@ornncompute/cli 1.0.113 → 1.0.115

package/README.md

@@ -91,7 +91,6 @@ volumes files    list | upload | download | delete
 volumes folders  delete
 volume-mounts    candidates | show | attach | wait | detach
 external-buckets list | show | connect | update-credentials | verify | import | disconnect
-filesystems      deploy | show | wait | delete
 ```
 
 `ssh-keys list` uses backend cursors; see [pagination](../../docs/cli.md#advanced-customer-resources).
@@ -273,7 +272,7 @@ as `--erase-local-data` or `--delete-node-record`. Machine retries require a
 caller-stable idempotency key and reconcile against durable owner state.
 
 Permanent deletion and teardown requests execute directly when explicitly
-requested. Private networks, detached volumes, filesystem deployments, and
+requested. Private networks, detached volumes, and
 Kubernetes or Slurm clusters use their command arguments to express the exact
 operation. Clearing a volume or deleting nested content is live-terminal only
 and does not prompt for consent.
@@ -365,7 +364,7 @@ with one replacement and <https://docs.ornn.com/cli#migrating-to-vnext>.
 | `ornn storage volumes *`                                                                  | `ornn volumes <verb>`                                         |
 | `ornn storage files *`                                                                    | `ornn volumes files <verb>`                                   |
 | `ornn storage buckets *`                                                                  | `ornn external-buckets <verb>`                                |
-| Storage targets, deploy, status, detach, filesystem                                       | exact `ornn volume-mounts` or `ornn filesystems` leaf printed |
+| Storage targets, deploy, status, detach                                                   | exact `ornn volume-mounts` leaf printed                       |
 | `ornn billing`                                                                            | Use the Ornn web app.                                         |
 | customer-root `facilities`, `tokens`, `users`, `node`, or staff `reservations *`          | exact `ornn admin ...` command printed by the error           |
 | `ornn api`, `commerce`, `orchestrator`, `cache purge`                                     | `ornn resources`; no generic replacement exists               |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ornncompute/cli",
-  "version": "1.0.113",
+  "version": "1.0.115",
   "description": "Command-line interface for Ornn compute access workflows.",
   "type": "module",
   "bin": {

package/src/catalog-shell.mjs

@@ -1,3 +1,4 @@
+import { getCliSession } from "../vendor/api-client/authorization.js";
 import { readFileSync } from "node:fs";
 
 import {
@@ -1009,7 +1010,9 @@ async function executeCapability(
           }
           if (capability.domain === "listings" && ownOrganizationId === undefined) {
             // Verify listing owner IDs before the request, never after a committed mutation.
-            const session = await customerCapabilityFetch(io, "/v1/cli/session", {}, authSnapshot);
+            const session = await getCliSession((path, init) =>
+              customerCapabilityFetch(io, path, init, authSnapshot)
+            );
             ownOrganizationId = session.selectedOrganization?.id ?? null;
           }
           return customerCapabilityFetch(io, path, init, authSnapshot);

package/src/device-auth.mjs

@@ -1,3 +1,7 @@
+import {
+  startCliDeviceAuthorization,
+  pollCliDeviceAuthorization,
+} from "../vendor/api-client/authorization.js";
 import { spawn } from "node:child_process";
 
 import { configuredAuthBaseUrl } from "./auth-store.mjs";
@@ -90,7 +94,7 @@ export async function openBrowser(url, { platform = process.platform, spawnImpl
 
 export async function startDeviceFlow({ apiBaseUrl, authBaseUrl, fetchImpl = fetch } = {}) {
