@ornncompute/cli 0.1.9 → 0.2.0

package/src/api-client.mjs

@@ -1,4 +1,4 @@
-import { clearAuthSession, configuredAuthBaseUrl, loadAuthSession } from "./auth-store.mjs";
+import { clearAuthSession, configuredApiBaseUrl, loadAuthSession } from "./auth-store.mjs";
 import { resolveAuthBaseUrl } from "./device-auth.mjs";
 
 export class CliApiError extends Error {
@@ -11,22 +11,56 @@ export class CliApiError extends Error {
 }
 
 export function resolveApiBaseUrl({ env = process.env, explicit, session } = {}) {
-  // Prefer the first configured source; do not fall through when it strips empty.
-  const candidates = [
+  // Prefer the first configured API source; do not fall through when it strips empty.
+  const apiCandidates = [
     [explicit, "API base URL"],
     [env.ORNN_API_BASE_URL, "ORNN_API_BASE_URL"],
+    [session?.apiBaseUrl, "session apiBaseUrl"],
+    [configuredApiBaseUrl(env), "configured apiBaseUrl"],
+  ];
+  for (const [value, sourceName] of apiCandidates) {
+    const trimmed = value?.trim();
+    if (!trimmed) {
+      continue;
+    }
+    return requireValidBaseUrl(trimmed, sourceName);
+  }
+
+  // Older CLI installs persisted only the web/auth origin. Migrate the known
+  // deployed Ornn hosts in memory so an update immediately reaches the gateway
+  // without requiring a reinstall; custom and localhost origins remain intact.
+  const authCandidates = [
     [env.ORNN_AUTH_BASE_URL, "ORNN_AUTH_BASE_URL"],
     [session?.authBaseUrl, "session authBaseUrl"],
   ];
-  for (const [value, sourceName] of candidates) {
+  for (const [value, sourceName] of authCandidates) {
     const trimmed = value?.trim();
     if (!trimmed) {
       continue;
     }
-    return requireValidBaseUrl(trimmed, sourceName);
+    return gatewayOriginForAuthOrigin(trimmed, sourceName);
   }
 
-  return requireValidBaseUrl(resolveAuthBaseUrl({ env }), "API base URL");
+  return gatewayOriginForAuthOrigin(resolveAuthBaseUrl({ env }), "API base URL");
+}
+
+function gatewayOriginForAuthOrigin(value, sourceName) {
+  const authOrigin = requireValidBaseUrl(value, sourceName);
+  const url = new URL(authOrigin);
+  if (url.hostname === "compute.ornn.com") {
+    return "https://api.ornn.com";
+  }
+  if (
+    url.hostname === "staging.compute.ornn.com" ||
+    url.hostname === "staging.fabric.ornn.com"
+  ) {
+    return "https://staging.api.ornn.com";
+  }
+  const dynamicMatch = url.hostname.match(/^([a-z0-9-]+)\.fabric\.ornn\.com$/i);
+  if (dynamicMatch) {
+    return `https://${dynamicMatch[1]}.api.ornn.com`;
+  }
+  return authOrigin;
 }
 
 export async function loadRequiredSession({ env = process.env } = {}) {
@@ -46,6 +80,7 @@ export async function cliRequest({
   method = "GET",
   raw = false,
   session,
+  timeoutMs,
 } = {}) {
   const authSession = session ?? (authRequired ? await loadRequiredSession({ env }) : null);
   const baseUrl = resolveApiBaseUrl({ env, session: authSession });
@@ -56,6 +91,10 @@ export async function cliRequest({
 
   if (authSession?.accessToken) {
     headers.Authorization = `Bearer ${authSession.accessToken}`;
+    // Explicitly select the gateway's user-credential resolver. This marker
+    // grants nothing by itself; the gateway still has to resolve the bearer
+    // through authorization and derive the caller's organization server-side.
+    headers["X-Ornn-Credential-Type"] = "user";
   }
 
