@ornncompute/cli 1.0.142 → 1.0.144

package/README.md

@@ -5,7 +5,7 @@ client for customer compute journeys and the explicit staff namespace. It
 sends browser and CLI traffic only through the API gateway.
 
 For the customer install and usage guide, see [`docs/cli.md`](../../docs/cli.md).
-The shared capability catalog in `packages/capabilities` is the authority for
+The [shared capability catalog](../../packages/capabilities/README.md) is the authority for
 command identity, role visibility, input schemas, help, and resource discovery.
 The CLI imports `@ornn/capabilities/cli`; packaging includes its dependencies,
 including `@ornn/api-client`, and excludes MCP-only catalog handlers. These
@@ -449,9 +449,10 @@ command UX changes. The smoke runner refuses production and shared staging.
 See [`docs/packaged-vnext-release-gate.md`](docs/packaged-vnext-release-gate.md).
 
 Private networks and VPN peers belong to the selected organization. There is no
-per-reservation network attachment step. Requests use the native Orchestrator
-network client; the catalog retains command metadata and the CLI owns network
-presentation, connection recovery, and local WireGuard config export.
+per-reservation network attachment step. CLI and MCP share network and VPN peer
+capabilities over the native Orchestrator network client. The CLI retains name
+resolution, review, replay, local pagination, connection recovery, and local
+WireGuard key/config files.
 Durable Bare Metal workspaces use
 `--network shared --volume <volume-id> --mount-access read-only|read-write`;
 private Kubernetes and Slurm launches continue to use `--network private`.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ornncompute/cli",
-  "version": "1.0.142",
+  "version": "1.0.144",
   "description": "Command-line interface for Ornn compute access workflows.",
   "type": "module",
   "bin": {

package/src/network-commands.mjs

@@ -1,14 +1,14 @@
 import { getReservation } from "../vendor/api-client/commerce.js";
 import {
-  createNetwork,
-  createNetworkPeer,
-  deleteNetwork,
-  deleteNetworkPeer,
-  getNetwork,
-  listNetworkPeerConfigs,
-  listNetworks,
-  updateNetwork,
-} from "../vendor/api-client/orchestrator.js";
+  privateNetworkCreateCapability,
+  privateNetworkDeleteCapability,
+  privateNetworkListCapability,
+  privateNetworkShowCapability,
+  privateNetworkUpdateCapability,
+  vpnConnectionConfigureCapability,
+  vpnConnectionDisconnectCapability,
+  vpnConnectionListCapability,
+} from "../vendor/capabilities/cli.js";
 import { z } from "zod";
 
 const CANONICAL_ID = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
@@ -108,10 +108,6 @@ function requireMutationKey(runtime, input) {
   return key;
 }
 
-function mutationHeaders(key) {
-  return key ? { "Idempotency-Key": key } : undefined;
-}
-
 function lifecycle(statusValue) {
   const status = text(statusValue)?.toLowerCase() ?? "unknown";
   if (["active", "ready", "applied", "connected"].includes(status)) {
@@ -189,12 +185,12 @@ function networkFromMutation(payload) {
 }
 
 async function fetchNetworks(context) {
-  return networkRows(await listNetworks(context.fetch));
+  return networkRows(await privateNetworkListCapability.execute(context, {}));
 }
 
 async function resolveNetwork(context, runtime, reference) {
   if (CANONICAL_ID.test(reference)) {
-    return record(await getNetwork(context.fetch, reference));
+    return record(await privateNetworkShowCapability.execute(context, { networkId: reference }));
   }
   const wanted = normalizedName(reference);
   const matches = (await fetchNetworks(context)).filter(
@@ -404,13 +400,11 @@ async function createPrivateNetwork(context, input) {
     }))
   )
     return declined(runtime);
-  const created = await createNetwork(
-    context.fetch,
-    { name, ...(cidr ? { cidr } : {}) },
-    {
-      headers: mutationHeaders(idempotencyKey),
-    }
-  );
+  const created = await privateNetworkCreateCapability.execute(context, {
+    name,
+    ...(cidr ? { cidr } : {}),
+    idempotencyKey,
+  });
   return networkMutationExecution(runtime, networkFromMutation(created), false);
 }
 
