@ornncompute/cli 0.2.24 → 1.0.34

package/vendor/capabilities/capabilities/external-buckets.js

@@ -0,0 +1,191 @@
+import { z } from "zod";
+import { defineCapability, } from "../capability.js";
+const pageInput = z
+    .object({
+    $positionals: z.array(z.string()).optional(),
+    cursor: z.string().optional(),
+    limit: z.union([z.string(), z.number()]).optional(),
+})
+    .strict();
+const showInput = z
+    .object({
+    $positionals: z.array(z.string()).optional(),
+})
+    .strict();
+const verificationInput = z
+    .object({
+    $positionals: z.array(z.string()).optional(),
+    idempotencyKey: z.string().optional(),
+})
+    .strict();
+const disconnectInput = z
+    .object({
+    $positionals: z.array(z.string()).optional(),
+    idempotencyKey: z.string().optional(),
+    yes: z.boolean().optional(),
+})
+    .strict();
+const connectInput = z
+    .object({
+    $positionals: z.array(z.string()).optional(),
+    accessKeyId: z.string().optional(),
+    accountId: z.string().optional(),
+    bucket: z.string().optional(),
+    endpointUrl: z.string().optional(),
+    idempotencyKey: z.string().optional(),
+    name: z.string().optional(),
+    prefix: z.string().optional(),
+    readOnly: z.boolean().optional(),
+    readWrite: z.boolean().optional(),
+    region: z.string().optional(),
+    secretAccessKeyFile: z.string().optional(),
+    url: z.string().optional(),
+    yes: z.boolean().optional(),
+})
+    .strict();
+const credentialInput = z
+    .object({
+    $positionals: z.array(z.string()).optional(),
+    accessKeyId: z.string().optional(),
+    idempotencyKey: z.string().optional(),
+    secretAccessKeyFile: z.string().optional(),
+    yes: z.boolean().optional(),
+})
+    .strict();
+const importInput = z
+    .object({
+    $positionals: z.array(z.string()).optional(),
+    idempotencyKey: z.string().optional(),
+    noWait: z.boolean().optional(),
+    reservation: z.string().optional(),
+    timeout: z.string().optional(),
+    wait: z.boolean().optional(),
+    yes: z.boolean().optional(),
+})
+    .strict();
+function externalBucketExecutor(context) {
+    const interaction = context.cli?.interaction;
+    if (!interaction?.externalBuckets) {
+        throw new Error("This capability must execute through the Ornn CLI external-bucket runtime.");
+    }
+    return interaction.externalBuckets.bind(interaction);
+}
+function externalBucketCapability({ acceptedReferences = [], automation, command, description, human, id, input, mutation, outcome, related = [], resumableStates = [], review, }) {
+    return defineCapability({
+        id,
+        domain: "storage",
+        roles: ["user"],
+        description,
+        mutation,
+        input,
+        cli: {
+            command,
+            vnext: {
+                arguments: "semantic",
+                audience: "customer",
+                category: "resource",
+                outcome,
+                human,
+                automation,
+                acceptedReferences,
+                related,
+                resumableStates,
+                ...(review ? { review } : {}),
+            },
+        },
+        mcp: false,
+        slack: false,
+        execute: async (context, commandInput) => externalBucketExecutor(context)(id, commandInput),
+    });
+}
+const gcsImportGuidance = "GCS requires bucket-level read access for Ornn's Storage Transfer service agent, granted with gcloud. CLI 1.x GCS imports are currently blocked by unavailable source verification. Setup and version-specific steps: https://docs.ornn.com/cli#gcs-imports-and-storage-transfer-service";
+export const externalBucketCapabilities = [
+    externalBucketCapability({
+        id: "storage.external-buckets.list",
+        command: ["external-buckets", "list"],
+        description: "List connected GCS, S3, and R2 buckets in one bounded page.",
+        mutation: "read",
+        input: pageInput,
+        outcome: "List external bucket connections without exposing stored credentials.",
+        human: "ornn external-buckets list [--limit <1-100>] [--cursor <cursor>]",
+        automation: "ornn external-buckets list --limit 50 --format json",
+        related: ["external-buckets show", "external-buckets connect"],
+    }),
+    externalBucketCapability({
+        id: "storage.external-buckets.show",
+        command: ["external-buckets", "show"],
+        description: "Inspect one connected external bucket by canonical ID or exact unique name.",
+        mutation: "read",
+        input: showInput,
+        outcome: "Inspect one credential-safe external bucket connection.",
+        human: "ornn external-buckets show <external-bucket>",
+        automation: "ornn external-buckets show <external-bucket-id> --format json",
