@ornncompute/cli 1.0.35 → 1.0.62

package/src/kubernetes-commands.mjs

@@ -330,6 +330,35 @@ function parsePositiveInteger(runtime, value, option) {
   return parsed;
 }
 
+/** Running VMs that join as workers alongside the selected machines. */
+function requestedVirtualMachineIds(runtime, input) {
+  const raw = text(input.vms);
+  const ids = raw
+    ? raw
+        .split(",")
+        .map((value) => value.trim())
+        .filter(Boolean)
+    : [];
+  if (ids.some((id) => !UUID.test(id))) {
+    runtime.usage("--vms takes canonical VM IDs.", {
+      code: "canonical_vm_id_required",
+      field: "vms",
+    });
+  }
+  if (new Set(ids).size !== ids.length) {
+    runtime.usage("Each selected VM must be unique.", {
+      code: "duplicate_vm_selection",
+      field: "vms",
+    });
+  }
+  return ids.sort();
+}
+
+function parseMembershipCount(runtime, value, allowZero) {
+  if (allowZero && Number(value) === 0) return 0;
+  return parsePositiveInteger(runtime, value, "--nodes");
+}
+
 function parseTimeoutSeconds(runtime, raw, { required = false } = {}) {
   if (raw === undefined || raw === null || raw === "") {
     if (required)
@@ -1088,11 +1117,14 @@ export async function launchClusterMode(
   }
   const label = clusterModeLabel(accessMode);
   requireWaitShape(runtime, input);
+  const virtualMachineIds = requestedVirtualMachineIds(runtime, input);
   const membershipValue = input.nodes ?? input.nodeCount;
   let membershipCount =
     membershipValue === undefined || membershipValue === null
-      ? null
-      : parsePositiveInteger(runtime, membershipValue, "--nodes");
+      ? virtualMachineIds.length
+        ? 0
+        : null
+      : parseMembershipCount(runtime, membershipValue, virtualMachineIds.length > 0);
   if (membershipCount === null && !runtime.eligibleHuman) {
     runtime.usage("--nodes is required outside an interactive terminal.", {
       code: "missing_input",
@@ -1145,7 +1177,7 @@ export async function launchClusterMode(
     membershipCount !== null &&
     requestedReferences.length === membershipCount &&
     requestedReferences.every((reference) => UUID.test(reference));
-  if (initialEligibility.length === 0 && !emptyProvisioningReplay) {
+  if (initialEligibility.length === 0 && !emptyProvisioningReplay && membershipCount !== 0) {
     runtime.error(`No machines are currently eligible for ${label} launch.`, {
       code: "no_eligible_machines",
     });
@@ -1165,14 +1197,18 @@ export async function launchClusterMode(
   }
   const selected = emptyProvisioningReplay
     ? requestedReferences.map((id) => ({ id, hostname: id }))
-    : await selectLaunchMachines(
-        runtime,
-        input,
-        initialEligibility,
-        membershipCount,
-        initialExisting
-      );
+    : membershipCount === 0
+      ? []
+      : await selectLaunchMachines(
+          runtime,
+          input,
+          initialEligibility,
+          membershipCount,
+          initialExisting
+        );
   const selectedIds = selected.map((machine) => machine.id).sort();
+  // A VM member is listed under its VM id.
+  const goalIds = [...selectedIds, ...virtualMachineIds].sort();
   const reviewedKey = record(keyPlan?.key);
   const requested = {
     reservation_id: reservationId,
@@ -1180,6 +1216,7 @@ export async function launchClusterMode(
     network_mode: networkMode,
     membership_count: membershipCount,
     machine_ids: selectedIds,
+    ...(virtualMachineIds.length ? { virtual_machine_ids: virtualMachineIds } : {}),
     idempotency_key: idempotencyKey,
     organization,
     ...(keyPlan
@@ -1209,7 +1246,7 @@ export async function launchClusterMode(
         );
       }
     } else {
-      if (!sameMembers(currentIds, selectedIds)) {
+      if (!sameMembers(currentIds, goalIds)) {
         runtime.error(
           `This reservation already has a ${label} cluster with a different membership goal.`,
           { code: "cluster_launch_goal_conflict" }
@@ -1231,7 +1268,7 @@ export async function launchClusterMode(
                 signal: runtime.signal,
                 sleep: runtime.sleep,
               },
-              goalIds: selectedIds,
+              goalIds,
               input,
               requireAccess: true,
             })
@@ -1270,6 +1307,10 @@ export async function launchClusterMode(
         label: `Machine ${index + 1}`,
         value: `${machine.hostname} (${machine.id})`,
       })),
+      ...virtualMachineIds.map((virtualMachineId, index) => ({
+        label: `VM ${index + 1}`,
+        value: `${virtualMachineId} (SSH keys are set aside while it is in the cluster)`,
+      })),
     ],
   });
   if (!confirmed) {
@@ -1313,7 +1354,7 @@ export async function launchClusterMode(
         });
       }
     } else {
-      if (!sameMembers(currentIds, selectedIds)) {
+      if (!sameMembers(currentIds, goalIds)) {
         runtime.error(`A different ${label} membership goal was accepted after review.`, {
           code: "cluster_launch_goal_conflict",
         });
@@ -1328,7 +1369,7 @@ export async function launchClusterMode(
               accepted: { replayed: true, requested },
               cluster: current,
               deps: { fetch: context.fetch, interaction: runtime },
-              goalIds: selectedIds,
+              goalIds,
               input,
               requireAccess: true,
             })
@@ -1364,8 +1405,9 @@ export async function launchClusterMode(
       headers: { "Idempotency-Key": idempotencyKey },
       body: {
         network_mode: networkMode,
-        node_count: membershipCount,
+        ...(membershipCount > 0 ? { node_count: membershipCount } : {}),
         node_ids: selectedIds,
+        ...(virtualMachineIds.length ? { virtual_machine_ids: virtualMachineIds } : {}),
         ...(selectedKeyId ? { ssh_key_ids: [selectedKeyId] } : {}),
       },
     }
@@ -1402,7 +1444,7 @@ export async function launchClusterMode(
       sleep: runtime.sleep,
       stderr: runtime.stderr,
     },
-    goalIds: selectedIds,
+    goalIds,
     input,
     requireAccess: true,
   });

