@ornncompute/cli 1.0.128 → 1.0.130

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ornncompute/cli",
-  "version": "1.0.128",
+  "version": "1.0.130",
   "description": "Command-line interface for Ornn compute access workflows.",
   "type": "module",
   "bin": {

package/src/admin-enrollment.mjs

@@ -1,3 +1,8 @@
+import {
+  enrollmentTokensPath,
+  remoteRunPath,
+  listEnrollmentLogs,
+} from "../vendor/api-client/orchestrator.js";
 import { createHash } from "node:crypto";
 import { lstat, readFile } from "node:fs/promises";
 
@@ -477,7 +482,7 @@ function enrollmentProgressTransport(fetch, runtime, privateKey) {
     );
 
   return async (path, init = {}) => {
-    if (path === "/enrollment-tokens") {
+    if (path === enrollmentTokensPath) {
       const minted = await request(path, init);
       if (minted && typeof minted === "object") {
         tokenId = typeof minted.id === "string" ? minted.id : "";
@@ -491,7 +496,7 @@ function enrollmentProgressTransport(fetch, runtime, privateKey) {
       }
       return minted;
     }
-    if (path !== "/remote" || !tokenId) return request(path, init);
+    if (path !== remoteRunPath || !tokenId) return request(path, init);
 
     const remote = request(path, init).then(
       (value) => ({ ok: true, value }),
@@ -502,10 +507,11 @@ function enrollmentProgressTransport(fetch, runtime, privateKey) {
     let currentPoll = Promise.resolve();
     const poll = async () => {
       try {
-        const payload = await fetch("/internal/enrollment-logs", {
-          method: "GET",
-          signal: AbortSignal.timeout(ENROLLMENT_LOG_READ_TIMEOUT_MS),
-        });
+        const payload = await listEnrollmentLogs(
+          fetch,
+          {},
+          AbortSignal.timeout(ENROLLMENT_LOG_READ_TIMEOUT_MS)
+        );
         const lines = freshEnrollmentLogLines(payload, tokenId, secrets, seen);
         for (const line of lines) runtime.stderr.write(`${line}\n`);
       } catch {

package/vendor/api-client/orchestrator.js

@@ -640,12 +640,183 @@ function removeControllerVirtualMachine(request, id, virtualMachineId, options)
     method: "DELETE"
   });
 }
+
+// ../../packages/api-client/dist/orchestrator/enrollment.js
+var enrollmentTokensPath = "/v1/orchestrator/enrollment-tokens";
+var enrollmentLogsPath = "/v1/orchestrator/enrollment-logs";
+function listEnrollmentTokens(request, query = {}) {
+  return request(enrollmentTokensPath + (query.id ? `?id=${encodeURIComponent(query.id)}` : ""), {
+    method: "GET"
+  });
+}
+function createEnrollmentToken(request, body) {
+  return request(enrollmentTokensPath, { method: "POST", body });
+}
+function revokeEnrollmentToken(request, id, idempotencyKey) {
+  return request(`${enrollmentTokensPath}/${encodeURIComponent(id)}`, {
+    method: "DELETE",
+    ...idempotencyKey ? { headers: { "Idempotency-Key": idempotencyKey } } : {}
+  });
+}
+function listEnrollmentCompartments(request, signal) {
+  return request("/v1/orchestrator/enrollment/compartments", { method: "GET", signal });
+}
+function listEnrollmentScripts(request, organizationId, signal) {
+  const query = organizationId ? `?organization_id=${encodeURIComponent(organizationId)}` : "";
+  return request(`/v1/orchestrator/enrollment-scripts${query}`, {
+    method: "GET",
+    signal
+  });
+}
+function getEnrollmentScriptSource(request, id, query = {}, signal) {
+  const params = new URLSearchParams();
+  if (query.sha256)
+    params.set("sha256", query.sha256);
+  if (query.filter)
+    params.set("filter", query.filter);
+  return request(`/v1/orchestrator/enrollment-scripts/${encodeURIComponent(id)}/source${params.size ? `?${params}` : ""}`, { method: "GET", signal });
+}