+        acceptedReferences: ["canonical external bucket ID", "exact unique external bucket name"],
+        related: ["external-buckets verify", "external-buckets import"],
+    }),
+    externalBucketCapability({
+        id: "storage.external-buckets.connect",
+        command: ["external-buckets", "connect"],
+        description: "Connect a typed GCS, AWS S3, or Cloudflare R2 source without verifying it implicitly.",
+        mutation: "preview-confirm",
+        input: connectInput,
+        outcome: "Create or rediscover one external bucket connection with verification kept separate.",
+        human: "ornn external-buckets connect <gcs|s3|r2> --bucket <bucket> [--name <name>] [--prefix <prefix>] [--region <region>] [--account-id <id>|--endpoint-url <url>] [--access-key-id <id> --secret-access-key-file <path>] [--read-only|--read-write]",
+        automation: "ornn external-buckets connect <gcs|s3|r2> --bucket <bucket> <provider-inputs> --yes --idempotency-key <key> --format json",
+        review: `Review the exact source, access mode, and credential presence before connecting it. ${gcsImportGuidance}`,
+        related: ["external-buckets verify", "external-buckets import"],
+    }),
+    externalBucketCapability({
+        id: "storage.external-buckets.update-credentials",
+        command: ["external-buckets", "update-credentials"],
+        description: "Replace scoped S3 or R2 credentials without returning credential bytes.",
+        mutation: "preview-confirm",
+        input: credentialInput,
+        outcome: "Update one connection's credentials and require a separate verification.",
+        human: "ornn external-buckets update-credentials <external-bucket> --access-key-id <id> --secret-access-key-file <path>",
+        automation: "ornn external-buckets update-credentials <external-bucket-id> --access-key-id <id> --secret-access-key-file <path> --yes --idempotency-key <key> --format json",
+        acceptedReferences: ["canonical external bucket ID", "exact unique external bucket name"],
+        review: "Credential changes invalidate the prior verification and require renewed review.",
+        related: ["external-buckets verify"],
+    }),
+    externalBucketCapability({
+        id: "storage.external-buckets.verify",
+        command: ["external-buckets", "verify"],
+        description: "Verify current S3 or R2 source access as a separate operation.",
+        mutation: "preview-confirm",
+        input: verificationInput,
+        outcome: "Record current source-access verification without exposing credential material.",
+        human: "ornn external-buckets verify <external-bucket>",
+        automation: "ornn external-buckets verify <external-bucket-id> --idempotency-key <key> --format json",
+        acceptedReferences: ["canonical external bucket ID", "exact unique external bucket name"],
+        review: gcsImportGuidance,
+        related: ["external-buckets import", "external-buckets update-credentials"],
+    }),
+    externalBucketCapability({
+        id: "storage.external-buckets.import",
+        command: ["external-buckets", "import"],
+        description: "Import a verified GCS or S3 source into its isolated managed working volume.",
+        mutation: "preview-confirm",
+        input: importInput,
+        outcome: "Create or replay exactly one managed working copy with source writeback disabled.",
+        human: "ornn external-buckets import <gcs|s3|r2> <external-bucket> --reservation <canonical-reservation-id> [--no-wait] [--timeout <duration>]",
+        automation: "ornn external-buckets import <gcs|s3> <external-bucket-id> --reservation <canonical-reservation-id> --yes --idempotency-key <key> [--wait --timeout <duration>] --format json",
+        acceptedReferences: ["canonical external bucket ID", "exact unique external bucket name"],
+        review: `Review the isolated destination and explicit no-writeback guarantee before importing. ${gcsImportGuidance}`,
+        resumableStates: ["pending", "working", "partial", "failed", "interrupted"],
+        related: ["external-buckets show", "storage status", "volumes files list"],
+    }),
+    externalBucketCapability({
+        id: "storage.external-buckets.disconnect",
+        command: ["external-buckets", "disconnect"],
+        description: "Disconnect an external bucket record after its working volume is detached.",
+        mutation: "preview-confirm",
+        input: disconnectInput,
+        outcome: "Remove one external source connection without writing to its source bucket.",
+        human: "ornn external-buckets disconnect <external-bucket>",
+        automation: "ornn external-buckets disconnect <external-bucket-id> --yes --idempotency-key <key> --format json",
+        acceptedReferences: ["canonical external bucket ID", "exact unique external bucket name"],
