@ornncompute/cli 0.1.0

package/README.md

@@ -0,0 +1,44 @@
+# Ornn Fabric CLI
+
+Command-line access for Ornn Fabric marketplace, reserve, portfolio, VM/Bare
+Metal machine, SSH key, and approved VM image workflows.
+
+## Install
+
+```bash
+curl -fsSL https://fabric.ornn.com/cli/install | sh
+```
+
+The installer requires Node.js 20 or newer and npm. It installs `@ornncompute/cli`
+globally, exposes both `fabric` and `ornn` binaries, adds the npm global bin
+directory to the user's shell profile when needed, and writes
+`ORNN_AUTH_BASE_URL` for the Fabric host that served the installer.
+
+## Commands
+
+```bash
+fabric login
+fabric whoami
+fabric status
+fabric marketplace listings
+fabric reserve view --view week
+fabric reserve create --deployment-id <id> --gpu-count 8 --start-date 2026-06-01 --end-date 2026-06-07 --price 12.50
+fabric portfolio reservations
+fabric portfolio bids
+fabric machines list <reservation-id>
+fabric machines switch-access <reservation-id> --mode vm --ssh-key-id <key-id> --image-id <image-id>
+fabric machines push-keys <instance-id> --ssh-key-id <key-id>
+fabric ssh-keys list
+fabric images list
+fabric images upload --name "Research Image" --os-family ubuntu-22.04 --registry-ref ghcr.io/org/image:tag --sha256 <hex> --cosign-signature <sig> --size-bytes <n>
+fabric images revoke <image-id>
+fabric logout
+```
+
+Custom VM image uploads are tenant-scoped by the web proxy; the CLI does not
+ask for an internal tenant ID. Use `--image-file <path>` for small local test
+payloads, or `--registry-ref <ref>` with `--sha256` and `--size-bytes` for
+registry-backed image records.
+
+Run `fabric --help` for the full command list and `fabric api` for the
+allowlisted compute API escape hatch.

package/bin/ornn.js

@@ -0,0 +1,11 @@
+#!/usr/bin/env node
+
+import { run } from "../src/cli.mjs";
+
+const exitCode = await run(process.argv.slice(2), {
+  env: process.env,
+  stderr: process.stderr,
+  stdout: process.stdout,
+});
+
+process.exitCode = exitCode;

package/package.json

@@ -0,0 +1,35 @@
+{
+  "name": "@ornncompute/cli",
+  "version": "0.1.0",
+  "description": "Command-line interface for Ornn Fabric marketplace, reserve, portfolio, and machine workflows.",
+  "type": "module",
+  "bin": {
+    "fabric": "bin/ornn.js",
+    "ornn": "bin/ornn.js"
+  },
+  "files": [
+    "bin",
+    "src",
+    "README.md"
+  ],
+  "homepage": "https://fabric.ornn.com",
+  "bugs": {
+    "url": "https://github.com/Ornn-AI/fabric/issues"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Ornn-AI/fabric.git",
+    "directory": "apps/cli"
+  },
+  "license": "UNLICENSED",
+  "publishConfig": {
+    "access": "public",
+    "registry": "https://registry.npmjs.org/"
+  },
+  "scripts": {
+    "test": "node --test"
+  },
+  "engines": {
+    "node": ">=20"
+  }
+}

package/src/api-client.mjs

@@ -0,0 +1,112 @@
+import { loadAuthSession } from "./auth-store.mjs";
+import { resolveAuthBaseUrl } from "./device-auth.mjs";
+
+export class CliApiError extends Error {
+  constructor(message, { status, detail } = {}) {
+    super(message);
+    this.name = "CliApiError";
+    this.status = status;
+    this.detail = detail;
+  }
+}
+
+export function resolveApiBaseUrl({ env = process.env, explicit, session } = {}) {
+  return (
+    explicit?.trim() ||
+    env.ORNN_API_BASE_URL?.trim() ||
+    env.ORNN_AUTH_BASE_URL?.trim() ||
+    session?.authBaseUrl?.trim() ||
+    resolveAuthBaseUrl({ env })
+  ).replace(/\/+$/, "");
+}
+
+export async function loadRequiredSession({ env = process.env } = {}) {
+  const session = await loadAuthSession({ env });
+  if (!session?.accessToken) {
+    throw new CliApiError("Not logged in. Run `fabric login` first.", { status: 401 });
+  }
+  return session;
+}
+
+export async function cliRequest({
+  authRequired = true,
+  body,
+  endpoint,
+  env = process.env,
+  fetchImpl = fetch,
+  method = "GET",
+  raw = false,
+  session,
+} = {}) {
+  const authSession = session ?? (authRequired ? await loadRequiredSession({ env }) : null);
+  const baseUrl = resolveApiBaseUrl({ env, session: authSession });
+  const url = new URL(endpoint, `${baseUrl}/`);
+  const headers = {
+    Accept: raw ? "*/*" : "application/json",
+  };
+
+  if (authSession?.accessToken) {
+    headers.Authorization = `Bearer ${authSession.accessToken}`;
+  }
+
+  let requestBody;
+  if (body !== undefined) {
+    headers["Content-Type"] = "application/json";
+    requestBody = typeof body === "string" ? body : JSON.stringify(body);
+  }
+
+  let response;
+  try {
+    response = await fetchImpl(url, {
+      body: requestBody,
+      headers,
+      method,
+    });
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    throw new CliApiError(`Could not reach Fabric at ${baseUrl}: ${message}`);
+  }
+
+  if (raw) {
+    const text = await response.text();
+    if (!response.ok) {
+      throw new CliApiError(text || response.statusText, { status: response.status });
+    }
+    return text;
+  }
+
+  const text = await response.text();
