@ornncompute/cli 1.0.25 → 1.0.34

package/src/mount-commands.mjs

@@ -351,7 +351,7 @@ async function reservationMachineCount(runtime, reservationId, signal) {
   let count = 0;
   try {
     const rows = candidateRows(
-      await runtime.fetch("/v1/cli/storage-targets", {
+      await runtime.fetch("/v1/orchestrator/storage-targets", {
         method: "GET",
         ...(signal ? { signal } : {}),
       })
@@ -595,7 +595,9 @@ async function candidates(input, runtime) {
     "ornn volume-mounts candidates [--limit <1-500>] [--cursor <cursor>]",
     runtime.interaction
   );
-  const rows = candidateRows(await runtime.fetch("/v1/cli/storage-targets", { method: "GET" }));
+  const rows = candidateRows(
+    await runtime.fetch("/v1/orchestrator/storage-targets", { method: "GET" })
+  );
   const offset = cursorOffset(input.cursor, runtime.interaction);
   const limit = pageLimit(input.limit, runtime.interaction);
   if (offset > rows.length) {

package/src/slurm-commands.mjs

@@ -1,6 +1,7 @@
 import { spawn as spawnProcessDefault } from "node:child_process";
 import { homedir } from "node:os";
 
+import { identityFilePermissionProblem } from "./identity-file.mjs";
 import {
   clusterModeConnectCandidates,
   launchClusterMode,
@@ -203,6 +204,16 @@ export function createSlurmConnectModeHandler({ spawnProcess = spawnProcessDefau
         ssh,
       };
       if (runtime.eligibleHuman && !runtime.machine && state.input.print !== true) {
+        const identityFile = text(state.input.identityFile);
+        const keyProblem = await identityFilePermissionProblem(
+          identityFile ? expandHome(identityFile) : null
+        );
+        if (keyProblem) {
+          runtime.usage(keyProblem, {
+            code: "identity_file_permissions",
+            field: "identityFile",
+          });
+        }
         const launched = await spawnSsh(login, spawnProcess);
         if (launched.code === 130) {
           return {

package/src/storage-commands.mjs

@@ -288,12 +288,17 @@ function safeStorageError(error, fallback, { action } = {}) {
       ? "service_unavailable"
       : "storage_operation_failed");
   const unavailable = code === "service_unavailable";
-  return new StorageCommandError(SAFE_ERROR_MESSAGES[code] ?? fallback, {
-    action,
-    code,
-    exitCode: unavailable ? 6 : 1,
-    retryable: unavailable,
-  });
+  const ownerMessage = detailOf(error)?.message;
+  return new StorageCommandError(
+    SAFE_ERROR_MESSAGES[code] ??
+      (typeof ownerMessage === "string" && ownerMessage.trim() ? ownerMessage : fallback),
+    {
+      action,
+      code,
+      exitCode: unavailable ? 6 : 1,
+      retryable: unavailable,
+    }
+  );
 }
 
 export function idempotencyHeaders(input) {
@@ -828,12 +833,15 @@ async function uploadFile(input, runtime) {
     title: "Upload volume file",
   });
   if (declined) return declined;
+  const requestHash = createHash("sha256");
+  for await (const chunk of createReadStream(localFile)) requestHash.update(chunk);
+  const sha256 = requestHash.digest("hex");
   let session;
   try {
     session = await runtime.fetch(
       computeEndpoint(`${STORAGE_PREFIX}/${encodeURIComponent(String(drive.id))}/file-upload-url`),
       {
-        body: { content_type: contentType, path: remotePath, size_bytes: fileInfo.size },
+        body: { content_type: contentType, path: remotePath, size_bytes: fileInfo.size, sha256 },
         headers: idempotencyHeaders(input),
         method: "POST",
       }
@@ -843,6 +851,18 @@ async function uploadFile(input, runtime) {
   }
   const uploadId =
     typeof session?.upload_id === "string" ? safeIdentifier(session.upload_id) : null;
+  if (uploadId && session.state === "complete") {
+    return runtime.interaction.result({
+      data: {
+        file: safeFile({ path: remotePath, size_bytes: fileInfo.size }),
+        integrity: { sha256 },
+        upload_id: uploadId,
+        volume: safeVolume(drive),
+      },
+      outcome: { class: "ready", phase: "uploaded" },
+      resume: { kind: "volume-upload", ref: uploadId },
+    });
+  }
   if (!uploadId || typeof session?.upload_url !== "string") {
     if (uploadId) await cancelUpload(runtime, String(drive.id), uploadId);
     throw new StorageCommandError("Ornn returned an invalid upload session.", {

