@ornncompute/cli 1.0.109 → 1.0.112

package/README.md

@@ -78,6 +78,10 @@ market           books | book | trades | bid | orders | cancel
 offers           list | post | accept | cancel
 machines         list | show | wait | switch | reboot | reset | metrics | logs
 clusters         list | show | wait | eligible-machines | add-node | remove-node | teardown | metrics | logs
+registry         login | show | usage
+registry repositories  list
+registry tags    list | delete
+registry copies  list
 ssh-keys         list | add | delete
 ssh-keys assignments  list | assign | sync | status
 private-networks      list | show | create | update | delete
@@ -125,6 +129,9 @@ billing stay in the web app. Launch consumes already allocated
 capacity; internal reservation lookups remain necessary for access and
 ownership.
 
+Where upfront card checkout is enabled, complete Fixed term purchases in the
+console to review the full price and finish any bank verification.
+
 Only admins can create primary listings or reservations through
 `ornn admin capacity-offers create` and `ornn admin reservations create`.
 They post to the role-aware `POST /commerce/v2/listings` and Markets
@@ -458,8 +465,8 @@ request conflicts, and an expired incomplete request requires a new key.
 The upload replay contract requires the matching gateway/orchestrator release;
 see [the service contract](../../services/orchestrator/README.md#file-upload-replay-and-usage).
 
-Staff can use `ornn admin ssh <node-id>` for certificate access on explicitly
-opted-in nodes. It requires an interactive staff login, creates a temporary
+Staff can use `ornn admin ssh <node-id>` for certificate access on nodes that trust
+the environment's SSH CA. It requires an interactive staff login, creates a temporary
 local key, obtains a 15-minute certificate through the gateway and launches
 OpenSSH with normal host-key verification. Temporary files are removed when
 the command exits. Shared and per-node key access remain available.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ornncompute/cli",
-  "version": "1.0.109",
+  "version": "1.0.112",
   "description": "Command-line interface for Ornn compute access workflows.",
   "type": "module",
   "bin": {

package/src/catalog-shell.mjs

@@ -37,6 +37,7 @@ import {
   writeExternalBucketResultHuman,
 } from "./external-bucket-commands.mjs";
 import { executeEvidenceCommand, supplierOwnedRecord } from "./evidence-commands.mjs";
+import { executeRegistryCommand } from "./registry-commands.mjs";
 import {
   executeKubernetesClusterCommand,
   kubernetesConnectModeHandler,
@@ -958,6 +959,13 @@ async function executeCapability(
                 interaction: this,
               });
             },
+            registry(command, registryInput) {
+              return executeRegistryCommand(command, registryInput, {
+                fetch: (path, init) => customerCapabilityFetch(io, path, init, authSnapshot),
+                interaction: this,
+                spawnProcess: io.spawnProcess,
+              });
+            },
             storage(command, storageInput) {
               return executeStorageCommand(command, storageInput, {
                 env: io.env,

package/src/registry-commands.mjs

@@ -0,0 +1,96 @@
+import { spawn as spawnProcessDefault } from "node:child_process";
+import os from "node:os";
+
+/** One key per machine: a new login revokes the key this machine's last one made. */
+const KEY_NAME_PREFIX = "Docker login on ";
+
+export async function executeRegistryCommand(command, input, runtime) {
+  if (command !== "registry.login") {
+    runtime.interaction.error("Unknown registry command.", { code: "unknown_command" });
+  }
+  return login(runtime);
+}
+
+async function login({
+  fetch,
+  interaction,
+  spawnProcess = spawnProcessDefault,
+  hostname = os.hostname(),
+}) {
+  const registry = await fetch("/v1/orchestrator/registry");
+  const session = await fetch("/v1/cli/session");
+  const organizationId = (session?.selectedOrganization ?? session?.selected_organization)?.id;
+  if (typeof organizationId !== "string" || !organizationId) {
+    interaction.usage("Join an organization before logging in to its registry.", {
+      code: "organization_required",
+      field: "organization",
+    });
+  }
+  const keysPath = `/v1/organizations/${encodeURIComponent(organizationId)}/api-keys`;
+  const name = `${KEY_NAME_PREFIX}${hostname}`.slice(0, 100);
+
+  const existing = await fetch(keysPath);
+  for (const key of existing?.api_keys ?? []) {
+    if (key?.name === name && typeof key.id === "string") {
+      await fetch(`${keysPath}/${encodeURIComponent(key.id)}`, { method: "DELETE" });
+    }
+  }
+  const created = await fetch(keysPath, {
+    method: "POST",
+    body: { name, access: "read_write" },
+  });
+
+  let exit;
+  try {
+    exit = await dockerLogin(spawnProcess, registry.host, created.token);
+  } catch (error) {
+    await fetch(`${keysPath}/${encodeURIComponent(created.id)}`, { method: "DELETE" });
+    const missing = error?.code === "ENOENT";
+    interaction.error(
+      missing
+        ? "Docker is not installed, or `docker` is not on your PATH. Install Docker and run ornn registry login again."