package/src/launch-mode-handlers.mjs

@@ -32,10 +32,10 @@ const MODE_OPTIONS = new Map([
       "volume",
     ]),
   ],
-  ["kubernetes", new Set([...COMMON_OPTIONS, "machine", "machines", "network", "nodes"])],
+  ["kubernetes", new Set([...COMMON_OPTIONS, "machine", "machines", "network", "nodes", "vms"])],
   [
     "slurm",
-    new Set([...COMMON_OPTIONS, ...KEY_OPTIONS, "machine", "machines", "network", "nodes"]),
+    new Set([...COMMON_OPTIONS, ...KEY_OPTIONS, "machine", "machines", "network", "nodes", "vms"]),
   ],
 ]);
 const OPTION_FLAGS = {

package/src/storage-commands.mjs

@@ -646,6 +646,13 @@ async function deleteVolume(input, runtime) {
   }
 }
 
+function shellQuote(value) {
+  const rendered = String(value);
+  return /^[A-Za-z0-9_./:@%+=,-]+$/.test(rendered)
+    ? rendered
+    : `'${rendered.replaceAll("'", `'\\''`)}'`;
+}
+
 async function fetchFileRows(runtime, drive, prefix) {
   const folder = prefix.includes("/") ? prefix.slice(0, prefix.lastIndexOf("/")) : "";
   const entries = [];
@@ -1121,8 +1128,9 @@ export function writeStorageResultHuman(stdout, capabilityId, execution) {
     }
     for (const file of files) stdout.write(`${file.path}  ${file.size_bytes} bytes\n`);
     if (execution.page?.next_cursor) {
+      const prefixFlag = data.prefix ? ` --prefix=${shellQuote(data.prefix)}` : "";
       stdout.write(
-        `Next: ornn volumes files list ${data.volume.id} --cursor ${execution.page.next_cursor} --format human\n`
+        `Next: ornn volumes files list ${data.volume.id}${prefixFlag} --cursor ${execution.page.next_cursor} --format human\n`
       );
     }
     return;

