@ornncompute/cli 0.1.0 → 0.1.1

package/src/cli.mjs

@@ -1,4 +1,3 @@
-import { createHash } from "node:crypto";
 import { readFile } from "node:fs/promises";
 
 import {
@@ -15,40 +14,54 @@ import {
   waitForDeviceApproval,
 } from "./device-auth.mjs";
 
-const VERSION = "0.1.0";
+const VERSION = "0.1.1";
+const DEFAULT_BUY_NOW_USD_PER_GPU_HOUR = 10;
+
+const CONCISE_HELP = `Ornn Fabric CLI
+
+Find, buy, access, and resell bare-metal compute.
+
+Usage:
+  fabric <command> [options]
+
+Examples:
+  fabric availability list
+  fabric buy <listing-id>
+  fabric access activate <reservation-id> --ssh-key-id <key-id>
+
+Run \`fabric --help\` for all commands, or \`fabric help <command>\`.
+`;
 
 const HELP = `Ornn Fabric CLI
 
 Usage:
+  fabric help [command]
   fabric login [--auth-base <url>] [--no-browser] [--timeout <seconds>]
   fabric whoami [--json]
   fabric status [--json]
-  fabric marketplace listings [--json]
-  fabric reserve view [--gpu-type <type>] [--facility <name>] [--view week|month]
-  fabric reserve create --deployment-id <id> --gpu-count <n> --start-date <yyyy-mm-dd> --end-date <yyyy-mm-dd> --price <usd>
-  fabric portfolio reservations [--status <status>] [--json]
-  fabric portfolio bids [--json]
-  fabric portfolio bid update <bid-id> --gpu-count <n> --min-gpu-count <n> --start-date <yyyy-mm-dd> --end-date <yyyy-mm-dd> --price <usd>
-  fabric portfolio bid withdraw <bid-id>
-  fabric portfolio reservation access-mode <reservation-id> --mode vm|bare-metal [--image-id <id>]
-  fabric portfolio reservation list <reservation-id> --ask-price <usd>
-  fabric portfolio reservation ask-price <reservation-id> --ask-price <usd>
-  fabric portfolio reservation delist <reservation-id>
-  fabric portfolio reservation buy <reservation-id>
-  fabric machines list <reservation-id> [--json]
-  fabric machines get <instance-id> [--json]
-  fabric machines cost <reservation-id> [--json]
-  fabric machines launch <reservation-id> --ssh-key-id <id> [--username <name>] [--machine-count <n>]
-  fabric machines switch-access <reservation-id> --mode vm|bare-metal [--ssh-key-id <id>] [--username <name>] [--image-id <id>]
-  fabric machines action <instance-id> start|stop|extend|teardown [--extend-by-minutes <n>]
-  fabric machines push-keys <instance-id> --ssh-key-id <id>
-  fabric machines revoke <instance-id>
+  fabric availability list [--gpu-type <type>] [--facility <name>] [--operator <name>] [--json]
+  fabric availability show <listing-id> [--open] [--json]
+  fabric buy <listing-id> [--no-open] [--json]
+  fabric bid create <listing-id> --gpu-count <n> --min-gpu-count <n> --start-date <yyyy-mm-dd> --end-date <yyyy-mm-dd> --price <usd> [--no-open] [--json]
+  fabric bid list [--json]
+  fabric bid show <bid-id> [--open] [--json]
+  fabric bid update <bid-id> --gpu-count <n> --min-gpu-count <n> --start-date <yyyy-mm-dd> --end-date <yyyy-mm-dd> --price <usd>
+  fabric bid withdraw <bid-id>
+  fabric reservations list [--status <status>] [--json]
+  fabric reservations show <reservation-id> [--open] [--json]
+  fabric reservations checkout <reservation-id> [--no-open] [--json]
+  fabric access show <reservation-id> [--json]
+  fabric access activate <reservation-id> --ssh-key-id <id> [--username <name>] [--no-open] [--json]
+  fabric access push-keys <reservation-id> --ssh-key-id <id> [--json]
+  fabric resale browse [--json]
+  fabric resale list <reservation-id> --ask-price <usd> [--no-open] [--json]
+  fabric resale update <reservation-id> --ask-price <usd> [--no-open] [--json]
+  fabric resale delist <reservation-id> [--no-open] [--json]
   fabric ssh-keys list [--json]
-  fabric ssh-keys add --public-key <key> [--label <label>]
-  fabric ssh-keys delete <key-id>
-  fabric images list [--json]
-  fabric images upload --name <name> --os-family <os> --cosign-signature <sig> (--image-file <path>|--registry-ref <ref>) [--sha256 <hex>] [--size-bytes <n>]
-  fabric images revoke <image-id>
+  fabric ssh-keys add --public-key <key> [--label <label>] [--json]
+  fabric ssh-keys add --public-key-file <path> [--label <label>] [--json]
+  fabric ssh-keys delete <key-id> [--json]
+  fabric billing open [--no-open] [--json]
   fabric api <get|post|patch|put|delete> <compute-path> [--data <json>] [--raw]
   fabric logout
 
