@ornncompute/cli 1.0.72 → 1.0.97

package/src/admin-node-sanitize.mjs

@@ -0,0 +1,243 @@
+import { createHash, randomUUID } from "node:crypto";
+import { readFileSync } from "node:fs";
+
+import { ADMIN_MUTATION_SAFETY, AdminMutationError, runAdminMutation } from "./admin-mutations.mjs";
+import { parseSemanticArguments } from "./interaction-runtime.mjs";
+
+const MANUAL_CLEANUP = "ACCEPT MANUAL CLEANUP";
+
+function usageError(capability, detail, field) {
+  return new AdminMutationError(
+    [`Usage: ${capability.cli.vnext.human}`, detail].filter(Boolean).join("\n"),
+    { code: "usage_error", ...(field ? { field } : {}) }
+  );
+}
+
+function semanticArguments(argv, capability) {
+  const { $positionals, ...options } = parseSemanticArguments(argv);
+  if ($positionals.length !== 1 || !$positionals[0]) {
+    throw usageError(capability, "Pass exactly one canonical node ID.", "node-id");
+  }
+  return { nodeId: $positionals[0], options };
+}
+
+function rejectExtra(capability, extra) {
+  const [name] = Object.keys(extra);
+  if (name) throw usageError(capability, `Unknown option: --${name}`, name);
+}
+
+function validated(capability, input) {
+  const parsed = capability.input.safeParse(input);
+  if (!parsed.success) throw usageError(capability, parsed.error.message);
+  return parsed.data;
+}
+
+function evidenceSha256(capability, path) {
+  try {
+    return createHash("sha256").update(readFileSync(path)).digest("hex");
+  } catch (error) {
+    throw usageError(
+      capability,
+      `Could not read --evidence-file: ${error instanceof Error ? error.message : String(error)}`,
+      "evidence-file"
+    );
+  }
+}
+
+function parseStart(argv, capability) {
+  const {
+    nodeId,
+    options: { operation, confirmation, jobId, batch, recoveryUuid, ...extra },
+  } = semanticArguments(argv, capability);
+  rejectExtra(capability, extra);
+  if (typeof operation !== "string") throw usageError(capability, "--operation is required.");
+  const input = validated(capability, {
+    node_id: nodeId,
+    job_id: jobId ?? randomUUID(),
+    operation,
+    ...(batch ? { maintenance_batch_id: batch } : {}),
+    ...(recoveryUuid ? { recovery_uuid: recoveryUuid } : {}),
+    confirmation,
+  });
+  return {
+    input,
+    mutation: { idempotencyKey: input.job_id, safety: ADMIN_MUTATION_SAFETY.eligibleHumanOnly },
+  };
+}
+
+function parseStatus(argv, capability) {
+  const {
+    nodeId,
+    options: { job, ...extra },
+  } = semanticArguments(argv, capability);
+  rejectExtra(capability, extra);
+  return { input: validated(capability, { node_id: nodeId, job_id: job }) };
+}
+
+function parseDecision(argv, capability) {
+  const {
+    nodeId,
+    options: {
+      job,
+      confirmation,
+      reservation,
+      releaseOperation,
+      reason,
+      evidenceFile,
+      tenantAccessRevoked,
+      dataDrivesSanitized,
+      acknowledgeRetainedOs,
+      ...extra
+    },
+  } = semanticArguments(argv, capability);
+  rejectExtra(capability, extra);
+  const cleanupOptions = {
+    reservation,
+    releaseOperation,
+    reason,
+    evidenceFile,
+    tenantAccessRevoked,
+    dataDrivesSanitized,
+    acknowledgeRetainedOs,
+  };
+  if (confirmation !== MANUAL_CLEANUP) {
+    const [supplied] =
+      Object.entries(cleanupOptions).find(([, value]) => value !== undefined) ?? [];
+    if (supplied) {
+      throw usageError(
+        capability,
+        `Manual cleanup options require --confirmation "${MANUAL_CLEANUP}".`
+      );
+    }
+    return {
+      input: validated(capability, { node_id: nodeId, job_id: job, confirmation }),
+      mutation: { safety: ADMIN_MUTATION_SAFETY.eligibleHumanOnly },
+    };
+  }
+  // Each attestation is the operator's own flag, never a default.
+  for (const [name, value] of Object.entries(cleanupOptions)) {
+    if (value === undefined || value === "") {
+      const flag = name.replace(/[A-Z]/g, (letter) => `-${letter.toLowerCase()}`);
+      throw usageError(capability, `--${flag} is required for manual cleanup.`, flag);
+    }
