@skrr-ai/cli 0.1.47 → 0.1.49

package/dist/commands/machines/dedicated/service/logs.js

@@ -0,0 +1,148 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const dedicated_service_command_1 = require("../../../../lib/dedicated-service-command");
+const dedicated_service_1 = require("../../../../lib/dedicated-service");
+/**
+ * `skrr machines dedicated service logs` — tail the service's log, or follow it.
+ *
+ * The daemon rotates a bounded `current` log per service; `logs` replays a
+ * byte tail of it and `-f` keeps the stream open on live
+ * `dedicated:service:log` frames. Ctrl-C ends the follow cleanly — the
+ * stream is closed with `logs:stop`, the service keeps running.
+ *
+ * While a follow is open, an agent proposal arriving on the same channel is
+ * surfaced on stderr: the owner watching logs is exactly the owner who can
+ * approve it.
+ */
+class DedicatedServiceLogs extends dedicated_service_command_1.DedicatedServiceCommand {
+    static summary = 'Print a service’s log; -f follows live output';
+    static examples = [
+        '<%= config.bin %> machines dedicated service logs <lease-id> <name>',
+        '<%= config.bin %> machines dedicated service logs <lease-id> <name> -f',
+        '<%= config.bin %> machines dedicated service logs <lease-id> <name> --tail 65536',
+    ];
+    static args = {
+        lease: core_1.Args.string({
+            description: dedicated_service_command_1.SERVICE_LEASE_ARG_DESCRIPTION,
+            required: true,
+            ignoreStdin: true,
+        }),
+        name: core_1.Args.string({ description: 'Service name', required: true, ignoreStdin: true }),
+    };
+    static flags = {
+        follow: core_1.Flags.boolean({
+            description: 'Keep the stream open on live log frames (Ctrl-C ends the follow, not the service)',
+            char: 'f',
+        }),
+        tail: core_1.Flags.integer({
+            description: 'Bytes from the end of the stored log to print first (daemon rotates at 8 MiB)',
+            min: 0,
+        }),
+        json: core_1.Flags.boolean({ description: 'Emit log frames as JSON objects' }),
+    };
+    async run() {
+        this.requireAuth();
+        const { args, flags } = await this.parse(DedicatedServiceLogs);
+        const leaseId = await this.resolveLeaseArg(args.lease);
+        if (flags.json) {
+            // --json emits one frame per line — a follow a program can consume.
+            // Proposals surface as frames too rather than stderr prose.
+            const code = await this.followJson(leaseId, args.name, flags);
+            if (code !== 0)
+                this.exit(code);
+            return;
+        }
+        let code;
+        try {
+            code = await (0, dedicated_service_1.streamServiceLogs)({
+                baseURL: this.cliConfig.baseURL,
+                token: this.resolvedCredential.token,
+                leaseId,
+                name: args.name,
+                follow: flags.follow,
+                tailBytes: flags.tail,
+                output: process.stdout,
+                errorOutput: process.stderr,
+            });
+        }
+        catch (err) {
+            this.reportServiceError(err);
+        }
+        if (code !== 0)
+            this.exit(code);
+    }
+    /**
+     * The machine-readable follow: each log frame is one JSON line. An ack's
+     * refusal surfaces through the same channel.call error path as every other
+     * verb (a `--json` caller reads the CLI error envelope).
+     */
+    async followJson(leaseId, name, flags) {
+        const channel = new dedicated_service_1.DedicatedServiceChannel({
+            baseURL: this.cliConfig.baseURL,
+            token: this.resolvedCredential.token,
+        });
+        return new Promise((resolve, reject) => {
+            let streamId = null;
+            let finished = false;
+            let closedByServer = false;
+            const onSigint = () => finish(0);
+            const finish = (code) => {
+                if (finished)
+                    return;
+                finished = true;
+                process.off('SIGINT', onSigint);
+                if (streamId && flags.follow && !closedByServer) {
+                    channel.send(dedicated_service_1.DEDICATED_SERVICE_EVENTS.logsStop, { leaseId, name, streamId });
+                }
+                channel.close();
+                resolve(code);
+            };
+            channel.setOnDead(() => finish(1));
+            channel
+                .open()
+                .then(async () => {
+                process.on('SIGINT', onSigint);
+                channel.on(dedicated_service_1.DEDICATED_SERVICE_EVENTS.log, (frame) => {
+                    if (streamId && frame.streamId && frame.streamId !== streamId)
+                        return;
+                    if (frame.name && frame.name !== name)
+                        return;
+                    this.log(JSON.stringify({ type: 'log', ...frame }));
+                });
+                channel.on(dedicated_service_1.DEDICATED_SERVICE_EVENTS.logClosed, (frame) => {
+                    if (streamId && frame.streamId && frame.streamId !== streamId)
+                        return;
+                    closedByServer = true;
+                    this.log(JSON.stringify({ type: 'closed', ...frame }));
+                    finish(0);
+                });
+                channel.on(dedicated_service_1.DEDICATED_SERVICE_EVENTS.proposed, (frame) => {
+                    this.log(JSON.stringify({ type: 'proposed', ...frame }));
+                });
+                const { result } = await channel.call('logs', {
+                    leaseId,
+                    name,
+                    follow: flags.follow,
+                    ...(flags.tail !== undefined ? { tailBytes: flags.tail } : {}),
+                    ...this.scopeFrom(flags),
+                });
+                streamId = typeof result?.streamId === 'string' ? result.streamId : null;
+                if (typeof result?.data === 'string' && result.data.length > 0) {
+                    this.log(JSON.stringify({ type: 'tail', name, data: result.data }));
+                }
+                if (!flags.follow)
+                    finish(0);
+            })
+                .catch((err) => {
+                // Reject BEFORE closing — disconnect() fires onDead → finish(1),
+                // which would otherwise win the settlement race and mask the refusal.
+                finished = true;
+                process.off('SIGINT', onSigint);
+                reject(err);
+                channel.close();
+            });
+        });
+    }
+}
+exports.default = DedicatedServiceLogs;

