@skrr-ai/cli 0.1.86 → 0.1.88

package/dist/commands/machines/hosted/start.js

@@ -5,7 +5,7 @@ const node_crypto_1 = require("node:crypto");
 const base_command_1 = require("../../../base-command");
 const hosted_machines_1 = require("../../../lib/hosted-machines");
 class HostedMachinesStart extends base_command_1.BaseCommand {
-    static description = 'Start a skrr Hosted Machine';
+    static description = 'Start a Skrr Hosted Machine';
     static examples = [
         '<%= config.bin %> machines hosted start --name scratch --wait',
         '<%= config.bin %> machines hosted start --repo acme/app --installation-id 123 --branch main --wait',

package/dist/commands/machines/services/declare.d.ts

@@ -0,0 +1,24 @@
+import { BaseCommand } from '../../../base-command';
+/**
+ * `skrr machines services declare` — name a web service running on a machine
+ * so its computer's Services app can open it (design §20.5; 9-17, OSK-13579).
+ * A service is a port on the machine's own loopback and an optional path —
+ * never a host or a URL. Declaring a name again replaces it. Needs the owner
+ * or an operate grant. Declaring starts nothing: the service must already be
+ * listening, or opening it shows the browser's own error page.
+ */
+export default class MachinesServicesDeclare extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static args: {
+        machine: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        name: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+        port: import("@oclif/core/lib/interfaces").OptionFlag<number, import("@oclif/core/lib/interfaces").CustomOptions>;
+        path: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        protocol: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/machines/services/declare.js

@@ -0,0 +1,73 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const base_command_1 = require("../../../base-command");
+const machine_services_1 = require("../../../lib/machine-services");
+/**
+ * `skrr machines services declare` — name a web service running on a machine
+ * so its computer's Services app can open it (design §20.5; 9-17, OSK-13579).
+ * A service is a port on the machine's own loopback and an optional path —
+ * never a host or a URL. Declaring a name again replaces it. Needs the owner
+ * or an operate grant. Declaring starts nothing: the service must already be
+ * listening, or opening it shows the browser's own error page.
+ */
+class MachinesServicesDeclare extends base_command_1.BaseCommand {
+    static description = 'Declare a web service on a machine (a port on the machine, and a path) so its computer can open it';
+    static examples = [
+        '<%= config.bin %> machines services declare lease:dr_abc123 --name web --port 5173',
+        '<%= config.bin %> machines services declare lease:dr_abc123 --name docs --port 8443 --path /docs/ --protocol https',
+    ];
+    static args = {
+        machine: core_1.Args.string({
+            ignoreStdin: true,
+            description: 'Machine id, uuid, daemon id, name, or a unique prefix',
+            required: true,
+        }),
+    };
+    static flags = {
+        name: core_1.Flags.string({
+            description: 'Lower-case name, e.g. web, api, storybook (declaring it again replaces it)',
+            required: true,
+        }),
+        port: core_1.Flags.integer({
+            description: 'The port it listens on, on the machine (1-65535)',
+            required: true,
+            min: 1,
+            max: 65535,
+        }),
+        path: core_1.Flags.string({ description: 'Absolute path to open, e.g. /docs/ (no query string)' }),
+        protocol: core_1.Flags.string({
+            description: 'http (default) or https',
+            options: [...machine_services_1.DECLARED_SERVICE_PROTOCOLS],
+        }),
+        json: core_1.Flags.boolean({ description: 'Output as JSON' }),
+    };
+    async run() {
+        this.requireAuth();
+        const { args, flags } = await this.parse(MachinesServicesDeclare);
+        let result;
+        try {
+            result = await (0, machine_services_1.declareMachineService)(await (0, machine_services_1.servicesMachineId)(args.machine), {
+                name: flags.name,
+                port: flags.port,
+                ...(flags.path ? { path: flags.path } : {}),
+                ...(flags.protocol
+                    ? { protocol: flags.protocol }
+                    : {}),
+            });
+        }
+        catch (err) {
+            this.handleApiError(err);
+        }
+        if (flags.json) {
+            this.log(JSON.stringify(result, null, 2));
+            return;
+        }
+        const service = result?.service;
+        if (!service) {
+            this.error('The machine did not say what it stored.', { exit: 1 });
+        }
+        this.log(`${result?.replaced ? 'Replaced' : 'Declared'} ${service.name} → ${(0, machine_services_1.declaredServiceAddress)(service)} on the machine. Open it from the computer's Services app.`);
+    }
+}
+exports.default = MachinesServicesDeclare;

