@ornncompute/cli 1.0.72 → 1.0.75

package/src/mount-commands.mjs

@@ -640,7 +640,7 @@ async function show(input, runtime, command) {
   return mountResult(runtime.interaction, await fetchMount(runtime, reservationId), reservationId);
 }
 
-export async function attachVolumeMount(input, runtime, { skipReview = false } = {}) {
+export async function attachVolumeMount(input, runtime) {
   const [rawReservation] = positionals(
     input,
     1,
@@ -684,50 +684,23 @@ export async function attachVolumeMount(input, runtime, { skipReview = false } =
       }
     );
   }
-  if (!skipReview) {
-    const accepted = await runtime.interaction.review({
-      title: "Attach managed volume",
-      terms: [
-        { label: "Capacity reservation", value: reservationId },
-        { label: "Managed volume", value: `${projectedVolume.name} (${projectedVolume.id})` },
-        { label: "Access", value: access },
-        { label: "Machine scope", value: "Every machine in the reservation" },
-        {
-          label: "Volume lifecycle",
-          value: "The volume remains independent from this relationship",
-        },
-      ],
-      prompt: "Attach this volume?",
+  const refreshedVolume = safeVolume(await resolveVolume(runtime, projectedVolume.id));
+  if (refreshedVolume.id !== projectedVolume.id || refreshedVolume.name !== projectedVolume.name) {
+    runtime.interaction.error("The selected managed volume changed before attachment.", {
+      code: "volume_selection_changed",
+    });
+  }
+  current = await fetchMount(runtime, reservationId);
+  if (current && ["detached", "ended"].includes(current.lifecycle.phase)) current = null;
+  if (mountSatisfied(current, goal)) {
+    return wait && !mountReady(current)
+      ? waitForMount(input, runtime, reservationId, current, "volume-mounts attach")
+      : mountResult(runtime.interaction, current, reservationId, { replayed: true });
+  }
+  if (current) {
+    runtime.interaction.error("The volume-mount relationship changed before attachment.", {
+      code: "volume_mount_conflict",
     });
-    if (!accepted) {
-      return runtime.interaction.result({
-        errors: [{ code: "declined", message: "Volume attachment declined.", retryable: false }],
-        exitCode: 1,
-        outcome: { class: "ended", phase: "declined" },
-        presentation: { lines: ["Volume attachment declined. No relationship was created."] },
-      });
-    }
-    const refreshedVolume = safeVolume(await resolveVolume(runtime, projectedVolume.id));
-    if (
-      refreshedVolume.id !== projectedVolume.id ||
-      refreshedVolume.name !== projectedVolume.name
-    ) {
-      runtime.interaction.error("The selected managed volume changed after review.", {
-        code: "volume_selection_changed",
-      });
-    }
-    current = await fetchMount(runtime, reservationId);
-    if (current && ["detached", "ended"].includes(current.lifecycle.phase)) current = null;
-    if (mountSatisfied(current, goal)) {
-      return wait && !mountReady(current)
-        ? waitForMount(input, runtime, reservationId, current, "volume-mounts attach")
-        : mountResult(runtime.interaction, current, reservationId, { replayed: true });
-    }
-    if (current) {
-      runtime.interaction.error("The volume-mount relationship changed after review.", {
-        code: "volume_mount_conflict",
-      });
-    }
   }
 
   try {
@@ -805,7 +778,7 @@ async function waitCommand(input, runtime, command) {
   );
 }
 
