@ornncompute/cli 1.0.121 → 1.0.123

package/vendor/capabilities/cli.js

@@ -1,3 +1,208 @@
+// ../../packages/api-client/dist/orchestrator/catalog.js
+var hardwareCatalogPath = "/v1/orchestrator/catalog/hardware";
+function getHardwareCatalog(request, signal) {
+  return request(hardwareCatalogPath, {
+    method: "GET",
+    ...signal ? { signal } : {}
+  });
+}
+
+// ../../packages/api-client/dist/orchestrator/locality.js
+var localityGeolocatePath = "/v1/orchestrator/locality/geolocate";
+function geolocate(request, query3, signal) {
+  const target = query3.ip !== void 0 ? `ip=${encodeURIComponent(query3.ip)}` : `address=${encodeURIComponent(query3.address)}`;
+  return request(`${localityGeolocatePath}?${target}`, {
+    method: "GET",
+    ...signal ? { signal } : {}
+  });
+}
+
+// ../../packages/api-client/dist/orchestrator/registry.js
+function getContainerRegistry(request) {
+  return request("/v1/orchestrator/registry", { method: "GET" });
+}
+function listRegistryRepositories(request) {
+  return request("/v1/orchestrator/registry/repositories", { method: "GET" });
+}
+function listRegistryTags(request, repository) {
+  return request(`/v1/orchestrator/registry/tags?${new URLSearchParams({ repository })}`, {
+    method: "GET"
+  });
+}
+function getRegistryUsage(request) {
+  return request("/v1/orchestrator/registry/usage", { method: "GET" });
+}
+function listRegistryCaches(request, query3 = {}) {
+  const params = new URLSearchParams();
+  if (query3.controller_id !== void 0)
+    params.set("controller_id", query3.controller_id);
+  return request(`/v1/orchestrator/registry/caches${params.size ? `?${params}` : ""}`, {
+    method: "GET"
+  });
+}
+function deleteRegistryTag(request, repository, tag) {
+  return request(`/v1/orchestrator/registry/tags?${new URLSearchParams({ repository, tag })}`, {
+    method: "DELETE"
+  });
+}
+
+// ../../packages/api-client/dist/orchestrator/drives.js
+function queryPath(path, query3) {
+  const params = new URLSearchParams();
+  for (const [key, value] of Object.entries(query3)) {
+    if (value !== void 0 && value !== null)
+      params.set(key, String(value));
+  }
+  return `${path}${params.size ? `?${params}` : ""}`;
+}
+function listDrives(request, query3 = {}, signal) {
+  return request(queryPath("/v1/orchestrator/drives", query3), {
+    method: "GET",
+    ...signal ? { signal } : {}
+  });
+}
+function getDrive(request, id, query3 = {}, options = {}) {
+  return request(queryPath(`/v1/orchestrator/drives/${encodeURIComponent(id)}`, query3), {
+    method: "GET",
+    ...options
+  });
+}
+function createDrive(request, body2, options = {}) {
+  return request("/v1/orchestrator/drives", {
+    method: "POST",
+    body: body2,
+    ...options
+  });
+}
+function updateDrive(request, id, body2, options = {}) {
+  return request(`/v1/orchestrator/drives/${encodeURIComponent(id)}`, {
+    method: "PATCH",
+    body: body2,
+    ...options
+  });
+}
+function deleteDrive(request, id, query3 = {}, options = {}) {
+  return request(queryPath(`/v1/orchestrator/drives/${encodeURIComponent(id)}`, query3), {
+    method: "DELETE",
+    ...options
+  });
+}
+function listStorageTargets(request, signal) {
+  return request("/v1/orchestrator/storage-targets", {
+    method: "GET",
+    ...signal ? { signal } : {}
+  });
+}
+
+// ../../packages/api-client/dist/orchestrator/drive-files.js
+function drivePath(id) {
+  return `/v1/orchestrator/drives/${encodeURIComponent(id)}`;
+}
+function listDriveContents(request, id, query3 = {}, signal) {
+  const params = new URLSearchParams();
+  for (const [key, value] of Object.entries(query3)) {
+    if (value !== void 0)
+      params.set(key, String(value));
+  }
+  return request(`${drivePath(id)}/contents${params.size ? `?${params}` : ""}`, {
+    method: "GET",
+    ...signal ? { signal } : {}
+  });
+}
+function clearDriveContents(request, id) {
+  return request(`${drivePath(id)}/contents`, { method: "DELETE" });
+}
+
+// ../../packages/api-client/dist/orchestrator/nodes.js
+function nodeQuery(query3) {
+  const params = new URLSearchParams();
+  for (const [key, value] of Object.entries(query3)) {
+    if (value !== void 0)
+      params.set(key, String(value));
+  }
+  return params.size ? `?${params}` : "";
+}
+function listNodes(request, query3 = {}, signal) {
+  return request(`/v1/orchestrator/nodes${nodeQuery(query3)}`, {
+    method: "GET",
+    ...signal ? { signal } : {}
+  });
+}
+function listStaffNodes(request, query3 = {}, signal) {
+  return request(`/v1/staff/nodes${nodeQuery(query3)}`, {
+    method: "GET",
+    ...signal ? { signal } : {}
+  });
+}
+function nodeResourcePath(id) {
+  return `/v1/orchestrator/nodes/${encodeURIComponent(id)}`;
+}
+function getNode(request, id, signal) {
+  return request(nodeResourcePath(id), {
+    method: "GET",
+    ...signal ? { signal } : {}
+  });
+}
+function terminateNode(request, id, body2, headers) {
+  return request(`${nodeResourcePath(id)}/terminate`, {
+    method: "POST",
+    body: body2,
+    ...headers ? { headers } : {}
+  });
+}
+function assignNode(request, id, body2, headers) {
+  return request(`${nodeResourcePath(id)}/assign`, {
+    method: "POST",
+    body: body2,
+    ...headers ? { headers } : {}
