@ornncompute/cli 1.0.72 → 1.0.97

package/vendor/capabilities/capabilities/admin-capacity-reservations.js

@@ -1,101 +0,0 @@
-import { z } from "zod";
-import { defineCapability, preview } from "../capability.js";
-import { ensureFacility, locateRegion, unplacedLocation } from "./locality.js";
-import { nativeListingCreateInput } from "./native-listing.js";
-import { idempotencyHeaders, microUsd } from "./market-shared.js";
-function adminHelp(command, outcome, human, automation, review) {
-    return {
-        audience: "admin",
-        category: "resource",
-        command,
-        outcome,
-        human,
-        automation,
-        acceptedReferences: [],
-        ...(review ? { review } : {}),
-    };
-}
-export const adminCapacityOffersCreateCapability = defineCapability({
-    id: "listing.create",
-    domain: "listings",
-    roles: ["admin"],
-    description: "Create native capacity with an organization, a facilityId or a location, hardware, availability and advertised terms. A location is any state, city, address, or catalog region (us-west-3); Ornn places it in a catalog region and uses the organization's facility there. Primary capacity needs daysToRfs (0 when ready now) or both availableAt and availableUntil. nodeIds attach nodes at creation. Returns {listing, terms}. Requires an idempotencyKey reused on retries and confirm: true.",
-    mutation: "preview-confirm",
-    http: { method: "POST", path: "/commerce/v2/listings" },
-    input: nativeListingCreateInput,
-    slack: false,
-    cli: {
-        command: ["admin", "capacity-offers", "create"],
-        vnext: adminHelp(["admin", "capacity-offers", "create"], "Create native capacity and its advertised financial terms.", "ornn admin capacity-offers create --gpu-slug GPU --gpus-per-node COUNT (--facility-id UUID | --location PLACE) --provisioning-type bare-metal|virtual-machine --state draft|available --terms JSON --idempotency-key KEY (--days-to-rfs DAYS | --available-at TIME --available-until TIME) [--capacity-node-count COUNT] [--node-ids JSON] [--organization-id UUID]", "Requires an eligible human terminal; --location also needs --organization-id; reuse --idempotency-key on retries.", "Review the native parent fields and each financial term before default-no consent."),
-    },
-    execute: async (ctx, input) => {
-        const { confirm: _confirm, idempotencyKey, location, ...body } = nativeListingCreateInput.parse(input);
-        const located = location ? await locateRegion(ctx.fetch, location) : null;
-        if (location && !located)
-            throw new Error(unplacedLocation(location));
-        if (!ctx.confirmed)
-            return preview("listing.create", located ? { ...body, located } : body);
-        const facilityId = located
-            ? (await ensureFacility(ctx.fetch, body.organizationId, located.region)).facilityId
-            : body.facilityId;
-        return ctx.fetch("/commerce/v2/listings", {
-            method: "POST",
-            body: { ...body, facilityId },
-            headers: idempotencyHeaders(ctx, idempotencyKey),
-        });
-    },
-});
-// Markets books whole-second windows; a fractional digit would shift or refuse one.