package/dist/commands/machines/dedicated/service/ls.d.ts

@@ -0,0 +1,20 @@
+import { DedicatedServiceCommand } from '../../../../lib/dedicated-service-command';
+/**
+ * `skrr machines dedicated service ls` — what the machine is keeping alive,
+ * and what agents have asked it to keep alive.
+ *
+ * Agent proposals are printed as their own section rather than as ordinary
+ * rows: a proposed service runs nothing until the owner approves it, and a
+ * table that listed it beside running work would lie by adjacency.
+ */
+export default class DedicatedServiceLs extends DedicatedServiceCommand {
+    static summary: string;
+    static examples: string[];
+    static args: {
+        lease: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/machines/dedicated/service/ls.js

@@ -0,0 +1,80 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const dedicated_service_command_1 = require("../../../../lib/dedicated-service-command");
+const format_1 = require("../../../../lib/format");
+/**
+ * `skrr machines dedicated service ls` — what the machine is keeping alive,
+ * and what agents have asked it to keep alive.
+ *
+ * Agent proposals are printed as their own section rather than as ordinary
+ * rows: a proposed service runs nothing until the owner approves it, and a
+ * table that listed it beside running work would lie by adjacency.
+ */
+class DedicatedServiceLs extends dedicated_service_command_1.DedicatedServiceCommand {
+    static summary = 'List declared services and pending agent proposals';
+    static examples = [
+        '<%= config.bin %> machines dedicated service ls <lease-id>',
+        '<%= config.bin %> machines dedicated service ls <lease-id> --json',
+    ];
+    static args = {
+        lease: core_1.Args.string({
+            description: dedicated_service_command_1.SERVICE_LEASE_ARG_DESCRIPTION,
+            required: true,
+            ignoreStdin: true,
+        }),
+    };
+    static flags = {
+        json: core_1.Flags.boolean({ description: 'Output as JSON' }),
+    };
+    async run() {
+        this.requireAuth();
+        const { args, flags } = await this.parse(DedicatedServiceLs);
+        const leaseId = await this.resolveLeaseArg(args.lease);
+        const result = await this.callService('list', {
+            leaseId,
+            ...this.scopeFrom(flags),
+        });
+        this.closeServiceChannel();
+        if (flags.json) {
+            this.log(JSON.stringify(result ?? { services: [] }, null, 2));
+            return;
+        }
+        const services = result?.services ?? [];
+        const proposals = result?.proposals ?? [];
+        if (services.length === 0 && proposals.length === 0) {
+            this.log(`No declared services on ${leaseId}.`);
+            this.log(`Declare one with \`${this.config.bin} machines dedicated service create ${leaseId} --name <name> -- <command>\`.`);
+            return;
+        }
+        if (services.length > 0) {
+            (0, format_1.renderTable)(services.map((svc) => ({
+                name: (0, format_1.formatCell)(svc.name ?? svc.spec?.name),
+                status: (0, format_1.formatCell)(svc.status ?? 'unknown'),
+                restart: (0, format_1.formatCell)(svc.restart ?? svc.spec?.restart),
+                createdBy: (0, format_1.formatCell)(svc.createdBy ?? svc.spec?.createdBy),
+            })), [
+                { key: 'name', header: 'NAME', verbatim: true },
+                { key: 'status', header: 'STATUS' },
+                { key: 'restart', header: 'RESTART' },
+                { key: 'createdBy', header: 'CREATED BY' },
+            ], (line) => this.log(line));
+        }
+        if (proposals.length > 0) {
+            if (services.length > 0)
+                this.log('');
+            this.log('Pending proposals — nothing runs until you approve:');
+            (0, format_1.renderTable)(proposals.map((p) => ({
+                name: (0, format_1.formatCell)(p.name ?? p.spec?.name),
+                proposedBy: (0, format_1.formatCell)(p.createdBy),
+                command: (0, format_1.formatCell)(Array.isArray(p.spec?.command) ? p.spec.command.join(' ') : (p.spec?.shell ?? ''), '-'),
+            })), [
+                { key: 'name', header: 'NAME', verbatim: true },
+                { key: 'proposedBy', header: 'PROPOSED BY' },
+                { key: 'command', header: 'COMMAND', maxWidth: 60 },
+            ], (line) => this.log(line));
+            this.log(`Approve with \`${this.config.bin} machines dedicated service approve ${leaseId} <name>\` (add --reject to refuse).`);
+        }
+    }
+}
+exports.default = DedicatedServiceLs;