@@ -56,16 +69,50 @@ Environment:
   ORNN_AUTH_BASE_URL  Web/auth server origin. Defaults to http://localhost:3000.
   ORNN_API_BASE_URL   Optional web API origin. Defaults to ORNN_AUTH_BASE_URL.
   ORNN_CONFIG_HOME    Directory for CLI auth state. Defaults to ~/.config/ornn.
+
+Output:
+  Commands print human-readable output by default.
+  Use --json for structured output suitable for scripts and jq.
+  Errors and login/browser progress are written to stderr.
 `;
 
+const HELP_TOPICS = new Set([
+  "access",
+  "account",
+  "api",
+  "availability",
+  "bid",
+  "bids",
+  "billing",
+  "buy",
+  "help",
+  "login",
+  "logout",
+  "reservations",
+  "resale",
+  "ssh-keys",
+  "status",
+  "whoami",
+]);
+
 export async function run(argv = [], io = {}) {
   const stdout = io.stdout ?? process.stdout;
   const stderr = io.stderr ?? process.stderr;
   const env = io.env ?? process.env;
   const fetchImpl = io.fetch ?? fetch;
+  const openBrowserImpl = io.openBrowser ?? openBrowser;
   const [command, ...args] = argv;
 
-  if (!command || command === "--help" || command === "-h") {
+  if (!command) {
+    stdout.write(CONCISE_HELP);
+    return 0;
+  }
+
+  if (command === "--help" || command === "-h") {
+    if (args.length) {
+      stderr.write(HELP);
+      return 1;
+    }
     stdout.write(HELP);
     return 0;
   }
@@ -76,8 +123,21 @@ export async function run(argv = [], io = {}) {
   }
 
   try {
+    if (args.includes("--help") || args.includes("-h")) {
+      const helpError = validateHelpInvocation(command, args.filter((arg) => arg !== "--help" && arg !== "-h"));
+      if (helpError) {
+        throw new Error(helpError);
+      }
+      stdout.write(HELP);
+      return 0;
+    }
+
+    if (command === "help") {
+      return await help(args, { stdout });
+    }
+
     if (command === "login") {
-      return await login(args, { env, stderr, stdout });
+      return await login(args, { env, fetchImpl, openBrowserImpl, stderr, stdout });
     }
 
     if (command === "whoami" || command === "account") {
@@ -92,31 +152,40 @@ export async function run(argv = [], io = {}) {
       return await api(args, { env, fetchImpl, stdout });
     }
 
-    if (command === "marketplace") {
-      return await marketplace(args, { env, fetchImpl, stdout });
+    if (command === "availability") {
+      return await availability(args, { env, fetchImpl, openBrowserImpl, stdout });
     }
 
-    if (command === "reserve") {
-      return await reserve(args, { env, fetchImpl, stdout });
+    if (command === "buy") {
+      return await buy(args, { env, fetchImpl, openBrowserImpl, stdout });
     }
 
-    if (command === "portfolio") {
-      return await portfolio(args, { env, fetchImpl, stdout });
+    if (command === "bid" || command === "bids") {
+      return await bid(args, { env, fetchImpl, openBrowserImpl, stdout });
     }
 