+  const data = text ? parseJson(text, url.toString()) : null;
+  if (!response.ok) {
+    const detail = data?.detail || data?.error || response.statusText;
+    throw new CliApiError(`Fabric request failed: ${detail}`, {
+      detail: data,
+      status: response.status,
+    });
+  }
+  return data;
+}
+
+export function computeEndpoint(path) {
+  const normalized = normalizeComputePath(path);
+  return `/api/cli/compute${normalized}`;
+}
+
+export function normalizeComputePath(path) {
+  if (!path || typeof path !== "string") {
+    throw new CliApiError("API path is required.");
+  }
+  const trimmed = path.trim();
+  if (!trimmed.startsWith("/")) {
+    return `/${trimmed}`;
+  }
+  return trimmed;
+}
+
+function parseJson(text, url) {
+  try {
+    return JSON.parse(text);
+  } catch {
+    throw new CliApiError(`Fabric returned invalid JSON from ${url}.`);
+  }
+}

package/src/auth-store.mjs

@@ -0,0 +1,56 @@
+import { mkdir, readFile, rm, writeFile } from "node:fs/promises";
+import { dirname, join, resolve } from "node:path";
+import { homedir } from "node:os";
+
+const APP_DIR = "ornn";
+const AUTH_FILE = "auth.json";
+
+export function getAuthConfigDir(env = process.env) {
+  if (env.ORNN_CONFIG_HOME?.trim()) {
+    return resolve(env.ORNN_CONFIG_HOME.trim());
+  }
+
+  if (env.XDG_CONFIG_HOME?.trim()) {
+    return join(env.XDG_CONFIG_HOME.trim(), APP_DIR);
+  }
+
+  return join(homedir(), ".config", APP_DIR);
+}
+
+export function getAuthConfigPath(env = process.env) {
+  return join(getAuthConfigDir(env), AUTH_FILE);
+}
+
+export async function loadAuthSession({ env = process.env } = {}) {
+  const path = getAuthConfigPath(env);
+
+  try {
+    const raw = await readFile(path, "utf8");
+    return JSON.parse(raw);
+  } catch (error) {
+    if (error?.code === "ENOENT") {
+      return null;
+    }
+    throw error;
+  }
+}
+
+export async function saveAuthSession(session, { env = process.env, now = new Date() } = {}) {
+  const path = getAuthConfigPath(env);
+  const payload = {
+    ...session,
+    savedAt: now.toISOString(),
+  };
+
+  await mkdir(dirname(path), { recursive: true, mode: 0o700 });
+  await writeFile(path, `${JSON.stringify(payload, null, 2)}\n`, {
+    encoding: "utf8",
+    mode: 0o600,
+  });
+
+  return payload;
+}
+
+export async function clearAuthSession({ env = process.env } = {}) {
+  await rm(getAuthConfigPath(env), { force: true });
+}

package/src/cli.mjs

@@ -0,0 +1,902 @@
+import { createHash } from "node:crypto";
+import { readFile } from "node:fs/promises";
+
+import {
+  CliApiError,
+  cliRequest,
+  computeEndpoint,
+} from "./api-client.mjs";
+import { clearAuthSession, getAuthConfigPath, loadAuthSession, saveAuthSession } from "./auth-store.mjs";
+import {
+  DeviceAuthError,
+  openBrowser,
+  resolveAuthBaseUrl,
+  startDeviceFlow,
+  waitForDeviceApproval,
+} from "./device-auth.mjs";
+
+const VERSION = "0.1.0";
+
+const HELP = `Ornn Fabric CLI
+
+Usage:
+  fabric login [--auth-base <url>] [--no-browser] [--timeout <seconds>]
+  fabric whoami [--json]
+  fabric status [--json]
+  fabric marketplace listings [--json]
+  fabric reserve view [--gpu-type <type>] [--facility <name>] [--view week|month]
+  fabric reserve create --deployment-id <id> --gpu-count <n> --start-date <yyyy-mm-dd> --end-date <yyyy-mm-dd> --price <usd>
+  fabric portfolio reservations [--status <status>] [--json]
+  fabric portfolio bids [--json]
+  fabric portfolio bid update <bid-id> --gpu-count <n> --min-gpu-count <n> --start-date <yyyy-mm-dd> --end-date <yyyy-mm-dd> --price <usd>
+  fabric portfolio bid withdraw <bid-id>
+  fabric portfolio reservation access-mode <reservation-id> --mode vm|bare-metal [--image-id <id>]
+  fabric portfolio reservation list <reservation-id> --ask-price <usd>
+  fabric portfolio reservation ask-price <reservation-id> --ask-price <usd>
+  fabric portfolio reservation delist <reservation-id>
+  fabric portfolio reservation buy <reservation-id>
+  fabric machines list <reservation-id> [--json]
+  fabric machines get <instance-id> [--json]
+  fabric machines cost <reservation-id> [--json]
+  fabric machines launch <reservation-id> --ssh-key-id <id> [--username <name>] [--machine-count <n>]
+  fabric machines switch-access <reservation-id> --mode vm|bare-metal [--ssh-key-id <id>] [--username <name>] [--image-id <id>]
+  fabric machines action <instance-id> start|stop|extend|teardown [--extend-by-minutes <n>]
+  fabric machines push-keys <instance-id> --ssh-key-id <id>
+  fabric machines revoke <instance-id>
+  fabric ssh-keys list [--json]
+  fabric ssh-keys add --public-key <key> [--label <label>]
+  fabric ssh-keys delete <key-id>
+  fabric images list [--json]
+  fabric images upload --name <name> --os-family <os> --cosign-signature <sig> (--image-file <path>|--registry-ref <ref>) [--sha256 <hex>] [--size-bytes <n>]
+  fabric images revoke <image-id>
+  fabric api <get|post|patch|put|delete> <compute-path> [--data <json>] [--raw]
+  fabric logout
+
+Environment:
+  ORNN_AUTH_BASE_URL  Web/auth server origin. Defaults to http://localhost:3000.
