@skrr-ai/cli 0.1.87 → 0.1.88

package/dist/commands/machines/dedicated/rm.js

@@ -0,0 +1,100 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const dedicated_lease_command_1 = require("../../../lib/dedicated-lease-command");
+const computer_files_1 = require("../../../lib/computer-files");
+/**
+ * `skrr machines dedicated rm` — delete one path on the machine.
+ *
+ * As `rm` does: a directory needs --recursive and is refused `not_empty`
+ * without it. `--tag` is the optimistic-concurrency fence — the tag `stat`
+ * prints; a file that changed since that read is refused `file_changed`, so a
+ * scripted delete never removes a version it never saw. For `--recursive` the
+ * tag must be the folder's CONTENTS tag (`stat --contents`): anything changed
+ * inside the folder since is refused. `--recursive` without `--tag` is unfenced.
+ */
+class DedicatedMachinesRm extends dedicated_lease_command_1.DedicatedLeaseCommand {
+    static summary = 'Delete a file or folder on a Dedicated Runtime machine';
+    static description = 'Deletes one path inside repos/ or user-data/, as the workload user. A ' +
+        'folder needs --recursive and is refused without it. --tag takes the tag ' +
+        '`stat` prints and refuses the delete when the path changed since. With ' +
+        "--recursive, --tag must be the folder's contents tag from `stat --contents` " +
+        '(inode:size:mtimeNs:contents), and the delete is refused if anything inside ' +
+        'the folder changed since; --recursive without --tag deletes whatever the ' +
+        'folder holds at that moment (unfenced). There is no trash: a deleted path is gone.';
+    static examples = [
+        '<%= config.bin %> machines dedicated rm rtl_abc123 user-data/notes/draft.md',
+        '<%= config.bin %> machines dedicated rm rtl_abc123 repos/app/dist --recursive',
+        '<%= config.bin %> machines dedicated rm rtl_abc123 repos/app/lock --tag 12345:3182:1761234567890000000',
+        '<%= config.bin %> machines dedicated rm rtl_abc123 repos/app/dist --recursive --tag <tag from `stat --contents`>',
+    ];
+    static args = {
+        lease: core_1.Args.string({
+            description: dedicated_lease_command_1.DEDICATED_LEASE_ARG_DESCRIPTION,
+            required: true,
+            ignoreStdin: true,
+        }),
+        path: core_1.Args.string({
+            description: 'Path to delete, relative to /workspace (inside repos/ or user-data/)',
+            required: true,
+            ignoreStdin: true,
+        }),
+    };
+    static flags = {
+        recursive: core_1.Flags.boolean({
+            char: 'r',
+            description: 'Delete a folder and everything in it',
+        }),
+        tag: core_1.Flags.string({
+            description: 'Refuse unless the path still has this tag — the <inode>:<size>:<mtimeNs> `stat` prints; with --recursive, the <inode>:<size>:<mtimeNs>:<contents> tag `stat --contents` prints',
+        }),
+        json: core_1.Flags.boolean({ description: 'Output the result as JSON' }),
+    };
+    async run() {
+        this.requireAuth();
+        const { args, flags } = await this.parse(DedicatedMachinesRm);
+        const leaseId = await this.resolveLeaseArg(args.lease);
+        let tag;
+        if (flags.tag !== undefined) {
+            try {
+                tag = (0, computer_files_1.parseComputerFileTag)(flags.tag);
+            }
+            catch (err) {
+                this.error(err.message, { exit: 2 });
+            }
+            // Said here rather than spent on a round trip the server would refuse
+            // (`contents_tag_required`): a folder's own tag covers only its direct
+            // entries, which is not what a recursive delete erases.
+            if (flags.recursive === true && tag?.contents === undefined) {
+                this.error(`--recursive --tag needs the folder's contents tag, which covers everything inside it. Read it with \`${this.config.bin} machines dedicated stat ${leaseId} ${args.path} --contents\` and pass that tag.`, { exit: 2 });
+            }
+        }
+        let result;
+        try {
+            const scope = this.scopeFrom(flags);
+            const generation = await (0, computer_files_1.resolveDedicatedFileGeneration)(leaseId, scope);
+            result = await (0, computer_files_1.deleteComputerFile)(leaseId, {
+                path: args.path,
+                generation,
+                ...(tag ? { tag } : {}),
+                recursive: flags.recursive === true,
+            }, scope);
+        }
+        catch (err) {
+            const failure = (0, computer_files_1.describeComputerFileFailure)(err, {
+                bin: this.config.bin,
+                leaseId,
+                takesTag: true,
+            });
+            if (failure)
+                this.failWithCliError({ ...failure, exit: 1 });
+            this.handleApiError(err);
+        }
+        if (flags.json) {
+            this.log(JSON.stringify({ ...result, deleted: true }, null, 2));
+            return;
+        }
+        this.log(`Deleted ${result.path}`);
+    }
+}
+exports.default = DedicatedMachinesRm;

