notify,
+                stopTimeoutSeconds: flags['stop-timeout'],
+                limits: {
+                    memoryMax: flags['limit-memory'],
+                    cpuQuotaPercent: flags['limit-cpu'],
+                    pidsMax: flags['limit-pids'],
+                },
+            });
+            return { ...spec, ...stripUndefined(fromFlags) };
+        }
+        return (0, dedicated_service_1.specFromFlags)({
+            name: flags.name,
+            argv,
+            cwd: flags.cwd,
+            env: (0, dedicated_service_1.parseEnvEntries)(flags.env),
+            restart: flags.restart,
+            notify: flags.notify,
+            stopTimeoutSeconds: flags['stop-timeout'],
+            limits: {
+                memoryMax: flags['limit-memory'],
+                cpuQuotaPercent: flags['limit-cpu'],
+                pidsMax: flags['limit-pids'],
+            },
+        });
+    }
+    /**
+     * `~/.skrr/templates/<name>.json` first, then the API gallery. A missing
+     * local file is a fall-through, a broken one is an error; a gallery miss
+     * names both places looked.
+     */
+    async resolveTemplate(name, flags) {
+        const local = (0, dedicated_service_1.loadLocalServiceTemplate)(name);
+        if (local)
+            return local;
+        try {
+            const channel = await this.serviceChannel();
+            const { result } = await channel.callTemplates('get', {
+                name,
+                ...this.scopeFrom(flags),
+            });
+            const template = result?.template ?? result;
+            if (template && typeof template === 'object' && template.spec) {
+                return template;
+            }
+            this.error(`Template ${name} was not found in ~/.skrr/templates/ or the gallery.`, {
+                exit: 1,
+            });
+        }
+        catch (err) {
+            // A timeout here is the API not answering `dedicated:templates:*` at
+            // all — the gallery is not served yet; name THAT, not "daemon offline".
+            if (err instanceof dedicated_service_1.DedicatedServiceError && err.code === 'SERVICE_CALL_TIMEOUT') {
+                this.error(`The template gallery is not available — ${name} was not in ~/.skrr/templates/ and this API does not serve dedicated:templates yet.`, { exit: 1 });
+            }
+            if (err instanceof dedicated_service_1.DedicatedServiceError)
+                this.reportServiceError(err);
+            this.handleApiError(err);
+        }
+    }
+}
+exports.default = DedicatedServiceCreate;
+function stripUndefined(spec) {
+    const out = {};
+    for (const [key, value] of Object.entries(spec)) {
+        if (value === undefined)
+            continue;
+        if (key === 'limits' && value && typeof value === 'object' && Object.keys(value).length === 0)
+            continue;
+        out[key] = value;
+    }
+    return out;
+}