+        review: "Disconnecting reduces access to the source and is blocked while mounts remain.",
+        related: ["storage detach", "external-buckets show"],
+    }),
+];

package/vendor/capabilities/capabilities/fleet.js

@@ -1,3 +1,4 @@
+import { listSupplierOrganizations, listSupplierOrganizationPage } from "../supplier-directory.js";
 import { z } from "zod";
 import { defineCapability, preview } from "../capability.js";
 function queryPath(path, params) {
@@ -9,18 +10,27 @@ function queryPath(path, params) {
     return parts.length ? `${path}?${parts.join("&")}` : path;
 }
 const emptyInput = z.object({});
+const suppliersInput = z.object({
+    q: z.string().optional(),
+    offset: z.number().int().min(0).optional(),
+    limit: z.number().int().min(1).max(1000).optional(),
+});
 const facilitiesInput = z.object({
-    operator_id: z.string().optional(),
-    operator: z.string().optional(),
+    organization_id: z.string().optional(),
+    organizationId: z.string().optional(),
+    cursor: z.string().optional(),
+    limit: z.number().int().min(1).max(500).optional(),
 });
 const nodesInput = z.object({
-    operator_id: z.string().optional(),
-    operatorId: z.string().optional(),
-    operator: z.string().optional(),
+    organization_id: z.string().optional(),
+    organizationId: z.string().optional(),
     facility_id: z.string().optional(),
     facilityId: z.string().optional(),
     status: z.string().optional(),
     email: z.string().optional(),
+    cursor: z.string().optional(),
+    max: z.number().int().positive().max(5000).optional(),
+    limit: z.number().int().positive().max(5000).optional(),
 });
 const nodeLifecycleInput = z.object({
     node_id: z.string().min(1),
@@ -39,29 +49,53 @@ const nodeExecInput = z.object({
 function nodeIdOf(input) {
     return (input.node_id || input.nodeId || "").trim();
 }
-export const listOperatorsCapability = defineCapability({
-    id: "operator.list",
+export const listSuppliersCapability = defineCapability({
+    id: "supplier.list",
     domain: "fleet",
-    roles: ["reviewer", "admin"],
-    description: "List GPU operators (id, slug, display name, status). Resolve operator names with this before nodes.list.",
+    roles: ["admin"],
+    description: "List supplier organizations (id, name). Resolve supplier names to organization_id with this before nodes.list or facilities.list.",
     mutation: "read",
-    http: { method: "GET", path: "/provisioning/operators" },
-    slack: { parameters: { type: "object", properties: {} } },
-    input: emptyInput,
-    execute: async (ctx) => ctx.fetch("/provisioning/operators", { method: "GET" }),
+    http: { method: "GET", path: "/v1/organizations" },
+    slack: {
+        parameters: {
+            type: "object",
+            properties: {
+                q: { type: "string", description: "Search supplier names." },
+                offset: { type: "integer", description: "Use next_offset to fetch another page." },
+                limit: { type: "integer", description: "Page size (Slack maximum 10)." },
+            },
+        },
+    },
+    input: suppliersInput,
+    execute: async (ctx, input) => {
+        const parsed = suppliersInput.parse(input);
+        const paged = parsed.limit !== undefined || parsed.offset !== undefined || parsed.q !== undefined;
+        const limit = parsed.limit ?? 25;
+        const offset = parsed.offset ?? 0;
+        const rows = paged
+            ? await listSupplierOrganizationPage(ctx.fetch, { ...parsed, limit, offset })
+            : await listSupplierOrganizations(ctx.fetch);
+        return {
+            suppliers: rows.map((org) => ({ id: org.id, name: org.name })),
+            ...(paged && rows.length === limit ? { next_offset: offset + rows.length } : {}),
+        };
+    },
 });
 export const listFacilitiesCapability = defineCapability({
     id: "facilities.list",
     domain: "fleet",
-    roles: ["reviewer", "admin"],
-    description: "List facilities (id, display name, region, operator). Optional operator_id filter. Resolve facility names with this before nodes.list.",
+    roles: ["admin"],
+    description: "List facilities (id, display name, region, supplier organization id). Optional organization_id filter. Resolve facility names with this before nodes.list.",
     mutation: "read",
     http: { method: "GET", path: "/provisioning/facilities" },
     slack: {
         parameters: {
             type: "object",
             properties: {
-                operator_id: { type: "string", description: "Commerce operator UUID." },
+                organization_id: {
+                    type: "string",
+                    description: "Optional supplier organization UUID from supplier.list.",