+  });
+}
+function issueNodeSshCertificate(request, id, body2) {
+  return request(`${nodeResourcePath(id)}/ssh-certificates`, { method: "POST", body: body2 });
+}
+function rebootNode(request, id, body2, headers) {
+  return request(`${nodeResourcePath(id)}/reboot`, {
+    method: "POST",
+    body: body2,
+    ...headers ? { headers } : {}
+  });
+}
+function pushNodeKeys(request, id, body2 = {}) {
+  return request(`${nodeResourcePath(id)}/push-keys`, { method: "POST", body: body2 });
+}
+
+// ../../packages/api-client/dist/orchestrator/node-access.js
+function launchReservation(request, reservationId, body2) {
+  return request(`/v1/orchestrator/nodes/reservations/${encodeURIComponent(reservationId)}/launch`, { method: "POST", body: body2 });
+}
+function switchReservationAccess(request, reservationId, body2) {
+  return request(`/v1/orchestrator/nodes/reservations/${encodeURIComponent(reservationId)}/switch-access`, { method: "POST", body: body2 });
+}
+function listReservationSshKeys(request, reservationId, query3 = {}, signal) {
+  const params = new URLSearchParams();
+  if (query3.virtual_machine_id !== void 0)
+    params.set("virtual_machine_id", query3.virtual_machine_id);
+  return request(`/v1/orchestrator/nodes/reservations/${encodeURIComponent(reservationId)}/ssh-keys${params.size ? `?${params}` : ""}`, { method: "GET", ...signal ? { signal } : {} });
+}
+function addReservationSshKey(request, reservationId, body2, options = {}) {
+  return request(`/v1/orchestrator/nodes/reservations/${encodeURIComponent(reservationId)}/ssh-keys`, { method: "POST", body: body2, ...options });
+}
+
+// ../../packages/api-client/dist/orchestrator/node-sanitize.js
+function sanitizePath(nodeId3, jobId) {
+  const base3 = `/v1/orchestrator/nodes/${encodeURIComponent(nodeId3)}/sanitize-drives`;
+  return jobId === void 0 ? base3 : `${base3}/${encodeURIComponent(jobId)}`;
+}
+function startNodeSanitize(request, nodeId3, body2) {
+  return request(sanitizePath(nodeId3), { method: "POST", body: body2 });
+}
+function getNodeSanitize(request, nodeId3, jobId) {
+  return request(sanitizePath(nodeId3, jobId), { method: "GET" });
+}
+function updateNodeSanitize(request, nodeId3, jobId, body2) {
+  return request(sanitizePath(nodeId3, jobId), { method: "PATCH", body: body2 });
+}
+
 // ../../packages/capabilities/dist/capabilities/admin-ssh.js
 import { z } from "zod";
 
@@ -62,7 +267,7 @@ var adminSshCapability = defineCapability({
   roles: ["admin"],
   description: "Open staff SSH using a temporary local key and a short-lived node certificate.",
   mutation: "local",
-  http: { method: "POST", path: "/nodes/{node_id}/ssh-certificates" },
+  http: { method: "POST", path: "/v1/orchestrator/nodes/{node_id}/ssh-certificates" },
   mcp: false,
   slack: false,
   cli: {
@@ -78,9 +283,8 @@ var adminSshCapability = defineCapability({
     }
   },
   input: z.object({ node_id: z.string().uuid(), public_key: z.string().min(1) }),
-  execute: (ctx, input) => ctx.fetch(`/nodes/${encodeURIComponent(input.node_id)}/ssh-certificates`, {
-    method: "POST",
-    body: { public_key: input.public_key }
+  execute: (ctx, input) => issueNodeSshCertificate(ctx.fetch, input.node_id, {
+    public_key: input.public_key
   })
 });
 
@@ -287,14 +491,6 @@ var listSupplierOrganizations2 = listSupplierOrganizations;
 
 // ../../packages/capabilities/dist/capabilities/fleet.js
 import { z as z2 } from "zod";
-function queryPath(path, params) {
-  const parts = [];
-  for (const [key, value] of Object.entries(params)) {
-    if (value?.trim())
-      parts.push(`${encodeURIComponent(key)}=${encodeURIComponent(value.trim())}`);
-  }
-  return parts.length ? `${path}?${parts.join("&")}` : path;
-}
 var suppliersInput = z2.object({
   q: z2.string().optional(),
   offset: z2.number().int().min(0).optional(),
@@ -473,15 +669,15 @@ var listNodesCapability = defineCapability({
       limit: parsed.max != null || parsed.limit != null ? String(parsed.max ?? parsed.limit) : void 0
     };
     if (ctx.role === "user") {
-      return ctx.fetch(queryPath("/nodes", pagination), { method: "GET" });
+      return listNodes(ctx.fetch, pagination);
     }
-    return ctx.fetch(queryPath("/nodes", {
+    return listStaffNodes(ctx.fetch, {
       organization_id: parsed.organization_id,
       facility_id: parsed.facility_id,
       status: parsed.status,
       reservation_id: parsed.reservation_id,
       ...pagination
-    }), { method: "GET" });
+    });
   }
 });
 var nodeExecCapability = defineCapability({
@@ -520,7 +716,7 @@ var nodeTerminateCapability = defineCapability({
   roles: ["admin"],
   description: "Admin-only. Mark a node terminated and clear its assignment once no undeleted VM remains on it. Does no host cleanup. There is no deenroll verb. Slack waits for a human confirm. ",
   mutation: "preview-confirm",
-  http: { method: "POST", path: "/nodes/{id}/terminate" },
+  http: { method: "POST", path: "/v1/orchestrator/nodes/{id}/terminate" },
   cli: {
     command: ["admin", "nodes", "terminate"],
     vnext: {
@@ -555,11 +751,7 @@ var nodeTerminateCapability = defineCapability({
     if (!ctx.confirmed) {
       return preview("node.terminate", { node_id: id, ...body2 });
     }
