@ornncompute/cli 1.0.121 → 1.0.123

package/README.md

@@ -69,6 +69,10 @@ The CLI uses Authorization's newest membership on every request, regardless of
 approval. `ornn context` displays that current organization; login and launch
 use the same context. Reserve browsing and purchasing still require approval.
 
+Node and VM requests use `@ornn/api-client/orchestrator`; CLI selection, polling,
+and SSH remain here. VM readiness comes from the guest resource, separately from
+physical-host readiness. See [machine behavior](../../docs/cli.md#customer-workflows).
+
 Advanced customer resources are registered under one noun and one verb:
 
 ```text
@@ -271,6 +275,10 @@ Global interaction modifiers are `--format`, `--guided`, `--wait`,
 as `--erase-local-data` or `--delete-node-record`. Machine retries require a
 caller-stable idempotency key and reconcile against durable owner state.
 
+Access-mode changes preserve the reported network mode and require an
+explicit `--network` when it is unreported. A same-mode request stays read-only,
+including its bounded wait; an existing request key reconciles its owner receipt.
+
 Permanent deletion and teardown requests execute directly when explicitly
 requested. Private networks, detached volumes, and
 Kubernetes or Slurm clusters use their command arguments to express the exact

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ornncompute/cli",
-  "version": "1.0.121",
+  "version": "1.0.123",
   "description": "Command-line interface for Ornn compute access workflows.",
   "type": "module",
   "bin": {

package/src/admin-node-diagnostics.mjs

@@ -1,3 +1,4 @@
+import * as orchestrator from "../vendor/api-client/orchestrator.js";
 import { createHash } from "node:crypto";
 
 import { ADMIN_MUTATION_SAFETY, AdminMutationError, runAdminMutation } from "./admin-mutations.mjs";
@@ -140,10 +141,7 @@ function reviewFields(target) {
 }
 
 async function prepareTarget(input, runtime, fetch) {
-  const payload = await fetch(`/nodes/${encodeURIComponent(input.node_id)}`, {
-    method: "GET",
-    ...(runtime.signal ? { signal: runtime.signal } : {}),
-  });
+  const payload = await orchestrator.getNode(fetch, input.node_id, runtime.signal);
   return nodeContext(payload, input.node_id);
 }
 

package/src/admin-node-lifecycle.mjs

@@ -1,3 +1,4 @@
+import * as orchestrator from "../vendor/api-client/orchestrator.js";
 import { getReservation } from "../vendor/api-client/commerce.js";
 import { ADMIN_MUTATION_SAFETY, AdminMutationError, runAdminMutation } from "./admin-mutations.mjs";
 import { isRecoverableWaitFailure } from "./interaction-runtime.mjs";
@@ -210,10 +211,7 @@ function isNotFound(error) {
 
 async function readNodeById(fetch, id, { allowMissing = false, signal } = {}) {
   try {
-    return await fetch(`/nodes/${encodeURIComponent(id)}`, {
-      method: "GET",
-      ...(signal ? { signal } : {}),
-    });
+    return await orchestrator.getNode(fetch, id, signal);
   } catch (error) {
     if (allowMissing && isNotFound(error)) return null;
     throw error;
@@ -238,7 +236,7 @@ async function resolveNode(fetch, reference, { allowMissing = false, machine = f
     });
   }
   const folded = reference.toLocaleLowerCase("en-US");
-  const matches = nodeRows(await fetch("/nodes", { method: "GET" })).filter((node) => {
+  const matches = nodeRows(await orchestrator.listStaffNodes(fetch)).filter((node) => {
     const names = [node?.hostname, node?.k8s_node_name]
       .map(text)
       .filter(Boolean)
@@ -282,9 +280,7 @@ async function resolveLiveMachine(fetch, node) {
     );
   }
   const rows = machineRows(
-    await fetch(`/nodes?reservation_id=${encodeURIComponent(reservation)}`, {
-      method: "GET",
-    })
+    await orchestrator.listStaffNodes(fetch, { reservation_id: reservation })
   );
   const refs = new Set([id, text(node?.id), text(node?.k8s_node_name)].filter(Boolean));
   const matches = rows.filter((machine) => refs.has(text(machine?.node_id)));

package/src/admin-ssh.mjs

@@ -1,3 +1,4 @@
+import * as orchestrator from "../vendor/api-client/orchestrator.js";
 import { spawn } from "node:child_process";
 import { mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
 import { constants, tmpdir } from "node:os";
@@ -21,7 +22,7 @@ function run(program, args, signal) {
 
 export async function openAdminSsh({ input, fetch, execute, runtime }, { runProcess = run } = {}) {
   // Read the existing node route; issuance returns only its own certificate.
