@ornncompute/cli 1.0.137 → 1.0.138

package/vendor/capabilities/cli.js

@@ -7,43 +7,60 @@ function getHardwareCatalog(request, signal) {
   });
 }
 
-// ../../packages/api-client/dist/orchestrator/locality.js
-var localityGeolocatePath = "/v1/orchestrator/locality/geolocate";
-function geolocate(request, query3, signal) {
-  const target = query3.ip !== void 0 ? `ip=${encodeURIComponent(query3.ip)}` : `address=${encodeURIComponent(query3.address)}`;
-  return request(`${localityGeolocatePath}?${target}`, {
-    method: "GET",
-    ...signal ? { signal } : {}
+// ../../packages/api-client/dist/orchestrator/configurable-enrollment.js
+var root = "/v1/orchestrator/enrollment/configurable";
+function createEnrollmentRun(request, body2) {
+  return request(`${root}/runs`, { method: "POST", body: body2 });
+}
+function launchEnrollmentRun(request, id, body2) {
+  return request(`${root}/runs/${encodeURIComponent(id)}/launch`, {
+    method: "POST",
+    body: body2
   });
 }
 
-// ../../packages/api-client/dist/orchestrator/registry.js
-function getContainerRegistry(request) {
-  return request("/v1/orchestrator/registry", { method: "GET" });
+// ../../packages/api-client/dist/orchestrator/controllers.js
+var controllersSocketPath = "/v1/orchestrator/controllers";
+function controllerPath(id) {
+  return `${controllersSocketPath}/${encodeURIComponent(id)}`;
 }
-function listRegistryRepositories(request) {
-  return request("/v1/orchestrator/registry/repositories", { method: "GET" });
+function createController(request, body2, options) {
+  return request(controllersSocketPath, {
+    ...options,
+    method: "POST",
+    body: body2
+  });
 }
-function listRegistryTags(request, repository) {
-  return request(`/v1/orchestrator/registry/tags?${new URLSearchParams({ repository })}`, {
-    method: "GET"
+function addControllerNode(request, id, nodeId3, options) {
+  return request(`${controllerPath(id)}/nodes/${encodeURIComponent(nodeId3)}`, {
+    ...options,
+    method: "POST"
   });
 }
-function getRegistryUsage(request) {
-  return request("/v1/orchestrator/registry/usage", { method: "GET" });
+function removeControllerNode(request, id, nodeId3, options) {
+  return request(`${controllerPath(id)}/nodes/${encodeURIComponent(nodeId3)}`, {
+    ...options,
+    method: "DELETE"
+  });
 }
-function listRegistryCaches(request, query3 = {}) {
+
+// ../../packages/api-client/dist/orchestrator/drive-files.js
+function drivePath(id) {
+  return `/v1/orchestrator/drives/${encodeURIComponent(id)}`;
+}
+function listDriveContents(request, id, query3 = {}, signal) {
   const params = new URLSearchParams();
-  if (query3.controller_id !== void 0)
-    params.set("controller_id", query3.controller_id);
-  return request(`/v1/orchestrator/registry/caches${params.size ? `?${params}` : ""}`, {
-    method: "GET"
+  for (const [key, value] of Object.entries(query3)) {
+    if (value !== void 0)
+      params.set(key, String(value));
+  }
+  return request(`${drivePath(id)}/contents${params.size ? `?${params}` : ""}`, {
+    method: "GET",
+    ...signal ? { signal } : {}
   });
 }
-function deleteRegistryTag(request, repository, tag) {
-  return request(`/v1/orchestrator/registry/tags?${new URLSearchParams({ repository, tag })}`, {
-    method: "DELETE"
-  });
+function clearDriveContents(request, id) {
+  return request(`${drivePath(id)}/contents`, { method: "DELETE" });
 }
 
 // ../../packages/api-client/dist/orchestrator/drives.js
@@ -94,82 +111,81 @@ function listStorageTargets(request, signal) {
   });
 }
 
-// ../../packages/api-client/dist/orchestrator/drive-files.js
-function drivePath(id) {
-  return `/v1/orchestrator/drives/${encodeURIComponent(id)}`;
+// ../../packages/api-client/dist/orchestrator/enrollment.js
+var enrollmentTokensPath = "/v1/orchestrator/enrollment-tokens";
+function listEnrollmentTokens(request, query3 = {}) {