   let requestBody;
@@ -70,8 +109,18 @@ export async function cliRequest({
       body: requestBody,
       headers,
       method,
+      ...(timeoutMs ? { signal: AbortSignal.timeout(timeoutMs) } : {}),
     });
   } catch (error) {
+    // Detect the timeout/abort case before the generic network-failure wrapping
+    // below, so a wedged compute call (e.g. status blocked behind an
+    // unresponsive FUSE mount) reports a customer-facing timeout instead of an
+    // opaque "Could not reach Ornn" message.
+    if (timeoutMs && (error?.name === "TimeoutError" || error?.name === "AbortError")) {
+      throw new CliApiError(
+        `Ornn did not respond within ${Math.round(timeoutMs / 1000)} seconds. The service or a node mount may be unresponsive; try again shortly.`,
+      );
+    }
     const message = error instanceof Error ? error.message : String(error);
     throw new CliApiError(`Could not reach Ornn at ${baseUrl}: ${message}`);
   }
@@ -87,196 +136,71 @@ export async function cliRequest({
 
   const text = await response.text();
   if (!response.ok) {
-    // Clear a dead token before parsing, so a 401 with a non-JSON body
-    // (e.g. a gateway/WAF error page) still triggers the re-login flow.
-    await handleAuthExpiry({ env, response, hadToken: Boolean(authSession?.accessToken) });
-  }
-  const data = text ? parseJson(text, url.toString(), response) : null;
-  if (!response.ok) {
-    const detail = data?.detail ?? data?.error ?? response.statusText;
-    const message = detailMessage(detail) || response.statusText;
-    throw new CliApiError(`Ornn request failed: ${message}`, {
-      detail: data,
-      status: response.status,
+    // Always throws: handles the 401/expired-session case (clearing the
+    // stored token) and the generic detail-surfacing case.
+    await raiseForFailedResponse({
+      env,
+      hadToken: Boolean(authSession?.accessToken),
+      response,
+      text,
+      url: url.toString(),
+      formatMessage: (message) => `Ornn request failed: ${message}`,
     });
   }
+  const data = text ? parseJson(text, url.toString(), response) : null;
   return data;
 }
 
