@ornncompute/cli 1.0.72 → 1.0.97

package/vendor/capabilities/capabilities/observability.js

@@ -1,218 +0,0 @@
-import { z } from "zod";
-import { defineCapability } from "../capability.js";
-function queryPath(path, params) {
-    const parts = [];
-    for (const [key, value] of Object.entries(params)) {
-        if (value?.trim())
-            parts.push(`${encodeURIComponent(key)}=${encodeURIComponent(value.trim())}`);
-    }
-    return parts.length ? `${path}?${parts.join("&")}` : path;
-}
-function nodePrefix(role, id) {
-    const encoded = encodeURIComponent(id);
-    return role === "user"
-        ? `/v1/observability/machines/${encoded}`
-        : `/v1/observability/nodes/${encoded}`;
-}
-const latestInput = z.object({
-    node_id: z.string().min(1),
-    nodeId: z.string().optional(),
-    start: z.string().optional(),
-    end: z.string().optional(),
-    span: z.string().optional(),
-    max_points: z.number().int().min(1).max(500).optional(),
-    metrics: z.string().optional(),
-});
-const logsLatestInput = z.object({
-    node_id: z.string().min(1),
-    nodeId: z.string().optional(),
-    stream: z.enum(["serial", "kernel"]).default("kernel"),
-    count: z.number().int().min(1).max(1000).optional(),
-    before: z.string().optional(),
-    start: z.string().optional(),
-    cursor: z.string().optional(),
-});
-const tailInput = z.object({
-    node_id: z.string().min(1),
-    nodeId: z.string().optional(),
-    duration: z.number().int().min(1).max(120).optional(),
-    max_events: z.number().int().min(1).max(200).optional(),
-    fields: z.string().optional(),
-});
-const logsTailInput = tailInput.extend({
-    stream: z.enum(["serial", "kernel"]).default("kernel"),
-});
-function nodeId(input) {
-    return (input.node_id || input.nodeId || "").trim();
-}
-function expandSpan(span, start, end) {
-    if (start?.trim() && end?.trim()) {
-        return { start: start.trim(), end: end.trim() };
-    }
-    const now = Date.now();
-    const match = /^(\d+)(m|h|d)$/.exec((span ?? "15m").trim());
-    const amount = match ? Number(match[1]) : 15;
-    const unit = match?.[2] ?? "m";
-    const ms = unit === "d" ? amount * 86_400_000 : unit === "h" ? amount * 3_600_000 : amount * 60_000;
-    return { start: new Date(now - ms).toISOString(), end: new Date(now).toISOString() };
-}
-export const telemetryLatestCapability = defineCapability({
-    id: "telemetry.latest",
-    domain: "observability",
-    roles: ["user", "admin"],
-    description: "One-shot telemetry window for one node (start/end or span plus max_points). Users may only query a reserved machine. Admins may query any enrolled node. Pass a node UUID. Use this for heartbeat / last-seen / public_ip. Not a live stream.",
-    mutation: "read",
-    http: { method: "GET", path: "/v1/observability/nodes/{id}/telemetry/query" },
-    slack: {
-        parameters: {
-            type: "object",
-            properties: {
-                node_id: { type: "string", description: "Node UUID from nodes.list." },
-                span: { type: "string", description: "Lookback like 15m, 1h, 1d. Default 15m." },
-                start: { type: "string" },
-                end: { type: "string" },
-                max_points: { type: "number", description: "Default 240, max 500." },
-                metrics: { type: "string", description: "Optional comma-separated metric names; omit for all stored metrics." },
-            },
-            required: ["node_id"],
-        },
-    },
-    input: latestInput,
-    execute: async (ctx, input) => {
-        const parsed = latestInput.parse(input);
-        const id = nodeId(parsed);
-        const range = expandSpan(parsed.span, parsed.start, parsed.end);
-        return ctx.fetch(queryPath(`${nodePrefix(ctx.role, id)}/telemetry/query`, {
-            start: range.start,
-            end: range.end,
-            max_points: String(parsed.max_points ?? 240),
-            metrics: parsed.metrics,
-        }), { method: "GET" });
-    },
-});
-export const logsLatestCapability = defineCapability({
-    id: "logs.latest",
-    domain: "observability",
-    roles: ["user", "admin"],
-    description: "Stored kernel or serial logs, all severities, newest first. Optional start/before bounds can query any retained history; default is the seven days before now. First call omits cursor; subsequent pages pass next_cursor with the same start/before. Users only on a reserved machine. Not a live tail.",