-const wholeSecondInstant = z.iso
-    .datetime({ offset: true })
-    .refine((value) => !/\.\d*[1-9]/.test(value), "Use a time in whole seconds.");
-export const reservationCreateInput = z.object({
-    organizationId: z.string().uuid().describe("The customer organization the window is booked for."),
-    listingId: z
-        .string()
-        .uuid()
-        .describe("The listing's capacityListingId. Staff may book any available listing."),
-    listingTermId: z
-        .string()
-        .uuid()
-        .describe("The listingTermsId of a non-renewable Reserved term on that listing."),
-    nodes: z.number().int().positive().max(2_147_483_647).describe("Whole nodes to book."),
-    startsAt: wholeSecondInstant.describe("RFC 3339 start of the window in whole seconds, no more than five minutes ago."),
-    endsAt: wholeSecondInstant.describe("RFC 3339 end of the window in whole seconds, at least an hour after the start and within the term's duration range."),
-    pricePerGpuHourMicroUsd: microUsd.describe("The term's price in micro-USD per GPU-hour. A changed price refuses the booking."),
-    idempotencyKey: z
-        .string()
-        .trim()
-        .min(1)
-        .max(200)
-        .describe("Reuse this key when retrying the same booking."),
-});
-export const adminReservationsCreateCapability = defineCapability({
-    id: "reservations.create",
-    domain: "reservations",
-    roles: ["admin"],
-    description: "Book a window of a listing term for a customer organization (admin). Markets holds the GPUs until the window starts, then settles a Commerce reservation with the booking's ID. Returns {bookings}.",
-    mutation: "preview-confirm",
-    http: { method: "POST", path: "/v1/markets/bookings" },
-    cli: {
-        command: ["admin", "reservations", "create"],
-        vnext: adminHelp(["admin", "reservations", "create"], "Book a listing term window for a customer organization.", "ornn admin reservations create --organization-id UUID --listing-id UUID --listing-term-id UUID --nodes COUNT --starts-at TIME --ends-at TIME --price-per-gpu-hour-micro-usd N --idempotency-key KEY", "Requires an eligible human terminal. Reuse --idempotency-key when retrying the same booking.", "Customer organization, listing, term, nodes, window, price, and idempotency key are reviewed before default-no consent."),
-    },
-    slack: false,
-    input: reservationCreateInput,
-    execute: async (ctx, input) => {
-        const { organizationId, idempotencyKey, ...leg } = reservationCreateInput.parse(input);
-        const body = { organizationId, legs: [leg] };
-        if (!ctx.confirmed)
-            return { preview: body };
-        return ctx.fetch("/v1/markets/bookings", {
-            method: "POST",
-            body,
-            headers: idempotencyHeaders(ctx, idempotencyKey),
-        });
-    },
-});
-export const adminCapacityReservationCapabilities = [
-    adminCapacityOffersCreateCapability,
-    adminReservationsCreateCapability,
-];

package/vendor/capabilities/capabilities/admin-enrollment.js

@@ -1,321 +0,0 @@
-import { z } from "zod";
-import { defineCapability } from "../capability.js";
-import { buildEnrollmentInstallCommand, tokensCreateCapability, tokensListCapability, } from "./tokens.js";
-const UUID = z.string().uuid();
-const nonEmpty = z.string().trim().min(1);
-const tokenTtl = z
-    .number()
-    .int()
-    .min(60)
-    .max(24 * 60 * 60);
-function adminHelp(command, outcome, human, automation, acceptedReferences = [], review) {
-    return {
-        audience: "admin",
-        category: "resource",
-        command,
-        outcome,
-        human,
-        automation,
-        acceptedReferences,
-        ...(review ? { review } : {}),
-    };
-}
-function withVnextBinding(capability, help) {
-    if (!help.command)
-        throw new Error(`${capability.id} requires a canonical CLI command`);
-    return {
-        ...capability,
-        cli: {
-            command: [...help.command],
-            vnext: help,
-        },
-    };
-}
-export const adminEnrollmentTokensListCapability = {