+  }
+  const input = validated(capability, {
+    node_id: nodeId,
+    job_id: job,
+    confirmation,
+    manual_cleanup: {
+      reservation_id: reservation,
+      lifecycle_operation_id: releaseOperation,
+      reason,
+      evidence_sha256: evidenceSha256(capability, evidenceFile),
+      acknowledge_retained_os: true,
+      tenant_access_revoked: true,
+      data_drives_sanitized: true,
+    },
+  });
+  return { input, mutation: { safety: ADMIN_MUTATION_SAFETY.eligibleHumanOnly } };
+}
+
+const startConsequence = {
+  data_wipe: "Erases every local data drive; the OS drive is preserved.",
+  ram_roundtrip: "Boots the node through RAM and back without erasing drives.",
+  node_turnover: "Erases the whole node, including the OS drive, and restores a host image.",
+  host_restore: "Restores the host OS from its trusted image.",
+};
+
+function decisionReview(input) {
+  const fields = [
+    { label: "Node", value: input.node_id },
+    { label: "Sanitize job", value: input.job_id },
+    { label: "Decision", value: input.confirmation },
+  ];
+  if (input.confirmation === "APPROVE SANITIZATION") {
+    return { fields, consequence: "Starts the held destructive maintenance on this node." };
+  }
+  if (input.confirmation === "SKIP SANITIZATION") {
+    return {
+      fields,
+      consequence: "Skips an eligible first-use wipe; nothing is erased or certified.",
+    };
+  }
+  const cleanup = input.manual_cleanup;
+  return {
+    fields: [
+      ...fields,
+      { label: "Reservation", value: cleanup.reservation_id },
+      { label: "Release operation", value: cleanup.lifecycle_operation_id },
+      { label: "Reason", value: cleanup.reason },
+      { label: "Evidence SHA-256", value: cleanup.evidence_sha256 },
+      {
+        label: "You attest",
+        value:
+          "tenant access revoked; every local data drive sanitized; existing OS retained and not certified",
+      },
+    ],
+    consequence:
+      "Lets the held release finish without a full wipe. The boot disk and prior root exposure remain.",
+  };
+}
+
+async function runStart({ execute, input, mutation, runtime }) {
+  return runAdminMutation({
+    ...runtime,
+    ...mutation,
+    prepare: async () => ({
+      review: {
+        title: "Start node sanitization",
+        fields: [
+          { label: "Node", value: input.node_id },
+          { label: "Operation", value: input.operation ?? "data_wipe" },
+          ...(input.recovery_uuid ? [{ label: "Recovery UUID", value: input.recovery_uuid }] : []),
+          { label: "Sanitize job", value: input.job_id },
+          { label: "Confirmation", value: input.confirmation },
+        ],
+        consequence: `${startConsequence[input.operation ?? "data_wipe"]} The job waits for staff approval.`,
+      },
+      value: input,
+    }),
+    execute: (value) => execute(value, { confirmed: true }),
+  });
+}
+
+async function runStatus({ execute, input }) {
+  return {
+    data: await execute(input),
+    exitCode: 0,
+    outcome: { class: "ready", phase: "complete" },
+  };
+}
+
+async function runDecision({ execute, input, mutation, runtime }) {
+  return runAdminMutation({
+    ...runtime,
+    ...mutation,
+    prepare: async () => ({
+      review: { title: "Decide node sanitize job", ...decisionReview(input) },
+      value: input,
+    }),
+    execute: (value) => execute(value, { confirmed: true }),
+  });
+}
+
+export const adminNodeSanitizeHandlers = [
+  {
+    capabilityId: "node.sanitize.start",
+    parse: parseStart,
+    run: runStart,
+    safety: ADMIN_MUTATION_SAFETY.eligibleHumanOnly,
+  },
+  {
+    capabilityId: "node.sanitize.show",
+    parse: parseStatus,
+    run: runStatus,
+    safety: ADMIN_MUTATION_SAFETY.direct,
+  },
+  {
+    capabilityId: "node.sanitize.update",
+    parse: parseDecision,
+    run: runDecision,
+    safety: ADMIN_MUTATION_SAFETY.eligibleHumanOnly,
+  },
+];

package/src/admin-shell.mjs

@@ -185,13 +185,21 @@ function parseAdminInput(capability, argv) {
     throw new AdminUsageError(usage);
   }
 