package/dist/commands/machines/dedicated/search.d.ts

@@ -0,0 +1,24 @@
+import { DedicatedLeaseCommand } from '../../../lib/dedicated-lease-command';
+/**
+ * `skrr machines dedicated search` — find files by name, or text inside them,
+ * under one folder. Guest-only today; the answer states whether it is whole.
+ */
+export default class DedicatedMachinesSearch extends DedicatedLeaseCommand {
+    static summary: string;
+    static description: string;
+    static examples: string[];
+    static args: {
+        lease: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+        path: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        query: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+        content: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+        'no-ignore': import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+        'case-sensitive': import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+        limit: import("@oclif/core/lib/interfaces").OptionFlag<number | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        'budget-ms': import("@oclif/core/lib/interfaces").OptionFlag<number | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/machines/dedicated/search.js

@@ -0,0 +1,78 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const dedicated_lease_command_1 = require("../../../lib/dedicated-lease-command");
+const computer_files_1 = require("../../../lib/computer-files");
+/**
+ * `skrr machines dedicated search` — find files by name, or text inside them,
+ * under one folder. Guest-only today; the answer states whether it is whole.
+ */
+class DedicatedMachinesSearch extends dedicated_lease_command_1.DedicatedLeaseCommand {
+    static summary = 'Search a folder on a Dedicated Runtime machine';
+    static description = 'Finds files by name, or with --content lines containing the text, under one folder. ' +
+        '.gitignore is honoured unless --no-ignore. The search is bounded: it stops at the result ' +
+        'limit or at a time bound, and says which — a truncated or "still searching" answer is ' +
+        'never printed as complete. Available on dedicated machines, not on a personal machine.';
+    static examples = [
+        '<%= config.bin %> machines dedicated search rtl_abc123 repos/app --query package.json',
+        '<%= config.bin %> machines dedicated search rtl_abc123 repos/app --query TODO --content --limit 50',
+        '<%= config.bin %> machines dedicated search rtl_abc123 repos/app --query dist --no-ignore --json',
+    ];
+    static args = {
+        lease: core_1.Args.string({
+            description: dedicated_lease_command_1.DEDICATED_LEASE_ARG_DESCRIPTION,
+            required: true,
+            ignoreStdin: true,
+        }),
+        path: core_1.Args.string({
+            description: 'Folder to search under, relative to /workspace (inside repos/ or user-data/)',
+            required: true,
+            ignoreStdin: true,
+        }),
+    };
+    static flags = {
+        query: core_1.Flags.string({
+            description: 'Text to look for (one line, at most 200 characters)',
+            required: true,
+        }),
+        content: core_1.Flags.boolean({ description: 'Search inside files instead of file names' }),
+        'no-ignore': core_1.Flags.boolean({ description: 'Also search what .gitignore excludes' }),
+        'case-sensitive': core_1.Flags.boolean({ description: 'Match case exactly' }),
+        limit: core_1.Flags.integer({ description: 'Most results to return (at most 1000)' }),
+        'budget-ms': core_1.Flags.integer({ description: 'Time bound in milliseconds (at most 20000)' }),
+        json: core_1.Flags.boolean({ description: 'Output the result as JSON' }),
+    };
+    async run() {
+        this.requireAuth();
+        const { args, flags } = await this.parse(DedicatedMachinesSearch);
+        const leaseId = await this.resolveLeaseArg(args.lease);
+        let result;
+        try {
+            const scope = this.scopeFrom(flags);
+            const generation = await (0, computer_files_1.resolveDedicatedFileGeneration)(leaseId, scope);
+            result = await (0, computer_files_1.searchComputerFiles)(leaseId, {
+                path: args.path,
+                generation,
+                query: flags.query,
+                content: flags.content,
+                ...(flags['no-ignore'] ? { respectIgnore: false } : {}),
+                caseSensitive: flags['case-sensitive'],
+                ...(flags.limit !== undefined ? { limit: flags.limit } : {}),
+                ...(flags['budget-ms'] !== undefined ? { budgetMs: flags['budget-ms'] } : {}),
+            }, scope);
+        }
+        catch (err) {
+            const failure = (0, computer_files_1.describeComputerFileFailure)(err, { bin: this.config.bin, leaseId });
+            if (failure)
+                this.failWithCliError({ ...failure, exit: 1 });
+            this.handleApiError(err);
+        }
+        if (flags.json) {
+            this.log(JSON.stringify(result, null, 2));
+            return;
+        }
+        for (const line of (0, computer_files_1.computerFileSearchLines)(result))
+            this.log(line);
+    }
+}
+exports.default = DedicatedMachinesSearch;