+  ORNN_API_BASE_URL   Optional web API origin. Defaults to ORNN_AUTH_BASE_URL.
+  ORNN_CONFIG_HOME    Directory for CLI auth state. Defaults to ~/.config/ornn.
+`;
+
+export async function run(argv = [], io = {}) {
+  const stdout = io.stdout ?? process.stdout;
+  const stderr = io.stderr ?? process.stderr;
+  const env = io.env ?? process.env;
+  const fetchImpl = io.fetch ?? fetch;
+  const [command, ...args] = argv;
+
+  if (!command || command === "--help" || command === "-h") {
+    stdout.write(HELP);
+    return 0;
+  }
+
+  if (command === "--version" || command === "-v" || command === "version") {
+    stdout.write(`${VERSION}\n`);
+    return 0;
+  }
+
+  try {
+    if (command === "login") {
+      return await login(args, { env, stderr, stdout });
+    }
+
+    if (command === "whoami" || command === "account") {
+      return await whoami(args, { env, fetchImpl, stderr, stdout });
+    }
+
+    if (command === "status") {
+      return await status(args, { env, fetchImpl, stdout });
+    }
+
+    if (command === "api") {
+      return await api(args, { env, fetchImpl, stdout });
+    }
+
+    if (command === "marketplace") {
+      return await marketplace(args, { env, fetchImpl, stdout });
+    }
+
+    if (command === "reserve") {
+      return await reserve(args, { env, fetchImpl, stdout });
+    }
+
+    if (command === "portfolio") {
+      return await portfolio(args, { env, fetchImpl, stdout });
+    }
+
+    if (command === "machines") {
+      return await machines(args, { env, fetchImpl, stdout });
+    }
+
+    if (command === "ssh-keys") {
+      return await sshKeys(args, { env, fetchImpl, stdout });
+    }
+
+    if (command === "images") {
+      return await images(args, { env, fetchImpl, stdout });
+    }
+
+    if (command === "logout") {
+      await clearAuthSession({ env });
+      stdout.write("Logged out of Ornn.\n");
+      return 0;
+    }
+
+    stderr.write(`Unknown command: ${command}\n\n${HELP}`);
+    return 1;
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    stderr.write(`${message}\n`);
+    return error instanceof DeviceAuthError || error instanceof CliApiError ? 2 : 1;
+  }
+}
+
+async function login(args, { env, stderr, stdout }) {
+  const options = parseLoginOptions(args);
+
+  if (options.help) {
+    stdout.write(HELP);
+    return 0;
+  }
+
+  const authBaseUrl = resolveAuthBaseUrl({ env, explicit: options.authBase });
+  stdout.write(`Starting Ornn browser login against ${authBaseUrl}\n`);
+
+  const started = await startDeviceFlow({ authBaseUrl });
+  stdout.write(`\nOpen this URL to continue:\n${started.verificationUri}\n\n`);
+  stdout.write(`Code: ${started.userCode}\n\n`);
+
+  if (!options.noBrowser) {
+    const opened = await openBrowser(started.verificationUri);
+    if (!opened) {
+      stderr.write("Could not open the browser automatically. Open the URL above manually.\n");
+    }
+  }
+
+  stdout.write("Waiting for browser approval");
+  const session = await waitForDeviceApproval({
+    authBaseUrl,
+    deviceCode: started.deviceCode,
+    expiresIn: started.expiresIn,
+    interval: options.pollInterval ?? started.interval,
+    onPending: () => stdout.write("."),
+    timeoutSeconds: options.timeout,
+  });
+
+  await saveAuthSession(session, { env });
+  stdout.write(`\nLogged in as ${formatUser(session.user)}.\n`);
+  stdout.write(`Session saved to ${getAuthConfigPath(env)}\n`);
+  return 0;
+}
+
+async function whoami(args, { env, fetchImpl, stderr, stdout }) {
+  const { options } = parseOptions(args, { boolean: ["json"] });
+  const session = await loadAuthSession({ env });
+
+  if (!session) {
+    stderr.write("Not logged in. Run `fabric login` first.\n");
+    return 1;
+  }
+
+  try {
+    const serverSession = await cliRequest({
+      endpoint: "/api/cli/session",
+      env,
+      fetchImpl,
+      session,
+    });
+    if (options.json) {
+      writeJson(stdout, serverSession);
+    } else {
+      stdout.write(`${formatUser(serverSession.user)}\n`);
+      stdout.write(`Organization: ${serverSession.organization?.name || "none"}\n`);
+      stdout.write(`Tenant: ${serverSession.tenant?.company_name || serverSession.tenant?.id || "none"}\n`);
+      stdout.write(`Role: ${serverSession.role || "none"}\n`);
+      stdout.write(`Approved: ${serverSession.routeState.isApproved ? "yes" : "no"}\n`);
+    }
+  } catch (error) {
+    if (options.json) {
+      writeJson(stdout, session);
+    } else {
+      stdout.write(`${formatUser(session.user)}\n`);
+      stdout.write(`Auth base: ${session.authBaseUrl || "unknown"}\n`);
+      stdout.write("Server session: unavailable\n");
+      if (session.savedAt) {
+        stdout.write(`Saved at: ${session.savedAt}\n`);
+      }
+    }
+  }
+  return 0;
+}
+
+async function status(args, { env, fetchImpl, stdout }) {
+  const { options } = parseOptions(args, { boolean: ["json"] });
+  const snapshot = await cliRequest({
+    authRequired: false,
+    endpoint: "/api/cli/status",
+    env,
+    fetchImpl,
+  });
+  if (options.json) {
+    writeJson(stdout, snapshot);
+  } else {
+    stdout.write(`${snapshot.overallStatusLabel}\n`);
+    stdout.write(`${snapshot.overallDetail}\n`);
+    stdout.write(`Generated: ${snapshot.generatedAtLabel}\n`);
+    for (const group of snapshot.groups || []) {
+      stdout.write(`${group.name}: ${group.statusLabel}\n`);
+    }
+  }
+  return 0;
+}
+
