@ornncompute/cli 1.0.124 → 1.0.126

package/vendor/capabilities/cli.js

@@ -203,6 +203,77 @@ function updateNodeSanitize(request, nodeId3, jobId, body2) {
   return request(sanitizePath(nodeId3, jobId), { method: "PATCH", body: body2 });
 }
 
+// ../../packages/api-client/dist/orchestrator/networks.js
+var networks = "/v1/orchestrator/networks";
+function networkPath(id) {
+  return `${networks}/${encodeURIComponent(id)}`;
+}
+function listNetworks(request, signal) {
+  return request(networks, { method: "GET", ...signal ? { signal } : {} });
+}
+function getNetwork(request, id, query3 = {}, signal) {
+  const params = new URLSearchParams();
+  if (query3.overlay !== void 0)
+    params.set("overlay", String(query3.overlay));
+  return request(`${networkPath(id)}${params.size ? `?${params}` : ""}`, {
+    method: "GET",
+    ...signal ? { signal } : {}
+  });
+}
+function createNetwork(request, body2, options = {}) {
+  return request(networks, { method: "POST", body: body2, ...options });
+}
+function updateNetwork(request, id, body2, options = {}) {
+  return request(networkPath(id), { method: "PATCH", body: body2, ...options });
+}
+function deleteNetwork(request, id, options = {}) {
+  return request(networkPath(id), { method: "DELETE", ...options });
+}
+function listNetworkPeerConfigs(request, networkId, signal) {
+  return request(`${networkPath(networkId)}/peers`, {
+    method: "GET",
+    ...signal ? { signal } : {}
+  });
+}
+function createNetworkPeer(request, networkId, body2, options = {}) {
+  return request(`${networkPath(networkId)}/peers`, {
+    method: "POST",
+    body: body2,
+    ...options
+  });
+}
+function deleteNetworkPeer(request, networkId, peerId, options = {}) {
+  return request(`${networkPath(networkId)}/peers/${encodeURIComponent(peerId)}`, {
+    method: "DELETE",
+    ...options
+  });
+}
+
+// ../../packages/api-client/dist/orchestrator/controllers.js
+var controllersSocketPath = "/v1/orchestrator/controllers";
+function controllerPath(id) {
+  return `${controllersSocketPath}/${encodeURIComponent(id)}`;
+}
+function createController(request, body2, options) {
+  return request(controllersSocketPath, {
+    ...options,
+    method: "POST",
+    body: body2
+  });
+}
+function addControllerNode(request, id, nodeId3, options) {
+  return request(`${controllerPath(id)}/nodes/${encodeURIComponent(nodeId3)}`, {
+    ...options,
+    method: "POST"
+  });
+}
+function removeControllerNode(request, id, nodeId3, options) {
+  return request(`${controllerPath(id)}/nodes/${encodeURIComponent(nodeId3)}`, {
+    ...options,
+    method: "DELETE"
+  });
+}
+
 // ../../packages/capabilities/dist/capabilities/admin-ssh.js
 import { z } from "zod";
 
@@ -457,11 +528,11 @@ function listOrganizations(request, query3 = {}, signal) {
 async function listSupplierOrganizations(request, signal) {
   const rows = [];
   for (let offset = 0; offset < 5e4; offset += 1e3) {
-    const page2 = await listOrganizations(request, { role: "supplier", limit: 1e3, offset, sort: "created_at", direction: "asc" }, signal);
-    if (!Array.isArray(page2))
+    const page = await listOrganizations(request, { role: "supplier", limit: 1e3, offset, sort: "created_at", direction: "asc" }, signal);
+    if (!Array.isArray(page))
       throw new Error("Invalid supplier directory response.");
-    rows.push(...page2);
-    if (page2.length < 1e3)
+    rows.push(...page);
+    if (page.length < 1e3)
       return rows;
   }
   throw new Error("The supplier directory is too large to load completely.");
@@ -1443,8 +1514,8 @@ function query(params) {
   for (const [key, value] of Object.entries(params))
     if (value)
       search.set(key, value);
-  const text2 = search.toString();
-  return text2 ? `?${text2}` : "";
+  const text = search.toString();
+  return text ? `?${text}` : "";
 }
 var MARKETS_SOCKET_PATH = `${BASE3}/ws`;
 function scope({ saleType: saleType2, region: region2 } = {}) {
@@ -1574,11 +1645,11 @@ function resolveIdempotencyKey(ctx, supplied) {
   return ctx.cli?.interaction?.idempotencyKey(supplied) ?? supplied?.trim();
 }
 async function consent(ctx, action, title, terms, payload) {
-  const interaction2 = ctx.cli?.interaction;
-  if (interaction2) {
-    if (await interaction2.review({ title, terms }))
+  const interaction = ctx.cli?.interaction;
+  if (interaction) {
+    if (await interaction.review({ title, terms }))
       return null;
-    return interaction2.result({
+    return interaction.result({
       data: null,
       errors: [{ code: "action_declined", message: "No changes were made.", retryable: false }],
       exitCode: 1,
@@ -3532,31 +3603,31 @@ var machineMaintenanceInput = z17.object({
   yes: z17.boolean().optional()
 }).strict();
 function runtime(context) {
-  const interaction2 = context.cli?.interaction;
-  if (!interaction2)
+  const interaction = context.cli?.interaction;
+  if (!interaction)
     throw new Error("This capability must execute through the Ornn CLI runtime.");
-  return interaction2;
+  return interaction;
 }
 async function executeLaunch(context, input) {
-  const interaction2 = runtime(context);
-  if (!interaction2.launch)
+  const interaction = runtime(context);
+  if (!interaction.launch)
     throw new Error("No launch mode handlers are registered.");
-  return interaction2.launch({ context, input, interaction: interaction2 });
+  return interaction.launch({ context, input, interaction });
 }
 function executeSshKeys(command) {
   return async (context, input) => {
-    const interaction2 = runtime(context);
-    if (!interaction2.sshKeys)
+    const interaction = runtime(context);
+    if (!interaction.sshKeys)
       throw new Error("SSH-key commands are unavailable.");
-    return interaction2.sshKeys(command, input, context);
+    return interaction.sshKeys(command, input, context);
   };
 }
 function executeMachines(command) {
   return async (context, input) => {
-    const interaction2 = runtime(context);
-    if (!interaction2.machines)
+    const interaction = runtime(context);
+    if (!interaction.machines)
       throw new Error("Machine commands are unavailable.");
-    return interaction2.machines(command, input, context);
+    return interaction.machines(command, input, context);
   };
 }
 function cliOnly(specification) {
@@ -4617,9 +4688,6 @@ var controllerNode = z20.object({
   nodeId: z20.string(),
   confirm: z20.boolean().optional()
 });
-function controllerNodePath(input) {
-  return `/v1/orchestrator/controllers/${encodeURIComponent(input.controllerId)}/nodes/${encodeURIComponent(input.nodeId)}`;
-}
 var clusterCapabilities = [
   defineCapability({
     id: "cluster.list",
@@ -4663,21 +4731,16 @@ var clusterCapabilities = [
       networkMode: z20.enum(["public", "private"]).optional(),
       nodeIds: z20.array(z20.string()).optional(),
       nodeCount: z20.number().int().positive().optional(),
-      storageLoadSizeBytes: z20.number().int().nonnegative().optional(),
       confirm: z20.boolean().optional()
-    }),
+    }).strict(),
     mcp: { name: "clusters_create" },
     slack: false,
-    execute: (ctx, input) => ctx.fetch("/v1/orchestrator/controllers", {
-      method: "POST",
-      body: {
-        kind: input.type,
-        reservation_id: input.reservationId,
-        ...input.networkMode ? { network_mode: input.networkMode } : {},
-        ...input.nodeCount !== void 0 ? { node_count: input.nodeCount } : {},
-        ...input.nodeIds?.length ? { node_ids: input.nodeIds } : {},
-        ...input.storageLoadSizeBytes !== void 0 ? { storage_load_size_bytes: input.storageLoadSizeBytes } : {}
-      }
+    execute: (ctx, input) => createController(ctx.fetch, {
+      kind: input.type,
+      reservation_id: input.reservationId,
+      ...input.networkMode ? { network_mode: input.networkMode } : {},
+      ...input.nodeCount !== void 0 ? { node_count: input.nodeCount } : {},
+      ...input.nodeIds?.length ? { node_ids: input.nodeIds } : {}
     })
   }),