package/dist/commands/machines/dedicated/stat.d.ts

@@ -0,0 +1,22 @@
+import type { ComputerFileStatResult } from '@skrr-ai/data-provider';
+import { DedicatedLeaseCommand } from '../../../lib/dedicated-lease-command';
+/** The `stat` read-out, as lines. Pure so a spec can pin it. */
+export declare function computerFileStatLines(result: ComputerFileStatResult): string[];
+/**
+ * `skrr machines dedicated stat` — one path's facts, including the entity tag
+ * a `mv`/`rm`/`file_changed` retry presents.
+ */
+export default class DedicatedMachinesStat extends DedicatedLeaseCommand {
+    static summary: string;
+    static description: string;
+    static examples: string[];
+    static args: {
+        lease: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+        path: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        contents: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/machines/dedicated/stat.js

@@ -0,0 +1,92 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.computerFileStatLines = computerFileStatLines;
+const core_1 = require("@oclif/core");
+const dedicated_lease_command_1 = require("../../../lib/dedicated-lease-command");
+const computer_files_1 = require("../../../lib/computer-files");
+/** The `stat` read-out, as lines. Pure so a spec can pin it. */
+function computerFileStatLines(result) {
+    const { entry } = result;
+    const lines = [entry.path];
+    const row = (label, value) => {
+        if (value === undefined || value === null || value === '')
+            return;
+        lines.push(`  ${`${label} `.padEnd(12)}${value}`);
+    };
+    row('type', entry.type);
+    row('size', `${entry.size} bytes`);
+    row('modified', Number.isFinite(entry.mtimeMs) ? new Date(entry.mtimeMs).toISOString() : undefined);
+    row('mode', `${entry.mode.toString(8).padStart(4, '0')} (${(0, computer_files_1.computerFileModeString)(entry.type, entry.mode)})`);
+    row('link target', entry.linkTarget);
+    if (entry.withheld) {
+        row('withheld', `${entry.withheld.reason}${entry.withheld.rule ? ` (${entry.withheld.rule})` : ''}`);
+    }
+    // `--contents` on a folder: how much a fenced `rm -r --tag` would erase.
+    if (result.entries !== undefined) {
+        row('contains', `${result.entries} entr${result.entries === 1 ? 'y' : 'ies'}, at every depth`);
+    }
+    // The tag is what `--tag` on mv and rm takes back, spelled the same way — for
+    // a folder read with --contents, with its contents digest as a fourth part.
+    row('tag', result.tag ? (0, computer_files_1.computerFileTagString)(result.tag) : undefined);
+    return lines;
+}
+/**
+ * `skrr machines dedicated stat` — one path's facts, including the entity tag
+ * a `mv`/`rm`/`file_changed` retry presents.
+ */
+class DedicatedMachinesStat extends dedicated_lease_command_1.DedicatedLeaseCommand {
+    static summary = 'Show one path on a Dedicated Runtime machine, with its tag';
+    static description = 'Type, size, mtime, mode and link target of one path on the machine, plus its entity tag, ' +
+        'the optimistic-concurrency token --tag on `mv` and `rm` (and --if-tag on `cp`) accepts. ' +
+        'With --contents, a folder is also walked: its tag gains a fourth part, a digest of everything ' +
+        'inside it, and the entry count is shown — the tag `rm --recursive --tag` needs, so a fenced ' +
