@ornncompute/cli 0.2.6 → 0.2.8

package/README.md

@@ -72,7 +72,7 @@ ornn nodes keys attach <node-id> --key <path|id|label> [--json]
 ornn nodes keys list <node-id> [--json]
 ornn node health <node-id> [--json]
 ornn node diagnose <node-id> [--json]
-ornn node list [--operator <id-or-slug>] [--facility <id>] [--json]
+ornn node list [--operator <id-or-slug>] [--facility <id>] [--email <email>] [--json]
 ornn node reboot <node-id> [--json]
 ornn node hard-reset <node-id> [--json]
 ornn node off-grid <node-id> [--reason <text>] [--yes] [--json]
@@ -138,6 +138,14 @@ ornn storage buckets connect gcs|s3|r2 --bucket <bucket>|--url <url> [--name <na
 ornn storage buckets update-credentials <drive-id> --access-key-id <id> --secret-access-key-file <path> [--json]
 ornn storage buckets verify <drive-id> [--json]
 ornn storage buckets disconnect <drive-id> [--json]
+ornn storage filesystem deploy --reservation <reservation-id> [--performance-tier <tier>] [--capacity-gib <gib>] [--json]
+ornn storage filesystem status --reservation <reservation-id> [--json]
+ornn storage filesystem delete --reservation <reservation-id> [--json]
+ornn telemetry latest <node-id> [--span 15m] [--start <iso>] [--end <iso>] [--max-points <n>] [--json]
+ornn telemetry tail <node-id> [--duration <seconds>] [--json]
+ornn logs latest <node-id> [--stream kernel] [--count <n>] [--before <iso>] [--cursor <token>] [--json]
+ornn logs tail <node-id> [--stream kernel] [--duration <seconds>] [--json]
+ornn users query [--name <name>] [--email <email>] [--organization <name>] [--max <n>]
 ornn keys list [--json]
 ornn keys add [<public-key-file>] --label <label> [--public-key <key>] [--json]
 ornn keys delete <key-id> [--json]
@@ -236,14 +244,15 @@ path.
 - `ornn node health <node-id>` shows launch readiness (ready/blocked plus
   reasons), passive fault reasons, and the last validation status.
 - `ornn node diagnose <node-id>` queues a manual node validation test.
-- `ornn node list [--operator <id-or-slug>] [--facility <id>]` lists GPU nodes,
-  optionally filtered by operator and/or facility. A UUID operator is matched by
-  id; anything else is treated as the operator slug.
-- `ornn node reboot <node-id>` queues an OS reboot of the host backing the node
-  (storage and SSH keys preserved).
+- `ornn node list [--operator <id-or-slug>] [--facility <id>] [--email <email>]` lists GPU nodes.
+  Orchestrator applies facility id and an operator UUID. Non-UUID `--operator`
+  slugs and `--email` are forwarded today and do not filter the fleet.
+- `ornn node reboot <node-id>` queues an OS reboot of the node's resolved
+  instance (its host for bare-metal, its VM for a virtual-machine instance id;
+  storage and SSH keys preserved).
 - `ornn node hard-reset <node-id>` wipes tenant storage/users and reboots, then
   re-pushes the tenant's keys on reconnect. The tenant keeps ownership of the
-  host.
+  instance.
 - `ornn node off-grid <node-id> [--reason <text>] [--yes]` takes a node off-grid
   (remove Ornn agent management, leave the host powered on). Asks y/N unless `--yes`.
 - `ornn node on-grid <node-id> [--yes]` re-enrolls an off-grid host: orchestrator

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ornncompute/cli",
-  "version": "0.2.6",
+  "version": "0.2.8",
   "description": "Command-line interface for Ornn compute access workflows.",
   "type": "module",
   "bin": {