package/dist/commands/machines/services/index.d.ts

@@ -0,0 +1,15 @@
+import { Command } from '@oclif/core';
+/**
+ * `skrr machines services` — a machine's declared services (design §20.5;
+ * 9-17, OSK-13579): the web services an agent or a person started on it, named
+ * so the computer's Services app can open them in the computer's own browser.
+ *
+ * Not `skrr machines dedicated service`, which keeps a WORKLOAD running on a
+ * Dedicated Runtime. A declared service is an address — a port on the
+ * machine's loopback and a path — and declaring one starts nothing.
+ */
+export default class MachinesServices extends Command {
+    static description: string;
+    static examples: string[];
+    run(): Promise<void>;
+}

package/dist/commands/machines/services/index.js

@@ -0,0 +1,31 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+/**
+ * `skrr machines services` — a machine's declared services (design §20.5;
+ * 9-17, OSK-13579): the web services an agent or a person started on it, named
+ * so the computer's Services app can open them in the computer's own browser.
+ *
+ * Not `skrr machines dedicated service`, which keeps a WORKLOAD running on a
+ * Dedicated Runtime. A declared service is an address — a port on the
+ * machine's loopback and a path — and declaring one starts nothing.
+ */
+class MachinesServices extends core_1.Command {
+    static description = "Declared services — web services on a machine, named so its computer can open them in the computer's own browser";
+    static examples = [
+        '<%= config.bin %> machines services ls lease:dr_abc123',
+        '<%= config.bin %> machines services declare lease:dr_abc123 --name web --port 5173',
+        '<%= config.bin %> machines services withdraw lease:dr_abc123 web',
+    ];
+    async run() {
+        const rows = [
+            ['ls', 'list the services declared on a machine'],
+            ['declare', 'name a port on the machine (and a path) so the computer can open it'],
+            ['withdraw', 'remove a declared service'],
+        ];
+        this.log('Declared services (skrr machines services <command>):');
+        for (const [name, what] of rows)
+            this.log(`  ${name.padEnd(10)} ${what}`);
+    }
+}
+exports.default = MachinesServices;

package/dist/commands/machines/services/ls.d.ts

@@ -0,0 +1,17 @@
+import { BaseCommand } from '../../../base-command';
+/**
+ * `skrr machines services ls` — the web services declared on a machine (design
+ * §20.5; 9-17, OSK-13579), as its daemon holds them now. The owner and anyone
+ * the machine is shared with may list them.
+ */
+export default class MachinesServicesLs extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static args: {
+        machine: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/machines/services/ls.js

