@ornncompute/cli 0.2.23 → 1.0.25

package/vendor/capabilities/capabilities/admin-enrollment.js

@@ -0,0 +1,321 @@
+import { z } from "zod";
+import { defineCapability } from "../capability.js";
+import { buildEnrollmentInstallCommand, tokensCreateCapability, tokensListCapability, } from "./tokens.js";
+const UUID = z.string().uuid();
+const nonEmpty = z.string().trim().min(1);
+const tokenTtl = z
+    .number()
+    .int()
+    .min(60)
+    .max(24 * 60 * 60);
+function adminHelp(command, outcome, human, automation, acceptedReferences = [], review) {
+    return {
+        audience: "admin",
+        category: "resource",
+        command,
+        outcome,
+        human,
+        automation,
+        acceptedReferences,
+        ...(review ? { review } : {}),
+    };
+}
+function withVnextBinding(capability, help) {
+    if (!help.command)
+        throw new Error(`${capability.id} requires a canonical CLI command`);
+    return {
+        ...capability,
+        cli: {
+            command: [...help.command],
+            vnext: help,
+        },
+    };
+}
+export const adminEnrollmentTokensListCapability = {
+    ...withVnextBinding(tokensListCapability, adminHelp(["admin", "enrollment-tokens", "list"], "List enrollment-token metadata without token bytes.", "ornn admin enrollment-tokens list [--limit 50] [--cursor CURSOR]", "ornn admin enrollment-tokens list --limit 50 --format json")),
+    execute: async (ctx) => {
+        const payload = await tokensListCapability.execute(ctx, {});
+        if (!ctx.cli)
+            return payload;
+        return {
+            enrollment_tokens: rowsFromTokenList(payload)
+                .map(tokenMetadata)
+                .filter((token) => token !== null),
+        };
+    },
+};
+export const adminEnrollmentTokenCreateCapability = withVnextBinding(tokensCreateCapability, adminHelp(["admin", "enrollment-tokens", "create"], "Create one expiring enrollment token through an explicit secret export.", "ornn admin enrollment-tokens create --operator UUID --expires-in SECONDS (--print | --output PATH) [--overwrite] [--yes]", "Unsupported: token creation requires an eligible human terminal.", ["canonical operator UUID"], "Review the operator, expiry, and secret destination before minting the token."));
+const tokenRevokeInput = z.object({
+    token_id: UUID,
+    expected_created_at: nonEmpty.optional(),
+    idempotency_key: nonEmpty.optional(),
+});
+function rowsFromTokenList(payload) {
+    if (Array.isArray(payload))
+        return payload;
+    if (!payload || typeof payload !== "object")
+        return [];
+    const source = payload;
+    for (const key of ["enrollment_tokens", "tokens", "items", "data"]) {
+        if (Array.isArray(source[key]))
+            return source[key];
+    }
+    return [];
+}
+function tokenMetadata(value) {
+    if (!value || typeof value !== "object")
+        return null;
+    const row = value;
+    if (typeof row.id !== "string" || !row.id)
+        return null;
+    return {
+        id: row.id,
+        operator_id: typeof row.operator_id === "string" ? row.operator_id : null,
+        status: typeof row.status === "string" ? row.status : "unknown",
+        expires_at: typeof row.expires_at === "string" ? row.expires_at : null,
+        created_at: typeof row.created_at === "string" ? row.created_at : null,
+    };
+}
+function codedError(code, message) {
+    const error = new Error(message);
+    error.detail = { code, retryable: false };
+    return error;
+}
+async function readExactToken(ctx, tokenId, expectedCreatedAt) {
+    // Filter at the owner before its list limit; an older active token may not be in the latest 500.
