@ornncompute/cli 1.0.75 → 1.0.107

package/vendor/capabilities/capabilities/admin-capacity-reservations.js

@@ -1,101 +0,0 @@
-import { z } from "zod";
-import { defineCapability, preview } from "../capability.js";
-import { ensureFacility, locateRegion, unplacedLocation } from "./locality.js";
-import { nativeListingCreateInput } from "./native-listing.js";
-import { idempotencyHeaders, microUsd } from "./market-shared.js";
-function adminHelp(command, outcome, human, automation, review) {
-    return {
-        audience: "admin",
-        category: "resource",
-        command,
-        outcome,
-        human,
-        automation,
-        acceptedReferences: [],
-        ...(review ? { review } : {}),
-    };
-}
-export const adminCapacityOffersCreateCapability = defineCapability({
-    id: "listing.create",
-    domain: "listings",
-    roles: ["admin"],
-    description: "Create native capacity with an organization, a facilityId or a location, hardware, availability and advertised terms. A location is any state, city, address, or catalog region (us-west-3); Ornn places it in a catalog region and uses the organization's facility there. Primary capacity needs daysToRfs (0 when ready now) or both availableAt and availableUntil. nodeIds attach nodes at creation. Returns {listing, terms}. Requires an idempotencyKey reused on retries and confirm: true.",
-    mutation: "preview-confirm",
-    http: { method: "POST", path: "/commerce/v2/listings" },
-    input: nativeListingCreateInput,
-    slack: false,
-    cli: {
-        command: ["admin", "capacity-offers", "create"],
-        vnext: adminHelp(["admin", "capacity-offers", "create"], "Create native capacity and its advertised financial terms.", "ornn admin capacity-offers create --gpu-slug GPU --gpus-per-node COUNT (--facility-id UUID | --location PLACE) --provisioning-type bare-metal|virtual-machine --state draft|available --terms JSON --idempotency-key KEY (--days-to-rfs DAYS | --available-at TIME --available-until TIME) [--capacity-node-count COUNT] [--node-ids JSON] [--organization-id UUID]", "Requires an eligible human terminal; --location also needs --organization-id; reuse --idempotency-key on retries.", "Review the native parent fields and each financial term before default-no consent."),
-    },
-    execute: async (ctx, input) => {
-        const { confirm: _confirm, idempotencyKey, location, ...body } = nativeListingCreateInput.parse(input);
-        const located = location ? await locateRegion(ctx.fetch, location) : null;
-        if (location && !located)
-            throw new Error(unplacedLocation(location));
-        if (!ctx.confirmed)
-            return preview("listing.create", located ? { ...body, located } : body);
-        const facilityId = located
-            ? (await ensureFacility(ctx.fetch, body.organizationId, located.region)).facilityId
-            : body.facilityId;
-        return ctx.fetch("/commerce/v2/listings", {
-            method: "POST",
-            body: { ...body, facilityId },
-            headers: idempotencyHeaders(ctx, idempotencyKey),
-        });
-    },
-});
-// Markets books whole-second windows; a fractional digit would shift or refuse one.