+function listEnrollmentLogs(request, query = {}, signal) {
+  return request(enrollmentLogsPath + (query.organization_id ? `?organization_id=${encodeURIComponent(query.organization_id)}` : ""), { method: "GET", signal });
+}
+function getEnrollmentAdminSshKey(request, nodeId) {
+  return request(`/v1/orchestrator/enrollment/admin-ssh-key?node_id=${encodeURIComponent(nodeId)}`, { method: "GET" });
+}
+function rotateEnrollmentAdminSshKey(request, nodeId) {
+  return request(`/v1/orchestrator/enrollment/admin-ssh-key?node_id=${encodeURIComponent(nodeId)}`, { method: "POST" });
+}
+function fakeEnroll(fetcher, body) {
+  return fetcher("/v1/orchestrator/fake-enroll", {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify(body)
+  });
+}
+function enrollmentInstallPath(query) {
+  const params = new URLSearchParams();
+  for (const [key, value] of Object.entries(query)) {
+    if (value !== void 0 && value !== false)
+      params.set(key, String(value));
+  }
+  return `/v1/orchestrator/enrollment/install?${params}`;
+}
+
+// ../../packages/api-client/dist/orchestrator/configurable-enrollment.js
+var root = "/v1/orchestrator/enrollment/configurable";
+function queryString(query) {
+  const params = new URLSearchParams();
+  for (const [key, value] of Object.entries(query))
+    if (value !== void 0)
+      params.set(key, String(value));
+  return params.size ? `?${params}` : "";
+}
+function listEnrollmentProfiles(request, query = {}, signal) {
+  return request(`${root}/profiles${queryString(query)}`, { method: "GET", signal });
+}
+async function listAllEnrollmentProfiles(request, query = {}, signal) {
+  const profiles = [];
+  const seen = /* @__PURE__ */ new Set();
+  let after = query.after;
+  do {
+    if (after && seen.has(after))
+      throw new Error("Enrollment profile pagination repeated a cursor.");
+    if (after)
+      seen.add(after);
+    const page = await listEnrollmentProfiles(request, { ...query, after }, signal);
+    profiles.push(...page.profiles);
+    after = page.next_cursor ?? void 0;
+  } while (after);
+  return { profiles, next_cursor: null };
+}
+function createEnrollmentProfile(request, body) {
+  return request(`${root}/profiles`, { method: "POST", body });
+}
+function updateEnrollmentProfile(request, id, body) {
+  return request(`${root}/profiles/${encodeURIComponent(id)}`, {
+    method: "PATCH",
+    body
+  });
+}
+function listEnrollmentRuns(request, query = {}) {
+  return request(`${root}/runs${queryString(query)}`, { method: "GET" });
+}
+function getEnrollmentRun(request, id) {
+  return request(`${root}/runs/${encodeURIComponent(id)}`, {
+    method: "GET"
+  });
+}
+function createEnrollmentRun(request, body) {
+  return request(`${root}/runs`, { method: "POST", body });
+}
+function cancelEnrollmentRun(request, id) {
+  return request(`${root}/runs/${encodeURIComponent(id)}`, {
+    method: "PATCH",
+    body: { action: "cancel" }
+  });
+}
+function getEnrollmentHosts(request, id) {
+  return request(`${root}/runs/${encodeURIComponent(id)}/hosts`, { method: "GET" });
+}
+function launchEnrollmentRun(request, id, body) {
+  return request(`${root}/runs/${encodeURIComponent(id)}/launch`, {
+    method: "POST",
+    body
+  });
+}
+function getEnrollmentHost(request, id) {
+  return request(`${root}/hosts/${encodeURIComponent(id)}`, {
+    method: "GET"
+  });
+}
+function actOnEnrollmentHost(request, id, body) {
+  return request(`${root}/hosts/${encodeURIComponent(id)}`, {
+    method: "PATCH",
+    body
+  });
+}
+function issueEnrollmentCredential(request, id) {
+  return request(`${root}/hosts/${encodeURIComponent(id)}/credentials`, {
+    method: "POST"
+  });
+}
+function getEnrollmentSteps(request, id) {