+        'recursive delete can only erase what you were shown. A path the machine withholds is answered ' +
+        'as a refusal.';
+    static examples = [
+        '<%= config.bin %> machines dedicated stat rtl_abc123 repos/app/package.json',
+        '<%= config.bin %> machines dedicated stat rtl_abc123 repos/app --json',
+        '<%= config.bin %> machines dedicated stat rtl_abc123 repos/app/dist --contents',
+    ];
+    static args = {
+        lease: core_1.Args.string({
+            description: dedicated_lease_command_1.DEDICATED_LEASE_ARG_DESCRIPTION,
+            required: true,
+            ignoreStdin: true,
+        }),
+        path: core_1.Args.string({
+            description: 'Path on the machine, relative to /workspace',
+            required: true,
+            ignoreStdin: true,
+        }),
+    };
+    static flags = {
+        contents: core_1.Flags.boolean({
+            description: 'For a folder: walk it and show its contents tag and entry count (for `rm --recursive --tag`)',
+        }),
+        json: core_1.Flags.boolean({ description: 'Output the result as JSON' }),
+    };
+    async run() {
+        this.requireAuth();
+        const { args, flags } = await this.parse(DedicatedMachinesStat);
+        const leaseId = await this.resolveLeaseArg(args.lease);
+        let result;
+        try {
+            const scope = this.scopeFrom(flags);
+            const generation = await (0, computer_files_1.resolveDedicatedFileGeneration)(leaseId, scope);
+            result = await (0, computer_files_1.statComputerFile)(leaseId, { path: args.path, generation, ...(flags.contents ? { contents: true } : {}) }, scope);
+        }
+        catch (err) {
+            const failure = (0, computer_files_1.describeComputerFileFailure)(err, { bin: this.config.bin, leaseId });
+            if (failure)
+                this.failWithCliError({ ...failure, exit: 1 });
+            this.handleApiError(err);
+        }
+        if (flags.json) {
+            this.log(JSON.stringify(result, null, 2));
+            return;
+        }
+        for (const line of computerFileStatLines(result))
+            this.log(line);
+    }
+}
+exports.default = DedicatedMachinesStat;

package/dist/commands/machines/hosted/index.js

@@ -14,7 +14,7 @@ class Machines extends core_1.Command {
         '<%= config.bin %> machines hosted connect <machine-id>',
     ];
     async run() {
-        this.log('skrr Hosted Machine commands:');
+        this.log('Skrr Hosted Machine commands:');
         this.log('  skrr machines hosted start      start a hosted machine');
         this.log('  skrr machines hosted list       list Hosted Machine sessions');
         this.log('  skrr machines hosted status     show machine status');

package/dist/commands/machines/hosted/list.js

@@ -6,7 +6,7 @@ const api_fetch_1 = require("../../../lib/api-fetch");
 const format_1 = require("../../../lib/format");
 const hosted_machines_1 = require("../../../lib/hosted-machines");
 class HostedMachinesList extends base_command_1.BaseCommand {
-    static description = 'List skrr Hosted Machine sessions';
+    static description = 'List Skrr Hosted Machine sessions';
     static examples = [
         '<%= config.bin %> machines hosted list',
         '<%= config.bin %> machines hosted list --workspace <workspace-id>',