-export async function detachVolumeMount(input, runtime, { skipReview = false } = {}) {
+export async function detachVolumeMount(input, runtime) {
   const [rawReservation] = positionals(
     input,
     1,
@@ -831,42 +804,13 @@ export async function detachVolumeMount(input, runtime, { skipReview = false } =
       },
     });
   }
-  if (!skipReview) {
-    const accepted = await runtime.interaction.review({
-      title: "Detach managed volume",
-      terms: [
-        { label: "Capacity reservation", value: reservationId },
-        {
-          label: "Managed volume",
-          value: `${current.volume.name ?? "Managed volume"} (${current.volume.id})`,
-        },
-        {
-          label: "Mounted machines",
-          value: `${current.readiness.ready} of ${current.readiness.expected}`,
-        },
-        {
-          label: "Consequence",
-          value: "Mounted access ends; the managed volume and its data remain",
-        },
-      ],
-      prompt: "Detach this volume?",
+  const refreshed = await fetchMount(runtime, reservationId);
+  if (!refreshed || refreshed.id !== current.id || refreshed.volume.id !== current.volume.id) {
+    runtime.interaction.error("The volume-mount relationship changed before detachment.", {
+      code: "volume_mount_changed",
     });
-    if (!accepted) {
-      return runtime.interaction.result({
-        errors: [{ code: "declined", message: "Volume detachment declined.", retryable: false }],
-        exitCode: 1,
-        outcome: { class: "ended", phase: "declined" },
-        presentation: { lines: ["Volume detachment declined. No relationship was changed."] },
-      });
-    }
-    const refreshed = await fetchMount(runtime, reservationId);
-    if (!refreshed || refreshed.id !== current.id || refreshed.volume.id !== current.volume.id) {
-      runtime.interaction.error("The volume-mount relationship changed after review.", {
-        code: "volume_mount_changed",
-      });
-    }
-    current = refreshed;
   }
+  current = refreshed;
   try {
     await runtime.fetch(reservationAttachmentPath(reservationId), {
       method: "DELETE",
@@ -933,28 +877,10 @@ async function deployFilesystem(input, runtime) {
       ? waitForMount(input, runtime, reservationId, current, "filesystems deploy")
       : mountResult(runtime.interaction, current, reservationId, { replayed: true });
   }
-  const accepted = await runtime.interaction.review({
-    title: "Deploy managed filesystem",
-    terms: [
-      { label: "Capacity reservation", value: reservationId },
-      { label: "Performance tier", value: performanceTier },
-      { label: "Capacity", value: `${capacityGib} GiB` },
-      { label: "Readiness", value: "Reported independently for every machine" },
-    ],
-    prompt: "Deploy this filesystem?",
-  });
-  if (!accepted) {
-    return runtime.interaction.result({
-      errors: [{ code: "declined", message: "Filesystem deployment declined.", retryable: false }],
-      exitCode: 1,
-      outcome: { class: "ended", phase: "declined" },
-      presentation: { lines: ["Filesystem deployment declined. No deployment was created."] },
-    });
-  }
   current = await fetchMount(runtime, reservationId);
   if (current && ["detached", "ended"].includes(current.lifecycle.phase)) current = null;
   if (current && !filesystemSatisfied(current, performanceTier, capacityGib)) {
-    runtime.interaction.error("The managed filesystem relationship changed after review.", {
+    runtime.interaction.error("The managed filesystem relationship changed before deployment.", {
       code: "filesystem_deployment_conflict",
     });
   }
@@ -1032,41 +958,9 @@ async function deleteFilesystem(input, runtime) {
       },
     });
   }
-  const accepted = await runtime.interaction.review({
-    title: "Delete managed filesystem deployment",
-    terms: [
-      { label: "Capacity reservation", value: reservationId },
-      {
-        label: "Managed volume",
-        value: `${current.volume.name ?? "Managed volume"} (${current.volume.id})`,
-      },
-      {
-        label: "Mounted machines",
-        value: `${current.readiness.ready} of ${current.readiness.expected}`,
-      },
-      {
-        label: "Consequence",
-        value: "Filesystem access ends; the managed volume and its data remain",
-      },
-    ],
-    prompt: "Delete this filesystem deployment?",
-  });
-  if (!accepted) {
-    return runtime.interaction.result({
-      data: {
-        filesystem_deployment: current,
-        reservation_id: reservationId,
-        volume_preserved: current.volume,
-      },
-      errors: [{ code: "declined", message: "Filesystem deletion declined.", retryable: false }],
-      exitCode: 1,
-      outcome: { class: "ended", phase: "declined" },
-      presentation: { lines: ["Filesystem deletion declined. No relationship was changed."] },
-    });
-  }
   const refreshed = await fetchMount(runtime, reservationId);
   if (!refreshed || refreshed.id !== current.id || refreshed.volume.id !== current.volume.id) {
-    runtime.interaction.error("The managed filesystem relationship changed after review.", {
+    runtime.interaction.error("The managed filesystem relationship changed before deletion.", {
       code: "filesystem_deployment_changed",
     });
   }

package/src/storage-commands.mjs

@@ -21,11 +21,6 @@ import {
 const DEFAULT_PAGE_LIMIT = 50;
 const MAX_PAGE_LIMIT = 500;
 const STORAGE_PREFIX = "/nodes/storage-drives";
-const UNSAFE_CONTENT_COMMANDS = new Set([
-  "storage.volumes.clear",
-  "storage.volumes.files.delete",
-  "storage.volumes.folders.delete",
-]);
 