   const requestBaseUrl = apiBaseUrl || authBaseUrl;
-  const data = await postJson(fetchImpl, `${requestBaseUrl}/v1/cli/device/start`, {});
+  const data = await startCliDeviceAuthorization(deviceRequest(fetchImpl, requestBaseUrl));
 
   const deviceCode = pickString(data, "deviceCode", "device_code");
   const userCode = pickString(data, "userCode", "user_code");
@@ -126,11 +130,10 @@ export async function pollDeviceFlow({
   signal,
 } = {}) {
   const requestBaseUrl = apiBaseUrl || authBaseUrl;
-  return postJson(
-    fetchImpl,
-    `${requestBaseUrl}/v1/cli/device/poll`,
+  return pollCliDeviceAuthorization(
+    deviceRequest(fetchImpl, requestBaseUrl),
     { device_code: deviceCode },
-    { signal }
+    signal
   );
 }
 
@@ -258,28 +261,31 @@ export async function waitForDeviceApproval({
   }
 }
 
-async function postJson(fetchImpl, url, body, { signal } = {}) {
-  const response = await fetchImpl(url, {
-    body: JSON.stringify(body),
-    headers: {
-      Accept: "application/json",
-      "Content-Type": "application/json",
-    },
-    method: "POST",
-    ...(signal ? { signal } : {}),
-  });
-  const text = await response.text();
-  const data = text ? parseJson(text, url) : {};
-
-  if (!response.ok) {
-    const detail = data.detail || data.error || response.statusText;
-    throw new DeviceAuthError(`Auth request failed: ${detail}`, {
-      detail: data,
-      status: response.status,
+function deviceRequest(fetchImpl, baseUrl) {
+  return async (path, { body, method, signal } = {}) => {
+    const url = `${baseUrl}${path}`;
+    const response = await fetchImpl(url, {
+      body: JSON.stringify(body),
+      headers: {
+        Accept: "application/json",
+        "Content-Type": "application/json",
+      },
+      method,
+      ...(signal ? { signal } : {}),
     });
-  }
+    const text = await response.text();
+    const data = text ? parseJson(text, url) : {};
 
-  return data;
+    if (!response.ok) {
+      const detail = data.detail || data.error || response.statusText;
+      throw new DeviceAuthError(`Auth request failed: ${detail}`, {
+        detail: data,
+        status: response.status,
+      });
+    }
+
+    return data;
+  };
 }
 
 function parseJson(text, url) {

package/src/machine-reference.mjs

@@ -1,3 +1,4 @@
+import { getCliSession } from "../vendor/api-client/authorization.js";
 import { listAllReservations } from "../vendor/api-client/commerce.js";
 import { gpuLabeler } from "./gpu-catalog.mjs";
 
@@ -114,7 +115,7 @@ function invalidGateway(interaction, message) {
 export async function listActiveReservations(context, interaction) {
   const session = context.cli?.session
     ? (await context.cli.session("context", {})).data
-    : await context.fetch("/v1/cli/session");
+    : await getCliSession(context.fetch);
   const customerId = text((session.selectedOrganization ?? session.selected_organization)?.id);
   if (!customerId) {
     interaction.usage("Select an organization before choosing a reservation.", {

package/src/mount-commands.mjs

@@ -55,17 +55,6 @@ function accessMode(value, interaction) {
   return candidate;
 }
 
-function positiveInteger(value, field, interaction) {
-  const parsed = integer(value);
-  if (parsed === null || parsed < 1) {
-    interaction.usage(`--${field} must be a positive integer.`, {
-      code: "invalid_input",
-      field,
-    });
-  }
-  return parsed;
-}
-
 function timeoutMilliseconds(value, interaction, fallback = DEFAULT_MOUNT_TIMEOUT) {
   const candidate = text(value) ?? fallback;
   const match = /^(\d+)(ms|s|m|h)$/.exec(candidate);
@@ -141,12 +130,6 @@ function reservationDeploymentPath(reservationId) {
   );
 }
 
-function reservationFilesystemPath(reservationId) {
-  return computeEndpoint(
-    `/nodes/reservations/${encodeURIComponent(reservationId)}/filesystem-deployment`
-  );
-}
-
 function stableAttachmentPhase(value) {
   const state = text(value)?.toLowerCase() ?? "pending";