-    mutation: "read",
-    http: { method: "GET", path: "/v1/observability/nodes/{id}/logs/{stream}/query" },
-    slack: {
-        parameters: {
-            type: "object",
-            properties: {
-                node_id: { type: "string", description: "Node UUID from nodes.list." },
-                stream: { type: "string", enum: ["serial", "kernel"] },
-                count: { type: "number", description: "Page size. Default 200, max 1000." },
-                before: { type: "string", description: "RFC3339 upper bound. Default now. Keep fixed when paging." },
-                start: { type: "string", description: "RFC3339 lower bound. Default seven days before the upper bound." },
-                cursor: { type: "string", description: "next_cursor from the previous page." },
-            },
-            required: ["node_id"],
-        },
-    },
-    input: logsLatestInput,
-    execute: async (ctx, input) => {
-        const parsed = logsLatestInput.parse(input);
-        const id = nodeId(parsed);
-        const end = parsed.before?.trim() || new Date().toISOString();
-        const start = parsed.start?.trim() || new Date(Date.parse(end) - 7 * 86_400_000).toISOString();
-        return ctx.fetch(queryPath(`${nodePrefix(ctx.role, id)}/logs/${parsed.stream}/query`, {
-            start,
-            end,
-            limit: String(parsed.count ?? 200),
-            order: "desc",
-            cursor: parsed.cursor,
-        }), { method: "GET" });
-    },
-});
-/** Full stored telemetry rows, including context fields omitted by numeric windows. */
-export const telemetrySnapshotCapability = defineCapability({
-    id: "telemetry.snapshot",
-    domain: "observability",
-    roles: ["admin"],
-    description: "Read the latest stored heartbeat with all staff-visible fields, including version, status, port context, and kernel-log coverage when stored. Works while the node is offline; check observed_at for staleness. limit=1 returns the latest row; larger limits only scan a bounded recent window, at most 24h. Use telemetry.latest for historical numeric windows.",
-    mutation: "read",
-    http: { method: "GET", path: "/v1/observability/nodes/{id}/telemetry/latest" },
-    mcp: false,
-    slack: {
-        parameters: {
-            type: "object",
-            properties: {
-                node_id: { type: "string", description: "Node UUID." },
-                limit: { type: "number", description: "Recent full heartbeat rows. Default 1, max 1000." },
-            },
-            required: ["node_id"],
-        },
-    },
-    input: z.object({ node_id: z.string().min(1), limit: z.number().int().min(1).max(1000).optional() }),
-    execute: async (ctx, input) => ctx.fetch(queryPath(`/v1/observability/nodes/${encodeURIComponent(input.node_id)}/telemetry/latest`, {
-        limit: String(input.limit ?? 1),
-    }), { method: "GET" }),
-});
-export const telemetryTailCapability = defineCapability({
-    id: "telemetry.tail",
-    domain: "observability",
-    roles: ["user", "admin"],
-    description: "Live telemetry follow on the same Observability subscribe feed the graphs use. Users only on a reserved machine. Slack and MCP attach for duration (default 20s) and return events. Not telemetry.latest.",
-    mutation: "read",
-    http: { method: "GET", path: "/v1/observability/nodes/{id}/telemetry/subscribe" },
-    slack: {
-        parameters: {
-            type: "object",
-            properties: {
-                node_id: { type: "string", description: "Node UUID from nodes.list." },
-                duration: { type: "number", description: "Seconds to attach. Default 20, max 120." },
-                max_events: { type: "number" },
-                fields: { type: "string" },
-            },
-            required: ["node_id"],
-        },
-    },
-    input: tailInput,
-    execute: async (ctx, input) => {
-        const parsed = tailInput.parse(input);
-        const id = nodeId(parsed);
-        return ctx.fetch(queryPath(`${nodePrefix(ctx.role, id)}/telemetry/subscribe`, {
-            fields: parsed.fields,
-            duration: String(parsed.duration ?? 20),
-            max_events: String(parsed.max_events ?? 40),
-        }), { method: "GET", headers: { Accept: "text/event-stream" } });
-    },
-});
-export const logsTailCapability = defineCapability({
-    id: "logs.tail",
-    domain: "observability",
-    roles: ["user", "admin"],