+  return request(`${root}/hosts/${encodeURIComponent(id)}/steps`, { method: "GET" });
+}
+function getEnrollmentStepCatalog(request, organizationId, signal) {
+  return request(`${root}/steps${queryString({ organization_id: organizationId })}`, {
+    method: "GET",
+    signal
+  });
+}
+function getEnrollmentProfileSource(request, id, signal) {
+  return request(`${root}/profiles/${encodeURIComponent(id)}/source`, {
+    method: "GET",
+    signal
+  });
+}
+function getEnrollmentRunSource(request, id, signal) {
+  return request(`${root}/runs/${encodeURIComponent(id)}/source`, {
+    method: "GET",
+    signal
+  });
+}
+function enrollmentHostEventsPath(id, query = {}) {
+  return `${root}/hosts/${encodeURIComponent(id)}/events${queryString(query)}`;
+}
+
+// ../../packages/api-client/dist/orchestrator/remote.js
+var remoteRunPath = "/v1/staff/remote";
+function runRemote(request, body) {
+  return request(remoteRunPath, { method: "POST", body });
+}
 export {
+  actOnEnrollmentHost,
   addControllerNode,
   addControllerVirtualMachine,
   addReservationSshKey,
   assignNode,
   cancelDriveUpload,
+  cancelEnrollmentRun,
   clearDriveContents,
   closeShellSession,
   closeVirtualMachinePort,
@@ -657,6 +828,9 @@ export {
   createController,
   createDisk,
   createDrive,
+  createEnrollmentProfile,
+  createEnrollmentRun,
+  createEnrollmentToken,
   createGhostNodes,
   createNetwork,
   createNetworkPeer,
@@ -678,11 +852,25 @@ export {
   driveArchivePath,
   driveFilePath,
   driveFolderArchivePath,
+  enrollmentHostEventsPath,
+  enrollmentInstallPath,
+  enrollmentLogsPath,
+  enrollmentTokensPath,
+  fakeEnroll,
   geolocate,
   getContainerRegistry,
   getControllerAccess,
   getCurrentShellSession,
   getDrive,
+  getEnrollmentAdminSshKey,
+  getEnrollmentHost,
+  getEnrollmentHosts,
+  getEnrollmentProfileSource,
+  getEnrollmentRun,
+  getEnrollmentRunSource,
+  getEnrollmentScriptSource,
+  getEnrollmentStepCatalog,
+  getEnrollmentSteps,
   getHardwareCatalog,
   getNetwork,
   getNode,
@@ -698,14 +886,23 @@ export {
   getVirtualMachineLogs,
   hardwareCatalogPath,
   importDisk,
+  issueEnrollmentCredential,
   issueNodeSshCertificate,
   keepDriveUploadsAlive,
+  launchEnrollmentRun,
   launchReservation,
+  listAllEnrollmentProfiles,
   listCatalogImages,
   listControllers,
   listDisks,
   listDriveContents,
   listDrives,
+  listEnrollmentCompartments,
+  listEnrollmentLogs,
+  listEnrollmentProfiles,
+  listEnrollmentRuns,
+  listEnrollmentScripts,
+  listEnrollmentTokens,
   listGitHubBranches,
   listGitHubConnections,
   listGitHubRepositories,
@@ -735,9 +932,13 @@ export {
   pushNodeKeys,
   rebootNode,
   rebootVirtualMachine,
+  remoteRunPath,
   removeControllerNode,
   removeControllerVirtualMachine,
   reservationEventsPath,
+  revokeEnrollmentToken,
+  rotateEnrollmentAdminSshKey,
+  runRemote,
   shellSessionAttachPath,
   startDiskUpload,
   startDriveUpload,
@@ -752,6 +953,7 @@ export {
   transferNode,
   updateDisk,
   updateDrive,
+  updateEnrollmentProfile,
   updateNetwork,
   updateNode,
   updateNodeKeys,

package/vendor/capabilities/cli.js

@@ -274,6 +274,43 @@ function removeControllerNode(request, id, nodeId3, options) {
   });
 }
 
+// ../../packages/api-client/dist/orchestrator/enrollment.js
+var enrollmentTokensPath = "/v1/orchestrator/enrollment-tokens";
+function listEnrollmentTokens(request, query3 = {}) {
+  return request(enrollmentTokensPath + (query3.id ? `?id=${encodeURIComponent(query3.id)}` : ""), {
+    method: "GET"
+  });
+}
+function createEnrollmentToken(request, body2) {
+  return request(enrollmentTokensPath, { method: "POST", body: body2 });
+}