-    ...withVnextBinding(tokensListCapability, adminHelp(["admin", "enrollment-tokens", "list"], "List enrollment-token metadata without token bytes.", "ornn admin enrollment-tokens list [--limit 50] [--cursor CURSOR]", "ornn admin enrollment-tokens list --limit 50 --format json")),
-    execute: async (ctx) => {
-        const payload = await tokensListCapability.execute(ctx, {});
-        if (!ctx.cli)
-            return payload;
-        return {
-            enrollment_tokens: rowsFromTokenList(payload)
-                .map(tokenMetadata)
-                .filter((token) => token !== null),
-        };
-    },
-};
-export const adminEnrollmentTokenCreateCapability = withVnextBinding(tokensCreateCapability, adminHelp(["admin", "enrollment-tokens", "create"], "Create one expiring enrollment token through an explicit secret export.", "ornn admin enrollment-tokens create --supplier UUID --expires-in SECONDS (--print | --output PATH) [--overwrite] [--yes]", "Unsupported: token creation requires an eligible human terminal.", ["canonical supplier organization UUID"], "Review the supplier, expiry, and secret destination before minting the token."));
-const tokenRevokeInput = z.object({
-    token_id: UUID,
-    expected_created_at: nonEmpty.optional(),
-    idempotency_key: nonEmpty.optional(),
-});
-function rowsFromTokenList(payload) {
-    if (Array.isArray(payload))
-        return payload;
-    if (!payload || typeof payload !== "object")
-        return [];
-    const source = payload;
-    for (const key of ["enrollment_tokens", "tokens", "items", "data"]) {
-        if (Array.isArray(source[key]))
-            return source[key];
-    }
-    return [];
-}
-function tokenMetadata(value) {
-    if (!value || typeof value !== "object")
-        return null;
-    const row = value;
-    if (typeof row.id !== "string" || !row.id)
-        return null;
-    return {
-        id: row.id,
-        organization_id: typeof row.organization_id === "string" ? row.organization_id : null,
-        status: typeof row.status === "string" ? row.status : "unknown",
-        expires_at: typeof row.expires_at === "string" ? row.expires_at : null,
-        created_at: typeof row.created_at === "string" ? row.created_at : null,
-    };
-}
-function codedError(code, message) {
-    const error = new Error(message);
-    error.detail = { code, retryable: false };
-    return error;
-}
-async function readExactToken(ctx, tokenId, expectedCreatedAt) {
-    // Filter at the owner before its list limit; an older active token may not be in the latest 500.
-    const listed = await ctx.fetch(`/enrollment-tokens?id=${encodeURIComponent(tokenId)}`, {
-        method: "GET",
-    });
-    const target = rowsFromTokenList(listed)
-        .map(tokenMetadata)
-        .find((candidate) => candidate?.id === tokenId);
-    if (!target)
-        return { disposition: "satisfied", target: null };
-    if (expectedCreatedAt && target.created_at !== expectedCreatedAt) {
-        return {
-            disposition: "conflict",
-            target,
-            message: `Enrollment token ${tokenId} was replaced after ${expectedCreatedAt}; refusing to revoke it.`,
-        };
-    }
-    if (target.status === "revoked" || target.status === "expired") {
-        return { disposition: "satisfied", target };
-    }
-    return { disposition: "apply", target };
-}
-export const adminEnrollmentTokenRevokeCapability = defineCapability({
-    id: "tokens.revoke",
-    domain: "fleet",
-    roles: ["admin"],
-    description: "Revoke one exact enrollment-token generation after reconciling its durable goal.",
-    mutation: "preview-confirm",
-    http: { method: "DELETE", path: "/enrollment-tokens/{id}" },
-    cli: {
-        command: ["admin", "enrollment-tokens", "revoke"],
-        vnext: adminHelp(["admin", "enrollment-tokens", "revoke"], "Revoke one exact enrollment-token generation.", "ornn admin enrollment-tokens revoke <token-id> [--expected-created-at TIME] [--yes]", "ornn admin enrollment-tokens revoke <token-id> --expected-created-at TIME --yes --idempotency-key KEY --format json", ["canonical token UUID", "token created_at generation"], "Review the exact token generation and the loss of future enrollment access."),
