@ornncompute/cli 0.2.7 → 0.2.9

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ornncompute/cli",
-  "version": "0.2.7",
+  "version": "0.2.9",
   "description": "Command-line interface for Ornn compute access workflows.",
   "type": "module",
   "bin": {

package/vendor/capabilities/capabilities/staff-access.d.ts

@@ -0,0 +1,27 @@
+import { z } from "zod";
+export declare const sshKeyPushInput: z.ZodObject<{
+    instanceId: z.ZodString;
+    reservationId: z.ZodString;
+    tenantId: z.ZodString;
+    authUserId: z.ZodString;
+    sshKeyIds: z.ZodArray<z.ZodString>;
+    requestId: z.ZodOptional<z.ZodString>;
+    confirm: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strip>;
+export declare const sshKeyPushCapability: import("../capability.ts").Capability<unknown, unknown>;
+export declare const sshKeyAddInput: z.ZodObject<{
+    reservationId: z.ZodString;
+    tenantId: z.ZodString;
+    authUserId: z.ZodString;
+    publicKey: z.ZodString;
+    label: z.ZodOptional<z.ZodString>;
+    confirm: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strip>;
+export declare const sshKeyAddCapability: import("../capability.ts").Capability<unknown, unknown>;
+export declare const sshKeyRevokeInput: z.ZodObject<{
+    tenantId: z.ZodString;
+    keyId: z.ZodString;
+    confirm: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strip>;
+export declare const sshKeyRevokeCapability: import("../capability.ts").Capability<unknown, unknown>;
+export declare const staffAccessCapabilities: import("../capability.ts").Capability<unknown, unknown>[];

package/vendor/capabilities/capabilities/staff-access.js

@@ -0,0 +1,192 @@
+import { z } from "zod";
+import { defineStaffMcpCapability, preview } from "../capability.js";
+import { mapBody, seg, statusOf } from "./staff-shared.js";
+// Staff SSH-access verbs. MCP-only — see `defineStaffMcpCapability`.
+//
+// Field contracts from the internal SSH-key routes:
+// - push: PATCH /internal/nodes/{instanceId}/keys (or /internal/pods/... for a VM)
+//   body { ssh_authorized_keys, request_id? }
+// - add: POST /internal/v1/reservations/{reservationId}/ssh-keys
+//   body { public_key, label? }, after authorization owns the public key
+// - revoke: DELETE /v1/organizations/{tenantId}/ssh-keys/{keyId}
+//
+// The routes never forward tenantId/authUserId to the orchestrator as-is — they use them to
+// verify the reservation actually belongs to that organization, and that authUserId is a member
+// of it (commerce GET /internal/v1/reservations/{id} + authorization GET
+// /internal/organizations/{id}/members). Those two checks live in
+// `assertReservationOwnedByTenantUser` below so every surface runs them.
+/** Acts as the caller for a write the tenant's own user is nominally making. */
+const AUTH_USER_HEADER = "X-Auth-User-Id";
+async function assertReservationOwnedByTenantUser(ctx, options) {
+    let reservation;
+    try {
+        reservation = (await ctx.fetch(`/internal/v1/reservations/${seg(options.reservationId)}`, {
+            method: "GET",
+        }));
+    }
+    catch (error) {
+        if (statusOf(error) === 404) {
+            throw new Error("Reservation not found.");
+        }
+        throw error;
+    }
+    if (!reservation?.reservationId) {
+        throw new Error("Reservation not found.");
+    }
+    const organizationId = reservation.organizationId ?? reservation.tenantId;
+    if (organizationId !== options.tenantId) {
+        throw new Error("Reservation does not belong to that tenant.");
+    }
+    const members = (await ctx.fetch(`/internal/organizations/${seg(options.tenantId)}/members`, {
+        method: "GET",
+    }));
+    if (!members.some((member) => member.user_id === options.authUserId)) {
+        throw new Error("Selected SSH key owner is not a member of this tenant.");
+    }
+}
+async function assertMachineBelongsToReservation(ctx, options) {
+    const listed = (await ctx.fetch(`/internal/nodes?reservation_id=${seg(options.reservationId)}`, {
+        method: "GET",
+    }));
+    if (!(listed.nodes ?? []).some((node) => node.node_id === options.instanceId || node.id === options.instanceId)) {
+        throw new Error("Machine does not belong to that reservation.");
+    }
+}
+export const sshKeyPushInput = z.object({
+    instanceId: z.string(),
+    reservationId: z.string(),
+    tenantId: z.string(),
+    authUserId: z.string(),
+    sshKeyIds: z.array(z.string()).min(1),
+    requestId: z.string().optional(),
+    confirm: z.boolean().optional(),
+});
+export const sshKeyPushCapability = defineStaffMcpCapability({
+    id: "ssh-key.push",
+    domain: "access",
+    roles: ["admin"],
+    description: "Internal staff only: push selected reservation SSH keys onto a live machine. " +
+        "This grants remote access to a live machine. Requires confirm: true.",
+    mutation: "preview-confirm",
+    http: { method: "PATCH", path: "/internal/nodes/{instanceId}/keys" },
+    input: sshKeyPushInput,
+    execute: async (ctx, input) => {
+        const parsed = sshKeyPushInput.parse(input);
+        if (!ctx.confirmed) {
+            return preview("ssh-key.push", {
+                instanceId: parsed.instanceId,
+                reservationId: parsed.reservationId,
+                sshKeyIds: parsed.sshKeyIds,
+            });
+        }
+        // Sequential, not Promise.all: this is a fail-fast authorization gate, not an independent
+        // read pair. If the reservation doesn't belong to this tenant/user, there's no reason to
+        // spend a second round trip checking machine membership.
+        await assertReservationOwnedByTenantUser(ctx, {
+            reservationId: parsed.reservationId,
+            tenantId: parsed.tenantId,
+            authUserId: parsed.authUserId,
+        });
+        await assertMachineBelongsToReservation(ctx, {
+            reservationId: parsed.reservationId,
+            instanceId: parsed.instanceId,
+        });
+        const listed = (await ctx.fetch(`/v1/organizations/${seg(parsed.tenantId)}/ssh-keys`, {
+            method: "GET",
+        }));
+        const wanted = new Set(parsed.sshKeyIds);
+        const sshAuthorizedKeys = (listed.ssh_keys ?? [])
+            .filter((key) => key.id &&
+            wanted.has(key.id) &&
+            key.status === "active" &&
+            !key.revoked_at &&
+            Boolean(key.public_key?.trim()))
+            .map((key) => key.public_key.trim());
+        const body = {
+            ssh_authorized_keys: sshAuthorizedKeys,
+            ...mapBody(parsed, { requestId: "request_id" }),
+        };
+        let keysPath = `/internal/nodes/${seg(parsed.instanceId)}/keys`;
+        try {
+            const pod = (await ctx.fetch(`/internal/pods/${seg(parsed.instanceId)}`, {
+                method: "GET",
+            }));
+            if (pod.kind === "virtual-machine") {
+                keysPath = `/internal/pods/${seg(parsed.instanceId)}/keys`;
+            }
+        }
+        catch {
+            // instanceId is a host node
+        }
+        return ctx.fetch(keysPath, {
+            method: "PATCH",
+            body,
+            headers: { [AUTH_USER_HEADER]: parsed.authUserId },
+        });
+    },
+});
+export const sshKeyAddInput = z.object({
+    reservationId: z.string(),
+    tenantId: z.string(),
+    authUserId: z.string(),
+    publicKey: z.string().min(1),
+    label: z.string().optional(),
+    confirm: z.boolean().optional(),
+});
+export const sshKeyAddCapability = defineStaffMcpCapability({
+    id: "ssh-key.add",
+    domain: "access",
+    roles: ["admin"],
+    description: "Internal staff only: register an SSH public key on a reservation for a tenant user. Requires confirm: true.",
+    mutation: "preview-confirm",
+    http: { method: "POST", path: "/internal/v1/reservations/{reservationId}/ssh-keys" },
+    input: sshKeyAddInput,
+    execute: async (ctx, input) => {
+        const parsed = sshKeyAddInput.parse(input);
+        const body = {
+            public_key: parsed.publicKey,
+            ...mapBody(parsed, { label: "label" }),
+        };
+        if (!ctx.confirmed) {
+            return preview("ssh-key.add", { reservationId: parsed.reservationId, ...body });
+        }
+        await assertReservationOwnedByTenantUser(ctx, {
+            reservationId: parsed.reservationId,
+            tenantId: parsed.tenantId,
+            authUserId: parsed.authUserId,
+        });
+        return ctx.fetch(`/internal/v1/reservations/${seg(parsed.reservationId)}/ssh-keys`, {
+            method: "POST",
+            body,
+            headers: { [AUTH_USER_HEADER]: parsed.authUserId },
+        });
+    },
+});
+export const sshKeyRevokeInput = z.object({
+    tenantId: z.string(),
+    keyId: z.string(),
+    confirm: z.boolean().optional(),
+});
+export const sshKeyRevokeCapability = defineStaffMcpCapability({
+    id: "ssh-key.revoke",
+    domain: "access",
+    roles: ["admin"],
+    description: "Internal staff only: revoke (delete) a tenant-scoped SSH key. Requires confirm: true.",
+    mutation: "preview-confirm",
+    http: { method: "DELETE", path: "/v1/organizations/{tenantId}/ssh-keys/{keyId}" },
+    input: sshKeyRevokeInput,
+    execute: async (ctx, input) => {
+        const parsed = sshKeyRevokeInput.parse(input);
+        if (!ctx.confirmed) {
+            return preview("ssh-key.revoke", { tenantId: parsed.tenantId, keyId: parsed.keyId });
+        }
+        return ctx.fetch(`/v1/organizations/${seg(parsed.tenantId)}/ssh-keys/${seg(parsed.keyId)}`, {
+            method: "DELETE",
+        });
+    },
+});
+export const staffAccessCapabilities = [
+    sshKeyPushCapability,
+    sshKeyAddCapability,
+    sshKeyRevokeCapability,
+];