-export function resolveComputeBaseUrl({ env = process.env } = {}) {
-  const base = env.ORNN_COMPUTE_BASE_URL?.trim();
-  if (!base) {
-    throw new CliApiError(
-      "Set ORNN_COMPUTE_BASE_URL to the internal compute service origin to run operator commands."
-    );
-  }
-  return requireValidBaseUrl(base, "ORNN_COMPUTE_BASE_URL");
-}
-
 /**
- * Origin used in `curl …/enrollment/install` one-liners.
+ * Shared failure path for both the JSON `cliRequest` helper and callers that
+ * stream a raw `fetchImpl` response directly (e.g. file downloads, which
+ * can't go through `cliRequest`'s JSON body handling). Always throws:
  *
- * Prefer an explicit compute/installer URL. When staff use the web operator
- * proxy (no local review secret), derive compute from the auth/web origin:
- *   - `https://<slug>.fabric.ornn.com` → `https://<slug>-api.fabric.ornn.com`
- *   - `https://compute.ornn.com` → `https://api-compute.ornn.com`
- *   - `http://localhost:3000` → `http://localhost:8000`
+ * - On 401 with a previously-valid token, clears the stored session and
+ *   throws the standard "session expired" `CliApiError` so every call site
+ *   gets the same re-login guidance instead of reimplementing it.
+ * - Otherwise, parses the body as JSON (if present) and surfaces its
+ *   `detail`/`error` field through the same `detailMessage` conventions
+ *   `cliRequest` uses, falling back to `fallbackMessage` (or the response's
+ *   status text) when the body has no usable detail.
  */
-export function resolveInstallerBaseUrl({ env = process.env, session } = {}) {
-  const explicit =
-    env.ORNN_INSTALLER_URL?.trim() ||
-    env.ORNN_COMPUTE_BASE_URL?.trim() ||
-    env.NEXT_PUBLIC_INSTALLER_URL?.trim();
-  if (explicit) {
-    return requireValidBaseUrl(explicit, "installer base URL");
-  }
-
-  // The session records where the caller actually logged in, so it outranks the
-  // installed default.
-  const authCandidates = [
-    env.ORNN_AUTH_BASE_URL,
-    env.ORNN_API_BASE_URL,
-    session?.authBaseUrl,
-    configuredAuthBaseUrl(env),
-  ];
-  for (const candidate of authCandidates) {
-    const trimmed = candidate?.trim();
-    if (!trimmed) {
-      continue;
-    }
-    const authOrigin = requireValidBaseUrl(trimmed, "ORNN_AUTH_BASE_URL");
-    return deriveInstallerOriginFromAuth(authOrigin);
-  }
-  return null;
-}
-
-function deriveInstallerOriginFromAuth(authOrigin) {
-  const url = new URL(authOrigin);
-  if (url.hostname === "localhost" || url.hostname === "127.0.0.1") {
-    url.port = "8000";
-    url.protocol = "http:";
-    return url.origin;
-  }
-  const fabricMatch = url.hostname.match(/^([a-z0-9-]+)\.fabric\.ornn\.com$/i);
-  if (fabricMatch && !fabricMatch[1].endsWith("-api")) {
-    url.hostname = `${fabricMatch[1]}-api.fabric.ornn.com`;
-    return url.origin;
-  }
-  if (url.hostname === "compute.ornn.com") {
-    url.hostname = "api-compute.ornn.com";
-    return url.origin;
-  }
-  return url.origin;
-}
-
-export function resolveInternalReviewSecret({ env = process.env } = {}) {
-  const secret = env.ORNN_INTERNAL_REVIEW_SECRET?.trim();
-  if (!secret) {
-    throw new CliApiError(
-      "Set ORNN_INTERNAL_REVIEW_SECRET to authenticate operator commands, or run `ornn login` as Ornn staff."
-    );
-  }
-  return secret;
-}
-
-function operatorProxyEndpoint(endpoint) {
-  return `/api/cli/operator${normalizeComputePath(endpoint)}`;
-}
-
-async function operatorRequestViaStaffSession({
-  body,
-  endpoint,
+export async function raiseForFailedResponse({
   env = process.env,
-  fetchImpl = fetch,
-  method = "GET",
+  fallbackMessage,
+  formatMessage = (message) => message,
+  hadToken,
+  response,
+  text,
+  url,
 } = {}) {
-  // Staff path: CLI bearer → web /api/cli/operator → compute with server-side review secret.
-  return cliRequest({
-    body,
-    endpoint: operatorProxyEndpoint(endpoint),
-    env,
-    fetchImpl,
-    method,
-    authRequired: true,
+  // Clear a dead token before parsing, so a 401 with a non-JSON body
+  // (e.g. a gateway/WAF error page) still triggers the re-login flow.
+  await handleAuthExpiry({ env, response, hadToken });
+  const data = text ? parseJson(text, url, response) : null;
+  const detail = data?.detail ?? data?.error ?? response.statusText;
+  const message = detailMessage(detail) || fallbackMessage || response.statusText;
+  throw new CliApiError(formatMessage(message), {
+    detail: data,
+    status: response.status,
   });
 }
 
-async function operatorRequestViaReviewSecret({
-  body,
-  endpoint,
-  env = process.env,
-  fetchImpl = fetch,
-  method = "GET",
-} = {}) {
-  // Break-glass / CI: hit compute directly with the review secret.
-  const baseUrl = resolveComputeBaseUrl({ env });
-  const secret = resolveInternalReviewSecret({ env });
-  const url = new URL(endpoint, `${baseUrl}/`);
-  const headers = {
-    Accept: "application/json",
-    "X-Internal-Actor": env.ORNN_INTERNAL_ACTOR?.trim() || "break-glass-cli",
-    "X-Internal-Review-Secret": secret,
-  };
-
-  let requestBody;
-  if (body !== undefined) {
-    headers["Content-Type"] = "application/json";
-    requestBody = typeof body === "string" ? body : JSON.stringify(body);
-  }
-
-  let response;
-  try {
-    response = await fetchImpl(url, { body: requestBody, headers, method });
-  } catch (error) {
-    const message = error instanceof Error ? error.message : String(error);
-    throw new CliApiError(`Could not reach Ornn compute at ${baseUrl}: ${message}`);
-  }
-
-  const text = await response.text();
-  const data = text ? parseJson(text, url.toString(), response) : null;
-  if (!response.ok) {
-    const detail = data?.detail ?? data?.error ?? response.statusText;
-    const message = detailMessage(detail) || response.statusText;
-    throw new CliApiError(`Ornn request failed: ${message}`, {
-      detail: data,
-      status: response.status,
-    });
+export function resolveInstallerBaseUrl({ env = process.env } = {}) {
+  const explicit = env.ORNN_INSTALLER_URL?.trim() || env.NEXT_PUBLIC_INSTALLER_URL?.trim();
+  if (!explicit) {
+    return null;
   }
-  return data;
+  return requireValidBaseUrl(explicit, "ORNN_INSTALLER_URL", { allowPath: true });
 }
 