package/dist/commands/machines/hosted/start.js

@@ -5,7 +5,7 @@ const node_crypto_1 = require("node:crypto");
 const base_command_1 = require("../../../base-command");
 const hosted_machines_1 = require("../../../lib/hosted-machines");
 class HostedMachinesStart extends base_command_1.BaseCommand {
-    static description = 'Start a skrr Hosted Machine';
+    static description = 'Start a Skrr Hosted Machine';
     static examples = [
         '<%= config.bin %> machines hosted start --name scratch --wait',
         '<%= config.bin %> machines hosted start --repo acme/app --installation-id 123 --branch main --wait',

package/dist/commands/machines/services/declare.d.ts

@@ -0,0 +1,24 @@
+import { BaseCommand } from '../../../base-command';
+/**
+ * `skrr machines services declare` — name a web service running on a machine
+ * so its computer's Services app can open it (design §20.5; 9-17, OSK-13579).
+ * A service is a port on the machine's own loopback and an optional path —
+ * never a host or a URL. Declaring a name again replaces it. Needs the owner
+ * or an operate grant. Declaring starts nothing: the service must already be
+ * listening, or opening it shows the browser's own error page.
+ */
+export default class MachinesServicesDeclare extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static args: {
+        machine: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        name: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+        port: import("@oclif/core/lib/interfaces").OptionFlag<number, import("@oclif/core/lib/interfaces").CustomOptions>;
+        path: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        protocol: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/machines/services/declare.js

@@ -0,0 +1,73 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const base_command_1 = require("../../../base-command");
+const machine_services_1 = require("../../../lib/machine-services");
+/**
+ * `skrr machines services declare` — name a web service running on a machine
+ * so its computer's Services app can open it (design §20.5; 9-17, OSK-13579).
+ * A service is a port on the machine's own loopback and an optional path —
+ * never a host or a URL. Declaring a name again replaces it. Needs the owner
+ * or an operate grant. Declaring starts nothing: the service must already be
+ * listening, or opening it shows the browser's own error page.
+ */
+class MachinesServicesDeclare extends base_command_1.BaseCommand {
+    static description = 'Declare a web service on a machine (a port on the machine, and a path) so its computer can open it';
+    static examples = [
+        '<%= config.bin %> machines services declare lease:dr_abc123 --name web --port 5173',
+        '<%= config.bin %> machines services declare lease:dr_abc123 --name docs --port 8443 --path /docs/ --protocol https',
+    ];
+    static args = {
+        machine: core_1.Args.string({
+            ignoreStdin: true,
+            description: 'Machine id, uuid, daemon id, name, or a unique prefix',
+            required: true,
+        }),
+    };
+    static flags = {
+        name: core_1.Flags.string({
+            description: 'Lower-case name, e.g. web, api, storybook (declaring it again replaces it)',
+            required: true,
+        }),
+        port: core_1.Flags.integer({
+            description: 'The port it listens on, on the machine (1-65535)',
+            required: true,
+            min: 1,
+            max: 65535,
+        }),
+        path: core_1.Flags.string({ description: 'Absolute path to open, e.g. /docs/ (no query string)' }),
+        protocol: core_1.Flags.string({
+            description: 'http (default) or https',
+            options: [...machine_services_1.DECLARED_SERVICE_PROTOCOLS],
+        }),
+        json: core_1.Flags.boolean({ description: 'Output as JSON' }),
+    };
+    async run() {
+        this.requireAuth();
+        const { args, flags } = await this.parse(MachinesServicesDeclare);
+        let result;
+        try {
+            result = await (0, machine_services_1.declareMachineService)(await (0, machine_services_1.servicesMachineId)(args.machine), {
+                name: flags.name,
+                port: flags.port,
+                ...(flags.path ? { path: flags.path } : {}),
+                ...(flags.protocol
+                    ? { protocol: flags.protocol }
+                    : {}),
+            });
+        }
+        catch (err) {
+            this.handleApiError(err);
+        }
+        if (flags.json) {
+            this.log(JSON.stringify(result, null, 2));
+            return;
+        }
+        const service = result?.service;
+        if (!service) {
+            this.error('The machine did not say what it stored.', { exit: 1 });
+        }
+        this.log(`${result?.replaced ? 'Replaced' : 'Declared'} ${service.name} → ${(0, machine_services_1.declaredServiceAddress)(service)} on the machine. Open it from the computer's Services app.`);
+    }
+}
+exports.default = MachinesServicesDeclare;

