@ornncompute/cli 1.0.137 → 1.0.139

package/vendor/capabilities/cli.js

@@ -7,43 +7,60 @@ function getHardwareCatalog(request, signal) {
   });
 }
 
-// ../../packages/api-client/dist/orchestrator/locality.js
-var localityGeolocatePath = "/v1/orchestrator/locality/geolocate";
-function geolocate(request, query3, signal) {
-  const target = query3.ip !== void 0 ? `ip=${encodeURIComponent(query3.ip)}` : `address=${encodeURIComponent(query3.address)}`;
-  return request(`${localityGeolocatePath}?${target}`, {
-    method: "GET",
-    ...signal ? { signal } : {}
+// ../../packages/api-client/dist/orchestrator/configurable-enrollment.js
+var root = "/v1/orchestrator/enrollment/configurable";
+function createEnrollmentRun(request, body2) {
+  return request(`${root}/runs`, { method: "POST", body: body2 });
+}
+function launchEnrollmentRun(request, id, body2) {
+  return request(`${root}/runs/${encodeURIComponent(id)}/launch`, {
+    method: "POST",
+    body: body2
   });
 }
 
-// ../../packages/api-client/dist/orchestrator/registry.js
-function getContainerRegistry(request) {
-  return request("/v1/orchestrator/registry", { method: "GET" });
+// ../../packages/api-client/dist/orchestrator/controllers.js
+var controllersSocketPath = "/v1/orchestrator/controllers";
+function controllerPath(id) {
+  return `${controllersSocketPath}/${encodeURIComponent(id)}`;
 }
-function listRegistryRepositories(request) {
-  return request("/v1/orchestrator/registry/repositories", { method: "GET" });
+function createController(request, body2, options) {
+  return request(controllersSocketPath, {
+    ...options,
+    method: "POST",
+    body: body2
+  });
 }
-function listRegistryTags(request, repository) {
-  return request(`/v1/orchestrator/registry/tags?${new URLSearchParams({ repository })}`, {
-    method: "GET"
+function addControllerNode(request, id, nodeId3, options) {
+  return request(`${controllerPath(id)}/nodes/${encodeURIComponent(nodeId3)}`, {
+    ...options,
+    method: "POST"
   });
 }
-function getRegistryUsage(request) {
-  return request("/v1/orchestrator/registry/usage", { method: "GET" });
+function removeControllerNode(request, id, nodeId3, options) {
+  return request(`${controllerPath(id)}/nodes/${encodeURIComponent(nodeId3)}`, {
+    ...options,
+    method: "DELETE"
+  });
 }
-function listRegistryCaches(request, query3 = {}) {
+
+// ../../packages/api-client/dist/orchestrator/drive-files.js
+function drivePath(id) {
+  return `/v1/orchestrator/drives/${encodeURIComponent(id)}`;
+}
+function listDriveContents(request, id, query3 = {}, signal) {
   const params = new URLSearchParams();
-  if (query3.controller_id !== void 0)
-    params.set("controller_id", query3.controller_id);
-  return request(`/v1/orchestrator/registry/caches${params.size ? `?${params}` : ""}`, {
-    method: "GET"
+  for (const [key, value] of Object.entries(query3)) {
+    if (value !== void 0)
+      params.set(key, String(value));
+  }
+  return request(`${drivePath(id)}/contents${params.size ? `?${params}` : ""}`, {
+    method: "GET",
+    ...signal ? { signal } : {}
   });
 }
-function deleteRegistryTag(request, repository, tag) {
-  return request(`/v1/orchestrator/registry/tags?${new URLSearchParams({ repository, tag })}`, {
-    method: "DELETE"
-  });
+function clearDriveContents(request, id) {
+  return request(`${drivePath(id)}/contents`, { method: "DELETE" });
 }
 
 // ../../packages/api-client/dist/orchestrator/drives.js
@@ -94,82 +111,81 @@ function listStorageTargets(request, signal) {
   });
 }
 
-// ../../packages/api-client/dist/orchestrator/drive-files.js
-function drivePath(id) {
-  return `/v1/orchestrator/drives/${encodeURIComponent(id)}`;
+// ../../packages/api-client/dist/orchestrator/enrollment.js
+var enrollmentTokensPath = "/v1/orchestrator/enrollment-tokens";
+function listEnrollmentTokens(request, query3 = {}) {
+  return request(enrollmentTokensPath + (query3.id ? `?id=${encodeURIComponent(query3.id)}` : ""), {
+    method: "GET"
+  });
 }
-function listDriveContents(request, id, query3 = {}, signal) {
-  const params = new URLSearchParams();
-  for (const [key, value] of Object.entries(query3)) {
-    if (value !== void 0)
-      params.set(key, String(value));
-  }
-  return request(`${drivePath(id)}/contents${params.size ? `?${params}` : ""}`, {
-    method: "GET",
-    ...signal ? { signal } : {}
+function revokeEnrollmentToken(request, id, idempotencyKey) {
+  return request(`${enrollmentTokensPath}/${encodeURIComponent(id)}`, {
+    method: "DELETE",
+    ...idempotencyKey ? { headers: { "Idempotency-Key": idempotencyKey } } : {}
   });
 }
-function clearDriveContents(request, id) {
-  return request(`${drivePath(id)}/contents`, { method: "DELETE" });
+function getEnrollmentAdminSshKey(request, nodeId3) {
+  return request(`/v1/orchestrator/enrollment/admin-ssh-key?node_id=${encodeURIComponent(nodeId3)}`, { method: "GET" });
 }
-
-// ../../packages/api-client/dist/orchestrator/nodes.js
-function nodeQuery(query3) {
-  const params = new URLSearchParams();
-  for (const [key, value] of Object.entries(query3)) {
-    if (value !== void 0)
-      params.set(key, String(value));
-  }
-  return params.size ? `?${params}` : "";
+function rotateEnrollmentAdminSshKey(request, nodeId3) {
+  return request(`/v1/orchestrator/enrollment/admin-ssh-key?node_id=${encodeURIComponent(nodeId3)}`, { method: "POST" });
 }
-function listNodes(request, query3 = {}, signal) {