package/dist/commands/machines/dedicated/service/restart.d.ts

@@ -0,0 +1,14 @@
+import { DedicatedServiceCommand } from '../../../../lib/dedicated-service-command';
+/** `skrr machines dedicated service restart` — bounce it now; also re-arms a `failed` service. */
+export default class DedicatedServiceRestart extends DedicatedServiceCommand {
+    static summary: string;
+    static examples: string[];
+    static args: {
+        lease: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+        name: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/machines/dedicated/service/restart.js

@@ -0,0 +1,29 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const dedicated_service_command_1 = require("../../../../lib/dedicated-service-command");
+/** `skrr machines dedicated service restart` — bounce it now; also re-arms a `failed` service. */
+class DedicatedServiceRestart extends dedicated_service_command_1.DedicatedServiceCommand {
+    static summary = 'Restart a service now (re-arms a failed one)';
+    static examples = [
+        '<%= config.bin %> machines dedicated service restart <lease-id> <name>',
+    ];
+    static args = {
+        lease: core_1.Args.string({
+            description: dedicated_service_command_1.SERVICE_LEASE_ARG_DESCRIPTION,
+            required: true,
+            ignoreStdin: true,
+        }),
+        name: core_1.Args.string({ description: 'Service name', required: true, ignoreStdin: true }),
+    };
+    static flags = {
+        json: core_1.Flags.boolean({ description: 'Output the result as JSON' }),
+    };
+    async run() {
+        this.requireAuth();
+        const { args, flags } = await this.parse(DedicatedServiceRestart);
+        const leaseId = await this.resolveLeaseArg(args.lease);
+        await this.runServiceAction(leaseId, args.name, 'restart', flags);
+    }
+}
+exports.default = DedicatedServiceRestart;

package/dist/commands/machines/dedicated/service/rm.d.ts

@@ -0,0 +1,20 @@
+import { DedicatedServiceCommand } from '../../../../lib/dedicated-service-command';
+/**
+ * `skrr machines dedicated service rm` — delete the declaration.
+ *
+ * The only way a declared service does not come back short of destroying the
+ * lease: the spec file is dropped, the scope is killed, and the reconciler
+ * forgets it.
+ */
+export default class DedicatedServiceRm extends DedicatedServiceCommand {
+    static summary: string;
+    static examples: string[];
+    static args: {
+        lease: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+        name: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/machines/dedicated/service/rm.js