@@ -456,14 +450,11 @@ async function updatePrivateNetwork(context, input) {
     }))
   )
     return declined(runtime);
-  const updated = await updateNetwork(
-    context.fetch,
-    String(current.id),
-    { name },
-    {
-      headers: mutationHeaders(idempotencyKey),
-    }
-  );
+  const updated = await privateNetworkUpdateCapability.execute(context, {
+    networkId: String(current.id),
+    name,
+    idempotencyKey,
+  });
   const network = networkFromMutation(updated);
   return runtime.result({
     data: { private_network: network, replayed: false },
@@ -496,8 +487,9 @@ async function deletePrivateNetwork(context, input) {
     }))
   )
     return declined(runtime);
-  await deleteNetwork(context.fetch, String(projected.id), {
-    headers: mutationHeaders(idempotencyKey),
+  await privateNetworkDeleteCapability.execute(context, {
+    networkId: String(projected.id),
+    idempotencyKey,
   });
   return runtime.result({
     data: { deleted: true, private_network: projected },
@@ -546,7 +538,7 @@ function vpnLines(connection) {
 }
 
 async function listVpnPayloads(context) {
-  return vpnPayloadRows(await listNetworkPeerConfigs(context.fetch, "shared"));
+  return vpnPayloadRows(await vpnConnectionListCapability.execute(context, {}));
 }
 
 async function listVpnConnections(context, input) {
@@ -798,14 +790,11 @@ async function configureVpnConnection(context, input) {
   )
     return declined(runtime);
   const applied = record(
-    await createNetworkPeer(
-      context.fetch,
-      "shared",
-      { label: effectiveName, public_key: publicKey },
-      {
-        headers: mutationHeaders(idempotencyKey),
-      }
-    )
+    await vpnConnectionConfigureCapability.execute(context, {
+      label: effectiveName,
+      publicKey,
+      idempotencyKey,
+    })
   );
   const exported = await exportVpnConfig(runtime, input, applied.config, privateKeyPath, publicKey);
   const connection = projectVpnConnection(applied, target);
@@ -854,8 +843,9 @@ async function disconnectVpnConnection(context, input) {
     }))
   )
     return declined(runtime);
-  await deleteNetworkPeer(context.fetch, "shared", String(connection.id), {
-    headers: mutationHeaders(idempotencyKey),
+  await vpnConnectionDisconnectCapability.execute(context, {
+    peerId: String(connection.id),
+    idempotencyKey,
   });
   return runtime.result({
     data: { disconnected: true, vpn_connection: connection },
@@ -1026,7 +1016,9 @@ async function connectPrivateTarget(context, input) {
     });
   }
 
-  const shared = record(await getNetwork(context.fetch, "shared"));
+  const shared = record(
+    await privateNetworkShowCapability.execute(context, { networkId: "shared" })
+  );
   const privateNetwork = projectNetwork({
     ...record(shared.network),
     id: "shared",

package/src/vm-commands.mjs

@@ -2,6 +2,8 @@ import {
   sshKeyListCapability,
   sshKeyAddCapability,
   sshKeyDeleteCapability,
+  sshKeyAssignmentListCapability,
+  sshKeyAssignmentAssignCapability,
   sshKeyAssignmentStatusCapability,
   sshKeyDeliveryStatus,
 } from "../vendor/capabilities/cli.js";
@@ -687,7 +689,7 @@ export async function materializeKey(context, plan, interaction, idempotencyKey)
 
 async function fetchAssignedKeys(context, reservationId) {
   return activeKeys(
-    keysFromPayload(await orchestrator.listReservationSshKeys(context.fetch, reservationId))
+    keysFromPayload(await sshKeyAssignmentListCapability.execute(context, { reservationId }))
   );
 }
 
@@ -697,12 +699,11 @@ async function ensureAssignment(context, reservationId, key, idempotencyKey, int
   const existing = assigned.find((candidate) => resourceId(candidate) === keyId);
   if (existing) return { created: false, key: existing };
   const created = record(
-    await orchestrator.addReservationSshKey(
-      context.fetch,
+    await sshKeyAssignmentAssignCapability.execute(context, {
       reservationId,
-      { ssh_key_id: keyId },
-      { headers: { "Idempotency-Key": idempotencyKey } }
-    )
+      keyId,
+      idempotencyKey,
+    })
   );
   if (resourceId(created) !== keyId) {
     interaction.error("The SSH-key assignment did not match the reviewed key.", {
@@ -1668,7 +1669,7 @@ async function executeWorkspaceCapability(
       code: "workspace_capability_unavailable",
     });
   }
-  const execution = await capability.execute(
+  const execution = await (capability.cli?.execute ?? capability.execute)(
     workspaceStepContext(context, interaction, signal),
     input
   );

package/vendor/api-client/gateway.js

@@ -231,19 +231,6 @@ function deleteAccountSshKey(request, id, options) {
     method: "DELETE"
   });
 }
-function listClusterUserKeys(request, input) {
-  return request(`${compute}/nodes/organizations/me/cluster-users${query2(input)}`, {
-    method: "GET"
-  });
-}
-function createClusterUserKey(request, body) {
-  return request(`${compute}/nodes/organizations/me/cluster-users`, { method: "POST", body });
-}
-function deleteClusterUserKey(request, id) {
-  return request(`${compute}/nodes/organizations/me/cluster-users/${encodeURIComponent(id)}`, {
-    method: "DELETE"
-  });
-}
 