-const wholeSecondInstant = z.iso
-    .datetime({ offset: true })
-    .refine((value) => !/\.\d*[1-9]/.test(value), "Use a time in whole seconds.");
-export const reservationCreateInput = z.object({
-    organizationId: z.string().uuid().describe("The customer organization the window is booked for."),
-    listingId: z
-        .string()
-        .uuid()
-        .describe("The listing's capacityListingId. Staff may book any available listing."),
-    listingTermId: z
-        .string()
-        .uuid()
-        .describe("The listingTermsId of a non-renewable Reserved term on that listing."),
-    nodes: z.number().int().positive().max(2_147_483_647).describe("Whole nodes to book."),
-    startsAt: wholeSecondInstant.describe("RFC 3339 start of the window in whole seconds, no more than five minutes ago."),
-    endsAt: wholeSecondInstant.describe("RFC 3339 end of the window in whole seconds, at least an hour after the start and within the term's duration range."),
-    pricePerGpuHourMicroUsd: microUsd.describe("The term's price in micro-USD per GPU-hour. A changed price refuses the booking."),
-    idempotencyKey: z
-        .string()
-        .trim()
-        .min(1)
-        .max(200)
-        .describe("Reuse this key when retrying the same booking."),
-});
-export const adminReservationsCreateCapability = defineCapability({
-    id: "reservations.create",
-    domain: "reservations",
-    roles: ["admin"],
-    description: "Book a window of a listing term for a customer organization (admin). Markets holds the GPUs until the window starts, then settles a Commerce reservation with the booking's ID. Returns {bookings}.",
-    mutation: "preview-confirm",
-    http: { method: "POST", path: "/v1/markets/bookings" },
-    cli: {
-        command: ["admin", "reservations", "create"],
-        vnext: adminHelp(["admin", "reservations", "create"], "Book a listing term window for a customer organization.", "ornn admin reservations create --organization-id UUID --listing-id UUID --listing-term-id UUID --nodes COUNT --starts-at TIME --ends-at TIME --price-per-gpu-hour-micro-usd N --idempotency-key KEY", "Requires an eligible human terminal. Reuse --idempotency-key when retrying the same booking.", "Customer organization, listing, term, nodes, window, price, and idempotency key are reviewed before default-no consent."),
-    },
-    slack: false,
-    input: reservationCreateInput,
-    execute: async (ctx, input) => {
-        const { organizationId, idempotencyKey, ...leg } = reservationCreateInput.parse(input);
-        const body = { organizationId, legs: [leg] };
-        if (!ctx.confirmed)
-            return { preview: body };
-        return ctx.fetch("/v1/markets/bookings", {
-            method: "POST",
-            body,
-            headers: idempotencyHeaders(ctx, idempotencyKey),
-        });
-    },
-});
-export const adminCapacityReservationCapabilities = [
-    adminCapacityOffersCreateCapability,
-    adminReservationsCreateCapability,
-];

package/vendor/capabilities/capabilities/admin-enrollment.js

@@ -1,322 +0,0 @@
-import { z } from "zod";
-import { defineCapability } from "../capability.js";
-import { buildEnrollmentInstallCommand, tokensCreateCapability, tokensListCapability, } from "./tokens.js";
-const UUID = z.string().uuid();
-const nonEmpty = z.string().trim().min(1);
-const tokenTtl = z
-    .number()
-    .int()
-    .min(60)
-    .max(24 * 60 * 60);
-function adminHelp(command, outcome, human, automation, acceptedReferences = [], review) {
-    return {
-        audience: "admin",
-        category: "resource",
-        command,
-        outcome,
-        human,
-        automation,
-        acceptedReferences,
-        ...(review ? { review } : {}),
-    };
-}
-function withVnextBinding(capability, help) {
-    if (!help.command)
-        throw new Error(`${capability.id} requires a canonical CLI command`);
-    return {
-        ...capability,
-        cli: {
-            command: [...help.command],
-            vnext: help,
-        },
-    };
-}
-export const adminEnrollmentTokensListCapability = {
-    ...withVnextBinding(tokensListCapability, adminHelp(["admin", "enrollment-tokens", "list"], "List enrollment-token metadata without token bytes.", "ornn admin enrollment-tokens list [--limit 50] [--cursor CURSOR]", "ornn admin enrollment-tokens list --limit 50 --format json")),
-    execute: async (ctx) => {
-        const payload = await tokensListCapability.execute(ctx, {});
-        if (!ctx.cli)
-            return payload;
-        return {
-            enrollment_tokens: rowsFromTokenList(payload)
-                .map(tokenMetadata)
-                .filter((token) => token !== null),
-        };
-    },
-};
-export const adminEnrollmentTokenCreateCapability = withVnextBinding(tokensCreateCapability, adminHelp(["admin", "enrollment-tokens", "create"], "Create one expiring enrollment token through an explicit secret export.", "ornn admin enrollment-tokens create --supplier UUID --expires-in SECONDS (--print | --output PATH) [--overwrite] []", "Unsupported: token creation requires an eligible human terminal.", ["canonical supplier organization UUID"], "Review the supplier, expiry, and secret destination before minting the token."));
-const tokenRevokeInput = z.object({
-    tokenId: z.string().min(1),
-    token_id: UUID.optional(),
-    expected_created_at: nonEmpty.optional(),
-    idempotency_key: nonEmpty.optional(),
-    confirm: z.boolean().optional(),
-});
-function rowsFromTokenList(payload) {
-    if (Array.isArray(payload))
-        return payload;
-    if (!payload || typeof payload !== "object")
-        return [];
-    const source = payload;
-    for (const key of ["enrollment_tokens", "tokens", "items", "data"]) {
-        if (Array.isArray(source[key]))
-            return source[key];
-    }
-    return [];
-}
-function tokenMetadata(value) {
-    if (!value || typeof value !== "object")
-        return null;
-    const row = value;
-    if (typeof row.id !== "string" || !row.id)
-        return null;
-    return {
-        id: row.id,
-        organization_id: typeof row.organization_id === "string" ? row.organization_id : null,
-        status: typeof row.status === "string" ? row.status : "unknown",
-        expires_at: typeof row.expires_at === "string" ? row.expires_at : null,
-        created_at: typeof row.created_at === "string" ? row.created_at : null,
-    };
-}
-function codedError(code, message) {
-    const error = new Error(message);
-    error.detail = { code, retryable: false };
-    return error;
-}
-async function readExactToken(ctx, tokenId, expectedCreatedAt) {
-    // Filter at the owner before its list limit; an older active token may not be in the latest 500.
