@ornncompute/cli 0.2.23 → 1.0.25

package/src/vpn-secret-output.mjs

@@ -0,0 +1,150 @@
+import { createHash, createPrivateKey, createPublicKey } from "node:crypto";
+import { readFile } from "node:fs/promises";
+import { networkInterfaces } from "node:os";
+
+import {
+  assertAtomicOutputAvailable,
+  AtomicOutputExistsError,
+  writeAtomicOutput,
+} from "./atomic-output.mjs";
+
+const X25519_PKCS8_PREFIX = Buffer.from("302e020100300506032b656e04220420", "hex");
+const PRIVATE_KEY_PLACEHOLDER = "<your-wireguard-private-key>";
+
+function parseWireGuardPrivateKey(content) {
+  const source = String(content).trim();
+  const assigned = source
+    .split(/\r?\n/)
+    .map((line) => line.match(/^\s*PrivateKey\s*=\s*(\S+)\s*$/)?.[1])
+    .find(Boolean);
+  const value = assigned ?? source;
+  if (!value || !/^[A-Za-z0-9+/]{42}[AEIMQUYcgkosw048]=$/.test(value)) {
+    const error = new Error(
+      "The WireGuard private-key file must contain one base64 private key or a PrivateKey = value line."
+    );
+    error.code = "invalid_wireguard_private_key";
+    throw error;
+  }
+  const raw = Buffer.from(value, "base64");
+  if (raw.length !== 32) {
+    const error = new Error("The WireGuard private key must decode to exactly 32 bytes.");
+    error.code = "invalid_wireguard_private_key";
+    throw error;
+  }
+  const privateObject = createPrivateKey({
+    key: Buffer.concat([X25519_PKCS8_PREFIX, raw]),
+    format: "der",
+    type: "pkcs8",
+  });
+  const publicDer = createPublicKey(privateObject).export({ format: "der", type: "spki" });
+  return {
+    privateKey: value,
+    publicKey: Buffer.from(publicDer).subarray(-32).toString("base64"),
+  };
+}
+
+async function wireGuardKeyFromFile(privateKeyPath) {
+  if (typeof privateKeyPath !== "string" || !privateKeyPath.trim()) {
+    const error = new Error("A WireGuard private-key file is required.");
+    error.code = "wireguard_private_key_required";
+    throw error;
+  }
+  return parseWireGuardPrivateKey(await readFile(privateKeyPath, "utf8"));
+}
+
+export async function wireGuardPublicKeyFromFile(privateKeyPath) {
+  return (await wireGuardKeyFromFile(privateKeyPath)).publicKey;
+}
+
+async function completeWireGuardConfig(content, privateKeyPath, expectedPublicKey) {
+  const key = await wireGuardKeyFromFile(privateKeyPath);
+  if (expectedPublicKey && key.publicKey !== expectedPublicKey) {
+    const error = new Error(
+      "The selected WireGuard private key no longer matches the reviewed peer."
+    );
+    error.code = "wireguard_key_changed";
+    throw error;
+  }
+  if (!String(content).includes(`PrivateKey = ${PRIVATE_KEY_PLACEHOLDER}`)) {
+    const error = new Error(
+      "Ornn returned a VPN configuration without its private-key handoff marker."