package/vendor/capabilities/capabilities/clusters.js

@@ -1,5 +1,5 @@
 import { z } from "zod";
-import { defineCapability } from "../capability.js";
+import { defineCapability, preview } from "../capability.js";
 const reservationInput = z.object({
     reservation_id: z.string().min(1),
     reservationId: z.string().optional(),
@@ -51,7 +51,7 @@ function clusterPair(kind, domain) {
                     return { ok: false, error: "other_cluster", reason: "other_cluster" };
                 }
                 if (!ctx.confirmed) {
-                    return { ok: true, action: `${kind}.launch`, reservation_id: id };
+                    return preview(`${kind}.launch`, { reservation_id: id });
                 }
                 return ctx.fetch(clusterPath(kind, id, "cluster/launch"), {
                     method: "POST",
@@ -75,7 +75,7 @@ function clusterPair(kind, domain) {
                 const parsed = reservationInput.parse(input);
                 const id = reservationId(parsed);
                 if (!ctx.confirmed) {
-                    return { ok: true, action: `${kind}.teardown`, reservation_id: id };
+                    return preview(`${kind}.teardown`, { reservation_id: id });
                 }
                 return ctx.fetch(clusterPath(kind, id, "cluster/teardown"), { method: "POST" });
             },

package/vendor/capabilities/capabilities/fleet.js

@@ -1,5 +1,5 @@
 import { z } from "zod";
-import { defineCapability } from "../capability.js";
+import { defineCapability, preview } from "../capability.js";
 function queryPath(path, params) {
     const parts = [];
     for (const [key, value] of Object.entries(params)) {
@@ -138,7 +138,7 @@ export const nodeOffGridCapability = defineCapability({
         const id = nodeIdOf(parsed);
         const body = { ...(parsed.reason ? { reason: parsed.reason } : {}) };
         if (!ctx.confirmed) {
-            return { ok: true, action: "node.off-grid", payload: { node_id: id, ...body } };
+            return preview("node.off-grid", { node_id: id, ...body });
         }
         return ctx.fetch(`/internal/nodes/${encodeURIComponent(id)}/off-grid`, {
             method: "POST",
@@ -167,7 +167,7 @@ export const nodeOnGridCapability = defineCapability({
         const parsed = nodeLifecycleInput.parse(input);
         const id = nodeIdOf(parsed);
         if (!ctx.confirmed) {
-            return { ok: true, action: "node.on-grid", payload: { node_id: id } };
+            return preview("node.on-grid", { node_id: id });
         }
         return ctx.fetch(`/internal/nodes/${encodeURIComponent(id)}/on-grid`, {
             method: "POST",
@@ -234,7 +234,7 @@ export const nodeTerminateCapability = defineCapability({
             ...(parsed.force !== undefined ? { force: parsed.force } : {}),
         };
         if (!ctx.confirmed) {
-            return { ok: true, action: "node.terminate", payload: { node_id: id, ...body } };
+            return preview("node.terminate", { node_id: id, ...body });
         }
         return ctx.fetch(`/internal/nodes/${encodeURIComponent(id)}/terminate`, {
             method: "POST",

package/vendor/capabilities/capabilities/listings.js

@@ -1,5 +1,5 @@
 import { z } from "zod";
-import { defineCapability } from "../capability.js";
+import { defineCapability, preview } from "../capability.js";
 import { bindHardwareFields, HARDWARE_LISTING_FIELDS, HARDWARE_LISTING_FILTERS, loadHardwareCatalog, projectCatalogTerms, } from "../spec-catalog.js";
 export const listingCreateInput = z.object({
     kind: z.enum(["gpu", "cpu", "node", "link"]).optional(),
@@ -147,7 +147,7 @@ export const createListingCapability = defineCapability({
             return bound;
         const payload = { backing_mode: "forward", ...bound.payload };
         if (!ctx.confirmed) {
-            return { ok: true, action: "create_listing", payload };
+            return preview("create_listing", payload);
         }
         return ctx.fetch("/inventory", { method: "POST", body: payload });
     },

package/vendor/capabilities/capabilities/staff-access.d.ts

@@ -0,0 +1,27 @@
+import { z } from "zod";
+export declare const sshKeyPushInput: z.ZodObject<{
+    instanceId: z.ZodString;
+    reservationId: z.ZodString;
+    tenantId: z.ZodString;
+    authUserId: z.ZodString;
+    sshKeyIds: z.ZodArray<z.ZodString>;
+    requestId: z.ZodOptional<z.ZodString>;
+    confirm: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strip>;
+export declare const sshKeyPushCapability: import("../capability.ts").Capability<unknown, unknown>;
+export declare const sshKeyAddInput: z.ZodObject<{
+    reservationId: z.ZodString;
+    tenantId: z.ZodString;
+    authUserId: z.ZodString;
+    publicKey: z.ZodString;
+    label: z.ZodOptional<z.ZodString>;
+    confirm: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strip>;
+export declare const sshKeyAddCapability: import("../capability.ts").Capability<unknown, unknown>;
+export declare const sshKeyRevokeInput: z.ZodObject<{
+    tenantId: z.ZodString;
+    keyId: z.ZodString;
+    confirm: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strip>;
+export declare const sshKeyRevokeCapability: import("../capability.ts").Capability<unknown, unknown>;
+export declare const staffAccessCapabilities: import("../capability.ts").Capability<unknown, unknown>[];