 // ../../packages/api-client/dist/gateway/staff.js
 function addStaffReservationKey(request, id, body) {
@@ -307,12 +294,10 @@ export {
   claimSupplierIntakeEditor,
   consoleMcpPath,
   createAccountSshKey,
-  createClusterUserKey,
   createPylonIssue,
   createStaffTestMember,
   createSupportThread,
   deleteAccountSshKey,
-  deleteClusterUserKey,
   deleteSupplierIntakeDocument,
   deployReservationStorage,
   deployStaffNode,
@@ -338,7 +323,6 @@ export {
   linkPylonAccount,
   linkPylonIssue,
   listAccountSshKeys,
-  listClusterUserKeys,
   listClusters,
   listGithubCommitPulls,
   listGithubCommits,

package/vendor/capabilities/cli.js

@@ -3359,19 +3359,6 @@ function deleteAccountSshKey(request, id, options) {
     method: "DELETE"
   });
 }
-function listClusterUserKeys(request, input) {
-  return request(`${compute}/nodes/organizations/me/cluster-users${query2(input)}`, {
-    method: "GET"
-  });
-}
-function createClusterUserKey(request, body2) {
-  return request(`${compute}/nodes/organizations/me/cluster-users`, { method: "POST", body: body2 });
-}
-function deleteClusterUserKey(request, id) {
-  return request(`${compute}/nodes/organizations/me/cluster-users/${encodeURIComponent(id)}`, {
-    method: "DELETE"
-  });
-}
 