package/vendor/capabilities/capabilities/staff-commerce.d.ts

@@ -0,0 +1,83 @@
+import { z } from "zod";
+export declare const reservationCancelInput: z.ZodObject<{
+    reservationId: z.ZodString;
+    confirm: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strip>;
+export declare const reservationCancelCapability: import("../capability.ts").Capability<unknown, unknown>;
+export declare const reservationTransferInput: z.ZodObject<{
+    reservationId: z.ZodString;
+    targetTenantId: z.ZodString;
+    targetAuthUserId: z.ZodOptional<z.ZodString>;
+    nodeId: z.ZodOptional<z.ZodString>;
+    reservedStrategy: z.ZodEnum<{
+        reject: "reject";
+        park: "park";
+    }>;
+    confirmReservedTransfer: z.ZodOptional<z.ZodBoolean>;
+    notes: z.ZodOptional<z.ZodString>;
+    confirm: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strip>;
+export declare const reservationTransferCapability: import("../capability.ts").Capability<unknown, unknown>;
+export declare const reservationMachinesListInput: z.ZodObject<{
+    reservationId: z.ZodString;
+}, z.core.$strip>;
+export declare const reservationMachinesListCapability: import("../capability.ts").Capability<unknown, unknown>;
+export declare const reservationSshKeyAddInput: z.ZodObject<{
+    reservationId: z.ZodString;
+    userId: z.ZodString;
+    publicKey: z.ZodString;
+    label: z.ZodOptional<z.ZodString>;
+    nodeId: z.ZodOptional<z.ZodString>;
+    confirm: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strip>;
+export declare const reservationSshKeyAddCapability: import("../capability.ts").Capability<unknown, unknown>;
+export declare const reservationSshKeyRemoveInput: z.ZodObject<{
+    reservationId: z.ZodString;
+    keyId: z.ZodString;
+    userId: z.ZodString;
+    nodeId: z.ZodOptional<z.ZodString>;
+    confirm: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strip>;
+export declare const reservationSshKeyRemoveCapability: import("../capability.ts").Capability<unknown, unknown>;
+export declare const reservationPublishInput: z.ZodObject<{
+    reservationId: z.ZodString;
+    confirm: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strip>;
+export declare const reservationPublishCapability: import("../capability.ts").Capability<unknown, unknown>;
+export declare const bidAcceptInput: z.ZodObject<{
+    bidId: z.ZodString;
+    acceptedGpuCount: z.ZodOptional<z.ZodNumber>;
+    confirm: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strip>;
+export declare const bidAcceptCapability: import("../capability.ts").Capability<unknown, unknown>;
+export declare const bidRejectInput: z.ZodObject<{
+    bidId: z.ZodString;
+    confirm: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strip>;
+export declare const bidRejectCapability: import("../capability.ts").Capability<unknown, unknown>;
+export declare const inventoryUpdateInput: z.ZodObject<{
+    inventoryId: z.ZodString;
+    siteOperator: z.ZodOptional<z.ZodString>;
+    siteNickname: z.ZodOptional<z.ZodString>;
+    gpuType: z.ZodOptional<z.ZodString>;
+    nodeCount: z.ZodOptional<z.ZodNumber>;
+    gpusPerNode: z.ZodOptional<z.ZodNumber>;
+    availableFrom: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    availableTo: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    availableStartAt: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    availableEndAt: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    cpu: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    ram: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    fabricType: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    storage: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    internet: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    networkHardware: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    buyNowPricePerGpuHour: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+    confirm: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strip>;
+export declare const inventoryUpdateCapability: import("../capability.ts").Capability<unknown, unknown>;
+export declare const tenantCreditProfileShowInput: z.ZodObject<{
+    tenantId: z.ZodString;
+}, z.core.$strip>;
+export declare const tenantCreditProfileShowCapability: import("../capability.ts").Capability<unknown, unknown>;
+export declare const staffCommerceCapabilities: import("../capability.ts").Capability<unknown, unknown>[];