package/src/vm-commands.mjs

@@ -1191,7 +1191,7 @@ export const vmLaunchModeHandler = {
             body: {
               access_mode: "virtual-machine",
               network_mode: "public",
-              image_id: null,
+              disk_id: null,
               machine_count: 1,
               request_id: idempotencyKey,
               ssh_key_ids: [resourceId(key)],
@@ -2056,7 +2056,7 @@ async function launchDurableBareMetalWorkspace({
           method: "POST",
           body: {
             access_mode: "bare-metal",
-            image_id: null,
+            disk_id: null,
             machine_count: 1,
             network_mode: "private",
             request_id: `${id}:machine`,
@@ -2456,7 +2456,7 @@ export const bareMetalLaunchModeHandler = {
         const launchBody = {
           access_mode: "bare-metal",
           network_mode: "public",
-          image_id: null,
+          disk_id: null,
           machine_count: 1,
           request_id: idempotencyKey,
           ssh_key_ids: [resourceId(key)],

package/vendor/capabilities/capabilities/admin-capacity-reservations.js

@@ -1,6 +1,7 @@
 import { z } from "zod";
-import { defineCapability } from "../capability.js";
-import { createListingCapability } from "./listings.js";
+import { defineCapability, preview } from "../capability.js";
+import { nativeListingCreateInput } from "./native-listing.js";
+import { idempotencyHeaders, microUsd } from "./market-shared.js";
 function adminHelp(command, outcome, human, automation, review) {
     return {
         audience: "admin",
@@ -13,81 +14,78 @@ function adminHelp(command, outcome, human, automation, review) {
         ...(review ? { review } : {}),
     };
 }
-const capacityOfferCreateInput = z.object({
-    gpu_type: z.string().min(1),
-    node_count: z.number().int().positive(),
-    gpus_per_node: z.number().int().min(1).max(8),
-    site_nickname: z.string().min(1),
-    available_start_at: z.string().min(1),
-    available_end_at: z.string().min(1),
-    buy_now_price_per_gpu_hour: z.number().positive(),
-    cost_per_gpu_hour: z.number().positive().optional(),
-    down_payment_cents: z.number().int().nonnegative().optional(),
-    access_mode: z.enum(["bare-metal", "virtual-machine"]).optional(),
-});
-export const adminCapacityOffersCreateCapability = {
-    ...createListingCapability,
+export const adminCapacityOffersCreateCapability = defineCapability({
+    id: "listing.create",
+    domain: "listings",
+    roles: ["admin"],
+    description: "Create native capacity with explicit organization/facility IDs, hardware, availability and advertised terms. Returns {listing, terms}. Requires an idempotencyKey reused on retries and confirm: true.",
+    mutation: "preview-confirm",
+    http: { method: "POST", path: "/commerce/v2/listings" },
+    input: nativeListingCreateInput,
+    slack: false,
     cli: {
-        ...createListingCapability.cli,
-        vnext: adminHelp(["admin", "capacity-offers", "create"], "Create one primary listing from explicit commercial terms.", "ornn admin capacity-offers create --gpu GPU --nodes COUNT --gpus-per-node COUNT --site SITE --starts-at TIME --ends-at TIME --price-per-gpu-hour USD [--supplier-price-per-gpu-hour USD] [--down-payment-cents CENTS] [--access-mode bare-metal|virtual-machine]", "Not supported in machine or redirected execution because offer creation has no durable replay identity.", "GPU, site, availability window, supplier price, spread, and down payment are normalized before default-no consent."),
+        command: ["admin", "capacity-offers", "create"],
+        vnext: adminHelp(["admin", "capacity-offers", "create"], "Create native capacity and its advertised financial terms.", "ornn admin capacity-offers create --gpu-slug GPU --capacity-node-count COUNT --gpus-per-node COUNT --facility-id UUID --provisioning-type bare-metal|virtual-machine --state draft|available --terms JSON --idempotency-key KEY [--organization-id UUID] [--available-at TIME --available-until TIME] [--days-to-rfs DAYS]", "Requires an eligible human terminal; reuse --idempotency-key on retries.", "Review the native parent fields and each financial term before default-no consent."),
     },
-    input: createListingCapability.input,
     execute: async (ctx, input) => {
-        if (!ctx.cli)
-            return createListingCapability.execute(ctx, createListingCapability.input.parse(input));
-        const result = await createListingCapability.execute(ctx, capacityOfferCreateInput.parse(input));
-        if (!ctx.confirmed || object(result).ok === false)
-            return result;
-        return { listing: result };
+        const { confirm: _confirm, idempotencyKey, ...body } = nativeListingCreateInput.parse(input);
+        if (!ctx.confirmed)
+            return preview("listing.create", body);
+        return ctx.fetch("/commerce/v2/listings", {
+            method: "POST",
+            body,
+            headers: idempotencyHeaders(ctx, idempotencyKey),