package/dist/commands/machines/services/index.d.ts

@@ -0,0 +1,15 @@
+import { Command } from '@oclif/core';
+/**
+ * `skrr machines services` — a machine's declared services (design §20.5;
+ * 9-17, OSK-13579): the web services an agent or a person started on it, named
+ * so the computer's Services app can open them in the computer's own browser.
+ *
+ * Not `skrr machines dedicated service`, which keeps a WORKLOAD running on a
+ * Dedicated Runtime. A declared service is an address — a port on the
+ * machine's loopback and a path — and declaring one starts nothing.
+ */
+export default class MachinesServices extends Command {
+    static description: string;
+    static examples: string[];
+    run(): Promise<void>;
+}

package/dist/commands/machines/services/index.js

@@ -0,0 +1,31 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+/**
+ * `skrr machines services` — a machine's declared services (design §20.5;
+ * 9-17, OSK-13579): the web services an agent or a person started on it, named
+ * so the computer's Services app can open them in the computer's own browser.
+ *
+ * Not `skrr machines dedicated service`, which keeps a WORKLOAD running on a
+ * Dedicated Runtime. A declared service is an address — a port on the
+ * machine's loopback and a path — and declaring one starts nothing.
+ */
+class MachinesServices extends core_1.Command {
+    static description = "Declared services — web services on a machine, named so its computer can open them in the computer's own browser";
+    static examples = [
+        '<%= config.bin %> machines services ls lease:dr_abc123',
+        '<%= config.bin %> machines services declare lease:dr_abc123 --name web --port 5173',
+        '<%= config.bin %> machines services withdraw lease:dr_abc123 web',
+    ];
+    async run() {
+        const rows = [
+            ['ls', 'list the services declared on a machine'],
+            ['declare', 'name a port on the machine (and a path) so the computer can open it'],
+            ['withdraw', 'remove a declared service'],
+        ];
+        this.log('Declared services (skrr machines services <command>):');
+        for (const [name, what] of rows)
+            this.log(`  ${name.padEnd(10)} ${what}`);
+    }
+}
+exports.default = MachinesServices;

package/dist/commands/machines/services/ls.d.ts

@@ -0,0 +1,17 @@
+import { BaseCommand } from '../../../base-command';
+/**
+ * `skrr machines services ls` — the web services declared on a machine (design
+ * §20.5; 9-17, OSK-13579), as its daemon holds them now. The owner and anyone
+ * the machine is shared with may list them.
+ */
+export default class MachinesServicesLs extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static args: {
+        machine: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/machines/services/ls.js

