@ornncompute/cli 1.0.140 → 1.0.142

package/vendor/capabilities/cli.js

@@ -337,7 +337,7 @@ function defineCapability(spec) {
         command: cli.command ?? names.cli
       }
     } : {},
-    ...mcp === false ? {} : { mcp: { name: mcp?.name ?? names.mcp } },
+    ...mcp === false ? {} : { mcp: { ...mcp, name: mcp?.name ?? names.mcp } },
     ...slack === false ? {} : {
       slack: {
         name: slack?.name ?? names.slack,
@@ -363,7 +363,7 @@ function forRole(catalog2, role, client) {
   return catalog2.filter((capability) => visibleToClient(capability, client, role));
 }
 function byMcpName(catalog2, name) {
-  return catalog2.find((capability) => capability.mcp?.name === name);
+  return catalog2.find((capability) => capability.mcp?.name === name || capability.mcp?.aliases?.includes(name));
 }
 function byCliCommand(catalog2, command) {
   return catalog2.find((capability) => capability.cli != null && capability.cli.command.length === command.length && capability.cli.command.every((part, index) => part === command[index]));
@@ -3379,83 +3379,152 @@ function getCliStatus(request) {
 }
 
 // ../../packages/capabilities/dist/capabilities/compute.js
+import { z as z18 } from "zod";
+
+// ../../packages/capabilities/dist/capabilities/ssh-keys.js
 import { z as z17 } from "zod";
-var positionals2 = z17.array(z17.string()).default([]);
-var launchInput = z17.object({
+async function activeReservationNodes(context, reservationId) {
+  const { nodes: nodes2 } = await listNodes(context.fetch, { reservation_id: reservationId });
+  return nodes2.filter((node) => node.status !== "terminated");
+}
+async function reservationKeyStatus(context, reservationId) {
+  const [{ ssh_keys }, nodes2] = await Promise.all([
+    listReservationSshKeys(context.fetch, reservationId),
+    activeReservationNodes(context, reservationId)
+  ]);
+  return {
+    keys: ssh_keys.filter((key) => key.status === "active" && !key.revoked_at),
+    nodes: nodes2
+  };
+}
+function sshKeyDeliveryStatus(key, node) {
+  const metadata = node.authorized_key_metadata?.find((item) => item.fingerprint === key.fingerprint);
+  const installed = !metadata && node.authorized_key_fingerprints.includes(key.fingerprint) && node.keys_pushed_at;
+  return {
+    status: metadata?.status ?? (installed ? "installed" : "associated"),
+    linux_username: metadata?.linux_username ?? null,
+    pushed_at: metadata?.pushed_at ?? (installed ? node.keys_pushed_at : null),
+    failed_at: metadata?.failed_at ?? null,
+    failure_reason: metadata?.failure_reason ?? null,
+    request_id: metadata?.request_id ?? null
+  };
+}
+var reservationKeysPushCapability = defineCapability({
+  id: "access.push_keys",
+  domain: "access",
+  roles: ["user"],
+  description: "Push SSH key(s) onto all active machines for a reservation.",
+  mutation: "immediate",
+  input: z17.object({
+    reservationId: z17.string(),
+    sshKeyIds: z17.array(z17.string()).min(1),
+    requestId: z17.string().optional()
+  }),
+  mcp: { aliases: ["access_keys_push"] },
+  slack: false,
+  execute: async (context, input) => {
+    const nodes2 = await activeReservationNodes(context, input.reservationId);
+    if (!nodes2.length)
+      throw new Error("No active bare-metal machines were found for this reservation.");
+    const pushed = [];
+    for (const node of nodes2) {
+      pushed.push(await pushNodeKeys(context.fetch, node.node_id, {
+        request_id: input.requestId || `mcp-push-keys:${node.node_id}:${Date.now()}`,
+        ssh_key_ids: input.sshKeyIds
+      }));
+    }
+    return pushed;
+  }
+});
+
+// ../../packages/capabilities/dist/capabilities/compute.js
+var positionals2 = z18.array(z18.string()).default([]);
+var launchInput = z18.object({
   $positionals: positionals2,
-  guided: z17.boolean().optional(),
-  idempotencyKey: z17.string().optional(),
-  key: z17.string().optional(),
-  keyId: z17.string().optional(),
-  label: z17.string().optional(),
-  machine: z17.string().optional(),
-  machines: z17.string().optional(),
-  mode: z17.string().optional(),
-  mountAccess: z17.string().optional(),
-  network: z17.string().optional(),
-  noWait: z17.boolean().optional(),
-  nodes: z17.union([z17.string(), z17.number()]).optional(),
-  publicKey: z17.string().optional(),
-  publicKeyFile: z17.string().optional(),
-  reservation: z17.string().optional(),
-  resume: z17.union([z17.string().min(1), z17.literal(true)]).optional(),
-  timeout: z17.string().optional(),
-  username: z17.string().optional(),
-  vms: z17.string().optional(),
-  wait: z17.boolean().optional(),
-  yes: z17.boolean().optional(),
-  volume: z17.string().optional()
+  guided: z18.boolean().optional(),
+  idempotencyKey: z18.string().optional(),
+  key: z18.string().optional(),
+  keyId: z18.string().optional(),
+  label: z18.string().optional(),
+  machine: z18.string().optional(),
+  machines: z18.string().optional(),
+  mode: z18.string().optional(),
+  mountAccess: z18.string().optional(),
+  network: z18.string().optional(),
+  noWait: z18.boolean().optional(),
+  nodes: z18.union([z18.string(), z18.number()]).optional(),
+  publicKey: z18.string().optional(),
+  publicKeyFile: z18.string().optional(),
+  reservation: z18.string().optional(),
+  resume: z18.union([z18.string().min(1), z18.literal(true)]).optional(),
+  timeout: z18.string().optional(),
+  username: z18.string().optional(),
+  vms: z18.string().optional(),
+  wait: z18.boolean().optional(),
+  yes: z18.boolean().optional(),
+  volume: z18.string().optional()
 }).strict();
-var keyListInput = z17.object({
+var pageInput = z18.object({
+  limit: z18.number().int().min(1).max(500).optional(),
+  cursor: z18.string().optional()
+});
+var publicKeyInput = z18.object({
+  publicKey: z18.string(),
+  label: z18.string().optional(),
+  confirm: z18.boolean().optional()
+});
+var keyIdInput = z18.object({ keyId: z18.string(), confirm: z18.boolean().optional() });
+var ADDED_KEY_OUTCOME = "The response's outcome field says whether the key was created, was already_registered (returned unchanged, so the submitted label is not applied), or was reactivated from a revoked key.";
+var keyListInput = z18.object({
   $positionals: positionals2,
-  cursor: z17.string().optional(),
-  limit: z17.coerce.number().int().min(1).max(500).optional()
+  cursor: z18.string().optional(),
+  limit: z18.coerce.number().int().min(1).max(500).optional()
 }).strict();
-var keyMutationInput = z17.object({
+var keyMutationInput = z18.object({
   $positionals: positionals2,
-  idempotencyKey: z17.string().optional(),
-  key: z17.string().optional(),
-  keyId: z17.string().optional(),
-  label: z17.string().optional(),
-  publicKey: z17.string().optional(),
-  publicKeyFile: z17.string().optional(),
-  yes: z17.boolean().optional()
+  idempotencyKey: z18.string().optional(),
+  key: z18.string().optional(),
+  keyId: z18.string().optional(),
+  label: z18.string().optional(),
+  publicKey: z18.string().optional(),
+  publicKeyFile: z18.string().optional(),
+  yes: z18.boolean().optional()
 }).strict();
-var machineListInput = z17.object({
+var machineListInput = z18.object({
   $positionals: positionals2,
-  cursor: z17.string().optional(),
-  limit: z17.coerce.number().int().min(1).max(500).optional()
+  cursor: z18.string().optional(),
+  limit: z18.coerce.number().int().min(1).max(500).optional()
 }).strict();
-var machineShowInput = z17.object({
+var machineShowInput = z18.object({
   $positionals: positionals2,
-  guided: z17.boolean().optional()
+  guided: z18.boolean().optional()
 }).strict();
-var machineWaitInput = z17.object({
+var machineWaitInput = z18.object({
   $positionals: positionals2,
-  guided: z17.boolean().optional(),
-  timeout: z17.string().optional()
+  guided: z18.boolean().optional(),
+  timeout: z18.string().optional()
 }).strict();
-var machineSwitchInput = z17.object({
+var machineSwitchInput = z18.object({
   $positionals: positionals2,
-  guided: z17.boolean().optional(),
-  eraseLocalData: z17.boolean().optional(),
-  idempotencyKey: z17.string().optional(),
-  mode: z17.string().optional(),
-  network: z17.string().optional(),
-  noWait: z17.boolean().optional(),
-  timeout: z17.string().optional(),
-  wait: z17.boolean().optional(),
-  yes: z17.boolean().optional()
+  guided: z18.boolean().optional(),
+  eraseLocalData: z18.boolean().optional(),
+  idempotencyKey: z18.string().optional(),
+  mode: z18.string().optional(),
+  network: z18.string().optional(),
+  noWait: z18.boolean().optional(),
+  timeout: z18.string().optional(),
+  wait: z18.boolean().optional(),
+  yes: z18.boolean().optional()
 }).strict();
-var machineMaintenanceInput = z17.object({
+var machineMaintenanceInput = z18.object({
   $positionals: positionals2,
-  eraseLocalData: z17.boolean().optional(),
-  guided: z17.boolean().optional(),
-  idempotencyKey: z17.string().optional(),
-  noWait: z17.boolean().optional(),
-  timeout: z17.string().optional(),
-  wait: z17.boolean().optional(),
-  yes: z17.boolean().optional()
+  eraseLocalData: z18.boolean().optional(),
+  guided: z18.boolean().optional(),
+  idempotencyKey: z18.string().optional(),
+  noWait: z18.boolean().optional(),
+  timeout: z18.string().optional(),
+  wait: z18.boolean().optional(),
+  yes: z18.boolean().optional()
 }).strict();
 function runtime(context) {
   const interaction = context.cli?.interaction;
@@ -3692,15 +3761,19 @@ var machineResetCapability = cliOnly({
   },
   execute: executeMachines("reset")
 });
-var sshKeyListCapability = cliOnly({
+var sshKeyListCapability = defineCapability({
   id: "access.ssh_keys.list",
   domain: "access",
   roles: ["user"],
   mutation: "read",
-  input: keyListInput,
-  description: "List organization SSH keys in a bounded page.",
+  input: pageInput.extend({ status: z18.enum(["active", "all"]).optional() }),
+  description: "List a page of account SSH keys. Pass next_cursor as cursor to continue.",
+  mcp: { name: "ssh_keys_list", input: pageInput },
+  slack: false,
   cli: {
     command: ["ssh-keys", "list"],
+    input: keyListInput,
+    execute: executeSshKeys("list"),
     vnext: {
       arguments: "semantic",
       audience: "customer",
@@ -3713,17 +3786,28 @@ var sshKeyListCapability = cliOnly({
       related: ["ssh-keys add", "ssh-keys assignments list"]
     }
   },
-  execute: executeSshKeys("list")
+  execute: (context, input) => listAccountSshKeys(context.fetch, {
+    status: input.status ?? "all",
+    limit: input.limit ?? 25,
+    ...input.cursor ? { cursor: input.cursor } : {}
+  })
 });
-var sshKeyAddCapability = cliOnly({
+var sshKeyAddCapability = defineCapability({
   id: "access.ssh_keys.add",