package/src/vm-commands.mjs

@@ -3,13 +3,14 @@ import { createHash } from "node:crypto";
 import { readFile } from "node:fs/promises";
 import { homedir } from "node:os";
 import { isIP } from "node:net";
+import { identityFilePermissionProblem } from "./identity-file.mjs";
 import { isRecoverableWaitFailure } from "./interaction-runtime.mjs";
 import { resolvedMountPath } from "./mount-commands.mjs";
 import {
   isReferenceMiss,
   listActiveDirectReservations,
   listOwnedActiveMachines,
-  reservationChoiceLabel as reservationLabel,
+  reservationLabeler,
   resolveMachineReference,
 } from "./machine-reference.mjs";
 
@@ -513,6 +514,7 @@ async function resolveReservation(context, input, interaction, expectedMode = nu
   }
   let ref = resourceId(candidates[0]);
   if (candidates.length > 1) {
+    const reservationLabel = await reservationLabeler(context.fetch);
     ref = await interaction.ask({
       label: "Capacity reservation",
       choices: candidates.map((reservation) => ({
@@ -534,9 +536,21 @@ async function resolveReservation(context, input, interaction, expectedMode = nu
 }
 
 async function fetchOrganizationKeys(context) {
-  return activeKeys(
-    keysFromPayload(await context.fetch("/v1/workflows/compute/nodes/organizations/me/ssh-keys"))
-  );
+  const keys = [];
+  const seen = new Set();
+  let cursor = null;
+  do {
+    const query = new URLSearchParams({ status: "active", limit: "500" });
+    if (cursor) query.set("cursor", cursor);
+    const page = await context.fetch(
+      `/v1/workflows/compute/nodes/organizations/me/ssh-keys?${query}`
+    );
+    keys.push(...keysFromPayload(page));
+    cursor = page.next_cursor ?? null;
+    if (cursor && seen.has(cursor)) throw new Error("SSH key pagination did not advance.");
+    if (cursor) seen.add(cursor);
+  } while (cursor);
+  return activeKeys(keys);
 }
 
 export function keyInputShapePreflight(input, interaction) {
@@ -1071,6 +1085,7 @@ export const vmLaunchModeHandler = {
     const reviewedRelationshipSnapshot = JSON.stringify(reviewedRelationships);
     const waitByDefault = interaction.eligibleHuman && !interaction.machine;
     const shouldWait = input.noWait ? false : input.wait ? true : waitByDefault;
+    const reservationLabel = await reservationLabeler(context.fetch);
     const reviewAccepted = await interaction.review({
       title: "VM launch review",
       terms: [
@@ -1828,6 +1843,7 @@ async function launchDurableBareMetalWorkspace({
     : input.wait
       ? true
       : interaction.eligibleHuman && !interaction.machine;
+  const reservationLabel = await reservationLabeler(context.fetch);
   const accepted = await interaction.review({
     title: "Durable Bare Metal workspace review",
     terms: [
@@ -2333,6 +2349,7 @@ export const bareMetalLaunchModeHandler = {
         ? true
         : interaction.eligibleHuman && !interaction.machine;
     const allocation = reservationAllocationContext(reservation);
+    const reservationLabel = await reservationLabeler(context.fetch);
     const reviewAccepted = await interaction.review({
       title: "Bare Metal launch review",
       terms: [
@@ -2857,6 +2874,15 @@ function createDirectMachineConnectModeHandler({
         ssh_command: command,
       };
       if (interaction.eligibleHuman && !interaction.machine && input.print !== true) {
+        const keyProblem = await identityFilePermissionProblem(
+          invocation.raw || !text(input.identityFile) ? null : expandPath(input.identityFile)
+        );
+        if (keyProblem) {
+          interaction.usage(keyProblem, {
+            code: "identity_file_permissions",
+            field: "identityFile",
+          });
+        }
         interaction.stderr?.write(
           `Opening SSH to ${displayName}.\nRun: ${command}\nWaiting for SSH to exit. Press Ctrl-C to stop only local SSH; the remote machine keeps running.\n`
         );
@@ -3355,6 +3381,7 @@ async function guidedSwitchReservation(context, interaction) {
   }
   let reference = resourceId(reservations[0]);
   if (reservations.length > 1) {
+    const reservationLabel = await reservationLabeler(context.fetch);
     reference = await interaction.ask({
       label: "Capacity reservation",
       choices: reservations.map((reservation) => ({
@@ -3527,6 +3554,7 @@ async function switchMachine(input, context, interaction) {
     reservationId,
     interaction
   );
+  const reservationLabel = await reservationLabeler(context.fetch);
   if (
     reservationLabel(currentReservation) !== reservationLabel(reservation) ||
     directMachineSnapshot(currentMachines, currentRelationships, currentKeys) !== snapshot
@@ -3988,10 +4016,17 @@ function reservationPosition(input, interaction) {
 export async function executeSshKeyCommand(command, input, context, interaction) {
   if (command === "list") {
     positional(input, 0, "ornn ssh-keys list [--limit <1-500>] [--cursor <cursor>]", interaction);
-    const keys = fetchOrganizationKeys(context).then((rows) =>
-      rows.sort((left, right) => String(resourceId(left)).localeCompare(String(resourceId(right))))
+    const limit = input.limit ?? 50;
+    const query = new URLSearchParams({ status: "active", limit: String(limit) });
+    if (text(input.cursor)) query.set("cursor", input.cursor);
+    const payload = await context.fetch(
+      `/v1/workflows/compute/nodes/organizations/me/ssh-keys?${query}`
     );
-    const page = cursorPage(await keys, input, interaction);
+    const items = activeKeys(keysFromPayload(payload));
+    const page = {
+      items,
+      page: { limit, returned: items.length, next_cursor: payload.next_cursor ?? null },
+    };
     return interaction.result({
       data: { ssh_keys: page.items.map(projectKey) },
       page: page.page,