-    const listed = await ctx.fetch(`/enrollment-tokens?id=${encodeURIComponent(tokenId)}`, {
-        method: "GET",
-    });
-    const target = rowsFromTokenList(listed)
-        .map(tokenMetadata)
-        .find((candidate) => candidate?.id === tokenId);
-    if (!target)
-        return { disposition: "satisfied", target: null };
-    if (expectedCreatedAt && target.created_at !== expectedCreatedAt) {
-        return {
-            disposition: "conflict",
-            target,
-            message: `Enrollment token ${tokenId} was replaced after ${expectedCreatedAt}; refusing to revoke it.`,
-        };
-    }
-    if (target.status === "revoked" || target.status === "expired") {
-        return { disposition: "satisfied", target };
-    }
-    return { disposition: "apply", target };
-}
-export const adminEnrollmentTokenRevokeCapability = defineCapability({
-    id: "enrollment.token.revoke",
-    domain: "fleet",
-    roles: ["admin"],
-    description: "Internal staff only: revoke one exact enrollment-token generation after reconciling its durable goal.",
-    mutation: "preview-confirm",
-    http: { method: "DELETE", path: "/enrollment-tokens/{tokenId}" },
-    cli: {
-        command: ["admin", "enrollment-tokens", "revoke"],
-        vnext: adminHelp(["admin", "enrollment-tokens", "revoke"], "Revoke one exact enrollment-token generation.", "ornn admin enrollment-tokens revoke <token-id> [--expected-created-at TIME] []", "ornn admin enrollment-tokens revoke <token-id> --expected-created-at TIME  --idempotency-key KEY --format json", ["canonical token UUID", "token created_at generation"], "Review the exact token generation and the loss of future enrollment access."),
-    },
-    slack: false,
-    mcp: { name: "enrollment_token_revoke" },
-    input: tokenRevokeInput,
-    execute: async (ctx, input) => {
-        const parsed = tokenRevokeInput.parse(input);
-        const tokenId = parsed.tokenId ?? parsed.token_id;
-        const current = await readExactToken(ctx, tokenId, parsed.expected_created_at);
-        if (!ctx.confirmed)
-            return current;
-        if (current.disposition === "conflict") {
-            throw codedError("token_identity_changed", current.message);
-        }
-        if (current.disposition === "satisfied") {
-            return {
-                id: tokenId,
-                created_at: parsed.expected_created_at ?? current.target?.created_at ?? null,
-                status: "revoked",
-                reconciled: true,
-            };
-        }
-        if (!current.target.created_at) {
-            throw codedError("token_identity_unavailable", `Enrollment token ${tokenId} has no stable creation identity and cannot be revoked safely.`);
-        }
-        const revoked = (await ctx.fetch(`/enrollment-tokens/${encodeURIComponent(tokenId)}`, {
-            method: "DELETE",
-            ...(parsed.idempotency_key ? { headers: { "Idempotency-Key": parsed.idempotency_key } } : {}),
-        }));
-        return {
-            id: tokenId,
-            created_at: current.target.created_at,
-            organization_id: current.target.organization_id,
-            expires_at: current.target.expires_at,
-            status: "revoked",
-            reconciled: false,
-            ...(typeof revoked?.deleted === "boolean" ? { deleted: revoked.deleted } : {}),
-        };
-    },
-});
-const nodeEnrollInput = z.object({
-    node_id: UUID,
-    host: nonEmpty,
-    organization_id: UUID,
-    facility_id: UUID,
-    filter: z.string().optional(),
-    identity_file: nonEmpty,
-    private_key: z.string().min(1).optional(),
-    username: nonEmpty.default("root"),
-    port: z.number().int().min(1).max(65535).default(22),
-    expires_in_seconds: tokenTtl,
-    installer_base: nonEmpty.optional(),
-    replace_existing_management: z.literal(true),
-    verbose: z.boolean().default(false),
-});
-function safeRemoteResult(value) {
-    if (!value || typeof value !== "object")
-        return {};
-    const row = value;