 /**
  * Narrow CLI adapter expected by executeStorageCommand:
@@ -381,48 +376,11 @@ export async function resolveVolume(runtime, reference) {
   return resolveFromRows(await fetchDrives(runtime), reference);
 }
 
-async function review(runtime, options) {
-  const accepted = await runtime.interaction.review(options);
-  if (accepted !== false) return null;
-  return runtime.interaction.result({
-    data: null,
-    exitCode: 1,
-    outcome: { class: "ended", phase: "declined" },
-  });
-}
-
-async function unsafeReview(command, input, runtime, reference, remotePath) {
-  if (!UNSAFE_CONTENT_COMMANDS.has(command)) return null;
-  const title =
-    command === "storage.volumes.clear"
-      ? "Clear volume contents"
-      : command === "storage.volumes.files.delete"
-        ? "Delete volume file"
-        : "Delete volume folder";
-  const terms = [
-    { label: "Volume", value: reference },
-    ...(remotePath ? [{ label: "Remote path", value: remotePath }] : []),
-    {
-      label: "Consequence",
-      value:
-        command === "storage.volumes.clear"
-          ? "Every file and folder will be permanently deleted"
-          : "The selected content will be permanently deleted",
-    },
-  ];
-  return review(runtime, {
-    prompt: "Continue?",
-    requireLive: true,
-    terms,
-    title,
-  });
-}
-
 async function createVolume(input, runtime) {
   positionals(
     input,
     0,
-    "Usage: ornn volumes create --name <name> [--source <volume>] [--yes] [--idempotency-key <key>]"
+    "Usage: ornn volumes create --name <name> [--source <volume>] [--idempotency-key <key>]"
   );
   requireMachineMutationKey(input, runtime);
   const name = normalizeVolumeName(input.name);
@@ -439,21 +397,6 @@ async function createVolume(input, runtime) {
       { code: "volume_name_ambiguous", field: "name" }
     );
   }
-  const declined = await review(runtime, {
-    prompt: "Create this volume?",
-    terms: [
-      { label: "Volume name", value: name },
-      { label: "Source", value: source ? String(source.id) : "empty volume" },
-      {
-        label: "Consequence",
-        value: source
-          ? "Create a durable managed volume copied from the selected source"
-          : "Create an empty durable managed volume",
-      },
-    ],
-    title: "Create volume",
-  });
-  if (declined) return declined;
   if (matches.length === 1) {
     const existing = matches[0];
     const existingSource = existing?.source_drive_id ?? existing?.source?.source_drive_id ?? null;
@@ -550,8 +493,6 @@ async function showVolume(input, runtime, { refresh = false } = {}) {
 