 // ../../packages/api-client/dist/gateway/index.js
 function getCliStatus(request) {
@@ -3474,6 +3461,7 @@ var publicKeyInput = z18.object({
   confirm: z18.boolean().optional()
 });
 var keyIdInput = z18.object({ keyId: z18.string(), confirm: z18.boolean().optional() });
+var reservationKeyInput = publicKeyInput.extend({ reservationId: z18.string() });
 var ADDED_KEY_OUTCOME = "The response's outcome field says whether the key was created, was already_registered (returned unchanged, so the submitted label is not applied), or was reactivated from a revoked key.";
 var keyListInput = z18.object({
   $positionals: positionals2,
@@ -3768,7 +3756,7 @@ var sshKeyListCapability = defineCapability({
   mutation: "read",
   input: pageInput.extend({ status: z18.enum(["active", "all"]).optional() }),
   description: "List a page of account SSH keys. Pass next_cursor as cursor to continue.",
-  mcp: { name: "ssh_keys_list", input: pageInput },
+  mcp: { name: "ssh_keys_list", aliases: ["cluster_users_list"], input: pageInput },
   slack: false,
   cli: {
     command: ["ssh-keys", "list"],
@@ -3802,7 +3790,7 @@ var sshKeyAddCapability = defineCapability({
     idempotencyKey: z18.string().optional()
   }),
   description: `Add an SSH public key to the account. ${ADDED_KEY_OUTCOME}`,
-  mcp: { name: "ssh_keys_add", input: publicKeyInput },
+  mcp: { name: "ssh_keys_add", aliases: ["cluster_users_add"], input: publicKeyInput },
   slack: false,
   cli: {
     command: ["ssh-keys", "add"],
@@ -3830,7 +3818,7 @@ var sshKeyDeleteCapability = defineCapability({
   mutation: "preview-confirm",
   input: keyIdInput.extend({ idempotencyKey: z18.string().optional() }),
   description: "Delete an SSH key from the account.",
-  mcp: { name: "ssh_keys_delete", input: keyIdInput },
+  mcp: { name: "ssh_keys_delete", aliases: ["cluster_users_revoke"], input: keyIdInput },
   slack: false,
   cli: {
     command: ["ssh-keys", "delete"],
@@ -3855,15 +3843,19 @@ var sshKeyDeleteCapability = defineCapability({
   },
   execute: async (context, input) => await deleteAccountSshKey(context.fetch, input.keyId, input.idempotencyKey ? { headers: { "Idempotency-Key": input.idempotencyKey } } : void 0) ?? { deleted: true }
 });
-var sshKeyAssignmentListCapability = cliOnly({
+var sshKeyAssignmentListCapability = defineCapability({
   id: "access.ssh_key_assignments.list",
   domain: "access",
   roles: ["user"],
   mutation: "read",
-  input: keyListInput,
-  description: "List SSH keys assigned to one capacity reservation.",
+  input: z18.object({ reservationId: z18.string() }),
+  description: "List SSH keys registered for a reservation.",
+  mcp: { name: "access_keys_list" },
+  slack: false,
   cli: {
     command: ["ssh-keys", "assignments", "list"],
+    input: keyListInput,
+    execute: executeSshKeys("assignments.list"),
     vnext: {
       arguments: "semantic",
       audience: "customer",
@@ -3876,17 +3868,24 @@ var sshKeyAssignmentListCapability = cliOnly({
       related: ["ssh-keys assignments status"]
     }
   },
-  execute: executeSshKeys("assignments.list")
+  execute: (context, input) => listReservationSshKeys(context.fetch, input.reservationId)
 });
-var sshKeyAssignmentAssignCapability = cliOnly({
+var sshKeyAssignmentAssignCapability = defineCapability({
   id: "access.ssh_key_assignments.assign",
   domain: "access",
   roles: ["user"],
   mutation: "preview-confirm",
-  input: keyMutationInput,
-  description: "Assign one existing organization SSH key to one capacity reservation.",
+  input: z18.union([
+    reservationKeyInput.extend({ idempotencyKey: z18.string().optional() }),
+    keyIdInput.extend({ reservationId: z18.string(), idempotencyKey: z18.string().optional() })
+  ]),
+  description: `Add an SSH key to a reservation. ${ADDED_KEY_OUTCOME}`,
+  mcp: { name: "access_keys_add", input: reservationKeyInput },
+  slack: false,
   cli: {
     command: ["ssh-keys", "assignments", "assign"],
+    input: keyMutationInput,
+    execute: executeSshKeys("assignments.assign"),
     vnext: {
       arguments: "semantic",
       audience: "customer",
@@ -3905,7 +3904,7 @@ var sshKeyAssignmentAssignCapability = cliOnly({
       related: ["ssh-keys assignments status"]
     }
   },
-  execute: executeSshKeys("assignments.assign")
+  execute: (context, input) => addReservationSshKey(context.fetch, input.reservationId, "keyId" in input ? { ssh_key_id: input.keyId } : { public_key: input.publicKey, label: input.label ?? null }, input.idempotencyKey ? { headers: { "Idempotency-Key": input.idempotencyKey } } : void 0)
 });
 var sshKeyAssignmentSyncCapability = cliOnly({
   id: "access.ssh_key_assignments.sync",
@@ -4047,29 +4046,6 @@ var accessVerbCapabilities = [
       ssh_key_ids: input.sshKeyIds
     })
   }),
-  defineCapability({
-    id: "access.keys.list",
-    domain: "access",
-    roles: ["user"],
-    description: "List SSH keys registered for a reservation.",
-    mutation: "read",
-    input: z18.object({ reservationId: z18.string() }),
-    slack: false,
-    execute: (ctx, input) => listReservationSshKeys(ctx.fetch, input.reservationId)
-  }),
-  defineCapability({
-    id: "access.keys.add",
-    domain: "access",
-    roles: ["user"],
-    description: `Add an SSH key to a reservation. ${ADDED_KEY_OUTCOME}`,
-    mutation: "preview-confirm",
-    input: publicKeyInput.extend({ reservationId: z18.string() }),
-    slack: false,
-    execute: (ctx, input) => addReservationSshKey(ctx.fetch, input.reservationId, {
-      label: input.label ?? null,
-      public_key: input.publicKey
-    })
-  }),
   defineCapability({
     id: "machine.reboot",
     domain: "access",
@@ -4091,43 +4067,6 @@ var accessVerbCapabilities = [
     mcp: { name: "nodes_hard_reset" },
     slack: false,
     execute: rebootMachine("hard_reset")
-  }),
-  defineCapability({
-    id: "cluster_users.list",
-    domain: "access",
-    roles: ["user"],
-    description: "List a page of organization cluster-user SSH keys. Pass next_cursor as cursor to continue.",
-    mutation: "read",
-    input: pageInput,
-    slack: false,
-    execute: (ctx, input) => listClusterUserKeys(ctx.fetch, {
-      status: "all",
-      limit: input.limit ?? 25,
-      ...input.cursor ? { cursor: input.cursor } : {}
-    })
-  }),
-  defineCapability({
-    id: "cluster_users.add",
-    domain: "access",
-    roles: ["user"],
-    description: "Add a cluster-user SSH public key to the organization. Registers the same organization key as ssh_keys_add; a key already registered is returned as-is with its existing label.",
-    mutation: "preview-confirm",
-    input: publicKeyInput,
-    slack: false,
-    execute: (ctx, input) => createClusterUserKey(ctx.fetch, {
-      public_key: input.publicKey,
-      label: input.label
-    })
-  }),
-  defineCapability({
-    id: "cluster_users.revoke",
-    domain: "access",
-    roles: ["user"],
-    description: "Revoke a cluster-user SSH key from the organization.",
-    mutation: "preview-confirm",
-    input: keyIdInput,
-    slack: false,
-    execute: async (ctx, input) => await deleteClusterUserKey(ctx.fetch, input.keyId) ?? { deleted: true }
   })
 ];
 