package/vendor/capabilities/capabilities/staff-access.js

@@ -0,0 +1,192 @@
+import { z } from "zod";
+import { defineStaffMcpCapability, preview } from "../capability.js";
+import { mapBody, seg, statusOf } from "./staff-shared.js";
+// Staff SSH-access verbs. MCP-only — see `defineStaffMcpCapability`.
+//
+// Field contracts from the internal SSH-key routes:
+// - push: PATCH /internal/nodes/{instanceId}/keys (or /internal/pods/... for a VM)
+//   body { ssh_authorized_keys, request_id? }
+// - add: POST /internal/v1/reservations/{reservationId}/ssh-keys
+//   body { public_key, label? }, after authorization owns the public key
+// - revoke: DELETE /v1/organizations/{tenantId}/ssh-keys/{keyId}
+//
+// The routes never forward tenantId/authUserId to the orchestrator as-is — they use them to
+// verify the reservation actually belongs to that organization, and that authUserId is a member
+// of it (commerce GET /internal/v1/reservations/{id} + authorization GET
+// /internal/organizations/{id}/members). Those two checks live in
+// `assertReservationOwnedByTenantUser` below so every surface runs them.
+/** Acts as the caller for a write the tenant's own user is nominally making. */
+const AUTH_USER_HEADER = "X-Auth-User-Id";
+async function assertReservationOwnedByTenantUser(ctx, options) {
+    let reservation;
+    try {
+        reservation = (await ctx.fetch(`/internal/v1/reservations/${seg(options.reservationId)}`, {
+            method: "GET",
+        }));
+    }
+    catch (error) {
+        if (statusOf(error) === 404) {
+            throw new Error("Reservation not found.");
+        }
+        throw error;
+    }
+    if (!reservation?.reservationId) {
+        throw new Error("Reservation not found.");
+    }
+    const organizationId = reservation.organizationId ?? reservation.tenantId;
+    if (organizationId !== options.tenantId) {
+        throw new Error("Reservation does not belong to that tenant.");
+    }
+    const members = (await ctx.fetch(`/internal/organizations/${seg(options.tenantId)}/members`, {
+        method: "GET",
+    }));
+    if (!members.some((member) => member.user_id === options.authUserId)) {
+        throw new Error("Selected SSH key owner is not a member of this tenant.");
+    }
+}
+async function assertMachineBelongsToReservation(ctx, options) {
+    const listed = (await ctx.fetch(`/internal/nodes?reservation_id=${seg(options.reservationId)}`, {
+        method: "GET",
+    }));
+    if (!(listed.nodes ?? []).some((node) => node.node_id === options.instanceId || node.id === options.instanceId)) {
+        throw new Error("Machine does not belong to that reservation.");
+    }
+}
+export const sshKeyPushInput = z.object({
+    instanceId: z.string(),
+    reservationId: z.string(),
+    tenantId: z.string(),
+    authUserId: z.string(),
+    sshKeyIds: z.array(z.string()).min(1),
+    requestId: z.string().optional(),
+    confirm: z.boolean().optional(),
+});
+export const sshKeyPushCapability = defineStaffMcpCapability({
+    id: "ssh-key.push",
+    domain: "access",
+    roles: ["admin"],
+    description: "Internal staff only: push selected reservation SSH keys onto a live machine. " +
+        "This grants remote access to a live machine. Requires confirm: true.",
+    mutation: "preview-confirm",
+    http: { method: "PATCH", path: "/internal/nodes/{instanceId}/keys" },
+    input: sshKeyPushInput,
+    execute: async (ctx, input) => {
+        const parsed = sshKeyPushInput.parse(input);
+        if (!ctx.confirmed) {
+            return preview("ssh-key.push", {
+                instanceId: parsed.instanceId,
+                reservationId: parsed.reservationId,
+                sshKeyIds: parsed.sshKeyIds,
+            });
+        }
+        // Sequential, not Promise.all: this is a fail-fast authorization gate, not an independent
+        // read pair. If the reservation doesn't belong to this tenant/user, there's no reason to
+        // spend a second round trip checking machine membership.
+        await assertReservationOwnedByTenantUser(ctx, {