 async function clearVolume(input, runtime) {
   const [reference] = positionals(input, 1, "Usage: ornn volumes clear <volume>");
-  const declined = await unsafeReview("storage.volumes.clear", input, runtime, reference);
-  if (declined) return declined;
   const drive = await resolveVolume(runtime, reference);
   try {
     const payload = await runtime.fetch(
@@ -590,15 +531,6 @@ async function clearVolume(input, runtime) {
 async function deleteVolume(input, runtime) {
   const [reference] = positionals(input, 1, "Usage: ornn volumes delete <volume>");
   requireMachineMutationKey(input, runtime);
-  const declined = await review(runtime, {
-    prompt: "Delete this volume?",
-    terms: [
-      { label: "Volume", value: reference },
-      { label: "Consequence", value: "The volume and all data in it will be permanently deleted" },
-    ],
-    title: "Delete volume",
-  });
-  if (declined) return declined;
   const drive = await resolveVolume(runtime, reference);
   try {
     await runtime.fetch(
@@ -802,7 +734,7 @@ async function uploadFile(input, runtime) {
   const [reference, localFile] = positionals(
     input,
     2,
-    "Usage: ornn volumes files upload <volume> <local-file> [--path <remote-path>] [--content-type <type>] [--yes] [--idempotency-key <key>]"
+    "Usage: ornn volumes files upload <volume> <local-file> [--path <remote-path>] [--content-type <type>] [--idempotency-key <key>]"
   );
   requireMachineMutationKey(input, runtime);
   let fileInfo;
@@ -825,21 +757,6 @@ async function uploadFile(input, runtime) {
     ? requiredText(input.contentType, "--content-type")
     : "application/octet-stream";
   const drive = await resolveVolume(runtime, reference);
-  const declined = await review(runtime, {
-    prompt: "Upload this file?",
-    terms: [
-      { label: "Volume", value: `${drive.name} (${drive.id})` },
-      { label: "Local file", value: localFile },
-      { label: "Remote path", value: remotePath },
-      { label: "Bytes", value: String(fileInfo.size) },
-      {
-        label: "Consequence",
-        value: "Create or replace the selected path in the managed volume",
-      },
-    ],
-    title: "Upload volume file",
-  });
-  if (declined) return declined;
   const requestHash = createHash("sha256");
   for await (const chunk of createReadStream(localFile)) requestHash.update(chunk);
   const sha256 = requestHash.digest("hex");
@@ -1032,8 +949,6 @@ async function deleteContent(command, input, runtime) {
     `Usage: ornn volumes ${kind === "file" ? "files" : "folders"} delete <volume> <remote-path>`
   );
   const remotePath = normalizeRemotePath(rawRemotePath);
-  const declined = await unsafeReview(command, input, runtime, reference, remotePath);
-  if (declined) return declined;
   const drive = await resolveVolume(runtime, reference);
   const endpoint = computeEndpoint(
     `${STORAGE_PREFIX}/${encodeURIComponent(String(drive.id))}/${kind}s/${encodedRemotePath(remotePath)}`

package/src/vm-commands.mjs

@@ -303,7 +303,6 @@ function failedOperationRecoveryCommand(value, interaction) {
       `--mode ${accessMode}`,
       `--network ${networkMode}`,
       accessMode !== sourceMode ? "--erase-local-data" : null,
-      "--yes",
       `--idempotency-key ${requestId}`,
     ]
       .filter(Boolean)
@@ -317,7 +316,6 @@ function failedOperationRecoveryCommand(value, interaction) {
       `ornn machines ${command}`,
       shellQuote(id),
       command === "reset" ? "--erase-local-data" : null,
-      "--yes",
       `--idempotency-key ${requestId}`,
     ]
       .filter(Boolean)
@@ -392,7 +390,7 @@ function positional(input, expected, usage, interaction) {
   return values;
 }
 
-function machineMutationPreflight(input, interaction, { requireYes = true } = {}) {
+function machineMutationPreflight(input, interaction) {
   if (!interaction.machine) return;
   if (!text(input.idempotencyKey)) {
     interaction.usage("--idempotency-key is required for automation.", {
@@ -400,12 +398,6 @@ function machineMutationPreflight(input, interaction, { requireYes = true } = {}
       field: "idempotencyKey",
     });
   }
-  if (requireYes && input.yes !== true) {
-    interaction.usage("--yes is required for automation after reviewing the exact intent.", {
-      code: "consent_required",
-      field: "yes",
-    });
-  }
 }
 
 async function selectedOrganization(context, interaction, expectedId) {
@@ -821,12 +813,6 @@ function launchInputPreflight(input, interaction) {
       field: "label",
     });
   }
-  if (input.yes !== true) {
-    interaction.usage("--yes is required for automation after reviewing the launch intent.", {
-      code: "consent_required",
-      field: "yes",
-    });
-  }
   if (!text(input.idempotencyKey)) {
     interaction.usage("--idempotency-key is required for automation.", {
       code: "idempotency_key_required",
@@ -1199,7 +1185,7 @@ export const vmLaunchModeHandler = {
           resourceId(key),
           "--idempotency-key",
           idempotencyKey,
-          ...(interaction.machine ? ["--yes", "--no-wait", "--format", "json"] : []),
+          ...(interaction.machine ? ["--no-wait", "--format", "json"] : []),
         ].join(" ");
         return uncertainMutationFailure(interaction, error, {
           data: {
@@ -1559,7 +1545,6 @@ function durableWorkspaceAllocation(reservation, interaction) {
 function workspaceStepContext(context, interaction, signal) {
   const stepInteraction = Object.create(interaction);
   stepInteraction.review = async () => true;
-  stepInteraction.options = { ...interaction.options, yes: true };
   return {
     ...context,
     fetch: (path, init = {}) =>
@@ -1681,7 +1666,7 @@ function workspaceResumeCommand(input, goal, facts, id, interaction, localResume
   if (goal.username) parts.push("--username", goal.username);
   if (input.noWait) parts.push("--no-wait");
   if (input.wait) parts.push("--wait", "--timeout", text(input.timeout));
-  if (interaction.machine) parts.push("--yes", "--format", interaction.format);
+  if (interaction.machine) parts.push("--format", interaction.format);
   return parts.map(shellQuote).join(" ");
 }
 
