@ornncompute/cli 0.2.24 → 1.0.25

package/vendor/capabilities/capabilities/observability.js

@@ -21,6 +21,7 @@ const latestInput = z.object({
     end: z.string().optional(),
     span: z.string().optional(),
     max_points: z.number().int().min(1).max(500).optional(),
+    metrics: z.string().optional(),
 });
 const logsLatestInput = z.object({
     node_id: z.string().min(1),
@@ -28,6 +29,7 @@ const logsLatestInput = z.object({
     stream: z.enum(["serial", "kernel"]).default("kernel"),
     count: z.number().int().min(1).max(1000).optional(),
     before: z.string().optional(),
+    start: z.string().optional(),
     cursor: z.string().optional(),
 });
 const tailInput = z.object({
@@ -57,8 +59,8 @@ function expandSpan(span, start, end) {
 export const telemetryLatestCapability = defineCapability({
     id: "telemetry.latest",
     domain: "observability",
-    roles: ["user", "reviewer", "admin"],
-    description: "One-shot telemetry window for one node (start/end or span plus max_points). Users may only query a reserved machine. Reviewers and admins may query any enrolled node. Pass a node UUID. Use this for heartbeat / last-seen / public_ip. Not a live stream.",
+    roles: ["user", "admin"],
+    description: "One-shot telemetry window for one node (start/end or span plus max_points). Users may only query a reserved machine. Admins may query any enrolled node. Pass a node UUID. Use this for heartbeat / last-seen / public_ip. Not a live stream.",
     mutation: "read",
     http: { method: "GET", path: "/v1/observability/nodes/{id}/telemetry/query" },
     slack: {
@@ -70,6 +72,7 @@ export const telemetryLatestCapability = defineCapability({
                 start: { type: "string" },
                 end: { type: "string" },
                 max_points: { type: "number", description: "Default 240, max 500." },
+                metrics: { type: "string", description: "Optional comma-separated metric names; omit for all stored metrics." },
             },
             required: ["node_id"],
         },
@@ -83,14 +86,15 @@ export const telemetryLatestCapability = defineCapability({
             start: range.start,
             end: range.end,
             max_points: String(parsed.max_points ?? 240),
+            metrics: parsed.metrics,
         }), { method: "GET" });
     },
 });
 export const logsLatestCapability = defineCapability({
     id: "logs.latest",
     domain: "observability",
-    roles: ["user", "reviewer", "admin"],
-    description: "One-shot newest kernel or serial log page (before + count + cursor). Users only on a reserved machine. Not a live tail. First call omits cursor; older pages pass next_cursor.",
+    roles: ["user", "admin"],
+    description: "Stored kernel or serial logs, all severities, newest first. Optional start/before bounds can query any retained history; default is the seven days before now. First call omits cursor; subsequent pages pass next_cursor with the same start/before. Users only on a reserved machine. Not a live tail.",
     mutation: "read",
     http: { method: "GET", path: "/v1/observability/nodes/{id}/logs/{stream}/query" },
     slack: {
@@ -100,7 +104,8 @@ export const logsLatestCapability = defineCapability({
                 node_id: { type: "string", description: "Node UUID from nodes.list." },
                 stream: { type: "string", enum: ["serial", "kernel"] },
                 count: { type: "number", description: "Page size. Default 200, max 1000." },
-                before: { type: "string", description: "RFC3339 upper bound. Default now." },
+                before: { type: "string", description: "RFC3339 upper bound. Default now. Keep fixed when paging." },
+                start: { type: "string", description: "RFC3339 lower bound. Default seven days before the upper bound." },
                 cursor: { type: "string", description: "next_cursor from the previous page." },
             },
             required: ["node_id"],
@@ -111,7 +116,7 @@ export const logsLatestCapability = defineCapability({
         const parsed = logsLatestInput.parse(input);
         const id = nodeId(parsed);
         const end = parsed.before?.trim() || new Date().toISOString();
-        const start = new Date(Date.parse(end) - 7 * 86_400_000).toISOString();
+        const start = parsed.start?.trim() || new Date(Date.parse(end) - 7 * 86_400_000).toISOString();
         return ctx.fetch(queryPath(`${nodePrefix(ctx.role, id)}/logs/${parsed.stream}/query`, {
             start,
             end,