-  return request(`/v1/orchestrator/nodes${nodeQuery(query3)}`, {
+
+// ../../packages/api-client/dist/orchestrator/locality.js
+var localityGeolocatePath = "/v1/orchestrator/locality/geolocate";
+function geolocate(request, query3, signal) {
+  const target = query3.ip !== void 0 ? `ip=${encodeURIComponent(query3.ip)}` : `address=${encodeURIComponent(query3.address)}`;
+  return request(`${localityGeolocatePath}?${target}`, {
     method: "GET",
     ...signal ? { signal } : {}
   });
 }
-function listStaffNodes(request, query3 = {}, signal) {
-  return request(`/v1/staff/nodes${nodeQuery(query3)}`, {
+
+// ../../packages/api-client/dist/orchestrator/networks.js
+var networks = "/v1/orchestrator/networks";
+function networkPath(id) {
+  return `${networks}/${encodeURIComponent(id)}`;
+}
+function listNetworks(request, signal) {
+  return request(networks, { method: "GET", ...signal ? { signal } : {} });
+}
+function getNetwork(request, id, query3 = {}, signal) {
+  const params = new URLSearchParams();
+  if (query3.overlay !== void 0)
+    params.set("overlay", String(query3.overlay));
+  return request(`${networkPath(id)}${params.size ? `?${params}` : ""}`, {
     method: "GET",
     ...signal ? { signal } : {}
   });
 }
-function nodeResourcePath(id) {
-  return `/v1/orchestrator/nodes/${encodeURIComponent(id)}`;
+function createNetwork(request, body2, options = {}) {
+  return request(networks, { method: "POST", body: body2, ...options });
 }
-function getNode(request, id, signal) {
-  return request(nodeResourcePath(id), {
+function updateNetwork(request, id, body2, options = {}) {
+  return request(networkPath(id), { method: "PATCH", body: body2, ...options });
+}
+function deleteNetwork(request, id, options = {}) {
+  return request(networkPath(id), { method: "DELETE", ...options });
+}
+function listNetworkPeerConfigs(request, networkId, signal) {
+  return request(`${networkPath(networkId)}/peers`, {
     method: "GET",
     ...signal ? { signal } : {}
   });
 }
-function terminateNode(request, id, body2, headers) {
-  return request(`${nodeResourcePath(id)}/terminate`, {
-    method: "POST",
-    body: body2,
-    ...headers ? { headers } : {}
-  });
-}
-function assignNode(request, id, body2, headers) {
-  return request(`${nodeResourcePath(id)}/assign`, {
+function createNetworkPeer(request, networkId, body2, options = {}) {
+  return request(`${networkPath(networkId)}/peers`, {
     method: "POST",
     body: body2,
-    ...headers ? { headers } : {}
+    ...options
   });
 }
-function issueNodeSshCertificate(request, id, body2) {
-  return request(`${nodeResourcePath(id)}/ssh-certificates`, { method: "POST", body: body2 });
-}
-function rebootNode(request, id, body2, headers) {
-  return request(`${nodeResourcePath(id)}/reboot`, {
-    method: "POST",
-    body: body2,
-    ...headers ? { headers } : {}
+function deleteNetworkPeer(request, networkId, peerId, options = {}) {
+  return request(`${networkPath(networkId)}/peers/${encodeURIComponent(peerId)}`, {
+    method: "DELETE",
+    ...options
   });
 }
-function pushNodeKeys(request, id, body2 = {}) {
-  return request(`${nodeResourcePath(id)}/push-keys`, { method: "POST", body: body2 });
-}
 
 // ../../packages/api-client/dist/orchestrator/node-access.js
 function launchReservation(request, reservationId, body2) {
@@ -203,106 +219,91 @@ function updateNodeSanitize(request, nodeId3, jobId, body2) {
   return request(sanitizePath(nodeId3, jobId), { method: "PATCH", body: body2 });
 }
 
-// ../../packages/api-client/dist/orchestrator/networks.js
-var networks = "/v1/orchestrator/networks";
-function networkPath(id) {
-  return `${networks}/${encodeURIComponent(id)}`;
-}
-function listNetworks(request, signal) {
-  return request(networks, { method: "GET", ...signal ? { signal } : {} });
-}
-function getNetwork(request, id, query3 = {}, signal) {
+// ../../packages/api-client/dist/orchestrator/nodes.js
+function nodeQuery(query3) {
   const params = new URLSearchParams();
-  if (query3.overlay !== void 0)
-    params.set("overlay", String(query3.overlay));
-  return request(`${networkPath(id)}${params.size ? `?${params}` : ""}`, {
+  for (const [key, value] of Object.entries(query3)) {
+    if (value !== void 0)
+      params.set(key, String(value));
+  }
+  return params.size ? `?${params}` : "";
+}
+function listNodes(request, query3 = {}, signal) {
+  return request(`/v1/orchestrator/nodes${nodeQuery(query3)}`, {
     method: "GET",
     ...signal ? { signal } : {}
   });
 }
-function createNetwork(request, body2, options = {}) {
-  return request(networks, { method: "POST", body: body2, ...options });
-}
-function updateNetwork(request, id, body2, options = {}) {
-  return request(networkPath(id), { method: "PATCH", body: body2, ...options });
+function listStaffNodes(request, query3 = {}, signal) {
+  return request(`/v1/staff/nodes${nodeQuery(query3)}`, {
+    method: "GET",
+    ...signal ? { signal } : {}
+  });
 }
-function deleteNetwork(request, id, options = {}) {
-  return request(networkPath(id), { method: "DELETE", ...options });
+function nodeResourcePath(id) {
+  return `/v1/orchestrator/nodes/${encodeURIComponent(id)}`;
 }
-function listNetworkPeerConfigs(request, networkId, signal) {
-  return request(`${networkPath(networkId)}/peers`, {
+function getNode(request, id, signal) {
+  return request(nodeResourcePath(id), {
     method: "GET",
     ...signal ? { signal } : {}
   });
 }
-function createNetworkPeer(request, networkId, body2, options = {}) {