-    return ctx.fetch(`/nodes/${encodeURIComponent(id)}/terminate`, {
-      method: "POST",
-      body: body2,
-      ...parsed.idempotency_key ? { headers: { "Idempotency-Key": parsed.idempotency_key } } : {}
-    });
+    return terminateNode(ctx.fetch, id, body2, parsed.idempotency_key ? { "Idempotency-Key": parsed.idempotency_key } : void 0);
   }
 });
 var fleetCapabilities = [
@@ -1196,7 +1388,7 @@ var adminNodeHealthCapability = defineCapability({
   roles: ["admin"],
   description: "Read lifecycle and readiness facts for one enrolled node.",
   mutation: "read",
-  http: { method: "GET", path: "/nodes/{id}" },
+  http: { method: "GET", path: "/v1/orchestrator/nodes/{id}" },
   cli: {
     command: ["admin", "nodes", "health"],
     vnext: adminHelp(["admin", "nodes", "health"], "Inspect lifecycle and readiness facts for one node.", "ornn admin nodes health <node-id>", "ornn admin nodes health <node-id> --format json", ["canonical node ID"])
@@ -1206,7 +1398,7 @@ var adminNodeHealthCapability = defineCapability({
   input: nodeInput,
   execute: async (ctx, input) => {
     const parsed = nodeInput.parse(input);
-    return ctx.fetch(`/nodes/${encodeURIComponent(parsed.node_id)}`, { method: "GET" });
+    return getNode(ctx.fetch, parsed.node_id);
   }
 });
 var adminNodeMetricsCapability = withAdminBinding(telemetryLatestCapability, adminHelp(["admin", "nodes", "metrics"], "Read a bounded telemetry window for one node.", "ornn admin nodes metrics <node-id> [--span 15m] [--start TIME --end TIME] [--max-points 240]", "ornn admin nodes metrics <node-id> --span 15m [--start TIME --end TIME] --max-points 240 --format json", ["canonical node ID"]));
@@ -1320,54 +1512,6 @@ function listOffers(request, filter = {}) {
 // ../../packages/capabilities/dist/capabilities/admin-capacity-reservations.js
 import { z as z9 } from "zod";
 
-// ../../packages/api-client/dist/orchestrator/catalog.js
-var hardwareCatalogPath = "/v1/orchestrator/catalog/hardware";
-function getHardwareCatalog(request, signal) {
-  return request(hardwareCatalogPath, {
-    method: "GET",
-    ...signal ? { signal } : {}
-  });
-}
-
-// ../../packages/api-client/dist/orchestrator/locality.js
-var localityGeolocatePath = "/v1/orchestrator/locality/geolocate";
-function geolocate(request, query3, signal) {
-  const target = query3.ip !== void 0 ? `ip=${encodeURIComponent(query3.ip)}` : `address=${encodeURIComponent(query3.address)}`;
-  return request(`${localityGeolocatePath}?${target}`, {
-    method: "GET",
-    ...signal ? { signal } : {}
-  });
-}
-
-// ../../packages/api-client/dist/orchestrator/registry.js
-function getContainerRegistry(request) {
-  return request("/v1/orchestrator/registry", { method: "GET" });
-}
-function listRegistryRepositories(request) {
-  return request("/v1/orchestrator/registry/repositories", { method: "GET" });
-}
-function listRegistryTags(request, repository) {
-  return request(`/v1/orchestrator/registry/tags?${new URLSearchParams({ repository })}`, {
-    method: "GET"
-  });
-}
-function getRegistryUsage(request) {
-  return request("/v1/orchestrator/registry/usage", { method: "GET" });
-}
-function listRegistryCaches(request, query3 = {}) {
-  const params = new URLSearchParams();
-  if (query3.controller_id !== void 0)
-    params.set("controller_id", query3.controller_id);
-  return request(`/v1/orchestrator/registry/caches${params.size ? `?${params}` : ""}`, {
-    method: "GET"
-  });
-}
-function deleteRegistryTag(request, repository, tag) {
-  return request(`/v1/orchestrator/registry/tags?${new URLSearchParams({ repository, tag })}`, {
-    method: "DELETE"
-  });
-}
-
 // ../../packages/capabilities/dist/capabilities/staff-shared.js
 function statusOf(error) {
   if (error && typeof error === "object" && "status" in error) {
@@ -2969,17 +3113,13 @@ function requireAdmin(ctx) {
   if (ctx.role !== "admin")
     throw new Error("Admin role required.");
 }
-function sanitizePath(nodeId3, jobId) {
-  const base3 = `/nodes/${encodeURIComponent(nodeId3)}/sanitize-drives`;
-  return jobId ? `${base3}/${encodeURIComponent(jobId)}` : base3;
-}
 var nodeSanitizeStartCapability = defineCapability({
   id: "node.sanitize.start",
   domain: "fleet",
   roles: ["admin"],
   description: "Destructive staff maintenance write: start node drive sanitization with a stable job UUID. data_wipe erases local data drives and keeps the OS; ram_roundtrip does not erase drives; node_turnover wipes and restores the whole node; host_restore restores the host. Supply the exact operation-specific confirmation phrase yourself; it is never filled automatically. The job then waits for staff approval. Slack waits for a human confirm.",
   mutation: "preview-confirm",
-  http: { method: "POST", path: "/nodes/{node_id}/sanitize-drives" },
+  http: { method: "POST", path: "/v1/orchestrator/nodes/{node_id}/sanitize-drives" },
   cli: {
     command: ["admin", "nodes", "sanitize"],
     vnext: sanitizeHelp(["admin", "nodes", "sanitize"], "Start one held sanitize job on one exact node.", "ornn admin nodes sanitize <node-id> --operation data_wipe|ram_roundtrip|node_turnover|host_restore --confirmation PHRASE [--recovery-uuid UUID] [--job-id UUID] [--batch UUID]", "Exact node, operation, job UUID, and confirmation phrase.")