-    const safe = {};
-    for (const key of ["id", "status", "state", "exit_code", "started_at", "completed_at"]) {
-        const field = row[key];
-        if (typeof field === "string" || typeof field === "number" || typeof field === "boolean") {
-            safe[key] = field;
-        }
-    }
-    return safe;
-}
-export const adminNodeEnrollCapability = defineCapability({
-    id: "nodes.enroll",
-    domain: "fleet",
-    roles: ["admin"],
-    description: "Enroll one explicit node over SSH with an explicit supplier and facility assignment.",
-    mutation: "preview-confirm",
-    http: { method: "POST", path: "/remote" },
-    cli: {
-        command: ["admin", "nodes", "enroll"],
-        vnext: adminHelp(["admin", "nodes", "enroll"], "Install Ornn management on one explicitly assigned node.", "ornn admin nodes enroll <node-id> --host HOST --supplier UUID --facility UUID [--filter COMPARTMENT_IDS] --identity-file PATH --token-ttl SECONDS --replace-existing-management [--verbose] []", "Unsupported: remote enrollment requires an eligible human terminal.", ["canonical node UUID", "canonical supplier organization UUID", "canonical facility UUID"], "Review node identity, SSH target, assignment, compartment filter, and replacement of existing management."),
-    },
-    mcp: false,
-    slack: false,
-    input: nodeEnrollInput,
-    execute: async (ctx, input) => {
-        const parsed = nodeEnrollInput.parse(input);
-        if (!ctx.confirmed) {
-            return {
-                node_id: parsed.node_id,
-                host: parsed.host,
-                organization_id: parsed.organization_id,
-                facility_id: parsed.facility_id,
-                filter: parsed.filter,
-                expires_in_seconds: parsed.expires_in_seconds,
-                replace_existing_management: true,
-            };
-        }
-        if (!parsed.private_key) {
-            throw codedError("identity_file_unreadable", "The SSH identity file could not be read.");
-        }
-        const minted = (await ctx.fetch("/enrollment-tokens", {
-            method: "POST",
-            body: {
-                organization_id: parsed.organization_id,
-                expires_in_seconds: parsed.expires_in_seconds,
-            },
-        }));
-        const token = typeof minted.token === "string"
-            ? minted.token
-            : typeof minted.plaintext === "string"
-                ? minted.plaintext
-                : "";
-        if (!token) {
-            throw codedError("token_material_unavailable", "The enrollment token was created without usable token material.");
-        }
-        const command = buildEnrollmentInstallCommand({
-            token,
-            base: parsed.installer_base ?? ctx.installerBaseUrl,
-            facilityId: parsed.facility_id,
-            filter: parsed.filter,
-            restoreNodeId: parsed.node_id,
-            force: true,
-        });
-        const remote = await ctx.fetch("/remote", {
-            method: "POST",
-            body: {
-                host: parsed.host,
-                username: parsed.username,
-                port: parsed.port,
-                private_key: parsed.private_key,
-                command,
-                timeout_seconds: 600,
-            },
-        });
-        return {
-            node_id: parsed.node_id,
-            host: parsed.host,
-            organization_id: parsed.organization_id,
-            facility_id: parsed.facility_id,
-            filter: parsed.filter,
-            management: "replaced",
-            token_metadata: {
-                id: typeof minted.id === "string" ? minted.id : null,
-                expires_at: typeof minted.expires_at === "string" ? minted.expires_at : null,
-            },
-            remote: safeRemoteResult(remote),
-        };
-    },
-});
-const nodeKeyInput = z.object({ node_id: UUID });
-export const adminNodeExportKeyCapability = defineCapability({
-    id: "nodes.export-key",
-    domain: "fleet",
-    roles: ["admin"],