@@ -0,0 +1,60 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const base_command_1 = require("../../../base-command");
+const format_1 = require("../../../lib/format");
+const machine_services_1 = require("../../../lib/machine-services");
+/**
+ * `skrr machines services ls` — the web services declared on a machine (design
+ * §20.5; 9-17, OSK-13579), as its daemon holds them now. The owner and anyone
+ * the machine is shared with may list them.
+ */
+class MachinesServicesLs extends base_command_1.BaseCommand {
+    static description = 'List the web services declared on a machine — name, address on the machine, who declared it';
+    static examples = [
+        '<%= config.bin %> machines services ls lease:dr_abc123',
+        '<%= config.bin %> machines services ls my-laptop --json',
+    ];
+    static args = {
+        machine: core_1.Args.string({
+            ignoreStdin: true,
+            description: 'Machine id, uuid, daemon id, name, or a unique prefix',
+            required: true,
+        }),
+    };
+    static flags = {
+        json: core_1.Flags.boolean({ description: 'Output as JSON' }),
+    };
+    async run() {
+        this.requireAuth();
+        const { args, flags } = await this.parse(MachinesServicesLs);
+        let result;
+        try {
+            result = await (0, machine_services_1.listMachineServices)(await (0, machine_services_1.servicesMachineId)(args.machine));
+        }
+        catch (err) {
+            this.handleApiError(err);
+        }
+        if (flags.json) {
+            this.log(JSON.stringify(result, null, 2));
+            return;
+        }
+        const services = result?.services ?? [];
+        if (services.length === 0) {
+            this.log('No services are declared on this machine.');
+            return;
+        }
+        (0, format_1.renderTable)(services.map((service) => ({
+            name: (0, format_1.formatCell)(service.name),
+            address: (0, format_1.formatCell)((0, machine_services_1.declaredServiceAddress)(service)),
+            by: (0, format_1.formatCell)(service.declaredBy.label),
+            since: (0, format_1.localStamp)(service.declaredAt),
+        })), [
+            { key: 'name', header: 'NAME', verbatim: true },
+            { key: 'address', header: 'ADDRESS ON THE MACHINE', verbatim: true },
+            { key: 'by', header: 'DECLARED BY' },
+            { key: 'since', header: `SINCE (${(0, format_1.localZone)()})` },
+        ], (line) => this.log(line));
+    }
+}
+exports.default = MachinesServicesLs;

package/dist/commands/machines/services/withdraw.d.ts

@@ -0,0 +1,19 @@
+import { BaseCommand } from '../../../base-command';
+/**
+ * `skrr machines services withdraw` — remove a declared service from a
+ * machine's computer (design §20.5; 9-17, OSK-13579). Stops nothing on the
+ * machine; the service simply leaves the Services app. Needs the owner or an
+ * operate grant.
+ */
+export default class MachinesServicesWithdraw extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static args: {
+        machine: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+        name: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/machines/services/withdraw.js

@@ -0,0 +1,47 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const base_command_1 = require("../../../base-command");
+const machine_services_1 = require("../../../lib/machine-services");
+/**
+ * `skrr machines services withdraw` — remove a declared service from a
+ * machine's computer (design §20.5; 9-17, OSK-13579). Stops nothing on the
+ * machine; the service simply leaves the Services app. Needs the owner or an
+ * operate grant.
+ */
+class MachinesServicesWithdraw extends base_command_1.BaseCommand {
+    static description = 'Withdraw a declared service from a machine (stops nothing)';
+    static examples = ['<%= config.bin %> machines services withdraw lease:dr_abc123 web'];
+    static args = {
+        machine: core_1.Args.string({
+            ignoreStdin: true,
+            description: 'Machine id, uuid, daemon id, name, or a unique prefix',
+            required: true,
+        }),
+        name: core_1.Args.string({
+            ignoreStdin: true,
+            description: 'The declared service’s name',
+            required: true,
+        }),
+    };
+    static flags = {
+        json: core_1.Flags.boolean({ description: 'Output as JSON' }),
+    };
+    async run() {
+        this.requireAuth();
+        const { args, flags } = await this.parse(MachinesServicesWithdraw);
+        let result;
+        try {
+            result = await (0, machine_services_1.withdrawMachineService)(await (0, machine_services_1.servicesMachineId)(args.machine), args.name);
+        }
+        catch (err) {
+            this.handleApiError(err);
+        }
+        if (flags.json) {
+            this.log(JSON.stringify(result, null, 2));
+            return;
+        }
+        this.log(`Withdrew ${result?.withdrawn?.name ?? args.name}.`);
+    }
+}
+exports.default = MachinesServicesWithdraw;