+        : `Docker could not be started: ${error?.message ?? error}`,
+      { code: missing ? "docker_not_found" : "docker_unavailable", exitCode: 6 }
+    );
+  }
+  if (exit.code !== 0) {
+    await fetch(`${keysPath}/${encodeURIComponent(created.id)}`, { method: "DELETE" });
+    interaction.error(`docker login ${registry.host} failed; no key was kept.`, {
+      code: "docker_login_failed",
+      exitCode: 1,
+      retryable: true,
+    });
+  }
+
+  return interaction.result({
+    data: {
+      host: registry.host,
+      namespace: registry.namespace,
+      api_key: { id: created.id, name: created.name },
+    },
+    presentation: {
+      lines: [
+        `Logged in to ${registry.host}.`,
+        `Push images under ${registry.host}/${registry.namespace}/<name>:<tag>.`,
+      ],
+    },
+  });
+}
+
+/** `docker login --password-stdin`: the key never reaches argv or the shell history. */
+function dockerLogin(spawnProcess, host, token) {
+  return new Promise((resolve, reject) => {
+    let child;
+    try {
+      child = spawnProcess("docker", ["login", host, "--username", "ornn", "--password-stdin"], {
+        stdio: ["pipe", "inherit", "inherit"],
+      });
+    } catch (error) {
+      reject(error);
+      return;
+    }
+    child.once("error", reject);
+    child.once("exit", (code, signal) => resolve({ code: signal ? 1 : code, signal }));
+    child.stdin.end(token);
+  });
+}

package/vendor/capabilities/cli.js

@@ -72,7 +72,7 @@ var adminSshCapability = defineCapability({
       audience: "admin",
       category: "journey",
       arguments: "semantic",
-      outcome: "Open an SSH session to one opted-in node with a 15-minute certificate.",
+      outcome: "Open an SSH session to a node that trusts the SSH CA with a 15-minute certificate.",
       human: "ornn admin ssh <node-id>",
       automation: "Requires an interactive terminal."
     }
@@ -6852,15 +6852,347 @@ var networkVerbCapabilities = [
   })
 ];
 
-// ../../packages/capabilities/dist/capabilities/reservation-list.js
+// ../../packages/capabilities/dist/capabilities/registry.js
 import { z as z28 } from "zod";
-var reservationListInput = z28.object({
-  customerId: z28.string().uuid().optional(),
-  listingId: z28.string().uuid().optional(),
-  listingTermId: z28.string().uuid().optional(),
-  status: z28.enum(["confirmed", "active", "completed", "cancelled"]).optional(),
-  cursor: z28.string().optional(),
-  limit: z28.number().int().min(1).max(100).optional()
+var REGISTRY_PATH = "/v1/orchestrator/registry";
+var globalInput2 = {
+  $positionals: z28.array(z28.string()).default([]),
+  yes: z28.boolean().optional()
+};
+var emptyInput4 = z28.object(globalInput2).strict();
+var repositoryInput = z28.object({
+  ...globalInput2,
+  repository: z28.string().optional().describe("Repository name, with or without your organization's namespace.")
+}).strict();
+var tagInput = z28.object({
+  ...globalInput2,
+  repository: z28.string().optional().describe("Repository name, with or without your organization's namespace."),
+  tag: z28.string().optional().describe("Tag to delete, such as v1.")