+function revokeEnrollmentToken(request, id, idempotencyKey) {
+  return request(`${enrollmentTokensPath}/${encodeURIComponent(id)}`, {
+    method: "DELETE",
+    ...idempotencyKey ? { headers: { "Idempotency-Key": idempotencyKey } } : {}
+  });
+}
+function getEnrollmentAdminSshKey(request, nodeId3) {
+  return request(`/v1/orchestrator/enrollment/admin-ssh-key?node_id=${encodeURIComponent(nodeId3)}`, { method: "GET" });
+}
+function rotateEnrollmentAdminSshKey(request, nodeId3) {
+  return request(`/v1/orchestrator/enrollment/admin-ssh-key?node_id=${encodeURIComponent(nodeId3)}`, { method: "POST" });
+}
+function enrollmentInstallPath(query3) {
+  const params = new URLSearchParams();
+  for (const [key, value] of Object.entries(query3)) {
+    if (value !== void 0 && value !== false)
+      params.set(key, String(value));
+  }
+  return `/v1/orchestrator/enrollment/install?${params}`;
+}
+
+// ../../packages/api-client/dist/orchestrator/remote.js
+var remoteRunPath = "/v1/staff/remote";
+function runRemote(request, body2) {
+  return request(remoteRunPath, { method: "POST", body: body2 });
+}
+
 // ../../packages/capabilities/dist/capabilities/admin-ssh.js
 import { z } from "zod";
 
@@ -757,7 +794,7 @@ var nodeExecCapability = defineCapability({
   roles: ["admin"],
   description: "Admin-only. Run one unrestricted command over orchestrator SSH. Pass node_id for an enrolled node (uses its stored admin key), or host + private_key (+ optional username, default root, and port, default 22) for any host, including one not enrolled yet. Always pass timeout_seconds. Not an interactive shell. On NVIDIA hosts use nvidia-smi; on AMD Instinct use amd-smi. Runs on the tool call \u2014 no confirm, no y/N.",
   mutation: "immediate",
-  http: { method: "POST", path: "/remote" },
+  http: { method: "POST", path: "/v1/staff/remote" },
   slack: {
     parameters: {
       type: "object",
@@ -775,9 +812,10 @@ var nodeExecCapability = defineCapability({
   input: nodeExecInput,
   execute: async (ctx, input) => {
     const { yes: _yes, ...parsed } = nodeExecInput.parse(input);
-    return ctx.fetch("/remote", {
-      method: "POST",
-      body: { ...parsed, node_id: parsed.node_id?.trim(), host: parsed.host?.trim() }
+    return runRemote(ctx.fetch, {
+      ...parsed,
+      node_id: parsed.node_id?.trim(),
+      host: parsed.host?.trim()
     });
   }
 });
@@ -1134,18 +1172,15 @@ var tokenCreateInput = z4.object({
 var emptyInput = z4.object({});
 function buildEnrollmentInstallCommand(options) {
   const base3 = (options.base ?? "https://api.ornn.com/v1/orchestrator").replace(/\/+$/, "");
-  const params = [`token=${encodeURIComponent(options.token)}`];
-  if (options.facilityId)
-    params.push(`facility_id=${encodeURIComponent(options.facilityId)}`);
-  if (options.filter)
-    params.push(`filter=${encodeURIComponent(options.filter)}`);
-  if (options.ip)
-    params.push(`ip=${encodeURIComponent(options.ip)}`);
-  if (options.restoreNodeId)
-    params.push(`restore_node_id=${encodeURIComponent(options.restoreNodeId)}`);
-  if (options.force)
-    params.push("force=true");
-  const href = `${base3}/enrollment/install?${params.join("&")}`;
+  const path = enrollmentInstallPath({
+    token: options.token,
+    facility_id: options.facilityId,
+    filter: options.filter,
+    ip: options.ip,
+    restore_node_id: options.restoreNodeId,
+    force: options.force
+  });
+  const href = `${base3}${path.replace(/^\/v1\/orchestrator/, "")}`;
   return `set -o pipefail; curl -fsSL '${href.replace(/'/g, "'\\''")}' | sudo bash`;
 }
 function tokenString(row, keys) {
@@ -1162,10 +1197,10 @@ var tokensListCapability = defineCapability({
   roles: ["admin"],