@@ -5765,24 +5704,54 @@ var vpnConfigureInput = z29.object({
   output: z29.string().optional(),
   privateKey: z29.string().optional()
 }).strict();
-function networkExecutor(context) {
-  const runtime3 = context.cli?.interaction;
-  if (!runtime3?.networks)
-    throw new Error("This capability must execute through the Ornn CLI network runtime.");
-  return runtime3.networks.bind(runtime3);
+function executeNetwork(command) {
+  return (context, input) => {
+    const runtime3 = context.cli?.interaction;
+    if (!runtime3?.networks)
+      throw new Error("This capability must execute through the Ornn CLI network runtime.");
+    return runtime3.networks(command, input, context);
+  };
 }
-function customerResource(specification) {
-  return defineCapability({ ...specification, mcp: false, slack: false });
+function mutationOptions(idempotencyKey) {
+  return idempotencyKey ? { headers: { "Idempotency-Key": idempotencyKey } } : void 0;
 }
-var privateNetworkListCapability = customerResource({
+var networkIdInput = z29.object({ networkId: z29.string() });
+var networkCreateFields = z29.object({
+  name: z29.string(),
+  cidr: z29.string().optional(),
+  description: z29.string().optional(),
+  confirm: z29.boolean().optional()
+});
+var networkUpdateFields = z29.object({
+  networkId: z29.string(),
+  name: z29.string().optional(),
+  description: z29.string().optional(),
+  clearDescription: z29.boolean().optional(),
+  confirm: z29.boolean().optional()
+}).refine((input) => !(input.clearDescription && input.description !== void 0), {
+  message: "Use either description or clearDescription, not both."
+}).refine((input) => input.name !== void 0 || input.description !== void 0 || input.clearDescription, { message: "Provide name, description, or clearDescription." });
+var networkDeleteInput = networkIdInput.extend({ confirm: z29.boolean().optional() });
+var vpnPeerCreateInput = z29.object({
+  publicKey: z29.string(),
+  label: z29.string().optional(),
+  confirm: z29.boolean().optional()
+});
+var vpnPeerDeleteInput = z29.object({ peerId: z29.string(), confirm: z29.boolean().optional() });
+var reservationInput = { reservationId: z29.string() };
+var privateNetworkListCapability = defineCapability({
   id: "networks.list",
   domain: "networks",
   roles: ["user"],
   mutation: "read",
-  input: listInput,
-  description: "List customer private networks with bounded pagination.",
+  input: z29.object({}),
+  description: "List this tenant's private networks.",
+  mcp: { name: "networks_list" },
+  slack: false,
   cli: {
     command: ["private-networks", "list"],
+    input: listInput,
+    execute: executeNetwork("private-networks list"),
     vnext: {
       arguments: "semantic",
       audience: "customer",
@@ -5794,17 +5763,21 @@ var privateNetworkListCapability = customerResource({
       related: ["private-networks show"]
     }
   },
-  execute: (ctx, input) => networkExecutor(ctx)("private-networks list", input, ctx)
+  execute: (ctx) => listNetworks(ctx.fetch)
 });
-var privateNetworkShowCapability = customerResource({
+var privateNetworkShowCapability = defineCapability({
   id: "networks.show",
   domain: "networks",
   roles: ["user"],
   mutation: "read",
-  input: noOptionsInput,
-  description: "Show one exact customer private network.",
+  input: networkIdInput,
+  description: "Show a single private network by id.",
+  mcp: { name: "networks_show" },
+  slack: false,
   cli: {
     command: ["private-networks", "show"],
+    input: noOptionsInput,
+    execute: executeNetwork("private-networks show"),
     vnext: {
       arguments: "semantic",
       audience: "customer",
@@ -5817,17 +5790,21 @@ var privateNetworkShowCapability = customerResource({
       related: ["private-networks list"]
     }
   },
-  execute: (ctx, input) => networkExecutor(ctx)("private-networks show", input, ctx)
+  execute: (ctx, input) => getNetwork(ctx.fetch, input.networkId)
 });
-var privateNetworkCreateCapability = customerResource({
+var privateNetworkCreateCapability = defineCapability({
   id: "networks.create",
   domain: "networks",
   roles: ["user"],
   mutation: "preview-confirm",
-  input: networkCreateInput,
-  description: "Create or safely replay a named customer private network.",
+  input: networkCreateFields.extend({ idempotencyKey: z29.string().optional() }),
+  description: "Create a private network.",
+  mcp: { name: "networks_create", input: networkCreateFields },
+  slack: false,
   cli: {
     command: ["private-networks", "create"],
+    input: networkCreateInput,
+    execute: executeNetwork("private-networks create"),
     vnext: {
       arguments: "semantic",
       audience: "customer",
@@ -5841,17 +5818,21 @@ var privateNetworkCreateCapability = customerResource({
       related: ["private-networks list"]
     }
   },
-  execute: (ctx, input) => networkExecutor(ctx)("private-networks create", input, ctx)
+  execute: (ctx, input) => createNetwork(ctx.fetch, { name: input.name, cidr: input.cidr ?? null, description: input.description ?? null }, mutationOptions(input.idempotencyKey))
 });
-var privateNetworkUpdateCapability = customerResource({
+var privateNetworkUpdateCapability = defineCapability({
   id: "networks.update",
   domain: "networks",
   roles: ["user"],
   mutation: "preview-confirm",
-  input: networkUpdateInput,
-  description: "Rename one exact customer private network.",
+  input: networkUpdateFields.safeExtend({ idempotencyKey: z29.string().optional() }),