+async function api(args, { env, fetchImpl, stdout }) {
+  const [method, path, ...rest] = args;
+  if (!method || !path) {
+    throw new Error("Usage: fabric api <get|post|patch|put|delete> <compute-path> [--data <json>] [--raw]");
+  }
+  const normalizedMethod = method.toUpperCase();
+  if (!["DELETE", "GET", "PATCH", "POST", "PUT"].includes(normalizedMethod)) {
+    throw new Error(`Unsupported API method: ${method}`);
+  }
+  const { options } = parseOptions(rest, { boolean: ["raw", "json"] });
+  const body = await readJsonOption(options.data);
+  const response = await cliRequest({
+    body,
+    endpoint: computeEndpoint(path),
+    env,
+    fetchImpl,
+    method: normalizedMethod,
+    raw: options.raw,
+  });
+  writeOutput(stdout, response, { raw: options.raw });
+  return 0;
+}
+
+async function marketplace(args, context) {
+  const [subcommand, ...rest] = args;
+  if (subcommand !== "listings") {
+    throw new Error("Usage: fabric marketplace listings [--json]");
+  }
+  const { options } = parseOptions(rest, { boolean: ["json"] });
+  const listings = await cliRequest({
+    authRequired: false,
+    endpoint: computeEndpoint("/marketplace/resale-listings"),
+    env: context.env,
+    fetchImpl: context.fetchImpl,
+  });
+  writeOutput(context.stdout, listings, { json: options.json });
+  return 0;
+}
+
+async function reserve(args, context) {
+  const [subcommand, ...rest] = args;
+  if (subcommand === "view") {
+    const { options } = parseOptions(rest, { boolean: ["json"] });
+    const query = buildQuery({
+      anchor_date: options.anchorDate,
+      facility: options.facility,
+      gpu_type: options.gpuType,
+      view: options.view,
+    });
+    const payload = await cliRequest({
+      authRequired: false,
+      endpoint: computeEndpoint(`/reserve/view${query}`),
+      env: context.env,
+      fetchImpl: context.fetchImpl,
+    });
+    writeOutput(context.stdout, payload, { json: options.json });
+    return 0;
+  }
+
+  if (subcommand === "create") {
+    const { options } = parseOptions(rest);
+    const gpuCount = numberOption(options.gpuCount, "--gpu-count");
+    const minGpuCount = options.minGpuCount ? numberOption(options.minGpuCount, "--min-gpu-count") : gpuCount;
+    const payload = {
+      access_mode: options.accessMode || "vm",
+      await_down_payment: true,
+      deployment_id: requiredOption(options.deploymentId, "--deployment-id"),
+      end_date: requiredOption(options.endDate, "--end-date"),
+      gpu_count: gpuCount,
+      image_id: options.imageId || null,
+      min_gpu_count: minGpuCount,
+      price_per_gpu_hour: numberOption(options.price || options.bidPricePerGpuHour, "--price"),
+      start_date: requiredOption(options.startDate, "--start-date"),
+    };
+    const reservation = await cliRequest({
+      body: payload,
+      endpoint: computeEndpoint("/reservations"),
+      env: context.env,
+      fetchImpl: context.fetchImpl,
+      method: "POST",
+    });
+    writeOutput(context.stdout, reservation);
+    return 0;
+  }
+
+  throw new Error("Usage: fabric reserve view|create");
+}
+
+async function portfolio(args, context) {
+  const [area, subcommand, ...rest] = args;
+
+  if (area === "reservations") {
+    const { options } = parseOptions([subcommand, ...rest].filter(Boolean), { boolean: ["json"] });
+    const query = buildQuery({ status: options.status });
+    const reservations = await cliRequest({
+      endpoint: computeEndpoint(`/tenants/me/reservations${query}`),
+      env: context.env,
+      fetchImpl: context.fetchImpl,
+    });
+    writeOutput(context.stdout, reservations, { json: options.json });
+    return 0;
+  }
+
+  if (area === "bids") {
+    const { options } = parseOptions([subcommand, ...rest].filter(Boolean), { boolean: ["json"] });
+    const bids = await cliRequest({
+      endpoint: computeEndpoint("/tenants/me/bids"),
+      env: context.env,
+      fetchImpl: context.fetchImpl,
+    });
+    writeOutput(context.stdout, bids, { json: options.json });
+    return 0;
+  }
+
+  if (area === "bid") {
+    return portfolioBid(subcommand, rest, context);
+  }
+
+  if (area === "reservation") {
+    return portfolioReservation(subcommand, rest, context);
+  }
+
+  throw new Error("Usage: fabric portfolio reservations|bids|bid|reservation");
+}
+
+async function portfolioBid(action, args, context) {
+  const [bidId, ...rest] = args;
+  if (!action || !bidId) {
+    throw new Error("Usage: fabric portfolio bid update|withdraw <bid-id>");
+  }
+
+  if (action === "withdraw" || action === "delete") {
+    const response = await cliRequest({
+      endpoint: computeEndpoint(`/tenants/me/bids/${bidId}`),
+      env: context.env,
+      fetchImpl: context.fetchImpl,
+      method: "DELETE",
+    });
+    writeOutput(context.stdout, response ?? { ok: true });
+    return 0;
+  }
+
+  if (action === "update") {
+    const { options } = parseOptions(rest);
+    const payload = {
+      bid_price_per_gpu_hour: numberOption(options.price || options.bidPricePerGpuHour, "--price"),
+      end_date: requiredOption(options.endDate, "--end-date"),
+      gpu_count: numberOption(options.gpuCount, "--gpu-count"),
+      min_gpu_count: numberOption(options.minGpuCount, "--min-gpu-count"),
+      start_date: requiredOption(options.startDate, "--start-date"),
+    };
+    const bid = await cliRequest({
+      body: payload,
+      endpoint: computeEndpoint(`/tenants/me/bids/${bidId}`),