-    if (command === "machines") {
-      return await machines(args, { env, fetchImpl, stdout });
+    if (command === "reservations") {
+      return await reservations(args, { env, fetchImpl, openBrowserImpl, stdout });
     }
 
-    if (command === "ssh-keys") {
-      return await sshKeys(args, { env, fetchImpl, stdout });
+    if (command === "access") {
+      return await access(args, { env, fetchImpl, openBrowserImpl, stdout });
+    }
+
+    if (command === "resale") {
+      return await resale(args, { env, fetchImpl, openBrowserImpl, stdout });
+    }
+
+    if (command === "billing") {
+      return await billing(args, { env, fetchImpl, openBrowserImpl, stdout });
     }
 
-    if (command === "images") {
-      return await images(args, { env, fetchImpl, stdout });
+    if (command === "ssh-keys") {
+      return await sshKeys(args, { env, fetchImpl, stdout });
     }
 
     if (command === "logout") {
+      parseCommandOptions(args, {}, "Usage: fabric logout");
       await clearAuthSession({ env });
       stdout.write("Logged out of Ornn.\n");
       return 0;
@@ -125,13 +194,217 @@ export async function run(argv = [], io = {}) {
     stderr.write(`Unknown command: ${command}\n\n${HELP}`);
     return 1;
   } catch (error) {
-    const message = error instanceof Error ? error.message : String(error);
+    const message = formatCliError(error);
     stderr.write(`${message}\n`);
     return error instanceof DeviceAuthError || error instanceof CliApiError ? 2 : 1;
   }
 }
 