@@ -121,10 +126,34 @@ export const logsLatestCapability = defineCapability({
         }), { method: "GET" });
     },
 });
+/** Full stored telemetry rows, including context fields omitted by numeric windows. */
+export const telemetrySnapshotCapability = defineCapability({
+    id: "telemetry.snapshot",
+    domain: "observability",
+    roles: ["admin"],
+    description: "Read the latest stored heartbeat with all staff-visible fields, including version, status, port context, and kernel-log coverage when stored. Works while the node is offline; check observed_at for staleness. limit=1 returns the latest row; larger limits only scan a bounded recent window, at most 24h. Use telemetry.latest for historical numeric windows.",
+    mutation: "read",
+    http: { method: "GET", path: "/v1/observability/nodes/{id}/telemetry/latest" },
+    mcp: false,
+    slack: {
+        parameters: {
+            type: "object",
+            properties: {
+                node_id: { type: "string", description: "Node UUID." },
+                limit: { type: "number", description: "Recent full heartbeat rows. Default 1, max 1000." },
+            },
+            required: ["node_id"],
+        },
+    },
+    input: z.object({ node_id: z.string().min(1), limit: z.number().int().min(1).max(1000).optional() }),
+    execute: async (ctx, input) => ctx.fetch(queryPath(`/v1/observability/nodes/${encodeURIComponent(input.node_id)}/telemetry/latest`, {
+        limit: String(input.limit ?? 1),
+    }), { method: "GET" }),
+});
 export const telemetryTailCapability = defineCapability({
     id: "telemetry.tail",
     domain: "observability",
-    roles: ["user", "reviewer", "admin"],
+    roles: ["user", "admin"],
     description: "Live telemetry follow on the same Observability subscribe feed the graphs use. Users only on a reserved machine. Slack and MCP attach for duration (default 20s) and return events. Not telemetry.latest.",
     mutation: "read",
     http: { method: "GET", path: "/v1/observability/nodes/{id}/telemetry/subscribe" },
@@ -154,7 +183,7 @@ export const telemetryTailCapability = defineCapability({
 export const logsTailCapability = defineCapability({
     id: "logs.tail",
     domain: "observability",
-    roles: ["user", "reviewer", "admin"],
+    roles: ["user", "admin"],
     description: "Live kernel or serial log follow on the same Observability subscribe feed LogViewer uses. Users only on a reserved machine. Slack and MCP attach for duration (default 20s). Not logs.latest.",
     mutation: "read",
     http: { method: "GET", path: "/v1/observability/nodes/{id}/logs/{stream}/subscribe" },
@@ -181,6 +210,7 @@ export const logsTailCapability = defineCapability({
     },
 });
 export const observabilityCapabilities = [
+    telemetrySnapshotCapability,
     telemetryLatestCapability,
     telemetryTailCapability,
     logsLatestCapability,

package/vendor/capabilities/capabilities/tokens.js

@@ -8,8 +8,7 @@ const tokenCreateInput = z.object({
     facilityId: optionalText,
     expires_in_seconds: z.number().int().positive().nullish(),
     expiresInSeconds: z.number().int().positive().nullish(),
-    node_mode: z.enum(["bare-metal", "virtual-machine", "vm"]).nullish(),
-    nodeMode: z.enum(["bare-metal", "virtual-machine", "vm"]).nullish(),
+    filter: z.string().nullish(),
     ip: optionalText,
     installer_base: optionalText,
     host: optionalText,
@@ -24,6 +23,10 @@ const emptyInput = z.object({});
 export function buildEnrollmentInstallCommand(options) {
     const base = (options.base ?? "https://api.ornn.com/v1/orchestrator").replace(/\/+$/, "");
     const params = [`token=${encodeURIComponent(options.token)}`];
+    if (options.facilityId)
+        params.push(`facility_id=${encodeURIComponent(options.facilityId)}`);
+    if (options.filter)
+        params.push(`filter=${encodeURIComponent(options.filter)}`);
     if (options.ip)
         params.push(`ip=${encodeURIComponent(options.ip)}`);
     if (options.restoreNodeId)
@@ -31,7 +34,10 @@ export function buildEnrollmentInstallCommand(options) {
     if (options.force)
         params.push("force=true");
     const href = `${base}/enrollment/install?${params.join("&")}`;
-    return `curl -fsSL '${href.replace(/'/g, "'\\''")}' | sudo bash`;
+    // Without pipefail, a failed curl (bad installer_base, network error, non-2xx
+    // response) pipes empty stdin into `sudo bash`, which then exits 0 having run
+    // nothing -- the caller sees exit_code: 0 for an install that never happened.