   domain: "access",
   roles: ["user"],
   mutation: "preview-confirm",
-  input: keyMutationInput,
-  description: "Add or replay one organization SSH public key.",
+  input: publicKeyInput.extend({
+    label: z18.string().nullable().optional(),
+    idempotencyKey: z18.string().optional()
+  }),
+  description: `Add an SSH public key to the account. ${ADDED_KEY_OUTCOME}`,
+  mcp: { name: "ssh_keys_add", input: publicKeyInput },
+  slack: false,
   cli: {
     command: ["ssh-keys", "add"],
+    input: keyMutationInput,
+    execute: executeSshKeys("add"),
     vnext: {
       arguments: "semantic",
       audience: "customer",
@@ -3737,17 +3821,21 @@ var sshKeyAddCapability = cliOnly({
       related: ["ssh-keys list", "ssh-keys assignments assign"]
     }
   },
-  execute: executeSshKeys("add")
+  execute: (context, input) => createAccountSshKey(context.fetch, { public_key: input.publicKey, label: input.label }, input.idempotencyKey ? { headers: { "Idempotency-Key": input.idempotencyKey } } : void 0)
 });
-var sshKeyDeleteCapability = cliOnly({
+var sshKeyDeleteCapability = defineCapability({
   id: "access.ssh_keys.delete",
   domain: "access",
   roles: ["user"],
   mutation: "preview-confirm",
-  input: keyMutationInput,
-  description: "Delete one exact organization SSH key after review.",
+  input: keyIdInput.extend({ idempotencyKey: z18.string().optional() }),
+  description: "Delete an SSH key from the account.",
+  mcp: { name: "ssh_keys_delete", input: keyIdInput },
+  slack: false,
   cli: {
     command: ["ssh-keys", "delete"],
+    input: keyMutationInput,
+    execute: executeSshKeys("delete"),
     vnext: {
       arguments: "semantic",
       audience: "customer",
@@ -3765,7 +3853,7 @@ var sshKeyDeleteCapability = cliOnly({
       related: ["ssh-keys list"]
     }
   },
-  execute: executeSshKeys("delete")
+  execute: async (context, input) => await deleteAccountSshKey(context.fetch, input.keyId, input.idempotencyKey ? { headers: { "Idempotency-Key": input.idempotencyKey } } : void 0) ?? { deleted: true }
 });
 var sshKeyAssignmentListCapability = cliOnly({
   id: "access.ssh_key_assignments.list",
@@ -3844,15 +3932,19 @@ var sshKeyAssignmentSyncCapability = cliOnly({
   },
   execute: executeSshKeys("assignments.sync")
 });
-var sshKeyAssignmentStatusCapability = cliOnly({
+var sshKeyAssignmentStatusCapability = defineCapability({
   id: "access.ssh_key_assignments.status",
   domain: "access",
   roles: ["user"],
   mutation: "read",
-  input: keyListInput,
-  description: "Show assigned, queued, installed, and failed SSH-key delivery per machine.",
+  input: z18.object({ reservationId: z18.string() }),
+  description: "Show SSH key push status per machine for a reservation.",
+  mcp: { name: "access_keys_status" },
+  slack: false,
   cli: {
     command: ["ssh-keys", "assignments", "status"],
+    input: keyListInput,
+    execute: executeSshKeys("assignments.status"),
     vnext: {
       arguments: "semantic",
       audience: "customer",
@@ -3866,7 +3958,7 @@ var sshKeyAssignmentStatusCapability = cliOnly({
       related: ["ssh-keys assignments sync", "connect"]
     }
   },
-  execute: executeSshKeys("assignments.status")
+  execute: (context, input) => reservationKeyStatus(context, input.reservationId)
 });
 var computeCapabilities = [
   launchCapability,
@@ -3884,18 +3976,7 @@ var computeCapabilities = [
   sshKeyAssignmentSyncCapability,
   sshKeyAssignmentStatusCapability
 ];
-var pageInput = z17.object({
-  limit: z17.number().int().min(1).max(500).optional(),
-  cursor: z17.string().optional()
-});
-var publicKeyInput = z17.object({
-  publicKey: z17.string(),
-  label: z17.string().optional(),
-  confirm: z17.boolean().optional()
-});
-var keyIdInput = z17.object({ keyId: z17.string(), confirm: z17.boolean().optional() });
-var nodeIdInput = z17.object({ nodeId: z17.string(), confirm: z17.boolean().optional() });
-var ADDED_KEY_OUTCOME = "The response's outcome field says whether the key was created, was already_registered (returned unchanged, so the submitted label is not applied), or was reactivated from a revoked key.";
+var nodeIdInput = z18.object({ nodeId: z18.string(), confirm: z18.boolean().optional() });
 function rebootMachine(mode) {
   return (ctx, input) => rebootNode(ctx.fetch, input.nodeId, { mode });
 }
@@ -3906,7 +3987,7 @@ var accessVerbCapabilities = [
     roles: ["user"],
     description: "Show VM and Bare Metal SSH access machines for a reservation.",
     mutation: "read",
-    input: z17.object({ reservationId: z17.string() }),
+    input: z18.object({ reservationId: z18.string() }),
     slack: false,
     execute: (ctx, input) => listNodes(ctx.fetch, { reservation_id: input.reservationId })
   }),
@@ -3916,18 +3997,18 @@ var accessVerbCapabilities = [
     roles: ["user"],
     description: "Activate access (bare-metal by default, or VM via accessMode) for a reservation and launch machine(s) with the given SSH key(s), optionally on the private network via networkMode. A VM launches on the reservation's saved disk; pass diskId to choose one, which a reservation without a saved disk needs.",
     mutation: "preview-confirm",
-    input: z17.object({
-      reservationId: z17.string(),
-      sshKeyIds: z17.array(z17.string()).min(1),
-      username: z17.string().optional(),
-      machineCount: z17.number().int().positive().optional(),
-      requestId: z17.string().optional(),
-      accessMode: z17.enum(["bare-metal", "vm"]).optional(),
-      networkMode: z17.enum(["public", "private"]).optional(),
-      diskId: z17.string().optional(),
-      storageLoadDriveId: z17.string().optional(),
-      storageSaveDriveId: z17.string().optional(),
-      confirm: z17.boolean().optional()
+    input: z18.object({
+      reservationId: z18.string(),
+      sshKeyIds: z18.array(z18.string()).min(1),
+      username: z18.string().optional(),
+      machineCount: z18.number().int().positive().optional(),
+      requestId: z18.string().optional(),
+      accessMode: z18.enum(["bare-metal", "vm"]).optional(),
+      networkMode: z18.enum(["public", "private"]).optional(),
+      diskId: z18.string().optional(),
+      storageLoadDriveId: z18.string().optional(),
+      storageSaveDriveId: z18.string().optional(),
+      confirm: z18.boolean().optional()
     }),
     slack: false,
     // Without disk_id the orchestrator boots "virtual-machine" from the
@@ -3949,14 +4030,14 @@ var accessVerbCapabilities = [
     roles: ["user"],
     description: "Switch a live reservation between public/private network mode (and optionally VM/Bare Metal) via switch-access. Use this instead of re-launching when machines are already running. Supply a unique requestId and keep it to check progress, including after a timeout. Acceptance does not confirm completion.",
     mutation: "preview-confirm",
-    input: z17.object({
-      reservationId: z17.string(),
-      networkMode: z17.enum(["public", "private"]),
-      sshKeyIds: z17.array(z17.string()).min(1),
-      accessMode: z17.enum(["bare-metal", "virtual-machine"]).optional(),
-      username: z17.string().optional(),
-      requestId: z17.string().regex(/\S/),
-      confirm: z17.boolean().optional()
+    input: z18.object({
+      reservationId: z18.string(),
+      networkMode: z18.enum(["public", "private"]),
+      sshKeyIds: z18.array(z18.string()).min(1),
+      accessMode: z18.enum(["bare-metal", "virtual-machine"]).optional(),
+      username: z18.string().optional(),
+      requestId: z18.string().regex(/\S/),
+      confirm: z18.boolean().optional()
     }),
     slack: false,
     execute: (ctx, input) => switchReservationAccess(ctx.fetch, input.reservationId, {
@@ -3972,7 +4053,7 @@ var accessVerbCapabilities = [
     roles: ["user"],
     description: "List SSH keys registered for a reservation.",
     mutation: "read",
-    input: z17.object({ reservationId: z17.string() }),
+    input: z18.object({ reservationId: z18.string() }),
     slack: false,
     execute: (ctx, input) => listReservationSshKeys(ctx.fetch, input.reservationId)
   }),
@@ -3982,7 +4063,7 @@ var accessVerbCapabilities = [
     roles: ["user"],
     description: `Add an SSH key to a reservation. ${ADDED_KEY_OUTCOME}`,
     mutation: "preview-confirm",
-    input: publicKeyInput.extend({ reservationId: z17.string() }),
+    input: publicKeyInput.extend({ reservationId: z18.string() }),
     slack: false,
     execute: (ctx, input) => addReservationSshKey(ctx.fetch, input.reservationId, {
       label: input.label ?? null,
@@ -4011,43 +4092,6 @@ var accessVerbCapabilities = [
     slack: false,
     execute: rebootMachine("hard_reset")
   }),
-  defineCapability({
-    id: "ssh_keys.list",
-    domain: "access",
-    roles: ["user"],
-    description: "List a page of account SSH keys. Pass next_cursor as cursor to continue.",
-    mutation: "read",
-    input: pageInput,
-    slack: false,
-    execute: (ctx, input) => listAccountSshKeys(ctx.fetch, {
-      status: "all",
-      limit: input.limit ?? 25,
-      ...input.cursor ? { cursor: input.cursor } : {}
-    })
-  }),
-  defineCapability({
-    id: "ssh_keys.add",
-    domain: "access",
-    roles: ["user"],
-    description: `Add an SSH public key to the account. ${ADDED_KEY_OUTCOME}`,
-    mutation: "preview-confirm",
-    input: publicKeyInput,
-    slack: false,
-    execute: (ctx, input) => createAccountSshKey(ctx.fetch, {
-      public_key: input.publicKey,
-      label: input.label
-    })
-  }),
-  defineCapability({
-    id: "ssh_keys.delete",
-    domain: "access",
-    roles: ["user"],
-    description: "Delete an SSH key from the account.",
-    mutation: "preview-confirm",
-    input: keyIdInput,
-    slack: false,
-    execute: async (ctx, input) => await deleteAccountSshKey(ctx.fetch, input.keyId) ?? { deleted: true }
-  }),
   defineCapability({
     id: "cluster_users.list",
     domain: "access",
@@ -4086,35 +4130,16 @@ var accessVerbCapabilities = [
     execute: async (ctx, input) => await deleteClusterUserKey(ctx.fetch, input.keyId) ?? { deleted: true }
   })
 ];
-var machinePushKeysCapability = defineCapability({
-  id: "machine.push_keys",
-  domain: "access",
-  roles: ["user"],
-  description: "Push SSH keys onto one reservation machine.",
-  mutation: "preview-confirm",
-  input: z17.object({
-    nodeId: z17.string(),
-    sshKeyIds: z17.array(z17.string()).min(1),
-    requestId: z17.string(),
-    confirm: z17.boolean().optional()
-  }),
-  mcp: false,
-  slack: false,
-  execute: (ctx, input) => pushNodeKeys(ctx.fetch, input.nodeId, {
-    request_id: input.requestId,
-    ssh_key_ids: input.sshKeyIds
-  })
-});
 