   if (["attached", "ready"].includes(state)) return state;
@@ -255,14 +238,6 @@ function mountSatisfied(mount, goal) {
   );
 }
 
-function filesystemSatisfied(mount, performanceTier, capacityGib) {
-  return Boolean(
-    mount &&
-    mount.filesystem.performance_tier === performanceTier &&
-    mount.filesystem.capacity_gib === capacityGib
-  );
-}
-
 function mountReady(mount) {
   return Boolean(
     mount && mount.readiness.expected > 0 && mount.readiness.ready === mount.readiness.expected
@@ -843,179 +818,6 @@ export async function detachVolumeMount(input, runtime) {
   });
 }
 
-async function deployFilesystem(input, runtime) {
-  const [rawReservation] = positionals(
-    input,
-    1,
-    "ornn filesystems deploy <canonical-reservation-id> --performance-tier <tier> --capacity-gib <gib>",
-    runtime.interaction
-  );
-  requireMachineMutation(input, runtime.interaction);
-  const reservationId = canonical(rawReservation, "reservation", runtime.interaction);
-  const performanceTier = required(input.performanceTier, "performance-tier", runtime.interaction);
-  const capacityGib = positiveInteger(input.capacityGib, "capacity-gib", runtime.interaction);
-  const wait = shouldWait(input, runtime.interaction);
-  let current = await fetchMount(runtime, reservationId);
-  if (current && ["detached", "ended"].includes(current.lifecycle.phase)) current = null;
-  if (current) {
-    const sameGoal = filesystemSatisfied(current, performanceTier, capacityGib);
-    if (!sameGoal) {
-      runtime.interaction.error(
-        "This capacity reservation already has a different managed filesystem relationship.",
-        {
-          action: {
-            command: `ornn filesystems show ${reservationId}`,
-            description:
-              "Inspect the current deployment before changing its exact capacity or performance goal.",
-            type: "command",
-          },
-          code: "filesystem_deployment_conflict",
-        }
-      );
-    }
-    return wait && !mountReady(current)
-      ? waitForMount(input, runtime, reservationId, current, "filesystems deploy")
-      : mountResult(runtime.interaction, current, reservationId, { replayed: true });
-  }
-  current = await fetchMount(runtime, reservationId);
-  if (current && ["detached", "ended"].includes(current.lifecycle.phase)) current = null;
-  if (current && !filesystemSatisfied(current, performanceTier, capacityGib)) {
-    runtime.interaction.error("The managed filesystem relationship changed before deployment.", {
-      code: "filesystem_deployment_conflict",
-    });
-  }
-  if (!current) {
-    try {
-      current = await withMachineCount(
-        runtime,
-        projectVolumeMount(
-          await runtime.fetch(reservationFilesystemPath(reservationId), {
-            method: "POST",
-            headers: idempotencyHeaders(input),
-            body: { performance_tier: performanceTier, capacity_gib: capacityGib },
-          }),
-          reservationId
-        ),
-        reservationId
-      );
-    } catch (error) {
-      if (error instanceof CliApiError && (error.status === undefined || error.status >= 500)) {
-        current = await fetchMount(runtime, reservationId);
-        if (!filesystemSatisfied(current, performanceTier, capacityGib)) throw error;
-      } else {
-        safeFailure(runtime.interaction, error, "The filesystem could not be deployed safely.");
-      }
-    }
-  }
-  if (!filesystemSatisfied(current, performanceTier, capacityGib)) {
-    runtime.interaction.error(
-      "The accepted filesystem deployment did not match the reviewed goal.",
-      {
-        code: "filesystem_deployment_goal_mismatch",
-      }
-    );
-  }
-  return wait && !mountReady(current)
-    ? waitForMount(input, runtime, reservationId, current, "filesystems deploy")
-    : mountResult(runtime.interaction, current, reservationId);
-}
-
-function filesystemExecution(result) {