+    const listed = await ctx.fetch(`/enrollment-tokens?id=${encodeURIComponent(tokenId)}`, {
+        method: "GET",
+    });
+    const target = rowsFromTokenList(listed)
+        .map(tokenMetadata)
+        .find((candidate) => candidate?.id === tokenId);
+    if (!target)
+        return { disposition: "satisfied", target: null };
+    if (expectedCreatedAt && target.created_at !== expectedCreatedAt) {
+        return {
+            disposition: "conflict",
+            target,
+            message: `Enrollment token ${tokenId} was replaced after ${expectedCreatedAt}; refusing to revoke it.`,
+        };
+    }
+    if (target.status === "revoked" || target.status === "expired") {
+        return { disposition: "satisfied", target };
+    }
+    return { disposition: "apply", target };
+}
+export const adminEnrollmentTokenRevokeCapability = defineCapability({
+    id: "tokens.revoke",
+    domain: "fleet",
+    roles: ["admin"],
+    description: "Revoke one exact enrollment-token generation after reconciling its durable goal.",
+    mutation: "preview-confirm",
+    http: { method: "POST", path: "/enrollment/tokens/{id}/revoke" },
+    cli: {
+        command: ["admin", "enrollment-tokens", "revoke"],
+        vnext: adminHelp(["admin", "enrollment-tokens", "revoke"], "Revoke one exact enrollment-token generation.", "ornn admin enrollment-tokens revoke <token-id> [--expected-created-at TIME] [--yes]", "ornn admin enrollment-tokens revoke <token-id> --expected-created-at TIME --yes --idempotency-key KEY --format json", ["canonical token UUID", "token created_at generation"], "Review the exact token generation and the loss of future enrollment access."),
+    },
+    mcp: false,
+    slack: false,
+    input: tokenRevokeInput,
+    execute: async (ctx, input) => {
+        const parsed = tokenRevokeInput.parse(input);
+        const current = await readExactToken(ctx, parsed.token_id, parsed.expected_created_at);
+        if (!ctx.confirmed)
+            return current;
+        if (current.disposition === "conflict") {
+            throw codedError("token_identity_changed", current.message);
+        }
+        if (current.disposition === "satisfied") {
+            return {
+                id: parsed.token_id,
+                created_at: parsed.expected_created_at ?? current.target?.created_at ?? null,
+                status: "revoked",
+                reconciled: true,
+            };
+        }
+        if (!current.target.created_at) {
+            throw codedError("token_identity_unavailable", `Enrollment token ${parsed.token_id} has no stable creation identity and cannot be revoked safely.`);
+        }
+        const revoked = (await ctx.fetch(`/enrollment/tokens/${encodeURIComponent(parsed.token_id)}/revoke`, {
+            method: "POST",
+            ...(parsed.idempotency_key
+                ? { headers: { "Idempotency-Key": parsed.idempotency_key } }
+                : {}),
+        }));
+        return {
+            id: parsed.token_id,
+            created_at: current.target.created_at,
+            operator_id: current.target.operator_id,
+            expires_at: current.target.expires_at,
+            status: "revoked",
+            reconciled: false,
+            ...(typeof revoked?.deleted === "boolean" ? { deleted: revoked.deleted } : {}),
+        };
+    },
+});
+const nodeEnrollInput = z.object({
+    node_id: UUID,
+    host: nonEmpty,
+    operator_id: UUID,
+    facility_id: UUID,
+    filter: z.string().optional(),
+    identity_file: nonEmpty,
+    private_key: z.string().min(1).optional(),
+    username: nonEmpty.default("root"),
+    port: z.number().int().min(1).max(65535).default(22),
+    expires_in_seconds: tokenTtl,
+    installer_base: nonEmpty.optional(),
+    replace_existing_management: z.literal(true),
+    verbose: z.boolean().default(false),
+});
+function safeRemoteResult(value) {
+    if (!value || typeof value !== "object")
+        return {};
+    const row = value;
+    const safe = {};
+    for (const key of ["id", "status", "state", "exit_code", "started_at", "completed_at"]) {
+        const field = row[key];