package/vendor/capabilities/capabilities/admin-capacity-reservations.js

@@ -16,17 +16,20 @@ function adminHelp(command, outcome, human, automation, review) {
 const capacityOfferCreateInput = z.object({
     gpu_type: z.string().min(1),
     node_count: z.number().int().positive(),
-    gpus_per_node: z.number().int().positive(),
+    gpus_per_node: z.number().int().min(1).max(8),
     site_nickname: z.string().min(1),
     available_start_at: z.string().min(1),
     available_end_at: z.string().min(1),
-    buy_now_price_per_gpu_hour: z.number().nonnegative(),
+    buy_now_price_per_gpu_hour: z.number().positive(),
+    cost_per_gpu_hour: z.number().positive().optional(),
+    down_payment_cents: z.number().int().nonnegative().optional(),
+    access_mode: z.enum(["bare-metal", "virtual-machine"]).optional(),
 });
 export const adminCapacityOffersCreateCapability = {
     ...createListingCapability,
     cli: {
         ...createListingCapability.cli,
-        vnext: adminHelp(["admin", "capacity-offers", "create"], "Create one capacity offer from explicit commercial terms.", "ornn admin capacity-offers create --gpu GPU --nodes COUNT --gpus-per-node COUNT --site SITE --starts-at TIME --ends-at TIME --price-per-gpu-hour USD", "Not supported in machine or redirected execution because offer creation has no durable replay identity.", "GPU, capacity, site, availability window, and price are normalized before default-no consent."),
+        vnext: adminHelp(["admin", "capacity-offers", "create"], "Create one primary listing from explicit commercial terms.", "ornn admin capacity-offers create --gpu GPU --nodes COUNT --gpus-per-node COUNT --site SITE --starts-at TIME --ends-at TIME --price-per-gpu-hour USD [--supplier-price-per-gpu-hour USD] [--down-payment-cents CENTS] [--access-mode bare-metal|virtual-machine]", "Not supported in machine or redirected execution because offer creation has no durable replay identity.", "GPU, site, availability window, supplier price, spread, and down payment are normalized before default-no consent."),
     },
     input: createListingCapability.input,
     execute: async (ctx, input) => {
@@ -35,89 +38,56 @@ export const adminCapacityOffersCreateCapability = {
         const result = await createListingCapability.execute(ctx, capacityOfferCreateInput.parse(input));
         if (!ctx.confirmed || object(result).ok === false)
             return result;
-        return { capacity_offer: normalizeCapacityOffer(result) };
+        return { listing: result };
     },
 };
-const reservationCreateInput = z.object({
+const MICRO_USD = 1_000_000;
+export const reservationCreateInput = z.object({
     organization_id: z.string().uuid(),
     listing_id: z.string().uuid(),
-    node_count: z.number().int().positive(),
     start_at: z.string().min(1),
     end_at: z.string().min(1),
-    price_per_gpu_hour: z.string().regex(/^\d+(?:\.\d{1,6})?$/),
+    price_per_gpu_hour: z
+        .string()
+        .regex(/^\d+(?:\.\d{1,6})?$/)
+        .describe("USD per GPU-hour, for example 2.50."),
+    down_payment_cents: z.number().int().nonnegative().optional(),
+    notes: z.string().max(2000).optional(),
 });
 function object(value) {
     return value && typeof value === "object" && !Array.isArray(value)
         ? value
         : {};
 }
-function field(value, ...keys) {
-    for (const key of keys) {
-        if (value[key] !== undefined)
-            return value[key];
-    }
-    return undefined;
-}
-function normalizeCapacityOffer(value) {
-    const row = object(object(value).capacity_offer ?? object(value).listing ?? value);
-    return {
-        capacity_offer_id: field(row, "capacity_offer_id", "listing_id", "listingId", "id"),
-        gpu: field(row, "gpu", "gpu_type", "gpuType"),
-        node_count: field(row, "node_count", "nodeCount", "capacity_nodes", "capacityNodes"),
-        gpus_per_node: field(row, "gpus_per_node", "gpusPerNode"),
-        site: field(row, "site", "site_nickname", "siteNickname", "facility"),
-        starts_at: field(row, "starts_at", "start_at", "startAt", "available_start_at"),
