@ornncompute/cli 1.0.143 → 1.0.145

package/README.md

@@ -259,6 +259,8 @@ never contains admin children. There is no second parser or command registry.
 An eligible human context requires TTY stdin and TTY stdout and no JSON/NDJSON
 format. Human commands may guide selection and render a normalized summary;
 mutations execute immediately without a confirmation prompt.
+This also applies to `volumes clear` when a noninteractive caller supplies an
+explicit output format.
 
 Automation supplies complete semantic inputs and an explicit format:
 
@@ -449,9 +451,10 @@ command UX changes. The smoke runner refuses production and shared staging.
 See [`docs/packaged-vnext-release-gate.md`](docs/packaged-vnext-release-gate.md).
 
 Private networks and VPN peers belong to the selected organization. There is no
-per-reservation network attachment step. Requests use the native Orchestrator
-network client; the catalog retains command metadata and the CLI owns network
-presentation, connection recovery, and local WireGuard config export.
+per-reservation network attachment step. CLI and MCP share network and VPN peer
+capabilities over the native Orchestrator network client. The CLI retains name
+resolution, review, replay, local pagination, connection recovery, and local
+WireGuard key/config files.
 Durable Bare Metal workspaces use
 `--network shared --volume <volume-id> --mount-access read-only|read-write`;
 private Kubernetes and Slurm launches continue to use `--network private`.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ornncompute/cli",
-  "version": "1.0.143",
+  "version": "1.0.145",
   "description": "Command-line interface for Ornn compute access workflows.",
   "type": "module",
   "bin": {

package/src/network-commands.mjs

@@ -1,14 +1,14 @@
 import { getReservation } from "../vendor/api-client/commerce.js";
 import {
-  createNetwork,
-  createNetworkPeer,
-  deleteNetwork,
-  deleteNetworkPeer,
-  getNetwork,
-  listNetworkPeerConfigs,
-  listNetworks,
-  updateNetwork,
-} from "../vendor/api-client/orchestrator.js";
+  privateNetworkCreateCapability,
+  privateNetworkDeleteCapability,
+  privateNetworkListCapability,
+  privateNetworkShowCapability,
+  privateNetworkUpdateCapability,
+  vpnConnectionConfigureCapability,
+  vpnConnectionDisconnectCapability,
+  vpnConnectionListCapability,
+} from "../vendor/capabilities/cli.js";
 import { z } from "zod";
 
 const CANONICAL_ID = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
@@ -108,10 +108,6 @@ function requireMutationKey(runtime, input) {
   return key;
 }
 
-function mutationHeaders(key) {
-  return key ? { "Idempotency-Key": key } : undefined;
-}
-
 function lifecycle(statusValue) {
   const status = text(statusValue)?.toLowerCase() ?? "unknown";
   if (["active", "ready", "applied", "connected"].includes(status)) {
@@ -189,12 +185,12 @@ function networkFromMutation(payload) {
 }
 
 async function fetchNetworks(context) {
-  return networkRows(await listNetworks(context.fetch));
+  return networkRows(await privateNetworkListCapability.execute(context, {}));
 }
 
 async function resolveNetwork(context, runtime, reference) {
   if (CANONICAL_ID.test(reference)) {
-    return record(await getNetwork(context.fetch, reference));
+    return record(await privateNetworkShowCapability.execute(context, { networkId: reference }));
   }
   const wanted = normalizedName(reference);
   const matches = (await fetchNetworks(context)).filter(
@@ -404,13 +400,11 @@ async function createPrivateNetwork(context, input) {
     }))
   )
     return declined(runtime);
-  const created = await createNetwork(
-    context.fetch,
-    { name, ...(cidr ? { cidr } : {}) },
-    {
-      headers: mutationHeaders(idempotencyKey),
-    }
-  );
+  const created = await privateNetworkCreateCapability.execute(context, {
+    name,
+    ...(cidr ? { cidr } : {}),
+    idempotencyKey,
+  });
   return networkMutationExecution(runtime, networkFromMutation(created), false);
 }
 
@@ -456,14 +450,11 @@ async function updatePrivateNetwork(context, input) {
     }))
   )
     return declined(runtime);
-  const updated = await updateNetwork(
-    context.fetch,
-    String(current.id),
-    { name },
-    {
-      headers: mutationHeaders(idempotencyKey),
-    }
-  );
+  const updated = await privateNetworkUpdateCapability.execute(context, {
+    networkId: String(current.id),
+    name,
+    idempotencyKey,
+  });
   const network = networkFromMutation(updated);
   return runtime.result({
     data: { private_network: network, replayed: false },
@@ -496,8 +487,9 @@ async function deletePrivateNetwork(context, input) {
     }))
   )
     return declined(runtime);
-  await deleteNetwork(context.fetch, String(projected.id), {
-    headers: mutationHeaders(idempotencyKey),
+  await privateNetworkDeleteCapability.execute(context, {
+    networkId: String(projected.id),
+    idempotencyKey,
   });
   return runtime.result({
     data: { deleted: true, private_network: projected },
@@ -546,7 +538,7 @@ function vpnLines(connection) {
 }
 
 async function listVpnPayloads(context) {
-  return vpnPayloadRows(await listNetworkPeerConfigs(context.fetch, "shared"));
+  return vpnPayloadRows(await vpnConnectionListCapability.execute(context, {}));
 }
 