+        if (typeof field === "string" || typeof field === "number" || typeof field === "boolean") {
+            safe[key] = field;
+        }
+    }
+    return safe;
+}
+export const adminNodeEnrollCapability = defineCapability({
+    id: "nodes.enroll",
+    domain: "fleet",
+    roles: ["admin"],
+    description: "Enroll one explicit node over SSH with an explicit operator and facility assignment.",
+    mutation: "preview-confirm",
+    http: { method: "POST", path: "/internal/remote" },
+    cli: {
+        command: ["admin", "nodes", "enroll"],
+        vnext: adminHelp(["admin", "nodes", "enroll"], "Install Ornn management on one explicitly assigned node.", "ornn admin nodes enroll <node-id> --host HOST --operator UUID --facility UUID [--filter COMPARTMENT_IDS] --identity-file PATH --token-ttl SECONDS --replace-existing-management [--verbose] [--yes]", "Unsupported: remote enrollment requires an eligible human terminal.", ["canonical node UUID", "canonical operator UUID", "canonical facility UUID"], "Review node identity, SSH target, assignment, compartment filter, and replacement of existing management."),
+    },
+    mcp: false,
+    slack: false,
+    input: nodeEnrollInput,
+    execute: async (ctx, input) => {
+        const parsed = nodeEnrollInput.parse(input);
+        if (!ctx.confirmed) {
+            return {
+                node_id: parsed.node_id,
+                host: parsed.host,
+                operator_id: parsed.operator_id,
+                facility_id: parsed.facility_id,
+                filter: parsed.filter,
+                expires_in_seconds: parsed.expires_in_seconds,
+                replace_existing_management: true,
+            };
+        }
+        if (!parsed.private_key) {
+            throw codedError("identity_file_unreadable", "The SSH identity file could not be read.");
+        }
+        const minted = (await ctx.fetch("/enrollment-tokens", {
+            method: "POST",
+            body: {
+                operator_id: parsed.operator_id,
+                expires_in_seconds: parsed.expires_in_seconds,
+            },
+        }));
+        const token = typeof minted.token === "string"
+            ? minted.token
+            : typeof minted.plaintext === "string"
+                ? minted.plaintext
+                : "";
+        if (!token) {
+            throw codedError("token_material_unavailable", "The enrollment token was created without usable token material.");
+        }
+        const command = buildEnrollmentInstallCommand({
+            token,
+            base: parsed.installer_base ?? ctx.installerBaseUrl,
+            facilityId: parsed.facility_id,
+            filter: parsed.filter,
+            restoreNodeId: parsed.node_id,
+            force: true,
+        });
+        const remote = await ctx.fetch("/internal/remote", {
+            method: "POST",
+            body: {
+                host: parsed.host,
+                username: parsed.username,
+                port: parsed.port,
+                private_key: parsed.private_key,
+                command,
+                timeout_seconds: 600,
+            },
+        });
+        return {
+            node_id: parsed.node_id,
+            host: parsed.host,
+            operator_id: parsed.operator_id,
+            facility_id: parsed.facility_id,
+            filter: parsed.filter,
+            management: "replaced",
+            token_metadata: {
+                id: typeof minted.id === "string" ? minted.id : null,
+                expires_at: typeof minted.expires_at === "string" ? minted.expires_at : null,
+            },
+            remote: safeRemoteResult(remote),
+        };
+    },
+});
+const nodeKeyInput = z.object({ node_id: UUID });
+export const adminNodeExportKeyCapability = defineCapability({
+    id: "nodes.export-key",
+    domain: "fleet",
+    roles: ["admin"],
+    description: "Export an enrolled node's private admin key only through an explicit secret destination.",
+    mutation: "read",
+    http: { method: "GET", path: "/enrollment/admin-ssh-key" },
+    cli: {
+        command: ["admin", "nodes", "export-key"],