-    },
-    mcp: false,
-    slack: false,
-    input: tokenRevokeInput,
-    execute: async (ctx, input) => {
-        const parsed = tokenRevokeInput.parse(input);
-        const current = await readExactToken(ctx, parsed.token_id, parsed.expected_created_at);
-        if (!ctx.confirmed)
-            return current;
-        if (current.disposition === "conflict") {
-            throw codedError("token_identity_changed", current.message);
-        }
-        if (current.disposition === "satisfied") {
-            return {
-                id: parsed.token_id,
-                created_at: parsed.expected_created_at ?? current.target?.created_at ?? null,
-                status: "revoked",
-                reconciled: true,
-            };
-        }
-        if (!current.target.created_at) {
-            throw codedError("token_identity_unavailable", `Enrollment token ${parsed.token_id} has no stable creation identity and cannot be revoked safely.`);
-        }
-        const revoked = (await ctx.fetch(`/enrollment-tokens/${encodeURIComponent(parsed.token_id)}`, {
-            method: "DELETE",
-            ...(parsed.idempotency_key
-                ? { headers: { "Idempotency-Key": parsed.idempotency_key } }
-                : {}),
-        }));
-        return {
-            id: parsed.token_id,
-            created_at: current.target.created_at,
-            organization_id: current.target.organization_id,
-            expires_at: current.target.expires_at,
-            status: "revoked",
-            reconciled: false,
-            ...(typeof revoked?.deleted === "boolean" ? { deleted: revoked.deleted } : {}),
-        };
-    },
-});
-const nodeEnrollInput = z.object({
-    node_id: UUID,
-    host: nonEmpty,
-    organization_id: UUID,
-    facility_id: UUID,
-    filter: z.string().optional(),
-    identity_file: nonEmpty,
-    private_key: z.string().min(1).optional(),
-    username: nonEmpty.default("root"),
-    port: z.number().int().min(1).max(65535).default(22),
-    expires_in_seconds: tokenTtl,
-    installer_base: nonEmpty.optional(),
-    replace_existing_management: z.literal(true),
-    verbose: z.boolean().default(false),
-});
-function safeRemoteResult(value) {
-    if (!value || typeof value !== "object")
-        return {};
-    const row = value;
-    const safe = {};
-    for (const key of ["id", "status", "state", "exit_code", "started_at", "completed_at"]) {
-        const field = row[key];
-        if (typeof field === "string" || typeof field === "number" || typeof field === "boolean") {
-            safe[key] = field;
-        }
-    }
-    return safe;
-}
-export const adminNodeEnrollCapability = defineCapability({
-    id: "nodes.enroll",
-    domain: "fleet",
-    roles: ["admin"],
-    description: "Enroll one explicit node over SSH with an explicit supplier and facility assignment.",
-    mutation: "preview-confirm",
-    http: { method: "POST", path: "/remote" },
-    cli: {
-        command: ["admin", "nodes", "enroll"],
-        vnext: adminHelp(["admin", "nodes", "enroll"], "Install Ornn management on one explicitly assigned node.", "ornn admin nodes enroll <node-id> --host HOST --supplier UUID --facility UUID [--filter COMPARTMENT_IDS] --identity-file PATH --token-ttl SECONDS --replace-existing-management [--verbose] [--yes]", "Unsupported: remote enrollment requires an eligible human terminal.", ["canonical node UUID", "canonical supplier organization UUID", "canonical facility UUID"], "Review node identity, SSH target, assignment, compartment filter, and replacement of existing management."),
-    },
-    mcp: false,
-    slack: false,
-    input: nodeEnrollInput,
-    execute: async (ctx, input) => {
-        const parsed = nodeEnrollInput.parse(input);
-        if (!ctx.confirmed) {
-            return {
-                node_id: parsed.node_id,
-                host: parsed.host,
-                organization_id: parsed.organization_id,
-                facility_id: parsed.facility_id,
-                filter: parsed.filter,
-                expires_in_seconds: parsed.expires_in_seconds,