 async function listVpnConnections(context, input) {
@@ -798,14 +790,11 @@ async function configureVpnConnection(context, input) {
   )
     return declined(runtime);
   const applied = record(
-    await createNetworkPeer(
-      context.fetch,
-      "shared",
-      { label: effectiveName, public_key: publicKey },
-      {
-        headers: mutationHeaders(idempotencyKey),
-      }
-    )
+    await vpnConnectionConfigureCapability.execute(context, {
+      label: effectiveName,
+      publicKey,
+      idempotencyKey,
+    })
   );
   const exported = await exportVpnConfig(runtime, input, applied.config, privateKeyPath, publicKey);
   const connection = projectVpnConnection(applied, target);
@@ -854,8 +843,9 @@ async function disconnectVpnConnection(context, input) {
     }))
   )
     return declined(runtime);
-  await deleteNetworkPeer(context.fetch, "shared", String(connection.id), {
-    headers: mutationHeaders(idempotencyKey),
+  await vpnConnectionDisconnectCapability.execute(context, {
+    peerId: String(connection.id),
+    idempotencyKey,
   });
   return runtime.result({
     data: { disconnected: true, vpn_connection: connection },
@@ -1026,7 +1016,9 @@ async function connectPrivateTarget(context, input) {
     });
   }
 
-  const shared = record(await getNetwork(context.fetch, "shared"));
+  const shared = record(
+    await privateNetworkShowCapability.execute(context, { networkId: "shared" })
+  );
   const privateNetwork = projectNetwork({
     ...record(shared.network),
     id: "shared",

package/src/storage-commands.mjs

@@ -1,5 +1,14 @@
 import * as storageApi from "../vendor/api-client/orchestrator.js";
-import { bucketListCapability, volumeFilesListCapability } from "../vendor/capabilities/cli.js";
+import {
+  bucketListCapability,
+  volumeListCapability,
+  volumeShowCapability,
+  volumeCreateCapability,
+  volumeRefreshCapability,
+  volumeClearCapability,
+  volumeDeleteCapability,
+  volumeFilesListCapability,
+} from "../vendor/capabilities/cli.js";
 import { createHash } from "node:crypto";
 import { createReadStream } from "node:fs";
 import { stat } from "node:fs/promises";
@@ -300,7 +309,10 @@ export async function fetchDrivePage(runtime, { limit = 25, cursor, scope = "all
             { actor: "", role: "user", fetch: runtime.fetch },
             input
           )
-        : await storageApi.listDrives(runtime.fetch, { ...input, scope });
+        : await volumeListCapability.execute(
+            { actor: "", role: "user", fetch: runtime.fetch },
+            { ...input, scope }
+          );
     return { drives: volumeRows(payload), next_cursor: payload?.next_cursor ?? null };
   } catch (error) {
     throw safeStorageError(error, "Volumes could not be loaded safely.");
@@ -349,7 +361,10 @@ function resolveFromRows(rows, reference, { source = false } = {}) {
 
 export async function resolveVolume(runtime, reference) {
   if (/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(reference)) {
-    const drive = await storageApi.getDrive(runtime.fetch, reference);
+    const drive = await volumeShowCapability.execute(
+      { actor: "", role: "user", fetch: runtime.fetch },
+      { driveId: reference }
+    );
     return resolveFromRows([drive], reference);
   }
   return resolveFromRows(await fetchDrives(runtime), reference);
@@ -395,11 +410,15 @@ async function createVolume(input, runtime) {
     });
   }
 
-  const body = { name, source_drive_id: source ? String(source.id) : null };
   try {
-    const created = await storageApi.createDrive(runtime.fetch, body, {
-      headers: idempotencyHeaders(input),
-    });
+    const created = await volumeCreateCapability.execute(
+      { actor: "", role: "user", fetch: runtime.fetch },
+      {
+        name,
+        sourceDriveId: source ? String(source.id) : undefined,
+        idempotencyKey: String(input.idempotencyKey ?? "").trim() || undefined,
+      }
+    );
     return runtime.interaction.result({
       data: { effective_input: effective, replayed: false, volume: safeVolume(created) },
       outcome: { class: "ready", phase: "created" },
@@ -454,7 +473,10 @@ async function showVolume(input, runtime, { refresh = false } = {}) {
     return runtime.interaction.result({ data: { volume: safeVolume(drive) } });
   }
   try {
-    const refreshed = await storageApi.getDrive(runtime.fetch, String(drive.id), { refresh: true });
+    const refreshed = await volumeRefreshCapability.execute(
+      { actor: "", role: "user", fetch: runtime.fetch },
+      { driveId: String(drive.id) }
+    );
     return runtime.interaction.result({
       data: { volume: safeVolume(refreshed) },
       outcome: { class: "ready", phase: "refreshed" },
@@ -469,7 +491,10 @@ async function clearVolume(input, runtime) {
   const [reference] = positionals(input, 1, "Usage: ornn volumes clear <volume>");
   const drive = await resolveVolume(runtime, reference);
   try {
-    const payload = await storageApi.clearDriveContents(runtime.fetch, String(drive.id));
+    const payload = await volumeClearCapability.execute(
+      { actor: "", role: "user", fetch: runtime.fetch },
+      { driveId: String(drive.id) }
+    );
     return runtime.interaction.result({
       data: {
         cleared: true,
@@ -504,11 +529,12 @@ async function deleteVolume(input, runtime) {
   requireMachineMutationKey(input, runtime);
   const drive = await resolveVolume(runtime, reference);
   try {
-    await storageApi.deleteDrive(
-      runtime.fetch,
-      String(drive.id),
-      {},
-      { headers: idempotencyHeaders(input) }
+    await volumeDeleteCapability.execute(
+      { actor: "", role: "user", fetch: runtime.fetch },
+      {
+        driveId: String(drive.id),
+        idempotencyKey: String(input.idempotencyKey ?? "").trim() || undefined,
+      }
     );
     return runtime.interaction.result({
       data: { deleted: true, volume: safeVolume(drive) },