-  return request(`${networkPath(networkId)}/peers`, {
+function terminateNode(request, id, body2, headers) {
+  return request(`${nodeResourcePath(id)}/terminate`, {
     method: "POST",
     body: body2,
-    ...options
+    ...headers ? { headers } : {}
   });
 }
-function deleteNetworkPeer(request, networkId, peerId, options = {}) {
-  return request(`${networkPath(networkId)}/peers/${encodeURIComponent(peerId)}`, {
-    method: "DELETE",
-    ...options
+function assignNode(request, id, body2, headers) {
+  return request(`${nodeResourcePath(id)}/assign`, {
+    method: "POST",
+    body: body2,
+    ...headers ? { headers } : {}
   });
 }
-
-// ../../packages/api-client/dist/orchestrator/controllers.js
-var controllersSocketPath = "/v1/orchestrator/controllers";
-function controllerPath(id) {
-  return `${controllersSocketPath}/${encodeURIComponent(id)}`;
+function issueNodeSshCertificate(request, id, body2) {
+  return request(`${nodeResourcePath(id)}/ssh-certificates`, { method: "POST", body: body2 });
 }
-function createController(request, body2, options) {
-  return request(controllersSocketPath, {
-    ...options,
+function rebootNode(request, id, body2, headers) {
+  return request(`${nodeResourcePath(id)}/reboot`, {
     method: "POST",
-    body: body2
-  });
-}
-function addControllerNode(request, id, nodeId3, options) {
-  return request(`${controllerPath(id)}/nodes/${encodeURIComponent(nodeId3)}`, {
-    ...options,
-    method: "POST"
+    body: body2,
+    ...headers ? { headers } : {}
   });
 }
-function removeControllerNode(request, id, nodeId3, options) {
-  return request(`${controllerPath(id)}/nodes/${encodeURIComponent(nodeId3)}`, {
-    ...options,
-    method: "DELETE"
-  });
+function pushNodeKeys(request, id, body2 = {}) {
+  return request(`${nodeResourcePath(id)}/push-keys`, { method: "POST", body: body2 });
 }
 
-// ../../packages/api-client/dist/orchestrator/enrollment.js
-var enrollmentTokensPath = "/v1/orchestrator/enrollment-tokens";
-function listEnrollmentTokens(request, query3 = {}) {
-  return request(enrollmentTokensPath + (query3.id ? `?id=${encodeURIComponent(query3.id)}` : ""), {
-    method: "GET"
-  });
+// ../../packages/api-client/dist/orchestrator/registry.js
+function getContainerRegistry(request) {
+  return request("/v1/orchestrator/registry", { method: "GET" });
 }
-function createEnrollmentToken(request, body2) {
-  return request(enrollmentTokensPath, { method: "POST", body: body2 });
+function listRegistryRepositories(request) {
+  return request("/v1/orchestrator/registry/repositories", { method: "GET" });
 }
-function revokeEnrollmentToken(request, id, idempotencyKey) {
-  return request(`${enrollmentTokensPath}/${encodeURIComponent(id)}`, {
-    method: "DELETE",
-    ...idempotencyKey ? { headers: { "Idempotency-Key": idempotencyKey } } : {}
+function listRegistryTags(request, repository) {
+  return request(`/v1/orchestrator/registry/tags?${new URLSearchParams({ repository })}`, {
+    method: "GET"
   });
 }
-function getEnrollmentAdminSshKey(request, nodeId3) {
-  return request(`/v1/orchestrator/enrollment/admin-ssh-key?node_id=${encodeURIComponent(nodeId3)}`, { method: "GET" });
-}
-function rotateEnrollmentAdminSshKey(request, nodeId3) {
-  return request(`/v1/orchestrator/enrollment/admin-ssh-key?node_id=${encodeURIComponent(nodeId3)}`, { method: "POST" });
+function getRegistryUsage(request) {
+  return request("/v1/orchestrator/registry/usage", { method: "GET" });
 }
-function enrollmentInstallPath(query3) {
+function listRegistryCaches(request, query3 = {}) {
   const params = new URLSearchParams();
-  for (const [key, value] of Object.entries(query3)) {
-    if (value !== void 0 && value !== false)
-      params.set(key, String(value));
-  }
-  return `/v1/orchestrator/enrollment/install?${params}`;
+  if (query3.controller_id !== void 0)
+    params.set("controller_id", query3.controller_id);
+  return request(`/v1/orchestrator/registry/caches${params.size ? `?${params}` : ""}`, {
+    method: "GET"
+  });
+}
+function deleteRegistryTag(request, repository, tag) {
+  return request(`/v1/orchestrator/registry/tags?${new URLSearchParams({ repository, tag })}`, {
+    method: "DELETE"
+  });
 }
 
 // ../../packages/api-client/dist/orchestrator/remote.js
@@ -332,8 +333,8 @@ function defineCapability(spec) {
     ...rest,
     ...cli !== false && cli !== void 0 ? {
       cli: {
-        command: cli.command ?? names.cli,
-        ...cli.vnext ? { vnext: cli.vnext } : {}
+        ...cli,
+        command: cli.command ?? names.cli
       }
     } : {},
     ...mcp === false ? {} : { mcp: { name: mcp?.name ?? names.mcp } },
@@ -1138,43 +1139,17 @@ var observabilityCapabilities = [
 
 // ../../packages/capabilities/dist/capabilities/tokens.js
 import { z as z4 } from "zod";
-var optionalText = z4.string().nullish();
+var emptyInput = z4.object({});
 var tokenCreateInput = z4.object({
-  organization_id: z4.string().min(1),
-  facility_id: optionalText,
-  expires_in_seconds: z4.number().int().positive().nullish(),
-  filter: z4.string().nullish(),
-  ip: optionalText,
-  installer_base: optionalText,
-  host: optionalText,
-  hosts: z4.array(z4.string()).nullish(),
-  username: optionalText,
+  organization_id: z4.string().uuid(),
+  profile_id: z4.string().uuid().optional(),
+  expires_in_seconds: z4.number().int().min(300).max(86400).nullish(),
+  host: z4.string().min(1).nullish(),
