@ornncompute/cli 0.2.24 → 1.0.25

package/vendor/capabilities/capabilities/external-buckets.js

@@ -0,0 +1,191 @@
+import { z } from "zod";
+import { defineCapability, } from "../capability.js";
+const pageInput = z
+    .object({
+    $positionals: z.array(z.string()).optional(),
+    cursor: z.string().optional(),
+    limit: z.union([z.string(), z.number()]).optional(),
+})
+    .strict();
+const showInput = z
+    .object({
+    $positionals: z.array(z.string()).optional(),
+})
+    .strict();
+const verificationInput = z
+    .object({
+    $positionals: z.array(z.string()).optional(),
+    idempotencyKey: z.string().optional(),
+})
+    .strict();
+const disconnectInput = z
+    .object({
+    $positionals: z.array(z.string()).optional(),
+    idempotencyKey: z.string().optional(),
+    yes: z.boolean().optional(),
+})
+    .strict();
+const connectInput = z
+    .object({
+    $positionals: z.array(z.string()).optional(),
+    accessKeyId: z.string().optional(),
+    accountId: z.string().optional(),
+    bucket: z.string().optional(),
+    endpointUrl: z.string().optional(),
+    idempotencyKey: z.string().optional(),
+    name: z.string().optional(),
+    prefix: z.string().optional(),
+    readOnly: z.boolean().optional(),
+    readWrite: z.boolean().optional(),
+    region: z.string().optional(),
+    secretAccessKeyFile: z.string().optional(),
+    url: z.string().optional(),
+    yes: z.boolean().optional(),
+})
+    .strict();
+const credentialInput = z
+    .object({
+    $positionals: z.array(z.string()).optional(),
+    accessKeyId: z.string().optional(),
+    idempotencyKey: z.string().optional(),
+    secretAccessKeyFile: z.string().optional(),
+    yes: z.boolean().optional(),
+})
+    .strict();
+const importInput = z
+    .object({
+    $positionals: z.array(z.string()).optional(),
+    idempotencyKey: z.string().optional(),
+    noWait: z.boolean().optional(),
+    reservation: z.string().optional(),
+    timeout: z.string().optional(),
+    wait: z.boolean().optional(),
+    yes: z.boolean().optional(),
+})
+    .strict();
+function externalBucketExecutor(context) {
+    const interaction = context.cli?.interaction;
+    if (!interaction?.externalBuckets) {
+        throw new Error("This capability must execute through the Ornn CLI external-bucket runtime.");
+    }
+    return interaction.externalBuckets.bind(interaction);
+}
+function externalBucketCapability({ acceptedReferences = [], automation, command, description, human, id, input, mutation, outcome, related = [], resumableStates = [], review, }) {
+    return defineCapability({
+        id,
+        domain: "storage",
+        roles: ["user"],
+        description,
+        mutation,
+        input,
+        cli: {
+            command,
+            vnext: {
+                arguments: "semantic",
+                audience: "customer",
+                category: "resource",
+                outcome,
+                human,
+                automation,
+                acceptedReferences,
+                related,
+                resumableStates,
+                ...(review ? { review } : {}),
+            },
+        },
+        mcp: false,
+        slack: false,
+        execute: async (context, commandInput) => externalBucketExecutor(context)(id, commandInput),
+    });
+}
+const gcsImportGuidance = "GCS requires bucket-level read access for Ornn's Storage Transfer service agent, granted with gcloud. CLI 1.x GCS imports are currently blocked by unavailable source verification. Setup and version-specific steps: https://docs.ornn.com/cli#gcs-imports-and-storage-transfer-service";
+export const externalBucketCapabilities = [
+    externalBucketCapability({
+        id: "storage.external-buckets.list",
+        command: ["external-buckets", "list"],
+        description: "List connected GCS, S3, and R2 buckets in one bounded page.",
+        mutation: "read",
+        input: pageInput,
+        outcome: "List external bucket connections without exposing stored credentials.",
+        human: "ornn external-buckets list [--limit <1-100>] [--cursor <cursor>]",
+        automation: "ornn external-buckets list --limit 50 --format json",
+        related: ["external-buckets show", "external-buckets connect"],
+    }),
+    externalBucketCapability({
+        id: "storage.external-buckets.show",
+        command: ["external-buckets", "show"],
+        description: "Inspect one connected external bucket by canonical ID or exact unique name.",
+        mutation: "read",
+        input: showInput,