package/vendor/capabilities/cli.js

@@ -5704,24 +5704,54 @@ var vpnConfigureInput = z29.object({
   output: z29.string().optional(),
   privateKey: z29.string().optional()
 }).strict();
-function networkExecutor(context) {
-  const runtime3 = context.cli?.interaction;
-  if (!runtime3?.networks)
-    throw new Error("This capability must execute through the Ornn CLI network runtime.");
-  return runtime3.networks.bind(runtime3);
+function executeNetwork(command) {
+  return (context, input) => {
+    const runtime3 = context.cli?.interaction;
+    if (!runtime3?.networks)
+      throw new Error("This capability must execute through the Ornn CLI network runtime.");
+    return runtime3.networks(command, input, context);
+  };
 }
-function customerResource(specification) {
-  return defineCapability({ ...specification, mcp: false, slack: false });
+function mutationOptions(idempotencyKey) {
+  return idempotencyKey ? { headers: { "Idempotency-Key": idempotencyKey } } : void 0;
 }
-var privateNetworkListCapability = customerResource({
+var networkIdInput = z29.object({ networkId: z29.string() });
+var networkCreateFields = z29.object({
+  name: z29.string(),
+  cidr: z29.string().optional(),
+  description: z29.string().optional(),
+  confirm: z29.boolean().optional()
+});
+var networkUpdateFields = z29.object({
+  networkId: z29.string(),
+  name: z29.string().optional(),
+  description: z29.string().optional(),
+  clearDescription: z29.boolean().optional(),
+  confirm: z29.boolean().optional()
+}).refine((input) => !(input.clearDescription && input.description !== void 0), {
+  message: "Use either description or clearDescription, not both."
+}).refine((input) => input.name !== void 0 || input.description !== void 0 || input.clearDescription, { message: "Provide name, description, or clearDescription." });
+var networkDeleteInput = networkIdInput.extend({ confirm: z29.boolean().optional() });
+var vpnPeerCreateInput = z29.object({
+  publicKey: z29.string(),
+  label: z29.string().optional(),
+  confirm: z29.boolean().optional()
+});
+var vpnPeerDeleteInput = z29.object({ peerId: z29.string(), confirm: z29.boolean().optional() });
+var reservationInput = { reservationId: z29.string() };
+var privateNetworkListCapability = defineCapability({
   id: "networks.list",
   domain: "networks",
   roles: ["user"],
   mutation: "read",
-  input: listInput,
-  description: "List customer private networks with bounded pagination.",
+  input: z29.object({}),
+  description: "List this tenant's private networks.",
+  mcp: { name: "networks_list" },
+  slack: false,
   cli: {
     command: ["private-networks", "list"],
+    input: listInput,
+    execute: executeNetwork("private-networks list"),
     vnext: {
       arguments: "semantic",
       audience: "customer",
@@ -5733,17 +5763,21 @@ var privateNetworkListCapability = customerResource({
       related: ["private-networks show"]
     }
   },
-  execute: (ctx, input) => networkExecutor(ctx)("private-networks list", input, ctx)
+  execute: (ctx) => listNetworks(ctx.fetch)
 });
-var privateNetworkShowCapability = customerResource({
+var privateNetworkShowCapability = defineCapability({
   id: "networks.show",
   domain: "networks",
   roles: ["user"],
   mutation: "read",
-  input: noOptionsInput,
-  description: "Show one exact customer private network.",
+  input: networkIdInput,
+  description: "Show a single private network by id.",
+  mcp: { name: "networks_show" },
+  slack: false,
   cli: {
     command: ["private-networks", "show"],
+    input: noOptionsInput,
+    execute: executeNetwork("private-networks show"),
     vnext: {
       arguments: "semantic",
       audience: "customer",
@@ -5756,17 +5790,21 @@ var privateNetworkShowCapability = customerResource({
       related: ["private-networks list"]
     }
   },
-  execute: (ctx, input) => networkExecutor(ctx)("private-networks show", input, ctx)
+  execute: (ctx, input) => getNetwork(ctx.fetch, input.networkId)
 });
-var privateNetworkCreateCapability = customerResource({
+var privateNetworkCreateCapability = defineCapability({
   id: "networks.create",
   domain: "networks",
   roles: ["user"],
   mutation: "preview-confirm",
-  input: networkCreateInput,
-  description: "Create or safely replay a named customer private network.",
+  input: networkCreateFields.extend({ idempotencyKey: z29.string().optional() }),
+  description: "Create a private network.",
+  mcp: { name: "networks_create", input: networkCreateFields },
+  slack: false,
   cli: {
     command: ["private-networks", "create"],
+    input: networkCreateInput,
+    execute: executeNetwork("private-networks create"),
     vnext: {
       arguments: "semantic",
       audience: "customer",
@@ -5780,17 +5818,21 @@ var privateNetworkCreateCapability = customerResource({
       related: ["private-networks list"]
     }
   },
-  execute: (ctx, input) => networkExecutor(ctx)("private-networks create", input, ctx)
+  execute: (ctx, input) => createNetwork(ctx.fetch, { name: input.name, cidr: input.cidr ?? null, description: input.description ?? null }, mutationOptions(input.idempotencyKey))
 });
-var privateNetworkUpdateCapability = customerResource({
+var privateNetworkUpdateCapability = defineCapability({
   id: "networks.update",
   domain: "networks",
   roles: ["user"],
   mutation: "preview-confirm",
-  input: networkUpdateInput,
-  description: "Rename one exact customer private network.",
+  input: networkUpdateFields.safeExtend({ idempotencyKey: z29.string().optional() }),