-async function login(args, { env, stderr, stdout }) {
+function validateHelpInvocation(command, args) {
+  if (command === "help") {
+    const [topic, ...extra] = args;
+    if (extra.length) {
+      return "Usage: fabric help [command]";
+    }
+    return topic && !HELP_TOPICS.has(topic) ? `Unknown command: ${topic}` : null;
+  }
+
+  if (command === "login") {
+    const parsed = parseHelpArgs(args, { booleanOptions: ["--no-browser"], valueOptions: ["--auth-base", "--poll-interval", "--timeout"] });
+    return parsed.error || (parsed.positionals.length ? "Usage: fabric login [--auth-base <url>] [--no-browser] [--timeout <seconds>]" : null);
+  }
+
+  if (command === "logout") {
+    return validateNoPositionals(args, "Usage: fabric logout");
+  }
+
+  if (command === "whoami" || command === "account") {
+    return validateNoPositionals(args, "Usage: fabric whoami [--json]", { booleanOptions: ["--json"] });
+  }
+
+  if (command === "status") {
+    return validateNoPositionals(args, "Usage: fabric status [--json]", { booleanOptions: ["--json"] });
+  }
+
+  if (command === "api") {
+    const parsed = parseHelpArgs(args, { booleanOptions: ["--json", "--raw"], valueOptions: ["--data"] });
+    if (parsed.error) {
+      return parsed.error;
+    }
+    if (!parsed.positionals.length) {
+      return null;
+    }
+    const [method, path, ...extra] = parsed.positionals;
+    if (!path || extra.length) {
+      return "Usage: fabric api <get|post|patch|put|delete> <compute-path> [--data <json>] [--raw]";
+    }
+    return ["delete", "get", "patch", "post", "put"].includes(method.toLowerCase()) ? null : `Unsupported API method: ${method}`;
+  }
+
+  if (command === "availability") {
+    const parsed = parseHelpArgs(args, { booleanOptions: ["--json", "--open"], valueOptions: ["--facility", "--gpu-type", "--operator"] });
+    if (parsed.error) {
+      return parsed.error;
+    }
+    const [subcommand, id, ...extra] = parsed.positionals;
+    if (!subcommand || subcommand === "list") {
+      return id || extra.length ? "Usage: fabric availability list [--gpu-type <type>] [--facility <name>] [--operator <name>] [--json]" : null;
+    }
+    if (subcommand === "show") {
+      return !id || extra.length ? "Usage: fabric availability show <listing-id> [--open] [--json]" : null;
+    }
+    return "Usage: fabric availability list|show";
+  }
+
+  if (command === "buy") {
+    const parsed = parseHelpArgs(args, { booleanOptions: ["--json", "--no-open"] });
+    if (parsed.error) {
+      return parsed.error;
+    }
+    return parsed.positionals.length === 1 ? null : "Usage: fabric buy <listing-id> [--no-open] [--json]";
+  }
+
+  if (command === "bid" || command === "bids") {
+    const parsed = parseHelpArgs(args, { booleanOptions: ["--json", "--no-open", "--open"], valueOptions: ["--end-date", "--gpu-count", "--min-gpu-count", "--price", "--start-date"] });
+    if (parsed.error) {
+      return parsed.error;
+    }
+    const [subcommand, id, ...extra] = parsed.positionals;
+    if (!subcommand || subcommand === "list") {
+      return id || extra.length ? "Usage: fabric bid list|show|create|update|withdraw" : null;
+    }
+    if (["create", "show", "update", "withdraw", "delete"].includes(subcommand)) {
+      return !id || extra.length ? "Usage: fabric bid list|show|create|update|withdraw" : null;
+    }
+    return "Usage: fabric bid list|show|create|update|withdraw";
+  }
+
+  if (command === "reservations") {
+    const parsed = parseHelpArgs(args, { booleanOptions: ["--json", "--no-open", "--open"], valueOptions: ["--status"] });
+    if (parsed.error) {
+      return parsed.error;
+    }
+    const [subcommand, id, ...extra] = parsed.positionals;
+    if (!subcommand || subcommand === "list") {
+      return id || extra.length ? "Usage: fabric reservations list|show|checkout" : null;
+    }
+    if (["show", "checkout"].includes(subcommand)) {
+      return !id || extra.length ? "Usage: fabric reservations list|show|checkout" : null;
+    }
+    return "Usage: fabric reservations list|show|checkout";
+  }
+
+  if (command === "access") {
+    const parsed = parseHelpArgs(args, { booleanOptions: ["--json", "--no-open"], valueOptions: ["--machine-count", "--request-id", "--ssh-key-id", "--tenant-username", "--username"] });
+    if (parsed.error) {
+      return parsed.error;
+    }
+    const [subcommand, id, ...extra] = parsed.positionals;
+    if (["show", "activate", "push-keys"].includes(subcommand)) {
+      return !id || extra.length ? "Usage: fabric access show|activate|push-keys <reservation-id>" : null;
+    }
+    return !subcommand ? null : "Usage: fabric access show|activate|push-keys <reservation-id>";
+  }
+
+  if (command === "resale") {
+    const parsed = parseHelpArgs(args, { booleanOptions: ["--json", "--no-open"], valueOptions: ["--ask-price"] });
+    if (parsed.error) {
+      return parsed.error;
+    }
+    const [subcommand, id, ...extra] = parsed.positionals;
+    if (!subcommand || subcommand === "browse") {
+      return id || extra.length ? "Usage: fabric resale browse|list|update|delist" : null;
+    }
+    if (["list", "update", "delist"].includes(subcommand)) {
+      return !id || extra.length ? "Usage: fabric resale browse|list|update|delist" : null;
+    }
+    return "Usage: fabric resale browse|list|update|delist";
+  }
+
+  if (command === "billing") {
+    const parsed = parseHelpArgs(args, { booleanOptions: ["--json", "--no-open"] });
+    if (parsed.error) {
+      return parsed.error;
+    }
+    const [subcommand, ...extra] = parsed.positionals;
+    if (!subcommand || subcommand === "open") {
+      return extra.length ? "Usage: fabric billing open [--no-open] [--json]" : null;
+    }
+    return "Usage: fabric billing open [--no-open] [--json]";
+  }
+
+  if (command === "ssh-keys") {
+    const parsed = parseHelpArgs(args, { booleanOptions: ["--json"], valueOptions: ["--label", "--public-key", "--public-key-file"] });
+    if (parsed.error) {
+      return parsed.error;
+    }
+    const [subcommand, id, ...extra] = parsed.positionals;
+    if (!subcommand || subcommand === "list") {
+      return id || extra.length ? "Usage: fabric ssh-keys list|add|delete" : null;
+    }
+    if (subcommand === "add") {
+      return id || extra.length ? "Usage: fabric ssh-keys list|add|delete" : null;
+    }
+    if (["delete", "remove"].includes(subcommand)) {
+      return extra.length ? "Usage: fabric ssh-keys list|add|delete" : null;
+    }
+    return "Usage: fabric ssh-keys list|add|delete";
+  }
+
+  return `Unknown command: ${command}`;
+}
+
+async function help(args, { stdout }) {
+  const [topic, ...extra] = args;
+  if (extra.length) {
+    throw new Error("Usage: fabric help [command]");
+  }
+  if (topic && !HELP_TOPICS.has(topic)) {
+    throw new Error(`Unknown command: ${topic}`);
+  }
+  stdout.write(HELP);
+  return 0;
+}
+
+function validateNoPositionals(args, usage, optionSpec = {}) {
+  const parsed = parseHelpArgs(args, optionSpec);
+  return parsed.error || (parsed.positionals.length ? usage : null);
+}
+
+function parseHelpArgs(args, { booleanOptions = [], valueOptions = [] } = {}) {
+  const booleanSet = new Set(booleanOptions);
+  const valueSet = new Set(valueOptions);
+  const positionals = [];
+
+  for (let index = 0; index < args.length; index += 1) {
+    const arg = args[index];
+    if (!arg?.startsWith("--")) {
+      positionals.push(arg);
+      continue;
+    }
+
+    const [option, inlineValue] = splitOption(arg);
+    if (booleanSet.has(option)) {
+      continue;
+    }
+    if (valueSet.has(option)) {
+      if (inlineValue !== null) {
+        continue;
+      }
+      const value = args[index + 1];
+      if (!value || value.startsWith("-")) {
+        return { error: `Missing value for ${option}.`, positionals };
+      }
+      index += 1;
+      continue;
+    }
+    return { error: `Unsupported option: ${option}.`, positionals };
+  }
+
+  return { error: null, positionals };
+}
+
+async function login(args, { env, fetchImpl, openBrowserImpl, stderr, stdout }) {
   const options = parseLoginOptions(args);
 