 // ../../packages/capabilities/dist/capabilities/credits.js
-import { z as z18 } from "zod";
-var creditGrantInput = z18.object({
-  organizationId: z18.uuid().describe("Customer organization UUID. Resolve names or emails with organization_list; ask which organization if matches are ambiguous."),
-  adjustmentId: z18.uuid().describe("The credit-adjustment API's required grant UUID. Keep the same UUID when confirming this grant."),
-  amountCents: z18.number().int().min(1).max(1e8).describe("USD cents: 10000 grants $100.00."),
-  direction: z18.enum(["credit", "debit"]).optional().describe("credit adds funds (default); debit removes funds. Choose explicitly for a debit."),
-  note: z18.string().trim().min(1).refine((value) => new TextEncoder().encode(value).length <= 500, "Keep the note under 500 UTF-8 bytes.").describe("Reason for the credit grant."),
-  confirm: z18.boolean().optional()
+import { z as z19 } from "zod";
+var creditGrantInput = z19.object({
+  organizationId: z19.uuid().describe("Customer organization UUID. Resolve names or emails with organization_list; ask which organization if matches are ambiguous."),
+  adjustmentId: z19.uuid().describe("The credit-adjustment API's required grant UUID. Keep the same UUID when confirming this grant."),
+  amountCents: z19.number().int().min(1).max(1e8).describe("USD cents: 10000 grants $100.00."),
+  direction: z19.enum(["credit", "debit"]).optional().describe("credit adds funds (default); debit removes funds. Choose explicitly for a debit."),
+  note: z19.string().trim().min(1).refine((value) => new TextEncoder().encode(value).length <= 500, "Keep the note under 500 UTF-8 bytes.").describe("Reason for the credit grant."),
+  confirm: z19.boolean().optional()
 });
 var creditGrantCapability = defineCapability({
   id: "credits.grant",
@@ -4175,20 +4200,20 @@ var creditGrantCapability = defineCapability({
 });
 