   description: "List issued enrollment tokens (id, supplier organization_id, status, expiry). Does not return plaintext secrets.",
   mutation: "read",
-  http: { method: "GET", path: "/enrollment-tokens" },
+  http: { method: "GET", path: "/v1/orchestrator/enrollment-tokens" },
   slack: { parameters: { type: "object", properties: {} } },
   input: emptyInput,
-  execute: async (ctx) => ctx.fetch("/enrollment-tokens", { method: "GET" })
+  execute: async (ctx) => listEnrollmentTokens(ctx.fetch)
 });
 var tokensCreateCapability = defineCapability({
   id: "tokens.create",
@@ -1173,7 +1208,7 @@ var tokensCreateCapability = defineCapability({
   roles: ["admin"],
   description: "Admin-only. Mint an enrollment token. Without a host this returns the curl installer. With host + private_key, orchestrator SSHs and runs that curl (same as Bulk Enroll). Never invent a command. Slack waits for a human confirm. ",
   mutation: "preview-confirm",
-  http: { method: "POST", path: "/enrollment-tokens" },
+  http: { method: "POST", path: "/v1/orchestrator/enrollment-tokens" },
   slack: {
     parameters: {
       type: "object",
@@ -1228,13 +1263,10 @@ var tokensCreateCapability = defineCapability({
     if (!ctx.confirmed) {
       return preview("tokens.create", { ...payload, private_key: privateKey ? "[redacted]" : "" });
     }
-    const minted = await ctx.fetch("/enrollment-tokens", {
-      method: "POST",
-      body: {
-        organization_id: organizationId,
-        ...payload.facility_id ? { facility_id: payload.facility_id } : {},
-        ...payload.expires_in_seconds ? { expires_in_seconds: payload.expires_in_seconds } : {}
-      }
+    const minted = await createEnrollmentToken(ctx.fetch, {
+      organization_id: organizationId,
+      ...payload.facility_id ? { facility_id: payload.facility_id } : {},
+      ...payload.expires_in_seconds ? { expires_in_seconds: payload.expires_in_seconds } : {}
     });
     const token = tokenString(minted, ["token", "plaintext"]) ?? "";
     const installCommand = token ? buildEnrollmentInstallCommand({
@@ -1249,16 +1281,13 @@ var tokensCreateCapability = defineCapability({
     }
     const results = [];
     for (const host of hosts) {
-      results.push(await ctx.fetch("/remote", {
-        method: "POST",
-        body: {
-          host,
-          username: payload.username,
-          port: payload.port,
-          private_key: privateKey,
-          command: installCommand,
-          timeout_seconds: 600
-        }
+      results.push(await runRemote(ctx.fetch, {
+        host,
+        username: payload.username,
+        port: payload.port,
+        private_key: privateKey,
+        command: installCommand,
+        timeout_seconds: 600
       }));
     }
     return {
@@ -2730,11 +2759,11 @@ function withVnextBinding(capability, help3) {
 var adminEnrollmentTokensListCapability2 = {
   ...withVnextBinding(tokensListCapability, adminHelp3(["admin", "enrollment-tokens", "list"], "List enrollment-token metadata without token bytes.", "ornn admin enrollment-tokens list [--limit 50] [--cursor CURSOR]", "ornn admin enrollment-tokens list --limit 50 --format json")),
   execute: async (ctx) => {
-    const payload = await tokensListCapability.execute(ctx, {});
+    const payload = await listEnrollmentTokens(ctx.fetch);
     if (!ctx.cli)
       return payload;
     return {
-      enrollment_tokens: rowsFromTokenList(payload).map(tokenMetadata).filter((token) => token !== null)
+      enrollment_tokens: payload.tokens.map(tokenMetadata).filter((token) => token !== null)
     };
   }
 };
@@ -2746,18 +2775,6 @@ var tokenRevokeInput = z12.object({
   idempotency_key: nonEmpty.optional(),
   confirm: z12.boolean().optional()