   if (options.help) {
@@ -140,37 +413,38 @@ async function login(args, { env, stderr, stdout }) {
   }
 
   const authBaseUrl = resolveAuthBaseUrl({ env, explicit: options.authBase });
-  stdout.write(`Starting Ornn browser login against ${authBaseUrl}\n`);
+  stderr.write(`Starting Ornn browser login against ${authBaseUrl}\n`);
 
-  const started = await startDeviceFlow({ authBaseUrl });
-  stdout.write(`\nOpen this URL to continue:\n${started.verificationUri}\n\n`);
-  stdout.write(`Code: ${started.userCode}\n\n`);
+  const started = await startDeviceFlow({ authBaseUrl, fetchImpl });
+  stderr.write(`\nOpen this URL to continue:\n${started.verificationUri}\n\n`);
+  stderr.write(`Code: ${started.userCode}\n\n`);
 
   if (!options.noBrowser) {
-    const opened = await openBrowser(started.verificationUri);
+    const opened = await openBrowserImpl(started.verificationUri);
     if (!opened) {
       stderr.write("Could not open the browser automatically. Open the URL above manually.\n");
     }
   }
 
-  stdout.write("Waiting for browser approval");
+  stderr.write("Waiting for browser approval");
   const session = await waitForDeviceApproval({
     authBaseUrl,
     deviceCode: started.deviceCode,
     expiresIn: started.expiresIn,
+    fetchImpl,
     interval: options.pollInterval ?? started.interval,
-    onPending: () => stdout.write("."),
+    onPending: () => stderr.write("."),
     timeoutSeconds: options.timeout,
   });
 
   await saveAuthSession(session, { env });
-  stdout.write(`\nLogged in as ${formatUser(session.user)}.\n`);
-  stdout.write(`Session saved to ${getAuthConfigPath(env)}\n`);
+  stderr.write(`\nLogged in as ${formatUser(session.user)}.\n`);
+  stderr.write(`Session saved to ${getAuthConfigPath(env)}\n`);
   return 0;
 }
 