 // ../../packages/capabilities/dist/capabilities/cli.js
-import { z as z19 } from "zod";
-var emptyInput2 = z19.object({});
+import { z as z20 } from "zod";
+var emptyInput2 = z20.object({});
 function requireCliRuntime(context) {
   if (!context.cli) {
     throw new Error("This capability must execute through the Ornn CLI runtime.");
   }
   return context.cli;
 }
-var updateInput = z19.object({
-  $positionals: z19.array(z19.string()).max(0).default([]),
-  major: z19.boolean().optional()
+var updateInput = z20.object({
+  $positionals: z20.array(z20.string()).max(0).default([]),
+  major: z20.boolean().optional()
 });
-var completionInput = z19.object({
-  $positionals: z19.tuple([z19.enum(["bash", "fish", "zsh"])])
+var completionInput = z20.object({
+  $positionals: z20.tuple([z20.enum(["bash", "fish", "zsh"])])
 }).transform(({ $positionals }) => ({ shell: $positionals[0] }));
 var versionCapability = defineCapability({
   id: "cli.version",
@@ -4329,23 +4354,23 @@ var cliShellCapabilities = [
 ];
 
 // ../../packages/capabilities/dist/capabilities/clusters.js
-import { z as z20 } from "zod";
-var clusterCliInput = z20.object({
-  $positionals: z20.array(z20.string()).optional(),
-  cursor: z20.string().optional(),
-  guided: z20.boolean().optional(),
-  idempotencyKey: z20.string().optional(),
-  limit: z20.union([z20.string(), z20.number()]).optional(),
-  machine: z20.string().optional(),
-  machines: z20.string().optional(),
-  network: z20.enum(["public", "private"]).optional(),
-  noWait: z20.boolean().optional(),
-  nodes: z20.union([z20.string(), z20.number()]).optional(),
-  output: z20.string().optional(),
-  overwrite: z20.boolean().optional(),
-  timeout: z20.string().optional(),
-  wait: z20.boolean().optional(),
-  yes: z20.boolean().optional()
+import { z as z21 } from "zod";
+var clusterCliInput = z21.object({
+  $positionals: z21.array(z21.string()).optional(),
+  cursor: z21.string().optional(),
+  guided: z21.boolean().optional(),
+  idempotencyKey: z21.string().optional(),
+  limit: z21.union([z21.string(), z21.number()]).optional(),
+  machine: z21.string().optional(),
+  machines: z21.string().optional(),
+  network: z21.enum(["public", "private"]).optional(),
+  noWait: z21.boolean().optional(),
+  nodes: z21.union([z21.string(), z21.number()]).optional(),
+  output: z21.string().optional(),
+  overwrite: z21.boolean().optional(),
+  timeout: z21.string().optional(),
+  wait: z21.boolean().optional(),
+  yes: z21.boolean().optional()
 }).strict();
 function clusterExecutor(context) {
   const runtime3 = context.cli?.interaction;
@@ -4473,12 +4498,12 @@ var clusterCliCapabilities = [
     related: ["clusters show", "reservations show"]
   })
 ];
-var clusterType = z20.enum(["kubernetes", "slurm"]);
-var reservationCluster = z20.object({ reservationId: z20.string(), type: clusterType });
-var controllerNode = z20.object({
-  controllerId: z20.string(),
-  nodeId: z20.string(),
-  confirm: z20.boolean().optional()
+var clusterType = z21.enum(["kubernetes", "slurm"]);
+var reservationCluster = z21.object({ reservationId: z21.string(), type: clusterType });
+var controllerNode = z21.object({
+  controllerId: z21.string(),
+  nodeId: z21.string(),
+  confirm: z21.boolean().optional()
 });
 var clusterCapabilities = [
   defineCapability({
@@ -4487,7 +4512,7 @@ var clusterCapabilities = [
     roles: ["user"],
     description: "List this tenant's kubernetes/slurm clusters.",
     mutation: "read",
-    input: z20.object({}),
+    input: z21.object({}),
     mcp: { name: "clusters_list" },
     slack: false,
     execute: (ctx) => listClusters(ctx.fetch)
@@ -4498,8 +4523,8 @@ var clusterCapabilities = [
     roles: ["user"],
     description: "List active reservations eligible for cluster creation (kubernetes/slurm), 100 per page. Pass the response's nextCursor as cursor for the next page.",
     mutation: "read",
-    input: z20.object({
-      cursor: z20.string().min(1).optional().describe("nextCursor from the previous page.")
+    input: z21.object({
+      cursor: z21.string().min(1).optional().describe("nextCursor from the previous page.")
     }),
     mcp: { name: "clusters_reservations_list" },
     slack: false,
@@ -4514,13 +4539,13 @@ var clusterCapabilities = [
     roles: ["user"],
     description: "Launch a kubernetes or slurm cluster on a reservation.",
     mutation: "preview-confirm",
-    input: z20.object({
-      reservationId: z20.string(),
+    input: z21.object({
+      reservationId: z21.string(),
       type: clusterType,
-      networkMode: z20.enum(["public", "private"]).optional(),
-      nodeIds: z20.array(z20.string()).optional(),
-      nodeCount: z20.number().int().positive().optional(),
-      confirm: z20.boolean().optional()
+      networkMode: z21.enum(["public", "private"]).optional(),
+      nodeIds: z21.array(z21.string()).optional(),
+      nodeCount: z21.number().int().positive().optional(),
+      confirm: z21.boolean().optional()
     }).strict(),
     mcp: { name: "clusters_create" },
     slack: false,
@@ -4560,7 +4585,7 @@ var clusterCapabilities = [
     roles: ["user"],
     description: "Fetch the raw kubeconfig text for a kubernetes cluster reservation. Unlike `ornn clusters kubeconfig`, this does not write a file locally -- the caller is responsible for saving the returned text if needed.",
     mutation: "read",
-    input: z20.object({ reservationId: z20.string() }),
+    input: z21.object({ reservationId: z21.string() }),
     mcp: { name: "clusters_kubeconfig" },
     slack: false,
     execute: async (ctx, input) => {
@@ -4599,7 +4624,7 @@ var clusterCapabilities = [
     roles: ["user"],
     description: "Tear down a kubernetes or slurm cluster on a reservation.",
     mutation: "preview-confirm",
-    input: reservationCluster.extend({ confirm: z20.boolean().optional() }),
+    input: reservationCluster.extend({ confirm: z21.boolean().optional() }),
     mcp: { name: "clusters_teardown" },
     slack: false,
     execute: (ctx, input) => teardownReservationCluster(ctx.fetch, input.type, input.reservationId)
@@ -4607,55 +4632,55 @@ var clusterCapabilities = [
 ];
 