+            reservationId: parsed.reservationId,
+            tenantId: parsed.tenantId,
+            authUserId: parsed.authUserId,
+        });
+        await assertMachineBelongsToReservation(ctx, {
+            reservationId: parsed.reservationId,
+            instanceId: parsed.instanceId,
+        });
+        const listed = (await ctx.fetch(`/v1/organizations/${seg(parsed.tenantId)}/ssh-keys`, {
+            method: "GET",
+        }));
+        const wanted = new Set(parsed.sshKeyIds);
+        const sshAuthorizedKeys = (listed.ssh_keys ?? [])
+            .filter((key) => key.id &&
+            wanted.has(key.id) &&
+            key.status === "active" &&
+            !key.revoked_at &&
+            Boolean(key.public_key?.trim()))
+            .map((key) => key.public_key.trim());
+        const body = {
+            ssh_authorized_keys: sshAuthorizedKeys,
+            ...mapBody(parsed, { requestId: "request_id" }),
+        };
+        let keysPath = `/internal/nodes/${seg(parsed.instanceId)}/keys`;
+        try {
+            const pod = (await ctx.fetch(`/internal/pods/${seg(parsed.instanceId)}`, {
+                method: "GET",
+            }));
+            if (pod.kind === "virtual-machine") {
+                keysPath = `/internal/pods/${seg(parsed.instanceId)}/keys`;
+            }
+        }
+        catch {
+            // instanceId is a host node
+        }
+        return ctx.fetch(keysPath, {
+            method: "PATCH",
+            body,
+            headers: { [AUTH_USER_HEADER]: parsed.authUserId },
+        });
+    },
+});
+export const sshKeyAddInput = z.object({
+    reservationId: z.string(),
+    tenantId: z.string(),
+    authUserId: z.string(),
+    publicKey: z.string().min(1),
+    label: z.string().optional(),
+    confirm: z.boolean().optional(),
+});
+export const sshKeyAddCapability = defineStaffMcpCapability({
+    id: "ssh-key.add",
+    domain: "access",
+    roles: ["admin"],
+    description: "Internal staff only: register an SSH public key on a reservation for a tenant user. Requires confirm: true.",
+    mutation: "preview-confirm",
+    http: { method: "POST", path: "/internal/v1/reservations/{reservationId}/ssh-keys" },
+    input: sshKeyAddInput,
+    execute: async (ctx, input) => {
+        const parsed = sshKeyAddInput.parse(input);
+        const body = {
+            public_key: parsed.publicKey,
+            ...mapBody(parsed, { label: "label" }),
+        };
+        if (!ctx.confirmed) {
+            return preview("ssh-key.add", { reservationId: parsed.reservationId, ...body });
+        }
+        await assertReservationOwnedByTenantUser(ctx, {
+            reservationId: parsed.reservationId,
+            tenantId: parsed.tenantId,
+            authUserId: parsed.authUserId,
+        });
+        return ctx.fetch(`/internal/v1/reservations/${seg(parsed.reservationId)}/ssh-keys`, {
+            method: "POST",
+            body,
+            headers: { [AUTH_USER_HEADER]: parsed.authUserId },
+        });
+    },
+});
+export const sshKeyRevokeInput = z.object({
+    tenantId: z.string(),
+    keyId: z.string(),
+    confirm: z.boolean().optional(),
+});
+export const sshKeyRevokeCapability = defineStaffMcpCapability({
+    id: "ssh-key.revoke",
+    domain: "access",
+    roles: ["admin"],
+    description: "Internal staff only: revoke (delete) a tenant-scoped SSH key. Requires confirm: true.",
+    mutation: "preview-confirm",
+    http: { method: "DELETE", path: "/v1/organizations/{tenantId}/ssh-keys/{keyId}" },
+    input: sshKeyRevokeInput,
+    execute: async (ctx, input) => {
+        const parsed = sshKeyRevokeInput.parse(input);
+        if (!ctx.confirmed) {
+            return preview("ssh-key.revoke", { tenantId: parsed.tenantId, keyId: parsed.keyId });
+        }
+        return ctx.fetch(`/v1/organizations/${seg(parsed.tenantId)}/ssh-keys/${seg(parsed.keyId)}`, {
+            method: "DELETE",
+        });
+    },
+});
+export const staffAccessCapabilities = [
+    sshKeyPushCapability,
+    sshKeyAddCapability,
+    sshKeyRevokeCapability,
+];