+                },
             },
         },
     },
@@ -69,49 +103,67 @@ export const listFacilitiesCapability = defineCapability({
     execute: async (ctx, input) => {
         const parsed = facilitiesInput.parse(input);
         return ctx.fetch(queryPath("/provisioning/facilities", {
-            operator_id: parsed.operator_id ?? parsed.operator,
+            organizationId: parsed.organization_id ?? parsed.organizationId,
+            cursor: parsed.cursor,
+            limit: parsed.limit === undefined ? undefined : String(parsed.limit),
         }), { method: "GET" });
     },
 });
 export const listNodesCapability = defineCapability({
     id: "nodes.list",
     domain: "fleet",
-    roles: ["user", "reviewer", "admin"],
-    description: "List nodes. Users see their own reserved machines. Reviewers and admins see enrolled, ghost, and off-grid nodes. Call with no filters for the whole fleet. Optional email lists nodes for that user's organizations. Optional operator_id, facility_id, and status (ghost, off-grid, bare-metal) narrow the same list. Never invent nodes. Never print private keys.",
+    roles: ["user", "admin"],
+    description: "List nodes. Users see their own reserved machines. Admins see enrolled, ghost, and off-grid nodes. Call with no filters for the whole fleet. Optional email lists nodes for that user's organizations. Optional organization_id (supplier), facility_id, and status (ghost, off-grid, bare-metal) narrow the same list. Paginate large fleets with cursor + max: pass the response's next_cursor back as cursor to fetch the next page; next_cursor is omitted once the page is not full. Never invent nodes. Never print private keys.",
     mutation: "read",
     http: { method: "GET", path: "/nodes" },
     slack: {
         parameters: {
             type: "object",
             properties: {
-                operator_id: {
+                organization_id: {
                     type: "string",
-                    description: "Optional commerce operator UUID from operator.list.",
+                    description: "Optional supplier organization UUID from supplier.list.",
                 },
                 facility_id: {
                     type: "string",
                     description: "Optional commerce facility UUID from facilities.list.",
                 },
-                email: { type: "string", description: "Optional. List nodes for this user's organizations." },
+                email: {
+                    type: "string",
+                    description: "Optional. List nodes for this user's organizations.",
+                },
                 status: {
                     type: "string",
                     enum: ["ghost", "off-grid", "bare-metal"],
                     description: "Optional orchestrator status filter. Default is all statuses.",
                 },
+                cursor: {
+                    type: "string",
+                    description: "Optional. Pass the previous response's next_cursor to fetch the next page.",
+                },
+                max: {
+                    type: "integer",
+                    description: "Optional page size (1-5000). Orchestrator default is 500.",
+                },
             },
         },
     },
     input: nodesInput,
     execute: async (ctx, input) => {
         const parsed = nodesInput.parse(input);
+        const pagination = {
+            cursor: parsed.cursor,
+            limit: parsed.max != null || parsed.limit != null ? String(parsed.max ?? parsed.limit) : undefined,
+        };
         if (ctx.role === "user") {
-            return ctx.fetch("/nodes", { method: "GET" });
+            return ctx.fetch(queryPath("/nodes", pagination), { method: "GET" });
         }
         return ctx.fetch(queryPath("/nodes", {
-            operator_id: parsed.operator_id ?? parsed.operatorId ?? parsed.operator,
+            organization_id: parsed.organization_id ?? parsed.organizationId,
             facility_id: parsed.facility_id ?? parsed.facilityId,
             status: parsed.status,
             email: parsed.email,
+            ...pagination,
         }), { method: "GET" });
     },
 });
@@ -243,7 +295,7 @@ export const nodeTerminateCapability = defineCapability({
     },
 });
 export const fleetCapabilities = [
-    listOperatorsCapability,
+    listSuppliersCapability,
     listFacilitiesCapability,
     listNodesCapability,
     nodeOffGridCapability,

package/vendor/capabilities/capabilities/identity.js

@@ -1,10 +1,103 @@
 import { z } from "zod";
 import { defineCapability } from "../capability.js";
 const emptyInput = z.object({});
+const contextInput = z.object({ organization: z.string().min(1).optional() });
+const loginInput = z.object({