package/vendor/capabilities/capabilities/staff-commerce.js

@@ -0,0 +1,290 @@
+import { z } from "zod";
+import { defineStaffMcpCapability, preview } from "../capability.js";
+import { mapBody, seg } from "./staff-shared.js";
+// Staff commerce verbs: reservations, bids, forward inventory, and the tenant
+// credit profile. MCP-only — see `defineStaffMcpCapability`.
+export const reservationCancelInput = z.object({
+    reservationId: z.string(),
+    confirm: z.boolean().optional(),
+});
+export const reservationCancelCapability = defineStaffMcpCapability({
+    id: "reservation.cancel",
+    domain: "reservations",
+    roles: ["admin"],
+    description: "Internal staff only: cancel a reservation. Mirrors the internal dashboard's Cancel/Reject action.",
+    mutation: "preview-confirm",
+    http: { method: "POST", path: "/internal/reservations/{reservationId}/cancel" },
+    input: reservationCancelInput,
+    execute: async (ctx, input) => {
+        const parsed = reservationCancelInput.parse(input);
+        if (!ctx.confirmed) {
+            return preview("reservation.cancel", { reservationId: parsed.reservationId });
+        }
+        return ctx.fetch(`/internal/reservations/${seg(parsed.reservationId)}/cancel`, {
+            method: "POST",
+        });
+    },
+});
+export const reservationTransferInput = z.object({
+    reservationId: z.string(),
+    targetTenantId: z.string(),
+    targetAuthUserId: z.string().optional(),
+    nodeId: z.string().optional(),
+    reservedStrategy: z.enum(["reject", "park"]),
+    confirmReservedTransfer: z.boolean().optional(),
+    notes: z.string().max(2000).optional(),
+    confirm: z.boolean().optional(),
+});
+export const reservationTransferCapability = defineStaffMcpCapability({
+    id: "reservation.transfer",
+    domain: "reservations",
+    roles: ["admin"],
+    description: "Internal staff only: transfer a reservation to a different tenant/node. Mirrors the internal node-overlay transfer action. " +
+        "reservedStrategy has no default and must be chosen explicitly: \"reject\" (transfer only if the reservation isn't " +
+        "currently provisioned/assigned) or \"park\" (clean up old access and park it for the target tenant, for a live handoff). " +
+        "The dashboard always computes this from the reservation's live state before sending it rather than relying on the " +
+        "backend's own default of \"reject\", because a silent \"reject\" default on a reservation the backend doesn't detect as " +
+        "actively provisioned/assigned would transfer it without ever asking for confirm_reserved_transfer.",
+    mutation: "preview-confirm",
+    http: { method: "POST", path: "/internal/reservations/{reservationId}/transfer" },
+    input: reservationTransferInput,
+    execute: async (ctx, input) => {
+        const parsed = reservationTransferInput.parse(input);
+        const body = {
+            target_tenant_id: parsed.targetTenantId,
+            reserved_strategy: parsed.reservedStrategy,
+            confirm_reserved_transfer: parsed.confirmReservedTransfer ?? false,
+            ...mapBody(parsed, {
+                targetAuthUserId: "target_auth_user_id",
+                nodeId: "node_id",
+                notes: "notes",
+            }),
+        };
+        if (!ctx.confirmed)
+            return preview("reservation.transfer", body);
+        return ctx.fetch(`/internal/reservations/${seg(parsed.reservationId)}/transfer`, {
+            method: "POST",
+            body,
+        });
+    },
+});
+export const reservationMachinesListInput = z.object({ reservationId: z.string() });
+export const reservationMachinesListCapability = defineStaffMcpCapability({
+    id: "reservation.machines.list",
+    domain: "reservations",
+    roles: ["reviewer", "admin"],
+    description: "Internal staff only: list machines for a reservation.",
+    mutation: "read",
+    http: { method: "GET", path: "/internal/nodes" },
+    input: reservationMachinesListInput,
+    execute: async (ctx, input) => {
+        const parsed = reservationMachinesListInput.parse(input);
+        return ctx.fetch(`/internal/nodes?reservation_id=${seg(parsed.reservationId)}`, {
+            method: "GET",
+        });
+    },
+});
+export const reservationSshKeyAddInput = z.object({
+    reservationId: z.string(),
+    userId: z.string(),
+    publicKey: z.string().min(1),
+    label: z.string().optional(),
+    nodeId: z.string().optional(),
+    confirm: z.boolean().optional(),
+});
+export const reservationSshKeyAddCapability = defineStaffMcpCapability({
+    id: "reservation.ssh-key.add",
+    domain: "reservations",
+    roles: ["admin"],
+    description: "Internal staff only: add an SSH key to a reservation and queue sync to its machines. Requires confirm: true.",
+    mutation: "preview-confirm",
+    http: { method: "POST", path: "/internal/v1/reservations/{reservationId}/ssh-keys" },
+    input: reservationSshKeyAddInput,
+    execute: async (ctx, input) => {
+        const parsed = reservationSshKeyAddInput.parse(input);
+        const body = {
+            user_id: parsed.userId,
+            public_key: parsed.publicKey,
+            ...mapBody(parsed, { label: "label", nodeId: "node_id" }),
+        };
+        if (!ctx.confirmed)
+            return preview("reservation.ssh-key.add", body);
+        return ctx.fetch(`/internal/v1/reservations/${seg(parsed.reservationId)}/ssh-keys`, {
+            method: "POST",
+            body,
+        });
+    },
+});
+export const reservationSshKeyRemoveInput = z.object({
+    reservationId: z.string(),
+    keyId: z.string(),
+    userId: z.string(),
+    nodeId: z.string().optional(),
+    confirm: z.boolean().optional(),
+});
+export const reservationSshKeyRemoveCapability = defineStaffMcpCapability({
+    id: "reservation.ssh-key.remove",
+    domain: "reservations",
+    roles: ["admin"],
+    description: "Internal staff only: remove an SSH key from a reservation and queue cleanup on its machines. Requires confirm: true.",
+    mutation: "preview-confirm",
+    http: { method: "DELETE", path: "/internal/v1/reservations/{reservationId}/ssh-keys/{keyId}" },
+    input: reservationSshKeyRemoveInput,
+    execute: async (ctx, input) => {
+        const parsed = reservationSshKeyRemoveInput.parse(input);
+        const body = {
+            user_id: parsed.userId,
+            ...mapBody(parsed, { nodeId: "node_id" }),
+        };
+        if (!ctx.confirmed)
+            return preview("reservation.ssh-key.remove", body);
+        return ctx.fetch(`/internal/v1/reservations/${seg(parsed.reservationId)}/ssh-keys/${seg(parsed.keyId)}`, { method: "DELETE", body });
+    },
+});
+export const reservationPublishInput = z.object({
+    reservationId: z.string(),
+    confirm: z.boolean().optional(),
+});
+export const reservationPublishCapability = defineStaffMcpCapability({
+    id: "reservation.publish",
+    domain: "reservations",
+    roles: ["admin"],
+    description: "Internal staff only: publish a commerce draft into a live Commerce reservation. Requires confirm: true.",
+    mutation: "preview-confirm",
+    http: { method: "POST", path: "/internal/reservations/{reservationId}/publish" },
+    input: reservationPublishInput,
+    execute: async (ctx, input) => {
+        const parsed = reservationPublishInput.parse(input);
+        if (!ctx.confirmed) {
+            return preview("reservation.publish", { reservationId: parsed.reservationId });
+        }
+        return ctx.fetch(`/internal/reservations/${seg(parsed.reservationId)}/publish`, {
+            method: "POST",
+        });
+    },
+});
+export const bidAcceptInput = z.object({
+    bidId: z.string(),
+    acceptedGpuCount: z.number().int().min(1).optional(),
+    confirm: z.boolean().optional(),
+});
+export const bidAcceptCapability = defineStaffMcpCapability({
+    id: "bid.accept",
+    domain: "bids",
+    roles: ["admin"],
+    description: "Internal staff only: accept an active bid. Optionally set acceptedGpuCount (defaults to the bid's full gpu_count). Mirrors the internal dashboard's Accept action.",
+    mutation: "preview-confirm",
+    http: { method: "POST", path: "/internal/bids/{bidId}/accept" },
+    input: bidAcceptInput,
+    execute: async (ctx, input) => {
+        const parsed = bidAcceptInput.parse(input);
+        const body = mapBody(parsed, { acceptedGpuCount: "accepted_gpu_count" });
+        if (!ctx.confirmed)
+            return preview("bid.accept", { bidId: parsed.bidId, ...body });
+        return ctx.fetch(`/internal/bids/${seg(parsed.bidId)}/accept`, { method: "POST", body });
+    },
+});
+export const bidRejectInput = z.object({
+    bidId: z.string(),
+    confirm: z.boolean().optional(),
+});
+export const bidRejectCapability = defineStaffMcpCapability({
+    id: "bid.reject",
+    domain: "bids",
+    roles: ["admin"],
+    description: "Internal staff only: reject an active bid. Mirrors the internal dashboard's Reject action.",
+    mutation: "preview-confirm",
+    http: { method: "POST", path: "/internal/bids/{bidId}/reject" },
+    input: bidRejectInput,
+    execute: async (ctx, input) => {
+        const parsed = bidRejectInput.parse(input);
+        if (!ctx.confirmed)
+            return preview("bid.reject", { bidId: parsed.bidId });
+        return ctx.fetch(`/internal/bids/${seg(parsed.bidId)}/reject`, { method: "POST" });
+    },
+});
+export const inventoryUpdateInput = z.object({
+    inventoryId: z.string(),
+    siteOperator: z.string().min(1).optional(),
+    siteNickname: z.string().min(1).optional(),
+    gpuType: z.string().min(1).optional(),
+    nodeCount: z
+        .number()
+        .int()
+        .positive()
+        .optional()
+        .describe("Total nodes (listing capacity), not total GPUs."),
+    gpusPerNode: z.number().int().min(1).max(32).optional(),
+    availableFrom: z.string().nullable().optional(),
+    availableTo: z.string().nullable().optional(),
+    availableStartAt: z.string().nullable().optional(),
+    availableEndAt: z.string().nullable().optional(),
+    cpu: z.string().nullable().optional(),
+    ram: z.string().nullable().optional(),
+    fabricType: z.string().nullable().optional(),
+    storage: z.string().nullable().optional(),
+    internet: z.string().nullable().optional(),
+    networkHardware: z.string().nullable().optional(),
+    buyNowPricePerGpuHour: z.number().positive().nullable().optional(),
+    confirm: z.boolean().optional(),
+});
+export const inventoryUpdateCapability = defineStaffMcpCapability({
+    id: "inventory.update",
+    domain: "listings",
+    roles: ["admin"],
+    description: "Internal staff only: patch editable fields on a forward inventory listing. Requires confirm: true. " +
+        "At least one editable field is required. buyNowPricePerGpuHour may be null to clear the price.",
+    mutation: "preview-confirm",
+    http: { method: "PATCH", path: "/inventory/{inventoryId}" },
+    input: inventoryUpdateInput,
+    execute: async (ctx, input) => {
+        const parsed = inventoryUpdateInput.parse(input);
+        const body = mapBody(parsed, {
+            siteOperator: "site_operator",
+            siteNickname: "site_nickname",
+            gpuType: "gpu_type",
+            nodeCount: "node_count",
+            gpusPerNode: "gpus_per_node",
+            availableFrom: "available_from",
+            availableTo: "available_to",
+            availableStartAt: "available_start_at",
+            availableEndAt: "available_end_at",
+            cpu: "cpu",
+            ram: "ram",
+            fabricType: "fabric_type",
+            storage: "storage",
+            internet: "internet",
+            networkHardware: "network_hardware",
+            buyNowPricePerGpuHour: "buy_now_price_per_gpu_hour",
+        });
+        if (!ctx.confirmed)
+            return preview("inventory.update", body);
+        return ctx.fetch(`/inventory/${seg(parsed.inventoryId)}`, { method: "PATCH", body });
+    },
+});
+export const tenantCreditProfileShowInput = z.object({ tenantId: z.string() });
+export const tenantCreditProfileShowCapability = defineStaffMcpCapability({
+    id: "tenant.credit-profile.show",
+    domain: "users",
+    roles: ["reviewer", "admin"],
+    description: "Internal staff only: show a tenant's credit profile, approval status, and onboarding details. Read-only — does not approve or disapprove.",
+    mutation: "read",
+    http: { method: "GET", path: "/internal/organizations/{tenantId}" },
+    input: tenantCreditProfileShowInput,
+    execute: async (ctx, input) => {
+        const parsed = tenantCreditProfileShowInput.parse(input);
+        return ctx.fetch(`/internal/organizations/${seg(parsed.tenantId)}`, { method: "GET" });
+    },
+});
+export const staffCommerceCapabilities = [
+    reservationCancelCapability,
+    reservationTransferCapability,
+    reservationMachinesListCapability,
+    reservationSshKeyAddCapability,
+    reservationSshKeyRemoveCapability,
+    reservationPublishCapability,
+    bidAcceptCapability,
+    bidRejectCapability,
+    inventoryUpdateCapability,
+    tenantCreditProfileShowCapability,
+];