+  return request(enrollmentTokensPath + (query3.id ? `?id=${encodeURIComponent(query3.id)}` : ""), {
+    method: "GET"
+  });
 }
-function listDriveContents(request, id, query3 = {}, signal) {
-  const params = new URLSearchParams();
-  for (const [key, value] of Object.entries(query3)) {
-    if (value !== void 0)
-      params.set(key, String(value));
-  }
-  return request(`${drivePath(id)}/contents${params.size ? `?${params}` : ""}`, {
-    method: "GET",
-    ...signal ? { signal } : {}
+function revokeEnrollmentToken(request, id, idempotencyKey) {
+  return request(`${enrollmentTokensPath}/${encodeURIComponent(id)}`, {
+    method: "DELETE",
+    ...idempotencyKey ? { headers: { "Idempotency-Key": idempotencyKey } } : {}
   });
 }
-function clearDriveContents(request, id) {
-  return request(`${drivePath(id)}/contents`, { method: "DELETE" });
+function getEnrollmentAdminSshKey(request, nodeId3) {
+  return request(`/v1/orchestrator/enrollment/admin-ssh-key?node_id=${encodeURIComponent(nodeId3)}`, { method: "GET" });
 }
-
-// ../../packages/api-client/dist/orchestrator/nodes.js
-function nodeQuery(query3) {
-  const params = new URLSearchParams();
-  for (const [key, value] of Object.entries(query3)) {
-    if (value !== void 0)
-      params.set(key, String(value));
-  }
-  return params.size ? `?${params}` : "";
+function rotateEnrollmentAdminSshKey(request, nodeId3) {
+  return request(`/v1/orchestrator/enrollment/admin-ssh-key?node_id=${encodeURIComponent(nodeId3)}`, { method: "POST" });
 }
-function listNodes(request, query3 = {}, signal) {
-  return request(`/v1/orchestrator/nodes${nodeQuery(query3)}`, {
+
+// ../../packages/api-client/dist/orchestrator/locality.js
+var localityGeolocatePath = "/v1/orchestrator/locality/geolocate";
+function geolocate(request, query3, signal) {
+  const target = query3.ip !== void 0 ? `ip=${encodeURIComponent(query3.ip)}` : `address=${encodeURIComponent(query3.address)}`;
+  return request(`${localityGeolocatePath}?${target}`, {
     method: "GET",
     ...signal ? { signal } : {}
   });
 }
-function listStaffNodes(request, query3 = {}, signal) {
-  return request(`/v1/staff/nodes${nodeQuery(query3)}`, {
+
+// ../../packages/api-client/dist/orchestrator/networks.js
+var networks = "/v1/orchestrator/networks";
+function networkPath(id) {
+  return `${networks}/${encodeURIComponent(id)}`;
+}
+function listNetworks(request, signal) {
+  return request(networks, { method: "GET", ...signal ? { signal } : {} });
+}
+function getNetwork(request, id, query3 = {}, signal) {
+  const params = new URLSearchParams();
+  if (query3.overlay !== void 0)
+    params.set("overlay", String(query3.overlay));
+  return request(`${networkPath(id)}${params.size ? `?${params}` : ""}`, {
     method: "GET",
     ...signal ? { signal } : {}
   });
 }
-function nodeResourcePath(id) {
-  return `/v1/orchestrator/nodes/${encodeURIComponent(id)}`;
+function createNetwork(request, body2, options = {}) {
+  return request(networks, { method: "POST", body: body2, ...options });
 }
-function getNode(request, id, signal) {
-  return request(nodeResourcePath(id), {
+function updateNetwork(request, id, body2, options = {}) {
+  return request(networkPath(id), { method: "PATCH", body: body2, ...options });
+}
+function deleteNetwork(request, id, options = {}) {
+  return request(networkPath(id), { method: "DELETE", ...options });
+}
+function listNetworkPeerConfigs(request, networkId, signal) {
+  return request(`${networkPath(networkId)}/peers`, {
     method: "GET",
     ...signal ? { signal } : {}
   });
 }
-function terminateNode(request, id, body2, headers) {
-  return request(`${nodeResourcePath(id)}/terminate`, {
-    method: "POST",
-    body: body2,
-    ...headers ? { headers } : {}
-  });
-}
-function assignNode(request, id, body2, headers) {
-  return request(`${nodeResourcePath(id)}/assign`, {
+function createNetworkPeer(request, networkId, body2, options = {}) {