+    return `set -o pipefail; curl -fsSL '${href.replace(/'/g, "'\\''")}' | sudo bash`;
 }
 function tokenString(row, keys) {
     for (const key of keys) {
@@ -44,7 +50,7 @@ function tokenString(row, keys) {
 export const tokensListCapability = defineCapability({
     id: "tokens.list",
     domain: "fleet",
-    roles: ["reviewer", "admin"],
+    roles: ["admin"],
     description: "List issued enrollment tokens (id, operator, status, expiry). Does not return plaintext secrets.",
     mutation: "read",
     http: { method: "GET", path: "/enrollment-tokens" },
@@ -66,7 +72,10 @@ export const tokensCreateCapability = defineCapability({
                 operator_id: { type: "string", description: "Commerce operator UUID from operator.list." },
                 facility_id: { type: "string", description: "Optional facility UUID." },
                 expires_in_seconds: { type: "integer", description: "Token TTL in seconds." },
-                node_mode: { type: "string", enum: ["bare-metal", "virtual-machine"] },
+                filter: {
+                    type: "string",
+                    description: "Optional comma-separated enrollment compartment ids. Omit to run every step.",
+                },
                 ip: { type: "string", description: "Optional IP stamped into the installer URL." },
                 host: { type: "string", description: "SSH host/IP to enroll now." },
                 hosts: {
@@ -76,7 +85,10 @@ export const tokensCreateCapability = defineCapability({
                 },
                 username: { type: "string", description: "SSH user. Default admin." },
                 port: { type: "integer", description: "SSH port. Default 22." },
-                private_key: { type: "string", description: "PEM private key. Required to enroll over SSH." },
+                private_key: {
+                    type: "string",
+                    description: "PEM private key. Required to enroll over SSH.",
+                },
             },
             required: ["operator_id"],
         },
@@ -90,12 +102,11 @@ export const tokensCreateCapability = defineCapability({
             ...(parsed.hosts ?? []).map((host) => host.trim()).filter(Boolean),
         ];
         const privateKey = parsed.private_key?.trim() || parsed.privateKey?.trim() || "";
-        const nodeMode = parsed.node_mode ?? parsed.nodeMode;
         const payload = {
             operator_id: operatorId,
             facility_id: parsed.facility_id ?? parsed.facilityId,
             expires_in_seconds: parsed.expires_in_seconds ?? parsed.expiresInSeconds,
-            node_mode: nodeMode,
+            filter: parsed.filter,
             ip: parsed.ip,
             hosts,
             username: parsed.username?.trim() || "admin",
@@ -119,6 +130,7 @@ export const tokensCreateCapability = defineCapability({
                 token,
                 base: parsed.installer_base ?? undefined,
                 ip: parsed.ip ?? undefined,
+                filter: parsed.filter ?? undefined,
                 force: payload.remote,
             })
             : null;

package/vendor/capabilities/capabilities/volumes.js

@@ -0,0 +1,178 @@
+import { z } from "zod";
+import { defineCapability, } from "../capability.js";
+const storageCliInput = z
+    .object({
+    $positionals: z.array(z.string()).optional(),
+    contentType: z.string().optional(),
+    cursor: z.string().optional(),
+    idempotencyKey: z.string().optional(),
+    limit: z.union([z.string(), z.number()]).optional(),
+    name: z.string().optional(),
+    output: z.string().optional(),
+    overwrite: z.boolean().optional(),
+    path: z.string().optional(),
+    prefix: z.string().optional(),
+    source: z.string().optional(),
+    yes: z.boolean().optional(),
+})
+    .strict();
+function storageExecutor(context) {
+    const interaction = context.cli?.interaction;
+    if (!interaction?.storage) {
+        throw new Error("This capability must execute through the Ornn CLI storage runtime.");
+    }
+    return interaction.storage.bind(interaction);
+}
+function storageCapability({ id, command, description, mutation, outcome, human, automation, acceptedReferences = [], review, related = [], }) {
+    return defineCapability({
+        id,
+        domain: "storage",
+        roles: ["user"],
+        description,
+        mutation,
+        input: storageCliInput,
+        cli: {
+            command,
+            vnext: {
+                arguments: "semantic",