@@ -0,0 +1,60 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const base_command_1 = require("../../../base-command");
+const format_1 = require("../../../lib/format");
+const machine_services_1 = require("../../../lib/machine-services");
+/**
+ * `skrr machines services ls` — the web services declared on a machine (design
+ * §20.5; 9-17, OSK-13579), as its daemon holds them now. The owner and anyone
+ * the machine is shared with may list them.
+ */
+class MachinesServicesLs extends base_command_1.BaseCommand {
+    static description = 'List the web services declared on a machine — name, address on the machine, who declared it';
+    static examples = [
+        '<%= config.bin %> machines services ls lease:dr_abc123',
+        '<%= config.bin %> machines services ls my-laptop --json',
+    ];
+    static args = {
+        machine: core_1.Args.string({
+            ignoreStdin: true,
+            description: 'Machine id, uuid, daemon id, name, or a unique prefix',
+            required: true,
+        }),
+    };
+    static flags = {
+        json: core_1.Flags.boolean({ description: 'Output as JSON' }),
+    };
+    async run() {
+        this.requireAuth();
+        const { args, flags } = await this.parse(MachinesServicesLs);
+        let result;
+        try {
+            result = await (0, machine_services_1.listMachineServices)(await (0, machine_services_1.servicesMachineId)(args.machine));
+        }
+        catch (err) {
+            this.handleApiError(err);
+        }
+        if (flags.json) {
+            this.log(JSON.stringify(result, null, 2));
+            return;
+        }
+        const services = result?.services ?? [];
+        if (services.length === 0) {
+            this.log('No services are declared on this machine.');
+            return;
+        }
+        (0, format_1.renderTable)(services.map((service) => ({
+            name: (0, format_1.formatCell)(service.name),
+            address: (0, format_1.formatCell)((0, machine_services_1.declaredServiceAddress)(service)),
+            by: (0, format_1.formatCell)(service.declaredBy.label),
+            since: (0, format_1.localStamp)(service.declaredAt),
+        })), [
+            { key: 'name', header: 'NAME', verbatim: true },
+            { key: 'address', header: 'ADDRESS ON THE MACHINE', verbatim: true },
+            { key: 'by', header: 'DECLARED BY' },
+            { key: 'since', header: `SINCE (${(0, format_1.localZone)()})` },
+        ], (line) => this.log(line));
+    }
+}
+exports.default = MachinesServicesLs;

package/dist/commands/machines/services/withdraw.d.ts

@@ -0,0 +1,19 @@
+import { BaseCommand } from '../../../base-command';
+/**
+ * `skrr machines services withdraw` — remove a declared service from a
+ * machine's computer (design §20.5; 9-17, OSK-13579). Stops nothing on the
+ * machine; the service simply leaves the Services app. Needs the owner or an
+ * operate grant.
+ */
+export default class MachinesServicesWithdraw extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static args: {
+        machine: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+        name: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/machines/services/withdraw.js

@@ -0,0 +1,47 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const base_command_1 = require("../../../base-command");
+const machine_services_1 = require("../../../lib/machine-services");
+/**
+ * `skrr machines services withdraw` — remove a declared service from a
+ * machine's computer (design §20.5; 9-17, OSK-13579). Stops nothing on the
+ * machine; the service simply leaves the Services app. Needs the owner or an
+ * operate grant.
+ */
+class MachinesServicesWithdraw extends base_command_1.BaseCommand {
+    static description = 'Withdraw a declared service from a machine (stops nothing)';
+    static examples = ['<%= config.bin %> machines services withdraw lease:dr_abc123 web'];
+    static args = {
+        machine: core_1.Args.string({
+            ignoreStdin: true,
+            description: 'Machine id, uuid, daemon id, name, or a unique prefix',
+            required: true,
+        }),
+        name: core_1.Args.string({
+            ignoreStdin: true,
+            description: 'The declared service’s name',
+            required: true,
+        }),
+    };
+    static flags = {
+        json: core_1.Flags.boolean({ description: 'Output as JSON' }),
+    };
+    async run() {
+        this.requireAuth();
+        const { args, flags } = await this.parse(MachinesServicesWithdraw);
+        let result;
+        try {
+            result = await (0, machine_services_1.withdrawMachineService)(await (0, machine_services_1.servicesMachineId)(args.machine), args.name);
+        }
+        catch (err) {
+            this.handleApiError(err);
+        }
+        if (flags.json) {
+            this.log(JSON.stringify(result, null, 2));
+            return;
+        }
+        this.log(`Withdrew ${result?.withdrawn?.name ?? args.name}.`);
+    }
+}
+exports.default = MachinesServicesWithdraw;