+}).strict();
+function cliInteraction(context) {
+  return context.cli?.interaction;
+}
+function qualifiedRepository(value, registry) {
+  let name = value.trim();
+  if (name.startsWith(`${registry.host}/`))
+    name = name.slice(registry.host.length + 1);
+  return name.startsWith(`${registry.namespace}/`) ? name : `${registry.namespace}/${name}`;
+}
+function shortName(repository, registry) {
+  return repository.startsWith(`${registry.namespace}/`) ? repository.slice(registry.namespace.length + 1) : repository;
+}
+function formatBytes(bytes) {
+  const units = ["B", "KB", "MB", "GB", "TB"];
+  let value = bytes;
+  let unit = 0;
+  while (value >= 1024 && unit < units.length - 1) {
+    value /= 1024;
+    unit += 1;
+  }
+  return `${value >= 10 || unit === 0 ? Math.round(value) : value.toFixed(1)} ${units[unit]}`;
+}
+async function registryOf(context) {
+  return await context.fetch(REGISTRY_PATH, { method: "GET" });
+}
+function repositoryArgument(input, interaction2) {
+  const raw = input.repository ?? input.$positionals[0];
+  if (!raw) {
+    const message = "Name a repository, such as trainer.";
+    if (interaction2)
+      interaction2.usage(message, { code: "repository_required", field: "repository" });
+    throw new Error(message);
+  }
+  const reference = raw.trim();
+  const slash = reference.lastIndexOf("/");
+  const colon = reference.lastIndexOf(":");
+  if (colon > slash) {
+    return { repository: reference.slice(0, colon), tag: input.tag ?? reference.slice(colon + 1) };
+  }
+  return { repository: reference, tag: input.tag ?? input.$positionals[1] };
+}
+var registryShowCapability = defineCapability({
+  id: "registry.show",
+  domain: "registry",
+  roles: ["user"],
+  description: "Show the organization's container registry: the host to docker login to and the namespace every image is pushed under.",
+  mutation: "read",
+  http: { method: "GET", path: REGISTRY_PATH },
+  input: emptyInput4,
+  cli: {
+    command: ["registry", "show"],
+    vnext: {
+      audience: "customer",
+      category: "resource",
+      order: 600,
+      outcome: "Show where your organization pushes container images.",
+      human: "ornn registry show",
+      automation: "ornn registry show --format json",
+      related: ["registry login", "registry repositories list"]
+    }
+  },
+  slack: false,
+  execute: async (context) => {
+    const registry = await registryOf(context);
+    const interaction2 = cliInteraction(context);
+    if (!interaction2)
+      return registry;
+    return interaction2.result({
+      data: registry,
+      presentation: {
+        lines: [`Image prefix: ${registry.host}/${registry.namespace}`],
+        next: "ornn registry login"
+      }
+    });
+  }
+});
+var registryRepositoriesListCapability = defineCapability({
+  id: "registry.repositories.list",
+  domain: "registry",
+  roles: ["user"],
+  description: "List the repositories in the organization's container registry that have a tag.",
+  mutation: "read",
+  http: { method: "GET", path: `${REGISTRY_PATH}/repositories` },
+  input: emptyInput4,
+  cli: {
+    command: ["registry", "repositories", "list"],
+    vnext: {
+      audience: "customer",
+      category: "resource",
+      order: 601,
+      outcome: "List the repositories your organization has pushed.",
+      human: "ornn registry repositories list",
+      automation: "ornn registry repositories list --format json",
+      related: ["registry tags list", "registry show"]
+    }
+  },
+  slack: false,
+  execute: async (context) => {
+    const listed = await context.fetch(`${REGISTRY_PATH}/repositories`, { method: "GET" });
+    const interaction2 = cliInteraction(context);
+    if (!interaction2)
+      return listed;
+    const registry = await registryOf(context);
+    return interaction2.result({
+      data: listed,
+      presentation: {
+        lines: listed.repositories.length ? listed.repositories.map((repository) => `${shortName(repository.name, registry)}  ${repository.tag_count} ${repository.tag_count === 1 ? "tag" : "tags"}`) : ["No images yet. Push one with docker push after ornn registry login."]