+  description: "Update a private network's name or description. Pass clearDescription: true to null out the description instead of setting it.",
+  mcp: { name: "networks_update", input: networkUpdateFields },
+  slack: false,
   cli: {
     command: ["private-networks", "update"],
+    input: networkUpdateInput,
+    execute: executeNetwork("private-networks update"),
     vnext: {
       arguments: "semantic",
       audience: "customer",
@@ -5804,17 +5846,24 @@ var privateNetworkUpdateCapability = customerResource({
       related: ["private-networks show"]
     }
   },
-  execute: (ctx, input) => networkExecutor(ctx)("private-networks update", input, ctx)
+  execute: (ctx, input) => updateNetwork(ctx.fetch, input.networkId, {
+    ...input.name !== void 0 ? { name: input.name } : {},
+    ...input.clearDescription ? { description: null } : input.description !== void 0 ? { description: input.description } : {}
+  }, mutationOptions(input.idempotencyKey))
 });
-var privateNetworkDeleteCapability = customerResource({
+var privateNetworkDeleteCapability = defineCapability({
   id: "networks.delete",
   domain: "networks",
   roles: ["user"],
   mutation: "preview-confirm",
-  input: noOptionsInput,
-  description: "Delete an unattached customer private network.",
+  input: networkDeleteInput.extend({ idempotencyKey: z29.string().optional() }),
+  description: "Delete a private network.",
+  mcp: { name: "networks_delete", input: networkDeleteInput },
+  slack: false,
   cli: {
     command: ["private-networks", "delete"],
+    input: noOptionsInput,
+    execute: executeNetwork("private-networks delete"),
     vnext: {
       arguments: "semantic",
       audience: "customer",
@@ -5828,17 +5877,24 @@ var privateNetworkDeleteCapability = customerResource({
       related: ["private-networks list"]
     }
   },
-  execute: (ctx, input) => networkExecutor(ctx)("private-networks delete", input, ctx)
+  execute: async (ctx, input) => {
+    await deleteNetwork(ctx.fetch, input.networkId, mutationOptions(input.idempotencyKey));
+    return { deleted: true, network_id: input.networkId };
+  }
 });
-var vpnConnectionListCapability = customerResource({
+var vpnConnectionListCapability = defineCapability({
   id: "vpn.connections.list",
   domain: "vpn",
   roles: ["user"],
   mutation: "read",
-  input: listInput,
-  description: "List named VPN connections for one exact private target.",
+  input: z29.object({}),
+  description: "List WireGuard VPN peers registered on a reservation.",
+  mcp: { name: "vpn_peers_list", input: z29.object(reservationInput) },
+  slack: false,
   cli: {
     command: ["vpn-connections", "list"],
+    input: listInput,
+    execute: executeNetwork("vpn-connections list"),
     vnext: {
       arguments: "semantic",
       audience: "customer",
@@ -5851,17 +5907,24 @@ var vpnConnectionListCapability = customerResource({
       related: ["vpn-connections configure", "connect"]
     }
   },
-  execute: (ctx, input) => networkExecutor(ctx)("vpn-connections list", input, ctx)
+  execute: (ctx) => listNetworkPeerConfigs(ctx.fetch, "shared")
 });
-var vpnConnectionConfigureCapability = customerResource({
+var vpnConnectionConfigureCapability = defineCapability({
   id: "vpn.connections.configure",
   domain: "vpn",
   roles: ["user"],
   mutation: "preview-confirm",
-  input: vpnConfigureInput,
-  description: "Configure and explicitly export one named VPN connection.",
+  input: vpnPeerCreateInput.extend({ idempotencyKey: z29.string().optional() }),
+  description: "Register a WireGuard VPN peer public key on a reservation.",
+  mcp: {
+    name: "vpn_peers_create",
+    input: z29.object({ ...reservationInput, ...vpnPeerCreateInput.shape })
+  },
+  slack: false,
   cli: {
     command: ["vpn-connections", "configure"],
+    input: vpnConfigureInput,
+    execute: executeNetwork("vpn-connections configure"),
     vnext: {
       arguments: "semantic",
       audience: "customer",
@@ -5876,17 +5939,24 @@ var vpnConnectionConfigureCapability = customerResource({
       related: ["connect", "vpn-connections disconnect"]
     }
   },
-  execute: (ctx, input) => networkExecutor(ctx)("vpn-connections configure", input, ctx)
+  execute: (ctx, input) => createNetworkPeer(ctx.fetch, "shared", { public_key: input.publicKey, label: input.label ?? null }, mutationOptions(input.idempotencyKey))
 });
-var vpnConnectionDisconnectCapability = customerResource({
+var vpnConnectionDisconnectCapability = defineCapability({
   id: "vpn.connections.disconnect",
   domain: "vpn",
   roles: ["user"],
   mutation: "preview-confirm",
-  input: noOptionsInput,
-  description: "Disconnect one exact named VPN connection.",
+  input: vpnPeerDeleteInput.extend({ idempotencyKey: z29.string().optional() }),
+  description: "Revoke a WireGuard VPN peer from a reservation.",
+  mcp: {
+    name: "vpn_peers_delete",
+    input: z29.object({ ...reservationInput, ...vpnPeerDeleteInput.shape })
+  },
+  slack: false,
   cli: {
     command: ["vpn-connections", "disconnect"],
+    input: noOptionsInput,
+    execute: executeNetwork("vpn-connections disconnect"),
     vnext: {
       arguments: "semantic",
       audience: "customer",
@@ -5904,15 +5974,17 @@ var vpnConnectionDisconnectCapability = customerResource({
       related: ["vpn-connections configure"]
     }
   },
-  execute: (ctx, input) => networkExecutor(ctx)("vpn-connections disconnect", input, ctx)