+      env: context.env,
+      fetchImpl: context.fetchImpl,
+      method: "PATCH",
+    });
+    writeOutput(context.stdout, bid);
+    return 0;
+  }
+
+  throw new Error(`Unsupported portfolio bid action: ${action}`);
+}
+
+async function portfolioReservation(action, args, context) {
+  const [reservationId, ...rest] = args;
+  if (!action || !reservationId) {
+    throw new Error("Usage: fabric portfolio reservation access-mode|list|ask-price|delist|buy <reservation-id>");
+  }
+
+  const { options } = parseOptions(rest);
+  const basePath = `/tenants/me/reservations/${reservationId}`;
+
+  if (action === "access-mode") {
+    const payload = {
+      access_mode: requiredOption(options.mode, "--mode"),
+      image_id: options.imageId || null,
+    };
+    const access = await cliRequest({
+      body: payload,
+      endpoint: computeEndpoint(`${basePath}/access-mode`),
+      env: context.env,
+      fetchImpl: context.fetchImpl,
+      method: "POST",
+    });
+    writeOutput(context.stdout, access);
+    return 0;
+  }
+
+  if (action === "list") {
+    const reservation = await cliRequest({
+      body: { ask_price_per_gpu_hour: numberOption(options.askPrice, "--ask-price") },
+      endpoint: computeEndpoint(`${basePath}/list`),
+      env: context.env,
+      fetchImpl: context.fetchImpl,
+      method: "POST",
+    });
+    writeOutput(context.stdout, reservation);
+    return 0;
+  }
+
+  if (action === "ask-price") {
+    const reservation = await cliRequest({
+      body: { ask_price_per_gpu_hour: numberOption(options.askPrice, "--ask-price") },
+      endpoint: computeEndpoint(`${basePath}/ask-price`),
+      env: context.env,
+      fetchImpl: context.fetchImpl,
+      method: "PATCH",
+    });
+    writeOutput(context.stdout, reservation);
+    return 0;
+  }
+
+  if (action === "delist") {
+    const reservation = await cliRequest({
+      endpoint: computeEndpoint(`${basePath}/delist`),
+      env: context.env,
+      fetchImpl: context.fetchImpl,
+      method: "POST",
+    });
+    writeOutput(context.stdout, reservation);
+    return 0;
+  }
+
+  if (action === "buy") {
+    const transaction = await cliRequest({
+      body: { buyer_tenant_id: "me" },
+      endpoint: computeEndpoint(`${basePath}/buy`),
+      env: context.env,
+      fetchImpl: context.fetchImpl,
+      method: "POST",
+    });
+    writeOutput(context.stdout, transaction);
+    return 0;
+  }
+
+  throw new Error(`Unsupported portfolio reservation action: ${action}`);
+}
+
+async function machines(args, context) {
+  const [subcommand, id, action, ...rest] = args;
+  if (subcommand === "list" && id) {
+    const { options } = parseOptions([action, ...rest].filter(Boolean), { boolean: ["json"] });
+    const machinesPayload = await cliRequest({
+      endpoint: computeEndpoint(`/standalone-vms/reservations/${id}/machines`),
+      env: context.env,
+      fetchImpl: context.fetchImpl,
+    });
+    writeOutput(context.stdout, machinesPayload, { json: options.json });
+    return 0;
+  }
+
+  if (subcommand === "get" && id) {
+    const { options } = parseOptions([action, ...rest].filter(Boolean), { boolean: ["json"] });
+    const machine = await cliRequest({
+      endpoint: computeEndpoint(`/standalone-vms/${id}`),
+      env: context.env,
+      fetchImpl: context.fetchImpl,
+    });
+    writeOutput(context.stdout, machine, { json: options.json });
+    return 0;
+  }
+
+  if (subcommand === "cost" && id) {
+    const { options } = parseOptions([action, ...rest].filter(Boolean), { boolean: ["json"] });
+    const cost = await cliRequest({
+      endpoint: computeEndpoint(`/standalone-vms/reservations/${id}/cost`),
+      env: context.env,
+      fetchImpl: context.fetchImpl,
+    });
+    writeOutput(context.stdout, cost, { json: options.json });
+    return 0;
+  }
+
+  if (subcommand === "launch" && id) {
+    const { options } = parseOptions([action, ...rest].filter(Boolean));
+    const payload = {
+      image_id: options.imageId || null,
+      machine_count: options.machineCount ? numberOption(options.machineCount, "--machine-count") : 1,
+      machine_type: options.machineType || null,
+      request_id: options.requestId || null,
+      ssh_key_ids: arrayOption(options.sshKeyId),
+      tenant_username: options.username || options.tenantUsername || null,
+      zone: options.zone || null,
+    };
+    const response = await cliRequest({
+      body: payload,
+      endpoint: computeEndpoint(`/standalone-vms/reservations/${id}/launch`),
+      env: context.env,
+      fetchImpl: context.fetchImpl,
+      method: "POST",
+    });
+    writeOutput(context.stdout, response);
+    return 0;
+  }
+
+  if (subcommand === "switch-access" && id) {
+    const { options } = parseOptions([action, ...rest].filter(Boolean));
+    const payload = {
+      access_mode: requiredOption(options.mode, "--mode"),
+      image_id: options.imageId || null,
+      request_id: options.requestId || null,
+      ssh_key_ids: arrayOption(options.sshKeyId),
+      tenant_username: options.username || options.tenantUsername || null,
+    };
+    const response = await cliRequest({
+      body: payload,
+      endpoint: computeEndpoint(`/standalone-vms/reservations/${id}/switch-access`),
+      env: context.env,
+      fetchImpl: context.fetchImpl,
+      method: "POST",
+    });
+    writeOutput(context.stdout, response);