package/vendor/capabilities/capabilities/staff-fleet.d.ts

@@ -0,0 +1,134 @@
+import { z } from "zod";
+export declare const enrollmentTokenRevokeInput: z.ZodObject<{
+    tokenId: z.ZodString;
+    confirm: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strip>;
+export declare const enrollmentTokenRevokeCapability: import("../capability.ts").Capability<unknown, unknown>;
+export declare const operatorCreateInput: z.ZodObject<{
+    slug: z.ZodString;
+    displayName: z.ZodString;
+    mode: z.ZodOptional<z.ZodEnum<{
+        managed: "managed";
+        federated: "federated";
+    }>>;
+    status: z.ZodOptional<z.ZodEnum<{
+        active: "active";
+        unavailable: "unavailable";
+        revoked: "revoked";
+    }>>;
+    confirm: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strip>;
+export declare const operatorCreateCapability: import("../capability.ts").Capability<unknown, unknown>;
+export declare const operatorUpdateInput: z.ZodObject<{
+    operatorId: z.ZodString;
+    displayName: z.ZodOptional<z.ZodString>;
+    slug: z.ZodOptional<z.ZodString>;
+    mode: z.ZodOptional<z.ZodEnum<{
+        managed: "managed";
+        federated: "federated";
+    }>>;
+    status: z.ZodOptional<z.ZodEnum<{
+        active: "active";
+        unavailable: "unavailable";
+        revoked: "revoked";
+    }>>;
+    confirm: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strip>;
+export declare const operatorUpdateCapability: import("../capability.ts").Capability<unknown, unknown>;
+export declare const operatorDeleteInput: z.ZodObject<{
+    operatorId: z.ZodString;
+    confirm: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strip>;
+export declare const operatorDeleteCapability: import("../capability.ts").Capability<unknown, unknown>;
+export declare const facilityCreateInput: z.ZodObject<{
+    operatorId: z.ZodString;
+    slug: z.ZodString;
+    displayName: z.ZodString;
+    region: z.ZodString;
+    zone: z.ZodOptional<z.ZodString>;
+    confirm: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strip>;
+export declare const facilityCreateCapability: import("../capability.ts").Capability<unknown, unknown>;
+export declare const facilityUpdateInput: z.ZodObject<{
+    facilityId: z.ZodString;
+    displayName: z.ZodOptional<z.ZodString>;
+    region: z.ZodOptional<z.ZodString>;
+    zone: z.ZodOptional<z.ZodString>;
+    confirm: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strip>;
+export declare const facilityUpdateCapability: import("../capability.ts").Capability<unknown, unknown>;
+export declare const nodeShowInput: z.ZodObject<{
+    nodeId: z.ZodString;
+}, z.core.$strip>;
+export declare const nodeShowCapability: import("../capability.ts").Capability<unknown, unknown>;
+export declare const nodeDetailsUpdateInput: z.ZodObject<{
+    nodeId: z.ZodString;
+    hostname: z.ZodOptional<z.ZodString>;
+    publicLocation: z.ZodOptional<z.ZodString>;
+    facilityId: z.ZodOptional<z.ZodString>;
+    gpuType: z.ZodOptional<z.ZodString>;
+    gpuCount: z.ZodOptional<z.ZodNumber>;
+    ornnMode: z.ZodOptional<z.ZodString>;
+    cpu: z.ZodOptional<z.ZodString>;
+    ram: z.ZodOptional<z.ZodString>;
+    storage: z.ZodOptional<z.ZodString>;
+    fabricType: z.ZodOptional<z.ZodString>;
+    internet: z.ZodOptional<z.ZodString>;
+    networkHardware: z.ZodOptional<z.ZodString>;
+    buyNowPricePerGpuHour: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+    confirm: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strip>;
+export declare const nodeDetailsUpdateCapability: import("../capability.ts").Capability<unknown, unknown>;
+export declare const nodeTestTriggerInput: z.ZodObject<{
+    nodeId: z.ZodString;
+    burnTimeMinutes: z.ZodOptional<z.ZodNumber>;
+    constraints: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    source: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    confirm: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strip>;
+export declare const nodeTestTriggerCapability: import("../capability.ts").Capability<unknown, unknown>;
+export declare const nodeTestResultInput: z.ZodObject<{
+    nodeId: z.ZodOptional<z.ZodString>;
+    jobId: z.ZodString;
+    packetId: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export declare const nodeTestResultCapability: import("../capability.ts").Capability<unknown, unknown>;
+export declare const nodeBenchmarkInput: z.ZodObject<{
+    nodeId: z.ZodString;
+}, z.core.$strip>;
+export declare const nodeBenchmarkCapability: import("../capability.ts").Capability<unknown, unknown>;
+export declare const nodeDeployInput: z.ZodObject<{
+    nodeId: z.ZodString;
+    targetTenantId: z.ZodString;
+    targetAuthUserId: z.ZodOptional<z.ZodString>;
+    networkMode: z.ZodOptional<z.ZodEnum<{
+        public: "public";
+        private: "private";
+    }>>;
+    notes: z.ZodOptional<z.ZodString>;
+    confirm: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strip>;
+export declare const nodeDeployCapability: import("../capability.ts").Capability<unknown, unknown>;
+export declare const nodeUpdateInput: z.ZodObject<{
+    nodeId: z.ZodString;
+    targetVersion: z.ZodOptional<z.ZodString>;
+    confirm: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strip>;
+export declare const nodeUpdateCapability: import("../capability.ts").Capability<unknown, unknown>;
+export declare const nodeRebootInput: z.ZodObject<{
+    instanceId: z.ZodString;
+    confirm: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strip>;
+export declare const nodeHardResetInput: z.ZodObject<{
+    instanceId: z.ZodString;
+    confirm: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strip>;
+export declare const nodeRebootCapability: import("../capability.ts").Capability<unknown, unknown>;
+export declare const nodeHardResetCapability: import("../capability.ts").Capability<unknown, unknown>;
+export declare const nodeAdminKeyInput: z.ZodObject<{
+    nodeId: z.ZodString;
+    generate: z.ZodOptional<z.ZodBoolean>;
+    confirm: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strip>;
+export declare const nodeAdminKeyCapability: import("../capability.ts").Capability<unknown, unknown>;
+export declare const staffFleetCapabilities: import("../capability.ts").Capability<unknown, unknown>[];