-    description: "Export an enrolled node's private admin key only through an explicit secret destination.",
-    mutation: "read",
-    http: { method: "GET", path: "/enrollment/admin-ssh-key" },
-    cli: {
-        command: ["admin", "nodes", "export-key"],
-        vnext: adminHelp(["admin", "nodes", "export-key"], "Export one node admin key deliberately.", "ornn admin nodes export-key <node-id> (--print | --output PATH) [--overwrite]", "ornn admin nodes export-key <node-id> --output PATH [--overwrite] --format json", ["canonical node UUID"]),
-    },
-    mcp: false,
-    slack: false,
-    input: nodeKeyInput,
-    execute: async (ctx, input) => {
-        const parsed = nodeKeyInput.parse(input);
-        return ctx.fetch(`/enrollment/admin-ssh-key?node_id=${encodeURIComponent(parsed.node_id)}`, {
-            method: "GET",
-        });
-    },
-});
-export const adminNodeRotateKeyCapability = defineCapability({
-    id: "nodes.rotate-key",
-    domain: "fleet",
-    roles: ["admin"],
-    description: "Replace a node's admin key and export the new private key explicitly.",
-    mutation: "preview-confirm",
-    http: { method: "POST", path: "/enrollment/admin-ssh-key" },
-    cli: {
-        command: ["admin", "nodes", "rotate-key"],
-        vnext: adminHelp(["admin", "nodes", "rotate-key"], "Rotate one node admin key and export the replacement deliberately.", "ornn admin nodes rotate-key <node-id> (--print | --output PATH) [--overwrite] []", "Unsupported: key rotation requires an eligible human terminal.", ["canonical node UUID"], "Review the node and loss of access through the previous private key."),
-    },
-    mcp: false,
-    slack: false,
-    input: nodeKeyInput,
-    execute: async (ctx, input) => {
-        const parsed = nodeKeyInput.parse(input);
-        if (!ctx.confirmed)
-            return { node_id: parsed.node_id };
-        return ctx.fetch(`/enrollment/admin-ssh-key?node_id=${encodeURIComponent(parsed.node_id)}`, {
-            method: "POST",
-        });
-    },
-});
-const replacements = {
-    "tokens.create": adminEnrollmentTokenCreateCapability,
-    "tokens.list": adminEnrollmentTokensListCapability,
-};
-/** Applies the canonical admin CLI bindings without changing MCP or Slack identities. */
-export function bindAdminEnrollmentCapabilities(capabilities) {
-    return capabilities.map((capability) => replacements[capability.id] ?? capability);
-}
-export const adminEnrollmentCapabilities = [
-    adminEnrollmentTokenRevokeCapability,
-    adminNodeEnrollCapability,
-    adminNodeExportKeyCapability,
-    adminNodeRotateKeyCapability,
-];

package/vendor/capabilities/capabilities/admin-node-diagnostics.js

@@ -1,88 +0,0 @@
-import { z } from "zod";
-import { defineCapability } from "../capability.js";
-import { nodeExecCapability } from "./fleet.js";
-const nodeId = z
-    .string()
-    .min(1)
-    .refine((value) => value === value.trim(), {
-    message: "node_id must be an exact canonical node ID without surrounding whitespace",
-});
-export const adminNodeDiagnoseInput = z.object({
-    node_id: nodeId,
-});
-export const adminNodeExecInput = z.object({
-    node_id: nodeId,
-    command: z.string().min(1),
-    timeout_seconds: z.number().int().min(1).max(900),
-});
-function adminNodeHelp(command, outcome, human, automation, review) {
-    return {
-        audience: "admin",
-        category: "resource",
-        command,
-        outcome,
-        human,
-        automation,
-        acceptedReferences: ["canonical node ID"],
-        review,
-    };
-}
-export const adminNodeDiagnoseCapability = defineCapability({
-    id: "node.diagnose",
-    domain: "fleet",
-    roles: ["admin"],
-    description: "Queue the staff-authorized diagnosis workflow for one exact node after a live review.",
-    mutation: "preview-confirm",
-    http: { method: "POST", path: "/jobs" },
-    cli: {
-        command: ["admin", "nodes", "diagnose"],