+  hosts: z4.array(z4.string().min(1)).max(64).nullish(),
+  username: z4.string().min(1).nullish(),
   port: z4.number().int().min(1).max(65535).nullish(),
-  private_key: optionalText,
-  yes: z4.boolean().optional()
+  private_key: z4.string().min(1).nullish()
 });
-var emptyInput = z4.object({});
-function buildEnrollmentInstallCommand(options) {
-  const base3 = (options.base ?? "https://api.ornn.com/v1/orchestrator").replace(/\/+$/, "");
-  const path = enrollmentInstallPath({
-    token: options.token,
-    facility_id: options.facilityId,
-    filter: options.filter,
-    ip: options.ip,
-    restore_node_id: options.restoreNodeId,
-    force: options.force
-  });
-  const href = `${base3}${path.replace(/^\/v1\/orchestrator/, "")}`;
-  return `set -o pipefail; curl -fsSL '${href.replace(/'/g, "'\\''")}' | sudo bash`;
-}
-function tokenString(row, keys) {
-  for (const key of keys) {
-    const value = row[key];
-    if (typeof value === "string" && value.trim())
-      return value.trim();
-  }
-  return void 0;
-}
 var tokensListCapability = defineCapability({
   id: "tokens.list",
   domain: "fleet",
@@ -1189,34 +1164,25 @@ var tokensCreateCapability = defineCapability({
   id: "tokens.create",
   domain: "fleet",
   roles: ["admin"],
-  description: "Admin-only. Mint an enrollment token. Without a host this returns the curl installer. With host + private_key, orchestrator SSHs and runs that curl (same as Bulk Enroll). Never invent a command. Slack waits for a human confirm. ",
+  description: "Create a configurable enrollment command. With SSH hosts and a private key, create and launch a configurable run. The command carries its credential; never construct an installer command yourself.",
   mutation: "preview-confirm",
   slack: {
     parameters: {
       type: "object",
       properties: {
-        organization_id: {
-          type: "string",
-          description: "Supplier organization UUID from supplier.list."
-        },
-        facility_id: { type: "string", description: "Optional facility UUID." },
-        expires_in_seconds: { type: "integer", description: "Token TTL in seconds." },
-        filter: {
+        organization_id: { type: "string", description: "Supplier organization UUID." },
+        profile_id: {
           type: "string",
-          description: "Optional comma-separated enrollment compartment ids. Omit to run every step."
+          description: "Optional saved enrollment profile; omission uses standard configurable settings."
         },
-        ip: { type: "string", description: "Optional IP stamped into the installer URL." },
-        host: { type: "string", description: "SSH host/IP to enroll now." },
-        hosts: {
-          type: "array",
-          items: { type: "string" },
-          description: "Optional extra SSH hosts to enroll with the same key."
-        },
-        username: { type: "string", description: "SSH user. Default admin." },
-        port: { type: "integer", description: "SSH port. Default 22." },
+        expires_in_seconds: { type: "integer", description: "Command lifetime in seconds." },
+        host: { type: "string", description: "SSH host to enroll." },
+        hosts: { type: "array", items: { type: "string" }, description: "SSH hosts to enroll." },
+        username: { type: "string", description: "SSH login; default admin." },
+        port: { type: "integer", description: "SSH port; default 22." },
         private_key: {
           type: "string",
-          description: "PEM private key. Required to enroll over SSH."
+          description: "SSH private key, required when hosts are supplied."
         }
       },
       required: ["organization_id"]
@@ -1225,59 +1191,29 @@ var tokensCreateCapability = defineCapability({
   input: tokenCreateInput,
   execute: async (ctx, input) => {
     const parsed = tokenCreateInput.parse(input);
-    const organizationId = parsed.organization_id.trim();
-    const hosts = [
-      ...parsed.host?.trim() ? [parsed.host.trim()] : [],
-      ...(parsed.hosts ?? []).map((host) => host.trim()).filter(Boolean)
-    ];
-    const privateKey = parsed.private_key?.trim() || "";
-    const payload = {
-      organization_id: organizationId,
-      facility_id: parsed.facility_id,
-      expires_in_seconds: parsed.expires_in_seconds,
-      filter: parsed.filter,
-      ip: parsed.ip,
-      hosts,
-      username: parsed.username?.trim() || "admin",
-      port: parsed.port ?? 22,
-      remote: hosts.length > 0 && privateKey.length > 0
-    };
-    if (!ctx.confirmed) {
-      return preview("tokens.create", { ...payload, private_key: privateKey ? "[redacted]" : "" });
-    }
-    const minted = await createEnrollmentToken(ctx.fetch, {
-      organization_id: organizationId,
-      ...payload.facility_id ? { facility_id: payload.facility_id } : {},
-      ...payload.expires_in_seconds ? { expires_in_seconds: payload.expires_in_seconds } : {}
-    });
-    const token = tokenString(minted, ["token", "plaintext"]) ?? "";
-    const installCommand = token ? buildEnrollmentInstallCommand({
-      token,
-      base: parsed.installer_base ?? void 0,
-      ip: parsed.ip ?? void 0,
-      filter: parsed.filter ?? void 0,
-      force: payload.remote
-    }) : null;
-    if (!payload.remote || !installCommand) {
-      return { ...minted, install_command: installCommand };
+    const hosts = [...parsed.host ? [parsed.host] : [], ...parsed.hosts ?? []];
+    if (hosts.length > 64 || hosts.length > 0 && !parsed.private_key) {