+    return 0;
+  }
+
+  if (subcommand === "action" && id && action) {
+    if (!["extend", "start", "stop", "teardown"].includes(action)) {
+      throw new Error("Machine action must be start, stop, extend, or teardown.");
+    }
+    const { options } = parseOptions(rest);
+    const body = action === "extend"
+      ? { extend_by_minutes: numberOption(options.extendByMinutes || 60, "--extend-by-minutes") }
+      : undefined;
+    const response = await cliRequest({
+      body,
+      endpoint: computeEndpoint(`/standalone-vms/${id}/${action}`),
+      env: context.env,
+      fetchImpl: context.fetchImpl,
+      method: "POST",
+    });
+    writeOutput(context.stdout, response);
+    return 0;
+  }
+
+  if (subcommand === "push-keys" && id) {
+    const { options } = parseOptions([action, ...rest].filter(Boolean));
+    const payload = {
+      request_id: options.requestId || null,
+      ssh_key_ids: requiredArrayOption(options.sshKeyId, "--ssh-key-id"),
+    };
+    const response = await cliRequest({
+      body: payload,
+      endpoint: computeEndpoint(`/standalone-vms/${id}/push-keys`),
+      env: context.env,
+      fetchImpl: context.fetchImpl,
+      method: "POST",
+    });
+    writeOutput(context.stdout, response);
+    return 0;
+  }
+
+  if (subcommand === "revoke" && id) {
+    const { options } = parseOptions([action, ...rest].filter(Boolean));
+    const response = await cliRequest({
+      body: { request_id: options.requestId || null },
+      endpoint: computeEndpoint(`/standalone-vms/${id}/revoke`),
+      env: context.env,
+      fetchImpl: context.fetchImpl,
+      method: "POST",
+    });
+    writeOutput(context.stdout, response);
+    return 0;
+  }
+
+  throw new Error("Usage: fabric machines list|get|cost|launch|switch-access|action|push-keys|revoke");
+}
+
+async function sshKeys(args, context) {
+  const [subcommand, id, ...rest] = args;
+  if (subcommand === "list") {
+    const keys = await cliRequest({
+      endpoint: computeEndpoint("/standalone-vms/tenants/me/ssh-keys"),
+      env: context.env,
+      fetchImpl: context.fetchImpl,
+    });
+    writeOutput(context.stdout, keys);
+    return 0;
+  }
+
+  if (subcommand === "add") {
+    const { options } = parseOptions([id, ...rest].filter(Boolean));
+    const publicKey = options.publicKeyFile
+      ? (await readFile(options.publicKeyFile, "utf8")).trim()
+      : requiredOption(options.publicKey, "--public-key");
+    const key = await cliRequest({
+      body: {
+        label: options.label || null,
+        public_key: publicKey,
+      },
+      endpoint: computeEndpoint("/standalone-vms/tenants/me/ssh-keys"),
+      env: context.env,
+      fetchImpl: context.fetchImpl,
+      method: "POST",
+    });
+    writeOutput(context.stdout, key);
+    return 0;
+  }
+
+  if ((subcommand === "delete" || subcommand === "remove") && id) {
+    const response = await cliRequest({
+      endpoint: computeEndpoint(`/standalone-vms/tenants/me/ssh-keys/${id}`),
+      env: context.env,
+      fetchImpl: context.fetchImpl,
+      method: "DELETE",
+    });
+    writeOutput(context.stdout, response);
+    return 0;
+  }
+
+  throw new Error("Usage: fabric ssh-keys list|add|delete");
+}
+
+async function images(args, context) {
+  const [subcommand, id, ...rest] = args;
+  if (subcommand === "list") {
+    const { options } = parseOptions([id, ...rest].filter(Boolean), { boolean: ["json"] });
+    const imagesPayload = await cliRequest({
+      endpoint: computeEndpoint("/account/images"),
+      env: context.env,
+      fetchImpl: context.fetchImpl,
+    });
+    writeOutput(context.stdout, imagesPayload, { json: options.json });
+    return 0;
+  }
+
+  if (subcommand === "upload") {
+    const { options } = parseOptions([id, ...rest].filter(Boolean), {
+      boolean: ["json", "operator-approved-large-image"],
+    });
+    const payload = await buildImageUploadPayload(options);
+    const image = await cliRequest({
+      body: payload,
+      endpoint: computeEndpoint("/vm-images"),
+      env: context.env,
+      fetchImpl: context.fetchImpl,
+      method: "POST",
+    });
+    writeOutput(context.stdout, image, { json: options.json });
+    return 0;
+  }
+
+  if ((subcommand === "revoke" || subcommand === "delete") && id) {
+    const { options } = parseOptions(rest, { boolean: ["json"] });
+    const response = await cliRequest({
+      endpoint: computeEndpoint(`/vm-images/${id}/revoke`),
+      env: context.env,
+      fetchImpl: context.fetchImpl,
+      method: "POST",
+    });
+    writeOutput(context.stdout, response, { json: options.json });
+    return 0;
+  }
+
+  throw new Error("Usage: fabric images list|upload|revoke");
+}
+
+async function buildImageUploadPayload(options) {
+  const imageFile = options.imageFile ? requiredOption(options.imageFile, "--image-file") : null;
+  const registryRef = options.registryRef ? requiredOption(options.registryRef, "--registry-ref") : null;
+  if (!imageFile && !registryRef) {
+    throw new Error("Provide --image-file or --registry-ref for image upload.");
+  }
+
+  let imageBuffer = null;
+  if (imageFile) {
+    imageBuffer = await readFile(imageFile);
+  }
+
+  const sha256 = options.sha256
+    ? requiredOption(options.sha256, "--sha256")
+    : imageBuffer
+      ? createHash("sha256").update(imageBuffer).digest("hex")
+      : requiredOption(options.sha256, "--sha256");