   defineCapability({
@@ -4741,7 +4804,7 @@ var clusterCapabilities = [
     input: controllerNode,
     mcp: { name: "clusters_add_node" },
     slack: false,
-    execute: (ctx, input) => ctx.fetch(controllerNodePath(input), { method: "POST" })
+    execute: (ctx, input) => addControllerNode(ctx.fetch, input.controllerId, input.nodeId)
   }),
   defineCapability({
     id: "cluster.remove_node",
@@ -4753,7 +4816,7 @@ var clusterCapabilities = [
     input: controllerNode,
     mcp: { name: "clusters_remove_node" },
     slack: false,
-    execute: (ctx, input) => ctx.fetch(controllerNodePath(input), { method: "DELETE" })
+    execute: (ctx, input) => removeControllerNode(ctx.fetch, input.controllerId, input.nodeId)
   }),
   defineCapability({
     id: "cluster.teardown",
@@ -4824,11 +4887,11 @@ var importInput = z21.object({
   yes: z21.boolean().optional()
 }).strict();
 function externalBucketExecutor(context) {
-  const interaction2 = context.cli?.interaction;
-  if (!interaction2?.externalBuckets) {
+  const interaction = context.cli?.interaction;
+  if (!interaction?.externalBuckets) {
     throw new Error("This capability must execute through the Ornn CLI external-bucket runtime.");
   }
-  return interaction2.externalBuckets.bind(interaction2);
+  return interaction.externalBuckets.bind(interaction);
 }
 function externalBucketCapability({ acceptedReferences = [], automation, command, description, human, id, input, mutation, outcome, related = [], resumableStates = [], review }) {
   return defineCapability({
@@ -4969,10 +5032,10 @@ var evidenceInput = z22.object({
   timeout: z22.string().optional()
 }).strict();
 function runtime2(context) {
-  const interaction2 = context.cli?.interaction;
-  if (!interaction2?.evidence)
+  const interaction = context.cli?.interaction;
+  if (!interaction?.evidence)
     throw new Error("The CLI evidence runtime is unavailable.");
-  return interaction2;
+  return interaction;
 }
 function execute(command) {
   return (context, input) => runtime2(context).evidence(command, input, context);
@@ -5109,11 +5172,11 @@ var mountInput = z23.object({
   yes: z23.boolean().optional()
 }).strict();
 function mountExecutor(context) {
-  const interaction2 = context.cli?.interaction;
-  if (!interaction2?.mounts) {
+  const interaction = context.cli?.interaction;
+  if (!interaction?.mounts) {
     throw new Error("This capability must execute through the Ornn CLI mount runtime.");
   }
-  return interaction2.mounts.bind(interaction2);
+  return interaction.mounts.bind(interaction);
 }
 function mountCapability({ acceptedReferences = [], automation, command, description, human, id, mutation, order, outcome, related = [], resumableStates = [], review }) {
   return defineCapability({
@@ -5754,11 +5817,7 @@ var organizationInviteCapability = defineCapability({
 
 // ../../packages/capabilities/dist/capabilities/networks.js
 import { z as z27 } from "zod";
-var CANONICAL_ID = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
-var DEFAULT_LIMIT = 50;
-var unknownRecordSchema = z27.record(z27.string(), z27.unknown());
-var MAX_LIMIT = 500;
-var NETWORKS_PATH = "/v1/workflows/compute/networks";
+var NETWORKS_PATH = "/v1/orchestrator/networks";
 var globalInput = {
   $positionals: z27.array(z27.string()).optional(),
   guided: z27.boolean().optional(),
@@ -5786,892 +5845,11 @@ var vpnConfigureInput = z27.object({
   output: z27.string().optional(),
   privateKey: z27.string().optional()
 }).strict();
-function responseStatus(error) {
-  if (!error || typeof error !== "object" || !("status" in error))
-    return null;
-  return typeof error.status === "number" ? error.status : null;
-}
-function interaction(context) {
-  const cli = context.cli;
-  const runtime3 = cli?.interaction;
-  if (!runtime3)
-    throw new Error("This capability must execute through the Ornn CLI interaction runtime.");
-  return runtime3;
-}
-function text(value) {
-  return typeof value === "string" && value.trim() ? value.trim() : null;
-}
-function shellQuote(value) {
-  return `'${value.replaceAll("'", "'\\''")}'`;
-}
-function record(value) {
-  const parsed = unknownRecordSchema.safeParse(value);
-  return parsed.success ? parsed.data : {};
-}
-function integer(value) {
-  return typeof value === "number" && Number.isInteger(value) ? value : null;
-}
-function normalizedName(value) {
-  return value.normalize("NFKC").trim().replace(/\s+/g, " ").toLocaleLowerCase("en-US");
-}
-function normalizedCidr(value) {
-  const [address, rawPrefix, ...extra] = value.trim().split("/");
-  const octets = address?.split(".").map(Number) ?? [];
-  const prefix = Number(rawPrefix);
-  if (extra.length || octets.length !== 4 || octets.some((octet) => !Number.isInteger(octet) || octet < 0 || octet > 255) || !Number.isInteger(prefix) || prefix < 0 || prefix > 32) {
-    return value.trim();
-  }
-  const numeric = ((octets[0] * 256 + octets[1]) * 256 + octets[2]) * 256 + octets[3] >>> 0;
-  const mask = prefix === 0 ? 0 : 4294967295 << 32 - prefix >>> 0;
-  const network = (numeric & mask) >>> 0;
-  return `${network >>> 24}.${network >>> 16 & 255}.${network >>> 8 & 255}.${network & 255}/${prefix}`;
-}
-function requiredOption(runtime3, value, option, usage) {
-  const parsed = text(value);
-  if (!parsed)
-    runtime3.usage(`${option} is required.
-${usage}`, { field: option.slice(2) });
-  return parsed;
-}
-function exactPositionals(runtime3, positionals4, count, usage) {
-  const values = positionals4 ?? [];
-  if (values.length !== count || values.some((value) => !value.trim()))
-    runtime3.usage(usage);
-  return values.map((value) => value.trim());
-}
-function requireCanonicalTarget(runtime3, value) {
-  if (!CANONICAL_ID.test(value)) {
-    runtime3.usage("Private targets currently require a canonical capacity-reservation identifier so connect cannot select an ambiguous resource.", { code: "canonical_reference_required", field: "target" });
-  }
-  return value;
-}
-function requireMutationKey(runtime3, input) {
-  if (!runtime3.machine)
-    return text(input.idempotencyKey);
-  const key = text(input.idempotencyKey);
-  if (!key) {
-    runtime3.usage("Machine mutations require --idempotency-key <caller-stable-key> before API I/O.", {
-      code: "idempotency_key_required",
-      field: "idempotencyKey"
-    });
-  }
-  return key;
-}
-function mutationHeaders(key) {
-  return key ? { "Idempotency-Key": key } : void 0;
-}
-function ownerErrorCode(error) {
-  if (!error || typeof error !== "object" || !("detail" in error))
-    return null;
-  const detail = record(error.detail);
-  const nested = detail.detail ?? detail.error;
-  if (typeof nested === "string")
-    return nested;
-  return text(record(nested).code) ?? text(detail.code);
-}
-function lifecycle(statusValue) {
-  const status = text(statusValue)?.toLowerCase() ?? "unknown";
-  if (["active", "ready", "applied", "connected"].includes(status)) {
-    return { class: "ready", phase: "available" };
-  }
-  if (["failed", "degraded", "error"].includes(status)) {
-    return { class: "failed", phase: "needs_attention" };
-  }
-  if (["deleted", "revoked", "disconnected"].includes(status)) {
-    return { class: "ended", phase: "disconnected" };
-  }
-  if (["deleting", "revoking"].includes(status)) {
-    return { class: "working", phase: "disconnecting" };
-  }
-  return { class: "pending", phase: "configuring" };
-}
-function reservationTargetLifecycle(statusValue) {
-  const status = text(statusValue)?.toLowerCase() ?? "unknown";
-  if (status === "active")
-    return { class: "ready", phase: "active" };
-  if (["failed", "payment_failed", "error"].includes(status)) {
-    return { class: "failed", phase: status };
-  }
-  if (["cancelled", "canceled", "completed", "ended", "expired", "rejected", "terminated"].includes(status)) {
-    return { class: "ended", phase: status };
-  }
-  return { class: "pending", phase: status };
-}
-function projectNetwork(value) {