@@ -2991,7 +3131,7 @@ var nodeSanitizeStartCapability = defineCapability({
     const { node_id, ...body2 } = nodeSanitizeStartInput.parse(input);
     if (!ctx.confirmed)
       return preview("node.sanitize.start", { node_id, ...body2 });
-    return ctx.fetch(sanitizePath(node_id), { method: "POST", body: body2 });
+    return startNodeSanitize(ctx.fetch, node_id, body2);
   }
 });
 var nodeSanitizeShowCapability = defineCapability({
@@ -3000,7 +3140,7 @@ var nodeSanitizeShowCapability = defineCapability({
   roles: ["admin"],
   description: "Staff maintenance read: show the bounded JSON status for one node sanitize job, including its operation, approval, manual cleanup attestation, and per-drive results. This does not request an NDJSON download.",
   mutation: "read",
-  http: { method: "GET", path: "/nodes/{node_id}/sanitize-drives/{job_id}" },
+  http: { method: "GET", path: "/v1/orchestrator/nodes/{node_id}/sanitize-drives/{job_id}" },
   cli: {
     command: ["admin", "nodes", "sanitize-status"],
     vnext: sanitizeHelp(["admin", "nodes", "sanitize-status"], "Read one sanitize job on one exact node.", "ornn admin nodes sanitize-status <node-id> --job UUID")
@@ -3010,7 +3150,7 @@ var nodeSanitizeShowCapability = defineCapability({
   execute: async (ctx, input) => {
     requireAdmin(ctx);
     const parsed = nodeSanitizeShowInput.parse(input);
-    return ctx.fetch(sanitizePath(parsed.node_id, parsed.job_id), { method: "GET" });
+    return getNodeSanitize(ctx.fetch, parsed.node_id, parsed.job_id);
   }
 });
 var nodeSanitizeUpdateCapability = defineCapability({
@@ -3019,7 +3159,7 @@ var nodeSanitizeUpdateCapability = defineCapability({
   roles: ["admin"],
   description: "Staff maintenance write on a held sanitize job. APPROVE SANITIZATION starts destructive maintenance. SKIP SANITIZATION skips an eligible first-use wipe and certifies nothing. ACCEPT MANUAL CLEANUP lets a held Bare Metal release finish when its node_turnover job is awaiting_approval with no recovery image, after staff manually revoked tenant access and sanitized the data drives with the OS retained; it requires manual_cleanup with the reservation, the current orchestrator release operation, a reason, the evidence file SHA-256, and all three attestations. The owner enforces eligibility. Slack waits for a human confirm.",
   mutation: "preview-confirm",
-  http: { method: "PATCH", path: "/nodes/{node_id}/sanitize-drives/{job_id}" },
+  http: { method: "PATCH", path: "/v1/orchestrator/nodes/{node_id}/sanitize-drives/{job_id}" },
   cli: {
     command: ["admin", "nodes", "sanitize-decide"],
     vnext: sanitizeHelp(["admin", "nodes", "sanitize-decide"], "Approve, skip, or accept manual cleanup for one held sanitize job.", 'ornn admin nodes sanitize-decide <node-id> --job UUID --confirmation "APPROVE SANITIZATION"|"SKIP SANITIZATION"|"ACCEPT MANUAL CLEANUP" [--reservation UUID --release-operation UUID --reason TEXT --evidence-file PATH --tenant-access-revoked --data-drives-sanitized --acknowledge-retained-os]', "Exact node, job, decision, and for manual cleanup the reservation, release operation, reason, evidence SHA-256, and retained-OS attestations.")
@@ -3031,7 +3171,7 @@ var nodeSanitizeUpdateCapability = defineCapability({
     const { node_id, job_id, ...body2 } = nodeSanitizeUpdateInput.parse(input);
     if (!ctx.confirmed)
       return preview("node.sanitize.update", { node_id, job_id, ...body2 });
-    return ctx.fetch(sanitizePath(node_id, job_id), { method: "PATCH", body: body2 });
+    return updateNodeSanitize(ctx.fetch, node_id, job_id, body2);
   }
 });
 var adminNodeSanitizeCapabilities = [
@@ -3101,14 +3241,10 @@ async function reboot(ctx, input, mode) {
     return preview2(`nodes.${mode}`, payload);
   if (!parsed.machine_id)
     throw new Error("The live machine target must be resolved before reboot.");
-  return ctx.fetch(`/nodes/${encodeURIComponent(parsed.machine_id)}/reboot`, {
-    method: "POST",
-    body: {
-      mode,
-      ...parsed.idempotency_key ? { request_id: parsed.idempotency_key } : {}
-    },
-    headers: requestHeaders(parsed.idempotency_key)
-  });
+  return rebootNode(ctx.fetch, parsed.machine_id, {
+    mode,
+    ...parsed.idempotency_key ? { request_id: parsed.idempotency_key } : {}
+  }, requestHeaders(parsed.idempotency_key));
 }
 var adminNodeRebootCapability = defineCapability({
   id: "nodes.reboot",
@@ -3116,7 +3252,7 @@ var adminNodeRebootCapability = defineCapability({
   roles: ["admin"],
   description: "Reboot the exact live machine backing one managed node after a normalized review.",
   mutation: "preview-confirm",
-  http: { method: "POST", path: "/nodes/{id}/reboot" },
+  http: { method: "POST", path: "/v1/orchestrator/nodes/{id}/reboot" },
   cli: {
     command: ["admin", "nodes", "reboot"],
     vnext: adminLifecycleHelp(["admin", "nodes", "reboot"], "Reboot one exact live machine while preserving local data and access configuration.", "ornn admin nodes reboot <node-ref> [] [--no-wait] [--timeout SECONDS]", "Unsupported: reboot requires an eligible human terminal.", "Node and live-machine identities, supplier, facility, capacity assignment, and preserved access.")