-        ends_at: field(row, "ends_at", "end_at", "endAt", "available_end_at"),
-        price_per_gpu_hour: field(row, "price_per_gpu_hour", "buy_now_price_per_gpu_hour", "buyNowRatePerGpuHour"),
-        status: field(row, "status", "state"),
-    };
-}
-function normalizeReservation(value) {
-    const row = object(value);
-    return {
-        reservation_id: field(row, "reservation_id", "reservationId", "id"),
-        listing_id: field(row, "listing_id", "listingId"),
-        organization_id: field(row, "organization_id", "organizationId", "tenant_id", "tenantId"),
-        node_count: field(row, "node_count", "nodeCount"),
-        start_at: field(row, "start_at", "startAt"),
-        end_at: field(row, "end_at", "endAt"),
-        status: field(row, "status"),
-        price_per_gpu_hour: field(row, "price_per_gpu_hour", "pricePerGpuHour", "pricePerGpuHr"),
-    };
-}
 export const adminReservationsCreateCapability = defineCapability({
     id: "reservations.create",
     domain: "reservations",
     roles: ["admin"],
-    description: "Create one capacity reservation from explicit, reviewed commercial terms.",
+    description: "Create one schedule reservation on a listing from explicit, reviewed commercial terms (admin). The reservation covers the listing's nodes for the window.",
     mutation: "preview-confirm",
-    http: { method: "POST", path: "/internal/commerce-reservations" },
+    http: { method: "POST", path: "/commerce/reservations" },
     cli: {
         command: ["admin", "reservations", "create"],
-        vnext: adminHelp(["admin", "reservations", "create"], "Create one capacity reservation from explicit commercial terms.", "ornn admin reservations create --organization ID --capacity-offer ID --nodes COUNT --starts-at TIME --ends-at TIME --price-per-gpu-hour USD", "Not supported in machine or redirected execution because reservation creation has no durable replay identity.", "Organization, capacity offer, quantity, dates, and price are normalized before default-no consent."),
+        vnext: adminHelp(["admin", "reservations", "create"], "Create one schedule reservation from explicit commercial terms.", "ornn admin reservations create --organization ID --capacity-offer ID --starts-at TIME --ends-at TIME --price-per-gpu-hour USD [--down-payment-cents CENTS]", "Not supported in machine or redirected execution because reservation creation has no durable replay identity.", "Organization, listing, dates, price, and down payment are normalized before default-no consent."),
     },
-    mcp: false,
     slack: false,
     input: reservationCreateInput,
     execute: async (ctx, input) => {
         const parsed = reservationCreateInput.parse(input);
-        if (!ctx.confirmed)
-            return { preview: parsed };
-        const payload = await ctx.fetch("/internal/commerce-reservations", {
-            method: "POST",
-            body: {
-                tenant_id: parsed.organization_id,
-                listing_id: parsed.listing_id,
-                node_count: parsed.node_count,
-                start_at: parsed.start_at,
-                end_at: parsed.end_at,
-                price_per_gpu_hr: parsed.price_per_gpu_hour,
-            },
-        });
-        const body = object(payload);
-        return {
-            reservation: normalizeReservation(body.reservation ?? body),
+        const body = {
+            listingId: parsed.listing_id,
+            organizationId: parsed.organization_id,
+            startsAt: parsed.start_at,
+            endsAt: parsed.end_at,
+            pricePerGpuHourMicroUsd: Math.round(Number(parsed.price_per_gpu_hour) * MICRO_USD),
+            ...(parsed.down_payment_cents !== undefined
+                ? { downPaymentCents: parsed.down_payment_cents }
+                : {}),
+            ...(parsed.notes ? { notes: parsed.notes } : {}),
         };
+        if (!ctx.confirmed)
+            return { preview: body };
+        return { reservation: await ctx.fetch("/commerce/reservations", { method: "POST", body }) };
     },
 });
 export const adminCapacityReservationCapabilities = [