+    );
+    error.code = "vpn_configuration_invalid";
+    throw error;
+  }
+  return String(content).replace(
+    `PrivateKey = ${PRIVATE_KEY_PLACEHOLDER}`,
+    `PrivateKey = ${key.privateKey}`
+  );
+}
+
+export function hasLocalNetworkAddress(address) {
+  const expected = String(address ?? "")
+    .split("/")[0]
+    .trim();
+  if (!expected) return false;
+  return Object.values(networkInterfaces()).some((entries) =>
+    (entries ?? []).some((entry) => entry.address === expected)
+  );
+}
+
+function fingerprint(content) {
+  return `sha256:${createHash("sha256").update(content).digest("hex")}`;
+}
+
+function modeLabel(mode) {
+  if (typeof mode === "string") return mode.startsWith("0") ? mode : `0${mode}`;
+  return `0${(Number(mode) & 0o777).toString(8).padStart(3, "0")}`;
+}
+
+function outputError(error, outputPath) {
+  if (!(error instanceof AtomicOutputExistsError)) return error;
+  const refusal = new Error(
+    `Refusing to overwrite existing VPN configuration: ${outputPath}. Add --overwrite to replace it deliberately.`
+  );
+  refusal.code = "output_exists";
+  return refusal;
+}
+
+export async function prepareVpnSecretExport({ outputPath, overwrite = false, print = false }) {
+  if (print) return;
+  try {
+    await assertAtomicOutputAvailable(outputPath, { overwrite });
+  } catch (error) {
+    throw outputError(error, outputPath);
+  }
+}
+
+/**
+ * App-owned secret export hook installed on the shared interaction runtime.
+ * Secret bytes are consumed here and never returned in the command result.
+ */
+export async function exportVpnSecret(
+  { content, outputPath, overwrite = false, print = false, privateKeyPath, publicKey },
+  { machine, stdout }
+) {
+  const completed = await completeWireGuardConfig(content, privateKeyPath, publicKey);
+  const digest = fingerprint(completed);
+  if (print) {
+    if (machine) {
+      const error = new Error(
+        "Machine mode cannot print VPN configuration bytes; use --output <path>."
+      );
+      error.code = "secret_print_unsupported_in_machine_mode";
+      throw error;
+    }
+    stdout.write(completed.endsWith("\n") ? completed : `${completed}\n`);
+    return { fingerprint: digest, mode: null, path: null };
+  }
+
+  try {
+    const written = await writeAtomicOutput(outputPath, completed, { mode: 0o600, overwrite });
+    return {
+      fingerprint: digest,
+      mode: modeLabel(written.mode),
+      path: written.path,
+    };
+  } catch (error) {
+    throw outputError(error, outputPath);
+  }
+}

package/src/wait-runtime.mjs

@@ -0,0 +1,231 @@
+function progressRecord(command, sequence, observedAt, outcome, message, data) {
+  return {
+    schema: "ornn.cli/v1",
+    type: "progress",
+    command,
+    sequence,
+    observed_at: observedAt,
+    outcome,
+    message,
+    data: data ?? null,
+  };
+}
+
+export async function waitForDelay(delay, sleep, signal) {
+  if (!signal) {
+    if (sleep) {
+      await sleep(delay);
+    } else {
+      await new Promise((resolve) => setTimeout(resolve, delay));
+    }
+    return "elapsed";
+  }
+  if (signal.aborted) return "interrupted";
+  if (sleep) {
+    return new Promise((resolve, reject) => {
+      let settled = false;
+      const finish = (outcome) => {
+        if (settled) return;
+        settled = true;
+        signal.removeEventListener("abort", interrupted);
+        resolve(outcome);
+      };
+      const interrupted = () => finish("interrupted");
+      signal.addEventListener("abort", interrupted, { once: true });
+      Promise.resolve(sleep(delay)).then(
+        () => finish("elapsed"),
+        (error) => {
+          signal.removeEventListener("abort", interrupted);
+          reject(error);
+        }
+      );
+    });
+  }
+  return new Promise((resolve) => {
+    let settled = false;
+    let timer;
+    const finish = (outcome) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      signal.removeEventListener("abort", interrupted);