package/vendor/capabilities/capabilities/staff-fleet.js

@@ -0,0 +1,439 @@
+import { z } from "zod";
+import { defineStaffMcpCapability, preview } from "../capability.js";
+import { mapBody, seg } from "./staff-shared.js";
+// Staff fleet verbs: operators, facilities, nodes, node jobs, and enrollment
+// token revocation. MCP-only — see `defineStaffMcpCapability`.
+const slugSchema = z
+    .string()
+    .regex(/^[a-z0-9][a-z0-9-]*$/, "slug must be lowercase alphanumeric with dashes")
+    .max(80);
+const operatorModeSchema = z.enum(["managed", "federated"]);
+const operatorStatusSchema = z.enum(["active", "unavailable", "revoked"]);
+export const enrollmentTokenRevokeInput = z.object({
+    tokenId: z.string(),
+    confirm: z.boolean().optional(),
+});
+export const enrollmentTokenRevokeCapability = defineStaffMcpCapability({
+    id: "enrollment.token.revoke",
+    domain: "fleet",
+    roles: ["admin"],
+    description: "Internal staff only: revoke an enrollment token.",
+    mutation: "preview-confirm",
+    http: { method: "POST", path: "/enrollment/tokens/{tokenId}/revoke" },
+    input: enrollmentTokenRevokeInput,
+    execute: async (ctx, input) => {
+        const parsed = enrollmentTokenRevokeInput.parse(input);
+        if (!ctx.confirmed)
+            return preview("enrollment.token.revoke", { tokenId: parsed.tokenId });
+        return ctx.fetch(`/enrollment/tokens/${seg(parsed.tokenId)}/revoke`, { method: "POST" });
+    },
+});
+export const operatorCreateInput = z.object({
+    slug: slugSchema,
+    displayName: z.string().min(1).max(160),
+    mode: operatorModeSchema.optional(),
+    status: operatorStatusSchema.optional(),
+    confirm: z.boolean().optional(),
+});
+export const operatorCreateCapability = defineStaffMcpCapability({
+    id: "operator.create",
+    domain: "fleet",
+    roles: ["admin"],
+    description: "Internal staff only: create an operator (managed or federated). Requires confirm: true. Does not touch any hardware.",
+    mutation: "preview-confirm",
+    http: { method: "POST", path: "/provisioning/operators" },
+    input: operatorCreateInput,
+    execute: async (ctx, input) => {
+        const parsed = operatorCreateInput.parse(input);
+        const body = {
+            slug: parsed.slug,
+            display_name: parsed.displayName,
+            ...mapBody(parsed, { mode: "mode", status: "status" }),
+        };
+        if (!ctx.confirmed)
+            return preview("operator.create", body);
+        return ctx.fetch("/provisioning/operators", { method: "POST", body });
+    },
+});
+export const operatorUpdateInput = z.object({
+    operatorId: z.string(),
+    displayName: z.string().min(1).max(160).optional(),
+    slug: slugSchema.optional(),
+    mode: operatorModeSchema.optional(),
+    status: operatorStatusSchema.optional(),
+    confirm: z.boolean().optional(),
+});
+export const operatorUpdateCapability = defineStaffMcpCapability({
+    id: "operator.update",
+    domain: "fleet",
+    roles: ["admin"],
+    description: "Internal staff only: update an operator's display name, slug, mode, or status. Requires confirm: true.",
+    mutation: "preview-confirm",
+    http: { method: "PATCH", path: "/provisioning/operators/{operatorId}" },
+    input: operatorUpdateInput,
+    execute: async (ctx, input) => {
+        const parsed = operatorUpdateInput.parse(input);
+        const body = mapBody(parsed, {
+            displayName: "display_name",
+            slug: "slug",
+            mode: "mode",
+            status: "status",
+        });
+        if (!ctx.confirmed)
+            return preview("operator.update", body);
+        return ctx.fetch(`/provisioning/operators/${seg(parsed.operatorId)}`, {
+            method: "PATCH",
+            body,
+        });
+    },
+});
+export const operatorDeleteInput = z.object({
+    operatorId: z.string(),
+    confirm: z.boolean().optional(),
+});
+export const operatorDeleteCapability = defineStaffMcpCapability({
+    id: "operator.delete",
+    domain: "fleet",
+    roles: ["admin"],
+    description: "Internal staff only: delete an operator. Requires confirm: true.",
+    mutation: "preview-confirm",
+    http: { method: "DELETE", path: "/provisioning/operators/{operatorId}" },
+    input: operatorDeleteInput,
+    execute: async (ctx, input) => {
+        const parsed = operatorDeleteInput.parse(input);
+        if (!ctx.confirmed)
+            return preview("operator.delete", { operatorId: parsed.operatorId });
+        return ctx.fetch(`/provisioning/operators/${seg(parsed.operatorId)}`, { method: "DELETE" });
+    },
+});
+export const facilityCreateInput = z.object({
+    operatorId: z.string(),
+    slug: slugSchema,
+    displayName: z.string().min(1).max(160),
+    region: z.string().min(1).max(120),
+    zone: z.string().max(120).optional(),
+    confirm: z.boolean().optional(),
+});
+export const facilityCreateCapability = defineStaffMcpCapability({
+    id: "facility.create",
+    domain: "fleet",
+    roles: ["admin"],
+    description: "Internal staff only: create a facility under an operator. Requires confirm: true. Does not touch any hardware.",
+    mutation: "preview-confirm",
+    http: { method: "POST", path: "/provisioning/facilities" },
+    input: facilityCreateInput,
+    execute: async (ctx, input) => {
+        const parsed = facilityCreateInput.parse(input);
+        const body = {
+            operator_id: parsed.operatorId,
+            slug: parsed.slug,
+            display_name: parsed.displayName,
+            region: parsed.region,
+            zone: parsed.zone ?? null,
+        };
+        if (!ctx.confirmed)
+            return preview("facility.create", body);
+        return ctx.fetch("/provisioning/facilities", { method: "POST", body });
+    },
+});
+export const facilityUpdateInput = z.object({
+    facilityId: z.string(),
+    displayName: z.string().min(1).max(160).optional(),
+    region: z.string().min(1).max(120).optional(),
+    zone: z.string().max(120).optional(),
+    confirm: z.boolean().optional(),
+});
+export const facilityUpdateCapability = defineStaffMcpCapability({
+    id: "facility.update",
+    domain: "fleet",
+    roles: ["admin"],
+    description: "Internal staff only: update a facility's display name, region, or zone. Pass zone as an empty string to clear it. Requires confirm: true.",
+    mutation: "preview-confirm",
+    http: { method: "PATCH", path: "/provisioning/facilities/{facilityId}" },
+    input: facilityUpdateInput,
+    execute: async (ctx, input) => {
+        const parsed = facilityUpdateInput.parse(input);
+        // "" clears zone; omitting it leaves zone unchanged (mirrors the dashboard PATCH).
+        const body = mapBody(parsed, {
+            displayName: "display_name",
+            region: "region",
+            zone: "zone",
+        });
+        if (!ctx.confirmed)
+            return preview("facility.update", body);
+        return ctx.fetch(`/provisioning/facilities/${seg(parsed.facilityId)}`, {
+            method: "PATCH",
+            body,
+        });
+    },
+});
+export const nodeShowInput = z.object({ nodeId: z.string() });
+export const nodeShowCapability = defineStaffMcpCapability({
+    id: "node.show",
+    domain: "fleet",
+    roles: ["reviewer", "admin"],
+    description: "Internal staff only: show details for a single GPU node.",
+    mutation: "read",
+    http: { method: "GET", path: "/internal/nodes/{nodeId}" },
+    input: nodeShowInput,
+    execute: async (ctx, input) => {
+        const parsed = nodeShowInput.parse(input);
+        return ctx.fetch(`/internal/nodes/${seg(parsed.nodeId)}`, { method: "GET" });
+    },
+});
+export const nodeDetailsUpdateInput = z.object({
+    nodeId: z.string(),
+    hostname: z.string().optional(),
+    publicLocation: z.string().optional(),
+    facilityId: z.string().optional(),
+    gpuType: z.string().optional(),
+    gpuCount: z.number().int().positive().optional(),
+    ornnMode: z.string().optional(),
+    cpu: z.string().optional(),
+    ram: z.string().optional(),
+    storage: z.string().optional(),
+    fabricType: z.string().optional(),
+    internet: z.string().optional(),
+    networkHardware: z.string().optional(),
+    buyNowPricePerGpuHour: z.number().nullable().optional(),
+    confirm: z.boolean().optional(),
+});
+export const nodeDetailsUpdateCapability = defineStaffMcpCapability({
+    id: "node.details-update",
+    domain: "fleet",
+    roles: ["admin"],
+    description: "Internal staff only: update core node fields and reserve-listing / spec-sheet values (hostname, location, GPUs, CPU/RAM/storage, buy-now price). Requires confirm: true.",
+    mutation: "preview-confirm",
+    http: { method: "PATCH", path: "/internal/nodes/{nodeId}/details" },
+    input: nodeDetailsUpdateInput,
+    execute: async (ctx, input) => {
+        const parsed = nodeDetailsUpdateInput.parse(input);
+        // Backend confirm is required for risky edits on reserved nodes; the caller's
+        // confirm already gated execution, so always send confirm: true on the wire.
+        const body = {
+            confirm: true,
+            ...mapBody(parsed, {
+                hostname: "hostname",
+                publicLocation: "public_location",
+                facilityId: "facility_id",
+                gpuType: "gpu_type",
+                gpuCount: "gpu_count",
+                ornnMode: "ornn_mode",