+        vnext: adminHelp(["admin", "nodes", "export-key"], "Export one node admin key deliberately.", "ornn admin nodes export-key <node-id> (--print | --output PATH) [--overwrite]", "ornn admin nodes export-key <node-id> --output PATH [--overwrite] --format json", ["canonical node UUID"]),
+    },
+    mcp: false,
+    slack: false,
+    input: nodeKeyInput,
+    execute: async (ctx, input) => {
+        const parsed = nodeKeyInput.parse(input);
+        return ctx.fetch(`/enrollment/admin-ssh-key?node_id=${encodeURIComponent(parsed.node_id)}`, {
+            method: "GET",
+        });
+    },
+});
+export const adminNodeRotateKeyCapability = defineCapability({
+    id: "nodes.rotate-key",
+    domain: "fleet",
+    roles: ["admin"],
+    description: "Replace a node's admin key and export the new private key explicitly.",
+    mutation: "preview-confirm",
+    http: { method: "POST", path: "/enrollment/admin-ssh-key" },
+    cli: {
+        command: ["admin", "nodes", "rotate-key"],
+        vnext: adminHelp(["admin", "nodes", "rotate-key"], "Rotate one node admin key and export the replacement deliberately.", "ornn admin nodes rotate-key <node-id> (--print | --output PATH) [--overwrite] [--yes]", "Unsupported: key rotation requires an eligible human terminal.", ["canonical node UUID"], "Review the node and loss of access through the previous private key."),
+    },
+    mcp: false,
+    slack: false,
+    input: nodeKeyInput,
+    execute: async (ctx, input) => {
+        const parsed = nodeKeyInput.parse(input);
+        if (!ctx.confirmed)
+            return { node_id: parsed.node_id };
+        return ctx.fetch(`/enrollment/admin-ssh-key?node_id=${encodeURIComponent(parsed.node_id)}`, {
+            method: "POST",
+        });
+    },
+});
+const replacements = {
+    "tokens.create": adminEnrollmentTokenCreateCapability,
+    "tokens.list": adminEnrollmentTokensListCapability,
+};
+/** Applies the canonical admin CLI bindings without changing MCP or Slack identities. */
+export function bindAdminEnrollmentCapabilities(capabilities) {
+    return capabilities.map((capability) => replacements[capability.id] ?? capability);
+}
+export const adminEnrollmentCapabilities = [
+    adminEnrollmentTokenRevokeCapability,
+    adminNodeEnrollCapability,
+    adminNodeExportKeyCapability,
+    adminNodeRotateKeyCapability,
+];

package/vendor/capabilities/capabilities/admin-node-diagnostics.js

@@ -0,0 +1,88 @@
+import { z } from "zod";
+import { defineCapability } from "../capability.js";
+import { nodeExecCapability } from "./fleet.js";
+const nodeId = z
+    .string()
+    .min(1)
+    .refine((value) => value === value.trim(), {
+    message: "node_id must be an exact canonical node ID without surrounding whitespace",
+});
+export const adminNodeDiagnoseInput = z.object({
+    node_id: nodeId,
+});
+export const adminNodeExecInput = z.object({
+    node_id: nodeId,
+    command: z.string().min(1),
+    timeout_seconds: z.number().int().min(1).max(900),
+});
+function adminNodeHelp(command, outcome, human, automation, review) {
+    return {
+        audience: "admin",
+        category: "resource",
+        command,
+        outcome,
+        human,
+        automation,
+        acceptedReferences: ["canonical node ID"],
+        review,
+    };
+}
+export const adminNodeDiagnoseCapability = defineCapability({
+    id: "node.diagnose",
+    domain: "fleet",
+    roles: ["admin"],
+    description: "Queue the staff-authorized diagnosis workflow for one exact node after a live review.",
+    mutation: "preview-confirm",
+    http: { method: "POST", path: "/jobs" },
+    cli: {
+        command: ["admin", "nodes", "diagnose"],
+        vnext: adminNodeHelp(["admin", "nodes", "diagnose"], "Queue diagnosis for one exact node.", "ornn admin nodes diagnose <node-id>", "Unavailable in machine and redirected modes; use an eligible human terminal.", "Exact node, lifecycle, reachability, and diagnosis workflow."),
+    },
+    mcp: false,
+    slack: false,
+    input: adminNodeDiagnoseInput,
+    execute: async (ctx, input) => {
+        const parsed = adminNodeDiagnoseInput.parse(input);
+        if (!ctx.confirmed) {
+            return {
+                action: "node.diagnose",