-        vnext: adminNodeHelp(["admin", "nodes", "diagnose"], "Queue diagnosis for one exact node.", "ornn admin nodes diagnose <node-id>", "Unavailable in machine and redirected modes; use an eligible human terminal.", "Exact node, lifecycle, reachability, and diagnosis workflow."),
-    },
-    mcp: false,
-    slack: false,
-    input: adminNodeDiagnoseInput,
-    execute: async (ctx, input) => {
-        const parsed = adminNodeDiagnoseInput.parse(input);
-        if (!ctx.confirmed) {
-            return {
-                action: "node.diagnose",
-                payload: { node_id: parsed.node_id, source: { mode: "cli" }, burn_time_minutes: 0 },
-            };
-        }
-        return ctx.fetch("/jobs", {
-            method: "POST",
-            body: { node_id: parsed.node_id, source: { mode: "cli" }, burn_time_minutes: 0 },
-        });
-    },
-});
-export const adminNodeExecCapability = {
-    ...nodeExecCapability,
-    mutation: "preview-confirm",
-    cli: {
-        ...nodeExecCapability.cli,
-        vnext: adminNodeHelp(["admin", "nodes", "exec"], "Execute exact command bytes on one exact node.", "ornn admin nodes exec <node-id> --command COMMAND --timeout DURATION", "Unavailable in machine and redirected modes; use an eligible human terminal.", "Exact node, lifecycle, reachability, command bytes, and timeout."),
-    },
-    input: adminNodeExecInput,
-    execute: async (ctx, input) => {
-        const parsed = adminNodeExecInput.parse(input);
-        if (ctx.cli && !ctx.confirmed) {
-            return {
-                action: "node.exec",
-                payload: {
-                    node_id: parsed.node_id,
-                    command: parsed.command,
-                    timeout_seconds: parsed.timeout_seconds,
-                },
-            };
-        }
-        return nodeExecCapability.execute(ctx, {
-            node_id: parsed.node_id,
-            command: parsed.command,
-            timeout_seconds: parsed.timeout_seconds,
-        });
-    },
-};
-export const adminNodeDiagnosticCapabilities = [
-    adminNodeDiagnoseCapability,
-    adminNodeExecCapability,
-];

package/vendor/capabilities/capabilities/admin-nodes-lifecycle.js

@@ -1,137 +0,0 @@
-import { z } from "zod";
-import { defineCapability } from "../capability.js";
-const nodeReference = z.string().trim().min(1);
-const optionalText = z.string().trim().min(1).optional();
-const commonInput = {
-    node_ref: nodeReference,
-    node_id: optionalText,
-    idempotency_key: optionalText,
-    reason: optionalText,
-    yes: z.boolean().optional(),
-    wait: z.boolean().optional(),
-    timeout_seconds: z.number().positive().optional(),
-};
-const rebootInput = z.object({
-    ...commonInput,
-    machine_id: optionalText,
-});
-const hardResetInput = rebootInput.extend({
-    erase_local_data: z.literal(true),
-});
-const assignmentInput = z.object({
-    ...commonInput,
-    reservation_id: z.string().trim().min(1),
-});
-function adminLifecycleHelp(command, outcome, human, automation, review) {
-    return {
-        audience: "admin",
-        category: "resource",
-        command,
-        outcome,
-        human,
-        automation,
-        acceptedReferences: ["canonical node ID", "exact unique node hostname in an eligible terminal"],
-        review,
-        resumableStates: ["accepted", "pending", "timed out", "interrupted"],
-        related: ["admin nodes health", "admin nodes list"],
-    };
-}
-function nodeId(input) {
-    if (!input.node_id)
-        throw new Error("The lifecycle target must be resolved before execution.");
-    return input.node_id;
-}
-function requestHeaders(idempotencyKey) {
-    return idempotencyKey ? { "Idempotency-Key": idempotencyKey } : undefined;
-}
-function preview(action, payload) {
-    return { ok: true, action, payload };
-}
-async function reboot(ctx, input, mode) {
-    const parsed = mode === "hard_reset" ? hardResetInput.parse(input) : rebootInput.parse(input);
-    const payload = {
-        node_id: parsed.node_id,
-        machine_id: parsed.machine_id,
-        mode,
-        ...(mode === "hard_reset" ? { erase_local_data: true } : {}),