+                cpu: "cpu",
+                ram: "ram",
+                storage: "storage",
+                fabricType: "fabric_type",
+                internet: "internet",
+                networkHardware: "network_hardware",
+                buyNowPricePerGpuHour: "buy_now_price_per_gpu_hour",
+            }),
+        };
+        if (!ctx.confirmed)
+            return preview("node.details-update", body);
+        return ctx.fetch(`/internal/nodes/${seg(parsed.nodeId)}/details`, { method: "PATCH", body });
+    },
+});
+export const nodeTestTriggerInput = z.object({
+    nodeId: z.string(),
+    burnTimeMinutes: z.number().optional(),
+    constraints: z.record(z.string(), z.unknown()).optional(),
+    source: z.record(z.string(), z.unknown()).optional(),
+    confirm: z.boolean().optional(),
+});
+export const nodeTestTriggerCapability = defineStaffMcpCapability({
+    id: "node.test-trigger",
+    domain: "fleet",
+    roles: ["admin"],
+    description: "Internal staff only: start a node job (host checks + GPU suites; optional burn-in minutes). Requires confirm: true.",
+    mutation: "preview-confirm",
+    http: { method: "POST", path: "/jobs" },
+    input: nodeTestTriggerInput,
+    execute: async (ctx, input) => {
+        const parsed = nodeTestTriggerInput.parse(input);
+        let constraints = { ...(parsed.constraints ?? {}) };
+        if (parsed.burnTimeMinutes !== undefined) {
+            constraints = {
+                ...constraints,
+                burn_time_minutes: parsed.burnTimeMinutes,
+                include_burn_samples: true,
+            };
+        }
+        const body = {
+            node_id: parsed.nodeId,
+            constraints,
+            source: parsed.source ?? { mode: "no_spec" },
+            burn_time_minutes: parsed.burnTimeMinutes ?? 0,
+        };
+        if (!ctx.confirmed)
+            return preview("node.test-trigger", body);
+        return ctx.fetch("/jobs", { method: "POST", body });
+    },
+});
+export const nodeTestResultInput = z.object({
+    nodeId: z.string().optional(),
+    jobId: z.string(),
+    packetId: z.string().optional(),
+});
+export const nodeTestResultCapability = defineStaffMcpCapability({
+    id: "node.test-result",
+    domain: "fleet",
+    roles: ["reviewer", "admin"],
+    description: "Internal staff only: fetch a node job by id.",
+    mutation: "read",
+    http: { method: "GET", path: "/jobs/{jobId}" },
+    input: nodeTestResultInput,
+    execute: async (ctx, input) => {
+        const parsed = nodeTestResultInput.parse(input);
+        return ctx.fetch(`/jobs/${seg(parsed.jobId)}`, { method: "GET" });
+    },
+});
+export const nodeBenchmarkInput = z.object({ nodeId: z.string() });
+export const nodeBenchmarkCapability = defineStaffMcpCapability({
+    id: "node.benchmark",
+    domain: "fleet",
+    roles: ["reviewer", "admin"],
+    description: "Internal staff only: show the current burn-in / benchmark summary for a GPU node.",
+    mutation: "read",
+    http: { method: "GET", path: "/jobs" },
+    input: nodeBenchmarkInput,
+    execute: async (ctx, input) => {
+        const parsed = nodeBenchmarkInput.parse(input);
+        return ctx.fetch(`/jobs?node_id=${seg(parsed.nodeId)}`, { method: "GET" });
+    },
+});
+export const nodeDeployInput = z.object({
+    nodeId: z.string(),
+    targetTenantId: z.string(),
+    targetAuthUserId: z.string().optional(),
+    networkMode: z.enum(["public", "private"]).optional(),
+    notes: z.string().max(2000).optional(),
+    confirm: z.boolean().optional(),
+});
+export const nodeDeployCapability = defineStaffMcpCapability({
+    id: "node.deploy",
+    domain: "fleet",
+    roles: ["admin"],
+    description: "Internal staff only: deploy a free GPU node to a target tenant (create reservation + queue handoff). Does not accept a force override. Requires confirm: true.",
+    mutation: "preview-confirm",
+    http: { method: "POST", path: "/internal/nodes/{nodeId}/deploy" },
+    input: nodeDeployInput,
+    execute: async (ctx, input) => {
+        const parsed = nodeDeployInput.parse(input);
+        const body = {
+            target_tenant_id: parsed.targetTenantId,
+            ...mapBody(parsed, {
+                targetAuthUserId: "target_auth_user_id",
+                networkMode: "network_mode",
+                notes: "notes",
+            }),
+        };
+        if (!ctx.confirmed)
+            return preview("node.deploy", body);
+        return ctx.fetch(`/internal/nodes/${seg(parsed.nodeId)}/deploy`, { method: "POST", body });
+    },
+});
+export const nodeUpdateInput = z.object({
+    nodeId: z.string(),
+    targetVersion: z.string().optional(),
+    confirm: z.boolean().optional(),
+});
+export const nodeUpdateCapability = defineStaffMcpCapability({
+    id: "node.update",
+    domain: "fleet",
+    roles: ["admin"],
+    description: "Internal staff only: write the desired ornn-node version on the host row. Does not accept a force override. Requires confirm: true.",
+    mutation: "preview-confirm",
+    http: { method: "PATCH", path: "/internal/nodes/{nodeId}" },
+    input: nodeUpdateInput,
+    execute: async (ctx, input) => {
+        const parsed = nodeUpdateInput.parse(input);
+        const body = mapBody(parsed, { targetVersion: "desired_agent_version" });
+        if (!ctx.confirmed)
+            return preview("node.update", body);
+        return ctx.fetch(`/internal/nodes/${seg(parsed.nodeId)}`, { method: "PATCH", body });
+    },
+});
+const machineRebootInput = z.object({
+    instanceId: z.string(),
+    confirm: z.boolean().optional(),
+});
+export const nodeRebootInput = machineRebootInput;
+export const nodeHardResetInput = machineRebootInput;
+/**
+ * Reboot and hard-reset share one orchestrator endpoint and differ only by
+ * `mode`, but they stay separate verbs: "wipe the host" must never be one
+ * mistyped argument away from "restart the host".
+ */
+function rebootCapability(options) {
+    return defineStaffMcpCapability({
+        id: options.id,
+        domain: "fleet",
+        roles: ["admin"],
+        description: options.description,
+        mutation: "preview-confirm",
+        http: { method: "POST", path: "/internal/nodes/{instanceId}/reboot" },
+        input: machineRebootInput,
+        execute: async (ctx, input) => {
+            const parsed = machineRebootInput.parse(input);
+            const body = { mode: options.mode };
+            if (!ctx.confirmed)
+                return preview(options.id, { instanceId: parsed.instanceId, ...body });
+            return ctx.fetch(`/internal/nodes/${seg(parsed.instanceId)}/reboot`, {
+                method: "POST",
+                body,
+            });
+        },
+    });
+}
+export const nodeRebootCapability = rebootCapability({
+    id: "node.reboot",
+    mode: "reboot",
+    description: "Internal staff only: reboot a live machine (a node's running instance). Plain OS reboot -- keeps storage and SSH keys. Address the machine by its instance id (see ornn_admin_reservation_machines_list). Requires confirm: true.",
+});
+export const nodeHardResetCapability = rebootCapability({
+    id: "node.hard-reset",
+    mode: "hard_reset",
+    description: "Internal staff only: hard-reset a live machine (a node's running instance) -- clean the host (wipe tenant storage, users, keys, caches) then reboot. This does NOT restore SSH access; after the reset completes, run ornn_admin_ssh_key_push to re-push the reservation's organization SSH keys. The tenant KEEPS ownership. Address the machine by its instance id (see ornn_admin_reservation_machines_list). Requires confirm: true.",
+});
+export const nodeAdminKeyInput = z.object({
+    nodeId: z.string(),
+    generate: z.boolean().optional(),
+    confirm: z.boolean().optional(),
+});
+export const nodeAdminKeyCapability = defineStaffMcpCapability({
+    id: "node.admin-key",
+    domain: "fleet",
+    roles: ["admin"],
+    description: "Internal staff only: fetch the Ornn admin SSH keypair for a GPU node, including the decrypted PRIVATE key, so an operator can SSH into the host directly. Handle the private key as a secret. Set generate: true (requires confirm: true) to mint a new pair and install the public key on the live host.",
+    // Reading the stored pair is a GET; minting a new one is the same path as a POST.
+    mutation: "preview-confirm",
+    http: { method: "GET", path: "/enrollment/admin-ssh-key" },
+    input: nodeAdminKeyInput,
+    execute: async (ctx, input) => {
+        const parsed = nodeAdminKeyInput.parse(input);
+        if (parsed.generate && !ctx.confirmed) {
+            return preview("node.admin-key", { nodeId: parsed.nodeId, generate: true });
+        }
+        return ctx.fetch(`/enrollment/admin-ssh-key?node_id=${seg(parsed.nodeId)}`, {
+            method: parsed.generate ? "POST" : "GET",
+        });
+    },
+});
+export const staffFleetCapabilities = [
+    enrollmentTokenRevokeCapability,
+    operatorCreateCapability,
+    operatorUpdateCapability,
+    operatorDeleteCapability,
+    facilityCreateCapability,
+    facilityUpdateCapability,
+    nodeShowCapability,
+    nodeDetailsUpdateCapability,
+    nodeTestTriggerCapability,
+    nodeTestResultCapability,
+    nodeBenchmarkCapability,
+    nodeDeployCapability,
+    nodeUpdateCapability,
+    nodeRebootCapability,
+    nodeHardResetCapability,
+    nodeAdminKeyCapability,
+];