+        outcome: "Inspect one credential-safe external bucket connection.",
+        human: "ornn external-buckets show <external-bucket>",
+        automation: "ornn external-buckets show <external-bucket-id> --format json",
+        acceptedReferences: ["canonical external bucket ID", "exact unique external bucket name"],
+        related: ["external-buckets verify", "external-buckets import"],
+    }),
+    externalBucketCapability({
+        id: "storage.external-buckets.connect",
+        command: ["external-buckets", "connect"],
+        description: "Connect a typed GCS, AWS S3, or Cloudflare R2 source without verifying it implicitly.",
+        mutation: "preview-confirm",
+        input: connectInput,
+        outcome: "Create or rediscover one external bucket connection with verification kept separate.",
+        human: "ornn external-buckets connect <gcs|s3|r2> --bucket <bucket> [--name <name>] [--prefix <prefix>] [--region <region>] [--account-id <id>|--endpoint-url <url>] [--access-key-id <id> --secret-access-key-file <path>] [--read-only|--read-write]",
+        automation: "ornn external-buckets connect <gcs|s3|r2> --bucket <bucket> <provider-inputs> --yes --idempotency-key <key> --format json",
+        review: `Review the exact source, access mode, and credential presence before connecting it. ${gcsImportGuidance}`,
+        related: ["external-buckets verify", "external-buckets import"],
+    }),
+    externalBucketCapability({
+        id: "storage.external-buckets.update-credentials",
+        command: ["external-buckets", "update-credentials"],
+        description: "Replace scoped S3 or R2 credentials without returning credential bytes.",
+        mutation: "preview-confirm",
+        input: credentialInput,
+        outcome: "Update one connection's credentials and require a separate verification.",
+        human: "ornn external-buckets update-credentials <external-bucket> --access-key-id <id> --secret-access-key-file <path>",
+        automation: "ornn external-buckets update-credentials <external-bucket-id> --access-key-id <id> --secret-access-key-file <path> --yes --idempotency-key <key> --format json",
+        acceptedReferences: ["canonical external bucket ID", "exact unique external bucket name"],
+        review: "Credential changes invalidate the prior verification and require renewed review.",
+        related: ["external-buckets verify"],
+    }),
+    externalBucketCapability({
+        id: "storage.external-buckets.verify",
+        command: ["external-buckets", "verify"],
+        description: "Verify current S3 or R2 source access as a separate operation.",
+        mutation: "preview-confirm",
+        input: verificationInput,
+        outcome: "Record current source-access verification without exposing credential material.",
+        human: "ornn external-buckets verify <external-bucket>",
+        automation: "ornn external-buckets verify <external-bucket-id> --idempotency-key <key> --format json",
+        acceptedReferences: ["canonical external bucket ID", "exact unique external bucket name"],
+        review: gcsImportGuidance,
+        related: ["external-buckets import", "external-buckets update-credentials"],
+    }),
+    externalBucketCapability({
+        id: "storage.external-buckets.import",
+        command: ["external-buckets", "import"],
+        description: "Import a verified GCS or S3 source into its isolated managed working volume.",
+        mutation: "preview-confirm",
+        input: importInput,
+        outcome: "Create or replay exactly one managed working copy with source writeback disabled.",
+        human: "ornn external-buckets import <gcs|s3|r2> <external-bucket> --reservation <canonical-reservation-id> [--no-wait] [--timeout <duration>]",
+        automation: "ornn external-buckets import <gcs|s3> <external-bucket-id> --reservation <canonical-reservation-id> --yes --idempotency-key <key> [--wait --timeout <duration>] --format json",
+        acceptedReferences: ["canonical external bucket ID", "exact unique external bucket name"],
+        review: `Review the isolated destination and explicit no-writeback guarantee before importing. ${gcsImportGuidance}`,
+        resumableStates: ["pending", "working", "partial", "failed", "interrupted"],
+        related: ["external-buckets show", "storage status", "volumes files list"],
+    }),
+    externalBucketCapability({
+        id: "storage.external-buckets.disconnect",
+        command: ["external-buckets", "disconnect"],
+        description: "Disconnect an external bucket record after its working volume is detached.",