 });
-function rowsFromTokenList(payload) {
-  if (Array.isArray(payload))
-    return payload;
-  if (!payload || typeof payload !== "object")
-    return [];
-  const source = payload;
-  for (const key of ["enrollment_tokens", "tokens", "items", "data"]) {
-    if (Array.isArray(source[key]))
-      return source[key];
-  }
-  return [];
-}
 function tokenMetadata(value) {
   if (!value || typeof value !== "object")
     return null;
@@ -2778,10 +2795,8 @@ function codedError(code, message) {
   return error;
 }
 async function readExactToken(ctx, tokenId, expectedCreatedAt) {
-  const listed = await ctx.fetch(`/enrollment-tokens?id=${encodeURIComponent(tokenId)}`, {
-    method: "GET"
-  });
-  const target = rowsFromTokenList(listed).map(tokenMetadata).find((candidate) => candidate?.id === tokenId);
+  const listed = await listEnrollmentTokens(ctx.fetch, { id: tokenId });
+  const target = listed.tokens.map(tokenMetadata).find((candidate) => candidate?.id === tokenId);
   if (!target)
     return { disposition: "satisfied", target: null };
   if (expectedCreatedAt && target.created_at !== expectedCreatedAt) {
@@ -2802,7 +2817,7 @@ var adminEnrollmentTokenRevokeCapability = defineCapability({
   roles: ["admin"],
   description: "Internal staff only: revoke one exact enrollment-token generation after reconciling its durable goal.",
   mutation: "preview-confirm",
-  http: { method: "DELETE", path: "/enrollment-tokens/{tokenId}" },
+  http: { method: "DELETE", path: "/v1/orchestrator/enrollment-tokens/{tokenId}" },
   cli: {
     command: ["admin", "enrollment-tokens", "revoke"],
     vnext: adminHelp3(["admin", "enrollment-tokens", "revoke"], "Revoke one exact enrollment-token generation.", "ornn admin enrollment-tokens revoke <token-id> [--expected-created-at TIME] []", "ornn admin enrollment-tokens revoke <token-id> --expected-created-at TIME  --idempotency-key KEY --format json", ["canonical token UUID", "token created_at generation"], "Review the exact token generation and the loss of future enrollment access.")
@@ -2830,10 +2845,7 @@ var adminEnrollmentTokenRevokeCapability = defineCapability({
     if (!current.target.created_at) {
       throw codedError("token_identity_unavailable", `Enrollment token ${tokenId} has no stable creation identity and cannot be revoked safely.`);
     }
-    const revoked = await ctx.fetch(`/enrollment-tokens/${encodeURIComponent(tokenId)}`, {
-      method: "DELETE",
-      ...parsed.idempotency_key ? { headers: { "Idempotency-Key": parsed.idempotency_key } } : {}
-    });
+    const revoked = await revokeEnrollmentToken(ctx.fetch, tokenId, parsed.idempotency_key);
     return {
       id: tokenId,
       created_at: current.target.created_at,
@@ -2879,7 +2891,7 @@ var adminNodeEnrollCapability = defineCapability({
   roles: ["admin"],
   description: "Enroll one explicit node over SSH with an explicit supplier and facility assignment.",
   mutation: "preview-confirm",
-  http: { method: "POST", path: "/remote" },
+  http: { method: "POST", path: "/v1/staff/remote" },
   cli: {
     command: ["admin", "nodes", "enroll"],
     vnext: adminHelp3(["admin", "nodes", "enroll"], "Install Ornn management on one explicitly assigned node.", "ornn admin nodes enroll <node-id> --host HOST --supplier UUID --facility UUID [--filter COMPARTMENT_IDS] --identity-file PATH --token-ttl SECONDS --replace-existing-management [--verbose] []", "Unsupported: remote enrollment requires an eligible human terminal.", ["canonical node UUID", "canonical supplier organization UUID", "canonical facility UUID"], "Review node identity, SSH target, assignment, compartment filter, and replacement of existing management.")