package/vendor/capabilities/capabilities/staff-shared.d.ts

@@ -0,0 +1,18 @@
+/** Helpers shared by the staff MCP verbs in `staff-*.ts`. */
+/**
+ * Build a request body from the fields that were actually supplied.
+ *
+ * Staff writes are almost all "PATCH the fields the caller named": `undefined`
+ * means leave alone, and `null` is a real value that clears the field. So the
+ * check is `!== undefined`, never truthiness.
+ */
+export declare function mapBody(input: Record<string, unknown>, mapping: Record<string, string>): Record<string, unknown>;
+/** Path segment escape. */
+export declare function seg(value: string): string;
+/**
+ * A transport failure's HTTP status, when it carries one.
+ *
+ * Capabilities cannot import a surface's error class (`apps/mcp`'s
+ * `WebApiError`, say), so read the status structurally.
+ */
+export declare function statusOf(error: unknown): number | undefined;

package/vendor/capabilities/capabilities/staff-shared.js

@@ -0,0 +1,34 @@
+/** Helpers shared by the staff MCP verbs in `staff-*.ts`. */
+/**
+ * Build a request body from the fields that were actually supplied.
+ *
+ * Staff writes are almost all "PATCH the fields the caller named": `undefined`
+ * means leave alone, and `null` is a real value that clears the field. So the
+ * check is `!== undefined`, never truthiness.
+ */
+export function mapBody(input, mapping) {
+    const body = {};
+    for (const [field, wire] of Object.entries(mapping)) {
+        if (input[field] !== undefined)
+            body[wire] = input[field];
+    }
+    return body;
+}
+/** Path segment escape. */
+export function seg(value) {
+    return encodeURIComponent(value);
+}
+/**
+ * A transport failure's HTTP status, when it carries one.
+ *
+ * Capabilities cannot import a surface's error class (`apps/mcp`'s
+ * `WebApiError`, say), so read the status structurally.
+ */
+export function statusOf(error) {
+    if (error && typeof error === "object" && "status" in error) {
+        const status = error.status;
+        if (typeof status === "number")
+            return status;
+    }
+    return undefined;
+}

package/vendor/capabilities/capability.d.ts

@@ -71,6 +71,20 @@ export type CapabilitySpec<I = unknown, O = unknown> = Omit<Capability<I, O>, "c
 };
 /** Fill CLI/MCP/Slack names from `id`. Slack parameters stay optional. */
 export declare function defineCapability<I, O>(spec: CapabilitySpec<I, O>): Capability;
+/** A staff verb that only MCP dispatches: an MCP name, no Slack or CLI binding. */
+export type StaffMcpCapabilitySpec<I = unknown, O = unknown> = Omit<CapabilitySpec<I, O>, "slack">;
+/**
+ * Fill only the MCP name from `id`.
+ *
+ * `visibleToClient` gates Slack on `capability.slack != null` and CLI on
+ * `capability.cli != null`, so omitting a binding is how the catalog already
+ * says "not on that surface" — `defineCapability` just happens to set all
+ * three unconditionally. Staff admin verbs need the MCP one only: Slack's
+ * staff surface is a deliberately small, human-confirmed set, and `apps/cli`
+ * writes each command by hand, so a CLI binding here would advertise a
+ * command that does not exist.
+ */
+export declare function defineStaffMcpCapability<I, O>(spec: StaffMcpCapabilitySpec<I, O>): Capability;
 export declare function slackStaffVisible(capability: Pick<Capability, "roles">): boolean;
 export declare function visibleToClient(capability: Pick<Capability, "roles" | "cli" | "mcp" | "slack">, client: ClientKind, role: Role): boolean;
 export declare function forRole(catalog: readonly Capability[], role: Role, client: ClientKind): Capability[];

package/vendor/capabilities/capability.js

@@ -41,6 +41,20 @@ export function defineCapability(spec) {
         },
     };
 }
+/**
+ * Fill only the MCP name from `id`.
+ *
+ * `visibleToClient` gates Slack on `capability.slack != null` and CLI on
+ * `capability.cli != null`, so omitting a binding is how the catalog already
+ * says "not on that surface" — `defineCapability` just happens to set all
+ * three unconditionally. Staff admin verbs need the MCP one only: Slack's
+ * staff surface is a deliberately small, human-confirmed set, and `apps/cli`
+ * writes each command by hand, so a CLI binding here would advertise a
+ * command that does not exist.
+ */
+export function defineStaffMcpCapability(spec) {
+    return { ...spec, mcp: { name: namesFromId(spec.id).mcp } };
+}
 export function slackStaffVisible(capability) {
     return capability.roles.some((role) => role === "reviewer" || role === "admin");
 }

package/vendor/capabilities/catalog.js

@@ -4,6 +4,9 @@ import { tokenCapabilities } from "./capabilities/tokens.js";
 import { identityCapabilities } from "./capabilities/identity.js";
 import { listingCapabilities } from "./capabilities/listings.js";
 import { observabilityCapabilities } from "./capabilities/observability.js";
+import { staffAccessCapabilities } from "./capabilities/staff-access.js";
+import { staffCommerceCapabilities } from "./capabilities/staff-commerce.js";
+import { staffFleetCapabilities } from "./capabilities/staff-fleet.js";
 import { userCapabilities } from "./capabilities/users.js";
 /** System of record for CLI, MCP, and Slack verbs. Add capabilities here. */
 export const catalog = [
@@ -15,4 +18,7 @@ export const catalog = [
     ...observabilityCapabilities,
     ...slurmCapabilities,
     ...kubernetesCapabilities,
+    ...staffFleetCapabilities,
+    ...staffCommerceCapabilities,
+    ...staffAccessCapabilities,
 ];