package/dist/commands/machines/share.d.ts

@@ -0,0 +1,29 @@
+import { BaseCommand } from '../../base-command';
+/**
+ * `skrr machines share` — grant a person a tier on one of your machines
+ * (design §9, D10; OSK-13558).
+ *
+ * The two tiers are the honest ones: `watch` sees every surface and its
+ * activity; `operate` can also take control and read and write files — "the
+ * machine's account in another person's hands". `power` and grant management
+ * stay with the owner, so there is no tier flag for them. The grantee may be
+ * any user — nothing here assumes a shared workspace.
+ *
+ * One verb for issue and change: the stated tier is the end state asked for.
+ * The server refuses a bare re-issue at a different tier (a retried issue can
+ * never silently escalate a grant), so an existing grant is changed through
+ * PATCH — and the output says which of the two happened.
+ */
+export default class MachinesShare extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static args: {
+        machine: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+        user: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        tier: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/machines/share.js

@@ -0,0 +1,100 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const base_command_1 = require("../../base-command");
+const api_fetch_1 = require("../../lib/api-fetch");
+const machines_1 = require("../../lib/machines");
+const machine_grants_1 = require("../../lib/machine-grants");
+/**
+ * `skrr machines share` — grant a person a tier on one of your machines
+ * (design §9, D10; OSK-13558).
+ *
+ * The two tiers are the honest ones: `watch` sees every surface and its
+ * activity; `operate` can also take control and read and write files — "the
+ * machine's account in another person's hands". `power` and grant management
+ * stay with the owner, so there is no tier flag for them. The grantee may be
+ * any user — nothing here assumes a shared workspace.
+ *
+ * One verb for issue and change: the stated tier is the end state asked for.
+ * The server refuses a bare re-issue at a different tier (a retried issue can
+ * never silently escalate a grant), so an existing grant is changed through
+ * PATCH — and the output says which of the two happened.
+ */
+class MachinesShare extends base_command_1.BaseCommand {
+    static description = 'Share a machine with a person — `watch` lets them see every surface; `operate` also gives control and file access';
+    static examples = [
+        '<%= config.bin %> machines share 03548116 68db4b2f0b4f5a9c1d2e3f40 --tier watch',
+        '<%= config.bin %> machines share lease:rtl_abc123 68db4b2f0b4f5a9c1d2e3f40 --tier operate',
+    ];
+    static args = {
+        machine: core_1.Args.string({
+            ignoreStdin: true,
+            description: 'Machine id, uuid, daemon id, name, or a unique prefix',
+            required: true,
+        }),
+        user: core_1.Args.string({
+            ignoreStdin: true,
+            description: 'The user id of the person to share with',
+            required: true,
+        }),
+    };
+    static flags = {
+        tier: core_1.Flags.string({
+            description: 'watch: see every surface and its activity. operate: also take control, open surfaces, and read/write files',
+            required: true,
+            options: [...machine_grants_1.MACHINE_GRANT_TIERS],
+        }),
+        json: core_1.Flags.boolean({ description: 'Output as JSON' }),
+    };
+    async run() {
+        this.requireAuth();
+        const { args, flags } = await this.parse(MachinesShare);
+        const tier = flags.tier;
+        let target;
+        try {
+            target = (0, machines_1.resolveMachineRef)(await (0, machines_1.listMachines)(), args.machine);
+        }
+        catch (err) {
+            this.handleApiError(err);
+        }
+        if (!target) {
+            this.error('Machine not found.', { exit: 1 });
+        }
+        let result;
+        try {
+            result = await (0, machine_grants_1.shareMachine)(target.id, args.user, tier);
+        }
+        catch (err) {
+            // A grant already held at another tier is a change, not an issue: the
+            // user named the tier they want, so PATCH it. The 409 is the server
+            // stopping a retried ISSUE from silently escalating — this is not that.
+            if (err instanceof api_fetch_1.ApiFetchError && err.code === 'COMPUTER_GRANT_EXISTS') {
+                result = await (0, machine_grants_1.changeMachineGrant)(target.id, args.user, tier);
+            }
+            else {
+                this.handleApiError(err);
+            }
+        }
+        if (flags.json) {
+            this.log(JSON.stringify(result, null, 2));
+            return;
+        }
+        const label = target.preferences?.name || target.name || target.id;
+        if (result?.created === false) {
+            this.log(`${label} is already shared with ${args.user} at ${tier}.`);
+        }
+        else if (result?.changed === false) {
+            this.log(`${label} stays shared with ${args.user} at ${tier}.`);
+        }
+        else if (result?.changed === true) {
+            this.log(`Changed ${args.user} to ${tier} on ${label}.`);
+        }
+        else {
+            this.log(`Shared ${label} with ${args.user} at ${tier}.`);
+            if (tier === 'operate') {
+                this.log("  operate is the machine's account in their hands: control of surfaces, and file read/write.");
+            }
+        }
+    }
+}
+exports.default = MachinesShare;