 async function whoami(args, { env, fetchImpl, stderr, stdout }) {
-  const { options } = parseOptions(args, { boolean: ["json"] });
+  const options = parseCommandOptions(args, { boolean: ["json"] }, "Usage: fabric whoami [--json]");
   const session = await loadAuthSession({ env });
 
   if (!session) {
@@ -210,7 +484,7 @@ async function whoami(args, { env, fetchImpl, stderr, stdout }) {
 }
 
 async function status(args, { env, fetchImpl, stdout }) {
-  const { options } = parseOptions(args, { boolean: ["json"] });
+  const options = parseCommandOptions(args, { boolean: ["json"] }, "Usage: fabric status [--json]");
   const snapshot = await cliRequest({
     authRequired: false,
     endpoint: "/api/cli/status",
@@ -239,7 +513,11 @@ async function api(args, { env, fetchImpl, stdout }) {
   if (!["DELETE", "GET", "PATCH", "POST", "PUT"].includes(normalizedMethod)) {
     throw new Error(`Unsupported API method: ${method}`);
   }
-  const { options } = parseOptions(rest, { boolean: ["raw", "json"] });
+  const options = parseCommandOptions(
+    rest,
+    { boolean: ["raw", "json"], value: ["data"] },
+    "Usage: fabric api <get|post|patch|put|delete> <compute-path> [--data <json>] [--raw]",
+  );
   const body = await readJsonOption(options.data);
   const response = await cliRequest({
     body,
@@ -253,479 +531,1110 @@ async function api(args, { env, fetchImpl, stdout }) {
   return 0;
 }
 
-async function marketplace(args, context) {
-  const [subcommand, ...rest] = args;
-  if (subcommand !== "listings") {
-    throw new Error("Usage: fabric marketplace listings [--json]");
+async function availability(args, context) {
+  const [subcommand = "list", id, ...rest] = args;
+  if (subcommand === "list") {
+    const options = parseCommandOptions(
+      [id, ...rest].filter(Boolean),
+      { boolean: ["json"], value: ["facility", "gpu-type", "operator"] },
+      "Usage: fabric availability list [--gpu-type <type>] [--facility <name>] [--operator <name>] [--json]",
+    );
+    const listings = await loadAvailabilityListings(context);
+    const filtered = filterAvailabilityListings(listings, options);
+    if (options.json) {
+      writeJson(context.stdout, filtered);
+    } else {
+      writeAvailabilityList(context.stdout, filtered);
+    }
+    return 0;
+  }
+
+  if (subcommand === "show" && id) {
+    const options = parseCommandOptions(
+      rest,
+      { boolean: ["json", "open"] },
+      "Usage: fabric availability show <listing-id> [--open] [--json]",
+    );
+    const listing = await resolveListing(id, context);
+    if (options.json) {
+      writeJson(context.stdout, listing);
+    } else {
+      writeAvailabilityDetail(context.stdout, listing);
+    }
+    if (options.open) {
+      await openFabricPage(context, marketplacePathForListing(listing), {
+        json: false,
+        label: "listing",
+        noOpen: false,
+      });
+    }
+    return 0;
   }
-  const { options } = parseOptions(rest, { boolean: ["json"] });
-  const listings = await cliRequest({
-    authRequired: false,
-    endpoint: computeEndpoint("/marketplace/resale-listings"),
-    env: context.env,
-    fetchImpl: context.fetchImpl,
+
+  throw new Error("Usage: fabric availability list|show");
+}
+
+async function buy(args, context) {
+  const [listingId, ...rest] = args;
+  if (!listingId) {
+    throw new Error("Usage: fabric buy <listing-id> [--no-open] [--json]");
+  }
+  const options = parseCommandOptions(
+    rest,
+    { boolean: ["json", "no-open"] },
+    "Usage: fabric buy <listing-id> [--no-open] [--json]",
+  );
+  const listing = await resolveListing(listingId, context);
+
+  const checkout = await openFabricPage(context, `/checkout?inventory=${encodeURIComponent(listing.id)}`, {
+    json: options.json,
+    label: "checkout",
+    noOpen: options.noOpen,
+    payload: { listing },
   });
-  writeOutput(context.stdout, listings, { json: options.json });
+  if (!options.json) {
+    writeCheckoutOpenResult(context.stdout, checkout, listing.kind === "resale" ? "Resale checkout" : "Checkout");
+  }
   return 0;
 }
 