package/vendor/capabilities/capabilities/admin-enrollment.js

@@ -44,7 +44,7 @@ export const adminEnrollmentTokensListCapability = {
         };
     },
 };
-export const adminEnrollmentTokenCreateCapability = withVnextBinding(tokensCreateCapability, adminHelp(["admin", "enrollment-tokens", "create"], "Create one expiring enrollment token through an explicit secret export.", "ornn admin enrollment-tokens create --operator UUID --expires-in SECONDS (--print | --output PATH) [--overwrite] [--yes]", "Unsupported: token creation requires an eligible human terminal.", ["canonical operator UUID"], "Review the operator, expiry, and secret destination before minting the token."));
+export const adminEnrollmentTokenCreateCapability = withVnextBinding(tokensCreateCapability, adminHelp(["admin", "enrollment-tokens", "create"], "Create one expiring enrollment token through an explicit secret export.", "ornn admin enrollment-tokens create --supplier UUID --expires-in SECONDS (--print | --output PATH) [--overwrite] [--yes]", "Unsupported: token creation requires an eligible human terminal.", ["canonical supplier organization UUID"], "Review the supplier, expiry, and secret destination before minting the token."));
 const tokenRevokeInput = z.object({
     token_id: UUID,
     expected_created_at: nonEmpty.optional(),
@@ -70,7 +70,7 @@ function tokenMetadata(value) {
         return null;
     return {
         id: row.id,
-        operator_id: typeof row.operator_id === "string" ? row.operator_id : null,
+        organization_id: typeof row.organization_id === "string" ? row.organization_id : null,
         status: typeof row.status === "string" ? row.status : "unknown",
         expires_at: typeof row.expires_at === "string" ? row.expires_at : null,
         created_at: typeof row.created_at === "string" ? row.created_at : null,
@@ -145,7 +145,7 @@ export const adminEnrollmentTokenRevokeCapability = defineCapability({
         return {
             id: parsed.token_id,
             created_at: current.target.created_at,
-            operator_id: current.target.operator_id,
+            organization_id: current.target.organization_id,
             expires_at: current.target.expires_at,
             status: "revoked",
             reconciled: false,
@@ -156,7 +156,7 @@ export const adminEnrollmentTokenRevokeCapability = defineCapability({
 const nodeEnrollInput = z.object({
     node_id: UUID,
     host: nonEmpty,
-    operator_id: UUID,
+    organization_id: UUID,
     facility_id: UUID,
     filter: z.string().optional(),
     identity_file: nonEmpty,
@@ -185,12 +185,12 @@ export const adminNodeEnrollCapability = defineCapability({
     id: "nodes.enroll",
     domain: "fleet",
     roles: ["admin"],
-    description: "Enroll one explicit node over SSH with an explicit operator and facility assignment.",
+    description: "Enroll one explicit node over SSH with an explicit supplier and facility assignment.",
     mutation: "preview-confirm",
     http: { method: "POST", path: "/internal/remote" },
     cli: {
         command: ["admin", "nodes", "enroll"],
-        vnext: adminHelp(["admin", "nodes", "enroll"], "Install Ornn management on one explicitly assigned node.", "ornn admin nodes enroll <node-id> --host HOST --operator UUID --facility UUID [--filter COMPARTMENT_IDS] --identity-file PATH --token-ttl SECONDS --replace-existing-management [--verbose] [--yes]", "Unsupported: remote enrollment requires an eligible human terminal.", ["canonical node UUID", "canonical operator UUID", "canonical facility UUID"], "Review node identity, SSH target, assignment, compartment filter, and replacement of existing management."),
+        vnext: adminHelp(["admin", "nodes", "enroll"], "Install Ornn management on one explicitly assigned node.", "ornn admin nodes enroll <node-id> --host HOST --supplier UUID --facility UUID [--filter COMPARTMENT_IDS] --identity-file PATH --token-ttl SECONDS --replace-existing-management [--verbose] [--yes]", "Unsupported: remote enrollment requires an eligible human terminal.", ["canonical node UUID", "canonical supplier organization UUID", "canonical facility UUID"], "Review node identity, SSH target, assignment, compartment filter, and replacement of existing management."),
     },
     mcp: false,
     slack: false,
@@ -201,7 +201,7 @@ export const adminNodeEnrollCapability = defineCapability({
             return {
                 node_id: parsed.node_id,
                 host: parsed.host,
-                operator_id: parsed.operator_id,
+                organization_id: parsed.organization_id,
                 facility_id: parsed.facility_id,
                 filter: parsed.filter,
                 expires_in_seconds: parsed.expires_in_seconds,
@@ -214,7 +214,7 @@ export const adminNodeEnrollCapability = defineCapability({
         const minted = (await ctx.fetch("/enrollment-tokens", {
             method: "POST",
             body: {
-                operator_id: parsed.operator_id,
+                organization_id: parsed.organization_id,
                 expires_in_seconds: parsed.expires_in_seconds,
             },
         }));
@@ -248,7 +248,7 @@ export const adminNodeEnrollCapability = defineCapability({
         return {
             node_id: parsed.node_id,
             host: parsed.host,
-            operator_id: parsed.operator_id,
+            organization_id: parsed.organization_id,
             facility_id: parsed.facility_id,
             filter: parsed.filter,
             management: "replaced",