+  description: "Update a private network's name or description. Pass clearDescription: true to null out the description instead of setting it.",
+  mcp: { name: "networks_update", input: networkUpdateFields },
+  slack: false,
   cli: {
     command: ["private-networks", "update"],
+    input: networkUpdateInput,
+    execute: executeNetwork("private-networks update"),
     vnext: {
       arguments: "semantic",
       audience: "customer",
@@ -5865,17 +5846,24 @@ var privateNetworkUpdateCapability = customerResource({
       related: ["private-networks show"]
     }
   },
-  execute: (ctx, input) => networkExecutor(ctx)("private-networks update", input, ctx)
+  execute: (ctx, input) => updateNetwork(ctx.fetch, input.networkId, {
+    ...input.name !== void 0 ? { name: input.name } : {},
+    ...input.clearDescription ? { description: null } : input.description !== void 0 ? { description: input.description } : {}
+  }, mutationOptions(input.idempotencyKey))
 });
-var privateNetworkDeleteCapability = customerResource({
+var privateNetworkDeleteCapability = defineCapability({
   id: "networks.delete",
   domain: "networks",
   roles: ["user"],
   mutation: "preview-confirm",
-  input: noOptionsInput,
-  description: "Delete an unattached customer private network.",
+  input: networkDeleteInput.extend({ idempotencyKey: z29.string().optional() }),
+  description: "Delete a private network.",
+  mcp: { name: "networks_delete", input: networkDeleteInput },
+  slack: false,
   cli: {
     command: ["private-networks", "delete"],
+    input: noOptionsInput,
+    execute: executeNetwork("private-networks delete"),
     vnext: {
       arguments: "semantic",
       audience: "customer",
@@ -5889,17 +5877,24 @@ var privateNetworkDeleteCapability = customerResource({
       related: ["private-networks list"]
     }
   },
-  execute: (ctx, input) => networkExecutor(ctx)("private-networks delete", input, ctx)
+  execute: async (ctx, input) => {
+    await deleteNetwork(ctx.fetch, input.networkId, mutationOptions(input.idempotencyKey));
+    return { deleted: true, network_id: input.networkId };
+  }
 });
-var vpnConnectionListCapability = customerResource({
+var vpnConnectionListCapability = defineCapability({
   id: "vpn.connections.list",
   domain: "vpn",
   roles: ["user"],
   mutation: "read",
-  input: listInput,
-  description: "List named VPN connections for one exact private target.",
+  input: z29.object({}),
+  description: "List WireGuard VPN peers registered on a reservation.",
+  mcp: { name: "vpn_peers_list", input: z29.object(reservationInput) },
+  slack: false,
   cli: {
     command: ["vpn-connections", "list"],
+    input: listInput,
+    execute: executeNetwork("vpn-connections list"),
     vnext: {
       arguments: "semantic",
       audience: "customer",
@@ -5912,17 +5907,24 @@ var vpnConnectionListCapability = customerResource({
       related: ["vpn-connections configure", "connect"]
     }
   },
-  execute: (ctx, input) => networkExecutor(ctx)("vpn-connections list", input, ctx)
+  execute: (ctx) => listNetworkPeerConfigs(ctx.fetch, "shared")
 });
-var vpnConnectionConfigureCapability = customerResource({
+var vpnConnectionConfigureCapability = defineCapability({
   id: "vpn.connections.configure",
   domain: "vpn",
   roles: ["user"],
   mutation: "preview-confirm",
-  input: vpnConfigureInput,
-  description: "Configure and explicitly export one named VPN connection.",
+  input: vpnPeerCreateInput.extend({ idempotencyKey: z29.string().optional() }),
+  description: "Register a WireGuard VPN peer public key on a reservation.",
+  mcp: {
+    name: "vpn_peers_create",
+    input: z29.object({ ...reservationInput, ...vpnPeerCreateInput.shape })
+  },
+  slack: false,
   cli: {
     command: ["vpn-connections", "configure"],
+    input: vpnConfigureInput,
+    execute: executeNetwork("vpn-connections configure"),
     vnext: {
       arguments: "semantic",
       audience: "customer",
@@ -5937,17 +5939,24 @@ var vpnConnectionConfigureCapability = customerResource({
       related: ["connect", "vpn-connections disconnect"]
     }
   },
-  execute: (ctx, input) => networkExecutor(ctx)("vpn-connections configure", input, ctx)
+  execute: (ctx, input) => createNetworkPeer(ctx.fetch, "shared", { public_key: input.publicKey, label: input.label ?? null }, mutationOptions(input.idempotencyKey))
 });
-var vpnConnectionDisconnectCapability = customerResource({
+var vpnConnectionDisconnectCapability = defineCapability({
   id: "vpn.connections.disconnect",
   domain: "vpn",
   roles: ["user"],
   mutation: "preview-confirm",
-  input: noOptionsInput,
-  description: "Disconnect one exact named VPN connection.",
+  input: vpnPeerDeleteInput.extend({ idempotencyKey: z29.string().optional() }),
+  description: "Revoke a WireGuard VPN peer from a reservation.",
+  mcp: {
+    name: "vpn_peers_delete",
+    input: z29.object({ ...reservationInput, ...vpnPeerDeleteInput.shape })
+  },
+  slack: false,
   cli: {
     command: ["vpn-connections", "disconnect"],
+    input: noOptionsInput,
+    execute: executeNetwork("vpn-connections disconnect"),
     vnext: {
       arguments: "semantic",
       audience: "customer",
@@ -5965,15 +5974,17 @@ var vpnConnectionDisconnectCapability = customerResource({
       related: ["vpn-connections configure"]
     }
   },
-  execute: (ctx, input) => networkExecutor(ctx)("vpn-connections disconnect", input, ctx)