+                payload: { node_id: parsed.node_id, source: { mode: "cli" }, burn_time_minutes: 0 },
+            };
+        }
+        return ctx.fetch("/jobs", {
+            method: "POST",
+            body: { node_id: parsed.node_id, source: { mode: "cli" }, burn_time_minutes: 0 },
+        });
+    },
+});
+export const adminNodeExecCapability = {
+    ...nodeExecCapability,
+    mutation: "preview-confirm",
+    cli: {
+        ...nodeExecCapability.cli,
+        vnext: adminNodeHelp(["admin", "nodes", "exec"], "Execute exact command bytes on one exact node.", "ornn admin nodes exec <node-id> --command COMMAND --timeout DURATION", "Unavailable in machine and redirected modes; use an eligible human terminal.", "Exact node, lifecycle, reachability, command bytes, and timeout."),
+    },
+    input: adminNodeExecInput,
+    execute: async (ctx, input) => {
+        const parsed = adminNodeExecInput.parse(input);
+        if (ctx.cli && !ctx.confirmed) {
+            return {
+                action: "node.exec",
+                payload: {
+                    node_id: parsed.node_id,
+                    command: parsed.command,
+                    timeout_seconds: parsed.timeout_seconds,
+                },
+            };
+        }
+        return nodeExecCapability.execute(ctx, {
+            node_id: parsed.node_id,
+            command: parsed.command,
+            timeout_seconds: parsed.timeout_seconds,
+        });
+    },
+};
+export const adminNodeDiagnosticCapabilities = [
+    adminNodeDiagnoseCapability,
+    adminNodeExecCapability,
+];

package/vendor/capabilities/capabilities/admin-nodes-lifecycle.js

@@ -0,0 +1,235 @@
+import { z } from "zod";
+import { defineCapability } from "../capability.js";
+const nodeReference = z.string().trim().min(1);
+const optionalText = z.string().trim().min(1).optional();
+const commonInput = {
+    node_ref: nodeReference,
+    node_id: optionalText,
+    idempotency_key: optionalText,
+    reason: optionalText,
+    yes: z.boolean().optional(),
+    wait: z.boolean().optional(),
+    timeout_seconds: z.number().positive().optional(),
+};
+const rebootInput = z.object({
+    ...commonInput,
+    machine_id: optionalText,
+});
+const hardResetInput = rebootInput.extend({
+    erase_local_data: z.literal(true),
+});
+const terminationInput = z.object({
+    ...commonInput,
+    delete_node_record: z.literal(true),
+    skip_cleanup: z.boolean().optional(),
+});
+const assignmentInput = z.object({
+    ...commonInput,
+    reservation_id: z.string().trim().min(1),
+});
+const managementInput = z.object(commonInput);
+function adminLifecycleHelp(command, outcome, human, automation, review) {
+    return {
+        audience: "admin",
+        category: "resource",
+        command,
+        outcome,
+        human,
+        automation,
+        acceptedReferences: ["canonical node ID", "exact unique node hostname in an eligible terminal"],
+        review,
+        resumableStates: ["accepted", "pending", "timed out", "interrupted"],
+        related: ["admin nodes health", "admin nodes list"],
+    };
+}
+function nodeId(input) {
+    if (!input.node_id)
+        throw new Error("The lifecycle target must be resolved before execution.");
+    return input.node_id;
+}
+function requestHeaders(idempotencyKey) {
+    return idempotencyKey ? { "Idempotency-Key": idempotencyKey } : undefined;
+}
+function preview(action, payload) {
+    return { ok: true, action, payload };
+}
+async function reboot(ctx, input, mode) {
+    const parsed = mode === "hard_reset" ? hardResetInput.parse(input) : rebootInput.parse(input);
+    const payload = {
+        node_id: parsed.node_id,
+        machine_id: parsed.machine_id,
+        mode,
+        ...(mode === "hard_reset" ? { erase_local_data: true } : {}),
+    };
+    if (!ctx.confirmed)
+        return preview(`nodes.${mode}`, payload);
+    if (!parsed.machine_id)
+        throw new Error("The live machine target must be resolved before reboot.");
+    return ctx.fetch(`/nodes/${encodeURIComponent(parsed.machine_id)}/reboot`, {
+        method: "POST",
+        body: {
+            mode,
+            ...(parsed.idempotency_key ? { request_id: parsed.idempotency_key } : {}),