-  const source = record(value);
-  const attachmentIds = Array.isArray(source.attached_reservation_ids) ? source.attached_reservation_ids.map((value2) => text(value2)).filter((value2) => Boolean(value2 && CANONICAL_ID.test(value2))) : [];
-  return {
-    id: text(source.id),
-    name: text(source.name) ?? "Unnamed private network",
-    cidr: text(source.cidr),
-    lifecycle: lifecycle(source.status),
-    attachment_count: integer(source.attached_reservation_count) ?? attachmentIds.length,
-    attached_reservation_ids: [...new Set(attachmentIds)],
-    created_at: text(source.created_at),
-    updated_at: text(source.updated_at)
-  };
-}
-function networkRows(payload) {
-  const source = record(payload);
-  const values = Array.isArray(payload) ? payload : Array.isArray(source.networks) ? source.networks : [];
-  return values.flatMap((value) => {
-    const parsed = unknownRecordSchema.safeParse(value);
-    return parsed.success ? [parsed.data] : [];
-  }).sort((left, right) => {
-    const byName = normalizedName(text(left.name) ?? "").localeCompare(normalizedName(text(right.name) ?? ""));
-    return byName || (text(left.id) ?? "").localeCompare(text(right.id) ?? "");
-  });
-}
-function networkFromMutation(payload) {
-  const source = record(payload);
-  return projectNetwork(source.network ?? source);
-}
-async function fetchNetworks(context) {
-  return networkRows(await context.fetch(NETWORKS_PATH));
-}
-async function resolveNetwork(context, runtime3, reference) {
-  if (CANONICAL_ID.test(reference)) {
-    return record(await context.fetch(`${NETWORKS_PATH}/${encodeURIComponent(reference)}`));
-  }
-  const wanted = normalizedName(reference);
-  const matches = (await fetchNetworks(context)).filter((candidate) => normalizedName(text(candidate.name) ?? "") === wanted);
-  if (matches.length === 0) {
-    runtime3.error(`Private network not found: ${reference}.`, {
-      code: "private_network_not_found"
-    });
-  }
-  if (matches.length > 1) {
-    runtime3.usage(`More than one private network has the exact name "${reference}"; use a canonical identifier.`, {
-      code: "private_network_ambiguous",
-      field: "network"
-    });
-  }
-  return matches[0];
-}
-function encodeCursor(command, offset) {
-  return encodeURIComponent(JSON.stringify({ command, offset }));
-}
-function decodeCursor(runtime3, command, cursor) {
-  if (!cursor)
-    return 0;
-  try {
-    const parsed = record(JSON.parse(decodeURIComponent(cursor)));
-    if (parsed.command === command && Number.isInteger(parsed.offset) && Number(parsed.offset) >= 0) {
-      return Number(parsed.offset);
-    }
-  } catch {
-  }
-  runtime3.usage("The pagination cursor is invalid or belongs to another command.", {
-    code: "invalid_cursor",
-    field: "cursor"
-  });
-}
-function pageLimit2(runtime3, raw) {
-  if (raw === void 0)
-    return DEFAULT_LIMIT;
-  const limit = Number(raw);
-  if (!Number.isInteger(limit) || limit < 1 || limit > MAX_LIMIT) {
-    runtime3.usage(`--limit must be an integer from 1 to ${MAX_LIMIT}.`, { field: "limit" });
-  }
-  return limit;
-}
-function page(runtime3, command, rows, input) {
-  const limit = pageLimit2(runtime3, input.limit);
-  const offset = decodeCursor(runtime3, command, input.cursor);
-  const items = rows.slice(offset, offset + limit);
-  const nextOffset = offset + items.length;
-  return {
-    items,
-    page: {
-      limit,
-      returned: items.length,
-      next_cursor: nextOffset < rows.length ? encodeCursor(command, nextOffset) : null
-    }
-  };
-}
-function declined(runtime3) {
-  return runtime3.result({
-    data: null,
-    errors: [{ code: "action_declined", message: "No changes were made.", retryable: false }],
-    exitCode: 1,
-    outcome: { class: "ended", phase: "declined" },
-    presentation: { lines: ["No changes were made."] }
-  });
-}
-function networkLines(network) {
-  const state = record(network.lifecycle);
-  return [
-    `${String(network.name)} (${String(network.id ?? "unknown")})`,
-    `  CIDR: ${String(network.cidr ?? "pending")}`,
-    `  State: ${state.class} (${state.phase})`
-  ];
-}
-function networkMutationExecution(runtime3, network, replayed) {
-  const state = record(network.lifecycle);
-  const stateClass = String(state.class);
-  const ready = stateClass === "ready";
-  const failed = stateClass === "failed";
-  const command = ready ? "ornn connect" : `ornn private-networks show ${String(network.id)}`;
-  return runtime3.result({
-    action: {
-      command,
-      description: ready ? "Continue to an exact compute target." : "Inspect private-network readiness before attaching or connecting.",
-      type: "command"
-    },
-    data: { private_network: network, replayed },
-    exitCode: ready ? 0 : failed ? 4 : 3,
-    outcome: ready ? { class: "ready", phase: "active" } : { class: String(state.class), phase: String(state.phase) },
-    presentation: {
-      lines: [
-        ready ? replayed ? "Private network already satisfies this request." : "Private network created." : failed ? "Private network exists, but provisioning failed." : "Private network creation was accepted and is still provisioning.",
-        ...networkLines(network)
-      ],
-      next: command
-    },
-    resume: ready ? null : { kind: "private_network", ref: String(network.id) }
-  });
-}
-async function listPrivateNetworks(context, input) {
-  const runtime3 = interaction(context);
-  exactPositionals(runtime3, input.$positionals, 0, "Usage: ornn private-networks list [--limit <1-500>] [--cursor <cursor>]");
-  const rows = (await fetchNetworks(context)).map(projectNetwork);
-  const selected = page(runtime3, "private-networks list", rows, input);
-  return runtime3.result({
-    data: { private_networks: selected.items },
-    page: selected.page,
-    presentation: {
-      lines: selected.items.length ? selected.items.flatMap(networkLines) : ["No private networks found."],
-      ...selected.page.next_cursor ? { next: `ornn private-networks list --cursor ${selected.page.next_cursor}` } : {}
-    }
-  });
-}
-async function showPrivateNetwork(context, input) {
-  const runtime3 = interaction(context);
-  const [reference] = exactPositionals(runtime3, input.$positionals, 1, "Usage: ornn private-networks show <exact-name-or-id>");
-  const network = projectNetwork(await resolveNetwork(context, runtime3, reference));
-  return runtime3.result({
-    data: { private_network: network },
-    presentation: { lines: networkLines(network) }
-  });
-}
-async function createPrivateNetwork(context, input) {
-  const runtime3 = interaction(context);
-  const usage = "Usage: ornn private-networks create --name <name> [--cidr <cidr>]";
-  exactPositionals(runtime3, input.$positionals, 0, usage);
-  if (!text(input.name) && input.guided === true && !runtime3.machine) {
-    input.name = await runtime3.ask({ label: "Private network name" });
-  }
-  const name = requiredOption(runtime3, input.name, "--name", usage).normalize("NFKC").trim().replace(/\s+/g, " ");
-  const cidr = text(input.cidr) ? normalizedCidr(String(input.cidr)) : null;
-  const idempotencyKey = requireMutationKey(runtime3, input);
-  const matches = (await fetchNetworks(context)).filter((candidate) => normalizedName(text(candidate.name) ?? "") === normalizedName(name));
-  if (matches.length > 1) {
-    runtime3.usage(`More than one private network has the exact name "${name}"; use a different name.`, {
-      code: "private_network_ambiguous",
-      field: "name"
-    });
-  }
-  if (matches.length === 1) {
-    const existingCidr = text(matches[0].cidr);
-    if (cidr && (!existingCidr || normalizedCidr(existingCidr) !== cidr)) {
-      runtime3.usage(`Private network "${name}" already exists with different effective input. Use a new idempotency key and name after review.`, { code: "private_network_replay_conflict", field: "cidr" });
-    }
-    return networkMutationExecution(runtime3, projectNetwork(matches[0]), true);
-  }