@@ -0,0 +1,33 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const dedicated_service_command_1 = require("../../../../lib/dedicated-service-command");
+/**
+ * `skrr machines dedicated service rm` — delete the declaration.
+ *
+ * The only way a declared service does not come back short of destroying the
+ * lease: the spec file is dropped, the scope is killed, and the reconciler
+ * forgets it.
+ */
+class DedicatedServiceRm extends dedicated_service_command_1.DedicatedServiceCommand {
+    static summary = 'Remove a service declaration';
+    static examples = ['<%= config.bin %> machines dedicated service rm <lease-id> <name>'];
+    static args = {
+        lease: core_1.Args.string({
+            description: dedicated_service_command_1.SERVICE_LEASE_ARG_DESCRIPTION,
+            required: true,
+            ignoreStdin: true,
+        }),
+        name: core_1.Args.string({ description: 'Service name', required: true, ignoreStdin: true }),
+    };
+    static flags = {
+        json: core_1.Flags.boolean({ description: 'Output the result as JSON' }),
+    };
+    async run() {
+        this.requireAuth();
+        const { args, flags } = await this.parse(DedicatedServiceRm);
+        const leaseId = await this.resolveLeaseArg(args.lease);
+        await this.runServiceAction(leaseId, args.name, 'remove', flags);
+    }
+}
+exports.default = DedicatedServiceRm;

package/dist/commands/machines/dedicated/service/secret/index.d.ts

@@ -0,0 +1,14 @@
+import { Command } from '@oclif/core';
+/**
+ * `skrr machines dedicated service secret` — values a spec references as
+ * `secret://<name>` (phase 2).
+ *
+ * The daemon resolves the reference at spawn; the spec and every status
+ * surface carry only the name. Mutation is owner-channel only and names —
+ * never values — reach the audit log.
+ */
+export default class DedicatedServiceSecret extends Command {
+    static description: string;
+    static examples: string[];
+    run(): Promise<void>;
+}

package/dist/commands/machines/dedicated/service/secret/index.js

@@ -0,0 +1,25 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+/**
+ * `skrr machines dedicated service secret` — values a spec references as
+ * `secret://<name>` (phase 2).
+ *
+ * The daemon resolves the reference at spawn; the spec and every status
+ * surface carry only the name. Mutation is owner-channel only and names —
+ * never values — reach the audit log.
+ */
+class DedicatedServiceSecret extends core_1.Command {
+    static description = 'Secrets a service spec can reference as secret://<name> — daemon-held, never in the spec (phase 2)';
+    static examples = [
+        '<%= config.bin %> machines dedicated service secret set <lease-id> <name> < secret.txt',
+        '<%= config.bin %> machines dedicated service secret set <lease-id> <name> --from-file .env.production',
+        '<%= config.bin %> machines dedicated service secret rm <lease-id> <name>',
+    ];
+    async run() {
+        this.log('skrr machines dedicated service secret commands:');
+        this.log('  skrr machines dedicated service secret set  store a secret a spec can reference');
+        this.log('  skrr machines dedicated service secret rm   remove one (--force if referenced)');
+    }
+}
+exports.default = DedicatedServiceSecret;

package/dist/commands/machines/dedicated/service/secret/rm.d.ts

@@ -0,0 +1,22 @@
+import { DedicatedServiceCommand } from '../../../../../lib/dedicated-service-command';
+/**
+ * `skrr machines dedicated service secret rm` — drop a stored secret.
+ *
+ * Removing a name a spec still references is refused unless forced — the
+ * daemon answers with the referencing services, and `--force` is the caller
+ * saying they know. Rotation stays manual on purpose: `secret set` +
+ * `service restart`, never a silent restart channel.
+ */
+export default class DedicatedServiceSecretRm extends DedicatedServiceCommand {
+    static summary: string;
+    static examples: string[];
+    static args: {
+        lease: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+        name: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        force: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/machines/dedicated/service/secret/rm.js