+        mutation: "preview-confirm",
+        input: disconnectInput,
+        outcome: "Remove one external source connection without writing to its source bucket.",
+        human: "ornn external-buckets disconnect <external-bucket>",
+        automation: "ornn external-buckets disconnect <external-bucket-id> --yes --idempotency-key <key> --format json",
+        acceptedReferences: ["canonical external bucket ID", "exact unique external bucket name"],
+        review: "Disconnecting reduces access to the source and is blocked while mounts remain.",
+        related: ["storage detach", "external-buckets show"],
+    }),
+];

package/vendor/capabilities/capabilities/fleet.js

@@ -21,6 +21,9 @@ const nodesInput = z.object({
     facilityId: z.string().optional(),
     status: z.string().optional(),
     email: z.string().optional(),
+    cursor: z.string().optional(),
+    max: z.number().int().positive().max(5000).optional(),
+    limit: z.number().int().positive().max(5000).optional(),
 });
 const nodeLifecycleInput = z.object({
     node_id: z.string().min(1),
@@ -42,7 +45,7 @@ function nodeIdOf(input) {
 export const listOperatorsCapability = defineCapability({
     id: "operator.list",
     domain: "fleet",
-    roles: ["reviewer", "admin"],
+    roles: ["admin"],
     description: "List GPU operators (id, slug, display name, status). Resolve operator names with this before nodes.list.",
     mutation: "read",
     http: { method: "GET", path: "/provisioning/operators" },
@@ -53,7 +56,7 @@ export const listOperatorsCapability = defineCapability({
 export const listFacilitiesCapability = defineCapability({
     id: "facilities.list",
     domain: "fleet",
-    roles: ["reviewer", "admin"],
+    roles: ["admin"],
     description: "List facilities (id, display name, region, operator). Optional operator_id filter. Resolve facility names with this before nodes.list.",
     mutation: "read",
     http: { method: "GET", path: "/provisioning/facilities" },
@@ -76,8 +79,8 @@ export const listFacilitiesCapability = defineCapability({
 export const listNodesCapability = defineCapability({
     id: "nodes.list",
     domain: "fleet",
-    roles: ["user", "reviewer", "admin"],
-    description: "List nodes. Users see their own reserved machines. Reviewers and admins see enrolled, ghost, and off-grid nodes. Call with no filters for the whole fleet. Optional email lists nodes for that user's organizations. Optional operator_id, facility_id, and status (ghost, off-grid, bare-metal) narrow the same list. Never invent nodes. Never print private keys.",
+    roles: ["user", "admin"],
+    description: "List nodes. Users see their own reserved machines. Admins see enrolled, ghost, and off-grid nodes. Call with no filters for the whole fleet. Optional email lists nodes for that user's organizations. Optional operator_id, facility_id, and status (ghost, off-grid, bare-metal) narrow the same list. Paginate large fleets with cursor + max: pass the response's next_cursor back as cursor to fetch the next page; next_cursor is omitted once the page is not full. Never invent nodes. Never print private keys.",
     mutation: "read",
     http: { method: "GET", path: "/nodes" },
     slack: {
@@ -98,20 +101,33 @@ export const listNodesCapability = defineCapability({
                     enum: ["ghost", "off-grid", "bare-metal"],
                     description: "Optional orchestrator status filter. Default is all statuses.",
                 },
+                cursor: {
+                    type: "string",
+                    description: "Optional. Pass the previous response's next_cursor to fetch the next page.",
+                },
+                max: {
+                    type: "integer",
+                    description: "Optional page size (1-5000). Orchestrator default is 500.",
+                },
             },
         },
     },
     input: nodesInput,
     execute: async (ctx, input) => {
         const parsed = nodesInput.parse(input);
+        const pagination = {
+            cursor: parsed.cursor,
+            limit: parsed.max != null || parsed.limit != null ? String(parsed.max ?? parsed.limit) : undefined,
+        };
         if (ctx.role === "user") {
-            return ctx.fetch("/nodes", { method: "GET" });
+            return ctx.fetch(queryPath("/nodes", pagination), { method: "GET" });
         }
         return ctx.fetch(queryPath("/nodes", {
             operator_id: parsed.operator_id ?? parsed.operatorId ?? parsed.operator,
             facility_id: parsed.facility_id ?? parsed.facilityId,