+  const sizeBytes = options.sizeBytes
+    ? numberOption(options.sizeBytes, "--size-bytes")
+    : imageBuffer
+      ? imageBuffer.byteLength
+      : numberOption(options.sizeBytes, "--size-bytes");
+
+  return {
+    cosign_signature: requiredOption(options.cosignSignature, "--cosign-signature"),
+    image_b64: imageBuffer ? imageBuffer.toString("base64") : undefined,
+    name: requiredOption(options.name, "--name"),
+    operator_approved_large_image: Boolean(options.operatorApprovedLargeImage),
+    os_family: requiredOption(options.osFamily, "--os-family"),
+    registry_ref: registryRef,
+    sha256,
+    size_bytes: sizeBytes,
+  };
+}
+
+function requiredArrayOption(value, name) {
+  const values = arrayOption(value);
+  if (!values.length) {
+    throw new Error(`${name} is required.`);
+  }
+  return values;
+}
+
+function parseLoginOptions(args) {
+  const options = {
+    authBase: null,
+    help: false,
+    noBrowser: false,
+    pollInterval: null,
+    timeout: null,
+  };
+
+  for (let index = 0; index < args.length; index += 1) {
+    const arg = args[index];
+    if (arg === "--help" || arg === "-h") {
+      options.help = true;
+    } else if (arg === "--no-browser") {
+      options.noBrowser = true;
+    } else if (arg === "--auth-base") {
+      options.authBase = requireValue(args, index, arg);
+      index += 1;
+    } else if (arg === "--timeout") {
+      options.timeout = parsePositiveNumber(requireValue(args, index, arg), arg);
+      index += 1;
+    } else if (arg === "--poll-interval") {
+      options.pollInterval = parsePositiveNumber(requireValue(args, index, arg), arg);
+      index += 1;
+    } else {
+      throw new Error(`Unknown login option: ${arg}`);
+    }
+  }
+
+  return options;
+}
+
+function requireValue(args, index, option) {
+  const value = args[index + 1];
+  if (!value || value.startsWith("-")) {
+    throw new Error(`Missing value for ${option}.`);
+  }
+  return value;
+}
+
+function parsePositiveNumber(value, option) {
+  const parsed = Number(value);
+  if (!Number.isFinite(parsed) || parsed <= 0) {
+    throw new Error(`${option} must be a positive number.`);
+  }
+  return parsed;
+}
+
+function formatUser(user = {}) {
+  const name = user.name ? `${user.name} ` : "";
+  const email = user.email || "unknown user";
+  return `${name}<${email}>`;
+}
+
+function parseOptions(args, { boolean = [] } = {}) {
+  const booleanSet = new Set(boolean.map(toCamelCase));
+  const options = {};
+  const positionals = [];
+
+  for (let index = 0; index < args.length; index += 1) {
+    const arg = args[index];
+    if (!arg?.startsWith("--")) {
+      positionals.push(arg);
+      continue;
+    }
+
+    const optionText = arg.slice(2);
+    const [rawKey, inlineValue] = splitOption(optionText);
+    const key = toCamelCase(rawKey);
+    let value;
+    if (inlineValue !== null) {
+      value = inlineValue;
+    } else if (booleanSet.has(key)) {
+      value = true;
+    } else {
+      value = requireValue(args, index, arg);
+      index += 1;
+    }
+    addOption(options, key, value);
+  }
+
+  return { options, positionals };
+}
+
+function splitOption(value) {
+  const equalsIndex = value.indexOf("=");
+  if (equalsIndex === -1) {
+    return [value, null];
+  }
+  return [value.slice(0, equalsIndex), value.slice(equalsIndex + 1)];
+}
+
+function addOption(options, key, value) {
+  if (options[key] === undefined) {
+    options[key] = value;
+  } else if (Array.isArray(options[key])) {
+    options[key].push(value);
+  } else {
+    options[key] = [options[key], value];
+  }
+}
+
+function toCamelCase(value) {
+  return value.replace(/-([a-z])/g, (_match, letter) => letter.toUpperCase());
+}
+
+function requiredOption(value, name) {
+  if (value === undefined || value === null || value === "") {
+    throw new Error(`${name} is required.`);
+  }
+  if (Array.isArray(value)) {
+    return value[value.length - 1];
+  }
+  return value;
+}
+
+function numberOption(value, name) {
+  const parsed = Number(requiredOption(value, name));
+  if (!Number.isFinite(parsed)) {
+    throw new Error(`${name} must be a number.`);
+  }
+  return parsed;
+}
+
+function arrayOption(value) {
+  if (value === undefined || value === null || value === "") {
+    return [];
+  }
+  return Array.isArray(value) ? value : [value];
+}
+
+async function readJsonOption(value) {
+  if (value === undefined) {
+    return undefined;
+  }
+  const raw = requiredOption(value, "--data");
+  const text = raw.startsWith("@") ? await readFile(raw.slice(1), "utf8") : raw;
+  return JSON.parse(text);
+}
+
+function buildQuery(values) {
+  const params = new URLSearchParams();
+  for (const [key, value] of Object.entries(values)) {
+    if (value !== undefined && value !== null && value !== "") {
+      params.set(key, String(value));
+    }
+  }
+  const text = params.toString();
+  return text ? `?${text}` : "";
+}
+
+function writeOutput(stdout, payload, { json = true, raw = false } = {}) {
+  if (raw) {
+    stdout.write(String(payload));
+    if (!String(payload).endsWith("\n")) {
+      stdout.write("\n");
+    }
+    return;
+  }
+  if (json || typeof payload === "object") {
+    writeJson(stdout, payload);
+    return;
+  }
+  stdout.write(`${payload}\n`);
+}
+
+function writeJson(stdout, payload) {
+  stdout.write(`${JSON.stringify(payload ?? { ok: true }, null, 2)}\n`);
+}

package/src/device-auth.mjs