+  execute: async (ctx, input) => await deleteNetworkPeer(ctx.fetch, "shared", input.peerId, mutationOptions(input.idempotencyKey)) ?? { deleted: true }
 });
-var connectCapability = customerResource({
+var connectCapability = defineCapability({
   id: "vpn.connect",
   domain: "vpn",
   roles: ["user"],
   mutation: "read",
   input: connectInput2,
   description: "Connect to one exact native machine or cluster target through recoverable private transport when required.",
+  mcp: false,
+  slack: false,
   cli: {
     command: ["connect"],
     vnext: {
@@ -5934,7 +6006,7 @@ var connectCapability = customerResource({
       related: ["launch", "vpn-connections configure", "clusters show"]
     }
   },
-  execute: (ctx, input) => networkExecutor(ctx)("connect", input, ctx)
+  execute: executeNetwork("connect")
 });
 var networkCapabilities = [
   privateNetworkListCapability,
@@ -5947,133 +6019,6 @@ var networkCapabilities = [
   vpnConnectionDisconnectCapability,
   connectCapability
 ];
-var networkUpdateFields = z29.object({
-  networkId: z29.string(),
-  name: z29.string().optional(),
-  description: z29.string().optional(),
-  clearDescription: z29.boolean().optional(),
-  confirm: z29.boolean().optional()
-}).refine((input) => !(input.clearDescription && input.description !== void 0), {
-  message: "Use either description or clearDescription, not both."
-}).refine((input) => input.name !== void 0 || input.description !== void 0 || input.clearDescription, { message: "Provide name, description, or clearDescription." });
-var networkVerbCapabilities = [
-  defineCapability({
-    id: "network.list",
-    domain: "networks",
-    roles: ["user"],
-    description: "List this tenant's private networks.",
-    mutation: "read",
-    input: z29.object({}),
-    mcp: { name: "networks_list" },
-    slack: false,
-    execute: (ctx) => listNetworks(ctx.fetch)
-  }),
-  defineCapability({
-    id: "network.show",
-    domain: "networks",
-    roles: ["user"],
-    description: "Show a single private network by id.",
-    mutation: "read",
-    input: z29.object({ networkId: z29.string() }),
-    mcp: { name: "networks_show" },
-    slack: false,
-    execute: (ctx, input) => getNetwork(ctx.fetch, input.networkId)
-  }),
-  defineCapability({
-    id: "network.create",
-    domain: "networks",
-    roles: ["user"],
-    description: "Create a private network.",
-    mutation: "preview-confirm",
-    input: z29.object({
-      name: z29.string(),
-      cidr: z29.string().optional(),
-      description: z29.string().optional(),
-      confirm: z29.boolean().optional()
-    }),
-    mcp: { name: "networks_create" },
-    slack: false,
-    execute: (ctx, input) => createNetwork(ctx.fetch, {
-      name: input.name,
-      cidr: input.cidr ?? null,
-      description: input.description ?? null
-    })
-  }),
-  defineCapability({
-    id: "network.update",
-    domain: "networks",
-    roles: ["user"],
-    description: "Update a private network's name or description. Pass clearDescription: true to null out the description instead of setting it.",
-    mutation: "preview-confirm",
-    input: networkUpdateFields,
-    mcp: { name: "networks_update" },
-    slack: false,
-    execute: (ctx, input) => updateNetwork(ctx.fetch, input.networkId, {
-      ...input.name !== void 0 ? { name: input.name } : {},
-      ...input.clearDescription ? { description: null } : input.description !== void 0 ? { description: input.description } : {}
-    })
-  }),
-  defineCapability({
-    id: "network.delete",
-    domain: "networks",
-    roles: ["user"],
-    description: "Delete a private network.",
-    mutation: "preview-confirm",
-    input: z29.object({ networkId: z29.string(), confirm: z29.boolean().optional() }),
-    mcp: { name: "networks_delete" },
-    slack: false,
-    // The route answers 204, so report which network went.
-    execute: async (ctx, input) => {
-      await deleteNetwork(ctx.fetch, input.networkId);
-      return { deleted: true, network_id: input.networkId };
-    }
-  }),
-  defineCapability({
-    id: "vpn.peers.list",
-    domain: "networks",
-    roles: ["user"],
-    description: "List WireGuard VPN peers registered on a reservation.",
-    mutation: "read",
-    input: z29.object({ reservationId: z29.string() }),
-    mcp: { name: "vpn_peers_list" },
-    slack: false,
-    execute: (ctx) => listNetworkPeerConfigs(ctx.fetch, "shared")
-  }),
-  defineCapability({
-    id: "vpn.peers.create",
-    domain: "networks",
-    roles: ["user"],
-    description: "Register a WireGuard VPN peer public key on a reservation.",
-    mutation: "preview-confirm",
-    input: z29.object({
-      reservationId: z29.string(),
-      publicKey: z29.string(),
-      label: z29.string().optional(),
-      confirm: z29.boolean().optional()
-    }),
-    mcp: { name: "vpn_peers_create" },
-    slack: false,
-    execute: (ctx, input) => createNetworkPeer(ctx.fetch, "shared", {
-      public_key: input.publicKey,
-      label: input.label ?? null
-    })
-  }),
-  defineCapability({
-    id: "vpn.peers.delete",
-    domain: "networks",
-    roles: ["user"],
-    description: "Revoke a WireGuard VPN peer from a reservation.",
-    mutation: "preview-confirm",
-    input: z29.object({
-      reservationId: z29.string(),
-      peerId: z29.string(),
-      confirm: z29.boolean().optional()
-    }),
-    mcp: { name: "vpn_peers_delete" },
-    slack: false,
-    execute: async (ctx, input) => await deleteNetworkPeer(ctx.fetch, "shared", input.peerId) ?? { deleted: true }
-  })
-];
 