+        });
     },
-};
-const MICRO_USD = 1_000_000;
+});
+// Markets books whole-second windows; a fractional digit would shift or refuse one.
+const wholeSecondInstant = z.iso
+    .datetime({ offset: true })
+    .refine((value) => !/\.\d*[1-9]/.test(value), "Use a time in whole seconds.");
 export const reservationCreateInput = z.object({
-    organization_id: z.string().uuid(),
-    listing_id: z.string().uuid(),
-    start_at: z.string().min(1),
-    end_at: z.string().min(1),
-    price_per_gpu_hour: z
+    organizationId: z.string().uuid().describe("The customer organization the window is booked for."),
+    listingId: z
+        .string()
+        .uuid()
+        .describe("The listing's capacityListingId. Staff may book any available listing."),
+    listingTermId: z
         .string()
-        .regex(/^\d+(?:\.\d{1,6})?$/)
-        .describe("USD per GPU-hour, for example 2.50."),
-    down_payment_cents: z.number().int().nonnegative().optional(),
-    notes: z.string().max(2000).optional(),
+        .uuid()
+        .describe("The listingTermsId of a non-renewable Reserved term on that listing."),
+    nodes: z.number().int().positive().max(2_147_483_647).describe("Whole nodes to book."),
+    startsAt: wholeSecondInstant.describe("RFC 3339 start of the window in whole seconds, no more than five minutes ago."),
+    endsAt: wholeSecondInstant.describe("RFC 3339 end of the window in whole seconds, at least an hour after the start and within the term's duration range."),
+    pricePerGpuHourMicroUsd: microUsd.describe("The term's price in micro-USD per GPU-hour. A changed price refuses the booking."),
+    idempotencyKey: z
+        .string()
+        .trim()
+        .min(1)
+        .max(200)
+        .describe("Reuse this key when retrying the same booking."),
 });
-function object(value) {
-    return value && typeof value === "object" && !Array.isArray(value)
-        ? value
-        : {};
-}
 export const adminReservationsCreateCapability = defineCapability({
     id: "reservations.create",
     domain: "reservations",
     roles: ["admin"],
-    description: "Create one schedule reservation on a listing from explicit, reviewed commercial terms (admin). The reservation covers the listing's nodes for the window.",
+    description: "Book a window of a listing term for a customer organization (admin). Markets holds the GPUs until the window starts, then settles a Commerce reservation with the booking's ID. Returns {bookings}.",
     mutation: "preview-confirm",
-    http: { method: "POST", path: "/commerce/reservations" },
+    http: { method: "POST", path: "/v1/markets/bookings" },
     cli: {
         command: ["admin", "reservations", "create"],
-        vnext: adminHelp(["admin", "reservations", "create"], "Create one schedule reservation from explicit commercial terms.", "ornn admin reservations create --organization ID --capacity-offer ID --starts-at TIME --ends-at TIME --price-per-gpu-hour USD [--down-payment-cents CENTS]", "Not supported in machine or redirected execution because reservation creation has no durable replay identity.", "Organization, listing, dates, price, and down payment are normalized before default-no consent."),
+        vnext: adminHelp(["admin", "reservations", "create"], "Book a listing term window for a customer organization.", "ornn admin reservations create --organization-id UUID --listing-id UUID --listing-term-id UUID --nodes COUNT --starts-at TIME --ends-at TIME --price-per-gpu-hour-micro-usd N --idempotency-key KEY", "Requires an eligible human terminal. Reuse --idempotency-key when retrying the same booking.", "Customer organization, listing, term, nodes, window, price, and idempotency key are reviewed before default-no consent."),
     },
     slack: false,
     input: reservationCreateInput,
     execute: async (ctx, input) => {
-        const parsed = reservationCreateInput.parse(input);
-        const body = {
-            listingId: parsed.listing_id,
-            organizationId: parsed.organization_id,
-            startsAt: parsed.start_at,
-            endsAt: parsed.end_at,
-            pricePerGpuHourMicroUsd: Math.round(Number(parsed.price_per_gpu_hour) * MICRO_USD),
-            ...(parsed.down_payment_cents !== undefined
-                ? { downPaymentCents: parsed.down_payment_cents }
-                : {}),
-            ...(parsed.notes ? { notes: parsed.notes } : {}),
-        };
+        const { organizationId, idempotencyKey, ...leg } = reservationCreateInput.parse(input);
+        const body = { organizationId, legs: [leg] };
         if (!ctx.confirmed)
             return { preview: body };
-        return { reservation: await ctx.fetch("/commerce/reservations", { method: "POST", body }) };
+        return ctx.fetch("/v1/markets/bookings", {
+            method: "POST",
+            body,
+            headers: idempotencyHeaders(ctx, idempotencyKey),
+        });
     },
 });
 export const adminCapacityReservationCapabilities = [