+  return request(`${networkPath(networkId)}/peers`, {
     method: "POST",
     body: body2,
-    ...headers ? { headers } : {}
+    ...options
   });
 }
-function issueNodeSshCertificate(request, id, body2) {
-  return request(`${nodeResourcePath(id)}/ssh-certificates`, { method: "POST", body: body2 });
-}
-function rebootNode(request, id, body2, headers) {
-  return request(`${nodeResourcePath(id)}/reboot`, {
-    method: "POST",
-    body: body2,
-    ...headers ? { headers } : {}
+function deleteNetworkPeer(request, networkId, peerId, options = {}) {
+  return request(`${networkPath(networkId)}/peers/${encodeURIComponent(peerId)}`, {
+    method: "DELETE",
+    ...options
   });
 }
-function pushNodeKeys(request, id, body2 = {}) {
-  return request(`${nodeResourcePath(id)}/push-keys`, { method: "POST", body: body2 });
-}
 
 // ../../packages/api-client/dist/orchestrator/node-access.js
 function launchReservation(request, reservationId, body2) {
@@ -203,106 +219,91 @@ function updateNodeSanitize(request, nodeId3, jobId, body2) {
   return request(sanitizePath(nodeId3, jobId), { method: "PATCH", body: body2 });
 }
 
-// ../../packages/api-client/dist/orchestrator/networks.js
-var networks = "/v1/orchestrator/networks";
-function networkPath(id) {
-  return `${networks}/${encodeURIComponent(id)}`;
-}
-function listNetworks(request, signal) {
-  return request(networks, { method: "GET", ...signal ? { signal } : {} });
-}
-function getNetwork(request, id, query3 = {}, signal) {
+// ../../packages/api-client/dist/orchestrator/nodes.js
+function nodeQuery(query3) {
   const params = new URLSearchParams();
-  if (query3.overlay !== void 0)
-    params.set("overlay", String(query3.overlay));
-  return request(`${networkPath(id)}${params.size ? `?${params}` : ""}`, {
+  for (const [key, value] of Object.entries(query3)) {
+    if (value !== void 0)
+      params.set(key, String(value));
+  }
+  return params.size ? `?${params}` : "";
+}
+function listNodes(request, query3 = {}, signal) {
+  return request(`/v1/orchestrator/nodes${nodeQuery(query3)}`, {
     method: "GET",
     ...signal ? { signal } : {}
   });
 }
-function createNetwork(request, body2, options = {}) {
-  return request(networks, { method: "POST", body: body2, ...options });
-}
-function updateNetwork(request, id, body2, options = {}) {
-  return request(networkPath(id), { method: "PATCH", body: body2, ...options });
+function listStaffNodes(request, query3 = {}, signal) {
+  return request(`/v1/staff/nodes${nodeQuery(query3)}`, {
+    method: "GET",
+    ...signal ? { signal } : {}
+  });
 }
-function deleteNetwork(request, id, options = {}) {
-  return request(networkPath(id), { method: "DELETE", ...options });
+function nodeResourcePath(id) {
+  return `/v1/orchestrator/nodes/${encodeURIComponent(id)}`;
 }
-function listNetworkPeerConfigs(request, networkId, signal) {
-  return request(`${networkPath(networkId)}/peers`, {
+function getNode(request, id, signal) {
+  return request(nodeResourcePath(id), {
     method: "GET",
     ...signal ? { signal } : {}
   });
 }
-function createNetworkPeer(request, networkId, body2, options = {}) {
-  return request(`${networkPath(networkId)}/peers`, {
+function terminateNode(request, id, body2, headers) {
+  return request(`${nodeResourcePath(id)}/terminate`, {
     method: "POST",
     body: body2,
-    ...options
+    ...headers ? { headers } : {}
   });
 }
-function deleteNetworkPeer(request, networkId, peerId, options = {}) {
-  return request(`${networkPath(networkId)}/peers/${encodeURIComponent(peerId)}`, {
-    method: "DELETE",
-    ...options
+function assignNode(request, id, body2, headers) {
+  return request(`${nodeResourcePath(id)}/assign`, {
+    method: "POST",
+    body: body2,
+    ...headers ? { headers } : {}
   });
 }
-
-// ../../packages/api-client/dist/orchestrator/controllers.js
-var controllersSocketPath = "/v1/orchestrator/controllers";