 // ../../packages/capabilities/dist/capabilities/registry.js
 import { z as z30 } from "zod";
@@ -6547,74 +6492,188 @@ var volumeFilesListCapability = defineCapability({
     }
   }
 });
-var volumeCapabilities = [
-  storageCapability({
-    id: "storage.volumes.list",
-    command: ["volumes", "list"],
-    description: "List managed volumes in one bounded page.",
-    mutation: "read",
-    outcome: "List durable managed volumes independently from their mounts.",
-    human: "ornn volumes list [--limit <1-100>] [--cursor <cursor>]",
-    automation: "ornn volumes list --limit 50 --format json",
-    related: ["volumes show", "volumes create"]
+var volumePageInput = z32.object({
+  limit: z32.number().int().min(1).max(100).optional(),
+  cursor: z32.string().optional()
+});
+var driveInput = z32.object({ driveId: z32.string() });
+var driveWrite = driveInput.extend({ confirm: z32.boolean().optional() });
+var volumeCreateInput = z32.object({
+  name: z32.string(),
+  sourceDriveId: z32.string().optional(),
+  confirm: z32.boolean().optional()
+});
+var volumeListCapability = defineCapability({
+  id: "storage.volumes.list",
+  domain: "storage",
+  roles: ["user"],
+  description: "List a page of storage volumes, newest updated first. Pass next_cursor as cursor to continue.",
+  mutation: "read",
+  input: volumePageInput.extend({ scope: z32.enum(["all", "managed"]).optional() }),
+  mcp: { name: "storage_volumes_list", input: volumePageInput },
+  slack: false,
+  execute: (context, input) => listDrives(context.fetch, {
+    limit: input.limit ?? 25,
+    ...input.cursor ? { cursor: input.cursor } : {},
+    ...input.scope ? { scope: input.scope } : {}
   }),
-  storageCapability({
-    id: "storage.volumes.show",
+  cli: {
+    command: ["volumes", "list"],
+    input: storageCliInput,
+    execute: (context, input) => storageExecutor(context)("storage.volumes.list", input),
+    vnext: {
+      arguments: "semantic",
+      audience: "customer",
+      category: "resource",
+      outcome: "List durable managed volumes independently from their mounts.",
+      human: "ornn volumes list [--limit <1-100>] [--cursor <cursor>]",
+      automation: "ornn volumes list --limit 50 --format json",
+      related: ["volumes show", "volumes create"]
+    }
+  }
+});
+var volumeShowCapability = defineCapability({
+  id: "storage.volumes.show",
+  domain: "storage",
+  roles: ["user"],
+  description: "Show a single storage volume (drive) by id.",
+  mutation: "read",
+  input: driveInput,
+  mcp: { name: "storage_volumes_show" },
+  slack: false,
+  execute: (context, input) => getDrive(context.fetch, input.driveId),
+  cli: {
     command: ["volumes", "show"],
-    description: "Inspect one managed volume by canonical ID or exact unique name.",
-    mutation: "read",
-    outcome: "Inspect one durable volume without changing its lifecycle.",
-    human: "ornn volumes show <volume>",
-    automation: "ornn volumes show <volume-id> --format json",
-    acceptedReferences: ["canonical volume ID", "exact unique volume name"],
-    related: ["volumes files list", "volume-mounts show"]
-  }),
-  storageCapability({
-    id: "storage.volumes.create",
+    input: storageCliInput,
+    execute: (context, input) => storageExecutor(context)("storage.volumes.show", input),
+    vnext: {
+      arguments: "semantic",
+      audience: "customer",
+      category: "resource",
+      outcome: "Inspect one durable volume without changing its lifecycle.",
+      human: "ornn volumes show <volume>",
+      automation: "ornn volumes show <volume-id> --format json",
+      acceptedReferences: ["canonical volume ID", "exact unique volume name"],
+      related: ["volumes files list", "volume-mounts show"]
+    }
+  }
+});
+var volumeCreateCapability = defineCapability({
+  id: "storage.volumes.create",
+  domain: "storage",
+  roles: ["user"],
+  description: "Create a storage volume (drive), optionally cloned from an existing source drive.",
+  mutation: "preview-confirm",
+  input: volumeCreateInput.extend({ idempotencyKey: z32.string().optional() }),
+  mcp: { name: "storage_volumes_create", input: volumeCreateInput },
+  slack: false,
+  execute: (context, input) => createDrive(context.fetch, { name: input.name, source_drive_id: input.sourceDriveId ?? null }, input.idempotencyKey ? { headers: { "Idempotency-Key": input.idempotencyKey } } : void 0),
+  cli: {
     command: ["volumes", "create"],
-    description: "Create or rediscover a uniquely named managed volume.",
-    mutation: "preview-confirm",
-    outcome: "Create one durable volume or safely replay its normalized intent.",
-    human: "ornn volumes create --name <name> [--source <volume>] []",
-    automation: "ornn volumes create --name <name> [--source <volume-id>]  --idempotency-key <key> --format json",
-    acceptedReferences: ["canonical source volume ID", "exact unique source volume name"],
-    related: ["volumes show", "volumes files upload"]
-  }),
-  storageCapability({
-    id: "storage.volumes.refresh",
+    input: storageCliInput,
+    execute: (context, input) => storageExecutor(context)("storage.volumes.create", input),
+    vnext: {
+      arguments: "semantic",
+      audience: "customer",
+      category: "resource",
+      outcome: "Create one durable volume or safely replay its normalized intent.",
+      human: "ornn volumes create --name <name> [--source <volume>] []",