-  const offsetPagination = ["users.list", "organization.list"].includes(capability.id);
+  const offsetPagination = ["users.list", "organization.list", "supplier.list"].includes(
+    capability.id
+  );
+  const directoryPagination = ["users.list", "organization.list"].includes(capability.id);
   const reservationList = capability.id === "reservation.list";
-  const limit = positiveInteger(
-    options.limit,
-    "limit",
-    offsetPagination || reservationList ? 100 : MAX_PAGE_LIMIT
-  ) ?? (offsetPagination ? 25 : DEFAULT_PAGE_LIMIT);
+  const maxLimit = directoryPagination
+    ? 100
+    : capability.id === "supplier.list"
+      ? 1000
+      : reservationList
+        ? 100
+        : MAX_PAGE_LIMIT;
+  const limit =
+    positiveInteger(options.limit, "limit", maxLimit) ??
+    (directoryPagination ? 25 : DEFAULT_PAGE_LIMIT);
   const input = {};
   if (nodeCommand) input.node_id = positionals[0];
   if (options.supplier) input.organization_id = options.supplier;
@@ -232,13 +240,8 @@ function parseAdminInput(capability, argv) {
     if (options.cursor) input.cursor = options.cursor;
   }
   if (offsetPagination) {
-    if (explicitOffset !== undefined && options.cursor) {
-      throw new AdminUsageError("--offset and --cursor cannot be used together.", {
-        field: "offset",
-      });
-    }
     input.limit = limit;
-    input.offset = explicitOffset ?? decodeCursor(command, options.cursor);
+    input.offset = explicitOffset ?? 0;
   }
 
   return {
@@ -328,14 +331,9 @@ function collectionKey(capability) {
   if (root === "nodes" && leaf === "logs") return "logs";
   if (!["list", "search"].includes(leaf)) return null;
   if (root === "enrollment-tokens") return "enrollment_tokens";
-  return [
-    "facilities",
-    "nodes",
-    "organizations",
-    "reservations",
-    "suppliers",
-    "users",
-  ].includes(root)
+  return ["facilities", "nodes", "organizations", "reservations", "suppliers", "users"].includes(
+    root
+  )
     ? root
     : null;
 }
@@ -445,14 +443,19 @@ export function finalizeAdminResult(capability, payload, pagination) {
     pagination.ownerOffsetPagination && payload && !Array.isArray(payload)
       ? payload.next_offset
       : undefined;
+  const nextOffset = pagination.ownerOffsetPagination
+    ? Number.isSafeInteger(ownerNextOffset) && ownerNextOffset > offset
+      ? ownerNextOffset
+      : selected.length === pagination.limit
+        ? offset + selected.length
+        : null
+    : undefined;
   const ownerNextCursor =
     payload && !Array.isArray(payload)
       ? (payload.next_cursor ?? payload.nextCursor ?? payload.page?.next_cursor ?? null)
       : null;
   let nextCursor = pagination.ownerOffsetPagination
-    ? Number.isSafeInteger(ownerNextOffset) && ownerNextOffset > offset
-      ? encodeCursor(command, ownerNextOffset)
-      : null
+    ? null
     : !pagination.ownerPagination && offset + selected.length < rows.length
       ? encodeCursor(command, offset + selected.length)
       : (ownerNextCursor ?? null);
@@ -480,11 +483,9 @@ export function finalizeAdminResult(capability, payload, pagination) {
   }
   return {
     data: { [key]: selected },
-    page: {
-      limit: pagination.limit,
-      returned: selected.length,
-      next_cursor: nextCursor,
-    },
+    page: pagination.ownerOffsetPagination
+      ? { limit: pagination.limit, returned: selected.length, next_offset: nextOffset }
+      : { limit: pagination.limit, returned: selected.length, next_cursor: nextCursor },
   };
 }
 