+    authBase: z.string().min(1).optional(),
+    noBrowser: z.boolean().optional(),
+    organization: z.string().min(1).optional(),
+    pollInterval: z.number().positive().optional(),
+    timeout: z.number().positive().optional(),
+});
+function executeSession(context, command, input) {
+    if (!context.cli?.session) {
+        throw new Error("This capability must execute through the Ornn CLI session runtime.");
+    }
+    return context.cli.session(command, input);
+}
+export const loginCapability = defineCapability({
+    id: "identity.login",
+    domain: "identity",
+    roles: ["user"],
+    description: "Authenticate the CLI with Ornn device authorization.",
+    mutation: "local",
+    http: { method: "POST", path: "/v1/cli/device/start" },
+    input: loginInput,
+    cli: {
+        command: ["login"],
+        vnext: {
+            audience: "customer",
+            category: "session",
+            arguments: "semantic",
+            outcome: "Authenticate in a browser and return to the terminal.",
+            human: "ornn login [--organization <exact-name>] [--no-browser] [--timeout <seconds>]",
+            automation: "ornn login --format json",
+            resumableStates: ["browser authorization"],
+            related: ["context", "logout"],
+            order: 1,
+        },
+    },
+    mcp: false,
+    slack: false,
+    execute: async (context, input) => executeSession(context, "login", input),
+});
+export const contextCapability = defineCapability({
+    id: "identity.context",
+    domain: "identity",
+    roles: ["user"],
+    description: "Show and select the current server-verified organization context.",
+    mutation: "read",
+    http: { method: "GET", path: "/v1/cli/session" },
+    input: contextInput,
+    cli: {
+        command: ["context"],
+        vnext: {
+            audience: "customer",
+            category: "session",
+            arguments: "semantic",
+            outcome: "Show the current user, selected organization, approval, and available organizations.",
+            human: "ornn context [--organization <exact-name-or-id>]",
+            automation: "ornn context --organization <canonical-id> --format json",
+            acceptedReferences: [
+                "exact organization name (human)",
+                "canonical organization ID (automation)",
+            ],
+            related: ["login", "logout"],
+            order: 2,
+        },
+    },
+    mcp: false,
+    slack: false,
+    execute: async (context, input) => executeSession(context, "context", input),
+});
+export const logoutCapability = defineCapability({
+    id: "identity.logout",
+    domain: "identity",
+    roles: ["user"],
+    description: "Revoke the remote CLI session and clear its local bearer.",
+    mutation: "local",
+    http: { method: "DELETE", path: "/v1/cli/session" },
+    input: emptyInput,
+    cli: {
+        command: ["logout"],
+        vnext: {
+            audience: "customer",
+            category: "session",
+            outcome: "End the remote session and always remove the local bearer.",
+            human: "ornn logout",
+            automation: "ornn logout --format json",
+            related: ["login", "context"],
+            order: 3,
+        },
+    },
+    mcp: false,
+    slack: false,
+    execute: async (context, input) => executeSession(context, "logout", input),
+});
 export const whoamiCapability = defineCapability({
     id: "identity.whoami",
     domain: "identity",
-    roles: ["user", "reviewer", "admin"],
+    roles: ["user", "admin"],
     description: "Show the signed-in Ornn user and organization.",
     mutation: "read",
     http: { method: "GET", path: "/v1/cli/session" },
@@ -14,11 +107,29 @@ export const whoamiCapability = defineCapability({
 export const statusCapability = defineCapability({
     id: "identity.status",
     domain: "identity",
-    roles: ["user", "reviewer", "admin"],
+    roles: ["user", "admin"],
     description: "Show Ornn platform status.",
     mutation: "read",
     http: { method: "GET", path: "/v1/cli/status" },
     input: emptyInput,
     execute: async (ctx) => ctx.fetch("/v1/cli/status", { method: "GET" }),
+    cli: {
+        command: ["status"],
+        vnext: {
+            audience: "customer",
+            category: "platform",
+            outcome: "Check current Ornn platform availability.",
+            human: "ornn status",
+            automation: "ornn status --format json",
+            related: ["version", "resources"],
+            order: 10,
+        },
+    },
 });
-export const identityCapabilities = [whoamiCapability, statusCapability];
+export const identityCapabilities = [
+    whoamiCapability,
+    loginCapability,
+    contextCapability,
+    logoutCapability,
+    statusCapability,
+];