-    description: "Live kernel or serial log follow on the same Observability subscribe feed LogViewer uses. Users only on a reserved machine. Slack and MCP attach for duration (default 20s). Not logs.latest.",
-    mutation: "read",
-    http: { method: "GET", path: "/v1/observability/nodes/{id}/logs/{stream}/subscribe" },
-    slack: {
-        parameters: {
-            type: "object",
-            properties: {
-                node_id: { type: "string", description: "Node UUID from nodes.list." },
-                stream: { type: "string", enum: ["serial", "kernel"] },
-                duration: { type: "number", description: "Seconds to attach. Default 20, max 120." },
-                max_events: { type: "number" },
-            },
-            required: ["node_id"],
-        },
-    },
-    input: logsTailInput,
-    execute: async (ctx, input) => {
-        const parsed = logsTailInput.parse(input);
-        const id = nodeId(parsed);
-        return ctx.fetch(queryPath(`${nodePrefix(ctx.role, id)}/logs/${parsed.stream}/subscribe`, {
-            duration: String(parsed.duration ?? 20),
-            max_events: String(parsed.max_events ?? 40),
-        }), { method: "GET", headers: { Accept: "text/event-stream" } });
-    },
-});
-export const observabilityCapabilities = [
-    telemetrySnapshotCapability,
-    telemetryLatestCapability,
-    telemetryTailCapability,
-    logsLatestCapability,
-    logsTailCapability,
-];

package/vendor/capabilities/capabilities/organization-invites.js

@@ -1,53 +0,0 @@
-import { z } from "zod";
-import { defineCapability } from "../capability.js";
-export const organizationInviteInput = z.object({
-    organization_id: z.uuid(),
-    email: z.string().trim().toLowerCase().pipe(z.email()),
-});
-export const organizationInviteCapability = defineCapability({
-    id: "organization.invite",
-    domain: "users",
-    roles: ["admin"],
-    description: "Email an invitation to an existing organization. Resolve its UUID with organization_list first; ask the operator to choose if matches are ambiguous. The recipient may already belong to another organization. Send directly when the admin requests the invitation.",
-    mutation: "immediate",
-    http: { method: "POST", path: "/v1/staff/invites" },
-    cli: {
-        command: ["admin", "organizations", "invite"],
-        vnext: {
-            audience: "admin",
-            category: "resource",
-            command: ["admin", "organizations", "invite"],
-            outcome: "Email an invitation to an existing organization.",
-            human: "ornn admin organizations invite --organization UUID --email EMAIL",
-            automation: "ornn admin organizations invite --organization UUID --email EMAIL --format json",
-            acceptedReferences: ["organization UUID from admin organizations list"],
-            related: ["admin organizations list"],
-        },
-    },
-    slack: {
-        parameters: {
-            type: "object",
-            properties: {
-                organization_id: {
-                    type: "string",
-                    format: "uuid",
-                    description: "Exact organization UUID from organization_list.",
-                },
-                email: {
-                    type: "string",
-                    format: "email",
-                    description: "Address to receive the invitation.",
-                },
-            },
-            required: ["organization_id", "email"],
-        },
-    },
-    input: organizationInviteInput,
-    execute: async (ctx, input) => {
-        const parsed = organizationInviteInput.parse(input);
-        return ctx.fetch("/v1/staff/invites", {
-            method: "POST",
-            body: { ...parsed, send_email: true },
-        });
-    },
-});

package/vendor/capabilities/capabilities/reservation-list.js

@@ -1,68 +0,0 @@
-import { z } from "zod";
-import { defineCapability } from "../capability.js";
-import { queryString } from "./staff-shared.js";
-export const reservationListInput = z.object({
-    customerId: z.string().uuid().optional(),
-    listingId: z.string().uuid().optional(),
-    listingTermId: z.string().uuid().optional(),
-    status: z.enum(["confirmed", "active", "completed", "cancelled"]).optional(),
-    cursor: z.string().optional(),
-    limit: z.number().int().min(1).max(100).optional(),
-});
-// Staff on every surface: Slack and the CLI resolve a customer's reservations
-// with this, then nodes.list reservation_id for that reservation's machines.