@@ -3132,7 +3268,7 @@ var adminNodeHardResetCapability = defineCapability({
   roles: ["admin"],
   description: "Hard reset the exact live machine backing one node with explicit local-data erasure scope.",
   mutation: "preview-confirm",
-  http: { method: "POST", path: "/nodes/{id}/reboot" },
+  http: { method: "POST", path: "/v1/orchestrator/nodes/{id}/reboot" },
   cli: {
     command: ["admin", "nodes", "hard-reset"],
     vnext: adminLifecycleHelp(["admin", "nodes", "hard-reset"], "Erase local tenant data and hard reset one exact live machine.", "ornn admin nodes hard-reset <node-ref> --erase-local-data [] [--no-wait] [--timeout SECONDS]", "Unsupported: hard reset requires an eligible human terminal.", "Node and live-machine identities, supplier, facility, capacity assignment, erased local data, and restored keys.")
@@ -3148,7 +3284,7 @@ var adminNodeAssignCapability = defineCapability({
   roles: ["admin"],
   description: "Assign one exact node to one exact capacity reservation after consequence review.",
   mutation: "preview-confirm",
-  http: { method: "POST", path: "/nodes/{id}/assign" },
+  http: { method: "POST", path: "/v1/orchestrator/nodes/{id}/assign" },
   cli: {
     command: ["admin", "nodes", "assign"],
     vnext: adminLifecycleHelp(["admin", "nodes", "assign"], "Assign one exact node to one exact capacity reservation.", "ornn admin nodes assign <node-ref> --reservation <reservation-id> [] [--no-wait]", "ornn admin nodes assign <node-id> --reservation <reservation-id>  --idempotency-key KEY --format json", "Node, supplier, facility, previous and requested capacity assignments, and tenant access change.")
@@ -3165,11 +3301,7 @@ var adminNodeAssignCapability = defineCapability({
     };
     if (!ctx.confirmed)
       return preview2("nodes.assign", { node_id: id, ...body2 });
-    return ctx.fetch(`/nodes/${encodeURIComponent(id)}/assign`, {
-      method: "POST",
-      body: body2,
-      headers: requestHeaders(parsed.idempotency_key)
-    });
+    return assignNode(ctx.fetch, id, body2, requestHeaders(parsed.idempotency_key));
   }
 });
 var adminNodeLifecycleCapabilities = [
@@ -3565,7 +3697,7 @@ var machineSwitchCapability = cliOnly({
       audience: "customer",
       category: "resource",
       order: 463,
-      outcome: "Change only the explicitly requested VM, Bare Metal, or network goal while retaining SSH-key intent.",
+      outcome: "Change VM, Bare Metal, or network access while retaining SSH keys. When changing access mode, specify --network if the current network mode is unreported.",
       human: "ornn machines switch <canonical-reservation-id> [--mode vm|bare-metal] [--network public|private] [--erase-local-data]",
       automation: "ornn machines switch <canonical-reservation-id> [--mode vm|bare-metal] [--network public|private] [--erase-local-data]  --idempotency-key <key> --format json",
       acceptedReferences: ["canonical capacity-reservation ID"],
@@ -3609,7 +3741,7 @@ var machineResetCapability = cliOnly({
   id: "access.machines.reset",
   domain: "access",
   roles: ["user"],
-  description: "Erase local machine data and hard reset one exact direct machine.",
+  description: "Erase local data and hard reset one exact Bare Metal host.",
   mutation: "preview-confirm",
   input: machineMaintenanceInput,
   cli: {
@@ -3619,7 +3751,7 @@ var machineResetCapability = cliOnly({
       audience: "customer",
       category: "resource",
       order: 465,
-      outcome: "Hard reset one exact machine only with explicit local-data erasure scope and final consent.",
+      outcome: "Hard reset one exact Bare Metal host with explicit local-data erasure scope and final consent.",
       human: "ornn machines reset <canonical-machine-id|exact-hostname> --erase-local-data [--no-wait]",
       automation: "ornn machines reset <canonical-machine-id> --erase-local-data  --idempotency-key <key> --format json",
       acceptedReferences: [
@@ -3826,12 +3958,9 @@ var computeCapabilities = [
   sshKeyAssignmentSyncCapability,
   sshKeyAssignmentStatusCapability
 ];
-var NODES_ROUTE = "/v1/workflows/compute/nodes";
-var ORG_SSH_KEYS_ROUTE = `${NODES_ROUTE}/organizations/me/ssh-keys`;
-var CLUSTER_USERS_ROUTE = `${NODES_ROUTE}/organizations/me/cluster-users`;
-function reservationNodesRoute(reservationId, suffix) {
-  return `${NODES_ROUTE}/reservations/${encodeURIComponent(reservationId)}/${suffix}`;
-}
+var NODES_ROUTE = "/v1/orchestrator/nodes";
+var ORG_SSH_KEYS_ROUTE = "/v1/workflows/compute/nodes/organizations/me/ssh-keys";
+var CLUSTER_USERS_ROUTE = "/v1/workflows/compute/nodes/organizations/me/cluster-users";
 var pageInput = z17.object({