-export async function operatorRequest({
-  body,
-  endpoint,
-  env = process.env,
-  fetchImpl = fetch,
-  method = "GET",
-} = {}) {
-  // Prefer an explicit review secret (CI / break-glass). Otherwise use a staff
-  // `ornn login` session through the web operator proxy — the secret never
-  // leaves the server.
-  if (env.ORNN_INTERNAL_REVIEW_SECRET?.trim()) {
-    return operatorRequestViaReviewSecret({ body, endpoint, env, fetchImpl, method });
-  }
-
-  const session = await loadAuthSession({ env });
-  if (session?.accessToken) {
-    return operatorRequestViaStaffSession({ body, endpoint, env, fetchImpl, method });
-  }
-
-  throw new CliApiError(
-    "Operator commands need Ornn staff auth: run `ornn login` as an internal user " +
-      "(ORNN_AUTH_BASE_URL), or set ORNN_INTERNAL_REVIEW_SECRET (+ ORNN_COMPUTE_BASE_URL) for direct compute access.",
-    { status: 401 }
-  );
+function operatorProxyEndpoint(endpoint) {
+  return `/v1/cli/operator${normalizeComputePath(endpoint)}`;
 }
 
-/**
- * Commerce-backed operator actions must cross the Web trust boundary. Web
- * validates Commerce state before it forwards to Compute, so direct
- * review-secret access is intentionally unavailable for these requests.
- */
-export async function webOperatorRequest({
+// Staff path: CLI bearer → gateway /v1/cli/operator → the owning service.
+// The gateway resolves the bearer and applies staff policy; the CLI never ships
+// a reviewer or service secret.
+export async function operatorRequest({
   body,
   endpoint,
   env = process.env,
@@ -286,16 +210,23 @@ export async function webOperatorRequest({
   const session = await loadAuthSession({ env });
   if (!session?.accessToken) {
     throw new CliApiError(
-      "Commerce-backed deployment requires Ornn staff auth through Web. Run `ornn login` first.",
+      "Operator commands need Ornn staff auth: run `ornn login` as an internal user (ORNN_AUTH_BASE_URL).",
       { status: 401 }
     );
   }
-  return operatorRequestViaStaffSession({ body, endpoint, env, fetchImpl, method });
+  return cliRequest({
+    body,
+    endpoint: operatorProxyEndpoint(endpoint),
+    env,
+    fetchImpl,
+    method,
+    authRequired: true,
+  });
 }
 
 export function computeEndpoint(path) {
   const normalized = normalizeComputePath(path);
-  return `/api/cli/compute${normalized}`;
+  return `/v1/cli/compute${normalized}`;
 }
 
 export function normalizeComputePath(path) {
@@ -309,7 +240,7 @@ export function normalizeComputePath(path) {
   return trimmed;
 }
 
-function requireValidBaseUrl(raw, sourceName) {
+function requireValidBaseUrl(raw, sourceName, { allowPath = false } = {}) {
   const stripped = raw.replace(/\/+$/, "");
   if (!stripped) {
     throw new CliApiError(
@@ -322,10 +253,13 @@ function requireValidBaseUrl(raw, sourceName) {
   } catch {
     throw new CliApiError(`${sourceName} must be a valid origin (got ${JSON.stringify(raw)}).`);
   }
-  // Path/search/hash are dropped when composing absolute endpoints against this base.
-  if (parsed.pathname !== "/" || parsed.search || parsed.hash) {
+  // API endpoints are composed from absolute paths and therefore require a
+  // bare origin. The installer is the one exception: its gateway-owned base
+  // intentionally includes `/v1/orchestrator` and is joined explicitly.
+  if ((!allowPath && parsed.pathname !== "/") || parsed.search || parsed.hash) {
+    const requirement = allowPath ? "base URL with no query or fragment" : "origin with no path";
     throw new CliApiError(
-      `${sourceName} must be a valid origin with no path (got ${JSON.stringify(raw)}).`
+      `${sourceName} must be a valid ${requirement} (got ${JSON.stringify(raw)}).`
     );
   }
   return stripped;