-function controllerPath(id) {
-  return `${controllersSocketPath}/${encodeURIComponent(id)}`;
+function issueNodeSshCertificate(request, id, body2) {
+  return request(`${nodeResourcePath(id)}/ssh-certificates`, { method: "POST", body: body2 });
 }
-function createController(request, body2, options) {
-  return request(controllersSocketPath, {
-    ...options,
+function rebootNode(request, id, body2, headers) {
+  return request(`${nodeResourcePath(id)}/reboot`, {
     method: "POST",
-    body: body2
-  });
-}
-function addControllerNode(request, id, nodeId3, options) {
-  return request(`${controllerPath(id)}/nodes/${encodeURIComponent(nodeId3)}`, {
-    ...options,
-    method: "POST"
+    body: body2,
+    ...headers ? { headers } : {}
   });
 }
-function removeControllerNode(request, id, nodeId3, options) {
-  return request(`${controllerPath(id)}/nodes/${encodeURIComponent(nodeId3)}`, {
-    ...options,
-    method: "DELETE"
-  });
+function pushNodeKeys(request, id, body2 = {}) {
+  return request(`${nodeResourcePath(id)}/push-keys`, { method: "POST", body: body2 });
 }
 
-// ../../packages/api-client/dist/orchestrator/enrollment.js
-var enrollmentTokensPath = "/v1/orchestrator/enrollment-tokens";
-function listEnrollmentTokens(request, query3 = {}) {
-  return request(enrollmentTokensPath + (query3.id ? `?id=${encodeURIComponent(query3.id)}` : ""), {
-    method: "GET"
-  });
+// ../../packages/api-client/dist/orchestrator/registry.js
+function getContainerRegistry(request) {
+  return request("/v1/orchestrator/registry", { method: "GET" });
 }
-function createEnrollmentToken(request, body2) {
-  return request(enrollmentTokensPath, { method: "POST", body: body2 });
+function listRegistryRepositories(request) {
+  return request("/v1/orchestrator/registry/repositories", { method: "GET" });
 }
-function revokeEnrollmentToken(request, id, idempotencyKey) {
-  return request(`${enrollmentTokensPath}/${encodeURIComponent(id)}`, {
-    method: "DELETE",
-    ...idempotencyKey ? { headers: { "Idempotency-Key": idempotencyKey } } : {}
+function listRegistryTags(request, repository) {
+  return request(`/v1/orchestrator/registry/tags?${new URLSearchParams({ repository })}`, {
+    method: "GET"
   });
 }
-function getEnrollmentAdminSshKey(request, nodeId3) {
-  return request(`/v1/orchestrator/enrollment/admin-ssh-key?node_id=${encodeURIComponent(nodeId3)}`, { method: "GET" });
-}
-function rotateEnrollmentAdminSshKey(request, nodeId3) {
-  return request(`/v1/orchestrator/enrollment/admin-ssh-key?node_id=${encodeURIComponent(nodeId3)}`, { method: "POST" });
+function getRegistryUsage(request) {
+  return request("/v1/orchestrator/registry/usage", { method: "GET" });
 }
-function enrollmentInstallPath(query3) {
+function listRegistryCaches(request, query3 = {}) {
   const params = new URLSearchParams();
-  for (const [key, value] of Object.entries(query3)) {
-    if (value !== void 0 && value !== false)
-      params.set(key, String(value));
-  }
-  return `/v1/orchestrator/enrollment/install?${params}`;
+  if (query3.controller_id !== void 0)
+    params.set("controller_id", query3.controller_id);
+  return request(`/v1/orchestrator/registry/caches${params.size ? `?${params}` : ""}`, {
+    method: "GET"
+  });
+}
+function deleteRegistryTag(request, repository, tag) {
+  return request(`/v1/orchestrator/registry/tags?${new URLSearchParams({ repository, tag })}`, {
+    method: "DELETE"
+  });
 }
 
 // ../../packages/api-client/dist/orchestrator/remote.js
@@ -1138,43 +1139,17 @@ var observabilityCapabilities = [
 
 // ../../packages/capabilities/dist/capabilities/tokens.js
 import { z as z4 } from "zod";
-var optionalText = z4.string().nullish();
+var emptyInput = z4.object({});
 var tokenCreateInput = z4.object({
-  organization_id: z4.string().min(1),
-  facility_id: optionalText,
-  expires_in_seconds: z4.number().int().positive().nullish(),