   limit: z17.number().int().min(1).max(500).optional(),
   cursor: z17.string().optional()
@@ -3845,10 +3974,7 @@ var keyIdInput = z17.object({ keyId: z17.string(), confirm: z17.boolean().option
 var nodeIdInput = z17.object({ nodeId: z17.string(), confirm: z17.boolean().optional() });
 var ADDED_KEY_OUTCOME = "The response's outcome field says whether the key was created, was already_registered (returned unchanged, so the submitted label is not applied), or was reactivated from a revoked key.";
 function rebootMachine(mode) {
-  return (ctx, input) => ctx.fetch(`${NODES_ROUTE}/${encodeURIComponent(input.nodeId)}/reboot`, {
-    method: "POST",
-    body: { mode }
-  });
+  return (ctx, input) => rebootNode(ctx.fetch, input.nodeId, { mode });
 }
 var accessVerbCapabilities = [
   defineCapability({
@@ -3860,9 +3986,7 @@ var accessVerbCapabilities = [
     http: { method: "GET", path: NODES_ROUTE },
     input: z17.object({ reservationId: z17.string() }),
     slack: false,
-    execute: (ctx, input) => ctx.fetch(`${NODES_ROUTE}?reservation_id=${encodeURIComponent(input.reservationId)}`, {
-      method: "GET"
-    })
+    execute: (ctx, input) => listNodes(ctx.fetch, { reservation_id: input.reservationId })
   }),
   defineCapability({
     id: "access.activate",
@@ -3887,18 +4011,15 @@ var accessVerbCapabilities = [
     slack: false,
     // Without disk_id the orchestrator boots "virtual-machine" from the
     // reservation's saved disk and refuses when there is none.
-    execute: (ctx, input) => ctx.fetch(reservationNodesRoute(input.reservationId, "launch"), {
-      method: "POST",
-      body: {
-        access_mode: input.accessMode === "vm" ? "virtual-machine" : "bare-metal",
-        machine_count: input.machineCount ?? 1,
-        request_id: input.requestId ?? null,
-        ssh_key_ids: input.sshKeyIds,
-        ...input.networkMode ? { network_mode: input.networkMode } : {},
-        ...input.diskId ? { disk_id: input.diskId } : {},
-        ...input.storageLoadDriveId ? { storage_load_drive_id: input.storageLoadDriveId } : {},
-        ...input.storageSaveDriveId ? { storage_save_drive_id: input.storageSaveDriveId } : {}
-      }
+    execute: (ctx, input) => launchReservation(ctx.fetch, input.reservationId, {
+      access_mode: input.accessMode === "vm" ? "virtual-machine" : "bare-metal",
+      machine_count: input.machineCount ?? 1,
+      request_id: input.requestId ?? null,
+      ssh_key_ids: input.sshKeyIds,
+      ...input.networkMode ? { network_mode: input.networkMode } : {},
+      ...input.diskId ? { disk_id: input.diskId } : {},
+      ...input.storageLoadDriveId ? { storage_load_drive_id: input.storageLoadDriveId } : {},
+      ...input.storageSaveDriveId ? { storage_save_drive_id: input.storageSaveDriveId } : {}
     })
   }),
   defineCapability({
@@ -3918,14 +4039,11 @@ var accessVerbCapabilities = [
       confirm: z17.boolean().optional()
     }),
     slack: false,
-    execute: (ctx, input) => ctx.fetch(reservationNodesRoute(input.reservationId, "switch-access"), {
-      method: "POST",
-      body: {
-        access_mode: input.accessMode ?? "bare-metal",
-        network_mode: input.networkMode,
-        request_id: input.requestId,
-        ssh_key_ids: input.sshKeyIds
-      }
+    execute: (ctx, input) => switchReservationAccess(ctx.fetch, input.reservationId, {
+      access_mode: input.accessMode ?? "bare-metal",
+      network_mode: input.networkMode,
+      request_id: input.requestId,
+      ssh_key_ids: input.sshKeyIds
     })
   }),
   defineCapability({
@@ -3937,7 +4055,7 @@ var accessVerbCapabilities = [
     http: { method: "GET", path: `${NODES_ROUTE}/reservations/{reservationId}/ssh-keys` },
     input: z17.object({ reservationId: z17.string() }),
     slack: false,
-    execute: (ctx, input) => ctx.fetch(reservationNodesRoute(input.reservationId, "ssh-keys"), { method: "GET" })
+    execute: (ctx, input) => listReservationSshKeys(ctx.fetch, input.reservationId)
   }),
   defineCapability({
     id: "access.keys.add",
@@ -3948,9 +4066,9 @@ var accessVerbCapabilities = [
     http: { method: "POST", path: `${NODES_ROUTE}/reservations/{reservationId}/ssh-keys` },
     input: publicKeyInput.extend({ reservationId: z17.string() }),
     slack: false,
-    execute: (ctx, input) => ctx.fetch(reservationNodesRoute(input.reservationId, "ssh-keys"), {
-      method: "POST",
-      body: { label: input.label ?? null, public_key: input.publicKey }
+    execute: (ctx, input) => addReservationSshKey(ctx.fetch, input.reservationId, {
+      label: input.label ?? null,
+      public_key: input.publicKey
     })
   }),
   defineCapability({
@@ -4073,9 +4191,9 @@ var machinePushKeysCapability = defineCapability({