-  if (!result?.data || !Object.hasOwn(result.data, "volume_mount")) return result;
-  const { volume_mount: filesystemDeployment, ...data } = result.data;
-  return {
-    ...result,
-    data: {
-      ...data,
-      filesystem_deployment: filesystemDeployment,
-    },
-  };
-}
-
-async function deleteFilesystem(input, runtime) {
-  const [rawReservation] = positionals(
-    input,
-    1,
-    "ornn filesystems delete <canonical-reservation-id>",
-    runtime.interaction
-  );
-  requireMachineMutation(input, runtime.interaction);
-  const reservationId = canonical(rawReservation, "reservation", runtime.interaction);
-  const current = await fetchMount(runtime, reservationId);
-  if (!current || ["detached", "ended"].includes(current.lifecycle.phase)) {
-    return runtime.interaction.result({
-      data: {
-        filesystem_deployment: current,
-        replayed: true,
-        reservation_id: reservationId,
-        volume_preserved: current?.volume ?? null,
-      },
-      outcome: { class: "ended", phase: "deleted" },
-      presentation: {
-        lines: [
-          `Capacity reservation ${reservationId} already has no managed filesystem deployment.`,
-        ],
-      },
-    });
-  }
-  const refreshed = await fetchMount(runtime, reservationId);
-  if (!refreshed || refreshed.id !== current.id || refreshed.volume.id !== current.volume.id) {
-    runtime.interaction.error("The managed filesystem relationship changed before deletion.", {
-      code: "filesystem_deployment_changed",
-    });
-  }
-  let deleting;
-  try {
-    deleting = await withMachineCount(
-      runtime,
-      projectVolumeMount(
-        await runtime.fetch(reservationFilesystemPath(reservationId), {
-          headers: idempotencyHeaders(input),
-          method: "DELETE",
-        }),
-        reservationId
-      ),
-      reservationId
-    );
-  } catch (error) {
-    if (error instanceof CliApiError && (error.status === undefined || error.status >= 500)) {
-      const reconciled = await fetchMount(runtime, reservationId);
-      const deletingState = reconciled?.filesystem?.phase;
-      if (
-        reconciled &&
-        !["deleting", "deleted", "ended"].includes(deletingState) &&
-        !["detached", "ended"].includes(reconciled.lifecycle.phase)
-      ) {
-        throw error;
-      }
-      deleting = reconciled;
-    } else {
-      safeFailure(
-        runtime.interaction,
-        error,
-        "The filesystem deployment could not be deleted safely."
-      );
-    }
-  }
-  return runtime.interaction.result({
-    data: {
-      filesystem_deployment: deleting,
-      replayed: false,
-      reservation_id: reservationId,
-      volume_preserved: current.volume,
-    },
-    outcome: { class: "working", phase: "deleting" },
-    resume: { kind: "filesystem_deployment", ref: reservationId },
-    presentation: {
-      lines: [
-        `Filesystem deployment removal accepted for ${reservationId}.`,
-        `Managed volume ${current.volume.name ?? current.volume.id} was preserved.`,
-      ],
-      next: `ornn filesystems show ${reservationId}`,
-    },
-  });
-}
-
 export async function executeMountCommand(command, input, runtime) {
   switch (command) {
     case "storage.volume-mounts.candidates":
@@ -1028,14 +830,6 @@ export async function executeMountCommand(command, input, runtime) {
       return waitCommand(input, runtime, "volume-mounts wait");
     case "storage.volume-mounts.detach":
       return detachVolumeMount(input, runtime);
-    case "storage.filesystems.deploy":
-      return filesystemExecution(await deployFilesystem(input, runtime));
-    case "storage.filesystems.show":
-      return filesystemExecution(await show(input, runtime, "filesystems show"));
-    case "storage.filesystems.wait":
-      return filesystemExecution(await waitCommand(input, runtime, "filesystems wait"));
-    case "storage.filesystems.delete":