package/vendor/capabilities/index.d.ts

@@ -1,4 +1,4 @@
-export { byCliCommand, byMcpName, bySlackName, defineCapability, forRole, preview, slackStaffVisible, visibleToClient, type Capability, type CapabilityBindings, type CapabilityContext, type CapabilitySpec, type JsonSchema, type CapabilityTransport, type Domain, type HttpSpec, type Mutation, type PreviewResult, } from "./capability.ts";
+export { byCliCommand, byMcpName, bySlackName, defineCapability, defineStaffMcpCapability, forRole, preview, slackStaffVisible, visibleToClient, type Capability, type CapabilityBindings, type CapabilityContext, type CapabilitySpec, type StaffMcpCapabilitySpec, type JsonSchema, type CapabilityTransport, type Domain, type HttpSpec, type Mutation, type PreviewResult, } from "./capability.ts";
 export { namesFromId } from "./names.ts";
 export { catalog } from "./catalog.ts";
 export { fleetCapabilities, listFacilitiesCapability, listNodesCapability, listOperatorsCapability, nodeExecCapability, nodeOffGridCapability, nodeOnGridCapability, nodeTerminateCapability, } from "./capabilities/fleet.ts";
@@ -8,5 +8,8 @@ export { createListingCapability, listingCreateInput, listCatalogTermsCapability
 export { userCapabilities, usersQueryCapability } from "./capabilities/users.ts";
 export { kubernetesCapabilities, slurmCapabilities } from "./capabilities/clusters.ts";
 export { logsLatestCapability, logsTailCapability, observabilityCapabilities, telemetryLatestCapability, telemetryTailCapability, } from "./capabilities/observability.ts";
+export { enrollmentTokenRevokeCapability, enrollmentTokenRevokeInput, facilityCreateCapability, facilityCreateInput, facilityUpdateCapability, facilityUpdateInput, nodeAdminKeyCapability, nodeAdminKeyInput, nodeBenchmarkCapability, nodeBenchmarkInput, nodeDeployCapability, nodeDeployInput, nodeDetailsUpdateCapability, nodeDetailsUpdateInput, nodeHardResetCapability, nodeHardResetInput, nodeRebootCapability, nodeRebootInput, nodeShowCapability, nodeShowInput, nodeTestResultCapability, nodeTestResultInput, nodeTestTriggerCapability, nodeTestTriggerInput, nodeUpdateCapability, nodeUpdateInput, operatorCreateCapability, operatorCreateInput, operatorDeleteCapability, operatorDeleteInput, operatorUpdateCapability, operatorUpdateInput, staffFleetCapabilities, } from "./capabilities/staff-fleet.ts";
+export { bidAcceptCapability, bidAcceptInput, bidRejectCapability, bidRejectInput, inventoryUpdateCapability, inventoryUpdateInput, reservationCancelCapability, reservationCancelInput, reservationMachinesListCapability, reservationMachinesListInput, reservationPublishCapability, reservationPublishInput, reservationSshKeyAddCapability, reservationSshKeyAddInput, reservationSshKeyRemoveCapability, reservationSshKeyRemoveInput, reservationTransferCapability, reservationTransferInput, staffCommerceCapabilities, tenantCreditProfileShowCapability, tenantCreditProfileShowInput, } from "./capabilities/staff-commerce.ts";
+export { sshKeyAddCapability, sshKeyAddInput, sshKeyPushCapability, sshKeyPushInput, sshKeyRevokeCapability, sshKeyRevokeInput, staffAccessCapabilities, } from "./capabilities/staff-access.ts";
 export { CLIENTS, parseRole, roleAtLeast, ROLES, type ClientKind, type Role } from "./role.ts";
 export { bindHardwareFields, HARDWARE_CATALOG_PATH, HARDWARE_KINDS, HARDWARE_LISTING_FIELDS, HARDWARE_LISTING_FILTERS, loadHardwareCatalog, looksLikeSpecDump, normalizeCatalogQuery, parseHardwareCatalog, projectCatalogTerms, proposeListingPayload, resolveCatalogTerm, UNRESOLVED_CATALOG_HINT, type CatalogBindResult, type CatalogTerm, type HardwareCatalog, type HardwareKind, type ResolvedCatalogTerm, } from "./spec-catalog.ts";

package/vendor/capabilities/index.js

@@ -1,4 +1,4 @@
-export { byCliCommand, byMcpName, bySlackName, defineCapability, forRole, preview, slackStaffVisible, visibleToClient, } from "./capability.js";
+export { byCliCommand, byMcpName, bySlackName, defineCapability, defineStaffMcpCapability, forRole, preview, slackStaffVisible, visibleToClient, } from "./capability.js";
 export { namesFromId } from "./names.js";
 export { catalog } from "./catalog.js";
 export { fleetCapabilities, listFacilitiesCapability, listNodesCapability, listOperatorsCapability, nodeExecCapability, nodeOffGridCapability, nodeOnGridCapability, nodeTerminateCapability, } from "./capabilities/fleet.js";
@@ -8,5 +8,8 @@ export { createListingCapability, listingCreateInput, listCatalogTermsCapability
 export { userCapabilities, usersQueryCapability } from "./capabilities/users.js";
 export { kubernetesCapabilities, slurmCapabilities } from "./capabilities/clusters.js";
 export { logsLatestCapability, logsTailCapability, observabilityCapabilities, telemetryLatestCapability, telemetryTailCapability, } from "./capabilities/observability.js";
+export { enrollmentTokenRevokeCapability, enrollmentTokenRevokeInput, facilityCreateCapability, facilityCreateInput, facilityUpdateCapability, facilityUpdateInput, nodeAdminKeyCapability, nodeAdminKeyInput, nodeBenchmarkCapability, nodeBenchmarkInput, nodeDeployCapability, nodeDeployInput, nodeDetailsUpdateCapability, nodeDetailsUpdateInput, nodeHardResetCapability, nodeHardResetInput, nodeRebootCapability, nodeRebootInput, nodeShowCapability, nodeShowInput, nodeTestResultCapability, nodeTestResultInput, nodeTestTriggerCapability, nodeTestTriggerInput, nodeUpdateCapability, nodeUpdateInput, operatorCreateCapability, operatorCreateInput, operatorDeleteCapability, operatorDeleteInput, operatorUpdateCapability, operatorUpdateInput, staffFleetCapabilities, } from "./capabilities/staff-fleet.js";
+export { bidAcceptCapability, bidAcceptInput, bidRejectCapability, bidRejectInput, inventoryUpdateCapability, inventoryUpdateInput, reservationCancelCapability, reservationCancelInput, reservationMachinesListCapability, reservationMachinesListInput, reservationPublishCapability, reservationPublishInput, reservationSshKeyAddCapability, reservationSshKeyAddInput, reservationSshKeyRemoveCapability, reservationSshKeyRemoveInput, reservationTransferCapability, reservationTransferInput, staffCommerceCapabilities, tenantCreditProfileShowCapability, tenantCreditProfileShowInput, } from "./capabilities/staff-commerce.js";
+export { sshKeyAddCapability, sshKeyAddInput, sshKeyPushCapability, sshKeyPushInput, sshKeyRevokeCapability, sshKeyRevokeInput, staffAccessCapabilities, } from "./capabilities/staff-access.js";
 export { CLIENTS, parseRole, roleAtLeast, ROLES } from "./role.js";
 export { bindHardwareFields, HARDWARE_CATALOG_PATH, HARDWARE_KINDS, HARDWARE_LISTING_FIELDS, HARDWARE_LISTING_FILTERS, loadHardwareCatalog, looksLikeSpecDump, normalizeCatalogQuery, parseHardwareCatalog, projectCatalogTerms, proposeListingPayload, resolveCatalogTerm, UNRESOLVED_CATALOG_HINT, } from "./spec-catalog.js";