+                audience: "customer",
+                category: "resource",
+                outcome,
+                human,
+                automation,
+                acceptedReferences,
+                ...(review ? { review } : {}),
+                related,
+            },
+        },
+        mcp: false,
+        slack: false,
+        execute: async (context, input) => storageExecutor(context)(id, input),
+    });
+}
+export const volumeCapabilities = [
+    storageCapability({
+        id: "storage.volumes.list",
+        command: ["volumes", "list"],
+        description: "List managed volumes in one bounded page.",
+        mutation: "read",
+        outcome: "List durable managed volumes independently from their mounts.",
+        human: "ornn volumes list [--limit <1-100>] [--cursor <cursor>]",
+        automation: "ornn volumes list --limit 50 --format json",
+        related: ["volumes show", "volumes create"],
+    }),
+    storageCapability({
+        id: "storage.volumes.show",
+        command: ["volumes", "show"],
+        description: "Inspect one managed volume by canonical ID or exact unique name.",
+        mutation: "read",
+        outcome: "Inspect one durable volume without changing its lifecycle.",
+        human: "ornn volumes show <volume>",
+        automation: "ornn volumes show <volume-id> --format json",
+        acceptedReferences: ["canonical volume ID", "exact unique volume name"],
+        related: ["volumes files list", "volume-mounts show"],
+    }),
+    storageCapability({
+        id: "storage.volumes.create",
+        command: ["volumes", "create"],
+        description: "Create or rediscover a uniquely named managed volume.",
+        mutation: "preview-confirm",
+        outcome: "Create one durable volume or safely replay its normalized intent.",
+        human: "ornn volumes create --name <name> [--source <volume>] [--yes]",
+        automation: "ornn volumes create --name <name> [--source <volume-id>] --yes --idempotency-key <key> --format json",
+        acceptedReferences: ["canonical source volume ID", "exact unique source volume name"],
+        related: ["volumes show", "volumes files upload"],
+    }),
+    storageCapability({
+        id: "storage.volumes.refresh",
+        command: ["volumes", "refresh"],
+        description: "Refresh the owner-backed view of one managed volume.",
+        mutation: "read",
+        outcome: "Refresh and inspect the current durable volume state.",
+        human: "ornn volumes refresh <volume>",
+        automation: "ornn volumes refresh <volume-id> --format json",
+        acceptedReferences: ["canonical volume ID", "exact unique volume name"],
+        related: ["volumes show"],
+    }),
+    storageCapability({
+        id: "storage.volumes.clear",
+        command: ["volumes", "clear"],
+        description: "Erase every file in one volume after a live default-no confirmation.",
+        mutation: "preview-confirm",
+        outcome: "Permanently clear one volume only from a live interactive terminal.",
+        human: "ornn volumes clear <volume>",
+        automation: "Unsupported: this command requires a live interactive terminal.",
+        acceptedReferences: ["canonical volume ID", "exact unique volume name"],
+        review: "Every file and folder in the volume is permanently deleted.",
+        related: ["volumes files list", "volume-mounts detach"],
+    }),
+    storageCapability({
+        id: "storage.volumes.delete",
+        command: ["volumes", "delete"],
+        description: "Delete an explicitly selected, relationship-free managed volume.",
+        mutation: "preview-confirm",
+        outcome: "Delete one detached volume after explicit consent.",
+        human: "ornn volumes delete <volume>",
+        automation: "ornn volumes delete <volume-id> --yes --idempotency-key <key> --format json",
+        acceptedReferences: ["canonical volume ID", "exact unique volume name"],
+        review: "The volume and all of its data are permanently deleted.",
+        related: ["volume-mounts detach", "volumes show"],
+    }),
+    storageCapability({
+        id: "storage.volumes.files.list",
+        command: ["volumes", "files", "list"],
+        description: "List nested files in one volume in a bounded page.",
+        mutation: "read",
+        outcome: "List nested volume files by semantic remote path.",
+        human: "ornn volumes files list <volume> [--prefix <remote-path>] [--limit <1-500>] [--cursor <cursor>]",