+  execute: async (ctx, input) => await deleteNetworkPeer(ctx.fetch, "shared", input.peerId, mutationOptions(input.idempotencyKey)) ?? { deleted: true }
 });
-var connectCapability = customerResource({
+var connectCapability = defineCapability({
   id: "vpn.connect",
   domain: "vpn",
   roles: ["user"],
   mutation: "read",
   input: connectInput2,
   description: "Connect to one exact native machine or cluster target through recoverable private transport when required.",
+  mcp: false,
+  slack: false,
   cli: {
     command: ["connect"],
     vnext: {
@@ -5995,7 +6006,7 @@ var connectCapability = customerResource({
       related: ["launch", "vpn-connections configure", "clusters show"]
     }
   },
-  execute: (ctx, input) => networkExecutor(ctx)("connect", input, ctx)
+  execute: executeNetwork("connect")
 });
 var networkCapabilities = [
   privateNetworkListCapability,
@@ -6008,133 +6019,6 @@ var networkCapabilities = [
   vpnConnectionDisconnectCapability,
   connectCapability
 ];
-var networkUpdateFields = z29.object({
-  networkId: z29.string(),
-  name: z29.string().optional(),
-  description: z29.string().optional(),
-  clearDescription: z29.boolean().optional(),
-  confirm: z29.boolean().optional()
-}).refine((input) => !(input.clearDescription && input.description !== void 0), {
-  message: "Use either description or clearDescription, not both."
-}).refine((input) => input.name !== void 0 || input.description !== void 0 || input.clearDescription, { message: "Provide name, description, or clearDescription." });
-var networkVerbCapabilities = [
-  defineCapability({
-    id: "network.list",
-    domain: "networks",
-    roles: ["user"],
-    description: "List this tenant's private networks.",
-    mutation: "read",
-    input: z29.object({}),
-    mcp: { name: "networks_list" },
-    slack: false,
-    execute: (ctx) => listNetworks(ctx.fetch)
-  }),
-  defineCapability({
-    id: "network.show",
-    domain: "networks",
-    roles: ["user"],
-    description: "Show a single private network by id.",
-    mutation: "read",
-    input: z29.object({ networkId: z29.string() }),
-    mcp: { name: "networks_show" },
-    slack: false,
-    execute: (ctx, input) => getNetwork(ctx.fetch, input.networkId)
-  }),
-  defineCapability({
-    id: "network.create",
-    domain: "networks",
-    roles: ["user"],
-    description: "Create a private network.",
-    mutation: "preview-confirm",
-    input: z29.object({
-      name: z29.string(),
-      cidr: z29.string().optional(),
-      description: z29.string().optional(),
-      confirm: z29.boolean().optional()
-    }),
-    mcp: { name: "networks_create" },
-    slack: false,
-    execute: (ctx, input) => createNetwork(ctx.fetch, {
-      name: input.name,
-      cidr: input.cidr ?? null,
-      description: input.description ?? null
-    })
-  }),
-  defineCapability({
-    id: "network.update",
-    domain: "networks",
-    roles: ["user"],
-    description: "Update a private network's name or description. Pass clearDescription: true to null out the description instead of setting it.",
-    mutation: "preview-confirm",
-    input: networkUpdateFields,
-    mcp: { name: "networks_update" },
-    slack: false,
-    execute: (ctx, input) => updateNetwork(ctx.fetch, input.networkId, {
-      ...input.name !== void 0 ? { name: input.name } : {},
-      ...input.clearDescription ? { description: null } : input.description !== void 0 ? { description: input.description } : {}
-    })
-  }),
-  defineCapability({
-    id: "network.delete",
-    domain: "networks",
-    roles: ["user"],
-    description: "Delete a private network.",
-    mutation: "preview-confirm",
-    input: z29.object({ networkId: z29.string(), confirm: z29.boolean().optional() }),
-    mcp: { name: "networks_delete" },
-    slack: false,
-    // The route answers 204, so report which network went.
-    execute: async (ctx, input) => {
-      await deleteNetwork(ctx.fetch, input.networkId);
-      return { deleted: true, network_id: input.networkId };
-    }
-  }),
-  defineCapability({
-    id: "vpn.peers.list",
-    domain: "networks",
-    roles: ["user"],
-    description: "List WireGuard VPN peers registered on a reservation.",
-    mutation: "read",
-    input: z29.object({ reservationId: z29.string() }),
-    mcp: { name: "vpn_peers_list" },
-    slack: false,
-    execute: (ctx) => listNetworkPeerConfigs(ctx.fetch, "shared")
-  }),
-  defineCapability({
-    id: "vpn.peers.create",
-    domain: "networks",
-    roles: ["user"],
-    description: "Register a WireGuard VPN peer public key on a reservation.",
-    mutation: "preview-confirm",
-    input: z29.object({
-      reservationId: z29.string(),
-      publicKey: z29.string(),
-      label: z29.string().optional(),
-      confirm: z29.boolean().optional()
-    }),
-    mcp: { name: "vpn_peers_create" },
-    slack: false,
-    execute: (ctx, input) => createNetworkPeer(ctx.fetch, "shared", {
-      public_key: input.publicKey,
-      label: input.label ?? null
-    })
-  }),
-  defineCapability({
-    id: "vpn.peers.delete",
-    domain: "networks",
-    roles: ["user"],
-    description: "Revoke a WireGuard VPN peer from a reservation.",
-    mutation: "preview-confirm",
-    input: z29.object({
-      reservationId: z29.string(),
-      peerId: z29.string(),
-      confirm: z29.boolean().optional()
-    }),
-    mcp: { name: "vpn_peers_delete" },
-    slack: false,
-    execute: async (ctx, input) => await deleteNetworkPeer(ctx.fetch, "shared", input.peerId) ?? { deleted: true }
-  })
-];
 