+      throw new Error("Provide at most 64 SSH hosts and a private key, or omit hosts to create a manual command.");
     }
-    const results = [];
-    for (const host of hosts) {
-      results.push(await runRemote(ctx.fetch, {
-        host,
-        username: payload.username,
-        port: payload.port,
-        private_key: privateKey,
-        command: installCommand,
-        timeout_seconds: 600
-      }));
-    }
-    return {
-      id: minted.id,
-      organization_id: minted.organization_id ?? organizationId,
-      expires_at: minted.expires_at,
-      hosts: results
+    const body2 = {
+      organization_id: parsed.organization_id,
+      label: "Host enrollment",
+      ...parsed.profile_id ? { profile_id: parsed.profile_id } : {},
+      ...parsed.expires_in_seconds ? { expires_in_seconds: parsed.expires_in_seconds } : {},
+      ...hosts.length ? {
+        hosts: hosts.map((address) => ({ address, port: parsed.port ?? 22 })),
+        discover_access: true
+      } : { discover_host: true }
     };
+    if (!ctx.confirmed)
+      return preview("tokens.create", body2);
+    const run = await createEnrollmentRun(ctx.fetch, body2);
+    if (hosts.length)
+      await launchEnrollmentRun(ctx.fetch, run.id, {
+        username: parsed.username ?? "admin",
+        private_key: parsed.private_key
+      });
+    return run;
   }
 });
 var tokenCapabilities = [tokensListCapability, tokensCreateCapability];
@@ -1553,7 +1489,8 @@ function quoteBid(request, bid) {
     orderType: bid.orderType,
     pricePerGpuHourMicroUsd: bid.pricePerGpuHourMicroUsd === void 0 ? null : String(bid.pricePerGpuHourMicroUsd),
     nodeSelections: bid.nodeSelections ? JSON.stringify(bid.nodeSelections) : null,
-    ...scope(bid)
+    ...scope(bid),
+    organizationId: bid.organizationId
   })}`, { method: "GET" });
 }
 function placeBid(request, bid, idempotencyKey) {
@@ -2737,7 +2674,7 @@ var adminEnrollmentTokensListCapability2 = {
     };
   }
 };
-var adminEnrollmentTokenCreateCapability = withVnextBinding(tokensCreateCapability, adminHelp3(["admin", "enrollment-tokens", "create"], "Create one expiring enrollment token through an explicit secret export.", "ornn admin enrollment-tokens create --supplier UUID --expires-in SECONDS (--print | --output PATH) [--overwrite] []", "Unsupported: token creation requires an eligible human terminal.", ["canonical supplier organization UUID"], "Review the supplier, expiry, and secret destination before minting the token."));
+var adminEnrollmentTokenCreateCapability = withVnextBinding(tokensCreateCapability, adminHelp3(["admin", "enrollment-tokens", "create"], "Create an expiring configurable enrollment command through an explicit secret export.", "ornn admin enrollment-tokens create --supplier UUID --expires-in SECONDS (--print | --output PATH) [--overwrite]", "Unsupported: token creation requires an eligible human terminal.", ["canonical supplier organization UUID"], "Review the supplier, expiry, and secret destination before creating the command."));
 var tokenRevokeInput = z12.object({
   tokenId: z12.string().min(1),
   token_id: UUID.optional(),
@@ -2831,29 +2768,13 @@ var nodeEnrollInput = z12.object({
   host: nonEmpty,
   organization_id: UUID,
   facility_id: UUID,
-  filter: z12.string().optional(),
   identity_file: nonEmpty,
   private_key: z12.string().min(1).optional(),
   username: nonEmpty.default("root"),
   port: z12.number().int().min(1).max(65535).default(22),
   expires_in_seconds: tokenTtl,
-  installer_base: nonEmpty.optional(),
-  replace_existing_management: z12.literal(true),
-  verbose: z12.boolean().default(false)
+  replace_existing_management: z12.literal(true)
 });
-function safeRemoteResult(value) {
-  if (!value || typeof value !== "object")
-    return {};
-  const row = value;
-  const safe = {};
-  for (const key of ["id", "status", "state", "exit_code", "started_at", "completed_at"]) {
-    const field = row[key];
-    if (typeof field === "string" || typeof field === "number" || typeof field === "boolean") {
-      safe[key] = field;
-    }
-  }
-  return safe;
-}
 var adminNodeEnrollCapability = defineCapability({
   id: "nodes.enroll",
   domain: "fleet",
@@ -2862,7 +2783,7 @@ var adminNodeEnrollCapability = defineCapability({
   mutation: "preview-confirm",
   cli: {
     command: ["admin", "nodes", "enroll"],
-    vnext: adminHelp3(["admin", "nodes", "enroll"], "Install Ornn management on one explicitly assigned node.", "ornn admin nodes enroll <node-id> --host HOST --supplier UUID --facility UUID [--filter COMPARTMENT_IDS] --identity-file PATH --token-ttl SECONDS --replace-existing-management [--verbose] []", "Unsupported: remote enrollment requires an eligible human terminal.", ["canonical node UUID", "canonical supplier organization UUID", "canonical facility UUID"], "Review node identity, SSH target, assignment, compartment filter, and replacement of existing management.")
+    vnext: adminHelp3(["admin", "nodes", "enroll"], "Install Ornn management on one explicitly assigned node.", "ornn admin nodes enroll <node-id> --host HOST --supplier UUID --facility UUID --identity-file PATH --token-ttl SECONDS --replace-existing-management []", "Unsupported: remote enrollment requires an eligible human terminal.", ["canonical node UUID", "canonical supplier organization UUID", "canonical facility UUID"], "Review node identity, SSH target, assignment, and replacement of existing management.")