-  const node = await fetch(`/nodes/${encodeURIComponent(input.node_id)}`, { method: "GET" });
+  const node = await orchestrator.getNode(fetch, input.node_id);
   const host = node.ip;
   const port = node.port ?? 22;
   if (

package/src/api-client.mjs

@@ -251,9 +251,12 @@ export function resolveInstallerBaseUrl({ env = process.env } = {}) {
 }
 
 function operatorProxyEndpoint(endpoint) {
-  // Shared clients use canonical staff or Benchmark paths. Keep the existing
+  // Shared clients use canonical staff or owner paths. Keep the existing
   // staff envelope, including its admin-role and impersonation checks.
-  const path = normalizeComputePath(endpoint).replace(/^\/v1\/(?:staff|benchmark)(?=\/|$)/, "");
+  const path = normalizeComputePath(endpoint).replace(
+    /^\/v1\/(?:staff|benchmark|orchestrator)(?=\/|$)/,
+    ""
+  );
   return `/v1/staff${path}`;
 }
 

package/src/evidence-commands.mjs

@@ -1,7 +1,11 @@
 import * as gatewayApi from "../vendor/api-client/gateway.js";
 import { gpuLabeler } from "./gpu-catalog.mjs";
 import { clusterFactLabel, reservationFactsForCluster } from "./kubernetes-commands.mjs";
-import { listOwnedActiveMachines, resolveMachineReference } from "./machine-reference.mjs";
+import {
+  canonicalMachineId as machineId,
+  listOwnedActiveMachines,
+  resolveMachineReference,
+} from "./machine-reference.mjs";
 import { machineReachability } from "./vm-commands.mjs";
 
 const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
@@ -106,11 +110,6 @@ function containsUnsafeFields(value) {
   });
 }
 
-function machineId(value) {
-  const source = record(value);
-  return text(source.id) ?? text(source.machine_id) ?? text(source.instance_id);
-}
-
 function reservationId(value) {
   const source = record(value);
   return text(source.reservation_id) ?? text(source.reservationId);
@@ -250,6 +249,11 @@ function lifecycle(value, kind) {
   if (["failed", "error", "unavailable"].includes(state)) {
     return { class: "failed", phase: "failed" };
   }
+  if (state === "bare_metal") {
+    return source.health_readiness?.ready === true
+      ? { class: "ready", phase: "active" }
+      : { class: "working", phase: "provisioning" };
+  }
   if (["active", "online", "ready", "running", "provisioned"].includes(state)) {
     return { class: "ready", phase: kind === "cluster" ? "access_ready" : "active" };
   }

package/src/external-bucket-commands.mjs

@@ -1,8 +1,9 @@
+import * as storageApi from "../vendor/api-client/orchestrator.js";
 import * as gatewayApi from "../vendor/api-client/gateway.js";
 import { createHash } from "node:crypto";
 import { readFile } from "node:fs/promises";
 
-import { CliApiError, computeEndpoint } from "./api-client.mjs";
+import { CliApiError } from "./api-client.mjs";
 import { isRecoverableWaitFailure } from "./interaction-runtime.mjs";
 import {
   codeOf,
@@ -18,7 +19,6 @@ import {
 
 const IMPORT_POLL_INTERVAL_MS = 10_000;
 const DEFAULT_IMPORT_TIMEOUT_MS = 30 * 60 * 1_000;
-const STORAGE_PREFIX = "/nodes/storage-drives";
 const PROVIDERS = new Set(["gcs", "s3", "r2"]);
 
 function usage(message, field, code = "usage_error") {
@@ -438,27 +438,6 @@ function requireMutationPreflight(input, runtime) {
   }
 }
 
-const SAFE_EXTERNAL_ERRORS = {
-  external_bucket_required: "The external bucket record is incomplete.",
-  external_endpoint_url_invalid: "The Cloudflare R2 endpoint is invalid.",
-  external_endpoint_url_required: "Cloudflare R2 requires an account endpoint.",
-  external_s3_credentials_required: "Current S3-compatible credentials are required.",
-  storage_drive_attached_elsewhere:
-    "This working volume is already attached to a different reservation.",
-  storage_drive_attached_to_reservation:
-    "Detach the working volume from every reservation before disconnecting the source.",
-  storage_location_unavailable:
-    "No managed destination is available for this reservation. The source bucket was not changed.",
-  storage_regional_bucket_unconfigured:
-    "Managed destination storage is temporarily unavailable. The source bucket was not changed.",
-  storage_reservation_node_offline:
-    "A reservation machine is offline, so the import destination was not changed.",
-  storage_source_client_unavailable: "The external bucket client is temporarily unavailable.",
-  storage_source_list_failed: "Ornn could not read the external bucket.",
-  storage_source_not_verified: "Verify this external bucket before importing it.",
-  storage_source_verification_unsupported: "This external bucket kind cannot be verified.",
-};
-
 function safeExternalError(error, fallback, { action, forcePartial = false } = {}) {
   if (error instanceof StorageCommandError) return error;
   if (error instanceof CliApiError && (error.status === 401 || error.status === 403)) {
@@ -476,8 +455,7 @@ function safeExternalError(error, fallback, { action, forcePartial = false } = {
   const unavailable = error?.status === undefined || error?.status >= 500;
   const ownerMessage = detailOf(error)?.message;
   return new StorageCommandError(
-    SAFE_EXTERNAL_ERRORS[code] ??