-  if (!await runtime3.review({
-    title: "Create private network",
-    terms: [
-      { label: "Name", value: name },
-      { label: "CIDR", value: cidr ?? "Automatically assigned" }
-    ]
-  }))
-    return declined(runtime3);
-  const created = await context.fetch(NETWORKS_PATH, {
-    body: { name, ...cidr ? { cidr } : {} },
-    headers: mutationHeaders(idempotencyKey),
-    method: "POST"
-  });
-  return networkMutationExecution(runtime3, networkFromMutation(created), false);
-}
-async function updatePrivateNetwork(context, input) {
-  const runtime3 = interaction(context);
-  const usage = "Usage: ornn private-networks update <exact-name-or-id> --name <new-name>";
-  const [reference] = exactPositionals(runtime3, input.$positionals, 1, usage);
-  const name = requiredOption(runtime3, input.name, "--name", usage).normalize("NFKC").trim().replace(/\s+/g, " ");
-  const idempotencyKey = requireMutationKey(runtime3, input);
-  const current = await resolveNetwork(context, runtime3, reference);
-  if (normalizedName(text(current.name) ?? "") === normalizedName(name)) {
-    const network2 = projectNetwork(current);
-    return runtime3.result({
-      data: { private_network: network2, replayed: true },
-      presentation: {
-        lines: ["Private network already has the requested name.", ...networkLines(network2)]
-      }
-    });
-  }
-  if ((await fetchNetworks(context)).some((candidate) => normalizedName(text(candidate.name) ?? "") === normalizedName(name))) {
-    runtime3.usage(`Another private network already has the exact name "${name}".`, {
-      code: "private_network_name_conflict",
-      field: "name"
-    });
-  }
-  if (!await runtime3.review({
-    title: "Update private network",
-    terms: [
-      {
-        label: "Private network",
-        value: `${text(current.name) ?? reference} (${text(current.id) ?? reference})`
-      },
-      { label: "New name", value: name }
-    ]
-  }))
-    return declined(runtime3);
-  const updated = await context.fetch(`${NETWORKS_PATH}/${encodeURIComponent(String(current.id))}`, {
-    body: { name },
-    headers: mutationHeaders(idempotencyKey),
-    method: "PATCH"
-  });
-  const network = networkFromMutation(updated);
-  return runtime3.result({
-    data: { private_network: network, replayed: false },
-    presentation: { lines: ["Private network updated.", ...networkLines(network)] }
-  });
-}
-async function deletePrivateNetwork(context, input) {
-  const runtime3 = interaction(context);
-  const [reference] = exactPositionals(runtime3, input.$positionals, 1, "Usage: ornn private-networks delete <exact-name-or-id>");
-  const idempotencyKey = requireMutationKey(runtime3, input);
-  const projected = projectNetwork(await resolveNetwork(context, runtime3, reference));
-  if (!await runtime3.review({
-    title: "Delete private network",
-    terms: [
-      { label: "Private network", value: `${String(projected.name)} (${String(projected.id)})` },
-      {
-        label: "Consequence",
-        value: "Permanently delete this organization private network when the owner permits deletion."
-      }
-    ],
-    prompt: "Delete this private network?"
-  }))
-    return declined(runtime3);
-  try {
-    await context.fetch(`${NETWORKS_PATH}/${encodeURIComponent(String(projected.id))}`, {
-      headers: mutationHeaders(idempotencyKey),
-      method: "DELETE"
-    });
-  } catch (error) {
-    if (ownerErrorCode(error) === "network_in_use") {
-      throw error;
-    }
-    throw error;
-  }
-  return runtime3.result({
-    data: { deleted: true, private_network: projected },
-    outcome: { class: "ended", phase: "deleted" },
-    presentation: {
-      lines: [`Private network deleted: ${String(projected.name)} (${String(projected.id)})`]
-    }
-  });
-}
-function vpnPath(reservationId) {
-  return `/v1/workflows/compute/nodes/reservations/${encodeURIComponent(reservationId)}/vpn/peers`;
-}
-function vpnPayloadRows(payload) {
-  const source = record(payload);
-  const peers = Array.isArray(source.peers) ? source.peers : [];
-  return peers.flatMap((value) => {
-    const parsed = unknownRecordSchema.safeParse(value);
-    return parsed.success ? [parsed.data] : [];
-  });
-}
-function vpnPeer(payload) {
-  const peer = record(payload.peer);
-  return Object.keys(peer).length ? peer : payload;
-}
-function projectVpnConnection(payload, reservationId) {
-  const peer = vpnPeer(payload);
-  const network = record(payload.network);
-  return {
-    id: text(peer.id),
-    name: text(peer.label) ?? "VPN connection",
-    reservation_id: reservationId,
-    private_network_id: text(network.network_id) ?? text(network.id),
-    assigned_address: text(peer.assigned_ip),
-    lifecycle: lifecycle(peer.status),
-    created_at: text(peer.created_at)
-  };
-}
-function vpnLines(connection) {
-  const state = record(connection.lifecycle);
-  return [
-    `${String(connection.name)} (${String(connection.id ?? "unknown")})`,
-    `  Private target: ${String(connection.reservation_id)}`,
-    `  State: ${state.class} (${state.phase})`
-  ];
-}
-async function listVpnPayloads(context, target) {
-  return vpnPayloadRows(await context.fetch(vpnPath(target)));
-}
-async function listVpnConnections(context, input) {
-  const runtime3 = interaction(context);
-  const [rawTarget] = exactPositionals(runtime3, input.$positionals, 1, "Usage: ornn vpn-connections list <canonical-reservation-id> [--limit <1-500>] [--cursor <cursor>]");
-  const target = requireCanonicalTarget(runtime3, rawTarget);
-  const connections = (await listVpnPayloads(context, target)).map((payload) => projectVpnConnection(payload, target)).sort((left, right) => normalizedName(String(left.name)).localeCompare(normalizedName(String(right.name))));
-  const selected = page(runtime3, "vpn-connections list", connections, input);
-  return runtime3.result({
-    data: { vpn_connections: selected.items },
-    page: selected.page,
-    presentation: {
-      lines: selected.items.length ? selected.items.flatMap(vpnLines) : [`No VPN connections found for private target ${target}.`],
-      ...selected.page.next_cursor ? { next: `ornn vpn-connections list ${target} --cursor ${selected.page.next_cursor}` } : {}
-    }
-  });
-}
-function validateSecretExport(runtime3, input) {
-  const hasOutput = Boolean(text(input.output));
-  const shouldPrint = input.print === true;
-  if (hasOutput === shouldPrint) {
-    runtime3.usage("Choose exactly one explicit VPN configuration destination: --print or --output <path>.", {
-      code: "secret_destination_required",
-      field: "output"
-    });
-  }
-  if (shouldPrint && runtime3.formatProvided) {
-    runtime3.usage("--print is incompatible with an explicit --format.", {
-      code: "secret_print_format_conflict",
-      field: "format"
-    });
-  }
-  if (runtime3.machine && shouldPrint) {
-    runtime3.usage("Machine mode cannot mix secret bytes with a result envelope; use --output <path>.", {
-      code: "secret_print_unsupported_in_machine_mode",
-      field: "print"
-    });
-  }
-  if (!runtime3.exportSecret || !runtime3.prepareSecretExport || !runtime3.wireGuardPublicKeyFromFile) {
-    runtime3.error("The CLI secret-output service is unavailable.", {
-      code: "secret_output_unavailable",
-      exitCode: 6,
-      retryable: true
-    });
-  }
-}
-async function prepareVpnExport(runtime3, input) {
-  try {
-    await runtime3.prepareSecretExport({
-      outputPath: text(input.output) ?? void 0,
-      overwrite: input.overwrite === true,
-      print: input.print === true
-    });
-  } catch (error) {
-    const code = error && typeof error === "object" && "code" in error ? text(error.code) : null;
-    const message = error instanceof Error && error.message ? error.message : "Could not prepare the VPN configuration destination.";
-    runtime3.error(message, { code: code ?? "vpn_configuration_export_failed" });
-  }
-}
-async function exportVpnConfig(runtime3, input, content, privateKeyPath, publicKey) {