   },
   mcp: false,
   slack: false,
@@ -2875,7 +2796,6 @@ var adminNodeEnrollCapability = defineCapability({
         host: parsed.host,
         organization_id: parsed.organization_id,
         facility_id: parsed.facility_id,
-        filter: parsed.filter,
         expires_in_seconds: parsed.expires_in_seconds,
         replace_existing_management: true
       };
@@ -2883,43 +2803,22 @@ var adminNodeEnrollCapability = defineCapability({
     if (!parsed.private_key) {
       throw codedError("identity_file_unreadable", "The SSH identity file could not be read.");
     }
-    const minted = await createEnrollmentToken(ctx.fetch, {
-      organization_id: parsed.organization_id,
-      expires_in_seconds: parsed.expires_in_seconds
-    });
-    const token = typeof minted.token === "string" ? minted.token : typeof minted.plaintext === "string" ? minted.plaintext : "";
-    if (!token) {
-      throw codedError("token_material_unavailable", "The enrollment token was created without usable token material.");
+    const node = await getNode(ctx.fetch, parsed.node_id);
+    if (node.organization_id !== parsed.organization_id || node.facility_id !== parsed.facility_id) {
+      throw codedError("node_assignment_changed", "The existing node supplier or facility does not match the requested assignment.");
     }
-    const command = buildEnrollmentInstallCommand({
-      token,
-      base: parsed.installer_base ?? ctx.installerBaseUrl,
-      facilityId: parsed.facility_id,
-      filter: parsed.filter,
-      restoreNodeId: parsed.node_id,
-      force: true
+    const run = await createEnrollmentRun(ctx.fetch, {
+      organization_id: parsed.organization_id,
+      label: "Recover node agent",
+      restore_node_id: parsed.node_id,
+      expires_in_seconds: parsed.expires_in_seconds,
+      hosts: [{ address: parsed.host, port: parsed.port }]
     });
-    const remote = await runRemote(ctx.fetch, {
-      host: parsed.host,
+    await launchEnrollmentRun(ctx.fetch, run.id, {
       username: parsed.username,
-      port: parsed.port,
-      private_key: parsed.private_key,
-      command,
-      timeout_seconds: 600
+      private_key: parsed.private_key
     });
-    return {
-      node_id: parsed.node_id,
-      host: parsed.host,
-      organization_id: parsed.organization_id,
-      facility_id: parsed.facility_id,
-      filter: parsed.filter,
-      management: "replaced",
-      token_metadata: {
-        id: typeof minted.id === "string" ? minted.id : null,
-        expires_at: typeof minted.expires_at === "string" ? minted.expires_at : null
-      },
-      remote: safeRemoteResult(remote)
-    };
+    return run;
   }
 });
 var nodeKeyInput = z12.object({ node_id: UUID });
@@ -2949,7 +2848,7 @@ var adminNodeRotateKeyCapability = defineCapability({
   mutation: "preview-confirm",
   cli: {
     command: ["admin", "nodes", "rotate-key"],
-    vnext: adminHelp3(["admin", "nodes", "rotate-key"], "Rotate one node admin key and export the replacement deliberately.", "ornn admin nodes rotate-key <node-id> (--print | --output PATH) [--overwrite] []", "Unsupported: key rotation requires an eligible human terminal.", ["canonical node UUID"], "Review the node and loss of access through the previous private key.")
+    vnext: adminHelp3(["admin", "nodes", "rotate-key"], "Rotate one node admin key and export the replacement deliberately.", "ornn admin nodes rotate-key <node-id> (--print | --output PATH) [--overwrite]", "Unsupported: key rotation requires an eligible human terminal.", ["canonical node UUID"], "Review the node and loss of access through the previous private key.")
   },
   mcp: false,
   slack: false,
@@ -3218,19 +3117,19 @@ var adminNodeSanitizeCapabilities = [
 // ../../packages/capabilities/dist/capabilities/admin-nodes-lifecycle.js
 import { z as z15 } from "zod";
 var nodeReference = z15.string().trim().min(1);
-var optionalText2 = z15.string().trim().min(1).optional();
+var optionalText = z15.string().trim().min(1).optional();
 var commonInput = {
   node_ref: nodeReference,
-  node_id: optionalText2,
-  idempotency_key: optionalText2,
-  reason: optionalText2,
+  node_id: optionalText,
+  idempotency_key: optionalText,
+  reason: optionalText,
   yes: z15.boolean().optional(),
   wait: z15.boolean().optional(),
   timeout_seconds: z15.number().positive().optional()
 };
 var rebootInput = z15.object({
   ...commonInput,
-  machine_id: optionalText2
+  machine_id: optionalText
 });
 var hardResetInput = rebootInput.extend({
   erase_local_data: z15.literal(true)
@@ -4831,30 +4730,119 @@ function externalBucketCapability({ acceptedReferences = [], automation, command
   });
 }
 var gcsImportGuidance = "GCS requires bucket-level read access for your organization's Ornn transfer account. Connecting prints the account and the two gcloud grants (roles/storage.objectViewer and roles/storage.legacyBucketReader). After granting, deploy the volume from the Ornn console; CLI 1.x import still requires verification, which GCS does not support. Steps: https://docs.ornn.com/cli#gcs-imports-and-storage-transfer-service";
-var externalBucketCapabilities = [
-  externalBucketCapability({
-    id: "storage.external-buckets.list",
+function isExternalBucket(drive) {
+  const source = drive.source;
+  if (!source || source.managed === true || source.provider === "ornn_object")
+    return false;
+  return ["external_gcs", "s3", "r2", "cloudflare_r2"].includes(source.provider ?? "") || Boolean(source.bucket);
+}
+var bucketInput = z21.object({ driveId: z21.string() });
+var bucketListCapability = defineCapability({
+  id: "storage.external-buckets.list",
+  domain: "storage",
+  roles: ["user"],
+  description: "List a page of connected external buckets. Pass next_cursor as cursor to continue.",
+  mutation: "read",
+  input: z21.object({