   }),
   mcp: false,
   slack: false,
-  execute: (ctx, input) => ctx.fetch(`${NODES_ROUTE}/${encodeURIComponent(input.nodeId)}/push-keys`, {
-    method: "POST",
-    body: { request_id: input.requestId, ssh_key_ids: input.sshKeyIds }
+  execute: (ctx, input) => pushNodeKeys(ctx.fetch, input.nodeId, {
+    request_id: input.requestId,
+    ssh_key_ids: input.sshKeyIds
   })
 });
 var machineMetricsCapabilities = [
@@ -4085,7 +4203,10 @@ var machineMetricsCapabilities = [
     roles: ["user"],
     description: "Fetch a live metrics snapshot for one reservation machine.",
     mutation: "read",
-    http: { method: "GET", path: `${NODES_ROUTE}/reservations/{reservationId}/live-metrics` },
+    http: {
+      method: "GET",
+      path: "/v1/workflows/compute/nodes/reservations/{reservationId}/live-metrics"
+    },
     input: z17.object({ reservationId: z17.string(), machineId: z17.string() }),
     mcp: false,
     slack: false,
@@ -4099,7 +4220,10 @@ var machineMetricsCapabilities = [
     roles: ["user"],
     description: "Fetch historical telemetry for one reservation machine over a time range.",
     mutation: "read",
-    http: { method: "GET", path: `${NODES_ROUTE}/reservations/{reservationId}/telemetry-history` },
+    http: {
+      method: "GET",
+      path: "/v1/workflows/compute/nodes/reservations/{reservationId}/telemetry-history"
+    },
     input: z17.object({
       reservationId: z17.string(),
       machineId: z17.string(),
@@ -7508,13 +7632,6 @@ var volumeCapabilities = [
   })
 ];
 var DRIVES_ROUTE = "/v1/orchestrator/drives";
-function drivePath(driveId) {
-  return `${DRIVES_ROUTE}/${encodeURIComponent(driveId)}`;
-}
-var STORAGE_DRIVES_ROUTE = "/v1/workflows/compute/nodes/storage-drives";
-function storageDrivePath(driveId, action) {
-  return `${STORAGE_DRIVES_ROUTE}/${encodeURIComponent(driveId)}/${action}`;
-}
 var reservationInput = z30.object({ reservationId: z30.string() });
 var reservationWrite = reservationInput.extend({ confirm: z30.boolean().optional() });
 var driveInput = z30.object({ driveId: z30.string() });
@@ -7593,7 +7710,7 @@ var storageVerbCapabilities = [
     http: { method: "GET", path: "/v1/orchestrator/storage-targets" },
     input: z30.object({}),
     slack: false,
-    execute: (ctx) => ctx.fetch("/v1/orchestrator/storage-targets", { method: "GET" })
+    execute: (ctx) => listStorageTargets(ctx.fetch)
   }),
   defineCapability({
     id: "volume.list",
@@ -7608,12 +7725,10 @@ var storageVerbCapabilities = [
     }),
     mcp: { name: "storage_volumes_list" },
     slack: false,
-    execute: (ctx, input) => {
-      const query3 = new URLSearchParams({ limit: String(input.limit ?? 25) });
-      if (input.cursor)
-        query3.set("cursor", input.cursor);
-      return ctx.fetch(`${DRIVES_ROUTE}?${query3}`, { method: "GET" });
-    }
+    execute: (ctx, input) => listDrives(ctx.fetch, {
+      limit: input.limit ?? 25,
+      ...input.cursor ? { cursor: input.cursor } : {}
+    })
   }),
   defineCapability({
     id: "volume.show",
@@ -7625,7 +7740,7 @@ var storageVerbCapabilities = [
     input: driveInput,
     mcp: { name: "storage_volumes_show" },
     slack: false,
-    execute: (ctx, input) => ctx.fetch(drivePath(input.driveId), { method: "GET" })
+    execute: (ctx, input) => getDrive(ctx.fetch, input.driveId)
   }),
   defineCapability({
     id: "volume.create",
@@ -7641,9 +7756,9 @@ var storageVerbCapabilities = [
     }),
     mcp: { name: "storage_volumes_create" },
     slack: false,
-    execute: (ctx, input) => ctx.fetch(DRIVES_ROUTE, {
-      method: "POST",
-      body: { name: input.name, source_drive_id: input.sourceDriveId ?? null }
+    execute: (ctx, input) => createDrive(ctx.fetch, {
+      name: input.name,
+      source_drive_id: input.sourceDriveId ?? null
     })
   }),
   defineCapability({
@@ -7652,11 +7767,11 @@ var storageVerbCapabilities = [
     roles: ["user"],
     description: "Refresh a storage volume's (drive's) reported usage/state.",
     mutation: "preview-confirm",
-    http: { method: "POST", path: `${STORAGE_DRIVES_ROUTE}/{driveId}/refresh` },
+    http: { method: "GET", path: `${DRIVES_ROUTE}/{driveId}` },
     input: driveWrite,
     mcp: { name: "storage_volumes_refresh" },
     slack: false,
-    execute: (ctx, input) => ctx.fetch(storageDrivePath(input.driveId, "refresh"), { method: "POST" })
+    execute: (ctx, input) => getDrive(ctx.fetch, input.driveId, { refresh: true })
   }),
   defineCapability({
     id: "volume.clear",
@@ -7670,7 +7785,7 @@ var storageVerbCapabilities = [
     slack: false,
     // The route answers 204, so report which volume was cleared.