             status: parsed.status,
             email: parsed.email,
+            ...pagination,
         }), { method: "GET" });
     },
 });

package/vendor/capabilities/capabilities/identity.js

@@ -1,10 +1,103 @@
 import { z } from "zod";
 import { defineCapability } from "../capability.js";
 const emptyInput = z.object({});
+const contextInput = z.object({ organization: z.string().min(1).optional() });
+const loginInput = z.object({
+    authBase: z.string().min(1).optional(),
+    noBrowser: z.boolean().optional(),
+    organization: z.string().min(1).optional(),
+    pollInterval: z.number().positive().optional(),
+    timeout: z.number().positive().optional(),
+});
+function executeSession(context, command, input) {
+    if (!context.cli?.session) {
+        throw new Error("This capability must execute through the Ornn CLI session runtime.");
+    }
+    return context.cli.session(command, input);
+}
+export const loginCapability = defineCapability({
+    id: "identity.login",
+    domain: "identity",
+    roles: ["user"],
+    description: "Authenticate the CLI with Ornn device authorization.",
+    mutation: "local",
+    http: { method: "POST", path: "/v1/cli/device/start" },
+    input: loginInput,
+    cli: {
+        command: ["login"],
+        vnext: {
+            audience: "customer",
+            category: "session",
+            arguments: "semantic",
+            outcome: "Authenticate in a browser and return to the terminal.",
+            human: "ornn login [--organization <exact-name>] [--no-browser] [--timeout <seconds>]",
+            automation: "ornn login --format json",
+            resumableStates: ["browser authorization"],
+            related: ["context", "logout"],
+            order: 1,
+        },
+    },
+    mcp: false,
+    slack: false,
+    execute: async (context, input) => executeSession(context, "login", input),
+});
+export const contextCapability = defineCapability({
+    id: "identity.context",
+    domain: "identity",
+    roles: ["user"],
+    description: "Show and select the current server-verified organization context.",
+    mutation: "read",
+    http: { method: "GET", path: "/v1/cli/session" },
+    input: contextInput,
+    cli: {
+        command: ["context"],
+        vnext: {
+            audience: "customer",
+            category: "session",
+            arguments: "semantic",
+            outcome: "Show the current user, selected organization, approval, and available organizations.",
+            human: "ornn context [--organization <exact-name-or-id>]",
+            automation: "ornn context --organization <canonical-id> --format json",
+            acceptedReferences: [
+                "exact organization name (human)",
+                "canonical organization ID (automation)",
+            ],
+            related: ["login", "logout"],
+            order: 2,
+        },
+    },
+    mcp: false,
+    slack: false,
+    execute: async (context, input) => executeSession(context, "context", input),
+});
+export const logoutCapability = defineCapability({
+    id: "identity.logout",
+    domain: "identity",
+    roles: ["user"],
+    description: "Revoke the remote CLI session and clear its local bearer.",
+    mutation: "local",
+    http: { method: "DELETE", path: "/v1/cli/session" },
+    input: emptyInput,
+    cli: {
+        command: ["logout"],
+        vnext: {
+            audience: "customer",
+            category: "session",
+            outcome: "End the remote session and always remove the local bearer.",
+            human: "ornn logout",
+            automation: "ornn logout --format json",
+            related: ["login", "context"],
+            order: 3,
+        },
+    },
+    mcp: false,
+    slack: false,
+    execute: async (context, input) => executeSession(context, "logout", input),
+});
 export const whoamiCapability = defineCapability({
     id: "identity.whoami",
     domain: "identity",
-    roles: ["user", "reviewer", "admin"],
+    roles: ["user", "admin"],
     description: "Show the signed-in Ornn user and organization.",
     mutation: "read",
     http: { method: "GET", path: "/v1/cli/session" },
@@ -14,11 +107,29 @@ export const whoamiCapability = defineCapability({
 export const statusCapability = defineCapability({
     id: "identity.status",
     domain: "identity",
-    roles: ["user", "reviewer", "admin"],
+    roles: ["user", "admin"],
     description: "Show Ornn platform status.",
     mutation: "read",
     http: { method: "GET", path: "/v1/cli/status" },
     input: emptyInput,