-  filter: z4.string().nullish(),
-  ip: optionalText,
-  installer_base: optionalText,
-  host: optionalText,
-  hosts: z4.array(z4.string()).nullish(),
-  username: optionalText,
+  organization_id: z4.string().uuid(),
+  profile_id: z4.string().uuid().optional(),
+  expires_in_seconds: z4.number().int().min(300).max(86400).nullish(),
+  host: z4.string().min(1).nullish(),
+  hosts: z4.array(z4.string().min(1)).max(64).nullish(),
+  username: z4.string().min(1).nullish(),
   port: z4.number().int().min(1).max(65535).nullish(),
-  private_key: optionalText,
-  yes: z4.boolean().optional()
+  private_key: z4.string().min(1).nullish()
 });
-var emptyInput = z4.object({});
-function buildEnrollmentInstallCommand(options) {
-  const base3 = (options.base ?? "https://api.ornn.com/v1/orchestrator").replace(/\/+$/, "");
-  const path = enrollmentInstallPath({
-    token: options.token,
-    facility_id: options.facilityId,
-    filter: options.filter,
-    ip: options.ip,
-    restore_node_id: options.restoreNodeId,
-    force: options.force
-  });
-  const href = `${base3}${path.replace(/^\/v1\/orchestrator/, "")}`;
-  return `set -o pipefail; curl -fsSL '${href.replace(/'/g, "'\\''")}' | sudo bash`;
-}
-function tokenString(row, keys) {
-  for (const key of keys) {
-    const value = row[key];
-    if (typeof value === "string" && value.trim())
-      return value.trim();
-  }
-  return void 0;
-}
 var tokensListCapability = defineCapability({
   id: "tokens.list",
   domain: "fleet",
@@ -1189,34 +1164,25 @@ var tokensCreateCapability = defineCapability({
   id: "tokens.create",
   domain: "fleet",
   roles: ["admin"],
-  description: "Admin-only. Mint an enrollment token. Without a host this returns the curl installer. With host + private_key, orchestrator SSHs and runs that curl (same as Bulk Enroll). Never invent a command. Slack waits for a human confirm. ",
+  description: "Create a configurable enrollment command. With SSH hosts and a private key, create and launch a configurable run. The command carries its credential; never construct an installer command yourself.",
   mutation: "preview-confirm",
   slack: {
     parameters: {
       type: "object",
       properties: {
-        organization_id: {
+        organization_id: { type: "string", description: "Supplier organization UUID." },
+        profile_id: {
           type: "string",
-          description: "Supplier organization UUID from supplier.list."
+          description: "Optional saved enrollment profile; omission uses standard configurable settings."
         },
-        facility_id: { type: "string", description: "Optional facility UUID." },
-        expires_in_seconds: { type: "integer", description: "Token TTL in seconds." },
-        filter: {
-          type: "string",
-          description: "Optional comma-separated enrollment compartment ids. Omit to run every step."
-        },
-        ip: { type: "string", description: "Optional IP stamped into the installer URL." },
-        host: { type: "string", description: "SSH host/IP to enroll now." },
-        hosts: {
-          type: "array",
-          items: { type: "string" },
-          description: "Optional extra SSH hosts to enroll with the same key."
-        },
-        username: { type: "string", description: "SSH user. Default admin." },
-        port: { type: "integer", description: "SSH port. Default 22." },
+        expires_in_seconds: { type: "integer", description: "Command lifetime in seconds." },
+        host: { type: "string", description: "SSH host to enroll." },
+        hosts: { type: "array", items: { type: "string" }, description: "SSH hosts to enroll." },
+        username: { type: "string", description: "SSH login; default admin." },
+        port: { type: "integer", description: "SSH port; default 22." },
         private_key: {
           type: "string",
-          description: "PEM private key. Required to enroll over SSH."