@@ -1952,7 +1937,6 @@ async function launchDurableBareMetalWorkspace({
         $positionals: [reservationId],
         key: resourceId(key),
         idempotencyKey: `${id}:ssh-key`,
-        yes: true,
       }
     );
     states.ssh_key_assignment = {
@@ -1988,7 +1972,6 @@ async function launchDurableBareMetalWorkspace({
         idempotencyKey: `${id}:volume-mount`,
         noWait: true,
         volume: facts.volume.id,
-        yes: true,
       }
     );
     facts.volumeMount = mount.data.volume_mount;
@@ -2464,7 +2447,7 @@ export const bareMetalLaunchModeHandler = {
           resourceId(key),
           "--idempotency-key",
           idempotencyKey,
-          ...(interaction.machine ? ["--yes", "--no-wait", "--format", "json"] : []),
+          ...(interaction.machine ? ["--no-wait", "--format", "json"] : []),
         ].join(" ");
         return uncertainMutationFailure(interaction, error, {
           data: {
@@ -3002,24 +2985,12 @@ function validateWaitInput(input, interaction, { waitCommand = false } = {}) {
 function requireMachineMutationSafety(input, interaction, { destructive = false } = {}) {
   validateWaitInput(input, interaction);
   if (destructive && input.eraseLocalData !== true) {
-    interaction.usage(
-      "machines reset requires --erase-local-data; --yes cannot infer destructive scope.",
-      {
-        code: "erase_local_data_required",
-        field: "eraseLocalData",
-      }
-    );
+    interaction.usage("machines reset requires --erase-local-data.", {
+      code: "erase_local_data_required",
+      field: "eraseLocalData",
+    });
   }
   if (interaction.machine || !interaction.eligibleHuman) {
-    if (input.yes !== true) {
-      interaction.usage(
-        "--yes is required outside an eligible terminal after reviewing the exact intent.",
-        {
-          code: "consent_required",
-          field: "yes",
-        }
-      );
-    }
     if (!text(input.idempotencyKey)) {
       interaction.usage("--idempotency-key is required outside an eligible terminal.", {
         code: "idempotency_key_required",
@@ -3452,7 +3423,7 @@ async function switchMachine(input, context, interaction) {
   const erasesLocalData = targetMode !== currentMode;
   if (erasesLocalData && input.eraseLocalData !== true) {
     interaction.usage(
-      "Changing between VM and Bare Metal permanently erases source-local data and requires --erase-local-data; --yes cannot infer destructive scope.",
+      "Changing between VM and Bare Metal permanently erases source-local data and requires --erase-local-data; cannot infer destructive scope.",
       { code: "erase_local_data_required", field: "eraseLocalData" }
     );
   }
@@ -3561,7 +3532,6 @@ async function switchMachine(input, context, interaction) {
     requestedMode ? `--mode ${requestedMode}` : null,
     requestedNetwork ? `--network ${requestedNetwork}` : null,
     erasesLocalData ? "--erase-local-data" : null,
-    "--yes",
     "--no-wait",
     `--idempotency-key ${shellQuote(idempotencyKey)}`,
   ]
@@ -3663,7 +3633,6 @@ async function switchMachine(input, context, interaction) {
     `--mode ${targetMode}`,
     `--network ${targetNetwork}`,
     erasesLocalData ? "--erase-local-data" : null,
-    "--yes",
     `--idempotency-key ${shellQuote(interaction.idempotencyKey())}`,
   ]
     .filter(Boolean)
@@ -3781,7 +3750,6 @@ async function maintainMachine(command, input, context, interaction) {
     `ornn machines ${command}`,
     shellQuote(machineId(machine)),
     destructive ? "--erase-local-data" : null,
-    "--yes",
     "--no-wait",
     `--idempotency-key ${shellQuote(idempotencyKey)}`,
   ]
@@ -3874,7 +3842,6 @@ async function maintainMachine(command, input, context, interaction) {
     `ornn machines ${command}`,
     shellQuote(machineId(waitOutcome.value)),
     destructive ? "--erase-local-data" : null,
-    "--yes",
     `--idempotency-key ${shellQuote(interaction.idempotencyKey())}`,
   ]
     .filter(Boolean)