-                replace_existing_management: true,
-            };
-        }
-        if (!parsed.private_key) {
-            throw codedError("identity_file_unreadable", "The SSH identity file could not be read.");
-        }
-        const minted = (await ctx.fetch("/enrollment-tokens", {
-            method: "POST",
-            body: {
-                organization_id: parsed.organization_id,
-                expires_in_seconds: parsed.expires_in_seconds,
-            },
-        }));
-        const token = typeof minted.token === "string"
-            ? minted.token
-            : typeof minted.plaintext === "string"
-                ? minted.plaintext
-                : "";
-        if (!token) {
-            throw codedError("token_material_unavailable", "The enrollment token was created without usable token material.");
-        }
-        const command = buildEnrollmentInstallCommand({
-            token,
-            base: parsed.installer_base ?? ctx.installerBaseUrl,
-            facilityId: parsed.facility_id,
-            filter: parsed.filter,
-            restoreNodeId: parsed.node_id,
-            force: true,
-        });
-        const remote = await ctx.fetch("/remote", {
-            method: "POST",
-            body: {
-                host: parsed.host,
-                username: parsed.username,
-                port: parsed.port,
-                private_key: parsed.private_key,
-                command,
-                timeout_seconds: 600,
-            },
-        });
-        return {
-            node_id: parsed.node_id,
-            host: parsed.host,
-            organization_id: parsed.organization_id,
-            facility_id: parsed.facility_id,
-            filter: parsed.filter,
-            management: "replaced",
-            token_metadata: {
-                id: typeof minted.id === "string" ? minted.id : null,
-                expires_at: typeof minted.expires_at === "string" ? minted.expires_at : null,
-            },
-            remote: safeRemoteResult(remote),
-        };
-    },
-});
-const nodeKeyInput = z.object({ node_id: UUID });
-export const adminNodeExportKeyCapability = defineCapability({
-    id: "nodes.export-key",
-    domain: "fleet",
-    roles: ["admin"],
-    description: "Export an enrolled node's private admin key only through an explicit secret destination.",
-    mutation: "read",
-    http: { method: "GET", path: "/enrollment/admin-ssh-key" },
-    cli: {
-        command: ["admin", "nodes", "export-key"],
-        vnext: adminHelp(["admin", "nodes", "export-key"], "Export one node admin key deliberately.", "ornn admin nodes export-key <node-id> (--print | --output PATH) [--overwrite]", "ornn admin nodes export-key <node-id> --output PATH [--overwrite] --format json", ["canonical node UUID"]),
-    },
-    mcp: false,
-    slack: false,
-    input: nodeKeyInput,
-    execute: async (ctx, input) => {
-        const parsed = nodeKeyInput.parse(input);
-        return ctx.fetch(`/enrollment/admin-ssh-key?node_id=${encodeURIComponent(parsed.node_id)}`, {
-            method: "GET",
-        });
-    },
-});
-export const adminNodeRotateKeyCapability = defineCapability({
-    id: "nodes.rotate-key",
-    domain: "fleet",
-    roles: ["admin"],
-    description: "Replace a node's admin key and export the new private key explicitly.",
-    mutation: "preview-confirm",
-    http: { method: "POST", path: "/enrollment/admin-ssh-key" },
-    cli: {
-        command: ["admin", "nodes", "rotate-key"],
-        vnext: adminHelp(["admin", "nodes", "rotate-key"], "Rotate one node admin key and export the replacement deliberately.", "ornn admin nodes rotate-key <node-id> (--print | --output PATH) [--overwrite] [--yes]", "Unsupported: key rotation requires an eligible human terminal.", ["canonical node UUID"], "Review the node and loss of access through the previous private key."),
-    },
-    mcp: false,
-    slack: false,
-    input: nodeKeyInput,
-    execute: async (ctx, input) => {
-        const parsed = nodeKeyInput.parse(input);
-        if (!ctx.confirmed)
-            return { node_id: parsed.node_id };