+      resolve(outcome);
+    };
+    const interrupted = () => finish("interrupted");
+    signal.addEventListener("abort", interrupted, { once: true });
+    timer = setTimeout(() => finish("elapsed"), delay);
+  });
+}
+
+export async function readUntilDeadline(read, { signal, timeoutMs } = {}) {
+  const controller = new AbortController();
+  return new Promise((resolve, reject) => {
+    let settled = false;
+    let timer;
+    const cleanup = () => {
+      clearTimeout(timer);
+      signal?.removeEventListener("abort", interrupted);
+    };
+    const finish = (result) => {
+      if (settled) return;
+      settled = true;
+      cleanup();
+      resolve(result);
+    };
+    const interrupted = () => {
+      controller.abort(signal?.reason);
+      finish({ kind: "interrupted" });
+    };
+    if (Number.isFinite(timeoutMs)) {
+      timer = setTimeout(
+        () => {
+          controller.abort(new DOMException("The wait deadline elapsed.", "TimeoutError"));
+          finish({ kind: "timeout" });
+        },
+        Math.max(0, timeoutMs)
+      );
+    }
+    signal?.addEventListener("abort", interrupted, { once: true });
+    Promise.resolve()
+      .then(() => read({ signal: controller.signal }))
+      .then(
+        (value) => finish({ kind: "value", value }),
+        (error) => {
+          if (settled) return;
+          settled = true;
+          cleanup();
+          reject(error);
+        }
+      );
+    if (signal?.aborted) interrupted();
+  });
+}
+
+/**
+ * Poll a durable remote goal. Poll callbacks must issue only idempotent reads
+ * and forward the provided signal so local timeout/interruption can end a
+ * stalled read without cancelling the durable remote operation.
+ */
+export async function waitForGoal(
+  {
+    command,
+    emitProgress = true,
+    initial,
+    intervalMs = 5_000,
+    isReady,
+    isTerminal = () => false,
+    message,
+    onObserve = () => {},
+    poll,
+    pollImmediately = false,
+    projectProgress = () => null,
+    progressIntervalMs = 10_000,
+    timeoutMs,
+  },
+  { format, now = () => Date.now(), signal, sleep, stderr, stdout }
+) {
+  let current = initial;
+  let elapsedMs = 0;
+  let scheduledElapsedMs = 0;
+  let delayBeforePoll = !pollImmediately;
+  let lastDescription = "";
+  let lastReportMs = -progressIntervalMs;
+  let sequence = 0;
+  const startedAt = now();
+  const localController = signal ? null : new AbortController();
+  const localSignal = signal ?? localController.signal;
+  const onSigint = localController ? () => localController.abort() : null;
+  if (onSigint) process.once("SIGINT", onSigint);
+
+  function syncElapsed() {
+    const wallElapsedMs = Math.max(0, now() - startedAt);
+    elapsedMs = Math.min(timeoutMs, Math.max(scheduledElapsedMs, wallElapsedMs));
+  }
+
+  function report(force = false) {
+    onObserve(current, elapsedMs);
+    if (!emitProgress) return;
+    const description = message(current, elapsedMs);
+    if (!force && description === lastDescription && elapsedMs - lastReportMs < progressIntervalMs)
+      return;
+    lastDescription = description;
+    lastReportMs = elapsedMs;
+    const outcome = isReady(current)
+      ? { class: "ready", phase: "goal_ready" }
+      : isTerminal(current)
+        ? { class: "failed", phase: "terminal" }
+        : { class: "working", phase: "provisioning" };
+    if (format === "ndjson") {
+      sequence += 1;
+      stdout.write(
+        `${JSON.stringify(
+          progressRecord(
+            command,
+            sequence,
+            new Date(startedAt + elapsedMs).toISOString(),
+            outcome,
+            description,
+            projectProgress(current)
+          )
+        )}\n`
+      );
+    } else if (format === "human") {
+      stderr.write(`${description}\n`);
+    }
+  }
+
+  try {
+    syncElapsed();
+    report(true);
+    for (;;) {
+      syncElapsed();
+      const immediatePoll = !delayBeforePoll;