     execute: async (ctx) => ctx.fetch("/v1/cli/status", { method: "GET" }),
+    cli: {
+        command: ["status"],
+        vnext: {
+            audience: "customer",
+            category: "platform",
+            outcome: "Check current Ornn platform availability.",
+            human: "ornn status",
+            automation: "ornn status --format json",
+            related: ["version", "resources"],
+            order: 10,
+        },
+    },
 });
-export const identityCapabilities = [whoamiCapability, statusCapability];
+export const identityCapabilities = [
+    whoamiCapability,
+    loginCapability,
+    contextCapability,
+    logoutCapability,
+    statusCapability,
+];

package/vendor/capabilities/capabilities/listings.js

@@ -1,6 +1,7 @@
 import { z } from "zod";
 import { defineCapability, preview } from "../capability.js";
 import { bindHardwareFields, HARDWARE_LISTING_FIELDS, HARDWARE_LISTING_FILTERS, loadHardwareCatalog, projectCatalogTerms, } from "../spec-catalog.js";
+import { capacityOfferForecastVnext, executeCapacityOfferForecast } from "./capacity-offers.js";
 function queryPath(path, params) {
     const parts = [];
     for (const [key, value] of Object.entries(params)) {
@@ -54,8 +55,9 @@ export const listingCreateInput = z.object({
     confirm: z.boolean().optional(),
 });
 const catalogTermsInput = z.object({ kind: z.enum(["gpu", "cpu", "node", "link"]).optional() });
-const listingForecastInput = z.object({
-    limit: z.number().int().min(1).max(500).optional(),
+export const listingForecastInput = z.object({
+    $positionals: z.array(z.string()).max(0).default([]),
+    limit: z.coerce.number().int().min(1).max(500).optional(),
     cursor: z.string().min(1).optional(),
 });
 const slackListingCreateParams = {
@@ -84,10 +86,10 @@ const slackListingCreateParams = {
 export const listCatalogTermsCapability = defineCapability({
     id: "listings.catalog_terms",
     domain: "listings",
-    roles: ["reviewer", "admin"],
+    roles: ["admin"],
     description: "Dump the orchestrator hardware dictionary (display name + aliases). Call once and pick from it. Hardware fields on listings must match a term. Optional kind filter: gpu, cpu, node, or link.",
     mutation: "read",
-    http: { method: "GET", path: "/v1/orchestrator/catalog" },
+    http: { method: "GET", path: "/v1/orchestrator/catalog/hardware" },
     slack: {
         parameters: {
             type: "object",
@@ -106,7 +108,7 @@ export const listCatalogTermsCapability = defineCapability({
 export const listListingsCapability = defineCapability({
     id: "listings.available",
     domain: "listings",
-    roles: ["reviewer", "admin"],
+    roles: ["user", "admin"],
     description: "List currently available marketplace listings. GPU, CPU, and fabric filters must be orchestrator catalog display names, canonicals, or aliases — not raw slang or spec-sheet text. Site may be a facility nickname. Returns spec-shaped JSON plus public reserve/OG/PDF URLs. Filters combine as AND. Date filters are inclusive YYYY-MM-DD.",
     mutation: "read",
     slack: {
@@ -154,10 +156,16 @@ export const forecastListingsCapability = defineCapability({
     description: "List the next 48 hourly availability buckets for customer-visible compute listings.",
     mutation: "read",
     http: { method: "GET", path: "/v1/workflows/commerce/listings/forecast" },
+    cli: {
+        command: ["capacity-offers", "forecast"],
+        vnext: capacityOfferForecastVnext,
+    },
     slack: false,
     input: listingForecastInput,
     execute: async (ctx, input) => {
         const parsed = listingForecastInput.parse(input);
+        if (ctx.cli?.interaction)
+            return executeCapacityOfferForecast(ctx, parsed);
         return ctx.fetch(queryPath("/v1/workflows/commerce/listings/forecast", {
             limit: parsed.limit?.toString(),
             cursor: parsed.cursor,
@@ -199,7 +207,7 @@ const LISTING_CREATE_INPUT_ONLY_KEYS = [
 export const createListingCapability = defineCapability({
     id: "listings.create",
     domain: "listings",
-    roles: ["reviewer", "admin"],
+    roles: ["admin"],
     description: "Create a marketplace listing. gpu_type, cpu, node_model, and fabric_type must exact-match an orchestrator catalog display name, canonical, or alias. CLI asks y/N. Slack never POSTs until a human replies confirm. MCP creates on this tool call.",
     mutation: "preview-confirm",
     http: { method: "POST", path: "/inventory" },
@@ -349,5 +357,3 @@ export const listingCapabilities = [
     forecastListingsCapability,
     createListingCapability,