@@ -0,0 +1,54 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const dedicated_service_command_1 = require("../../../../../lib/dedicated-service-command");
+const dedicated_service_1 = require("../../../../../lib/dedicated-service");
+/**
+ * `skrr machines dedicated service secret rm` — drop a stored secret.
+ *
+ * Removing a name a spec still references is refused unless forced — the
+ * daemon answers with the referencing services, and `--force` is the caller
+ * saying they know. Rotation stays manual on purpose: `secret set` +
+ * `service restart`, never a silent restart channel.
+ */
+class DedicatedServiceSecretRm extends dedicated_service_command_1.DedicatedServiceCommand {
+    static summary = 'Remove a stored secret (--force when services still reference it)';
+    static examples = [
+        '<%= config.bin %> machines dedicated service secret rm <lease-id> <name>',
+        '<%= config.bin %> machines dedicated service secret rm <lease-id> <name> --force',
+    ];
+    static args = {
+        lease: core_1.Args.string({
+            description: dedicated_service_command_1.SERVICE_LEASE_ARG_DESCRIPTION,
+            required: true,
+            ignoreStdin: true,
+        }),
+        name: core_1.Args.string({ description: 'Secret name', required: true, ignoreStdin: true }),
+    };
+    static flags = {
+        force: core_1.Flags.boolean({ description: 'Remove even when services still reference the name' }),
+        json: core_1.Flags.boolean({ description: 'Output the result as JSON' }),
+    };
+    async run() {
+        this.requireAuth();
+        const { args, flags } = await this.parse(DedicatedServiceSecretRm);
+        const leaseId = await this.resolveLeaseArg(args.lease);
+        if (!dedicated_service_1.SERVICE_SECRET_NAME_PATTERN.test(args.name)) {
+            this.error(`Invalid secret name ${args.name} — must start with a letter or _ and use only letters, digits, _, ., - (max 128).`, { exit: 2 });
+        }
+        const result = await this.callService('secret', {
+            leaseId,
+            op: 'rm',
+            name: args.name,
+            ...(flags.force ? { force: true } : {}),
+            ...this.scopeFrom(flags),
+        });
+        this.closeServiceChannel();
+        if (flags.json) {
+            this.log(JSON.stringify(result ?? { name: args.name, op: 'rm' }, null, 2));
+            return;
+        }
+        this.log(`Secret ${args.name} removed.`);
+    }
+}
+exports.default = DedicatedServiceSecretRm;

package/dist/commands/machines/dedicated/service/secret/set.d.ts

@@ -0,0 +1,22 @@
+import { DedicatedServiceCommand } from '../../../../../lib/dedicated-service-command';
+/**
+ * `skrr machines dedicated service secret set` — store a value the daemon
+ * resolves at spawn when a spec's env carries `secret://<name>` (phase 2).
+ *
+ * The value travels the admitted channel once; after that only the name is
+ * ever spoken — in the spec, in status output, in the audit entry.
+ */
+export default class DedicatedServiceSecretSet extends DedicatedServiceCommand {
+    static summary: string;
+    static examples: string[];
+    static args: {
+        lease: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+        name: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        value: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        'from-file': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/machines/dedicated/service/secret/set.js