-      return deleteFilesystem(input, runtime);
     default:
       runtime.interaction.error("Unknown mount command.", { code: "unknown_command" });
   }

package/src/registry-commands.mjs

@@ -1,4 +1,9 @@
-import { listApiKeys, createApiKey, revokeApiKey } from "../vendor/api-client/authorization.js";
+import {
+  listApiKeys,
+  createApiKey,
+  revokeApiKey,
+  getCliSession,
+} from "../vendor/api-client/authorization.js";
 import { spawn as spawnProcessDefault } from "node:child_process";
 import os from "node:os";
 
@@ -19,7 +24,7 @@ async function login({
   hostname = os.hostname(),
 }) {
   const registry = await fetch("/v1/orchestrator/registry");
-  const session = await fetch("/v1/cli/session");
+  const session = await getCliSession(fetch);
   const organizationId = (session?.selectedOrganization ?? session?.selected_organization)?.id;
   if (typeof organizationId !== "string" || !organizationId) {
     interaction.usage("Join an organization before logging in to its registry.", {

package/src/session-commands.mjs

@@ -1,3 +1,4 @@
+import { getCliSession, revokeCliSession } from "../vendor/api-client/authorization.js";
 import { CliApiError, cliRequest, resolveApiBaseUrl } from "./api-client.mjs";
 import {
   bindAuthUser,
@@ -143,13 +144,15 @@ async function context({ env, fetchImpl, sessionSnapshot }) {
     sessionSnapshot.current = localSession;
   }
   const data = sessionContext(
-    await cliRequest({
-      endpoint: "/v1/cli/session",
-      env,
-      fetchImpl,
-      method: "GET",
-      session: localSession,
-    })
+    await getCliSession((endpoint, init) =>
+      cliRequest({
+        ...init,
+        endpoint,
+        env,
+        fetchImpl,
+        session: localSession,
+      })
+    )
   );
   await bindAuthUser(data.user, {
     env,
@@ -291,14 +294,16 @@ async function logout(runtime) {
   try {
     if (!revocationError && session?.accessToken) {
       attempted = true;
-      await cliRequest({
-        endpoint: "/v1/cli/session",
-        env: runtime.env,
-        fetchImpl: runtime.fetchImpl,
-        method: "DELETE",
-        raw: true,
-        session,
-      });
+      await revokeCliSession((endpoint, init) =>
+        cliRequest({
+          ...init,
+          endpoint,
+          env: runtime.env,
+          fetchImpl: runtime.fetchImpl,
+          raw: true,
+          session,
+        })
+      );
     }
   } catch (error) {
     revocationError = error;

package/vendor/api-client/authorization.js

@@ -305,22 +305,137 @@ function createSupplierApplication(fetcher, body, query = {}) {
     body: JSON.stringify(body)
   });
 }
+
+// ../../packages/api-client/dist/authorization/sessions.js
+var browserSessionPath = "/v1/auth/session";
+var signInPath = "/v1/auth/sign-in";
+var inviteRedeemPath = "/v1/auth/invites/redeem";
+var unsubscribePath = "/v1/auth/unsubscribe";
+var post = (body, signal) => ({
+  method: "POST",
+  headers: { "Content-Type": "application/json" },
+  body: JSON.stringify(body),
+  ...signal ? { signal } : {}
+});
+function getBrowserSession(fetcher, query = {}, options = {}) {
+  return fetcher(withQuery(browserSessionPath, query), { ...options, method: "GET" });
+}
+function signOutBrowserSession(fetcher, next) {
+  return fetcher(withQuery("/v1/auth/sign-out", { next }), post({}));
+}
+function changeEmail(fetcher, body) {
+  return fetcher("/v1/auth/change-email", post(body));
+}
+function authorizeStaff(fetcher, body, signal) {
+  return fetcher("/v1/authorize", post(body, signal));
+}
+function createSlackSession(fetcher, body, signal) {
+  return fetcher("/v1/slack/session", post(body, signal));
+}
+function startCliDeviceAuthorization(request) {
+  return request("/v1/cli/device/start", {
+    method: "POST",
+    body: {}
+  });
+}
+function pollCliDeviceAuthorization(request, body, signal) {
+  return request("/v1/cli/device/poll", { method: "POST", body, signal });
+}