package/dist/commands/machines/shared.d.ts

@@ -0,0 +1,19 @@
+import { BaseCommand } from '../../base-command';
+/**
+ * `skrr machines shared` — the machines other people shared with you
+ * (design §9, D4/D10; OSK-13567): how a grantee finds a computer without being
+ * sent a link. The grantee may be outside every workspace the owner is in, so
+ * nothing here assumes one.
+ *
+ * Each row says who shared it, at which tier (`watch` sees every surface and
+ * its activity; `operate` adds control and file read/write), and the machine's
+ * live power phase. `skrr machines dedicated computer <id>` opens one.
+ */
+export default class MachinesShared extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static flags: {
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/machines/shared.js

@@ -0,0 +1,62 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const base_command_1 = require("../../base-command");
+const format_1 = require("../../lib/format");
+const machine_grants_1 = require("../../lib/machine-grants");
+/**
+ * `skrr machines shared` — the machines other people shared with you
+ * (design §9, D4/D10; OSK-13567): how a grantee finds a computer without being
+ * sent a link. The grantee may be outside every workspace the owner is in, so
+ * nothing here assumes one.
+ *
+ * Each row says who shared it, at which tier (`watch` sees every surface and
+ * its activity; `operate` adds control and file read/write), and the machine's
+ * live power phase. `skrr machines dedicated computer <id>` opens one.
+ */
+class MachinesShared extends base_command_1.BaseCommand {
+    static description = 'List the computers shared with you — machine, owner, tier, and live state';
+    static examples = [
+        '<%= config.bin %> machines shared',
+        '<%= config.bin %> machines shared --json',
+    ];
+    static flags = {
+        json: core_1.Flags.boolean({ description: 'Output as JSON' }),
+    };
+    async run() {
+        this.requireAuth();
+        const { flags } = await this.parse(MachinesShared);
+        let result;
+        try {
+            result = await (0, machine_grants_1.listSharedMachines)();
+        }
+        catch (err) {
+            this.handleApiError(err);
+        }
+        if (flags.json) {
+            this.log(JSON.stringify(result, null, 2));
+            return;
+        }
+        const machines = result?.machines ?? [];
+        if (machines.length === 0) {
+            this.log('No computers are shared with you.');
+            return;
+        }
+        (0, format_1.renderTable)(machines.map((machine) => ({
+            id: (0, format_1.formatCell)(machine.machineId),
+            name: (0, format_1.formatCell)(machine.name),
+            owner: (0, format_1.formatCell)(machine.owner?.name || machine.owner?.username),
+            tier: (0, format_1.formatCell)(machine.tier),
+            power: (0, format_1.formatCell)(machine.power?.phase),
+            since: (0, format_1.localStamp)(machine.grantedAt),
+        })), [
+            { key: 'id', header: 'ID', verbatim: true },
+            { key: 'name', header: 'NAME', maxWidth: 28 },
+            { key: 'owner', header: 'OWNER' },
+            { key: 'tier', header: 'TIER' },
+            { key: 'power', header: 'STATE' },
+            { key: 'since', header: `SHARED (${(0, format_1.localZone)()})` },
+        ], (line) => this.log(line));
+    }
+}
+exports.default = MachinesShared;