+      }
+    });
+  }
+});
+var registryTagsListCapability = defineCapability({
+  id: "registry.tags.list",
+  domain: "registry",
+  roles: ["user"],
+  description: "List one repository's tags with the digest each names, the bytes the image occupies, and when it was built.",
+  mutation: "read",
+  http: { method: "GET", path: `${REGISTRY_PATH}/tags` },
+  input: repositoryInput,
+  cli: {
+    command: ["registry", "tags", "list"],
+    vnext: {
+      arguments: "semantic",
+      audience: "customer",
+      category: "resource",
+      order: 602,
+      outcome: "List a repository's tags.",
+      human: "ornn registry tags list <repository>",
+      automation: "ornn registry tags list <repository> --format json",
+      acceptedReferences: ["repository name", "<namespace>/<repository>"],
+      related: ["registry tags delete", "registry copies list"]
+    }
+  },
+  slack: false,
+  execute: async (context, input) => {
+    const interaction2 = cliInteraction(context);
+    const registry = await registryOf(context);
+    const repository = qualifiedRepository(repositoryArgument(input, interaction2).repository, registry);
+    const listed = await context.fetch(`${REGISTRY_PATH}/tags?${new URLSearchParams({ repository })}`, { method: "GET" });
+    if (!interaction2)
+      return listed;
+    return interaction2.result({
+      data: listed,
+      presentation: {
+        lines: listed.tags.map((tag) => `${tag.tag}  ${tag.digest.slice(0, 19)}  ${formatBytes(tag.size_bytes)}${tag.created_at ? `  built ${tag.created_at}` : ""}`)
+      }
+    });
+  }
+});
+var registryTagsDeleteCapability = defineCapability({
+  id: "registry.tags.delete",
+  domain: "registry",
+  roles: ["user"],
+  description: "Delete a tag from the organization's container registry. Pods and Slurm jobs that name it can no longer pull it; each cluster drops its copy within a minute, and the registry frees the space no other tag uses, pausing pushes for about a minute while it does.",
+  mutation: "preview-confirm",
+  http: { method: "DELETE", path: `${REGISTRY_PATH}/tags` },
+  input: tagInput,
+  cli: {
+    command: ["registry", "tags", "delete"],
+    vnext: {
+      arguments: "semantic",
+      audience: "customer",
+      category: "resource",
+      order: 603,
+      outcome: "Delete one tag after review.",
+      human: "ornn registry tags delete <repository>:<tag>",
+      automation: "ornn registry tags delete <repository>:<tag> --yes --format json",
+      acceptedReferences: ["<repository>:<tag>"],
+      review: "Shows the tag before deleting it; --yes skips the review.",
+      related: ["registry tags list"]
+    }
+  },
+  slack: false,
+  execute: async (context, input) => {
+    const interaction2 = cliInteraction(context);
+    const registry = await registryOf(context);
+    const argument = repositoryArgument(input, interaction2);
+    const repository = qualifiedRepository(argument.repository, registry);
+    if (!argument.tag) {
+      const message = "Name the tag to delete, such as trainer:v1.";
+      if (interaction2)
+        interaction2.usage(message, { code: "tag_required", field: "tag" });
+      throw new Error(message);
+    }
+    const target = { repository, tag: argument.tag };
+    if (interaction2) {
+      if (!input.yes) {
+        const approved = await interaction2.review({
+          title: "Delete this image tag?",
+          terms: [
+            { label: "Image", value: `${registry.host}/${repository}:${argument.tag}` },
+            {
+              label: "Effect",
+              value: "Pulls of this tag stop working; clusters drop their copy within a minute."
+            }
+          ],
+          prompt: "Delete it?"