+function approveCliDeviceAuthorization(fetcher, body) {
+  return fetcher("/v1/cli/device/approve", post(body));
+}
+function getCliSession(request) {
+  return request("/v1/cli/session", { method: "GET" });
+}
+function revokeCliSession(request) {
+  return request("/v1/cli/session", { method: "DELETE" });
+}
+
+// ../../packages/api-client/dist/authorization/mcp.js
+function getMcpApplication(fetcher, clientId) {
+  return fetcher(`/v1/mcp/applications/${encodeURIComponent(clientId)}`, { method: "GET" });
+}
+function listMcpConnections(fetcher, userId) {
+  return fetcher(withQuery("/v1/mcp/connections", { user_id: userId }), { method: "GET" });
+}
+function revokeMcpConnection(fetcher, userId, clientId) {
+  return fetcher(withQuery(`/v1/mcp/connections/${encodeURIComponent(clientId)}`, { user_id: userId }), { method: "DELETE" });
+}
+function resolveMcpSession(fetcher, token) {
+  return fetcher("/v1/mcp/session", {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ token })
+  });
+}
+function authorizeMcp(fetcher, body, signal) {
+  return fetcher("/v1/auth/mcp/authorize", {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify(body),
+    signal
+  });
+}
+function consentMcp(fetcher, body, signal) {
+  return fetcher("/v1/auth/mcp/consent", {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify(body),
+    signal
+  });
+}
+
+// ../../packages/api-client/dist/authorization/impersonation.js
+function getActiveImpersonationGrant(fetcher, staffUserId) {
+  return fetcher(`/v1/impersonation/active/${encodeURIComponent(staffUserId)}`, { method: "GET" });
+}
+function deleteImpersonationGrant(fetcher, staffUserId) {
+  return fetcher(`/v1/impersonation/${encodeURIComponent(staffUserId)}`, { method: "DELETE" });
+}
+function listImpersonationCustomers(request, query = {}, signal) {
+  return request(withQuery("/v1/staff/impersonation/customers", query), {
+    method: "GET",
+    signal
+  });
+}
+function startStaffImpersonation(fetcher, body) {
+  return fetcher("/v1/staff/impersonation/start", {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify(body)
+  });
+}
+function stopStaffImpersonation(fetcher) {
+  return fetcher("/v1/staff/impersonation/stop", { method: "POST" });
+}
 export {
   acceptInvite,
   addStaffOrganizationMember,
+  approveCliDeviceAuthorization,
   approveSupplierApplicationFromSlack,
+  authorizeMcp,
+  authorizeStaff,
   bookOnboardingCall,
+  browserSessionPath,
   cancelOnboardingCall,
   cancelOrganizationFollowUp,
+  changeEmail,
+  consentMcp,
   countOrganizations,
   createApiKey,
   createInvite,
   createOrganization,
+  createSlackSession,
   createSshKey,
   createStaffInvite,
   createStaffOrganization,
   createSupplierApplication,
+  deleteImpersonationGrant,
+  getActiveImpersonationGrant,
+  getBrowserSession,
+  getCliSession,
   getInvite,
+  getMcpApplication,
   getNotificationPreferences,
   getOrganization,
   getOrganizationMembership,
@@ -328,10 +443,13 @@ export {
   getStaffOrganization,
   getUserPreferences,
   getUserProfile,
+  inviteRedeemPath,
   listAllSshKeys,
   listApiKeys,
   listAvailabilityAlerts,
+  listImpersonationCustomers,
   listInvites,
+  listMcpConnections,
   listOnboardingSlots,
   listOrganizationMembers,
   listOrganizations,
@@ -344,16 +462,26 @@ export {
   listSupplierOrganizations,
   organizationAvatarPath,
   personAvatarPath,
+  pollCliDeviceAuthorization,
   removeOrganizationMember,
   removeStaffOrganizationMember,
+  resolveMcpSession,
   revokeApiKey,
+  revokeCliSession,
   revokeInvite,
+  revokeMcpConnection,
   revokeSshKey,
   revokeStaffOrganizationInvite,
   searchStaffOrganizations,
   searchStaffPeople,
   setAvailabilityAlert,
+  signInPath,
+  signOutBrowserSession,
+  startCliDeviceAuthorization,
+  startStaffImpersonation,
+  stopStaffImpersonation,
   submitOnboardingIntake,
+  unsubscribePath,
   updateNotificationPreferences,
   updateOrganization,