     execute: async (ctx, input) => {
-      await ctx.fetch(`${drivePath(input.driveId)}/contents`, { method: "DELETE" });
+      await clearDriveContents(ctx.fetch, input.driveId);
       return { cleared: true, drive_id: input.driveId };
     }
   }),
@@ -7685,7 +7800,7 @@ var storageVerbCapabilities = [
     mcp: { name: "storage_volumes_delete" },
     slack: false,
     execute: async (ctx, input) => {
-      await ctx.fetch(drivePath(input.driveId), { method: "DELETE" });
+      await deleteDrive(ctx.fetch, input.driveId);
       return { deleted: true, drive_id: input.driveId };
     }
   }),
@@ -7701,22 +7816,19 @@ var storageVerbCapabilities = [
     slack: false,
     execute: (ctx, input) => {
       const endpoint = input.endpointUrl ?? (input.provider === "r2" && input.accountId ? `https://${input.accountId}.r2.cloudflarestorage.com` : void 0);
-      return ctx.fetch(DRIVES_ROUTE, {
-        method: "POST",
-        body: {
-          name: input.name ?? input.bucket,
-          provider: "ornn_volume",
-          source_provider: input.provider === "gcs" ? "external_gcs" : "s3",
-          external_bucket: input.bucket,
-          external_prefix: input.prefix ?? null,
-          external_region: input.region ?? (input.provider === "r2" ? "auto" : null),
-          external_read_only: input.readOnly !== false,
-          ...input.provider === "r2" ? { external_s3_provider: "cloudflare_r2" } : {},
-          ...input.provider === "s3" ? { external_s3_provider: "aws_s3" } : {},
-          ...endpoint ? { external_endpoint_url: endpoint } : {},
-          ...input.accessKeyId ? { external_access_key_id: input.accessKeyId } : {},
-          ...input.secretAccessKey ? { external_secret_access_key: input.secretAccessKey } : {}
-        }
+      return createDrive(ctx.fetch, {
+        name: input.name ?? input.bucket,
+        provider: "ornn_volume",
+        source_provider: input.provider === "gcs" ? "external_gcs" : "s3",
+        external_bucket: input.bucket,
+        external_prefix: input.prefix ?? null,
+        external_region: input.region ?? (input.provider === "r2" ? "auto" : null),
+        external_read_only: input.readOnly !== false,
+        ...input.provider === "r2" ? { external_s3_provider: "cloudflare_r2" } : {},
+        ...input.provider === "s3" ? { external_s3_provider: "aws_s3" } : {},
+        ...endpoint ? { external_endpoint_url: endpoint } : {},
+        ...input.accessKeyId ? { external_access_key_id: input.accessKeyId } : {},
+        ...input.secretAccessKey ? { external_secret_access_key: input.secretAccessKey } : {}
       });
     }
   }),
@@ -7726,11 +7838,11 @@ var storageVerbCapabilities = [
     roles: ["user"],
     description: "Verify a connected S3-compatible bucket's source credentials/connectivity.",
     mutation: "preview-confirm",
-    http: { method: "POST", path: `${STORAGE_DRIVES_ROUTE}/{driveId}/verify-source` },
+    http: { method: "PATCH", path: `${DRIVES_ROUTE}/{driveId}` },
     input: driveWrite,
     mcp: { name: "storage_buckets_verify" },
     slack: false,
-    execute: (ctx, input) => ctx.fetch(storageDrivePath(input.driveId, "verify-source"), { method: "POST" })
+    execute: (ctx, input) => updateDrive(ctx.fetch, input.driveId, { verify_source: true })
   }),
   defineCapability({
     id: "bucket.update_credentials",
@@ -7738,13 +7850,12 @@ var storageVerbCapabilities = [
     roles: ["user"],
     description: "Update a connected S3-compatible bucket's access key credentials.",
     mutation: "preview-confirm",
-    http: { method: "PATCH", path: `${STORAGE_DRIVES_ROUTE}/{driveId}/source-credentials` },
+    http: { method: "PATCH", path: `${DRIVES_ROUTE}/{driveId}` },
     input: driveWrite.extend({ accessKeyId: z30.string(), secretAccessKey: z30.string() }),
     mcp: { name: "storage_buckets_update_credentials" },
     slack: false,
-    execute: (ctx, input) => ctx.fetch(storageDrivePath(input.driveId, "source-credentials"), {
-      method: "PATCH",
-      body: {
+    execute: (ctx, input) => updateDrive(ctx.fetch, input.driveId, {
+      source_credentials: {
         external_access_key_id: input.accessKeyId,
         external_secret_access_key: input.secretAccessKey
       }
@@ -7765,12 +7876,11 @@ var storageCompositionCapabilities = [
     }),
     mcp: false,
     slack: false,
-    execute: (ctx, input) => {
-      const query3 = new URLSearchParams({ limit: String(input.limit ?? 25), scope: "external" });
-      if (input.cursor)
-        query3.set("cursor", input.cursor);
-      return ctx.fetch(`${DRIVES_ROUTE}?${query3}`, { method: "GET" });
-    }
+    execute: (ctx, input) => listDrives(ctx.fetch, {
+      limit: input.limit ?? 25,
+      scope: "external",
+      ...input.cursor ? { cursor: input.cursor } : {}
+    })
   }),
   defineCapability({
     id: "volume.contents",
@@ -7786,14 +7896,11 @@ var storageCompositionCapabilities = [
     }),
     mcp: false,
     slack: false,
-    execute: (ctx, input) => {
-      const query3 = new URLSearchParams({ recursive: "true" });
-      if (input.path)
-        query3.set("path", input.path);
-      if (input.cursor)
-        query3.set("cursor", String(input.cursor));
-      return ctx.fetch(`${drivePath(input.driveId)}/contents?${query3}`, { method: "GET" });
-    }
+    execute: (ctx, input) => listDriveContents(ctx.fetch, input.driveId, {
+      recursive: true,
+      ...input.path ? { path: input.path } : {},
+      ...input.cursor ? { cursor: input.cursor } : {}
+    })
   })
 ];