+          description: "SSH private key, required when hosts are supplied."
         }
       },
       required: ["organization_id"]
@@ -1225,59 +1191,29 @@ var tokensCreateCapability = defineCapability({
   input: tokenCreateInput,
   execute: async (ctx, input) => {
     const parsed = tokenCreateInput.parse(input);
-    const organizationId = parsed.organization_id.trim();
-    const hosts = [
-      ...parsed.host?.trim() ? [parsed.host.trim()] : [],
-      ...(parsed.hosts ?? []).map((host) => host.trim()).filter(Boolean)
-    ];
-    const privateKey = parsed.private_key?.trim() || "";
-    const payload = {
-      organization_id: organizationId,
-      facility_id: parsed.facility_id,
-      expires_in_seconds: parsed.expires_in_seconds,
-      filter: parsed.filter,
-      ip: parsed.ip,
-      hosts,
-      username: parsed.username?.trim() || "admin",
-      port: parsed.port ?? 22,
-      remote: hosts.length > 0 && privateKey.length > 0
-    };
-    if (!ctx.confirmed) {
-      return preview("tokens.create", { ...payload, private_key: privateKey ? "[redacted]" : "" });
+    const hosts = [...parsed.host ? [parsed.host] : [], ...parsed.hosts ?? []];
+    if (hosts.length > 64 || hosts.length > 0 && !parsed.private_key) {
+      throw new Error("Provide at most 64 SSH hosts and a private key, or omit hosts to create a manual command.");
     }
-    const minted = await createEnrollmentToken(ctx.fetch, {
-      organization_id: organizationId,
-      ...payload.facility_id ? { facility_id: payload.facility_id } : {},
-      ...payload.expires_in_seconds ? { expires_in_seconds: payload.expires_in_seconds } : {}
-    });
-    const token = tokenString(minted, ["token", "plaintext"]) ?? "";
-    const installCommand = token ? buildEnrollmentInstallCommand({
-      token,
-      base: parsed.installer_base ?? void 0,
-      ip: parsed.ip ?? void 0,
-      filter: parsed.filter ?? void 0,
-      force: payload.remote
-    }) : null;
-    if (!payload.remote || !installCommand) {
-      return { ...minted, install_command: installCommand };
-    }
-    const results = [];
-    for (const host of hosts) {
-      results.push(await runRemote(ctx.fetch, {
-        host,
-        username: payload.username,
-        port: payload.port,
-        private_key: privateKey,
-        command: installCommand,
-        timeout_seconds: 600
-      }));
-    }
-    return {
-      id: minted.id,
-      organization_id: minted.organization_id ?? organizationId,
-      expires_at: minted.expires_at,
-      hosts: results
+    const body2 = {
+      organization_id: parsed.organization_id,
+      label: "Host enrollment",
+      ...parsed.profile_id ? { profile_id: parsed.profile_id } : {},
+      ...parsed.expires_in_seconds ? { expires_in_seconds: parsed.expires_in_seconds } : {},
+      ...hosts.length ? {
+        hosts: hosts.map((address) => ({ address, port: parsed.port ?? 22 })),
+        discover_access: true
+      } : { discover_host: true }
     };
+    if (!ctx.confirmed)
+      return preview("tokens.create", body2);
+    const run = await createEnrollmentRun(ctx.fetch, body2);
+    if (hosts.length)
+      await launchEnrollmentRun(ctx.fetch, run.id, {
+        username: parsed.username ?? "admin",
+        private_key: parsed.private_key
+      });
+    return run;
   }
 });
 var tokenCapabilities = [tokensListCapability, tokensCreateCapability];
@@ -1553,7 +1489,8 @@ function quoteBid(request, bid) {
     orderType: bid.orderType,
     pricePerGpuHourMicroUsd: bid.pricePerGpuHourMicroUsd === void 0 ? null : String(bid.pricePerGpuHourMicroUsd),
     nodeSelections: bid.nodeSelections ? JSON.stringify(bid.nodeSelections) : null,
-    ...scope(bid)