-export const reservationListCapability = defineCapability({
-    id: "reservation.list",
-    domain: "reservations",
-    roles: ["admin"],
-    description: "Internal staff only: list Commerce reservations across organizations, optionally filtered by customer organization (customerId), listing, listing term, and derived status. Resolve a customer's organization with users.list or organization.list first; pass each reservationId to nodes.list reservation_id for its machines. Page with nextCursor as cursor.",
-    mutation: "read",
-    http: { method: "GET", path: "/commerce/reservations" },
-    cli: {
-        command: ["admin", "reservations", "list"],
-        vnext: {
-            audience: "admin",
-            category: "resource",
-            command: ["admin", "reservations", "list"],
-            outcome: "List reservations across organizations.",
-            human: "ornn admin reservations list [--customer UUID] [--listing UUID] [--listing-term UUID] [--status confirmed|active|completed|cancelled] [--limit 50] [--cursor CURSOR]",
-            automation: "ornn admin reservations list --customer UUID --limit 50 [--cursor CURSOR] --format json",
-            acceptedReferences: [],
-        },
-    },
-    slack: {
-        parameters: {
-            type: "object",
-            properties: {
-                customerId: {
-                    type: "string",
-                    description: "Optional customer organization UUID from users_list or organization_list.",
-                },
-                listingId: { type: "string", description: "Optional listing UUID." },
-                listingTermId: { type: "string", description: "Optional listing term UUID." },
-                status: {
-                    type: "string",
-                    enum: ["confirmed", "active", "completed", "cancelled"],
-                    description: "Optional derived reservation status.",
-                },
-                cursor: {
-                    type: "string",
-                    description: "Optional. Pass the previous response's nextCursor to fetch the next page.",
-                },
-                limit: { type: "integer", description: "Optional page size (Slack returns at most 10)." },
-            },
-        },
-    },
-    input: reservationListInput,
-    execute: async (ctx, input) => {
-        const parsed = reservationListInput.parse(input ?? {});
-        return ctx.fetch(`/commerce/reservations${queryString({
-            customerId: parsed.customerId,
-            listingId: parsed.listingId,
-            status: parsed.status,
-            listingTermId: parsed.listingTermId,
-            cursor: parsed.cursor,
-            limit: parsed.limit,
-        })}`, { method: "GET" });
-    },
-});

package/vendor/capabilities/capabilities/staff-shared.js

@@ -1,64 +0,0 @@
-/** Helpers shared by staff capabilities. */
-/**
- * Build a request body from the fields that were actually supplied.
- *
- * Staff writes are almost all "PATCH the fields the caller named": `undefined`
- * means leave alone, and `null` is a real value that clears the field. So the
- * check is `!== undefined`, never truthiness.
- */
-export function mapBody(input, mapping) {
-    const body = {};
-    for (const [field, wire] of Object.entries(mapping)) {
-        if (input[field] !== undefined)
-            body[wire] = input[field];
-    }
-    return body;
-}
-/** Path segment escape. */
-export function seg(value) {
-    return encodeURIComponent(value);
-}
-/**
- * A transport failure's HTTP status, when it carries one.
- *
- * Capabilities cannot import a surface's error class (`apps/mcp`'s
- * `WebApiError`, say), so read the status structurally.
- */
-export function statusOf(error) {
-    if (error && typeof error === "object" && "status" in error) {
-        const status = error.status;
-        if (typeof status === "number")
-            return status;
-    }
-    return undefined;
-}
-/**
- * Read a resource's current optimistic-concurrency version.