package/vendor/capabilities/capabilities/admin-nodes-lifecycle.js

@@ -83,7 +83,7 @@ export const adminNodeRebootCapability = defineCapability({
     http: { method: "POST", path: "/nodes/{id}/reboot" },
     cli: {
         command: ["admin", "nodes", "reboot"],
-        vnext: adminLifecycleHelp(["admin", "nodes", "reboot"], "Reboot one exact live machine while preserving local data and access configuration.", "ornn admin nodes reboot <node-ref> [--yes] [--no-wait] [--timeout SECONDS]", "Unsupported: reboot requires an eligible human terminal.", "Node and live-machine identities, operator, facility, capacity assignment, and preserved access."),
+        vnext: adminLifecycleHelp(["admin", "nodes", "reboot"], "Reboot one exact live machine while preserving local data and access configuration.", "ornn admin nodes reboot <node-ref> [--yes] [--no-wait] [--timeout SECONDS]", "Unsupported: reboot requires an eligible human terminal.", "Node and live-machine identities, supplier, facility, capacity assignment, and preserved access."),
     },
     mcp: false,
     slack: false,
@@ -99,7 +99,7 @@ export const adminNodeHardResetCapability = defineCapability({
     http: { method: "POST", path: "/nodes/{id}/reboot" },
     cli: {
         command: ["admin", "nodes", "hard-reset"],
-        vnext: adminLifecycleHelp(["admin", "nodes", "hard-reset"], "Erase local tenant data and hard reset one exact live machine.", "ornn admin nodes hard-reset <node-ref> --erase-local-data [--yes] [--no-wait] [--timeout SECONDS]", "Unsupported: hard reset requires an eligible human terminal.", "Node and live-machine identities, operator, facility, capacity assignment, erased local data, and restored keys."),
+        vnext: adminLifecycleHelp(["admin", "nodes", "hard-reset"], "Erase local tenant data and hard reset one exact live machine.", "ornn admin nodes hard-reset <node-ref> --erase-local-data [--yes] [--no-wait] [--timeout SECONDS]", "Unsupported: hard reset requires an eligible human terminal.", "Node and live-machine identities, supplier, facility, capacity assignment, erased local data, and restored keys."),
     },
     mcp: false,
     slack: false,
@@ -115,7 +115,7 @@ export const adminNodeSuspendManagementCapability = defineCapability({
     http: { method: "POST", path: "/internal/nodes/{id}/off-grid" },
     cli: {
         command: ["admin", "nodes", "suspend-management"],
-        vnext: adminLifecycleHelp(["admin", "nodes", "suspend-management"], "Remove Ornn management and managed access from one powered-on node.", "ornn admin nodes suspend-management <node-ref> [--reason TEXT] [--yes] [--no-wait]", "ornn admin nodes suspend-management <node-id> --yes --idempotency-key KEY --format json", "Node, operator, facility, capacity assignment, management removal, and managed-access loss."),
+        vnext: adminLifecycleHelp(["admin", "nodes", "suspend-management"], "Remove Ornn management and managed access from one powered-on node.", "ornn admin nodes suspend-management <node-ref> [--reason TEXT] [--yes] [--no-wait]", "ornn admin nodes suspend-management <node-id> --yes --idempotency-key KEY --format json", "Node, supplier, facility, capacity assignment, management removal, and managed-access loss."),
     },
     mcp: false,
     slack: false,