@@ -0,0 +1,188 @@
+import { spawn } from "node:child_process";
+
+const DEFAULT_AUTH_BASE_URL = "http://localhost:3000";
+const DEFAULT_POLL_INTERVAL_SECONDS = 2;
+const DEFAULT_TIMEOUT_SECONDS = 600;
+
+export class DeviceAuthError extends Error {
+  constructor(message, { status, detail } = {}) {
+    super(message);
+    this.name = "DeviceAuthError";
+    this.status = status;
+    this.detail = detail;
+  }
+}
+
+export function resolveAuthBaseUrl({ explicit, env = process.env } = {}) {
+  const value =
+    explicit?.trim() ||
+    env.ORNN_AUTH_BASE_URL?.trim() ||
+    env.BETTER_AUTH_URL?.trim() ||
+    DEFAULT_AUTH_BASE_URL;
+
+  return value.replace(/\/+$/, "");
+}
+
+export async function openBrowser(url, { platform = process.platform, spawnImpl = spawn } = {}) {
+  const command =
+    platform === "darwin" ? "open" : platform === "win32" ? "cmd" : "xdg-open";
+  const args = platform === "win32" ? ["/c", "start", "", url] : [url];
+
+  try {
+    const child = spawnImpl(command, args, {
+      detached: true,
+      stdio: "ignore",
+    });
+    child.unref?.();
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+export async function startDeviceFlow({ authBaseUrl, fetchImpl = fetch } = {}) {
+  const data = await postJson(fetchImpl, `${authBaseUrl}/api/cli/auth/device/start`, {
+    client: "ornn-cli",
+  });
+
+  const deviceCode = pickString(data, "deviceCode", "device_code");
+  const userCode = pickString(data, "userCode", "user_code");
+  const verificationUri =
+    pickString(data, "verificationUriComplete", "verification_uri_complete") ||
+    pickString(data, "verificationUri", "verification_uri");
+
+  if (!deviceCode || !userCode || !verificationUri) {
+    throw new DeviceAuthError("Auth server returned an invalid device login response.", {
+      detail: data,
+    });
+  }
+
+  return {
+    deviceCode,
+    expiresIn: pickNumber(data, "expiresIn", "expires_in") ?? DEFAULT_TIMEOUT_SECONDS,
+    interval: pickNumber(data, "interval") ?? DEFAULT_POLL_INTERVAL_SECONDS,
+    userCode,
+    verificationUri,
+  };
+}
+
+export async function pollDeviceFlow({ authBaseUrl, deviceCode, fetchImpl = fetch } = {}) {
+  return postJson(fetchImpl, `${authBaseUrl}/api/cli/auth/device/poll`, {
+    deviceCode,
+  });
+}
+
+export async function waitForDeviceApproval({
+  authBaseUrl,
+  deviceCode,
+  expiresIn,
+  fetchImpl = fetch,
+  interval,
+  onPending,
+  timeoutSeconds,
+} = {}) {
+  const pollIntervalMs = Math.max(1, Number(interval) || DEFAULT_POLL_INTERVAL_SECONDS) * 1000;
+  const timeoutMs =
+    Math.max(1, Number(timeoutSeconds) || Number(expiresIn) || DEFAULT_TIMEOUT_SECONDS) * 1000;
+  const deadline = Date.now() + timeoutMs;
+
+  while (Date.now() < deadline) {
+    await sleep(pollIntervalMs);
+    const data = await pollDeviceFlow({ authBaseUrl, deviceCode, fetchImpl });
+    const status = pickString(data, "status") || "pending";
+
+    if (status === "pending") {
+      onPending?.();
+      continue;
+    }
+
+    if (status === "approved") {
+      const token = pickString(data, "accessToken", "access_token", "sessionToken", "session_token");
+      const user = data.user && typeof data.user === "object" ? data.user : null;
+
+      if (!token || !user?.email) {
+        throw new DeviceAuthError("Auth server approved login without a usable session.");
+      }
+
+      return {
+        accessToken: token,
+        authBaseUrl,
+        tokenType: pickString(data, "tokenType", "token_type") || "bearer",
+        user: {
+          email: String(user.email),
+          id: user.id ? String(user.id) : null,
+          name: user.name ? String(user.name) : null,
+        },
+      };
+    }
+
+    if (status === "denied") {
+      throw new DeviceAuthError("Device login was denied in the browser.");
+    }
+
+    if (status === "expired") {
+      throw new DeviceAuthError("Device login expired. Run `ornn login` again.");
+    }
+
+    throw new DeviceAuthError(`Auth server returned unexpected status: ${status}`);
+  }
+
+  throw new DeviceAuthError("Timed out waiting for browser login approval.");
+}
+
+async function postJson(fetchImpl, url, body) {
+  const response = await fetchImpl(url, {
+    body: JSON.stringify(body),
+    headers: {
+      Accept: "application/json",
+      "Content-Type": "application/json",
+    },
+    method: "POST",
+  });
+  const text = await response.text();
+  const data = text ? parseJson(text, url) : {};
+
+  if (!response.ok) {
+    const detail = data.detail || data.error || response.statusText;
+    throw new DeviceAuthError(`Auth request failed: ${detail}`, {
+      detail: data,
+      status: response.status,
+    });
+  }
+
+  return data;
+}
+
+function parseJson(text, url) {
+  try {
+    return JSON.parse(text);
+  } catch {
+    throw new DeviceAuthError(`Auth server returned invalid JSON from ${url}.`);
+  }
+}
+
+function pickString(value, ...keys) {
+  for (const key of keys) {
+    const found = value?.[key];
+    if (typeof found === "string" && found.trim()) {
+      return found.trim();
+    }
+  }
+  return null;
+}
+
+function pickNumber(value, ...keys) {
+  for (const key of keys) {
+    const found = value?.[key];
+    if (typeof found === "number" && Number.isFinite(found)) {
+      return found;
+    }
+  }
+  return null;
+}
+
+function sleep(ms) {
+  return new Promise((resolve) => {
+    setTimeout(resolve, ms);
+  });
+}