+      if (localSignal.aborted) return { kind: "interrupted", value: current };
+      if (isReady(current)) return { kind: "ready", value: current };
+      if (isTerminal(current)) return { kind: "terminal", value: current };
+      if (elapsedMs >= timeoutMs && !immediatePoll) {
+        return { kind: "timeout", value: current };
+      }
+      if (delayBeforePoll) {
+        const untilProgressMs = Math.max(0, progressIntervalMs - (elapsedMs - lastReportMs));
+        const delay = Math.min(intervalMs, timeoutMs - elapsedMs, untilProgressMs);
+        if (delay > 0) {
+          const waited = await waitForDelay(delay, sleep, localSignal);
+          if (waited === "interrupted" || localSignal.aborted) {
+            return { kind: "interrupted", value: current };
+          }
+          scheduledElapsedMs += delay;
+        }
+      }
+      delayBeforePoll = true;
+      syncElapsed();
+      report();
+      if (elapsedMs >= timeoutMs && !immediatePoll) {
+        return { kind: "timeout", value: current };
+      }
+      const remainingMs = Math.max(1, timeoutMs - elapsedMs);
+      const untilProgressMs = Math.max(1, progressIntervalMs - (elapsedMs - lastReportMs));
+      const readWindowMs = Math.min(remainingMs, progressIntervalMs, untilProgressMs);
+      const polled = await readUntilDeadline(poll, {
+        signal: localSignal,
+        timeoutMs: readWindowMs,
+      });
+      if (polled.kind === "interrupted") {
+        return { kind: "interrupted", value: current };
+      }
+      if (polled.kind === "timeout") {
+        scheduledElapsedMs += readWindowMs;
+        syncElapsed();
+        if (elapsedMs >= timeoutMs) return { kind: "timeout", value: current };
+        report();
+        delayBeforePoll = false;
+        continue;
+      }
+      current = polled.value;
+      syncElapsed();
+      report();
+    }
+  } finally {
+    if (onSigint) process.removeListener("SIGINT", onSigint);
+  }
+}

package/vendor/capabilities/capabilities/admin-capacity-reservations.js

@@ -0,0 +1,126 @@
+import { z } from "zod";
+import { defineCapability } from "../capability.js";
+import { createListingCapability } from "./listings.js";
+function adminHelp(command, outcome, human, automation, review) {
+    return {
+        audience: "admin",
+        category: "resource",
+        command,
+        outcome,
+        human,
+        automation,
+        acceptedReferences: [],
+        ...(review ? { review } : {}),
+    };
+}
+const capacityOfferCreateInput = z.object({
+    gpu_type: z.string().min(1),
+    node_count: z.number().int().positive(),
+    gpus_per_node: z.number().int().positive(),
+    site_nickname: z.string().min(1),
+    available_start_at: z.string().min(1),
+    available_end_at: z.string().min(1),
+    buy_now_price_per_gpu_hour: z.number().nonnegative(),
+});
+export const adminCapacityOffersCreateCapability = {
+    ...createListingCapability,
+    cli: {
+        ...createListingCapability.cli,
+        vnext: adminHelp(["admin", "capacity-offers", "create"], "Create one capacity offer from explicit commercial terms.", "ornn admin capacity-offers create --gpu GPU --nodes COUNT --gpus-per-node COUNT --site SITE --starts-at TIME --ends-at TIME --price-per-gpu-hour USD", "Not supported in machine or redirected execution because offer creation has no durable replay identity.", "GPU, capacity, site, availability window, and price are normalized before default-no consent."),
+    },
+    input: createListingCapability.input,
+    execute: async (ctx, input) => {
+        if (!ctx.cli)
+            return createListingCapability.execute(ctx, createListingCapability.input.parse(input));
+        const result = await createListingCapability.execute(ctx, capacityOfferCreateInput.parse(input));
+        if (!ctx.confirmed || object(result).ok === false)
+            return result;
+        return { capacity_offer: normalizeCapacityOffer(result) };
+    },
+};
+const reservationCreateInput = z.object({