+    limit: z21.number().int().min(1).max(100).optional(),
+    cursor: z21.string().optional()
+  }),
+  mcp: { name: "storage_buckets_list" },
+  slack: false,
+  execute: async (context, input) => {
+    const page = await listDrives(context.fetch, {
+      limit: input.limit ?? 25,
+      scope: "external",
+      ...input.cursor ? { cursor: input.cursor } : {}
+    });
+    return { ...page, drives: page.drives.filter(isExternalBucket) };
+  },
+  cli: {
     command: ["external-buckets", "list"],
-    description: "List connected GCS, S3, and R2 buckets in one bounded page.",
-    mutation: "read",
     input: pageInput2,
-    outcome: "List external bucket connections without exposing stored credentials.",
-    human: "ornn external-buckets list [--limit <1-100>] [--cursor <cursor>]",
-    automation: "ornn external-buckets list --limit 50 --format json",
-    related: ["external-buckets show", "external-buckets connect"]
-  }),
-  externalBucketCapability({
-    id: "storage.external-buckets.show",
+    execute: (context, input) => externalBucketExecutor(context)("storage.external-buckets.list", input),
+    vnext: {
+      arguments: "semantic",
+      audience: "customer",
+      category: "resource",
+      outcome: "List external bucket connections without exposing stored credentials.",
+      human: "ornn external-buckets list [--limit <1-100>] [--cursor <cursor>]",
+      automation: "ornn external-buckets list --limit 50 --format json",
+      acceptedReferences: [],
+      related: ["external-buckets show", "external-buckets connect"],
+      resumableStates: []
+    }
+  }
+});
+var bucketShowCapability = defineCapability({
+  id: "storage.external-buckets.show",
+  domain: "storage",
+  roles: ["user"],
+  description: "Show a single connected external bucket by drive id.",
+  mutation: "read",
+  input: bucketInput,
+  mcp: { name: "storage_buckets_show" },
+  slack: false,
+  execute: async (context, input) => {
+    const bucket = await getDrive(context.fetch, input.driveId);
+    if (!isExternalBucket(bucket))
+      throw new Error(`Storage bucket not found: ${input.driveId}`);
+    return bucket;
+  },
+  cli: {
     command: ["external-buckets", "show"],
-    description: "Inspect one connected external bucket by canonical ID or exact unique name.",
-    mutation: "read",
     input: showInput,
-    outcome: "Inspect one credential-safe external bucket connection.",
-    human: "ornn external-buckets show <external-bucket>",
-    automation: "ornn external-buckets show <external-bucket-id> --format json",
-    acceptedReferences: ["canonical external bucket ID", "exact unique external bucket name"],
-    related: ["external-buckets verify", "external-buckets import"]
-  }),
+    execute: (context, input) => externalBucketExecutor(context)("storage.external-buckets.show", input),
+    vnext: {
+      arguments: "semantic",
+      audience: "customer",
+      category: "resource",
+      outcome: "Inspect one credential-safe external bucket connection.",
+      human: "ornn external-buckets show <external-bucket>",
+      automation: "ornn external-buckets show <external-bucket-id> --format json",
+      acceptedReferences: ["canonical external bucket ID", "exact unique external bucket name"],
+      related: ["external-buckets verify", "external-buckets import"],
+      resumableStates: []
+    }
+  }
+});
+var bucketDisconnectCapability = defineCapability({
+  id: "storage.external-buckets.disconnect",
+  domain: "storage",
+  roles: ["user"],
+  description: "Disconnect a connected external bucket (deletes the backing drive record).",
+  mutation: "preview-confirm",
+  input: bucketInput,
+  mcp: { name: "storage_buckets_disconnect" },
+  slack: false,
+  execute: async (context, input) => {
+    if (!context.confirmed)
+      return preview("storage.external-buckets.disconnect", input);
+    await bucketShowCapability.execute(context, input);
+    await deleteDrive(context.fetch, input.driveId);
+    return { disconnected: true, drive_id: input.driveId };
+  },
+  cli: {
+    command: ["external-buckets", "disconnect"],
+    input: disconnectInput,
+    execute: (context, input) => externalBucketExecutor(context)("storage.external-buckets.disconnect", input),
+    vnext: {
+      arguments: "semantic",
+      audience: "customer",
+      category: "resource",
+      outcome: "Remove one external source connection without writing to its source bucket.",
+      human: "ornn external-buckets disconnect <external-bucket>",
+      automation: "ornn external-buckets disconnect <external-bucket-id>  --idempotency-key <key> --format json",
+      acceptedReferences: ["canonical external bucket ID", "exact unique external bucket name"],
+      review: "Disconnecting reduces access to the source and is blocked while mounts remain.",
+      related: ["storage detach", "external-buckets show"],
+      resumableStates: []
+    }
+  }
+});
+var externalBucketCapabilities = [
+  bucketListCapability,
+  bucketShowCapability,
   externalBucketCapability({
     id: "storage.external-buckets.connect",
     command: ["external-buckets", "connect"],
@@ -4907,19 +4895,7 @@ var externalBucketCapabilities = [
     resumableStates: ["pending", "working", "partial", "failed", "interrupted"],
     related: ["external-buckets show", "storage status", "volumes files list"]
   }),
-  externalBucketCapability({
-    id: "storage.external-buckets.disconnect",
-    command: ["external-buckets", "disconnect"],
-    description: "Disconnect an external bucket record after its working volume is detached.",
-    mutation: "preview-confirm",
-    input: disconnectInput,
-    outcome: "Remove one external source connection without writing to its source bucket.",
-    human: "ornn external-buckets disconnect <external-bucket>",