+        });
+        if (!approved) {
+          return interaction2.result({
+            data: target,
+            outcome: { class: "cancelled", phase: "review" },
+            presentation: { lines: ["Nothing was deleted."] }
+          });
+        }
+      }
+    } else if (!context.confirmed) {
+      return preview("registry.tags.delete", target);
+    }
+    await context.fetch(`${REGISTRY_PATH}/tags?${new URLSearchParams(target)}`, {
+      method: "DELETE"
+    });
+    const deleted = { deleted: true, ...target };
+    if (!interaction2)
+      return deleted;
+    return interaction2.result({
+      data: deleted,
+      presentation: { lines: [`Deleted ${shortName(repository, registry)}:${argument.tag}.`] }
+    });
+  }
+});
+var registryUsageCapability = defineCapability({
+  id: "registry.usage",
+  domain: "registry",
+  roles: ["user"],
+  description: "Show the bytes the organization's tagged images occupy in its container registry, each layer counted once.",
+  mutation: "read",
+  http: { method: "GET", path: `${REGISTRY_PATH}/usage` },
+  input: emptyInput4,
+  cli: {
+    command: ["registry", "usage"],
+    vnext: {
+      audience: "customer",
+      category: "resource",
+      order: 604,
+      outcome: "Show how much registry storage your images use.",
+      human: "ornn registry usage",
+      automation: "ornn registry usage --format json",
+      related: ["registry repositories list"]
+    }
+  },
+  slack: false,
+  execute: async (context) => {
+    const usage = await context.fetch(`${REGISTRY_PATH}/usage`, { method: "GET" });
+    const interaction2 = cliInteraction(context);
+    if (!interaction2)
+      return usage;
+    return interaction2.result({
+      data: usage,
+      presentation: { lines: [`Storage used: ${formatBytes(usage.bytes)}`] }
+    });
+  }
+});
+var registryCopiesListCapability = defineCapability({
+  id: "registry.copies.list",
+  domain: "registry",
+  roles: ["user"],
+  description: "List, for each of the organization's clusters, the registry tags its own copy holds now and the digest it holds them at, so a push or delete can be followed until every cluster has it.",
+  mutation: "read",
+  http: { method: "GET", path: `${REGISTRY_PATH}/caches` },
+  input: emptyInput4,
+  cli: {
+    command: ["registry", "copies", "list"],
+    vnext: {
+      audience: "customer",
+      category: "resource",
+      order: 605,
+      outcome: "Show which tags each of your clusters already holds.",
+      human: "ornn registry copies list",
+      automation: "ornn registry copies list --format json",
+      related: ["registry tags list"]
+    }
+  },
+  slack: false,
+  execute: async (context) => context.fetch(`${REGISTRY_PATH}/caches`, { method: "GET" })
+});
+var registryLoginCapability = defineCapability({
+  id: "registry.login",
+  domain: "registry",
+  roles: ["user"],
+  description: "Log Docker on this machine in to the organization's container registry, with a read-write API key the CLI creates for it.",
+  mutation: "local",
+  input: emptyInput4,
+  cli: {
+    command: ["registry", "login"],
+    vnext: {
+      audience: "customer",
+      category: "resource",
+      order: 599,
+      outcome: "Log Docker in to your organization's registry.",
+      human: "ornn registry login",
+      automation: "ornn registry login --format json",
+      related: ["registry show"]
+    }
+  },
+  mcp: false,
+  slack: false,
+  execute: async (context, input) => {
+    const interaction2 = context.cli?.interaction;
+    if (!interaction2?.registry) {
+      throw new Error("ornn registry login runs only in the Ornn CLI.");
+    }
+    return interaction2.registry.call(interaction2, "registry.login", input);
+  }
+});
+var registryCapabilities = [
+  registryLoginCapability,
+  registryShowCapability,
+  registryRepositoriesListCapability,
+  registryTagsListCapability,