package/vendor/capabilities/capabilities/admin-enrollment.js

@@ -44,11 +44,13 @@ export const adminEnrollmentTokensListCapability = {
         };
     },
 };
-export const adminEnrollmentTokenCreateCapability = withVnextBinding(tokensCreateCapability, adminHelp(["admin", "enrollment-tokens", "create"], "Create one expiring enrollment token through an explicit secret export.", "ornn admin enrollment-tokens create --supplier UUID --expires-in SECONDS (--print | --output PATH) [--overwrite] [--yes]", "Unsupported: token creation requires an eligible human terminal.", ["canonical supplier organization UUID"], "Review the supplier, expiry, and secret destination before minting the token."));
+export const adminEnrollmentTokenCreateCapability = withVnextBinding(tokensCreateCapability, adminHelp(["admin", "enrollment-tokens", "create"], "Create one expiring enrollment token through an explicit secret export.", "ornn admin enrollment-tokens create --supplier UUID --expires-in SECONDS (--print | --output PATH) [--overwrite] []", "Unsupported: token creation requires an eligible human terminal.", ["canonical supplier organization UUID"], "Review the supplier, expiry, and secret destination before minting the token."));
 const tokenRevokeInput = z.object({
-    token_id: UUID,
+    tokenId: z.string().min(1),
+    token_id: UUID.optional(),
     expected_created_at: nonEmpty.optional(),
     idempotency_key: nonEmpty.optional(),
+    confirm: z.boolean().optional(),
 });
 function rowsFromTokenList(payload) {
     if (Array.isArray(payload))
@@ -104,22 +106,23 @@ async function readExactToken(ctx, tokenId, expectedCreatedAt) {
     return { disposition: "apply", target };
 }
 export const adminEnrollmentTokenRevokeCapability = defineCapability({
-    id: "tokens.revoke",
+    id: "enrollment.token.revoke",
     domain: "fleet",
     roles: ["admin"],
-    description: "Revoke one exact enrollment-token generation after reconciling its durable goal.",
+    description: "Internal staff only: revoke one exact enrollment-token generation after reconciling its durable goal.",
     mutation: "preview-confirm",
-    http: { method: "DELETE", path: "/enrollment-tokens/{id}" },
+    http: { method: "DELETE", path: "/enrollment-tokens/{tokenId}" },
     cli: {
         command: ["admin", "enrollment-tokens", "revoke"],
-        vnext: adminHelp(["admin", "enrollment-tokens", "revoke"], "Revoke one exact enrollment-token generation.", "ornn admin enrollment-tokens revoke <token-id> [--expected-created-at TIME] [--yes]", "ornn admin enrollment-tokens revoke <token-id> --expected-created-at TIME --yes --idempotency-key KEY --format json", ["canonical token UUID", "token created_at generation"], "Review the exact token generation and the loss of future enrollment access."),
+        vnext: adminHelp(["admin", "enrollment-tokens", "revoke"], "Revoke one exact enrollment-token generation.", "ornn admin enrollment-tokens revoke <token-id> [--expected-created-at TIME] []", "ornn admin enrollment-tokens revoke <token-id> --expected-created-at TIME  --idempotency-key KEY --format json", ["canonical token UUID", "token created_at generation"], "Review the exact token generation and the loss of future enrollment access."),
     },
-    mcp: false,
     slack: false,
+    mcp: { name: "enrollment_token_revoke" },
     input: tokenRevokeInput,
     execute: async (ctx, input) => {
         const parsed = tokenRevokeInput.parse(input);
-        const current = await readExactToken(ctx, parsed.token_id, parsed.expected_created_at);
+        const tokenId = parsed.tokenId ?? parsed.token_id;
+        const current = await readExactToken(ctx, tokenId, parsed.expected_created_at);
         if (!ctx.confirmed)
             return current;
         if (current.disposition === "conflict") {
@@ -127,23 +130,21 @@ export const adminEnrollmentTokenRevokeCapability = defineCapability({