-    automation: "ornn external-buckets disconnect <external-bucket-id>  --idempotency-key <key> --format json",
-    acceptedReferences: ["canonical external bucket ID", "exact unique external bucket name"],
-    review: "Disconnecting reduces access to the source and is blocked while mounts remain.",
-    related: ["storage detach", "external-buckets show"]
-  })
+  bucketDisconnectCapability
 ];
 
 // ../../packages/capabilities/dist/capabilities/evidence.js
@@ -6545,6 +6521,50 @@ function storageCapability({ id, command, description, mutation, outcome, human,
     execute: async (context, input) => storageExecutor(context)(id, input)
   });
 }
+var filesListInput = z30.object({ driveId: z30.string(), prefix: z30.string().optional() });
+async function* listFiles(context, input) {
+  const prefix = input.prefix ?? "";
+  const folder = prefix.includes("/") ? prefix.slice(0, prefix.lastIndexOf("/")) : "";
+  let cursor = 0;
+  while (cursor !== null) {
+    const page = await listDriveContents(context.fetch, input.driveId, {
+      recursive: true,
+      ...folder ? { path: folder } : {},
+      ...cursor ? { cursor } : {}
+    });
+    for (const entry of page.entries) {
+      if (entry.kind === "file" && entry.path.startsWith(prefix))
+        yield entry;
+    }
+    cursor = page.next_cursor ?? null;
+  }
+}
+var volumeFilesListCapability = defineCapability({
+  id: "storage.volumes.files.list",
+  domain: "storage",
+  roles: ["user"],
+  description: "List files on a storage volume (drive). Optional prefix filters paths. This is a listing only -- it does not download bytes.",
+  mutation: "read",
+  input: filesListInput,
+  mcp: { name: "storage_files_ls" },
+  slack: false,
+  execute: async (context, input) => listFiles(context, input),
+  cli: {
+    command: ["volumes", "files", "list"],
+    input: storageCliInput,
+    execute: (context, input) => storageExecutor(context)("storage.volumes.files.list", input),
+    vnext: {
+      arguments: "semantic",
+      audience: "customer",
+      category: "resource",
+      outcome: "List nested volume files by semantic remote path.",
+      human: "ornn volumes files list <volume> [--prefix <remote-path>] [--limit <1-500>] [--cursor <cursor>]",
+      automation: "ornn volumes files list <volume-id> --limit 50 --format json",
+      acceptedReferences: ["canonical volume ID", "exact unique volume name"],
+      related: ["volumes files upload", "volumes files download"]
+    }
+  }
+});
 var volumeCapabilities = [
   storageCapability({
     id: "storage.volumes.list",
@@ -6613,17 +6633,7 @@ var volumeCapabilities = [
     review: "The volume and all of its data are permanently deleted.",
     related: ["volume-mounts detach", "volumes show"]
   }),
-  storageCapability({
-    id: "storage.volumes.files.list",
-    command: ["volumes", "files", "list"],
-    description: "List nested files in one volume in a bounded page.",
-    mutation: "read",
-    outcome: "List nested volume files by semantic remote path.",
-    human: "ornn volumes files list <volume> [--prefix <remote-path>] [--limit <1-500>] [--cursor <cursor>]",
-    automation: "ornn volumes files list <volume-id> --limit 50 --format json",
-    acceptedReferences: ["canonical volume ID", "exact unique volume name"],
-    related: ["volumes files upload", "volumes files download"]
-  }),
+  volumeFilesListCapability,
   storageCapability({
     id: "storage.volumes.files.upload",
     command: ["volumes", "files", "upload"],
@@ -6879,46 +6889,6 @@ var storageVerbCapabilities = [
     })
   })
 ];
-var bucketListCapability = defineCapability({
-  id: "bucket.list",
-  domain: "storage",
-  roles: ["user"],
-  description: "List a page of connected external buckets. Pass next_cursor as cursor to continue.",
-  mutation: "read",
-  input: z30.object({
-    limit: z30.number().int().min(1).max(100).optional(),
-    cursor: z30.string().optional()
-  }),
-  mcp: { name: "storage_buckets_list" },
-  slack: false,
-  execute: (ctx, input) => listDrives(ctx.fetch, {
-    limit: input.limit ?? 25,
-    scope: "external",
-    ...input.cursor ? { cursor: input.cursor } : {}
-  })
-});
-var storageCompositionCapabilities = [
-  bucketListCapability,
-  defineCapability({
-    id: "volume.contents",
-    domain: "storage",
-    roles: ["user"],
-    description: "List one page of a storage volume's contents.",
-    mutation: "read",
-    input: z30.object({
-      driveId: z30.string(),
-      path: z30.string().optional(),
-      cursor: z30.union([z30.string(), z30.number()]).optional()
-    }),
-    mcp: false,
-    slack: false,
-    execute: (ctx, input) => listDriveContents(ctx.fetch, input.driveId, {
-      recursive: true,
-      ...input.path ? { path: input.path } : {},
-      ...input.cursor ? { cursor: input.cursor } : {}
-    })
-  })
-];
 
 // ../../packages/capabilities/dist/cli-catalog.js
 function canonicalCliCatalog(capabilities) {
@@ -6931,6 +6901,7 @@ function canonicalCliCatalog(capabilities) {
     return {
       ...capability,
       cli: {
+        ...capability.cli,
         command: [...help3.command ?? capability.cli?.command ?? []],
         vnext: help3
       }
@@ -6960,7 +6931,6 @@ var catalog = [
       ...networkVerbCapabilities,
       ...accessVerbCapabilities,
       ...storageVerbCapabilities,
-      ...storageCompositionCapabilities,
       machinePushKeysCapability,
       ...machineMetricsCapabilities,
       ...billingCapabilities,
@@ -7238,11 +7208,15 @@ export {
   ADMIN_CLI_ROOTS,
   CLI_MIGRATION_GUIDE_URL,
   LEGACY_CLI_MIGRATIONS,
+  bucketDisconnectCapability,
+  bucketListCapability,
+  bucketShowCapability,
   byCliCommand,
   byMcpName,
   catalog,
   findLegacyCliMigration,
   forRole,
   gpuDisplay,
-  parseHardwareCatalog
+  parseHardwareCatalog,
+  volumeFilesListCapability
 };