+    organization_id: z.string().uuid(),
+    listing_id: z.string().uuid(),
+    node_count: z.number().int().positive(),
+    start_at: z.string().min(1),
+    end_at: z.string().min(1),
+    price_per_gpu_hour: z.string().regex(/^\d+(?:\.\d{1,6})?$/),
+});
+function object(value) {
+    return value && typeof value === "object" && !Array.isArray(value)
+        ? value
+        : {};
+}
+function field(value, ...keys) {
+    for (const key of keys) {
+        if (value[key] !== undefined)
+            return value[key];
+    }
+    return undefined;
+}
+function normalizeCapacityOffer(value) {
+    const row = object(object(value).capacity_offer ?? object(value).listing ?? value);
+    return {
+        capacity_offer_id: field(row, "capacity_offer_id", "listing_id", "listingId", "id"),
+        gpu: field(row, "gpu", "gpu_type", "gpuType"),
+        node_count: field(row, "node_count", "nodeCount", "capacity_nodes", "capacityNodes"),
+        gpus_per_node: field(row, "gpus_per_node", "gpusPerNode"),
+        site: field(row, "site", "site_nickname", "siteNickname", "facility"),
+        starts_at: field(row, "starts_at", "start_at", "startAt", "available_start_at"),
+        ends_at: field(row, "ends_at", "end_at", "endAt", "available_end_at"),
+        price_per_gpu_hour: field(row, "price_per_gpu_hour", "buy_now_price_per_gpu_hour", "buyNowRatePerGpuHour"),
+        status: field(row, "status", "state"),
+    };
+}
+function normalizeReservation(value) {
+    const row = object(value);
+    return {
+        reservation_id: field(row, "reservation_id", "reservationId", "id"),
+        listing_id: field(row, "listing_id", "listingId"),
+        organization_id: field(row, "organization_id", "organizationId", "tenant_id", "tenantId"),
+        node_count: field(row, "node_count", "nodeCount"),
+        start_at: field(row, "start_at", "startAt"),
+        end_at: field(row, "end_at", "endAt"),
+        status: field(row, "status"),
+        price_per_gpu_hour: field(row, "price_per_gpu_hour", "pricePerGpuHour", "pricePerGpuHr"),
+    };
+}
+export const adminReservationsCreateCapability = defineCapability({
+    id: "reservations.create",
+    domain: "reservations",
+    roles: ["admin"],
+    description: "Create one capacity reservation from explicit, reviewed commercial terms.",
+    mutation: "preview-confirm",
+    http: { method: "POST", path: "/internal/commerce-reservations" },
+    cli: {
+        command: ["admin", "reservations", "create"],
+        vnext: adminHelp(["admin", "reservations", "create"], "Create one capacity reservation from explicit commercial terms.", "ornn admin reservations create --organization ID --capacity-offer ID --nodes COUNT --starts-at TIME --ends-at TIME --price-per-gpu-hour USD", "Not supported in machine or redirected execution because reservation creation has no durable replay identity.", "Organization, capacity offer, quantity, dates, and price are normalized before default-no consent."),
+    },
+    mcp: false,
+    slack: false,
+    input: reservationCreateInput,
+    execute: async (ctx, input) => {
+        const parsed = reservationCreateInput.parse(input);
+        if (!ctx.confirmed)
+            return { preview: parsed };
+        const payload = await ctx.fetch("/internal/commerce-reservations", {
+            method: "POST",
+            body: {
+                tenant_id: parsed.organization_id,
+                listing_id: parsed.listing_id,
+                node_count: parsed.node_count,
+                start_at: parsed.start_at,
+                end_at: parsed.end_at,
+                price_per_gpu_hr: parsed.price_per_gpu_hour,
+            },
+        });
+        const body = object(payload);
+        return {
+            reservation: normalizeReservation(body.reservation ?? body),
+        };
+    },
+});
+export const adminCapacityReservationCapabilities = [
+    adminCapacityOffersCreateCapability,
+    adminReservationsCreateCapability,
+];