+      automation: "ornn volumes create --name <name> [--source <volume-id>]  --idempotency-key <key> --format json",
+      acceptedReferences: ["canonical source volume ID", "exact unique source volume name"],
+      related: ["volumes show", "volumes files upload"]
+    }
+  }
+});
+var volumeRefreshCapability = defineCapability({
+  id: "storage.volumes.refresh",
+  domain: "storage",
+  roles: ["user"],
+  description: "Refresh a storage volume's (drive's) reported usage/state.",
+  mutation: "preview-confirm",
+  input: driveWrite,
+  mcp: { name: "storage_volumes_refresh" },
+  slack: false,
+  execute: (context, input) => getDrive(context.fetch, input.driveId, { refresh: true }),
+  cli: {
     command: ["volumes", "refresh"],
-    description: "Refresh the owner-backed view of one managed volume.",
-    mutation: "read",
-    outcome: "Refresh and inspect the current durable volume state.",
-    human: "ornn volumes refresh <volume>",
-    automation: "ornn volumes refresh <volume-id> --format json",
-    acceptedReferences: ["canonical volume ID", "exact unique volume name"],
-    related: ["volumes show"]
-  }),
-  storageCapability({
-    id: "storage.volumes.clear",
+    input: storageCliInput,
+    execute: (context, input) => storageExecutor(context)("storage.volumes.refresh", input),
+    vnext: {
+      arguments: "semantic",
+      audience: "customer",
+      category: "resource",
+      outcome: "Refresh and inspect the current durable volume state.",
+      human: "ornn volumes refresh <volume>",
+      automation: "ornn volumes refresh <volume-id> --format json",
+      acceptedReferences: ["canonical volume ID", "exact unique volume name"],
+      related: ["volumes show"]
+    }
+  }
+});
+var volumeClearCapability = defineCapability({
+  id: "storage.volumes.clear",
+  domain: "storage",
+  roles: ["user"],
+  description: "Clear (empty) a storage volume's (drive's) contents without deleting the drive.",
+  mutation: "preview-confirm",
+  input: driveWrite,
+  mcp: { name: "storage_volumes_clear" },
+  slack: false,
+  execute: (context, input) => clearDriveContents(context.fetch, input.driveId),
+  cli: {
     command: ["volumes", "clear"],
-    description: "Erase every file in one volume after a live default-no confirmation.",
-    mutation: "preview-confirm",
-    outcome: "Permanently clear one volume only from a live interactive terminal.",
-    human: "ornn volumes clear <volume>",
-    automation: "Unsupported: this command requires a live interactive terminal.",
-    acceptedReferences: ["canonical volume ID", "exact unique volume name"],
-    review: "Every file and folder in the volume is permanently deleted.",
-    related: ["volumes files list", "volume-mounts detach"]
-  }),
-  storageCapability({
-    id: "storage.volumes.delete",
+    input: storageCliInput,
+    execute: (context, input) => storageExecutor(context)("storage.volumes.clear", input),
+    vnext: {
+      arguments: "semantic",
+      audience: "customer",
+      category: "resource",
+      outcome: "Permanently clear every file and folder from one volume.",
+      human: "ornn volumes clear <volume>",
+      automation: "ornn volumes clear <volume-id> --format json",
+      acceptedReferences: ["canonical volume ID", "exact unique volume name"],
+      review: "Every file and folder in the volume is permanently deleted.",
+      related: ["volumes files list", "volume-mounts detach"]
+    }
+  }
+});
+var volumeDeleteCapability = defineCapability({
+  id: "storage.volumes.delete",
+  domain: "storage",
+  roles: ["user"],
+  description: "Delete a storage volume (drive).",
+  mutation: "preview-confirm",
+  input: driveWrite.extend({ idempotencyKey: z32.string().optional() }),
+  mcp: { name: "storage_volumes_delete", input: driveWrite },
+  slack: false,
+  execute: async (context, input) => {
+    await deleteDrive(context.fetch, input.driveId, {}, input.idempotencyKey ? { headers: { "Idempotency-Key": input.idempotencyKey } } : void 0);
+    return { deleted: true, drive_id: input.driveId };
+  },
+  cli: {
     command: ["volumes", "delete"],
-    description: "Delete an explicitly selected, relationship-free managed volume.",
-    mutation: "preview-confirm",
-    outcome: "Delete one detached volume after explicit consent.",
-    human: "ornn volumes delete <volume>",
-    automation: "ornn volumes delete <volume-id>  --idempotency-key <key> --format json",
-    acceptedReferences: ["canonical volume ID", "exact unique volume name"],
-    review: "The volume and all of its data are permanently deleted.",
-    related: ["volume-mounts detach", "volumes show"]
-  }),
+    input: storageCliInput,
+    execute: (context, input) => storageExecutor(context)("storage.volumes.delete", input),
+    vnext: {
+      arguments: "semantic",
+      audience: "customer",
+      category: "resource",
+      outcome: "Delete one detached volume after explicit consent.",
+      human: "ornn volumes delete <volume>",
+      automation: "ornn volumes delete <volume-id>  --idempotency-key <key> --format json",
+      acceptedReferences: ["canonical volume ID", "exact unique volume name"],
+      review: "The volume and all of its data are permanently deleted.",
+      related: ["volume-mounts detach", "volumes show"]
+    }
+  }
+});
+var volumeCapabilities = [
+  volumeListCapability,
+  volumeShowCapability,