-      (typeof ownerMessage === "string" && ownerMessage.trim() ? ownerMessage : fallback),
+    typeof ownerMessage === "string" && ownerMessage.trim() ? ownerMessage : fallback,
     {
       action,
       code: code ?? (unavailable ? "service_unavailable" : "external_bucket_operation_failed"),
@@ -560,8 +538,9 @@ async function connectBucket(input, runtime) {
 
   let created;
   try {
-    created = await runtime.fetch(computeEndpoint(STORAGE_PREFIX), {
-      body: {
+    created = await storageApi.createDrive(
+      runtime.fetch,
+      {
         name: intent.name,
         provider: "ornn_volume",
         source_provider: intent.kind === "gcs" ? "external_gcs" : "s3",
@@ -575,9 +554,8 @@ async function connectBucket(input, runtime) {
         ...(intent.accessKeyId ? { external_access_key_id: intent.accessKeyId } : {}),
         ...(intent.secretAccessKey ? { external_secret_access_key: intent.secretAccessKey } : {}),
       },
-      headers: idempotencyHeaders(input),
-      method: "POST",
-    });
+      { headers: idempotencyHeaders(input) }
+    );
   } catch (error) {
     throw safeExternalError(error, "The external bucket could not be connected safely.");
   }
@@ -609,12 +587,11 @@ async function verifyBucket(input, runtime) {
   const id = safeIdentifier(source.id);
   let verified;
   try {
-    verified = await runtime.fetch(
-      computeEndpoint(`${STORAGE_PREFIX}/${encodeURIComponent(id)}/verify-source`),
-      {
-        headers: idempotencyHeaders(input),
-        method: "POST",
-      }
+    verified = await storageApi.updateDrive(
+      runtime.fetch,
+      id,
+      { verify_source: true },
+      { headers: idempotencyHeaders(input) }
     );
   } catch (error) {
     throw safeExternalError(error, "External bucket verification could not be completed safely.");
@@ -668,16 +645,16 @@ async function updateCredentials(input, runtime) {
   const id = safeIdentifier(source.id);
   let updated;
   try {
-    updated = await runtime.fetch(
-      computeEndpoint(`${STORAGE_PREFIX}/${encodeURIComponent(id)}/source-credentials`),
+    updated = await storageApi.updateDrive(
+      runtime.fetch,
+      id,
       {
-        body: {
+        source_credentials: {
           external_access_key_id: accessKeyId,
           external_secret_access_key: secret,
         },
-        headers: idempotencyHeaders(input),
-        method: "PATCH",
-      }
+      },
+      { headers: idempotencyHeaders(input) }
     );
   } catch (error) {
     throw safeExternalError(error, "External bucket credentials could not be updated safely.");
@@ -715,10 +692,12 @@ async function disconnectBucket(input, runtime) {
     );
   }
   try {
-    await runtime.fetch(computeEndpoint(`${STORAGE_PREFIX}/${encodeURIComponent(safe.id)}`), {
-      headers: idempotencyHeaders(input),
-      method: "DELETE",
-    });
+    await storageApi.deleteDrive(
+      runtime.fetch,
+      safe.id,
+      {},
+      { headers: idempotencyHeaders(input) }
+    );
   } catch (error) {
     throw safeExternalError(error, "The external bucket could not be disconnected safely.");
   }

package/src/interaction-runtime.mjs

@@ -2,6 +2,7 @@ import { randomUUID } from "node:crypto";
 import { createInterface } from "node:readline/promises";
 
 import { resolveAuthBaseUrl } from "./device-auth.mjs";
+import { CliApiError } from "./api-client.mjs";
 
 const BOOLEAN_OPTIONS = new Set([
   "acknowledge-retained-os",
@@ -53,6 +54,7 @@ export class InteractionError extends Error {
 }
 
 export function isRecoverableWaitFailure(error) {
+  if (error instanceof CliApiError && error.status === undefined) return true;
   const status = Number(error?.status);
   if (status === 401 || status === 403 || (Number.isFinite(status) && status >= 500)) {
     return true;

package/src/machine-reference.mjs

@@ -1,3 +1,4 @@