+        },
+        headers: requestHeaders(parsed.idempotency_key),
+    });
+}
+export const adminNodeRebootCapability = defineCapability({
+    id: "nodes.reboot",
+    domain: "fleet",
+    roles: ["admin"],
+    description: "Reboot the exact live machine backing one managed node after a normalized review.",
+    mutation: "preview-confirm",
+    http: { method: "POST", path: "/nodes/{id}/reboot" },
+    cli: {
+        command: ["admin", "nodes", "reboot"],
+        vnext: adminLifecycleHelp(["admin", "nodes", "reboot"], "Reboot one exact live machine while preserving local data and access configuration.", "ornn admin nodes reboot <node-ref> [--yes] [--no-wait] [--timeout SECONDS]", "Unsupported: reboot requires an eligible human terminal.", "Node and live-machine identities, operator, facility, capacity assignment, and preserved access."),
+    },
+    mcp: false,
+    slack: false,
+    input: rebootInput,
+    execute: (ctx, input) => reboot(ctx, input, "reboot"),
+});
+export const adminNodeHardResetCapability = defineCapability({
+    id: "nodes.hard_reset",
+    domain: "fleet",
+    roles: ["admin"],
+    description: "Hard reset the exact live machine backing one node with explicit local-data erasure scope.",
+    mutation: "preview-confirm",
+    http: { method: "POST", path: "/nodes/{id}/reboot" },
+    cli: {
+        command: ["admin", "nodes", "hard-reset"],
+        vnext: adminLifecycleHelp(["admin", "nodes", "hard-reset"], "Erase local tenant data and hard reset one exact live machine.", "ornn admin nodes hard-reset <node-ref> --erase-local-data [--yes] [--no-wait] [--timeout SECONDS]", "Unsupported: hard reset requires an eligible human terminal.", "Node and live-machine identities, operator, facility, capacity assignment, erased local data, and restored keys."),
+    },
+    mcp: false,
+    slack: false,
+    input: hardResetInput,
+    execute: (ctx, input) => reboot(ctx, input, "hard_reset"),
+});
+export const adminNodeSuspendManagementCapability = defineCapability({
+    id: "nodes.suspend_management",
+    domain: "fleet",
+    roles: ["admin"],
+    description: "Suspend Ornn management while leaving the exact host powered on.",
+    mutation: "preview-confirm",
+    http: { method: "POST", path: "/internal/nodes/{id}/off-grid" },
+    cli: {
+        command: ["admin", "nodes", "suspend-management"],
+        vnext: adminLifecycleHelp(["admin", "nodes", "suspend-management"], "Remove Ornn management and managed access from one powered-on node.", "ornn admin nodes suspend-management <node-ref> [--reason TEXT] [--yes] [--no-wait]", "ornn admin nodes suspend-management <node-id> --yes --idempotency-key KEY --format json", "Node, operator, facility, capacity assignment, management removal, and managed-access loss."),
+    },
+    mcp: false,
+    slack: false,
+    input: managementInput,
+    execute: async (ctx, input) => {
+        const parsed = managementInput.parse(input);
+        const id = nodeId(parsed);
+        const body = {
+            ...(parsed.idempotency_key ? { request_id: parsed.idempotency_key } : {}),
+            ...(parsed.reason ? { reason: parsed.reason } : {}),
+        };
+        if (!ctx.confirmed)
+            return preview("nodes.suspend_management", { node_id: id, ...body });
+        return ctx.fetch(`/internal/nodes/${encodeURIComponent(id)}/off-grid`, {
+            method: "POST",
+            body,
+            headers: requestHeaders(parsed.idempotency_key),
+        });
+    },
+});
+export const adminNodeResumeManagementCapability = defineCapability({
+    id: "nodes.resume_management",
+    domain: "fleet",
+    roles: ["admin"],
+    description: "Resume Ornn management for one exact off-grid node.",
+    mutation: "preview-confirm",
+    http: { method: "POST", path: "/internal/nodes/{id}/on-grid" },
+    cli: {
+        command: ["admin", "nodes", "resume-management"],
+        vnext: adminLifecycleHelp(["admin", "nodes", "resume-management"], "Restore Ornn management and managed access on one off-grid node.", "ornn admin nodes resume-management <node-ref> [--yes] [--no-wait]", "ornn admin nodes resume-management <node-id> --yes --idempotency-key KEY --format json", "Node, operator, facility, capacity assignment, remote re-enrollment, and restored managed access."),