+  volumeCreateCapability,
+  volumeRefreshCapability,
+  volumeClearCapability,
+  volumeDeleteCapability,
   volumeFilesListCapability,
   storageCapability({
     id: "storage.volumes.files.upload",
@@ -6663,10 +6722,8 @@ var volumeCapabilities = [
     related: ["volumes files list"]
   })
 ];
-var reservationInput = z32.object({ reservationId: z32.string() });
-var reservationWrite = reservationInput.extend({ confirm: z32.boolean().optional() });
-var driveInput = z32.object({ driveId: z32.string() });
-var driveWrite = driveInput.extend({ confirm: z32.boolean().optional() });
+var reservationInput2 = z32.object({ reservationId: z32.string() });
+var reservationWrite = reservationInput2.extend({ confirm: z32.boolean().optional() });
 var bucketConnectInput = z32.object({
   provider: z32.enum(["gcs", "s3", "r2"]),
   bucket: z32.string(),
@@ -6716,7 +6773,7 @@ var storageVerbCapabilities = [
     roles: ["user"],
     description: "Show a reservation's storage deployment (attachment) status.",
     mutation: "read",
-    input: reservationInput,
+    input: reservationInput2,
     slack: false,
     execute: (ctx, input) => getReservationStorageAttachment(ctx.fetch, input.reservationId)
   }),
@@ -6730,92 +6787,6 @@ var storageVerbCapabilities = [
     slack: false,
     execute: (ctx) => listStorageTargets(ctx.fetch)
   }),
-  defineCapability({
-    id: "volume.list",
-    domain: "storage",
-    roles: ["user"],
-    description: "List a page of storage volumes, newest updated first. Pass next_cursor as cursor to continue.",
-    mutation: "read",
-    input: z32.object({
-      limit: z32.number().int().min(1).max(100).optional(),
-      cursor: z32.string().optional()
-    }),
-    mcp: { name: "storage_volumes_list" },
-    slack: false,
-    execute: (ctx, input) => listDrives(ctx.fetch, {
-      limit: input.limit ?? 25,
-      ...input.cursor ? { cursor: input.cursor } : {}
-    })
-  }),
-  defineCapability({
-    id: "volume.show",
-    domain: "storage",
-    roles: ["user"],
-    description: "Show a single storage volume (drive) by id.",
-    mutation: "read",
-    input: driveInput,
-    mcp: { name: "storage_volumes_show" },
-    slack: false,
-    execute: (ctx, input) => getDrive(ctx.fetch, input.driveId)
-  }),
-  defineCapability({
-    id: "volume.create",
-    domain: "storage",
-    roles: ["user"],
-    description: "Create a storage volume (drive), optionally cloned from an existing source drive.",
-    mutation: "preview-confirm",
-    input: z32.object({
-      name: z32.string(),
-      sourceDriveId: z32.string().optional(),
-      confirm: z32.boolean().optional()
-    }),
-    mcp: { name: "storage_volumes_create" },
-    slack: false,
-    execute: (ctx, input) => createDrive(ctx.fetch, {
-      name: input.name,
-      source_drive_id: input.sourceDriveId ?? null
-    })
-  }),
-  defineCapability({
-    id: "volume.refresh",
-    domain: "storage",
-    roles: ["user"],
-    description: "Refresh a storage volume's (drive's) reported usage/state.",
-    mutation: "preview-confirm",
-    input: driveWrite,
-    mcp: { name: "storage_volumes_refresh" },
-    slack: false,
-    execute: (ctx, input) => getDrive(ctx.fetch, input.driveId, { refresh: true })
-  }),
-  defineCapability({
-    id: "volume.clear",
-    domain: "storage",
-    roles: ["user"],
-    description: "Clear (empty) a storage volume's (drive's) contents without deleting the drive.",
-    mutation: "preview-confirm",
-    input: driveWrite,
-    mcp: { name: "storage_volumes_clear" },
-    slack: false,
-    // The route answers 204, so report which volume was cleared.
-    execute: async (ctx, input) => {
-      await clearDriveContents(ctx.fetch, input.driveId);
-      return { cleared: true, drive_id: input.driveId };
-    }
-  }),
-  defineCapability({
-    id: "volume.delete",
-    domain: "storage",
-    roles: ["user"],
-    description: "Delete a storage volume (drive).",
-    mutation: "preview-confirm",
-    input: driveWrite,
-    mcp: { name: "storage_volumes_delete" },
-    slack: false,
-    execute: async (ctx, input) => {
-      await deleteDrive(ctx.fetch, input.driveId);
-      return { deleted: true, drive_id: input.driveId };
-    }
-  }),
   defineCapability({
     id: "bucket.connect",
     domain: "storage",
@@ -6910,7 +6881,6 @@ var catalog = [
       ...evidenceCapabilities,
       ...observabilityCapabilities,
       ...clusterCapabilities,
-      ...networkVerbCapabilities,
       ...accessVerbCapabilities,
       ...storageVerbCapabilities,
       reservationKeysPushCapability,
@@ -7202,6 +7172,11 @@ export {
   metricsHistoryCapability,
   metricsSnapshotCapability,
   parseHardwareCatalog,
+  privateNetworkCreateCapability,
+  privateNetworkDeleteCapability,
+  privateNetworkListCapability,
+  privateNetworkShowCapability,
+  privateNetworkUpdateCapability,
   sshKeyAddCapability,
   sshKeyAssignmentAssignCapability,
   sshKeyAssignmentListCapability,
@@ -7209,5 +7184,14 @@ export {
   sshKeyDeleteCapability,
   sshKeyDeliveryStatus,
   sshKeyListCapability,
-  volumeFilesListCapability
+  volumeClearCapability,
+  volumeCreateCapability,
+  volumeDeleteCapability,
+  volumeFilesListCapability,
+  volumeListCapability,
+  volumeRefreshCapability,
+  volumeShowCapability,
+  vpnConnectionConfigureCapability,
+  vpnConnectionDisconnectCapability,
+  vpnConnectionListCapability
 };