- *
- * Commerce rejects a PATCH or lifecycle action whose `version` is absent or
- * non-positive ("missing version" / "version must be positive"), but no staff
- * caller has that number to hand. Read it back when it was not supplied, and
- * only once confirmed so a preview stays a pure dry run.
- */
-export async function resolveVersion(ctx, path, provided) {
-    if (provided && provided > 0)
-        return provided;
-    if (!ctx.confirmed)
-        return 1;
-    try {
-        const current = (await ctx.fetch(path, { method: "GET" }));
-        if (typeof current?.version === "number" && current.version > 0)
-            return current.version;
-    }
-    catch {
-        // Fall through: send 1 and let commerce report the conflict, which names
-        // the expected version, rather than failing on a lookup the caller can't see.
-    }
-    return 1;
-}
-export function queryString(params) {
-    const parts = Object.entries(params)
-        .filter((entry) => entry[1] !== undefined && entry[1] !== "")
-        .map(([key, value]) => `${encodeURIComponent(key)}=${encodeURIComponent(String(value))}`);
-    return parts.length > 0 ? `?${parts.join("&")}` : "";
-}

package/vendor/capabilities/capabilities/tokens.js

@@ -1,165 +0,0 @@
-import { z } from "zod";
-import { defineCapability, preview } from "../capability.js";
-const optionalText = z.string().nullish();
-const tokenCreateInput = z.object({
-    organization_id: z.string().min(1),
-    organizationId: optionalText,
-    facility_id: optionalText,
-    facilityId: optionalText,
-    expires_in_seconds: z.number().int().positive().nullish(),
-    expiresInSeconds: z.number().int().positive().nullish(),
-    filter: z.string().nullish(),
-    ip: optionalText,
-    installer_base: optionalText,
-    host: optionalText,
-    hosts: z.array(z.string()).nullish(),
-    username: optionalText,
-    port: z.number().int().min(1).max(65535).nullish(),
-    private_key: optionalText,
-    privateKey: optionalText,
-    yes: z.boolean().optional(),
-});
-const emptyInput = z.object({});
-export function buildEnrollmentInstallCommand(options) {
-    const base = (options.base ?? "https://api.ornn.com/v1/orchestrator").replace(/\/+$/, "");
-    const params = [`token=${encodeURIComponent(options.token)}`];
-    if (options.facilityId)
-        params.push(`facility_id=${encodeURIComponent(options.facilityId)}`);
-    if (options.filter)
-        params.push(`filter=${encodeURIComponent(options.filter)}`);
-    if (options.ip)
-        params.push(`ip=${encodeURIComponent(options.ip)}`);
-    if (options.restoreNodeId)
-        params.push(`restore_node_id=${encodeURIComponent(options.restoreNodeId)}`);
-    if (options.force)
-        params.push("force=true");
-    const href = `${base}/enrollment/install?${params.join("&")}`;
-    // Without pipefail, a failed curl (bad installer_base, network error, non-2xx
-    // response) pipes empty stdin into `sudo bash`, which then exits 0 having run
-    // nothing -- the caller sees exit_code: 0 for an install that never happened.