   updateOrganizationApproval,

package/vendor/capabilities/cli.js

@@ -268,6 +268,11 @@ function createStaffInvite(request, body2) {
   return request("/v1/staff/invites", { method: "POST", body: body2 });
 }
 
+// ../../packages/api-client/dist/authorization/sessions.js
+function getCliSession(request) {
+  return request("/v1/cli/session", { method: "GET" });
+}
+
 // ../../packages/capabilities/dist/supplier-directory.js
 function listSupplierOrganizationPage(fetch, input) {
   return listOrganizations(fetch, {
@@ -3322,7 +3327,6 @@ var launchCapability = cliOnly({
         "machines list",
         "clusters show",
         "volume-mounts show",
-        "filesystems show",
         "ssh-keys list",
         "ssh-keys assignments status"
       ]
@@ -4841,12 +4845,10 @@ import { z as z23 } from "zod";
 var mountInput = z23.object({
   $positionals: z23.array(z23.string()).default([]),
   access: z23.string().optional(),
-  capacityGib: z23.union([z23.string(), z23.number()]).optional(),
   cursor: z23.string().optional(),
   idempotencyKey: z23.string().optional(),
   limit: z23.union([z23.string(), z23.number()]).optional(),
   noWait: z23.boolean().optional(),
-  performanceTier: z23.string().optional(),
   timeout: z23.string().optional(),
   volume: z23.string().optional(),
   wait: z23.boolean().optional(),
@@ -4955,59 +4957,6 @@ var mountCapabilities = [
     review: "Review the exact relationship and access loss; the managed volume remains.",
     resumableStates: ["detaching", "ended"],
     related: ["volumes show", "private-networks list"]
-  }),
-  mountCapability({
-    id: "storage.filesystems.deploy",
-    command: ["filesystems", "deploy"],
-    description: "Deploy one managed filesystem for an exact capacity reservation.",
-    mutation: "preview-confirm",
-    order: 550,
-    outcome: "Create or rediscover one filesystem deployment and expose every machine mount.",
-    human: "ornn filesystems deploy <canonical-reservation-id> --performance-tier <tier> --capacity-gib <gib> [--no-wait]",
-    automation: "ornn filesystems deploy <canonical-reservation-id> --performance-tier <tier> --capacity-gib <gib>  --idempotency-key <key> --format json",
-    acceptedReferences: ["canonical capacity-reservation ID"],
-    review: "Review the exact reservation, performance tier, capacity, and managed filesystem consequence.",
-    resumableStates: ["accepted", "partial", "ready"],
-    related: ["filesystems wait", "filesystems delete"]
-  }),
-  mountCapability({
-    id: "storage.filesystems.show",
-    command: ["filesystems", "show"],
-    description: "Summarize one filesystem deployment from its underlying per-machine mounts.",
-    mutation: "read",
-    order: 551,
-    outcome: "Show actual per-machine filesystem readiness without changing volume state.",
-    human: "ornn filesystems show <canonical-reservation-id>",
-    automation: "ornn filesystems show <canonical-reservation-id> --format json",
-    acceptedReferences: ["canonical capacity-reservation ID"],
-    related: ["filesystems wait", "volume-mounts show"]
-  }),
-  mountCapability({
-    id: "storage.filesystems.wait",
-    command: ["filesystems", "wait"],
-    description: "Wait locally for a filesystem deployment's per-machine mount goal.",
-    mutation: "read",
-    order: 552,
-    outcome: "Wait for every filesystem member while retaining partial member data.",
-    human: "ornn filesystems wait <canonical-reservation-id> [--timeout <duration>]",
-    automation: "ornn filesystems wait <canonical-reservation-id> --timeout <duration> --format json",
-    acceptedReferences: ["canonical capacity-reservation ID"],
-    resumableStates: ["partial", "ready"],
-    related: ["filesystems show", "filesystems delete"]
-  }),
-  mountCapability({
-    id: "storage.filesystems.delete",
-    command: ["filesystems", "delete"],
-    description: "Remove one filesystem deployment relationship without deleting its managed volume.",