         }
         if (current.disposition === "satisfied") {
             return {
-                id: parsed.token_id,
+                id: tokenId,
                 created_at: parsed.expected_created_at ?? current.target?.created_at ?? null,
                 status: "revoked",
                 reconciled: true,
             };
         }
         if (!current.target.created_at) {
-            throw codedError("token_identity_unavailable", `Enrollment token ${parsed.token_id} has no stable creation identity and cannot be revoked safely.`);
+            throw codedError("token_identity_unavailable", `Enrollment token ${tokenId} has no stable creation identity and cannot be revoked safely.`);
         }
-        const revoked = (await ctx.fetch(`/enrollment-tokens/${encodeURIComponent(parsed.token_id)}`, {
+        const revoked = (await ctx.fetch(`/enrollment-tokens/${encodeURIComponent(tokenId)}`, {
             method: "DELETE",
-            ...(parsed.idempotency_key
-                ? { headers: { "Idempotency-Key": parsed.idempotency_key } }
-                : {}),
+            ...(parsed.idempotency_key ? { headers: { "Idempotency-Key": parsed.idempotency_key } } : {}),
         }));
         return {
-            id: parsed.token_id,
+            id: tokenId,
             created_at: current.target.created_at,
             organization_id: current.target.organization_id,
             expires_at: current.target.expires_at,
@@ -190,7 +191,7 @@ export const adminNodeEnrollCapability = defineCapability({
     http: { method: "POST", path: "/remote" },
     cli: {
         command: ["admin", "nodes", "enroll"],
-        vnext: adminHelp(["admin", "nodes", "enroll"], "Install Ornn management on one explicitly assigned node.", "ornn admin nodes enroll <node-id> --host HOST --supplier UUID --facility UUID [--filter COMPARTMENT_IDS] --identity-file PATH --token-ttl SECONDS --replace-existing-management [--verbose] [--yes]", "Unsupported: remote enrollment requires an eligible human terminal.", ["canonical node UUID", "canonical supplier organization UUID", "canonical facility UUID"], "Review node identity, SSH target, assignment, compartment filter, and replacement of existing management."),
+        vnext: adminHelp(["admin", "nodes", "enroll"], "Install Ornn management on one explicitly assigned node.", "ornn admin nodes enroll <node-id> --host HOST --supplier UUID --facility UUID [--filter COMPARTMENT_IDS] --identity-file PATH --token-ttl SECONDS --replace-existing-management [--verbose] []", "Unsupported: remote enrollment requires an eligible human terminal.", ["canonical node UUID", "canonical supplier organization UUID", "canonical facility UUID"], "Review node identity, SSH target, assignment, compartment filter, and replacement of existing management."),
     },
     mcp: false,
     slack: false,
@@ -291,7 +292,7 @@ export const adminNodeRotateKeyCapability = defineCapability({
     http: { method: "POST", path: "/enrollment/admin-ssh-key" },
     cli: {
         command: ["admin", "nodes", "rotate-key"],
-        vnext: adminHelp(["admin", "nodes", "rotate-key"], "Rotate one node admin key and export the replacement deliberately.", "ornn admin nodes rotate-key <node-id> (--print | --output PATH) [--overwrite] [--yes]", "Unsupported: key rotation requires an eligible human terminal.", ["canonical node UUID"], "Review the node and loss of access through the previous private key."),
+        vnext: adminHelp(["admin", "nodes", "rotate-key"], "Rotate one node admin key and export the replacement deliberately.", "ornn admin nodes rotate-key <node-id> (--print | --output PATH) [--overwrite] []", "Unsupported: key rotation requires an eligible human terminal.", ["canonical node UUID"], "Review the node and loss of access through the previous private key."),
     },
     mcp: false,
     slack: false,