-    return `set -o pipefail; curl -fsSL '${href.replace(/'/g, "'\\''")}' | sudo bash`;
-}
-function tokenString(row, keys) {
-    for (const key of keys) {
-        const value = row[key];
-        if (typeof value === "string" && value.trim())
-            return value.trim();
-    }
-    return undefined;
-}
-export const tokensListCapability = defineCapability({
-    id: "tokens.list",
-    domain: "fleet",
-    roles: ["admin"],
-    description: "List issued enrollment tokens (id, supplier organization_id, status, expiry). Does not return plaintext secrets.",
-    mutation: "read",
-    http: { method: "GET", path: "/enrollment-tokens" },
-    slack: { parameters: { type: "object", properties: {} } },
-    input: emptyInput,
-    execute: async (ctx) => ctx.fetch("/enrollment-tokens", { method: "GET" }),
-});
-export const tokensCreateCapability = defineCapability({
-    id: "tokens.create",
-    domain: "fleet",
-    roles: ["admin"],
-    description: "Admin-only. Mint an enrollment token. Without a host this returns the curl installer. With host + private_key, orchestrator SSHs and runs that curl (same as Bulk Enroll). Never invent a command. CLI asks y/N. Slack waits for a human confirm. MCP requires confirm: true.",
-    mutation: "preview-confirm",
-    http: { method: "POST", path: "/enrollment-tokens" },
-    slack: {
-        parameters: {
-            type: "object",
-            properties: {
-                organization_id: {
-                    type: "string",
-                    description: "Supplier organization UUID from supplier.list.",
-                },
-                facility_id: { type: "string", description: "Optional facility UUID." },
-                expires_in_seconds: { type: "integer", description: "Token TTL in seconds." },
-                filter: {
-                    type: "string",
-                    description: "Optional comma-separated enrollment compartment ids. Omit to run every step.",
-                },
-                ip: { type: "string", description: "Optional IP stamped into the installer URL." },
-                host: { type: "string", description: "SSH host/IP to enroll now." },
-                hosts: {
-                    type: "array",
-                    items: { type: "string" },
-                    description: "Optional extra SSH hosts to enroll with the same key.",
-                },
-                username: { type: "string", description: "SSH user. Default admin." },
-                port: { type: "integer", description: "SSH port. Default 22." },
-                private_key: {
-                    type: "string",
-                    description: "PEM private key. Required to enroll over SSH.",
-                },
-            },
-            required: ["organization_id"],
-        },
-    },
-    input: tokenCreateInput,
-    execute: async (ctx, input) => {
-        const parsed = tokenCreateInput.parse(input);
-        const organizationId = (parsed.organization_id || parsed.organizationId || "").trim();
-        const hosts = [
-            ...(parsed.host?.trim() ? [parsed.host.trim()] : []),
-            ...(parsed.hosts ?? []).map((host) => host.trim()).filter(Boolean),
-        ];
-        const privateKey = parsed.private_key?.trim() || parsed.privateKey?.trim() || "";
-        const payload = {
-            organization_id: organizationId,
-            facility_id: parsed.facility_id ?? parsed.facilityId,
-            expires_in_seconds: parsed.expires_in_seconds ?? parsed.expiresInSeconds,
-            filter: parsed.filter,
-            ip: parsed.ip,
-            hosts,
-            username: parsed.username?.trim() || "admin",
-            port: parsed.port ?? 22,
-            remote: hosts.length > 0 && privateKey.length > 0,
-        };
-        if (!ctx.confirmed) {
-            return preview("tokens.create", { ...payload, private_key: privateKey ? "[redacted]" : "" });
-        }
-        const minted = (await ctx.fetch("/enrollment-tokens", {
-            method: "POST",
-            body: {
-                organization_id: organizationId,
-                ...(payload.facility_id ? { facility_id: payload.facility_id } : {}),
-                ...(payload.expires_in_seconds ? { expires_in_seconds: payload.expires_in_seconds } : {}),
-            },
-        }));
-        const token = tokenString(minted, ["token", "plaintext"]) ?? "";
-        const installCommand = token
-            ? buildEnrollmentInstallCommand({
-                token,
-                base: parsed.installer_base ?? undefined,
-                ip: parsed.ip ?? undefined,
-                filter: parsed.filter ?? undefined,
-                force: payload.remote,
-            })
-            : null;
-        if (!payload.remote || !installCommand) {
-            return { ...minted, install_command: installCommand };
-        }
-        const results = [];
-        for (const host of hosts) {
-            results.push(await ctx.fetch("/remote", {
-                method: "POST",
-                body: {
-                    host,
-                    username: payload.username,
-                    port: payload.port,
-                    private_key: privateKey,
-                    command: installCommand,
-                    timeout_seconds: 600,
-                },
-            }));
-        }
-        return {
-            id: minted.id,
-            organization_id: minted.organization_id ?? organizationId,
-            expires_at: minted.expires_at,
-            hosts: results,
-        };
-    },
-});
-export const tokenCapabilities = [tokensListCapability, tokensCreateCapability];