 ];
-/** @deprecated Use createListingCapability. */
-export const proposeListingCapability = createListingCapability;

package/vendor/capabilities/capabilities/mounts.js

@@ -0,0 +1,176 @@
+import { z } from "zod";
+import { defineCapability, } from "../capability.js";
+const mountInput = z
+    .object({
+    $positionals: z.array(z.string()).default([]),
+    access: z.string().optional(),
+    capacityGib: z.union([z.string(), z.number()]).optional(),
+    cursor: z.string().optional(),
+    idempotencyKey: z.string().optional(),
+    limit: z.union([z.string(), z.number()]).optional(),
+    noWait: z.boolean().optional(),
+    performanceTier: z.string().optional(),
+    timeout: z.string().optional(),
+    volume: z.string().optional(),
+    wait: z.boolean().optional(),
+    yes: z.boolean().optional(),
+})
+    .strict();
+function mountExecutor(context) {
+    const interaction = context.cli?.interaction;
+    if (!interaction?.mounts) {
+        throw new Error("This capability must execute through the Ornn CLI mount runtime.");
+    }
+    return interaction.mounts.bind(interaction);
+}
+function mountCapability({ acceptedReferences = [], automation, command, description, human, id, mutation, order, outcome, related = [], resumableStates = [], review, }) {
+    return defineCapability({
+        id,
+        domain: "storage",
+        roles: ["user"],
+        description,
+        mutation,
+        input: mountInput,
+        cli: {
+            command,
+            vnext: {
+                arguments: "semantic",
+                audience: "customer",
+                category: "resource",
+                order,
+                outcome,
+                human,
+                automation,
+                acceptedReferences,
+                related,
+                resumableStates,
+                ...(review ? { review } : {}),
+            },
+        },
+        mcp: false,
+        slack: false,
+        execute: async (context, input) => mountExecutor(context)(id, input),
+    });
+}
+export const mountCapabilities = [
+    mountCapability({
+        id: "storage.volume-mounts.candidates",
+        command: ["volume-mounts", "candidates"],
+        description: "List capacity reservations eligible for a managed-volume mount.",
+        mutation: "read",
+        order: 540,
+        outcome: "List one bounded page of safe Bare Metal volume-mount candidates.",
+        human: "ornn volume-mounts candidates [--limit <1-500>] [--cursor <cursor>]",
+        automation: "ornn volume-mounts candidates --limit 50 --format json",
+        related: ["volume-mounts attach", "volumes list"],
+    }),
+    mountCapability({
+        id: "storage.volume-mounts.show",
+        command: ["volume-mounts", "show"],
+        description: "Show one reservation's exact managed-volume relationship and per-machine readiness.",
+        mutation: "read",
+        order: 541,
+        outcome: "Show actual per-machine mount state without rewriting volume lifecycle.",
+        human: "ornn volume-mounts show <canonical-reservation-id>",
+        automation: "ornn volume-mounts show <canonical-reservation-id> --format json",
+        acceptedReferences: ["canonical capacity-reservation ID"],
+        related: ["volume-mounts wait", "volumes show"],
+    }),
+    mountCapability({
+        id: "storage.volume-mounts.attach",
+        command: ["volume-mounts", "attach"],
+        description: "Attach one exact managed volume to every machine in one exact capacity reservation.",
+        mutation: "preview-confirm",
+        order: 542,
+        outcome: "Reconcile one exact volume-mount goal and preserve per-machine readiness.",
+        human: "ornn volume-mounts attach <canonical-reservation-id> --volume <exact-name-or-id> --access read-only|read-write [--no-wait]",
+        automation: "ornn volume-mounts attach <canonical-reservation-id> --volume <canonical-volume-id> --access read-only|read-write --yes --idempotency-key <key> --format json",
+        acceptedReferences: [
+            "canonical capacity-reservation ID",
+            "canonical or exact unique managed-volume reference",
+        ],
+        review: "Review the exact capacity reservation, volume, and access mode.",
+        resumableStates: ["accepted", "partial", "ready"],
+        related: ["volume-mounts wait", "volume-mounts detach"],
+    }),
+    mountCapability({
+        id: "storage.volume-mounts.wait",
+        command: ["volume-mounts", "wait"],
+        description: "Wait locally for every requested machine mount to reach a durable terminal state.",