+  registryTagsDeleteCapability,
+  registryUsageCapability,
+  registryCopiesListCapability
+];
+
+// ../../packages/capabilities/dist/capabilities/reservation-list.js
+import { z as z29 } from "zod";
+var reservationListInput = z29.object({
+  customerId: z29.string().uuid().optional(),
+  listingId: z29.string().uuid().optional(),
+  listingTermId: z29.string().uuid().optional(),
+  status: z29.enum(["confirmed", "active", "completed", "cancelled"]).optional(),
+  cursor: z29.string().optional(),
+  limit: z29.number().int().min(1).max(100).optional()
 });
 var reservationListCapability = defineCapability({
   id: "reservation.list",
@@ -6912,20 +7244,20 @@ var reservationListCapability = defineCapability({
 });
 
 // ../../packages/capabilities/dist/capabilities/volumes.js
-import { z as z29 } from "zod";
-var storageCliInput = z29.object({
-  $positionals: z29.array(z29.string()).optional(),
-  contentType: z29.string().optional(),
-  cursor: z29.string().optional(),
-  idempotencyKey: z29.string().optional(),
-  limit: z29.union([z29.string(), z29.number()]).optional(),
-  name: z29.string().optional(),
-  output: z29.string().optional(),
-  overwrite: z29.boolean().optional(),
-  path: z29.string().optional(),
-  prefix: z29.string().optional(),
-  source: z29.string().optional(),
-  yes: z29.boolean().optional()
+import { z as z30 } from "zod";
+var storageCliInput = z30.object({
+  $positionals: z30.array(z30.string()).optional(),
+  contentType: z30.string().optional(),
+  cursor: z30.string().optional(),
+  idempotencyKey: z30.string().optional(),
+  limit: z30.union([z30.string(), z30.number()]).optional(),
+  name: z30.string().optional(),
+  output: z30.string().optional(),
+  overwrite: z30.boolean().optional(),
+  path: z30.string().optional(),
+  prefix: z30.string().optional(),
+  source: z30.string().optional(),
+  yes: z30.boolean().optional()
 }).strict();
 function storageExecutor(context) {
   const interaction2 = context.cli?.interaction;
@@ -7098,22 +7430,22 @@ function storageDrivePath(driveId, action) {
 function reservationStorageRoute(reservationId, suffix) {
   return `/v1/workflows/compute/nodes/reservations/${encodeURIComponent(reservationId)}/${suffix}`;
 }
-var reservationInput = z29.object({ reservationId: z29.string() });
-var reservationWrite = reservationInput.extend({ confirm: z29.boolean().optional() });
-var driveInput = z29.object({ driveId: z29.string() });
-var driveWrite = driveInput.extend({ confirm: z29.boolean().optional() });
-var bucketConnectInput = z29.object({
-  provider: z29.enum(["gcs", "s3", "r2"]),
-  bucket: z29.string(),
-  name: z29.string().optional(),
-  prefix: z29.string().optional(),
-  region: z29.string().optional(),
-  endpointUrl: z29.string().optional(),
-  accountId: z29.string().optional(),
-  accessKeyId: z29.string().optional(),
-  secretAccessKey: z29.string().optional(),
-  readOnly: z29.boolean().optional(),
-  confirm: z29.boolean().optional()
+var reservationInput = z30.object({ reservationId: z30.string() });
+var reservationWrite = reservationInput.extend({ confirm: z30.boolean().optional() });
+var driveInput = z30.object({ driveId: z30.string() });
+var driveWrite = driveInput.extend({ confirm: z30.boolean().optional() });
+var bucketConnectInput = z30.object({
+  provider: z30.enum(["gcs", "s3", "r2"]),
+  bucket: z30.string(),
+  name: z30.string().optional(),
+  prefix: z30.string().optional(),
+  region: z30.string().optional(),
+  endpointUrl: z30.string().optional(),
+  accountId: z30.string().optional(),
+  accessKeyId: z30.string().optional(),
+  secretAccessKey: z30.string().optional(),
+  readOnly: z30.boolean().optional(),
+  confirm: z30.boolean().optional()
 }).refine((input) => !(input.provider === "gcs" && (input.accessKeyId || input.secretAccessKey)), {
   message: "Access key credentials are only supported for S3-compatible buckets."