 // ../../packages/capabilities/dist/capabilities/external-buckets.js
-import { z as z21 } from "zod";
-var pageInput2 = z21.object({
-  $positionals: z21.array(z21.string()).optional(),
-  cursor: z21.string().optional(),
-  limit: z21.union([z21.string(), z21.number()]).optional()
+import { z as z22 } from "zod";
+var pageInput2 = z22.object({
+  $positionals: z22.array(z22.string()).optional(),
+  cursor: z22.string().optional(),
+  limit: z22.union([z22.string(), z22.number()]).optional()
 }).strict();
-var showInput = z21.object({
-  $positionals: z21.array(z21.string()).optional()
+var showInput = z22.object({
+  $positionals: z22.array(z22.string()).optional()
 }).strict();
-var verificationInput = z21.object({
-  $positionals: z21.array(z21.string()).optional(),
-  idempotencyKey: z21.string().optional()
+var verificationInput = z22.object({
+  $positionals: z22.array(z22.string()).optional(),
+  idempotencyKey: z22.string().optional()
 }).strict();
-var disconnectInput = z21.object({
-  $positionals: z21.array(z21.string()).optional(),
-  idempotencyKey: z21.string().optional(),
-  yes: z21.boolean().optional()
+var disconnectInput = z22.object({
+  $positionals: z22.array(z22.string()).optional(),
+  idempotencyKey: z22.string().optional(),
+  yes: z22.boolean().optional()
 }).strict();
-var connectInput = z21.object({
-  $positionals: z21.array(z21.string()).optional(),
-  accessKeyId: z21.string().optional(),
-  accountId: z21.string().optional(),
-  bucket: z21.string().optional(),
-  endpointUrl: z21.string().optional(),
-  idempotencyKey: z21.string().optional(),
-  name: z21.string().optional(),
-  prefix: z21.string().optional(),
-  readOnly: z21.boolean().optional(),
-  readWrite: z21.boolean().optional(),
-  region: z21.string().optional(),
-  secretAccessKeyFile: z21.string().optional(),
-  url: z21.string().optional(),
-  yes: z21.boolean().optional()
+var connectInput = z22.object({
+  $positionals: z22.array(z22.string()).optional(),
+  accessKeyId: z22.string().optional(),
+  accountId: z22.string().optional(),
+  bucket: z22.string().optional(),
+  endpointUrl: z22.string().optional(),
+  idempotencyKey: z22.string().optional(),
+  name: z22.string().optional(),
+  prefix: z22.string().optional(),
+  readOnly: z22.boolean().optional(),
+  readWrite: z22.boolean().optional(),
+  region: z22.string().optional(),
+  secretAccessKeyFile: z22.string().optional(),
+  url: z22.string().optional(),
+  yes: z22.boolean().optional()
 }).strict();
-var credentialInput = z21.object({
-  $positionals: z21.array(z21.string()).optional(),
-  accessKeyId: z21.string().optional(),
-  idempotencyKey: z21.string().optional(),
-  secretAccessKeyFile: z21.string().optional(),
-  yes: z21.boolean().optional()
+var credentialInput = z22.object({
+  $positionals: z22.array(z22.string()).optional(),
+  accessKeyId: z22.string().optional(),
+  idempotencyKey: z22.string().optional(),
+  secretAccessKeyFile: z22.string().optional(),
+  yes: z22.boolean().optional()
 }).strict();
-var importInput = z21.object({
-  $positionals: z21.array(z21.string()).optional(),
-  idempotencyKey: z21.string().optional(),
-  noWait: z21.boolean().optional(),
-  reservation: z21.string().optional(),
-  timeout: z21.string().optional(),
-  wait: z21.boolean().optional(),
-  yes: z21.boolean().optional()
+var importInput = z22.object({
+  $positionals: z22.array(z22.string()).optional(),
+  idempotencyKey: z22.string().optional(),
+  noWait: z22.boolean().optional(),
+  reservation: z22.string().optional(),
+  timeout: z22.string().optional(),
+  wait: z22.boolean().optional(),
+  yes: z22.boolean().optional()
 }).strict();
 function externalBucketExecutor(context) {
   const interaction = context.cli?.interaction;
@@ -4699,16 +4724,16 @@ function isExternalBucket(drive) {
     return false;
   return ["external_gcs", "s3", "r2", "cloudflare_r2"].includes(source.provider ?? "") || Boolean(source.bucket);
 }
-var bucketInput = z21.object({ driveId: z21.string() });
+var bucketInput = z22.object({ driveId: z22.string() });
 var bucketListCapability = defineCapability({
   id: "storage.external-buckets.list",
   domain: "storage",
   roles: ["user"],
   description: "List a page of connected external buckets. Pass next_cursor as cursor to continue.",
   mutation: "read",
-  input: z21.object({
-    limit: z21.number().int().min(1).max(100).optional(),
-    cursor: z21.string().optional()
+  input: z22.object({
+    limit: z22.number().int().min(1).max(100).optional(),
+    cursor: z22.string().optional()
   }),
   mcp: { name: "storage_buckets_list" },
   slack: false,
@@ -4862,22 +4887,22 @@ var externalBucketCapabilities = [
 ];
 
 // ../../packages/capabilities/dist/capabilities/evidence.js
-import { z as z22 } from "zod";
-var positionals3 = z22.array(z22.string()).default([]);
-var evidenceInput = z22.object({
+import { z as z23 } from "zod";
+var positionals3 = z23.array(z23.string()).default([]);
+var evidenceInput = z23.object({
   $positionals: positionals3,
-  before: z22.string().optional(),
-  count: z22.string().optional(),
-  cursor: z22.string().optional(),
-  end: z22.string().optional(),
-  follow: z22.boolean().optional(),
-  guided: z22.boolean().optional(),
-  interval: z22.string().optional(),
-  limit: z22.string().optional(),
-  maxPoints: z22.string().optional(),
-  start: z22.string().optional(),
-  stream: z22.enum(["kernel", "serial"]).optional(),
-  timeout: z22.string().optional()
+  before: z23.string().optional(),
+  count: z23.string().optional(),
+  cursor: z23.string().optional(),
+  end: z23.string().optional(),
+  follow: z23.boolean().optional(),
+  guided: z23.boolean().optional(),
+  interval: z23.string().optional(),
+  limit: z23.string().optional(),
+  maxPoints: z23.string().optional(),
+  start: z23.string().optional(),
+  stream: z23.enum(["kernel", "serial"]).optional(),
+  timeout: z23.string().optional()
 }).strict();
 function runtime2(context) {
   const interaction = context.cli?.interaction;
@@ -5006,8 +5031,8 @@ var evidenceCapabilities = [
 ];
 
 // ../../packages/capabilities/dist/capabilities/metrics.js
-import { z as z23 } from "zod";
-var metricInput = z23.object({ reservationId: z23.string(), machineId: z23.string().optional() });
+import { z as z24 } from "zod";
+var metricInput = z24.object({ reservationId: z24.string(), machineId: z24.string().optional() });
 async function nodeIds(context, input) {
   if (input.machineId)
     return [input.machineId];
@@ -5043,9 +5068,9 @@ var metricsHistoryCapability = defineCapability({
   mutation: "read",
   description: "Fetch historical telemetry for a reservation's machine over a time range. machineId is optional: omit it to use the first active machine on the reservation.",
   input: metricInput.extend({
-    start: z23.string().optional(),
-    end: z23.string().optional(),
-    maxPoints: z23.number().int().positive().optional()
+    start: z24.string().optional(),
+    end: z24.string().optional(),
+    maxPoints: z24.number().int().positive().optional()
   }),
   slack: false,
   execute: async (context, input) => {
@@ -5061,18 +5086,18 @@ var metricsHistoryCapability = defineCapability({
 var metricsCapabilities = [metricsSnapshotCapability, metricsHistoryCapability];
 
 // ../../packages/capabilities/dist/capabilities/mounts.js
-import { z as z24 } from "zod";
-var mountInput = z24.object({
-  $positionals: z24.array(z24.string()).default([]),
-  access: z24.string().optional(),
-  cursor: z24.string().optional(),
-  idempotencyKey: z24.string().optional(),
-  limit: z24.union([z24.string(), z24.number()]).optional(),
-  noWait: z24.boolean().optional(),
-  timeout: z24.string().optional(),
-  volume: z24.string().optional(),
-  wait: z24.boolean().optional(),
-  yes: z24.boolean().optional()
+import { z as z25 } from "zod";
+var mountInput = z25.object({
+  $positionals: z25.array(z25.string()).default([]),
+  access: z25.string().optional(),
+  cursor: z25.string().optional(),
+  idempotencyKey: z25.string().optional(),
+  limit: z25.union([z25.string(), z25.number()]).optional(),
+  noWait: z25.boolean().optional(),
+  timeout: z25.string().optional(),
+  volume: z25.string().optional(),
+  wait: z25.boolean().optional(),
+  yes: z25.boolean().optional()
 }).strict();
 function mountExecutor(context) {
   const interaction = context.cli?.interaction;
@@ -5181,13 +5206,13 @@ var mountCapabilities = [
 ];
 