+    ...scope(bid),
+    organizationId: bid.organizationId
   })}`, { method: "GET" });
 }
 function placeBid(request, bid, idempotencyKey) {
@@ -2737,7 +2674,7 @@ var adminEnrollmentTokensListCapability2 = {
     };
   }
 };
-var adminEnrollmentTokenCreateCapability = withVnextBinding(tokensCreateCapability, adminHelp3(["admin", "enrollment-tokens", "create"], "Create one expiring enrollment token through an explicit secret export.", "ornn admin enrollment-tokens create --supplier UUID --expires-in SECONDS (--print | --output PATH) [--overwrite] []", "Unsupported: token creation requires an eligible human terminal.", ["canonical supplier organization UUID"], "Review the supplier, expiry, and secret destination before minting the token."));
+var adminEnrollmentTokenCreateCapability = withVnextBinding(tokensCreateCapability, adminHelp3(["admin", "enrollment-tokens", "create"], "Create an expiring configurable enrollment command through an explicit secret export.", "ornn admin enrollment-tokens create --supplier UUID --expires-in SECONDS (--print | --output PATH) [--overwrite]", "Unsupported: token creation requires an eligible human terminal.", ["canonical supplier organization UUID"], "Review the supplier, expiry, and secret destination before creating the command."));
 var tokenRevokeInput = z12.object({
   tokenId: z12.string().min(1),
   token_id: UUID.optional(),
@@ -2831,29 +2768,13 @@ var nodeEnrollInput = z12.object({
   host: nonEmpty,
   organization_id: UUID,
   facility_id: UUID,
-  filter: z12.string().optional(),
   identity_file: nonEmpty,
   private_key: z12.string().min(1).optional(),
   username: nonEmpty.default("root"),
   port: z12.number().int().min(1).max(65535).default(22),
   expires_in_seconds: tokenTtl,
-  installer_base: nonEmpty.optional(),
-  replace_existing_management: z12.literal(true),
-  verbose: z12.boolean().default(false)
+  replace_existing_management: z12.literal(true)
 });
-function safeRemoteResult(value) {
-  if (!value || typeof value !== "object")
-    return {};
-  const row = value;
-  const safe = {};
-  for (const key of ["id", "status", "state", "exit_code", "started_at", "completed_at"]) {
-    const field = row[key];
-    if (typeof field === "string" || typeof field === "number" || typeof field === "boolean") {
-      safe[key] = field;
-    }
-  }
-  return safe;
-}
 var adminNodeEnrollCapability = defineCapability({
   id: "nodes.enroll",
   domain: "fleet",
@@ -2862,7 +2783,7 @@ var adminNodeEnrollCapability = defineCapability({
   mutation: "preview-confirm",
   cli: {
     command: ["admin", "nodes", "enroll"],
-    vnext: adminHelp3(["admin", "nodes", "enroll"], "Install Ornn management on one explicitly assigned node.", "ornn admin nodes enroll <node-id> --host HOST --supplier UUID --facility UUID [--filter COMPARTMENT_IDS] --identity-file PATH --token-ttl SECONDS --replace-existing-management [--verbose] []", "Unsupported: remote enrollment requires an eligible human terminal.", ["canonical node UUID", "canonical supplier organization UUID", "canonical facility UUID"], "Review node identity, SSH target, assignment, compartment filter, and replacement of existing management.")
+    vnext: adminHelp3(["admin", "nodes", "enroll"], "Install Ornn management on one explicitly assigned node.", "ornn admin nodes enroll <node-id> --host HOST --supplier UUID --facility UUID --identity-file PATH --token-ttl SECONDS --replace-existing-management []", "Unsupported: remote enrollment requires an eligible human terminal.", ["canonical node UUID", "canonical supplier organization UUID", "canonical facility UUID"], "Review node identity, SSH target, assignment, and replacement of existing management.")