package/src/auth-store.mjs

@@ -6,7 +6,6 @@ import { homedir } from "node:os";
 const APP_DIR = "ornn";
 const AUTH_FILE = "auth.json";
 const CONFIG_FILE = "config.json";
-const FLEETS_DIR = "fleets";
 
 export function getAuthConfigDir(env = process.env) {
   if (env.ORNN_CONFIG_HOME?.trim()) {
@@ -28,10 +27,6 @@ export function getCliConfigPath(env = process.env) {
   return join(getAuthConfigDir(env), CONFIG_FILE);
 }
 
-export function getFleetConfigDir(env = process.env) {
-  return join(getAuthConfigDir(env), FLEETS_DIR);
-}
-
 // Read synchronously so callers resolving a base URL stay synchronous.
 export function configuredAuthBaseUrl(env = process.env) {
   try {
@@ -42,6 +37,15 @@ export function configuredAuthBaseUrl(env = process.env) {
   }
 }
 
+export function configuredApiBaseUrl(env = process.env) {
+  try {
+    const value = JSON.parse(readFileSync(getCliConfigPath(env), "utf8"))?.apiBaseUrl;
+    return typeof value === "string" ? value.trim() : "";
+  } catch {
+    return "";
+  }
+}
+
 export async function loadAuthSession({ env = process.env } = {}) {
   const path = getAuthConfigPath(env);
 