 // ../../packages/capabilities/dist/capabilities/registry.js
 import { z as z30 } from "zod";
@@ -6724,8 +6608,8 @@ var volumeCapabilities = [
     related: ["volumes files list"]
   })
 ];
-var reservationInput = z32.object({ reservationId: z32.string() });
-var reservationWrite = reservationInput.extend({ confirm: z32.boolean().optional() });
+var reservationInput2 = z32.object({ reservationId: z32.string() });
+var reservationWrite = reservationInput2.extend({ confirm: z32.boolean().optional() });
 var driveInput = z32.object({ driveId: z32.string() });
 var driveWrite = driveInput.extend({ confirm: z32.boolean().optional() });
 var bucketConnectInput = z32.object({
@@ -6777,7 +6661,7 @@ var storageVerbCapabilities = [
     roles: ["user"],
     description: "Show a reservation's storage deployment (attachment) status.",
     mutation: "read",
-    input: reservationInput,
+    input: reservationInput2,
     slack: false,
     execute: (ctx, input) => getReservationStorageAttachment(ctx.fetch, input.reservationId)
   }),
@@ -6971,7 +6855,6 @@ var catalog = [
       ...evidenceCapabilities,
       ...observabilityCapabilities,
       ...clusterCapabilities,
-      ...networkVerbCapabilities,
       ...accessVerbCapabilities,
       ...storageVerbCapabilities,
       reservationKeysPushCapability,
@@ -7263,10 +7146,20 @@ export {
   metricsHistoryCapability,
   metricsSnapshotCapability,
   parseHardwareCatalog,
+  privateNetworkCreateCapability,
+  privateNetworkDeleteCapability,
+  privateNetworkListCapability,
+  privateNetworkShowCapability,
+  privateNetworkUpdateCapability,
   sshKeyAddCapability,
+  sshKeyAssignmentAssignCapability,
+  sshKeyAssignmentListCapability,
   sshKeyAssignmentStatusCapability,
   sshKeyDeleteCapability,
   sshKeyDeliveryStatus,
   sshKeyListCapability,
-  volumeFilesListCapability
+  volumeFilesListCapability,
+  vpnConnectionConfigureCapability,
+  vpnConnectionDisconnectCapability,
+  vpnConnectionListCapability
 };