package/vendor/capabilities/capabilities/admin-enrollment.js

@@ -109,7 +109,7 @@ export const adminEnrollmentTokenRevokeCapability = defineCapability({
     roles: ["admin"],
     description: "Revoke one exact enrollment-token generation after reconciling its durable goal.",
     mutation: "preview-confirm",
-    http: { method: "POST", path: "/enrollment/tokens/{id}/revoke" },
+    http: { method: "DELETE", path: "/enrollment-tokens/{id}" },
     cli: {
         command: ["admin", "enrollment-tokens", "revoke"],
         vnext: adminHelp(["admin", "enrollment-tokens", "revoke"], "Revoke one exact enrollment-token generation.", "ornn admin enrollment-tokens revoke <token-id> [--expected-created-at TIME] [--yes]", "ornn admin enrollment-tokens revoke <token-id> --expected-created-at TIME --yes --idempotency-key KEY --format json", ["canonical token UUID", "token created_at generation"], "Review the exact token generation and the loss of future enrollment access."),
@@ -136,8 +136,8 @@ export const adminEnrollmentTokenRevokeCapability = defineCapability({
         if (!current.target.created_at) {
             throw codedError("token_identity_unavailable", `Enrollment token ${parsed.token_id} has no stable creation identity and cannot be revoked safely.`);
         }
-        const revoked = (await ctx.fetch(`/enrollment/tokens/${encodeURIComponent(parsed.token_id)}/revoke`, {
-            method: "POST",
+        const revoked = (await ctx.fetch(`/enrollment-tokens/${encodeURIComponent(parsed.token_id)}`, {
+            method: "DELETE",
             ...(parsed.idempotency_key
                 ? { headers: { "Idempotency-Key": parsed.idempotency_key } }
                 : {}),