-    mutation: "preview-confirm",
-    order: 553,
-    outcome: "Detach every filesystem member while preserving the underlying managed volume.",
-    human: "ornn filesystems delete <canonical-reservation-id>",
-    automation: "ornn filesystems delete <canonical-reservation-id>  --idempotency-key <key> --format json",
-    acceptedReferences: ["canonical capacity-reservation ID"],
-    review: "Review the exact deployment and access loss; its managed volume remains.",
-    resumableStates: ["detaching", "ended"],
-    related: ["volumes show", "filesystems deploy"]
   })
 ];
 
@@ -5109,7 +5058,7 @@ var whoamiCapability = defineCapability({
   mutation: "read",
   http: { method: "GET", path: "/v1/cli/session" },
   input: emptyInput3,
-  execute: async (ctx) => ctx.fetch("/v1/cli/session", { method: "GET" })
+  execute: async (ctx) => getCliSession(ctx.fetch)
 });
 var statusCapability = defineCapability({
   id: "identity.status",
@@ -7505,7 +7454,7 @@ var storageVerbCapabilities = [
     id: "storage.deployment_status",
     domain: "storage",
     roles: ["user"],
-    description: "Show a reservation's storage/filesystem deployment (attachment) status.",
+    description: "Show a reservation's storage deployment (attachment) status.",
     mutation: "read",
     http: {
       method: "GET",
@@ -7517,42 +7466,6 @@ var storageVerbCapabilities = [
       method: "GET"
     })
   }),
-  defineCapability({
-    id: "storage.filesystem_deploy",
-    domain: "storage",
-    roles: ["user"],
-    description: "Deploy a managed filesystem (Filestore) onto a reservation. Both performanceTier and capacityGib are required. Capacity starts at 1024 GiB and must land on the tier's increment: standard accepts any GiB up to 65433, performance uses 256 GiB steps to 9984 GiB then 2560 GiB steps to 102400 GiB, enterprise uses 256 GiB steps to 10240 GiB.",
-    mutation: "preview-confirm",
-    http: {
-      method: "POST",
-      path: "/v1/workflows/compute/nodes/reservations/{reservationId}/filesystem-deployment"
-    },
-    input: reservationWrite.extend({
-      performanceTier: z30.enum(["standard", "performance", "enterprise"]),
-      capacityGib: z30.number().int().positive()
-    }),
-    slack: false,
-    execute: (ctx, input) => ctx.fetch(reservationStorageRoute(input.reservationId, "filesystem-deployment"), {
-      method: "POST",
-      body: { performance_tier: input.performanceTier, capacity_gib: input.capacityGib }
-    })
-  }),
-  defineCapability({
-    id: "storage.filesystem_delete",
-    domain: "storage",
-    roles: ["user"],
-    description: "Delete a reservation's managed filesystem (Filestore) deployment.",
-    mutation: "preview-confirm",
-    http: {
-      method: "DELETE",
-      path: "/v1/workflows/compute/nodes/reservations/{reservationId}/filesystem-deployment"
-    },
-    input: reservationWrite,
-    slack: false,
-    execute: (ctx, input) => ctx.fetch(reservationStorageRoute(input.reservationId, "filesystem-deployment"), {
-      method: "DELETE"
-    })
-  }),
   defineCapability({
     id: "storage.targets",
     domain: "storage",
@@ -8027,10 +7940,6 @@ var LEGACY_CLI_MIGRATIONS = [
   { legacy: ["storage", "deploy"], replacement: "ornn volume-mounts attach" },
   { legacy: ["storage", "status"], replacement: "ornn volume-mounts show" },
   { legacy: ["storage", "detach"], replacement: "ornn volume-mounts detach" },
-  { legacy: ["storage", "filesystem"], replacement: "ornn filesystems show" },
-  { legacy: ["storage", "filesystem", "deploy"], replacement: "ornn filesystems deploy" },
-  { legacy: ["storage", "filesystem", "status"], replacement: "ornn filesystems show" },
-  { legacy: ["storage", "filesystem", "delete"], replacement: "ornn filesystems delete" },
   {
     legacy: ["billing", "summary"],
     replacement: "ornn capacity-offers list (use the Ornn web app for commercial workflows)"