-  const config = typeof content === "string" && content.length > 0 ? content : null;
-  if (!config) {
-    runtime3.error("Ornn did not return a usable VPN configuration.", {
-      code: "vpn_configuration_unavailable",
-      exitCode: 6,
-      retryable: true
-    });
-  }
-  try {
-    return await runtime3.exportSecret({
-      content: config,
-      outputPath: text(input.output) ?? void 0,
-      overwrite: input.overwrite === true,
-      print: input.print === true,
-      privateKeyPath,
-      publicKey
-    });
-  } catch (error) {
-    const code = error && typeof error === "object" && "code" in error ? text(error.code) : null;
-    const message = error instanceof Error && error.message ? error.message : "Could not export the VPN configuration.";
-    runtime3.error(message, { code: code ?? "vpn_configuration_export_failed" });
-  }
-}
-function vpnConfigureExecution(runtime3, target, connection, exported, replayed) {
-  const state = record(connection.lifecycle);
-  const stateClass = String(state.class);
-  const ready = stateClass === "ready";
-  const failed = stateClass === "failed";
-  const activationCommand = exported.path ? `sudo wg-quick up ${shellQuote(exported.path)}` : "sudo wg-quick up <saved-configuration-path>";
-  const action = ready ? {
-    command: activationCommand,
-    description: "Activate the completed local WireGuard configuration before connecting.",
-    type: "command"
-  } : {
-    command: `ornn vpn-connections configure ${target} --guided`,
-    description: failed ? "Retry applying this exact VPN peer with its original private key." : "Reapply this pending VPN peer after gateway readiness is restored.",
-    type: "command"
-  };
-  return runtime3.result({
-    action,
-    data: { export: exported, replayed, vpn_connection: connection },
-    exitCode: ready ? 3 : failed ? 4 : 3,
-    outcome: ready ? { class: "action_required", phase: "local_vpn_activation_required" } : { class: String(state.class), phase: String(state.phase) },
-    presentation: {
-      lines: [
-        ready ? replayed ? "VPN configuration exported again; local tunnel activation is still required." : "VPN peer is active and the complete local configuration was exported." : failed ? "VPN connection was saved, but the gateway rejected or could not apply it." : "VPN connection was saved and is waiting for gateway application.",
-        ...vpnLines(connection),
-        `Configuration fingerprint: ${exported.fingerprint}`,
-        ...exported.path ? [`Configuration written to ${exported.path} (${exported.mode}).`] : []
-      ],
-      next: action.command
-    },
-    resume: ready ? { kind: "connect", ref: target } : { kind: "vpn_connection", ref: String(connection.id) }
-  });
-}
-async function configureVpnConnection(context, input) {
-  const runtime3 = interaction(context);
-  const usage = "Usage: ornn vpn-connections configure <canonical-reservation-id> --name <name> --private-key <path> (--print | --output <path>)";
-  const [rawTarget] = exactPositionals(runtime3, input.$positionals, 1, usage);
-  const target = requireCanonicalTarget(runtime3, rawTarget);
-  if (input.guided === true && !runtime3.machine) {
-    input.name ??= await runtime3.ask({ label: "VPN connection name" });
-    input.privateKey ??= await runtime3.ask({ label: "WireGuard private-key path" });
-    if (input.print !== true && !text(input.output)) {
-      input.output = await runtime3.ask({ label: "VPN configuration output path" });
-    }
-  }
-  const name = requiredOption(runtime3, input.name, "--name", usage).normalize("NFKC").trim().replace(/\s+/g, " ");
-  const privateKeyPath = requiredOption(runtime3, input.privateKey, "--private-key", usage);
-  validateSecretExport(runtime3, input);
-  await prepareVpnExport(runtime3, input);
-  let publicKey = "";
-  try {
-    publicKey = await runtime3.wireGuardPublicKeyFromFile(privateKeyPath);
-  } catch (error) {
-    const code = error && typeof error === "object" && "code" in error ? text(error.code) : null;
-    const message = error instanceof Error && error.message ? error.message : "Could not read the WireGuard private key.";
-    runtime3.error(message, { code: code ?? "invalid_wireguard_private_key", field: "privateKey" });
-  }
-  const idempotencyKey = requireMutationKey(runtime3, input);
-  const existing = await listVpnPayloads(context, target);
-  const sameKey = existing.find((payload) => text(vpnPeer(payload).public_key) === publicKey);
-  let effectiveName = name;
-  if (sameKey) {
-    const existingName = text(vpnPeer(sameKey).label) ?? "VPN connection";
-    effectiveName = existingName;
-    if (normalizedName(existingName) !== normalizedName(name)) {
-      runtime3.usage("This public key already identifies a VPN connection with a different name. Use the original effective input or a new key after review.", { code: "vpn_connection_replay_conflict", field: "name" });
-    }
-  } else if (existing.some((payload) => normalizedName(text(vpnPeer(payload).label) ?? "VPN connection") === normalizedName(name))) {
-    runtime3.usage(`A VPN connection named "${name}" already exists with different key material.`, {
-      code: "vpn_connection_name_conflict",
-      field: "name"
-    });
-  }
-  if (sameKey && lifecycle(text(vpnPeer(sameKey).status)).class === "ready") {
-    const exported2 = await exportVpnConfig(runtime3, input, sameKey.config, privateKeyPath, publicKey);
-    return vpnConfigureExecution(runtime3, target, projectVpnConnection(sameKey, target), exported2, true);
-  }
-  if (!await runtime3.review({
-    title: sameKey ? "Retry VPN connection" : "Configure VPN connection",
-    terms: [
-      { label: "Private target", value: target },
-      { label: "VPN connection", value: name },
-      { label: "WireGuard public key", value: publicKey },
-      {
-        label: "Configuration destination",
-        value: input.print ? "Terminal (explicit --print)" : String(input.output)
-      }
-    ]
-  }))
-    return declined(runtime3);
-  const applied = record(await context.fetch(vpnPath(target), {
-    body: { label: effectiveName, public_key: publicKey },
-    headers: mutationHeaders(idempotencyKey),
-    method: "POST"
-  }));
-  const exported = await exportVpnConfig(runtime3, input, applied.config, privateKeyPath, publicKey);
-  const connection = projectVpnConnection(applied, target);
-  return vpnConfigureExecution(runtime3, target, connection, exported, Boolean(sameKey));
-}
-async function disconnectVpnConnection(context, input) {
-  const runtime3 = interaction(context);
-  const [rawTarget, reference] = exactPositionals(runtime3, input.$positionals, 2, "Usage: ornn vpn-connections disconnect <canonical-reservation-id> <exact-name-or-id>");
-  const target = requireCanonicalTarget(runtime3, rawTarget);
-  const idempotencyKey = requireMutationKey(runtime3, input);
-  const matches = (await listVpnPayloads(context, target)).filter((payload) => {
-    const peer = vpnPeer(payload);
-    return CANONICAL_ID.test(reference) ? text(peer.id) === reference : normalizedName(text(peer.label) ?? "VPN connection") === normalizedName(reference);
-  });
-  if (matches.length === 0)
-    runtime3.error(`VPN connection not found: ${reference}.`, { code: "vpn_connection_not_found" });
-  if (matches.length > 1) {
-    runtime3.usage(`More than one VPN connection has the exact name "${reference}"; use a canonical identifier.`, {
-      code: "vpn_connection_ambiguous",
-      field: "connection"
-    });
-  }
-  const connection = projectVpnConnection(matches[0], target);
-  if (!await runtime3.review({
-    title: "Disconnect VPN connection",
-    terms: [
-      { label: "Private target", value: target },
-      { label: "VPN connection", value: `${String(connection.name)} (${String(connection.id)})` },
-      {
-        label: "Consequence",
-        value: "Private access through this VPN connection ends; the private network remains."