+        automation: "ornn volumes files list <volume-id> --limit 50 --format json",
+        acceptedReferences: ["canonical volume ID", "exact unique volume name"],
+        related: ["volumes files upload", "volumes files download"],
+    }),
+    storageCapability({
+        id: "storage.volumes.files.upload",
+        command: ["volumes", "files", "upload"],
+        description: "Stage, upload, and finalize one local file at a nested volume path.",
+        mutation: "preview-confirm",
+        outcome: "Upload one file through a reconciled staged transfer.",
+        human: "ornn volumes files upload <volume> <local-file> [--path <remote-path>] [--content-type <type>] [--yes]",
+        automation: "ornn volumes files upload <volume-id> <local-file> --path <remote-path> --yes --idempotency-key <key> --format json",
+        acceptedReferences: ["canonical volume ID", "exact unique volume name"],
+        related: ["volumes files list", "volumes refresh"],
+    }),
+    storageCapability({
+        id: "storage.volumes.files.download",
+        command: ["volumes", "files", "download"],
+        description: "Download one nested volume file to an explicit local path atomically.",
+        mutation: "local",
+        outcome: "Download one file without partially replacing local data.",
+        human: "ornn volumes files download <volume> <remote-path> --output <local-path> [--overwrite]",
+        automation: "ornn volumes files download <volume-id> <remote-path> --output <local-path> --format json",
+        acceptedReferences: ["canonical volume ID", "exact unique volume name"],
+        related: ["volumes files list"],
+    }),
+    storageCapability({
+        id: "storage.volumes.files.delete",
+        command: ["volumes", "files", "delete"],
+        description: "Delete one nested file after a live default-no confirmation.",
+        mutation: "preview-confirm",
+        outcome: "Permanently delete one file only from a live interactive terminal.",
+        human: "ornn volumes files delete <volume> <remote-path>",
+        automation: "Unsupported: this command requires a live interactive terminal.",
+        acceptedReferences: ["canonical volume ID", "exact unique volume name"],
+        review: "The selected file is permanently deleted.",
+        related: ["volumes files list"],
+    }),
+    storageCapability({
+        id: "storage.volumes.folders.delete",
+        command: ["volumes", "folders", "delete"],
+        description: "Delete one nested folder after a live default-no confirmation.",
+        mutation: "preview-confirm",
+        outcome: "Permanently delete one folder tree only from a live interactive terminal.",
+        human: "ornn volumes folders delete <volume> <remote-path>",
+        automation: "Unsupported: this command requires a live interactive terminal.",
+        acceptedReferences: ["canonical volume ID", "exact unique volume name"],
+        review: "The selected folder and every nested file are permanently deleted.",
+        related: ["volumes files list"],
+    }),
+];

package/vendor/capabilities/capability.js

@@ -1,5 +1,6 @@
 import { namesFromId } from "./names.js";
 export const DOMAINS = [
+    "cli",
     "identity",
     "listings",
     "fleet",
@@ -29,19 +30,26 @@ export const DOMAINS = [
 export function preview(action, payload) {
     return { status: "preview", requiresConfirm: true, confirmed: false, action, payload };
 }
-/** Fill CLI/MCP/Slack names from `id`. Slack parameters stay optional. */
+/** CLI is opt-in; MCP and Slack retain derived names unless explicitly unbound. */
 export function defineCapability(spec) {
     const names = namesFromId(spec.id);
-    const { slack, ...rest } = spec;
+    const { cli, mcp, slack, ...rest } = spec;
     return {
         ...rest,
-        cli: { command: names.cli },
-        mcp: { name: names.mcp },
+        ...(cli !== false && cli !== undefined
+            ? {
+                cli: {
+                    command: cli.command ?? names.cli,
+                    ...(cli.vnext ? { vnext: cli.vnext } : {}),
+                },
+            }
+            : {}),
+        ...(mcp === false ? {} : { mcp: { name: mcp?.name ?? names.mcp } }),
         ...(slack === false
             ? {}
             : {
                 slack: {
-                    name: names.slack,
+                    name: slack?.name ?? names.slack,
                     ...(slack?.parameters ? { parameters: slack.parameters } : {}),