 }).refine((input) => Boolean(input.accessKeyId) === Boolean(input.secretAccessKey), {
@@ -7132,7 +7464,7 @@ var storageVerbCapabilities = [
       method: "POST",
       path: "/v1/workflows/compute/nodes/reservations/{reservationId}/storage-deployment"
     },
-    input: reservationWrite.extend({ driveId: z29.string(), readOnly: z29.boolean().optional() }),
+    input: reservationWrite.extend({ driveId: z30.string(), readOnly: z30.boolean().optional() }),
     slack: false,
     execute: (ctx, input) => ctx.fetch(reservationStorageRoute(input.reservationId, "storage-deployment"), {
       method: "POST",
@@ -7182,8 +7514,8 @@ var storageVerbCapabilities = [
       path: "/v1/workflows/compute/nodes/reservations/{reservationId}/filesystem-deployment"
     },
     input: reservationWrite.extend({
-      performanceTier: z29.enum(["standard", "performance", "enterprise"]),
-      capacityGib: z29.number().int().positive()
+      performanceTier: z30.enum(["standard", "performance", "enterprise"]),
+      capacityGib: z30.number().int().positive()
     }),
     slack: false,
     execute: (ctx, input) => ctx.fetch(reservationStorageRoute(input.reservationId, "filesystem-deployment"), {
@@ -7214,7 +7546,7 @@ var storageVerbCapabilities = [
     description: "List reservations that can receive a storage deploy, grouped the same way as the console picker.",
     mutation: "read",
     http: { method: "GET", path: "/v1/orchestrator/storage-targets" },
-    input: z29.object({}),
+    input: z30.object({}),
     slack: false,
     execute: (ctx) => ctx.fetch("/v1/orchestrator/storage-targets", { method: "GET" })
   }),
@@ -7225,9 +7557,9 @@ var storageVerbCapabilities = [
     description: "List a page of storage volumes, newest updated first. Pass next_cursor as cursor to continue.",
     mutation: "read",
     http: { method: "GET", path: DRIVES_ROUTE },
-    input: z29.object({
-      limit: z29.number().int().min(1).max(100).optional(),
-      cursor: z29.string().optional()
+    input: z30.object({
+      limit: z30.number().int().min(1).max(100).optional(),
+      cursor: z30.string().optional()
     }),
     mcp: { name: "storage_volumes_list" },
     slack: false,
@@ -7257,10 +7589,10 @@ var storageVerbCapabilities = [
     description: "Create a storage volume (drive), optionally cloned from an existing source drive.",
     mutation: "preview-confirm",
     http: { method: "POST", path: DRIVES_ROUTE },
-    input: z29.object({
-      name: z29.string(),
-      sourceDriveId: z29.string().optional(),
-      confirm: z29.boolean().optional()
+    input: z30.object({
+      name: z30.string(),
+      sourceDriveId: z30.string().optional(),
+      confirm: z30.boolean().optional()
     }),
     mcp: { name: "storage_volumes_create" },
     slack: false,
@@ -7362,7 +7694,7 @@ var storageVerbCapabilities = [
     description: "Update a connected S3-compatible bucket's access key credentials.",
     mutation: "preview-confirm",
     http: { method: "PATCH", path: `${STORAGE_DRIVES_ROUTE}/{driveId}/source-credentials` },
-    input: driveWrite.extend({ accessKeyId: z29.string(), secretAccessKey: z29.string() }),
+    input: driveWrite.extend({ accessKeyId: z30.string(), secretAccessKey: z30.string() }),
     mcp: { name: "storage_buckets_update_credentials" },
     slack: false,
     execute: (ctx, input) => ctx.fetch(storageDrivePath(input.driveId, "source-credentials"), {
@@ -7382,9 +7714,9 @@ var storageCompositionCapabilities = [
     description: "List a page of connected external buckets.",
     mutation: "read",
     http: { method: "GET", path: DRIVES_ROUTE },
-    input: z29.object({
-      limit: z29.number().int().min(1).max(100).optional(),
-      cursor: z29.string().optional()
+    input: z30.object({
+      limit: z30.number().int().min(1).max(100).optional(),
+      cursor: z30.string().optional()
     }),
     mcp: false,
     slack: false,
@@ -7402,10 +7734,10 @@ var storageCompositionCapabilities = [
     description: "List one page of a storage volume's contents.",
     mutation: "read",
     http: { method: "GET", path: `${DRIVES_ROUTE}/{driveId}/contents` },
-    input: z29.object({
-      driveId: z29.string(),
-      path: z29.string().optional(),
-      cursor: z29.union([z29.string(), z29.number()]).optional()
+    input: z30.object({
+      driveId: z30.string(),
+      path: z30.string().optional(),
+      cursor: z30.union([z30.string(), z30.number()]).optional()
     }),
     mcp: false,
     slack: false,
@@ -7464,6 +7796,7 @@ var catalog = [
       machinePushKeysCapability,
       ...machineMetricsCapabilities,
       ...billingCapabilities,
+      ...registryCapabilities,
       ...adminNodeLifecycleCapabilities
     ])),
     ...adminCapabilities.filter((capability) => capability.id === "nodes.health"),