package/dist/commands/machines/shares.d.ts

@@ -0,0 +1,16 @@
+import { BaseCommand } from '../../base-command';
+/**
+ * `skrr machines shares` — who a machine is shared with, and at which tier
+ * (design §9; OSK-13558). Owner-only: the server answers 403 to anyone else.
+ */
+export default class MachinesShares extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static args: {
+        machine: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/machines/shares.js

@@ -0,0 +1,69 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const base_command_1 = require("../../base-command");
+const format_1 = require("../../lib/format");
+const machines_1 = require("../../lib/machines");
+const machine_grants_1 = require("../../lib/machine-grants");
+/**
+ * `skrr machines shares` — who a machine is shared with, and at which tier
+ * (design §9; OSK-13558). Owner-only: the server answers 403 to anyone else.
+ */
+class MachinesShares extends base_command_1.BaseCommand {
+    static description = 'List the people a machine is shared with — grantee, tier, and when the grant was made';
+    static examples = [
+        '<%= config.bin %> machines shares 03548116',
+        '<%= config.bin %> machines shares lease:rtl_abc123 --json',
+    ];
+    static args = {
+        machine: core_1.Args.string({
+            ignoreStdin: true,
+            description: 'Machine id, uuid, daemon id, name, or a unique prefix',
+            required: true,
+        }),
+    };
+    static flags = {
+        json: core_1.Flags.boolean({ description: 'Output as JSON' }),
+    };
+    async run() {
+        this.requireAuth();
+        const { args, flags } = await this.parse(MachinesShares);
+        let target;
+        try {
+            target = (0, machines_1.resolveMachineRef)(await (0, machines_1.listMachines)(), args.machine);
+        }
+        catch (err) {
+            this.handleApiError(err);
+        }
+        if (!target) {
+            this.error('Machine not found.', { exit: 1 });
+        }
+        let result;
+        try {
+            result = await (0, machine_grants_1.listMachineGrants)(target.id);
+        }
+        catch (err) {
+            this.handleApiError(err);
+        }
+        if (flags.json) {
+            this.log(JSON.stringify(result, null, 2));
+            return;
+        }
+        const grants = result?.grants ?? [];
+        if (grants.length === 0) {
+            this.log('Not shared with anyone.');
+            return;
+        }
+        this.log(`Shared with ${grants.length} ${grants.length === 1 ? 'person' : 'people'}:`);
+        (0, format_1.renderTable)(grants.map((grant) => ({
+            user: (0, format_1.formatCell)(grant.granteeUserId),
+            tier: (0, format_1.formatCell)(grant.tier),
+            since: (0, format_1.localStamp)(grant.createdAt),
+        })), [
+            { key: 'user', header: 'USER', verbatim: true },
+            { key: 'tier', header: 'TIER' },
+            { key: 'since', header: `SINCE (${(0, format_1.localZone)()})` },
+        ], (line) => this.log(line));
+    }
+}
+exports.default = MachinesShares;

package/dist/commands/machines/unshare.d.ts

@@ -0,0 +1,19 @@
+import { BaseCommand } from '../../base-command';
+/**
+ * `skrr machines unshare` — revoke one person's grant on a machine (design §9;
+ * OSK-13558). Revocation bumps the machine's grant-set version, so its daemon
+ * detaches that person's attachments and releases any lease they hold when
+ * the new set arrives. Reversible — `machines share` grants again.
+ */
+export default class MachinesUnshare extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static args: {
+        machine: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+        user: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}