 // ../../packages/capabilities/dist/capabilities/identity.js
-import { z as z25 } from "zod";
-var emptyInput3 = z25.object({});
-var loginInput = z25.object({
-  authBase: z25.string().min(1).optional(),
-  noBrowser: z25.boolean().optional(),
-  pollInterval: z25.number().positive().optional(),
-  timeout: z25.number().positive().optional()
+import { z as z26 } from "zod";
+var emptyInput3 = z26.object({});
+var loginInput = z26.object({
+  authBase: z26.string().min(1).optional(),
+  noBrowser: z26.boolean().optional(),
+  pollInterval: z26.number().positive().optional(),
+  timeout: z26.number().positive().optional()
 });
 function executeSession(context, command, input) {
   if (!context.cli?.session) {
@@ -5306,50 +5331,50 @@ var identityCapabilities = [
 ];
 
 // ../../packages/capabilities/dist/capabilities/listings.js
-import { z as z26 } from "zod";
-var listingCreateInput = z26.object({
-  organizationId: z26.string().optional(),
-  organization_id: z26.string().optional(),
-  facilityId: z26.string().optional(),
-  facility_id: z26.string().optional(),
-  kind: z26.enum(["gpu", "cpu", "node", "link"]).optional(),
-  gpu: z26.string().optional(),
-  cpu: z26.string().optional(),
-  site: z26.string().optional(),
-  fabric: z26.string().optional(),
-  min_nodes: z26.number().int().optional(),
-  starts_after: z26.string().optional(),
-  starts_before: z26.string().optional(),
-  ends_after: z26.string().optional(),
-  ends_before: z26.string().optional(),
-  gpu_type: z26.string().optional(),
-  node_model: z26.string().optional(),
-  fabric_type: z26.string().optional(),
-  node_count: z26.number().int().optional(),
-  gpus_per_node: z26.number().int().optional(),
-  cores_per_node: z26.number().int().optional().describe('CPU listings: cores per node (2 vCPUs each), at least 1, priced per vCPU-hour. Omit gpu_type or set it to "cpu".'),
-  site_nickname: z26.string().optional().describe("A state, city, address, or catalog region such as us-west-3."),
-  site_supplier: z26.string().optional(),
-  ram: z26.string().optional(),
-  storage: z26.string().optional(),
-  internet: z26.string().optional(),
-  network_hardware: z26.string().optional(),
-  available_start_at: z26.string().optional().describe("Start of the availability window. YYYY-MM-DD or RFC3339."),
-  available_end_at: z26.string().optional().describe("End of the availability window. YYYY-MM-DD or RFC3339."),
-  available_from: z26.string().optional().describe("Alias for available_start_at."),
-  available_to: z26.string().optional().describe("Alias for available_end_at."),
-  buy_now_price_per_gpu_hour: z26.number().optional().describe("Price buyers pay, USD per GPU-hour (per vCPU-hour on CPU listings)."),
-  deposit_percent: z26.number().optional(),
-  down_payment_cents: z26.number().int().nonnegative().optional(),
-  access_mode: z26.enum(["bare-metal", "virtual-machine"]).optional(),
-  state: z26.enum(["available", "draft"]).optional(),
-  price_omitted: z26.boolean().optional(),
-  announce: z26.boolean().optional(),
-  text: z26.string().optional(),
-  confirm: z26.boolean().optional(),
-  idempotencyKey: z26.string().min(1).max(200).optional()
-});
-var catalogTermsInput = z26.object({ kind: z26.enum(["gpu", "cpu", "node", "link"]).optional() });
+import { z as z27 } from "zod";
+var listingCreateInput = z27.object({
+  organizationId: z27.string().optional(),
+  organization_id: z27.string().optional(),
+  facilityId: z27.string().optional(),
+  facility_id: z27.string().optional(),
+  kind: z27.enum(["gpu", "cpu", "node", "link"]).optional(),
+  gpu: z27.string().optional(),
+  cpu: z27.string().optional(),
+  site: z27.string().optional(),
+  fabric: z27.string().optional(),
+  min_nodes: z27.number().int().optional(),
+  starts_after: z27.string().optional(),
+  starts_before: z27.string().optional(),
+  ends_after: z27.string().optional(),
+  ends_before: z27.string().optional(),
+  gpu_type: z27.string().optional(),
+  node_model: z27.string().optional(),
+  fabric_type: z27.string().optional(),
+  node_count: z27.number().int().optional(),
+  gpus_per_node: z27.number().int().optional(),
+  cores_per_node: z27.number().int().optional().describe('CPU listings: cores per node (2 vCPUs each), at least 1, priced per vCPU-hour. Omit gpu_type or set it to "cpu".'),
+  site_nickname: z27.string().optional().describe("A state, city, address, or catalog region such as us-west-3."),
+  site_supplier: z27.string().optional(),
+  ram: z27.string().optional(),
+  storage: z27.string().optional(),
+  internet: z27.string().optional(),
+  network_hardware: z27.string().optional(),
+  available_start_at: z27.string().optional().describe("Start of the availability window. YYYY-MM-DD or RFC3339."),
+  available_end_at: z27.string().optional().describe("End of the availability window. YYYY-MM-DD or RFC3339."),
+  available_from: z27.string().optional().describe("Alias for available_start_at."),
+  available_to: z27.string().optional().describe("Alias for available_end_at."),
+  buy_now_price_per_gpu_hour: z27.number().optional().describe("Price buyers pay, USD per GPU-hour (per vCPU-hour on CPU listings)."),
+  deposit_percent: z27.number().optional(),
+  down_payment_cents: z27.number().int().nonnegative().optional(),
+  access_mode: z27.enum(["bare-metal", "virtual-machine"]).optional(),
+  state: z27.enum(["available", "draft"]).optional(),
+  price_omitted: z27.boolean().optional(),
+  announce: z27.boolean().optional(),
+  text: z27.string().optional(),
+  confirm: z27.boolean().optional(),
+  idempotencyKey: z27.string().min(1).max(200).optional()
+});
+var catalogTermsInput = z27.object({ kind: z27.enum(["gpu", "cpu", "node", "link"]).optional() });
 var slackListingCreateParams = {
   type: "object",
   properties: {
@@ -5647,12 +5672,12 @@ var listingCapabilities = [
 ];
 
 // ../../packages/capabilities/dist/capabilities/organization-invites.js
-import { z as z27 } from "zod";
-var organizationInviteInput = z27.object({
-  organization_id: z27.uuid().optional(),
-  email: z27.string().trim().toLowerCase().pipe(z27.email()),
-  organization_role: z27.enum(["consumer", "supplier"]).optional(),
-  send_email: z27.boolean().optional().describe("Defaults to true for an existing organization; false returns a link. Signup invites cannot be emailed.")
+import { z as z28 } from "zod";
+var organizationInviteInput = z28.object({
+  organization_id: z28.uuid().optional(),
+  email: z28.string().trim().toLowerCase().pipe(z28.email()),
+  organization_role: z28.enum(["consumer", "supplier"]).optional(),
+  send_email: z28.boolean().optional().describe("Defaults to true for an existing organization; false returns a link. Signup invites cannot be emailed.")
 }).superRefine((input, ctx) => {
   if (!input.organization_id && input.send_email === true) {
     ctx.addIssue({
@@ -5712,33 +5737,33 @@ var organizationInviteCapability = defineCapability({
 });
 