+import * as orchestrator from "../vendor/api-client/orchestrator.js";
 import { getCliSession } from "../vendor/api-client/authorization.js";
 import { listAllReservations } from "../vendor/api-client/commerce.js";
 import { gpuLabeler } from "./gpu-catalog.mjs";
@@ -139,8 +140,9 @@ export async function listActiveDirectReservations(context, interaction) {
   );
 }
 
-export async function listOwnedActiveMachines(context, interaction) {
-  const reservations = await listActiveDirectReservations(context, interaction);
+export async function listOwnedActiveMachines(context, interaction, activeReservations) {
+  const reservations =
+    activeReservations ?? (await listActiveDirectReservations(context, interaction));
   const pages = await Promise.all(
     reservations.map(async (reservation) => {
       const ref = reservationId(reservation);
@@ -150,21 +152,13 @@ export async function listOwnedActiveMachines(context, interaction) {
           "The gateway returned a capacity reservation without a canonical identifier."
         );
       }
-      const payload = await context.fetch(
-        `/v1/workflows/compute/nodes/reservations/${encodeURIComponent(ref)}/machines`,
-        { method: "GET" }
-      );
+      const payload = await orchestrator.listNodes(context.fetch, { reservation_id: ref });
       const machineRows = rows(payload, "machines");
       if (!machineRows)
         invalidGateway(interaction, "The gateway returned an invalid machine collection.");
       return machineRows
         .map(record)
-        .filter((machine) => !TERMINAL_MACHINE_STATES.has(machineState(machine)))
-        .map((machine) => ({
-          ...machine,
-          reservation_id:
-            text(machine.reservation_id) ?? text(machine.commerce_reservation_id) ?? ref,
-        }));
+        .filter((machine) => !TERMINAL_MACHINE_STATES.has(machineState(machine)));
     })
   );
 
@@ -185,11 +179,7 @@ export async function listOwnedActiveMachines(context, interaction) {
 
 async function fetchCanonicalMachine(reference, context, interaction, { allowMiss = false } = {}) {
   try {
-    const machine = record(
-      await context.fetch(`/v1/workflows/compute/nodes/${encodeURIComponent(reference)}`, {
-        method: "GET",
-      })
-    );
+    const machine = record(await orchestrator.getNode(context.fetch, reference));
     if (canonicalMachineId(machine)?.toLowerCase() !== reference.toLowerCase()) {
       invalidGateway(
         interaction,

package/src/mount-commands.mjs

@@ -1,3 +1,4 @@
+import * as storageApi from "../vendor/api-client/orchestrator.js";
 import * as gatewayApi from "../vendor/api-client/gateway.js";
 import { CliApiError } from "./api-client.mjs";
 import { isRecoverableWaitFailure } from "./interaction-runtime.mjs";
@@ -314,12 +315,7 @@ async function reservationMachineCount(runtime, reservationId, signal) {
   if (cache.has(reservationId)) return cache.get(reservationId);
   let count = 0;
   try {
-    const rows = candidateRows(
-      await runtime.fetch("/v1/orchestrator/storage-targets", {
-        method: "GET",
-        ...(signal ? { signal } : {}),
-      })
-    );
+    const rows = candidateRows(await storageApi.listStorageTargets(runtime.fetch, signal));
     const row = rows.find(
       (candidate) =>
         candidate.id === reservationId || candidate.reservation_ids.includes(reservationId)
@@ -560,9 +556,7 @@ async function candidates(input, runtime) {
     "ornn volume-mounts candidates [--limit <1-500>] [--cursor <cursor>]",
     runtime.interaction
   );
-  const rows = candidateRows(
-    await runtime.fetch("/v1/orchestrator/storage-targets", { method: "GET" })
-  );
+  const rows = candidateRows(await storageApi.listStorageTargets(runtime.fetch));
   const offset = cursorOffset(input.cursor, runtime.interaction);
   const limit = pageLimit(input.limit, runtime.interaction);
   if (offset > rows.length) {