@@ -0,0 +1,93 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const node_fs_1 = require("node:fs");
+const core_1 = require("@oclif/core");
+const dedicated_service_command_1 = require("../../../../../lib/dedicated-service-command");
+const dedicated_service_1 = require("../../../../../lib/dedicated-service");
+/** Read the secret's bytes: --value, --from-file, or piped stdin. */
+async function readSecretValue(command, flags) {
+    if (flags.value !== undefined && flags['from-file']) {
+        command.error('Give the secret once: --value or --from-file, not both.', { exit: 2 });
+    }
+    if (flags['from-file']) {
+        try {
+            return (0, node_fs_1.readFileSync)(flags['from-file'], 'utf8');
+        }
+        catch (err) {
+            command.error(`Cannot read ${flags['from-file']}: ${err instanceof Error ? err.message : err}`, { exit: 2 });
+        }
+    }
+    if (flags.value !== undefined)
+        return flags.value;
+    if (process.stdin.isTTY) {
+        command.error('No secret value given. Pipe it on stdin, or pass --value / --from-file.', {
+            exit: 2,
+        });
+    }
+    const chunks = [];
+    for await (const chunk of process.stdin) {
+        chunks.push(typeof chunk === 'string' ? Buffer.from(chunk) : chunk);
+    }
+    const value = Buffer.concat(chunks).toString('utf8');
+    if (!value) {
+        command.error('The secret value on stdin was empty.', { exit: 2 });
+    }
+    return value;
+}
+/**
+ * `skrr machines dedicated service secret set` — store a value the daemon
+ * resolves at spawn when a spec's env carries `secret://<name>` (phase 2).
+ *
+ * The value travels the admitted channel once; after that only the name is
+ * ever spoken — in the spec, in status output, in the audit entry.
+ */
+class DedicatedServiceSecretSet extends dedicated_service_command_1.DedicatedServiceCommand {
+    static summary = 'Store a secret a service spec can reference as secret://<name>';
+    static examples = [
+        'echo "$TOKEN" | <%= config.bin %> machines dedicated service secret set <lease-id> registry-token',
+        '<%= config.bin %> machines dedicated service secret set <lease-id> app-env --from-file .env.production',
+    ];
+    static args = {
+        lease: core_1.Args.string({
+            description: dedicated_service_command_1.SERVICE_LEASE_ARG_DESCRIPTION,
+            required: true,
+            ignoreStdin: true,
+        }),
+        name: core_1.Args.string({
+            description: 'Secret name the spec references',
+            required: true,
+            ignoreStdin: true,
+        }),
+    };
+    static flags = {
+        value: core_1.Flags.string({
+            description: 'The secret value (prefer stdin — flags show in shell history)',
+        }),
+        'from-file': core_1.Flags.string({ description: 'Read the secret value from a file' }),
+        json: core_1.Flags.boolean({ description: 'Output the result as JSON' }),
+    };
+    async run() {
+        this.requireAuth();
+        const { args, flags } = await this.parse(DedicatedServiceSecretSet);
+        const leaseId = await this.resolveLeaseArg(args.lease);
+        if (!dedicated_service_1.SERVICE_SECRET_NAME_PATTERN.test(args.name)) {
+            this.error(`Invalid secret name ${args.name} — must start with a letter or _ and use only letters, digits, _, ., - (max 128).`, { exit: 2 });
+        }
+        const value = await readSecretValue(this, flags);
+        const result = await this.callService('secret', {
+            leaseId,
+            op: 'set',
+            name: args.name,
+            value,
+            ...this.scopeFrom(flags),
+        });
+        this.closeServiceChannel();
+        if (flags.json) {
+            this.log(JSON.stringify(result ?? { name: args.name, op: 'set' }, null, 2));
+            return;
+        }
+        this.log(`Secret ${args.name} stored. Reference it in a spec as "secret://${args.name}" in an env value, ` +
+            'then `service restart` the referencing services.');
+    }
+}
+exports.default = DedicatedServiceSecretSet;

package/dist/commands/machines/dedicated/service/start.d.ts

@@ -0,0 +1,14 @@
+import { DedicatedServiceCommand } from '../../../../lib/dedicated-service-command';
+/** `skrr machines dedicated service start` — desired state back to running. */
+export default class DedicatedServiceStart extends DedicatedServiceCommand {
+    static summary: string;
+    static examples: string[];
+    static args: {
+        lease: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+        name: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/machines/dedicated/service/start.js

@@ -0,0 +1,29 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const dedicated_service_command_1 = require("../../../../lib/dedicated-service-command");
+/** `skrr machines dedicated service start` — desired state back to running. */
+class DedicatedServiceStart extends dedicated_service_command_1.DedicatedServiceCommand {
+    static summary = 'Set a service’s desired state to running';
+    static examples = [
+        '<%= config.bin %> machines dedicated service start <lease-id> <name>',
+    ];
+    static args = {
+        lease: core_1.Args.string({
+            description: dedicated_service_command_1.SERVICE_LEASE_ARG_DESCRIPTION,
+            required: true,
+            ignoreStdin: true,
+        }),
+        name: core_1.Args.string({ description: 'Service name', required: true, ignoreStdin: true }),
+    };
+    static flags = {
+        json: core_1.Flags.boolean({ description: 'Output the result as JSON' }),
+    };
+    async run() {
+        this.requireAuth();
+        const { args, flags } = await this.parse(DedicatedServiceStart);
+        const leaseId = await this.resolveLeaseArg(args.lease);
+        await this.runServiceAction(leaseId, args.name, 'start', flags);
+    }
+}
+exports.default = DedicatedServiceStart;

package/dist/commands/machines/dedicated/service/status.d.ts

@@ -0,0 +1,21 @@
+import { DedicatedServiceCommand } from '../../../../lib/dedicated-service-command';
+/**
+ * `skrr machines dedicated service status` — one service, as the machine
+ * computes it right now: the spec it reconciles, the state it derived, and
+ * the exits it has seen.
+ *
+ * Status is computed from `spec + live children`, never stored — so what
+ * prints here is what the reconciler believes, not a record that can drift.
+ */
+export default class DedicatedServiceStatus extends DedicatedServiceCommand {
+    static summary: string;
+    static examples: string[];
+    static args: {
+        lease: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+        name: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}