 // ../../packages/capabilities/dist/capabilities/networks.js
-import { z as z28 } from "zod";
+import { z as z29 } from "zod";
 var globalInput = {
-  $positionals: z28.array(z28.string()).optional(),
-  guided: z28.boolean().optional(),
-  idempotencyKey: z28.string().optional(),
-  noBrowser: z28.boolean().optional(),
-  noWait: z28.boolean().optional(),
-  overwrite: z28.boolean().optional(),
-  print: z28.boolean().optional(),
-  wait: z28.boolean().optional(),
-  yes: z28.boolean().optional()
+  $positionals: z29.array(z29.string()).optional(),
+  guided: z29.boolean().optional(),
+  idempotencyKey: z29.string().optional(),
+  noBrowser: z29.boolean().optional(),
+  noWait: z29.boolean().optional(),
+  overwrite: z29.boolean().optional(),
+  print: z29.boolean().optional(),
+  wait: z29.boolean().optional(),
+  yes: z29.boolean().optional()
 };
-var noOptionsInput = z28.object(globalInput).strict();
-var connectInput2 = z28.object({
+var noOptionsInput = z29.object(globalInput).strict();
+var connectInput2 = z29.object({
   ...globalInput,
-  identityFile: z28.string().optional(),
-  output: z28.string().optional(),
-  user: z28.string().optional()
+  identityFile: z29.string().optional(),
+  output: z29.string().optional(),
+  user: z29.string().optional()
 }).strict();
-var listInput = z28.object({ ...globalInput, cursor: z28.string().optional(), limit: z28.string().optional() }).strict();
-var networkCreateInput = z28.object({ ...globalInput, cidr: z28.string().optional(), name: z28.string().optional() }).strict();
-var networkUpdateInput = z28.object({ ...globalInput, name: z28.string().optional() }).strict();
-var vpnConfigureInput = z28.object({
+var listInput = z29.object({ ...globalInput, cursor: z29.string().optional(), limit: z29.string().optional() }).strict();
+var networkCreateInput = z29.object({ ...globalInput, cidr: z29.string().optional(), name: z29.string().optional() }).strict();
+var networkUpdateInput = z29.object({ ...globalInput, name: z29.string().optional() }).strict();
+var vpnConfigureInput = z29.object({
   ...globalInput,
-  name: z28.string().optional(),
-  output: z28.string().optional(),
-  privateKey: z28.string().optional()
+  name: z29.string().optional(),
+  output: z29.string().optional(),
+  privateKey: z29.string().optional()
 }).strict();
 function networkExecutor(context) {
   const runtime3 = context.cli?.interaction;
@@ -5983,12 +6008,12 @@ var networkCapabilities = [
   vpnConnectionDisconnectCapability,
   connectCapability
 ];
-var networkUpdateFields = z28.object({
-  networkId: z28.string(),
-  name: z28.string().optional(),
-  description: z28.string().optional(),
-  clearDescription: z28.boolean().optional(),
-  confirm: z28.boolean().optional()
+var networkUpdateFields = z29.object({
+  networkId: z29.string(),
+  name: z29.string().optional(),
+  description: z29.string().optional(),
+  clearDescription: z29.boolean().optional(),
+  confirm: z29.boolean().optional()
 }).refine((input) => !(input.clearDescription && input.description !== void 0), {
   message: "Use either description or clearDescription, not both."
 }).refine((input) => input.name !== void 0 || input.description !== void 0 || input.clearDescription, { message: "Provide name, description, or clearDescription." });
@@ -5999,7 +6024,7 @@ var networkVerbCapabilities = [
     roles: ["user"],
     description: "List this tenant's private networks.",
     mutation: "read",
-    input: z28.object({}),
+    input: z29.object({}),
     mcp: { name: "networks_list" },
     slack: false,
     execute: (ctx) => listNetworks(ctx.fetch)
@@ -6010,7 +6035,7 @@ var networkVerbCapabilities = [
     roles: ["user"],
     description: "Show a single private network by id.",
     mutation: "read",
-    input: z28.object({ networkId: z28.string() }),
+    input: z29.object({ networkId: z29.string() }),
     mcp: { name: "networks_show" },
     slack: false,
     execute: (ctx, input) => getNetwork(ctx.fetch, input.networkId)
@@ -6021,11 +6046,11 @@ var networkVerbCapabilities = [
     roles: ["user"],
     description: "Create a private network.",
     mutation: "preview-confirm",
-    input: z28.object({
-      name: z28.string(),
-      cidr: z28.string().optional(),
-      description: z28.string().optional(),
-      confirm: z28.boolean().optional()
+    input: z29.object({
+      name: z29.string(),
+      cidr: z29.string().optional(),
+      description: z29.string().optional(),
+      confirm: z29.boolean().optional()
     }),
     mcp: { name: "networks_create" },
     slack: false,
@@ -6055,7 +6080,7 @@ var networkVerbCapabilities = [
     roles: ["user"],
     description: "Delete a private network.",
     mutation: "preview-confirm",
-    input: z28.object({ networkId: z28.string(), confirm: z28.boolean().optional() }),
+    input: z29.object({ networkId: z29.string(), confirm: z29.boolean().optional() }),
     mcp: { name: "networks_delete" },
     slack: false,
     // The route answers 204, so report which network went.
@@ -6070,7 +6095,7 @@ var networkVerbCapabilities = [
     roles: ["user"],
     description: "List WireGuard VPN peers registered on a reservation.",
     mutation: "read",
-    input: z28.object({ reservationId: z28.string() }),
+    input: z29.object({ reservationId: z29.string() }),
     mcp: { name: "vpn_peers_list" },
     slack: false,
     execute: (ctx) => listNetworkPeerConfigs(ctx.fetch, "shared")
@@ -6081,11 +6106,11 @@ var networkVerbCapabilities = [
     roles: ["user"],
     description: "Register a WireGuard VPN peer public key on a reservation.",
     mutation: "preview-confirm",
-    input: z28.object({
-      reservationId: z28.string(),
-      publicKey: z28.string(),
-      label: z28.string().optional(),
-      confirm: z28.boolean().optional()
+    input: z29.object({
+      reservationId: z29.string(),
+      publicKey: z29.string(),
+      label: z29.string().optional(),
+      confirm: z29.boolean().optional()
     }),
     mcp: { name: "vpn_peers_create" },
     slack: false,
@@ -6100,10 +6125,10 @@ var networkVerbCapabilities = [
     roles: ["user"],
     description: "Revoke a WireGuard VPN peer from a reservation.",
     mutation: "preview-confirm",
-    input: z28.object({
-      reservationId: z28.string(),
-      peerId: z28.string(),
-      confirm: z28.boolean().optional()
+    input: z29.object({
+      reservationId: z29.string(),
+      peerId: z29.string(),
+      confirm: z29.boolean().optional()
     }),
     mcp: { name: "vpn_peers_delete" },
     slack: false,
@@ -6112,20 +6137,20 @@ var networkVerbCapabilities = [
 ];
 
 // ../../packages/capabilities/dist/capabilities/registry.js
-import { z as z29 } from "zod";
+import { z as z30 } from "zod";
 var globalInput2 = {
-  $positionals: z29.array(z29.string()).default([]),
-  yes: z29.boolean().optional()
+  $positionals: z30.array(z30.string()).default([]),
+  yes: z30.boolean().optional()
 };
-var emptyInput4 = z29.object(globalInput2).strict();
-var repositoryInput = z29.object({
+var emptyInput4 = z30.object(globalInput2).strict();
+var repositoryInput = z30.object({
   ...globalInput2,
-  repository: z29.string().optional().describe("Repository name, with or without your organization's namespace.")
+  repository: z30.string().optional().describe("Repository name, with or without your organization's namespace.")
 }).strict();
-var tagInput = z29.object({
+var tagInput = z30.object({
   ...globalInput2,
-  repository: z29.string().optional().describe("Repository name, with or without your organization's namespace."),
-  tag: z29.string().optional().describe("Tag to delete, such as v1.")
+  repository: z30.string().optional().describe("Repository name, with or without your organization's namespace."),
+  tag: z30.string().optional().describe("Tag to delete, such as v1.")
 }).strict();
 function cliInteraction(context) {
   return context.cli?.interaction;
@@ -6432,14 +6457,14 @@ var registryCapabilities = [
 ];
 