package/src/catalog-dispatch.mjs

@@ -0,0 +1,186 @@
+import { createInterface } from "node:readline/promises";
+import { stdin as defaultStdin, stdout as defaultStdout } from "node:process";
+
+import { cliRequest, operatorRequest } from "./api-client.mjs";
+
+async function loadCapabilities() {
+  try {
+    return await import("@ornn/capabilities");
+  } catch {
+    return await import("../vendor/capabilities/index.js");
+  }
+}
+
+function parseYes(value) {
+  return /^(y|yes)$/i.test(String(value ?? "").trim());
+}
+
+export async function confirmCatalogMutation({ stdin, stdout, yes, label }) {
+  if (yes) return true;
+  const input = stdin ?? defaultStdin;
+  const output = stdout ?? defaultStdout;
+  if (!input.isTTY || !output.isTTY) {
+    throw new Error("Refusing to create without --yes on a non-interactive terminal.");
+  }
+  const rl = createInterface({ input, output });
+  try {
+    const answer = await rl.question(`${label} [y/N] `);
+    return parseYes(answer);
+  } finally {
+    rl.close();
+  }
+}
+
+function catalogFetch({ env, fetchImpl }) {
+  return async (path, init) => {
+    const method = init?.method ?? "GET";
+    const staffPath =
+      path.startsWith("/internal") ||
+      path.startsWith("/provisioning") ||
+      path === "/inventory" ||
+      path.startsWith("/inventory/");
+    const request = staffPath ? operatorRequest : cliRequest;
+    return request({
+      endpoint: path,
+      env,
+      fetchImpl,
+      method,
+      ...(init?.body !== undefined ? { body: init.body } : {}),
+    });
+  };
+}
+
+export async function runCatalogCapability(capability, input, context) {
+  const { parseRole } = await loadCapabilities();
+  const role = parseRole(context.role) ?? (context.staff ? "reviewer" : "user");
+  return capability.execute(
+    {
+      actor: context.actor ?? "",
+      role,
+      confirmed: context.confirmed === true,
+      fetch: catalogFetch(context),
+    },
+    input,
+  );
+}
+
+export async function listingsCreateCommand(args, context) {
+  const { createListingCapability } = await loadCapabilities();
+  const options = context.parseCommandOptions(
+    args,
+    {
+      boolean: ["json", "yes"],
+      value: [
+        "gpu-type",
+        "cpu",
+        "node-model",
+        "fabric-type",
+        "node-count",
+        "gpus-per-node",
+        "site-nickname",
+        "site-operator",
+        "ram",
+        "storage",
+        "available-start-at",
+        "available-end-at",
+        "buy-now-price-per-gpu-hour",
+        "cost-per-gpu-hour",
+        "deposit-percent",
+      ],
+    },
+    "Usage: ornn listings create [--gpu-type H100] [--node-count 8] [--yes] [--json]",
+  );
+  const input = {
+    gpu_type: options.gpuType,
+    cpu: options.cpu,
+    node_model: options.nodeModel,
+    fabric_type: options.fabricType,
+    node_count: options.nodeCount != null ? Number(options.nodeCount) : undefined,
+    gpus_per_node: options.gpusPerNode != null ? Number(options.gpusPerNode) : undefined,
+    site_nickname: options.siteNickname,
+    site_operator: options.siteOperator,
+    ram: options.ram,
+    storage: options.storage,
+    available_start_at: options.availableStartAt,
+    available_end_at: options.availableEndAt,
+    buy_now_price_per_gpu_hour:
+      options.buyNowPricePerGpuHour != null ? Number(options.buyNowPricePerGpuHour) : undefined,
+    cost_per_gpu_hour: options.costPerGpuHour != null ? Number(options.costPerGpuHour) : undefined,
+    deposit_percent: options.depositPercent != null ? Number(options.depositPercent) : undefined,
+  };
+  const preview = await runCatalogCapability(createListingCapability, input, {
+    ...context,
+    confirmed: false,
+    staff: true,
+    role: "reviewer",
+  });
+  if (preview?.ok === false) {
+    throw new Error(preview.error ?? "listing create failed");
+  }
+  const confirmed = await confirmCatalogMutation({
+    stdin: context.stdin,
+    stdout: context.stdout,
+    yes: options.yes,
+    label: "Create this listing?",
+  });
+  if (!confirmed) {
+    context.stdout.write("Aborted.\n");
+    return 1;
+  }
+  const result = await runCatalogCapability(createListingCapability, input, {
+    ...context,
+    confirmed: true,
+    staff: true,
+    role: "reviewer",
+  });
+  if (options.json) {
+    context.stdout.write(`${JSON.stringify(result, null, 2)}\n`);
+  } else {
+    context.stdout.write(`${JSON.stringify(result)}\n`);
+  }
+  return 0;
+}
+
+export async function operatorListCommand(args, context) {
+  const { listOperatorsCapability } = await loadCapabilities();
+  context.parseCommandOptions(args, { boolean: ["json"] }, "Usage: ornn operator list [--json]");
+  const result = await runCatalogCapability(listOperatorsCapability, {}, {
+    ...context,
+    staff: true,
+    role: "reviewer",
+  });
+  context.stdout.write(`${JSON.stringify(result, null, 2)}\n`);
+  return 0;
+}
+
+export async function usersQueryCommand(args, context) {
+  const { usersQueryCapability } = await loadCapabilities();
+  const options = context.parseCommandOptions(
+    args,
+    { boolean: ["json"], value: ["name", "email", "organization", "max"] },
+    "Usage: ornn users query [--name Ada] [--email a@b.com] [--organization Acme] [--max 20]",
+  );
+  const result = await runCatalogCapability(
+    usersQueryCapability,
+    {
+      name: options.name,
+      email: options.email,
+      organization: options.organization,
+      max: options.max != null ? Number(options.max) : undefined,
+    },
+    { ...context, staff: true, role: "admin" },
+  );
+  context.stdout.write(`${JSON.stringify(result, null, 2)}\n`);
+  return 0;
+}
+
+export async function nodesConsoleCommand(nodeId, context) {
+  const { nodesConsoleCapability } = await loadCapabilities();
+  const result = await runCatalogCapability(
+    nodesConsoleCapability,
+    { node_id: nodeId },
+    { ...context, role: context.staff ? "reviewer" : "user" },
+  );
+  context.stdout.write(`${JSON.stringify(result, null, 2)}\n`);
+  return 0;
+}