                 },
             }),
@@ -61,19 +69,17 @@ export function defineCapability(spec) {
 export function defineStaffMcpCapability(spec) {
     return { ...spec, mcp: { name: namesFromId(spec.id).mcp } };
 }
-export function slackStaffVisible(capability) {
-    return capability.roles.some((role) => role === "reviewer" || role === "admin");
-}
 export function visibleToClient(capability, client, role) {
     if (!capability.roles.includes(role))
         return false;
-    if (client === "slack") {
-        if (role === "user")
+    if (client === "slack")
+        return capability.slack != null;
+    if (client === "cli") {
+        const help = capability.cli?.vnext;
+        if (!help || !capability.cli)
             return false;
-        return slackStaffVisible(capability) && capability.slack != null;
+        return help.audience === "customer" ? role === "user" : role === "admin";
     }
-    if (client === "cli")
-        return capability.cli != null;
     return capability.mcp != null;
 }
 export function forRole(catalog, role, client) {

package/vendor/capabilities/cli-catalog.js

@@ -0,0 +1,65 @@
+import { adminCapabilities, bindAdminCapabilities } from "./capabilities/admin.js";
+import { capacityOfferCapabilities } from "./capabilities/capacity-offers.js";
+import { adminCapacityReservationCapabilities } from "./capabilities/admin-capacity-reservations.js";
+import { adminEnrollmentCapabilities, bindAdminEnrollmentCapabilities, } from "./capabilities/admin-enrollment.js";
+import { adminNodeDiagnosticCapabilities } from "./capabilities/admin-node-diagnostics.js";
+import { adminNodeLifecycleCapabilities } from "./capabilities/admin-nodes-lifecycle.js";
+import { computeCapabilities } from "./capabilities/compute.js";
+import { cliShellCapabilities } from "./capabilities/cli.js";
+import { clusterCliCapabilities, kubernetesCapabilities, slurmCapabilities, } from "./capabilities/clusters.js";
+import { externalBucketCapabilities } from "./capabilities/external-buckets.js";
+import { evidenceCapabilities } from "./capabilities/evidence.js";
+import { fleetCapabilities } from "./capabilities/fleet.js";
+import { tokenCapabilities } from "./capabilities/tokens.js";
+import { mountCapabilities } from "./capabilities/mounts.js";
+import { identityCapabilities } from "./capabilities/identity.js";
+import { listingCapabilities } from "./capabilities/listings.js";
+import { observabilityCapabilities } from "./capabilities/observability.js";
+import { networkCapabilities } from "./capabilities/networks.js";
+import { volumeCapabilities } from "./capabilities/volumes.js";
+import { userCapabilities } from "./capabilities/users.js";
+function canonicalCliCatalog(capabilities) {
+    return capabilities.map((capability) => {
+        const help = capability.cli?.vnext;
+        if (!help) {
+            const { cli: _retiredCliBinding, ...withoutCli } = capability;
+            return withoutCli;
+        }
+        return {
+            ...capability,
+            cli: {
+                command: [...(help.command ?? capability.cli?.command ?? [])],
+                vnext: help,
+            },
+        };
+    });
+}
+/** Canonical operational catalog, without staff-only commerce or CRM modules. */
+export const catalog = [
+    ...canonicalCliCatalog([
+        ...bindAdminEnrollmentCapabilities(bindAdminCapabilities([
+            ...cliShellCapabilities,
+            ...identityCapabilities,
+            ...listingCapabilities,
+            ...capacityOfferCapabilities,
+            ...computeCapabilities,
+            ...fleetCapabilities.filter((capability) => capability.id !== "node.exec"),
+            ...networkCapabilities,
+            ...clusterCliCapabilities,
+            ...tokenCapabilities,
+            ...userCapabilities,
+            ...volumeCapabilities,
+            ...mountCapabilities,
+            ...externalBucketCapabilities,
+            ...evidenceCapabilities,
+            ...observabilityCapabilities,
+            ...slurmCapabilities,
+            ...kubernetesCapabilities,
+            ...adminNodeLifecycleCapabilities,
+        ])),
+        ...adminCapabilities.filter((capability) => capability.id === "nodes.health"),
+        ...adminCapacityReservationCapabilities.filter((capability) => capability.id !== "listings.create"),
+        ...adminNodeDiagnosticCapabilities,
+        ...adminEnrollmentCapabilities,
+    ]),
+];