@@ -145,7 +145,7 @@ export const adminNodeResumeManagementCapability = defineCapability({
     http: { method: "POST", path: "/internal/nodes/{id}/on-grid" },
     cli: {
         command: ["admin", "nodes", "resume-management"],
-        vnext: adminLifecycleHelp(["admin", "nodes", "resume-management"], "Restore Ornn management and managed access on one off-grid node.", "ornn admin nodes resume-management <node-ref> [--yes] [--no-wait]", "ornn admin nodes resume-management <node-id> --yes --idempotency-key KEY --format json", "Node, operator, facility, capacity assignment, remote re-enrollment, and restored managed access."),
+        vnext: adminLifecycleHelp(["admin", "nodes", "resume-management"], "Restore Ornn management and managed access on one off-grid node.", "ornn admin nodes resume-management <node-ref> [--yes] [--no-wait]", "ornn admin nodes resume-management <node-id> --yes --idempotency-key KEY --format json", "Node, supplier, facility, capacity assignment, remote re-enrollment, and restored managed access."),
     },
     mcp: false,
     slack: false,
@@ -173,7 +173,7 @@ export const adminNodeTerminateCapability = defineCapability({
     http: { method: "POST", path: "/internal/nodes/{id}/terminate" },
     cli: {
         command: ["admin", "nodes", "terminate"],
-        vnext: adminLifecycleHelp(["admin", "nodes", "terminate"], "End managed access and permanently delete one exact node record.", "ornn admin nodes terminate <node-ref> --delete-node-record [--skip-cleanup] [--reason TEXT] [--yes]", "ornn admin nodes terminate <node-id> --delete-node-record --yes --idempotency-key KEY --format json", "Node, operator, facility, reservation/capacity, host cleanup, node-record deletion, and access loss."),
+        vnext: adminLifecycleHelp(["admin", "nodes", "terminate"], "End managed access and permanently delete one exact node record.", "ornn admin nodes terminate <node-ref> --delete-node-record [--skip-cleanup] [--reason TEXT] [--yes]", "ornn admin nodes terminate <node-id> --delete-node-record --yes --idempotency-key KEY --format json", "Node, supplier, facility, reservation/capacity, host cleanup, node-record deletion, and access loss."),
     },
     mcp: false,
     slack: false,
@@ -204,7 +204,7 @@ export const adminNodeAssignCapability = defineCapability({
     http: { method: "POST", path: "/internal/nodes/{id}/assign" },
     cli: {
         command: ["admin", "nodes", "assign"],
-        vnext: adminLifecycleHelp(["admin", "nodes", "assign"], "Assign one exact node to one exact capacity reservation.", "ornn admin nodes assign <node-ref> --reservation <reservation-id> [--yes] [--no-wait]", "ornn admin nodes assign <node-id> --reservation <reservation-id> --yes --idempotency-key KEY --format json", "Node, operator, facility, previous and requested capacity assignments, and tenant access change."),
+        vnext: adminLifecycleHelp(["admin", "nodes", "assign"], "Assign one exact node to one exact capacity reservation.", "ornn admin nodes assign <node-ref> --reservation <reservation-id> [--yes] [--no-wait]", "ornn admin nodes assign <node-id> --reservation <reservation-id> --yes --idempotency-key KEY --format json", "Node, supplier, facility, previous and requested capacity assignments, and tenant access change."),
     },
     mcp: false,
     slack: false,