-        return ctx.fetch(`/enrollment/admin-ssh-key?node_id=${encodeURIComponent(parsed.node_id)}`, {
-            method: "POST",
-        });
-    },
-});
-const replacements = {
-    "tokens.create": adminEnrollmentTokenCreateCapability,
-    "tokens.list": adminEnrollmentTokensListCapability,
-};
-/** Applies the canonical admin CLI bindings without changing MCP or Slack identities. */
-export function bindAdminEnrollmentCapabilities(capabilities) {
-    return capabilities.map((capability) => replacements[capability.id] ?? capability);
-}
-export const adminEnrollmentCapabilities = [
-    adminEnrollmentTokenRevokeCapability,
-    adminNodeEnrollCapability,
-    adminNodeExportKeyCapability,
-    adminNodeRotateKeyCapability,
-];

package/vendor/capabilities/capabilities/admin-node-diagnostics.js

@@ -1,88 +0,0 @@
-import { z } from "zod";
-import { defineCapability } from "../capability.js";
-import { nodeExecCapability } from "./fleet.js";
-const nodeId = z
-    .string()
-    .min(1)
-    .refine((value) => value === value.trim(), {
-    message: "node_id must be an exact canonical node ID without surrounding whitespace",
-});
-export const adminNodeDiagnoseInput = z.object({
-    node_id: nodeId,
-});
-export const adminNodeExecInput = z.object({
-    node_id: nodeId,
-    command: z.string().min(1),
-    timeout_seconds: z.number().int().min(1).max(900),
-});
-function adminNodeHelp(command, outcome, human, automation, review) {
-    return {
-        audience: "admin",
-        category: "resource",
-        command,
-        outcome,
-        human,
-        automation,
-        acceptedReferences: ["canonical node ID"],
-        review,
-    };
-}
-export const adminNodeDiagnoseCapability = defineCapability({
-    id: "node.diagnose",
-    domain: "fleet",
-    roles: ["admin"],
-    description: "Queue the staff-authorized diagnosis workflow for one exact node after a live review.",
-    mutation: "preview-confirm",
-    http: { method: "POST", path: "/jobs" },
-    cli: {
-        command: ["admin", "nodes", "diagnose"],
-        vnext: adminNodeHelp(["admin", "nodes", "diagnose"], "Queue diagnosis for one exact node.", "ornn admin nodes diagnose <node-id>", "Unavailable in machine and redirected modes; use an eligible human terminal.", "Exact node, lifecycle, reachability, and diagnosis workflow."),
-    },
-    mcp: false,
-    slack: false,
-    input: adminNodeDiagnoseInput,
-    execute: async (ctx, input) => {
-        const parsed = adminNodeDiagnoseInput.parse(input);
-        if (!ctx.confirmed) {
-            return {
-                action: "node.diagnose",
-                payload: { node_id: parsed.node_id, source: { mode: "cli" }, burn_time_minutes: 0 },
-            };
-        }
-        return ctx.fetch("/jobs", {
-            method: "POST",
-            body: { node_id: parsed.node_id, source: { mode: "cli" }, burn_time_minutes: 0 },
-        });
-    },
-});
-export const adminNodeExecCapability = {
-    ...nodeExecCapability,
-    mutation: "preview-confirm",
-    cli: {
-        ...nodeExecCapability.cli,
-        vnext: adminNodeHelp(["admin", "nodes", "exec"], "Execute exact command bytes on one exact node.", "ornn admin nodes exec <node-id> --command COMMAND --timeout DURATION", "Unavailable in machine and redirected modes; use an eligible human terminal.", "Exact node, lifecycle, reachability, command bytes, and timeout."),
-    },
-    input: adminNodeExecInput,
-    execute: async (ctx, input) => {
-        const parsed = adminNodeExecInput.parse(input);
-        if (ctx.cli && !ctx.confirmed) {
-            return {
-                action: "node.exec",
-                payload: {
-                    node_id: parsed.node_id,
-                    command: parsed.command,
-                    timeout_seconds: parsed.timeout_seconds,
-                },
-            };
-        }
-        return nodeExecCapability.execute(ctx, {
-            node_id: parsed.node_id,
-            command: parsed.command,
-            timeout_seconds: parsed.timeout_seconds,
-        });
-    },
-};
-export const adminNodeDiagnosticCapabilities = [
-    adminNodeDiagnoseCapability,
-    adminNodeExecCapability,
-];