-      }
-    ]
-  }))
-    return declined(runtime3);
-  await context.fetch(`${vpnPath(target)}/${encodeURIComponent(String(connection.id))}`, {
-    headers: mutationHeaders(idempotencyKey),
-    method: "DELETE"
-  });
-  return runtime3.result({
-    data: { disconnected: true, vpn_connection: connection },
-    outcome: { class: "ended", phase: "disconnected" },
-    presentation: {
-      lines: [`VPN connection disconnected: ${String(connection.name)} (${String(connection.id)})`]
-    }
-  });
-}
-function normalizedConnectAccessMode(value) {
-  const mode = text(value)?.toLowerCase();
-  return mode === "virtual-machine" ? "vm" : mode ?? null;
-}
-function validateKnownConnectMode(runtime3, input, mode) {
-  if (mode === "vm" || mode === "bare-metal" || mode === "slurm") {
-    if (input.output || input.overwrite) {
-      runtime3.usage(`${mode === "slurm" ? "Slurm" : mode === "vm" ? "VM" : "Bare Metal"} connect uses native SSH and does not write an output file.`, {
-        code: mode === "slurm" ? "slurm_output_unsupported" : "direct_machine_output_unsupported",
-        field: input.output ? "output" : "overwrite"
-      });
-    }
-    return;
-  }
-  if (mode === "kubernetes" && (input.identityFile || input.user || input.print)) {
-    runtime3.usage("Kubernetes connect writes a kubeconfig and does not accept SSH identity, user, or print options.", {
-      code: input.print ? "kubeconfig_output_required" : "kubernetes_ssh_options_unsupported",
-      field: input.identityFile ? "identityFile" : input.user ? "user" : "output"
-    });
-  }
-}
-function blockedPrivateTransport(runtime3, lifecycleValue, action, data, reservationId) {
-  const state = record(lifecycleValue);
-  const outcome = {
-    class: text(state.class) ?? "pending",
-    phase: text(state.phase) ?? "configuring"
-  };
-  return runtime3.result({
-    action,
-    data,
-    exitCode: ["failed", "ended"].includes(outcome.class) ? 1 : 3,
-    outcome,
-    resume: { kind: "connect", ref: reservationId }
-  });
-}
-function compareVpnConnections(left, right) {
-  return (text(left.created_at) ?? "").localeCompare(text(right.created_at) ?? "") || (text(left.id) ?? "").localeCompare(text(right.id) ?? "") || normalizedName(text(left.name) ?? "").localeCompare(normalizedName(text(right.name) ?? ""));
-}
-async function connectPrivateTarget(context, input) {
-  const runtime3 = interaction(context);
-  const values = input.$positionals ?? [];
-  if (values.length > 1) {
-    runtime3.usage("Usage: ornn connect [<exact-hostname-or-canonical-machine-id>]", {
-      code: "usage_error"
-    });
-  }
-  const rawTarget = text(values[0]);
-  let resolved = null;
-  let target = rawTarget;
-  if (runtime3.resolveConnectTarget) {
-    resolved = await runtime3.resolveConnectTarget({
-      context,
-      input,
-      interaction: runtime3,
-      reference: rawTarget
-    });
-    if (resolved) {
-      validateKnownConnectMode(runtime3, input, normalizedConnectAccessMode(resolved.mode));
-    }
-    if (resolved && resolved.privateTransportRequired !== true && runtime3.continueConnect) {
-      const direct = await runtime3.continueConnect(resolved);
-      if (direct)
-        return runtime3.result(direct);
-    }
-    if (resolved)
-      target = resolved.reservationId;
-  }
-  if (!resolved && rawTarget && CANONICAL_ID.test(rawTarget)) {
-    try {
-      const reservation = await getReservation(context.fetch, rawTarget);
-      const reservationId = text(reservation.reservationId);
-      if (reservationId && reservationId !== rawTarget) {
-        runtime3.error("The gateway returned a different capacity reservation.", {
-          code: "reservation_correlation_changed"
-        });
-      }
-      const status = text(reservation.status)?.toLowerCase() ?? "unknown";
-      const mode = normalizedConnectAccessMode(reservation.provisioningType);
-      if (status !== "active") {
-        const state = reservationTargetLifecycle(status);
-        const waiting = state.class === "pending" || state.class === "working";
-        return runtime3.result({
-          action: waiting ? {
-            command: `ornn reservations show ${reservationId ?? rawTarget}`,
-            description: "Wait for the capacity reservation to become active before launching native compute.",
-            type: "command"
-          } : null,
-          data: {
-            capacity_reservation: {
-              id: reservationId ?? rawTarget,
-              access_mode: mode,
-              lifecycle: state
-            }
-          },
-          exitCode: waiting ? 3 : 1,
-          outcome: state,
-          presentation: {
-            lines: [
-              waiting ? `Capacity reservation ${reservationId ?? rawTarget} is not active yet; it has no native-access target.` : `Capacity reservation ${reservationId ?? rawTarget} is ${state.phase}; it has no launchable native-access target.`
-            ]
-          },
-          resume: waiting ? { kind: "reservation", ref: reservationId ?? rawTarget } : null
-        });
-      }
-      validateKnownConnectMode(runtime3, input, mode);
-      return runtime3.actionRequired({
-        action: {
-          command: "ornn launch",
-          description: "Launch compute for this capacity reservation before requesting native access.",
-          type: "command"
-        },
-        data: {
-          capacity_reservation: {
-            id: reservationId ?? rawTarget,
-            access_mode: mode
-          }
-        },
-        resume: { kind: "reservation", ref: reservationId ?? rawTarget }
-      });
-    } catch (error) {
-      if (![400, 404, 422].includes(responseStatus(error) ?? 0))
-        throw error;
-    }
-  }
-  const privateTarget = target ?? "";
-  if (!privateTarget || !CANONICAL_ID.test(privateTarget)) {
-    runtime3.usage("Connect requires an exact unique hostname, canonical machine ID, or eligible guided choice.", {
-      code: "invalid_reference",
-      field: "machine"
-    });
-  }
-  if (!resolved) {
-    runtime3.error("No accessible machine, cluster, or capacity reservation matches this target.", {
-      code: "connect_target_not_found"
-    });
-  }
-  const shared = record(await context.fetch(`${NETWORKS_PATH}/shared?overlay=true`));
-  const privateNetwork = projectNetwork({
-    ...record(shared.network),
-    id: "shared",
-    name: "Organization private network"
-  });
-  const networkState = record(privateNetwork.lifecycle);
-  if (networkState.class !== "ready") {
-    const recoverable = ["failed", "ended"].includes(String(networkState.class));
-    return blockedPrivateTransport(runtime3, networkState, {
-      command: `ornn vpn-connections list ${privateTarget}`,
-      description: recoverable ? "Inspect organization VPN connectivity before retrying." : "Wait for organization networking to become ready, then retry connect.",
-      type: "command"
-    }, {
-      private_network: privateNetwork,
-      private_target: { reservation_id: privateTarget },
-      vpn_connection: null
-    }, privateTarget);
-  }
-  const connections = (await listVpnPayloads(context, privateTarget)).map((payload) => projectVpnConnection(payload, privateTarget)).sort(compareVpnConnections);
-  if (connections.length === 0) {
-    return runtime3.actionRequired({
-      action: {
-        command: `ornn vpn-connections configure ${privateTarget} --guided`,
-        description: "Provide one VPN peer and explicit configuration destination, then retry connect.",
-        type: "command"
-      },
-      data: {
-        private_network: privateNetwork,
-        private_target: { reservation_id: privateTarget },
-        vpn_connection: null
-      },
-      resume: { kind: "connect", ref: privateTarget }
-    });
-  }
-  const readyConnections = connections.filter((connection2) => record(connection2.lifecycle).class === "ready");
-  if (readyConnections.length === 0) {
-    const connection2 = connections.find((candidate) => ["pending", "working"].includes(String(record(candidate.lifecycle).class))) ?? connections.find((candidate) => record(candidate.lifecycle).class === "failed") ?? connections[0];
-    const state = record(connection2.lifecycle);
-    const stateClass = String(state.class);
-    const id = text(connection2.id);
-    const failed = stateClass === "failed";
-    const ended = stateClass === "ended";
-    const action = failed && id ? {