   },
   mcp: false,
   slack: false,
@@ -2875,7 +2796,6 @@ var adminNodeEnrollCapability = defineCapability({
         host: parsed.host,
         organization_id: parsed.organization_id,
         facility_id: parsed.facility_id,
-        filter: parsed.filter,
         expires_in_seconds: parsed.expires_in_seconds,
         replace_existing_management: true
       };
@@ -2883,43 +2803,22 @@ var adminNodeEnrollCapability = defineCapability({
     if (!parsed.private_key) {
       throw codedError("identity_file_unreadable", "The SSH identity file could not be read.");
     }
-    const minted = await createEnrollmentToken(ctx.fetch, {
-      organization_id: parsed.organization_id,
-      expires_in_seconds: parsed.expires_in_seconds
-    });
-    const token = typeof minted.token === "string" ? minted.token : typeof minted.plaintext === "string" ? minted.plaintext : "";
-    if (!token) {
-      throw codedError("token_material_unavailable", "The enrollment token was created without usable token material.");
+    const node = await getNode(ctx.fetch, parsed.node_id);
+    if (node.organization_id !== parsed.organization_id || node.facility_id !== parsed.facility_id) {
+      throw codedError("node_assignment_changed", "The existing node supplier or facility does not match the requested assignment.");
     }
-    const command = buildEnrollmentInstallCommand({
-      token,
-      base: parsed.installer_base ?? ctx.installerBaseUrl,
-      facilityId: parsed.facility_id,
-      filter: parsed.filter,
-      restoreNodeId: parsed.node_id,
-      force: true
+    const run = await createEnrollmentRun(ctx.fetch, {
+      organization_id: parsed.organization_id,
+      label: "Recover node agent",
+      restore_node_id: parsed.node_id,
+      expires_in_seconds: parsed.expires_in_seconds,
+      hosts: [{ address: parsed.host, port: parsed.port }]
     });
-    const remote = await runRemote(ctx.fetch, {
-      host: parsed.host,
+    await launchEnrollmentRun(ctx.fetch, run.id, {
       username: parsed.username,
-      port: parsed.port,
-      private_key: parsed.private_key,
-      command,
-      timeout_seconds: 600
+      private_key: parsed.private_key
     });
-    return {
-      node_id: parsed.node_id,
-      host: parsed.host,
-      organization_id: parsed.organization_id,
-      facility_id: parsed.facility_id,
-      filter: parsed.filter,
-      management: "replaced",
-      token_metadata: {
-        id: typeof minted.id === "string" ? minted.id : null,
-        expires_at: typeof minted.expires_at === "string" ? minted.expires_at : null
-      },
-      remote: safeRemoteResult(remote)
-    };
+    return run;
   }
 });
 var nodeKeyInput = z12.object({ node_id: UUID });
@@ -2949,7 +2848,7 @@ var adminNodeRotateKeyCapability = defineCapability({
   mutation: "preview-confirm",
   cli: {
     command: ["admin", "nodes", "rotate-key"],
-    vnext: adminHelp3(["admin", "nodes", "rotate-key"], "Rotate one node admin key and export the replacement deliberately.", "ornn admin nodes rotate-key <node-id> (--print | --output PATH) [--overwrite] []", "Unsupported: key rotation requires an eligible human terminal.", ["canonical node UUID"], "Review the node and loss of access through the previous private key.")
+    vnext: adminHelp3(["admin", "nodes", "rotate-key"], "Rotate one node admin key and export the replacement deliberately.", "ornn admin nodes rotate-key <node-id> (--print | --output PATH) [--overwrite]", "Unsupported: key rotation requires an eligible human terminal.", ["canonical node UUID"], "Review the node and loss of access through the previous private key.")
   },
   mcp: false,
   slack: false,
@@ -3218,19 +3117,19 @@ var adminNodeSanitizeCapabilities = [
 // ../../packages/capabilities/dist/capabilities/admin-nodes-lifecycle.js
 import { z as z15 } from "zod";
 var nodeReference = z15.string().trim().min(1);
-var optionalText2 = z15.string().trim().min(1).optional();
+var optionalText = z15.string().trim().min(1).optional();
 var commonInput = {
   node_ref: nodeReference,
-  node_id: optionalText2,
-  idempotency_key: optionalText2,
-  reason: optionalText2,
+  node_id: optionalText,
+  idempotency_key: optionalText,
+  reason: optionalText,
   yes: z15.boolean().optional(),
   wait: z15.boolean().optional(),
   timeout_seconds: z15.number().positive().optional()
 };
 var rebootInput = z15.object({
   ...commonInput,
-  machine_id: optionalText2
+  machine_id: optionalText
 });
 var hardResetInput = rebootInput.extend({
   erase_local_data: z15.literal(true)