-    };
-    if (!ctx.confirmed)
-        return preview(`nodes.${mode}`, payload);
-    if (!parsed.machine_id)
-        throw new Error("The live machine target must be resolved before reboot.");
-    return ctx.fetch(`/nodes/${encodeURIComponent(parsed.machine_id)}/reboot`, {
-        method: "POST",
-        body: {
-            mode,
-            ...(parsed.idempotency_key ? { request_id: parsed.idempotency_key } : {}),
-        },
-        headers: requestHeaders(parsed.idempotency_key),
-    });
-}
-export const adminNodeRebootCapability = defineCapability({
-    id: "nodes.reboot",
-    domain: "fleet",
-    roles: ["admin"],
-    description: "Reboot the exact live machine backing one managed node after a normalized review.",
-    mutation: "preview-confirm",
-    http: { method: "POST", path: "/nodes/{id}/reboot" },
-    cli: {
-        command: ["admin", "nodes", "reboot"],
-        vnext: adminLifecycleHelp(["admin", "nodes", "reboot"], "Reboot one exact live machine while preserving local data and access configuration.", "ornn admin nodes reboot <node-ref> [] [--no-wait] [--timeout SECONDS]", "Unsupported: reboot requires an eligible human terminal.", "Node and live-machine identities, supplier, facility, capacity assignment, and preserved access."),
-    },
-    mcp: false,
-    slack: false,
-    input: rebootInput,
-    execute: (ctx, input) => reboot(ctx, input, "reboot"),
-});
-export const adminNodeHardResetCapability = defineCapability({
-    id: "nodes.hard_reset",
-    domain: "fleet",
-    roles: ["admin"],
-    description: "Hard reset the exact live machine backing one node with explicit local-data erasure scope.",
-    mutation: "preview-confirm",
-    http: { method: "POST", path: "/nodes/{id}/reboot" },
-    cli: {
-        command: ["admin", "nodes", "hard-reset"],
-        vnext: adminLifecycleHelp(["admin", "nodes", "hard-reset"], "Erase local tenant data and hard reset one exact live machine.", "ornn admin nodes hard-reset <node-ref> --erase-local-data [] [--no-wait] [--timeout SECONDS]", "Unsupported: hard reset requires an eligible human terminal.", "Node and live-machine identities, supplier, facility, capacity assignment, erased local data, and restored keys."),
-    },
-    mcp: false,
-    slack: false,
-    input: hardResetInput,
-    execute: (ctx, input) => reboot(ctx, input, "hard_reset"),
-});
-export const adminNodeAssignCapability = defineCapability({
-    id: "nodes.assign",
-    domain: "fleet",
-    roles: ["admin"],
-    description: "Assign one exact node to one exact capacity reservation after consequence review.",
-    mutation: "preview-confirm",
-    http: { method: "POST", path: "/nodes/{id}/assign" },
-    cli: {
-        command: ["admin", "nodes", "assign"],
-        vnext: adminLifecycleHelp(["admin", "nodes", "assign"], "Assign one exact node to one exact capacity reservation.", "ornn admin nodes assign <node-ref> --reservation <reservation-id> [] [--no-wait]", "ornn admin nodes assign <node-id> --reservation <reservation-id>  --idempotency-key KEY --format json", "Node, supplier, facility, previous and requested capacity assignments, and tenant access change."),
-    },
-    mcp: false,
-    slack: false,
-    input: assignmentInput,
-    execute: async (ctx, input) => {
-        const parsed = assignmentInput.parse(input);
-        const id = nodeId(parsed);
-        const body = {
-            reservation_id: parsed.reservation_id,
-            ...(parsed.idempotency_key ? { request_id: parsed.idempotency_key } : {}),
-        };
-        if (!ctx.confirmed)
-            return preview("nodes.assign", { node_id: id, ...body });
-        return ctx.fetch(`/nodes/${encodeURIComponent(id)}/assign`, {
-            method: "POST",
-            body,
-            headers: requestHeaders(parsed.idempotency_key),
-        });
-    },
-});
-export const adminNodeLifecycleCapabilities = [
-    adminNodeRebootCapability,
-    adminNodeHardResetCapability,
-    adminNodeAssignCapability,
-];