-      command: `ornn vpn-connections disconnect ${privateTarget} ${id}`,
-      description: "Remove the failed VPN connection before configuring a replacement.",
-      type: "command"
-    } : ended ? {
-      command: `ornn vpn-connections configure ${privateTarget} --guided`,
-      description: "Configure a new VPN connection, then retry connect.",
-      type: "command"
-    } : {
-      command: `ornn vpn-connections configure ${privateTarget} --guided`,
-      description: "Reapply the pending VPN connection, then retry connect.",
-      type: "command"
-    };
-    return blockedPrivateTransport(runtime3, state, action, {
-      private_network: privateNetwork,
-      private_target: { reservation_id: privateTarget },
-      vpn_connection: connection2
-    }, privateTarget);
-  }
-  const connection = readyConnections.find((candidate) => {
-    const address = text(candidate.assigned_address);
-    return Boolean(address && runtime3.hasLocalNetworkAddress?.(address) === true);
-  }) ?? readyConnections[0];
-  const assignedAddress = text(connection.assigned_address);
-  if (!assignedAddress || runtime3.hasLocalNetworkAddress?.(assignedAddress) !== true) {
-    return runtime3.actionRequired({
-      action: {
-        command: `ornn vpn-connections configure ${privateTarget} --guided`,
-        description: "Export a complete WireGuard configuration, activate it locally, then retry connect.",
-        type: "command"
-      },
-      data: {
-        private_network: privateNetwork,
-        private_target: { reservation_id: privateTarget },
-        vpn_connection: connection
-      },
-      resume: { kind: "connect", ref: privateTarget }
-    });
-  }
-  if (runtime3.continueConnect) {
-    const continuation = await runtime3.continueConnect({
-      ...resolved ?? {},
-      privateNetwork,
-      reservationId: privateTarget,
-      vpnConnection: connection
-    });
-    if (continuation)
-      return runtime3.result(continuation);
-  }
-  return runtime3.result({
-    data: {
-      private_network: privateNetwork,
-      private_target: { reservation_id: privateTarget },
-      vpn_connection: connection
-    },
-    outcome: { class: "ready", phase: "private_transport_ready" },
-    presentation: {
-      lines: ["VPN connection is ready for private access.", ...vpnLines(connection)]
-    }
-  });
+function networkExecutor(context) {
+  const runtime3 = context.cli?.interaction;
+  if (!runtime3?.networks)
+    throw new Error("This capability must execute through the Ornn CLI network runtime.");
+  return runtime3.networks.bind(runtime3);
 }
 function customerResource(specification) {
   return defineCapability({ ...specification, mcp: false, slack: false });
@@ -6696,7 +5874,7 @@ var privateNetworkListCapability = customerResource({
       related: ["private-networks show"]
     }
   },
-  execute: listPrivateNetworks
+  execute: (ctx, input) => networkExecutor(ctx)("private-networks list", input, ctx)
 });
 var privateNetworkShowCapability = customerResource({
   id: "networks.show",
@@ -6719,7 +5897,7 @@ var privateNetworkShowCapability = customerResource({
       related: ["private-networks list"]
     }
   },
-  execute: showPrivateNetwork
+  execute: (ctx, input) => networkExecutor(ctx)("private-networks show", input, ctx)
 });
 var privateNetworkCreateCapability = customerResource({
   id: "networks.create",
@@ -6743,7 +5921,7 @@ var privateNetworkCreateCapability = customerResource({
       related: ["private-networks list"]
     }
   },
-  execute: createPrivateNetwork
+  execute: (ctx, input) => networkExecutor(ctx)("private-networks create", input, ctx)
 });
 var privateNetworkUpdateCapability = customerResource({
   id: "networks.update",
@@ -6767,7 +5945,7 @@ var privateNetworkUpdateCapability = customerResource({
       related: ["private-networks show"]
     }
   },
-  execute: updatePrivateNetwork
+  execute: (ctx, input) => networkExecutor(ctx)("private-networks update", input, ctx)
 });
 var privateNetworkDeleteCapability = customerResource({
   id: "networks.delete",
@@ -6791,7 +5969,7 @@ var privateNetworkDeleteCapability = customerResource({
       related: ["private-networks list"]
     }
   },
-  execute: deletePrivateNetwork
+  execute: (ctx, input) => networkExecutor(ctx)("private-networks delete", input, ctx)
 });
 var vpnConnectionListCapability = customerResource({
   id: "vpn.connections.list",
@@ -6814,7 +5992,7 @@ var vpnConnectionListCapability = customerResource({
       related: ["vpn-connections configure", "connect"]
     }
   },
-  execute: listVpnConnections
+  execute: (ctx, input) => networkExecutor(ctx)("vpn-connections list", input, ctx)
 });
 var vpnConnectionConfigureCapability = customerResource({
   id: "vpn.connections.configure",
@@ -6839,7 +6017,7 @@ var vpnConnectionConfigureCapability = customerResource({
       related: ["connect", "vpn-connections disconnect"]
     }
   },
-  execute: configureVpnConnection
+  execute: (ctx, input) => networkExecutor(ctx)("vpn-connections configure", input, ctx)
 });
 var vpnConnectionDisconnectCapability = customerResource({
   id: "vpn.connections.disconnect",
@@ -6867,7 +6045,7 @@ var vpnConnectionDisconnectCapability = customerResource({
       related: ["vpn-connections configure"]
     }
   },
-  execute: disconnectVpnConnection
+  execute: (ctx, input) => networkExecutor(ctx)("vpn-connections disconnect", input, ctx)
 });
 var connectCapability = customerResource({
   id: "vpn.connect",
@@ -6897,7 +6075,7 @@ var connectCapability = customerResource({
       related: ["launch", "vpn-connections configure", "clusters show"]
     }
   },
-  execute: connectPrivateTarget
+  execute: (ctx, input) => networkExecutor(ctx)("connect", input, ctx)
 });
 var networkCapabilities = [
   privateNetworkListCapability,
@@ -6910,12 +6088,6 @@ var networkCapabilities = [
   vpnConnectionDisconnectCapability,
   connectCapability
 ];
-function networkPath(networkId) {
-  return `${NETWORKS_PATH}/${encodeURIComponent(networkId)}`;
-}
-function vpnPeersPath(reservationId) {
-  return `/v1/workflows/compute/nodes/reservations/${encodeURIComponent(reservationId)}/vpn/peers`;
-}
 var networkUpdateFields = z27.object({
   networkId: z27.string(),
   name: z27.string().optional(),
@@ -6936,7 +6108,7 @@ var networkVerbCapabilities = [
     input: z27.object({}),
     mcp: { name: "networks_list" },
     slack: false,
-    execute: (ctx) => ctx.fetch(NETWORKS_PATH, { method: "GET" })
+    execute: (ctx) => listNetworks(ctx.fetch)
   }),
   defineCapability({
     id: "network.show",
@@ -6948,7 +6120,7 @@ var networkVerbCapabilities = [
     input: z27.object({ networkId: z27.string() }),
     mcp: { name: "networks_show" },
     slack: false,
-    execute: (ctx, input) => ctx.fetch(networkPath(input.networkId), { method: "GET" })
+    execute: (ctx, input) => getNetwork(ctx.fetch, input.networkId)
   }),
   defineCapability({
     id: "network.create",
@@ -6965,13 +6137,10 @@ var networkVerbCapabilities = [
     }),
     mcp: { name: "networks_create" },
     slack: false,
-    execute: (ctx, input) => ctx.fetch(NETWORKS_PATH, {
-      method: "POST",
-      body: {
-        name: input.name,
-        cidr: input.cidr ?? null,
-        description: input.description ?? null
-      }
+    execute: (ctx, input) => createNetwork(ctx.fetch, {
+      name: input.name,
+      cidr: input.cidr ?? null,
+      description: input.description ?? null
     })
   }),
   defineCapability({
@@ -6984,12 +6153,9 @@ var networkVerbCapabilities = [
     input: networkUpdateFields,
     mcp: { name: "networks_update" },
     slack: false,
-    execute: (ctx, input) => ctx.fetch(networkPath(input.networkId), {
-      method: "PATCH",
-      body: {
-        ...input.name !== void 0 ? { name: input.name } : {},
-        ...input.clearDescription ? { description: null } : input.description !== void 0 ? { description: input.description } : {}
-      }
+    execute: (ctx, input) => updateNetwork(ctx.fetch, input.networkId, {
+      ...input.name !== void 0 ? { name: input.name } : {},
+      ...input.clearDescription ? { description: null } : input.description !== void 0 ? { description: input.description } : {}
     })
   }),
   defineCapability({
@@ -7004,7 +6170,7 @@ var networkVerbCapabilities = [
     slack: false,
     // The route answers 204, so report which network went.