 // ../../packages/capabilities/dist/capabilities/reservation-list.js
-import { z as z30 } from "zod";
-var reservationListInput = z30.object({
-  customerId: z30.string().uuid().optional(),
-  listingId: z30.string().uuid().optional(),
-  listingTermId: z30.string().uuid().optional(),
-  status: z30.enum(["confirmed", "active", "completed", "cancelled"]).optional(),
-  cursor: z30.string().optional(),
-  limit: z30.number().int().min(1).max(100).optional()
+import { z as z31 } from "zod";
+var reservationListInput = z31.object({
+  customerId: z31.string().uuid().optional(),
+  listingId: z31.string().uuid().optional(),
+  listingTermId: z31.string().uuid().optional(),
+  status: z31.enum(["confirmed", "active", "completed", "cancelled"]).optional(),
+  cursor: z31.string().optional(),
+  limit: z31.number().int().min(1).max(100).optional()
 });
 var reservationListCapability = defineCapability({
   id: "reservation.list",
@@ -6490,20 +6515,20 @@ var reservationListCapability = defineCapability({
 });
 
 // ../../packages/capabilities/dist/capabilities/volumes.js
-import { z as z31 } from "zod";
-var storageCliInput = z31.object({
-  $positionals: z31.array(z31.string()).optional(),
-  contentType: z31.string().optional(),
-  cursor: z31.string().optional(),
-  idempotencyKey: z31.string().optional(),
-  limit: z31.union([z31.string(), z31.number()]).optional(),
-  name: z31.string().optional(),
-  output: z31.string().optional(),
-  overwrite: z31.boolean().optional(),
-  path: z31.string().optional(),
-  prefix: z31.string().optional(),
-  source: z31.string().optional(),
-  yes: z31.boolean().optional()
+import { z as z32 } from "zod";
+var storageCliInput = z32.object({
+  $positionals: z32.array(z32.string()).optional(),
+  contentType: z32.string().optional(),
+  cursor: z32.string().optional(),
+  idempotencyKey: z32.string().optional(),
+  limit: z32.union([z32.string(), z32.number()]).optional(),
+  name: z32.string().optional(),
+  output: z32.string().optional(),
+  overwrite: z32.boolean().optional(),
+  path: z32.string().optional(),
+  prefix: z32.string().optional(),
+  source: z32.string().optional(),
+  yes: z32.boolean().optional()
 }).strict();
 function storageExecutor(context) {
   const interaction = context.cli?.interaction;
@@ -6539,7 +6564,7 @@ function storageCapability({ id, command, description, mutation, outcome, human,
     execute: async (context, input) => storageExecutor(context)(id, input)
   });
 }
-var filesListInput = z31.object({ driveId: z31.string(), prefix: z31.string().optional() });
+var filesListInput = z32.object({ driveId: z32.string(), prefix: z32.string().optional() });
 async function* listFiles(context, input) {
   const prefix = input.prefix ?? "";
   const folder = prefix.includes("/") ? prefix.slice(0, prefix.lastIndexOf("/")) : "";
@@ -6699,22 +6724,22 @@ var volumeCapabilities = [
     related: ["volumes files list"]
   })
 ];
-var reservationInput = z31.object({ reservationId: z31.string() });
-var reservationWrite = reservationInput.extend({ confirm: z31.boolean().optional() });
-var driveInput = z31.object({ driveId: z31.string() });
-var driveWrite = driveInput.extend({ confirm: z31.boolean().optional() });
-var bucketConnectInput = z31.object({
-  provider: z31.enum(["gcs", "s3", "r2"]),
-  bucket: z31.string(),
-  name: z31.string().optional(),
-  prefix: z31.string().optional(),
-  region: z31.string().optional(),
-  endpointUrl: z31.string().optional(),
-  accountId: z31.string().optional(),
-  accessKeyId: z31.string().optional(),
-  secretAccessKey: z31.string().optional(),
-  readOnly: z31.boolean().optional(),
-  confirm: z31.boolean().optional()
+var reservationInput = z32.object({ reservationId: z32.string() });
+var reservationWrite = reservationInput.extend({ confirm: z32.boolean().optional() });
+var driveInput = z32.object({ driveId: z32.string() });
+var driveWrite = driveInput.extend({ confirm: z32.boolean().optional() });
+var bucketConnectInput = z32.object({
+  provider: z32.enum(["gcs", "s3", "r2"]),
+  bucket: z32.string(),
+  name: z32.string().optional(),
+  prefix: z32.string().optional(),
+  region: z32.string().optional(),
+  endpointUrl: z32.string().optional(),
+  accountId: z32.string().optional(),
+  accessKeyId: z32.string().optional(),
+  secretAccessKey: z32.string().optional(),
+  readOnly: z32.boolean().optional(),
+  confirm: z32.boolean().optional()
 }).refine((input) => !(input.provider === "gcs" && (input.accessKeyId || input.secretAccessKey)), {
   message: "Access key credentials are only supported for S3-compatible buckets."
 }).refine((input) => Boolean(input.accessKeyId) === Boolean(input.secretAccessKey), {
@@ -6729,7 +6754,7 @@ var storageVerbCapabilities = [
     roles: ["user"],
     description: "Attach an existing storage volume (drive) to a reservation -- the inverse of storage_undeploy. Always mounts at the platform path /home/tenant/volume (fuse). There is no customer mount-path override.",
     mutation: "preview-confirm",
-    input: reservationWrite.extend({ driveId: z31.string(), readOnly: z31.boolean().optional() }),
+    input: reservationWrite.extend({ driveId: z32.string(), readOnly: z32.boolean().optional() }),
     slack: false,
     execute: (ctx, input) => deployReservationStorage(ctx.fetch, input.reservationId, {
       drive_id: input.driveId,
@@ -6762,7 +6787,7 @@ var storageVerbCapabilities = [
     roles: ["user"],
     description: "List reservations that can receive a storage deploy, grouped the same way as the console picker.",
     mutation: "read",
-    input: z31.object({}),
+    input: z32.object({}),
     slack: false,
     execute: (ctx) => listStorageTargets(ctx.fetch)
   }),
@@ -6772,9 +6797,9 @@ var storageVerbCapabilities = [
     roles: ["user"],
     description: "List a page of storage volumes, newest updated first. Pass next_cursor as cursor to continue.",
     mutation: "read",
-    input: z31.object({
-      limit: z31.number().int().min(1).max(100).optional(),
-      cursor: z31.string().optional()
+    input: z32.object({
+      limit: z32.number().int().min(1).max(100).optional(),
+      cursor: z32.string().optional()
     }),
     mcp: { name: "storage_volumes_list" },
     slack: false,
@@ -6800,10 +6825,10 @@ var storageVerbCapabilities = [
     roles: ["user"],
     description: "Create a storage volume (drive), optionally cloned from an existing source drive.",
     mutation: "preview-confirm",
-    input: z31.object({
-      name: z31.string(),
-      sourceDriveId: z31.string().optional(),
-      confirm: z31.boolean().optional()
+    input: z32.object({
+      name: z32.string(),
+      sourceDriveId: z32.string().optional(),
+      confirm: z32.boolean().optional()
     }),
     mcp: { name: "storage_volumes_create" },
     slack: false,
@@ -6896,7 +6921,7 @@ var storageVerbCapabilities = [
     roles: ["user"],
     description: "Update a connected S3-compatible bucket's access key credentials.",
     mutation: "preview-confirm",
-    input: driveWrite.extend({ accessKeyId: z31.string(), secretAccessKey: z31.string() }),
+    input: driveWrite.extend({ accessKeyId: z32.string(), secretAccessKey: z32.string() }),
     mcp: { name: "storage_buckets_update_credentials" },
     slack: false,
     execute: (ctx, input) => updateDrive(ctx.fetch, input.driveId, {
@@ -6949,7 +6974,7 @@ var catalog = [
       ...networkVerbCapabilities,
       ...accessVerbCapabilities,
       ...storageVerbCapabilities,
-      machinePushKeysCapability,
+      reservationKeysPushCapability,
       ...metricsCapabilities,
       ...billingCapabilities,
       ...registryCapabilities,
@@ -7238,5 +7263,10 @@ export {
   metricsHistoryCapability,
   metricsSnapshotCapability,
   parseHardwareCatalog,
+  sshKeyAddCapability,
+  sshKeyAssignmentStatusCapability,
+  sshKeyDeleteCapability,
+  sshKeyDeliveryStatus,
+  sshKeyListCapability,
   volumeFilesListCapability
 };