+    },
+    mcp: false,
+    slack: false,
+    input: managementInput,
+    execute: async (ctx, input) => {
+        const parsed = managementInput.parse(input);
+        const id = nodeId(parsed);
+        if (!ctx.confirmed)
+            return preview("nodes.resume_management", { node_id: id });
+        return ctx.fetch(`/internal/nodes/${encodeURIComponent(id)}/on-grid`, {
+            method: "POST",
+            body: {
+                ...(parsed.idempotency_key ? { request_id: parsed.idempotency_key } : {}),
+            },
+            headers: requestHeaders(parsed.idempotency_key),
+        });
+    },
+});
+export const adminNodeTerminateCapability = defineCapability({
+    id: "nodes.terminate",
+    domain: "fleet",
+    roles: ["admin"],
+    description: "Delete one exact node record with explicit cleanup scope and consequence review.",
+    mutation: "preview-confirm",
+    http: { method: "POST", path: "/internal/nodes/{id}/terminate" },
+    cli: {
+        command: ["admin", "nodes", "terminate"],
+        vnext: adminLifecycleHelp(["admin", "nodes", "terminate"], "End managed access and permanently delete one exact node record.", "ornn admin nodes terminate <node-ref> --delete-node-record [--skip-cleanup] [--reason TEXT] [--yes]", "ornn admin nodes terminate <node-id> --delete-node-record --yes --idempotency-key KEY --format json", "Node, operator, facility, reservation/capacity, host cleanup, node-record deletion, and access loss."),
+    },
+    mcp: false,
+    slack: false,
+    input: terminationInput,
+    execute: async (ctx, input) => {
+        const parsed = terminationInput.parse(input);
+        const id = nodeId(parsed);
+        const body = {
+            force: parsed.skip_cleanup === true,
+            ...(parsed.idempotency_key ? { request_id: parsed.idempotency_key } : {}),
+            ...(parsed.reason ? { reason: parsed.reason } : {}),
+        };
+        if (!ctx.confirmed)
+            return preview("nodes.terminate", { node_id: id, ...body });
+        return ctx.fetch(`/internal/nodes/${encodeURIComponent(id)}/terminate`, {
+            method: "POST",
+            body,
+            headers: requestHeaders(parsed.idempotency_key),
+        });
+    },
+});
+export const adminNodeAssignCapability = defineCapability({
+    id: "nodes.assign",
+    domain: "fleet",
+    roles: ["admin"],
+    description: "Assign one exact node to one exact capacity reservation after consequence review.",
+    mutation: "preview-confirm",
+    http: { method: "POST", path: "/internal/nodes/{id}/assign" },
+    cli: {
+        command: ["admin", "nodes", "assign"],
+        vnext: adminLifecycleHelp(["admin", "nodes", "assign"], "Assign one exact node to one exact capacity reservation.", "ornn admin nodes assign <node-ref> --reservation <reservation-id> [--yes] [--no-wait]", "ornn admin nodes assign <node-id> --reservation <reservation-id> --yes --idempotency-key KEY --format json", "Node, operator, facility, previous and requested capacity assignments, and tenant access change."),
+    },
+    mcp: false,
+    slack: false,
+    input: assignmentInput,
+    execute: async (ctx, input) => {
+        const parsed = assignmentInput.parse(input);
+        const id = nodeId(parsed);
+        const body = {
+            reservation_id: parsed.reservation_id,
+            ...(parsed.idempotency_key ? { request_id: parsed.idempotency_key } : {}),
+        };
+        if (!ctx.confirmed)
+            return preview("nodes.assign", { node_id: id, ...body });
+        return ctx.fetch(`/internal/nodes/${encodeURIComponent(id)}/assign`, {
+            method: "POST",
+            body,
+            headers: requestHeaders(parsed.idempotency_key),
+        });
+    },
+});
+export const adminNodeLifecycleCapabilities = [
+    adminNodeRebootCapability,
+    adminNodeHardResetCapability,
+    adminNodeSuspendManagementCapability,
+    adminNodeResumeManagementCapability,
+    adminNodeTerminateCapability,
+    adminNodeAssignCapability,
+];