package/vendor/capabilities/capabilities/staff-commerce.d.ts

@@ -0,0 +1,83 @@
+import { z } from "zod";
+export declare const reservationCancelInput: z.ZodObject<{
+    reservationId: z.ZodString;
+    confirm: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strip>;
+export declare const reservationCancelCapability: import("../capability.ts").Capability<unknown, unknown>;
+export declare const reservationTransferInput: z.ZodObject<{
+    reservationId: z.ZodString;
+    targetTenantId: z.ZodString;
+    targetAuthUserId: z.ZodOptional<z.ZodString>;
+    nodeId: z.ZodOptional<z.ZodString>;
+    reservedStrategy: z.ZodEnum<{
+        reject: "reject";
+        park: "park";
+    }>;
+    confirmReservedTransfer: z.ZodOptional<z.ZodBoolean>;
+    notes: z.ZodOptional<z.ZodString>;
+    confirm: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strip>;
+export declare const reservationTransferCapability: import("../capability.ts").Capability<unknown, unknown>;
+export declare const reservationMachinesListInput: z.ZodObject<{
+    reservationId: z.ZodString;
+}, z.core.$strip>;
+export declare const reservationMachinesListCapability: import("../capability.ts").Capability<unknown, unknown>;
+export declare const reservationSshKeyAddInput: z.ZodObject<{
+    reservationId: z.ZodString;
+    userId: z.ZodString;
+    publicKey: z.ZodString;
+    label: z.ZodOptional<z.ZodString>;
+    nodeId: z.ZodOptional<z.ZodString>;
+    confirm: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strip>;
+export declare const reservationSshKeyAddCapability: import("../capability.ts").Capability<unknown, unknown>;
+export declare const reservationSshKeyRemoveInput: z.ZodObject<{
+    reservationId: z.ZodString;
+    keyId: z.ZodString;
+    userId: z.ZodString;
+    nodeId: z.ZodOptional<z.ZodString>;
+    confirm: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strip>;
+export declare const reservationSshKeyRemoveCapability: import("../capability.ts").Capability<unknown, unknown>;
+export declare const reservationPublishInput: z.ZodObject<{
+    reservationId: z.ZodString;
+    confirm: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strip>;
+export declare const reservationPublishCapability: import("../capability.ts").Capability<unknown, unknown>;
+export declare const bidAcceptInput: z.ZodObject<{
+    bidId: z.ZodString;
+    acceptedGpuCount: z.ZodOptional<z.ZodNumber>;
+    confirm: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strip>;
+export declare const bidAcceptCapability: import("../capability.ts").Capability<unknown, unknown>;
+export declare const bidRejectInput: z.ZodObject<{
+    bidId: z.ZodString;
+    confirm: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strip>;
+export declare const bidRejectCapability: import("../capability.ts").Capability<unknown, unknown>;
+export declare const inventoryUpdateInput: z.ZodObject<{
+    inventoryId: z.ZodString;
+    siteOperator: z.ZodOptional<z.ZodString>;
+    siteNickname: z.ZodOptional<z.ZodString>;
+    gpuType: z.ZodOptional<z.ZodString>;
+    nodeCount: z.ZodOptional<z.ZodNumber>;
+    gpusPerNode: z.ZodOptional<z.ZodNumber>;
+    availableFrom: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    availableTo: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    availableStartAt: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    availableEndAt: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    cpu: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    ram: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    fabricType: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    storage: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    internet: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    networkHardware: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    buyNowPricePerGpuHour: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+    confirm: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strip>;
+export declare const inventoryUpdateCapability: import("../capability.ts").Capability<unknown, unknown>;
+export declare const tenantCreditProfileShowInput: z.ZodObject<{
+    tenantId: z.ZodString;
+}, z.core.$strip>;
+export declare const tenantCreditProfileShowCapability: import("../capability.ts").Capability<unknown, unknown>;
+export declare const staffCommerceCapabilities: import("../capability.ts").Capability<unknown, unknown>[];