@@ -2903,12 +2915,9 @@ var adminNodeEnrollCapability = defineCapability({
     if (!parsed.private_key) {
       throw codedError("identity_file_unreadable", "The SSH identity file could not be read.");
     }
-    const minted = await ctx.fetch("/enrollment-tokens", {
-      method: "POST",
-      body: {
-        organization_id: parsed.organization_id,
-        expires_in_seconds: parsed.expires_in_seconds
-      }
+    const minted = await createEnrollmentToken(ctx.fetch, {
+      organization_id: parsed.organization_id,
+      expires_in_seconds: parsed.expires_in_seconds
     });
     const token = typeof minted.token === "string" ? minted.token : typeof minted.plaintext === "string" ? minted.plaintext : "";
     if (!token) {
@@ -2922,16 +2931,13 @@ var adminNodeEnrollCapability = defineCapability({
       restoreNodeId: parsed.node_id,
       force: true
     });
-    const remote = await ctx.fetch("/remote", {
-      method: "POST",
-      body: {
-        host: parsed.host,
-        username: parsed.username,
-        port: parsed.port,
-        private_key: parsed.private_key,
-        command,
-        timeout_seconds: 600
-      }
+    const remote = await runRemote(ctx.fetch, {
+      host: parsed.host,
+      username: parsed.username,
+      port: parsed.port,
+      private_key: parsed.private_key,
+      command,
+      timeout_seconds: 600
     });
     return {
       node_id: parsed.node_id,
@@ -2955,7 +2961,7 @@ var adminNodeExportKeyCapability = defineCapability({
   roles: ["admin"],
   description: "Export an enrolled node's private admin key only through an explicit secret destination.",
   mutation: "read",
-  http: { method: "GET", path: "/enrollment/admin-ssh-key" },
+  http: { method: "GET", path: "/v1/orchestrator/enrollment/admin-ssh-key" },
   cli: {
     command: ["admin", "nodes", "export-key"],
     vnext: adminHelp3(["admin", "nodes", "export-key"], "Export one node admin key deliberately.", "ornn admin nodes export-key <node-id> (--print | --output PATH) [--overwrite]", "ornn admin nodes export-key <node-id> --output PATH [--overwrite] --format json", ["canonical node UUID"])
@@ -2965,9 +2971,7 @@ var adminNodeExportKeyCapability = defineCapability({
   input: nodeKeyInput,
   execute: async (ctx, input) => {
     const parsed = nodeKeyInput.parse(input);
-    return ctx.fetch(`/enrollment/admin-ssh-key?node_id=${encodeURIComponent(parsed.node_id)}`, {
-      method: "GET"
-    });
+    return getEnrollmentAdminSshKey(ctx.fetch, parsed.node_id);
   }
 });
 var adminNodeRotateKeyCapability = defineCapability({
@@ -2976,7 +2980,7 @@ var adminNodeRotateKeyCapability = defineCapability({
   roles: ["admin"],
   description: "Replace a node's admin key and export the new private key explicitly.",
   mutation: "preview-confirm",
-  http: { method: "POST", path: "/enrollment/admin-ssh-key" },
+  http: { method: "POST", path: "/v1/orchestrator/enrollment/admin-ssh-key" },
   cli: {
     command: ["admin", "nodes", "rotate-key"],
     vnext: adminHelp3(["admin", "nodes", "rotate-key"], "Rotate one node admin key and export the replacement deliberately.", "ornn admin nodes rotate-key <node-id> (--print | --output PATH) [--overwrite] []", "Unsupported: key rotation requires an eligible human terminal.", ["canonical node UUID"], "Review the node and loss of access through the previous private key.")
@@ -2988,9 +2992,7 @@ var adminNodeRotateKeyCapability = defineCapability({
     const parsed = nodeKeyInput.parse(input);
     if (!ctx.confirmed)
       return { node_id: parsed.node_id };
-    return ctx.fetch(`/enrollment/admin-ssh-key?node_id=${encodeURIComponent(parsed.node_id)}`, {
-      method: "POST"
-    });
+    return rotateEnrollmentAdminSshKey(ctx.fetch, parsed.node_id);
   }
 });
 var replacements2 = {