     execute: async (ctx, input) => {
-      await ctx.fetch(networkPath(input.networkId), { method: "DELETE" });
+      await deleteNetwork(ctx.fetch, input.networkId);
       return { deleted: true, network_id: input.networkId };
     }
   }),
@@ -7016,12 +6182,12 @@ var networkVerbCapabilities = [
     mutation: "read",
     http: {
       method: "GET",
-      path: "/v1/workflows/compute/nodes/reservations/{reservationId}/vpn/peers"
+      path: "/v1/orchestrator/networks/shared/peers"
     },
     input: z27.object({ reservationId: z27.string() }),
     mcp: { name: "vpn_peers_list" },
     slack: false,
-    execute: (ctx, input) => ctx.fetch(vpnPeersPath(input.reservationId), { method: "GET" })
+    execute: (ctx) => listNetworkPeerConfigs(ctx.fetch, "shared")
   }),
   defineCapability({
     id: "vpn.peers.create",
@@ -7031,7 +6197,7 @@ var networkVerbCapabilities = [
     mutation: "preview-confirm",
     http: {
       method: "POST",
-      path: "/v1/workflows/compute/nodes/reservations/{reservationId}/vpn/peers"
+      path: "/v1/orchestrator/networks/shared/peers"
     },
     input: z27.object({
       reservationId: z27.string(),
@@ -7041,9 +6207,9 @@ var networkVerbCapabilities = [
     }),
     mcp: { name: "vpn_peers_create" },
     slack: false,
-    execute: (ctx, input) => ctx.fetch(vpnPeersPath(input.reservationId), {
-      method: "POST",
-      body: { public_key: input.publicKey, label: input.label ?? null }
+    execute: (ctx, input) => createNetworkPeer(ctx.fetch, "shared", {
+      public_key: input.publicKey,
+      label: input.label ?? null
     })
   }),
   defineCapability({
@@ -7054,7 +6220,7 @@ var networkVerbCapabilities = [
     mutation: "preview-confirm",
     http: {
       method: "DELETE",
-      path: "/v1/workflows/compute/nodes/reservations/{reservationId}/vpn/peers/{peerId}"
+      path: "/v1/orchestrator/networks/shared/peers/{peerId}"
     },
     input: z27.object({
       reservationId: z27.string(),
@@ -7063,9 +6229,7 @@ var networkVerbCapabilities = [
     }),
     mcp: { name: "vpn_peers_delete" },
     slack: false,
-    execute: async (ctx, input) => await ctx.fetch(`${vpnPeersPath(input.reservationId)}/${encodeURIComponent(input.peerId)}`, {
-      method: "DELETE"
-    }) ?? { deleted: true }
+    execute: async (ctx, input) => await deleteNetworkPeer(ctx.fetch, "shared", input.peerId) ?? { deleted: true }
   })
 ];
 
@@ -7108,12 +6272,12 @@ function formatBytes(bytes) {
   }
   return `${value >= 10 || unit === 0 ? Math.round(value) : value.toFixed(1)} ${units[unit]}`;
 }
-function repositoryArgument(input, interaction2) {
+function repositoryArgument(input, interaction) {
   const raw = input.repository ?? input.$positionals[0];
   if (!raw) {
     const message = "Name a repository, such as trainer.";
-    if (interaction2)
-      interaction2.usage(message, { code: "repository_required", field: "repository" });
+    if (interaction)
+      interaction.usage(message, { code: "repository_required", field: "repository" });
     throw new Error(message);
   }
   const reference = raw.trim();
@@ -7147,10 +6311,10 @@ var registryShowCapability = defineCapability({
   slack: false,
   execute: async (context) => {
     const registry = await getContainerRegistry(context.fetch);
-    const interaction2 = cliInteraction(context);
-    if (!interaction2)
+    const interaction = cliInteraction(context);
+    if (!interaction)
       return registry;
-    return interaction2.result({
+    return interaction.result({
       data: registry,
       presentation: {
         lines: [`Image prefix: ${registry.host}/${registry.namespace}`],
@@ -7182,11 +6346,11 @@ var registryRepositoriesListCapability = defineCapability({
   slack: false,
   execute: async (context) => {
     const listed = await listRegistryRepositories(context.fetch);
-    const interaction2 = cliInteraction(context);
-    if (!interaction2)
+    const interaction = cliInteraction(context);
+    if (!interaction)
       return listed;
     const registry = await getContainerRegistry(context.fetch);
-    return interaction2.result({
+    return interaction.result({
       data: listed,
       presentation: {
         lines: listed.repositories.length ? listed.repositories.map((repository) => `${shortName(repository.name, registry)}  ${repository.tag_count} ${repository.tag_count === 1 ? "tag" : "tags"}`) : ["No images yet. Push one with docker push after ornn registry login."]
@@ -7218,13 +6382,13 @@ var registryTagsListCapability = defineCapability({
   },
   slack: false,
   execute: async (context, input) => {
-    const interaction2 = cliInteraction(context);
+    const interaction = cliInteraction(context);
     const registry = await getContainerRegistry(context.fetch);
-    const repository = qualifiedRepository(repositoryArgument(input, interaction2).repository, registry);
+    const repository = qualifiedRepository(repositoryArgument(input, interaction).repository, registry);
     const listed = await listRegistryTags(context.fetch, repository);
-    if (!interaction2)
+    if (!interaction)
       return listed;
-    return interaction2.result({
+    return interaction.result({
       data: listed,
       presentation: {
         lines: listed.tags.map((tag) => `${tag.tag}  ${tag.digest.slice(0, 19)}  ${formatBytes(tag.size_bytes)}${tag.created_at ? `  built ${tag.created_at}` : ""}`)
@@ -7257,20 +6421,20 @@ var registryTagsDeleteCapability = defineCapability({
   },
   slack: false,
   execute: async (context, input) => {
-    const interaction2 = cliInteraction(context);
+    const interaction = cliInteraction(context);
     const registry = await getContainerRegistry(context.fetch);
-    const argument = repositoryArgument(input, interaction2);
+    const argument = repositoryArgument(input, interaction);
     const repository = qualifiedRepository(argument.repository, registry);
     if (!argument.tag) {
       const message = "Name the tag to delete, such as trainer:v1.";
-      if (interaction2)
-        interaction2.usage(message, { code: "tag_required", field: "tag" });
+      if (interaction)
+        interaction.usage(message, { code: "tag_required", field: "tag" });
       throw new Error(message);
     }
     const target = { repository, tag: argument.tag };
-    if (interaction2) {
+    if (interaction) {
       if (!input.yes) {
-        const approved = await interaction2.review({
+        const approved = await interaction.review({
           title: "Delete this image tag?",
           terms: [
             { label: "Image", value: `${registry.host}/${repository}:${argument.tag}` },
@@ -7282,7 +6446,7 @@ var registryTagsDeleteCapability = defineCapability({
           prompt: "Delete it?"
         });
         if (!approved) {
-          return interaction2.result({
+          return interaction.result({
             data: target,
             outcome: { class: "cancelled", phase: "review" },
             presentation: { lines: ["Nothing was deleted."] }
@@ -7294,9 +6458,9 @@ var registryTagsDeleteCapability = defineCapability({
     }
     await deleteRegistryTag(context.fetch, target.repository, target.tag);
     const deleted = { deleted: true, ...target };
-    if (!interaction2)
+    if (!interaction)
       return deleted;
-    return interaction2.result({
+    return interaction.result({
       data: deleted,
       presentation: { lines: [`Deleted ${shortName(repository, registry)}:${argument.tag}.`] }
     });
@@ -7325,10 +6489,10 @@ var registryUsageCapability = defineCapability({
   slack: false,
   execute: async (context) => {
     const usage = await getRegistryUsage(context.fetch);
-    const interaction2 = cliInteraction(context);
-    if (!interaction2)
+    const interaction = cliInteraction(context);
+    if (!interaction)
       return usage;
-    return interaction2.result({
+    return interaction.result({
       data: usage,
       presentation: { lines: [`Storage used: ${formatBytes(usage.bytes)}`] }
     });
@@ -7379,11 +6543,11 @@ var registryLoginCapability = defineCapability({
   mcp: false,
   slack: false,
   execute: async (context, input) => {
-    const interaction2 = context.cli?.interaction;
-    if (!interaction2?.registry) {
+    const interaction = context.cli?.interaction;
+    if (!interaction?.registry) {
       throw new Error("ornn registry login runs only in the Ornn CLI.");
     }
-    return interaction2.registry.call(interaction2, "registry.login", input);
+    return interaction.registry.call(interaction, "registry.login", input);
   }
 });
 var registryCapabilities = [
@@ -7472,11 +6636,11 @@ var storageCliInput = z30.object({
   yes: z30.boolean().optional()
 }).strict();
 function storageExecutor(context) {
-  const interaction2 = context.cli?.interaction;
-  if (!interaction2?.storage) {
+  const interaction = context.cli?.interaction;
+  if (!interaction?.storage) {
     throw new Error("This capability must execute through the Ornn CLI storage runtime.");
   }
-  return interaction2.storage.bind(interaction2);
+  return interaction.storage.bind(interaction);
 }
 function storageCapability({ id, command, description, mutation, outcome, human, automation, acceptedReferences = [], review, related = [] }) {
   return defineCapability({