@@ -515,7 +516,15 @@ export function writeAdminResultHuman(stdout, command, result, input = {}) {
   } else {
     for (const row of rows) stdout.write(`${JSON.stringify(row)}\n`);
   }
-  if (result.page.next_cursor) {
+  const nextPage =
+    result.page.next_offset !== undefined
+      ? result.page.next_offset === null
+        ? null
+        : `--offset ${result.page.next_offset}`
+      : result.page.next_cursor
+        ? `--cursor ${shellSingleQuote(result.page.next_cursor)}`
+        : null;
+  if (nextPage) {
     const target = command === "admin nodes logs" ? ` ${shellSingleQuote(input.node_id)}` : "";
     const filters = [
       ["supplier", command === "admin users list" ? undefined : input.organization_id],
@@ -535,8 +544,6 @@ export function writeAdminResultHuman(stdout, command, result, input = {}) {
       .filter(([, value]) => value !== undefined)
       .map(([name, value]) => ` --${name} ${shellSingleQuote(String(value))}`)
       .join("");
-    stdout.write(
-      `Next: ornn ${command}${target} --cursor ${shellSingleQuote(result.page.next_cursor)}${filters}\n`
-    );
+    stdout.write(`Next: ornn ${command}${target} ${nextPage}${filters}\n`);
   }
 }

package/src/catalog-shell.mjs

@@ -818,13 +818,13 @@ function parseCapabilityInput(capability, rawInput) {
   });
 }
 
-// Commerce's market routes and Markets serve every caller on one path and
-// decide from the session what it may do; a staff session is an admin there.
-const ROLE_AWARE_PREFIXES = ["/commerce/v2/listings", "/commerce/reservations", "/v1/markets"];
+// Native Commerce and Markets routes authenticate the caller at the gateway.
+// Commerce's /internal/v1 routes additionally require staff.
+const DIRECT_GATEWAY_PREFIXES = ["/commerce", "/internal/v1", "/v1/markets"];
 
-function isRoleAwarePath(path) {
+function isDirectGatewayPath(path) {
   const pathname = String(path).split("?")[0];
-  return ROLE_AWARE_PREFIXES.some(
+  return DIRECT_GATEWAY_PREFIXES.some(
     (prefix) => pathname === prefix || pathname.startsWith(`${prefix}/`)
   );
 }
@@ -839,7 +839,7 @@ function adminFetch(io, path, init = {}) {
     ...(init.headers !== undefined ? { headers: init.headers } : {}),
     ...((init.signal ?? io.signal) !== undefined ? { signal: init.signal ?? io.signal } : {}),
   };
-  return isRoleAwarePath(path) || (path === "/v1/staff/invites" && request.method === "POST")
+  return isDirectGatewayPath(path) || (path === "/v1/staff/invites" && request.method === "POST")
     ? cliRequest(request)
     : operatorRequest(request);
 }

package/src/evidence-commands.mjs

@@ -264,15 +264,13 @@ function reachability(value) {
   if (explicit === true) return { state: "reachable", observed_at: null };
   if (explicit === false) return { state: "unreachable", observed_at: null };
   const candidate = record(source.reachability);
-  const offGrid = record(source.off_grid_reachability);
-  const state = stateToken(candidate.state ?? candidate.status ?? offGrid.state ?? offGrid.status);
-  const phase = stateToken(candidate.phase ?? offGrid.phase);
-  const observedAt =
-    text(candidate.observed_at) ?? text(candidate.checked_at) ?? text(offGrid.last_checked_at);
+  const state = stateToken(candidate.state ?? candidate.status);
+  const phase = stateToken(candidate.phase);
+  const observedAt = text(candidate.observed_at) ?? text(candidate.checked_at);
   if (["reachable", "live", "online"].includes(state) || phase === "ssh_ready")
     return { state: "reachable", observed_at: observedAt };
   if (
-    ["unreachable", "offline", "off_grid"].includes(state) ||
+    ["unreachable", "offline"].includes(state) ||
     ["ssh_unreachable", "unreachable"].includes(phase)
   )
     return { state: "unreachable", observed_at: observedAt };