package/vendor/capabilities/capabilities/admin.js

@@ -3,10 +3,10 @@ import { defineCapability } from "../capability.js";
 import { listFacilitiesCapability, listNodesCapability, listSuppliersCapability } from "./fleet.js";
 import { logsLatestCapability, telemetryLatestCapability } from "./observability.js";
 import { tokensListCapability } from "./tokens.js";
-import { usersQueryCapability } from "./users.js";
-import { adminCapacityOffersCreateCapability } from "./admin-capacity-reservations.js";
+import { organizationListCapability, usersListCapability } from "./users.js";
 export const ADMIN_CLI_ROOTS = [
     { name: "users" },
+    { name: "organizations" },
     { name: "suppliers" },
     { name: "facilities" },
     { name: "nodes" },
@@ -36,10 +36,11 @@ function withAdminBinding(capability, help) {
         },
     };
 }
-export const adminUsersSearchCapability = withAdminBinding(usersQueryCapability, adminHelp(["admin", "users", "search"], "Search the staff-authorized user directory.", "ornn admin users search [--name NAME] [--email EMAIL] [--organization NAME] [--limit 50] [--cursor CURSOR]", "ornn admin users search --email EMAIL --limit 50 [--cursor CURSOR] --format json"));
+export const adminUsersListCapability = withAdminBinding(usersListCapability, adminHelp(["admin", "users", "list"], "List users belonging to organizations in the Authorization directory.", "ornn admin users list [--query QUERY] [--organization UUID] [--limit 25] [--offset OFFSET] [--cursor CURSOR]", "ornn admin users list --query QUERY --limit 25 [--cursor CURSOR] --format json"));
+export const adminOrganizationsListCapability = withAdminBinding(organizationListCapability, adminHelp(["admin", "organizations", "list"], "List organizations in the Authorization directory.", "ornn admin organizations list [--query QUERY] [--role consumer|supplier] [--approved true|false] [--ids UUID,...] [--limit 25] [--offset OFFSET] [--cursor CURSOR]", "ornn admin organizations list --query QUERY --limit 25 [--cursor CURSOR] --format json"));
 export const adminSuppliersListCapability = withAdminBinding(listSuppliersCapability, adminHelp(["admin", "suppliers", "list"], "List supplier organizations visible to staff.", "ornn admin suppliers list [--limit 50] [--cursor CURSOR]", "ornn admin suppliers list --limit 50 --format json"));
 export const adminFacilitiesListCapability = withAdminBinding(listFacilitiesCapability, adminHelp(["admin", "facilities", "list"], "List facilities visible to staff.", "ornn admin facilities list [--supplier UUID] [--limit 50] [--cursor CURSOR]", "ornn admin facilities list --limit 50 --format json"));
-export const adminNodesListCapability = withAdminBinding(listNodesCapability, adminHelp(["admin", "nodes", "list"], "List enrolled, ghost, and off-grid nodes.", "ornn admin nodes list [--supplier UUID] [--facility FACILITY] [--status STATUS] [--email EMAIL] [--limit 50] [--cursor CURSOR]", "ornn admin nodes list --limit 50 [--cursor CURSOR] --format json"));
+export const adminNodesListCapability = withAdminBinding(listNodesCapability, adminHelp(["admin", "nodes", "list"], "List enrolled, ghost, and off-grid nodes.", "ornn admin nodes list [--supplier UUID] [--facility FACILITY] [--status STATUS] [--reservation UUID] [--limit 50] [--cursor CURSOR]", "ornn admin nodes list --limit 50 [--cursor CURSOR] --format json"));
 const nodeInput = z.object({ node_id: z.string().min(1) });
 export const adminNodeHealthCapability = defineCapability({
     id: "nodes.health",
@@ -64,7 +65,8 @@ export const adminNodeMetricsCapability = withAdminBinding(telemetryLatestCapabi
 export const adminNodeLogsCapability = withAdminBinding(logsLatestCapability, adminHelp(["admin", "nodes", "logs"], "Read one bounded node log page.", "ornn admin nodes logs <node-id> [--stream kernel|serial] [--count 200] [--before TIME] [--cursor CURSOR]", "ornn admin nodes logs <node-id> --stream kernel --count 200 [--before TIME] [--cursor CURSOR] --format json", ["canonical node ID"]));
 export const adminEnrollmentTokensListCapability = withAdminBinding(tokensListCapability, adminHelp(["admin", "enrollment-tokens", "list"], "List enrollment-token metadata without token bytes.", "ornn admin enrollment-tokens list [--limit 50] [--cursor CURSOR]", "ornn admin enrollment-tokens list --limit 50 --format json"));
 export const adminCapabilities = [
-    adminUsersSearchCapability,
+    adminUsersListCapability,
+    adminOrganizationsListCapability,
     adminSuppliersListCapability,
     adminFacilitiesListCapability,
     adminNodesListCapability,
@@ -74,14 +76,14 @@ export const adminCapabilities = [
     adminEnrollmentTokensListCapability,
 ];
 const replacements = {
-    "listings.create": adminCapacityOffersCreateCapability,
     "facilities.list": adminFacilitiesListCapability,
     "logs.latest": adminNodeLogsCapability,
     "nodes.list": adminNodesListCapability,
     "supplier.list": adminSuppliersListCapability,
     "telemetry.latest": adminNodeMetricsCapability,
     "tokens.list": adminEnrollmentTokensListCapability,
-    "users.query": adminUsersSearchCapability,
+    "users.list": adminUsersListCapability,
+    "organization.list": adminOrganizationsListCapability,
 };
 /** Applies canonical admin CLI bindings without changing MCP or Slack identities. */
 export function bindAdminCapabilities(capabilities) {