+        mutation: "read",
+        order: 543,
+        outcome: "Wait with a bounded deadline while preserving useful per-machine partial data.",
+        human: "ornn volume-mounts wait <canonical-reservation-id> [--timeout <duration>]",
+        automation: "ornn volume-mounts wait <canonical-reservation-id> --timeout <duration> --format json",
+        acceptedReferences: ["canonical capacity-reservation ID"],
+        resumableStates: ["partial", "ready"],
+        related: ["volume-mounts show", "volume-mounts detach"],
+    }),
+    mountCapability({
+        id: "storage.volume-mounts.detach",
+        command: ["volume-mounts", "detach"],
+        description: "Detach one exact reservation relationship without deleting its volume.",
+        mutation: "preview-confirm",
+        order: 544,
+        outcome: "Reconcile an exact detached goal and preserve the underlying volume.",
+        human: "ornn volume-mounts detach <canonical-reservation-id>",
+        automation: "ornn volume-mounts detach <canonical-reservation-id> --yes --idempotency-key <key> --format json",
+        acceptedReferences: ["canonical capacity-reservation ID"],
+        review: "Review the exact relationship and access loss; the managed volume remains.",
+        resumableStates: ["detaching", "ended"],
+        related: ["volumes show", "private-networks list"],
+    }),
+    mountCapability({
+        id: "storage.filesystems.deploy",
+        command: ["filesystems", "deploy"],
+        description: "Deploy one managed filesystem for an exact capacity reservation.",
+        mutation: "preview-confirm",
+        order: 550,
+        outcome: "Create or rediscover one filesystem deployment and expose every machine mount.",
+        human: "ornn filesystems deploy <canonical-reservation-id> --performance-tier <tier> --capacity-gib <gib> [--no-wait]",
+        automation: "ornn filesystems deploy <canonical-reservation-id> --performance-tier <tier> --capacity-gib <gib> --yes --idempotency-key <key> --format json",
+        acceptedReferences: ["canonical capacity-reservation ID"],
+        review: "Review the exact reservation, performance tier, capacity, and managed filesystem consequence.",
+        resumableStates: ["accepted", "partial", "ready"],
+        related: ["filesystems wait", "filesystems delete"],
+    }),
+    mountCapability({
+        id: "storage.filesystems.show",
+        command: ["filesystems", "show"],
+        description: "Summarize one filesystem deployment from its underlying per-machine mounts.",
+        mutation: "read",
+        order: 551,
+        outcome: "Show actual per-machine filesystem readiness without changing volume state.",
+        human: "ornn filesystems show <canonical-reservation-id>",
+        automation: "ornn filesystems show <canonical-reservation-id> --format json",
+        acceptedReferences: ["canonical capacity-reservation ID"],
+        related: ["filesystems wait", "volume-mounts show"],
+    }),
+    mountCapability({
+        id: "storage.filesystems.wait",
+        command: ["filesystems", "wait"],
+        description: "Wait locally for a filesystem deployment's per-machine mount goal.",
+        mutation: "read",
+        order: 552,
+        outcome: "Wait for every filesystem member while retaining partial member data.",
+        human: "ornn filesystems wait <canonical-reservation-id> [--timeout <duration>]",
+        automation: "ornn filesystems wait <canonical-reservation-id> --timeout <duration> --format json",
+        acceptedReferences: ["canonical capacity-reservation ID"],
+        resumableStates: ["partial", "ready"],
+        related: ["filesystems show", "filesystems delete"],
+    }),
+    mountCapability({
+        id: "storage.filesystems.delete",
+        command: ["filesystems", "delete"],
+        description: "Remove one filesystem deployment relationship without deleting its managed volume.",
+        mutation: "preview-confirm",
+        order: 553,
+        outcome: "Detach every filesystem member while preserving the underlying managed volume.",
+        human: "ornn filesystems delete <canonical-reservation-id>",
+        automation: "ornn filesystems delete <canonical-reservation-id> --yes --idempotency-key <key> --format json",
+        acceptedReferences: ["canonical capacity-reservation ID"],
+        review: "Review the exact deployment and access loss; its managed volume remains.",
+        resumableStates: ["detaching", "ended"],
+        related: ["volumes show", "filesystems deploy"],
+    }),
+];