package/vendor/capabilities/capabilities/admin.js

@@ -1,13 +1,13 @@
 import { z } from "zod";
 import { defineCapability } from "../capability.js";
-import { listFacilitiesCapability, listNodesCapability, listOperatorsCapability } from "./fleet.js";
+import { listFacilitiesCapability, listNodesCapability, listSuppliersCapability } from "./fleet.js";
 import { logsLatestCapability, telemetryLatestCapability } from "./observability.js";
 import { tokensListCapability } from "./tokens.js";
 import { usersQueryCapability } from "./users.js";
 import { adminCapacityOffersCreateCapability } from "./admin-capacity-reservations.js";
 export const ADMIN_CLI_ROOTS = [
     { name: "users" },
-    { name: "operators" },
+    { name: "suppliers" },
     { name: "facilities" },
     { name: "nodes" },
     { name: "enrollment-tokens" },
@@ -37,9 +37,9 @@ function withAdminBinding(capability, help) {
     };
 }
 export const adminUsersSearchCapability = withAdminBinding(usersQueryCapability, adminHelp(["admin", "users", "search"], "Search the staff-authorized user directory.", "ornn admin users search [--name NAME] [--email EMAIL] [--organization NAME] [--limit 50] [--cursor CURSOR]", "ornn admin users search --email EMAIL --limit 50 [--cursor CURSOR] --format json"));
-export const adminOperatorsListCapability = withAdminBinding(listOperatorsCapability, adminHelp(["admin", "operators", "list"], "List operators visible to staff.", "ornn admin operators list [--limit 50] [--cursor CURSOR]", "ornn admin operators list --limit 50 --format json"));
-export const adminFacilitiesListCapability = withAdminBinding(listFacilitiesCapability, adminHelp(["admin", "facilities", "list"], "List facilities visible to staff.", "ornn admin facilities list [--operator OPERATOR] [--limit 50] [--cursor CURSOR]", "ornn admin facilities list --limit 50 --format json"));
-export const adminNodesListCapability = withAdminBinding(listNodesCapability, adminHelp(["admin", "nodes", "list"], "List enrolled, ghost, and off-grid nodes.", "ornn admin nodes list [--operator OPERATOR] [--facility FACILITY] [--status STATUS] [--email EMAIL] [--limit 50] [--cursor CURSOR]", "ornn admin nodes list --limit 50 [--cursor CURSOR] --format json"));
+export const adminSuppliersListCapability = withAdminBinding(listSuppliersCapability, adminHelp(["admin", "suppliers", "list"], "List supplier organizations visible to staff.", "ornn admin suppliers list [--limit 50] [--cursor CURSOR]", "ornn admin suppliers list --limit 50 --format json"));
+export const adminFacilitiesListCapability = withAdminBinding(listFacilitiesCapability, adminHelp(["admin", "facilities", "list"], "List facilities visible to staff.", "ornn admin facilities list [--supplier UUID] [--limit 50] [--cursor CURSOR]", "ornn admin facilities list --limit 50 --format json"));
+export const adminNodesListCapability = withAdminBinding(listNodesCapability, adminHelp(["admin", "nodes", "list"], "List enrolled, ghost, and off-grid nodes.", "ornn admin nodes list [--supplier UUID] [--facility FACILITY] [--status STATUS] [--email EMAIL] [--limit 50] [--cursor CURSOR]", "ornn admin nodes list --limit 50 [--cursor CURSOR] --format json"));
 const nodeInput = z.object({ node_id: z.string().min(1) });
 export const adminNodeHealthCapability = defineCapability({
     id: "nodes.health",
@@ -65,7 +65,7 @@ export const adminNodeLogsCapability = withAdminBinding(logsLatestCapability, ad
 export const adminEnrollmentTokensListCapability = withAdminBinding(tokensListCapability, adminHelp(["admin", "enrollment-tokens", "list"], "List enrollment-token metadata without token bytes.", "ornn admin enrollment-tokens list [--limit 50] [--cursor CURSOR]", "ornn admin enrollment-tokens list --limit 50 --format json"));
 export const adminCapabilities = [
     adminUsersSearchCapability,
-    adminOperatorsListCapability,
+    adminSuppliersListCapability,
     adminFacilitiesListCapability,
     adminNodesListCapability,
     adminNodeHealthCapability,
@@ -78,7 +78,7 @@ const replacements = {
     "facilities.list": adminFacilitiesListCapability,
     "logs.latest": adminNodeLogsCapability,
     "nodes.list": adminNodesListCapability,
-    "operator.list": adminOperatorsListCapability,
+    "supplier.list": adminSuppliersListCapability,
     "telemetry.latest": adminNodeMetricsCapability,
     "tokens.list": adminEnrollmentTokensListCapability,
     "users.query": adminUsersSearchCapability,