-async function reserve(args, context) {
-  const [subcommand, ...rest] = args;
-  if (subcommand === "view") {
-    const { options } = parseOptions(rest, { boolean: ["json"] });
-    const query = buildQuery({
-      anchor_date: options.anchorDate,
-      facility: options.facility,
-      gpu_type: options.gpuType,
-      view: options.view,
-    });
-    const payload = await cliRequest({
-      authRequired: false,
-      endpoint: computeEndpoint(`/reserve/view${query}`),
+async function bid(args, context) {
+  const [subcommand = "list", id, ...rest] = args;
+
+  if (subcommand === "list") {
+    const options = parseCommandOptions(
+      [id, ...rest].filter(Boolean),
+      { boolean: ["json"] },
+      "Usage: fabric bid list [--json]",
+    );
+    const bids = await cliRequest({
+      endpoint: computeEndpoint("/tenants/me/bids"),
       env: context.env,
       fetchImpl: context.fetchImpl,
     });
-    writeOutput(context.stdout, payload, { json: options.json });
+    if (options.json) {
+      writeJson(context.stdout, bids);
+    } else {
+      writeBidList(context.stdout, requireArrayPayload(bids, "bids"));
+    }
+    return 0;
+  }
+
+  if (subcommand === "show" && id) {
+    const options = parseCommandOptions(
+      rest,
+      { boolean: ["json", "open"] },
+      "Usage: fabric bid show <bid-id> [--open] [--json]",
+    );
+    const found = await findBid(id, context);
+    if (options.json) {
+      writeJson(context.stdout, found);
+    } else {
+      writeBidDetail(context.stdout, found);
+    }
+    if (options.open) {
+      await openFabricPage(context, `/portfolio/bids/${encodeURIComponent(found.id)}`, {
+        label: "bid",
+        noOpen: false,
+      });
+    }
     return 0;
   }
 
-  if (subcommand === "create") {
-    const { options } = parseOptions(rest);
-    const gpuCount = numberOption(options.gpuCount, "--gpu-count");
-    const minGpuCount = options.minGpuCount ? numberOption(options.minGpuCount, "--min-gpu-count") : gpuCount;
+  if (subcommand === "create" && id) {
+    const options = parseCommandOptions(
+      rest,
+      {
+        boolean: ["json", "no-open"],
+        value: ["bid-price-per-gpu-hour", "end-date", "gpu-count", "min-gpu-count", "price", "start-date"],
+      },
+      "Usage: fabric bid create <listing-id> --gpu-count <n> --min-gpu-count <n> --start-date <yyyy-mm-dd> --end-date <yyyy-mm-dd> --price <usd> [--no-open] [--json]",
+    );
+    if (id.startsWith("resale-")) {
+      throw new Error("Bids can only be placed on primary availability listings, not resale listings.");
+    }
+    const { endDate, startDate } = dateRangeOptions(options);
+    const gpuCount = positiveIntegerOption(options.gpuCount, "--gpu-count");
+    const minGpuCount = optionProvided(options.minGpuCount) ? positiveIntegerOption(options.minGpuCount, "--min-gpu-count") : gpuCount;
+    validateMinGpuCount(minGpuCount, gpuCount);
     const payload = {
-      access_mode: options.accessMode || "vm",
-      await_down_payment: true,
-      deployment_id: requiredOption(options.deploymentId, "--deployment-id"),
-      end_date: requiredOption(options.endDate, "--end-date"),
+      bid_price_per_gpu_hour: bidPriceOption(options),
+      deployment_id: id,
+      end_date: endDate,
       gpu_count: gpuCount,
-      image_id: options.imageId || null,
       min_gpu_count: minGpuCount,
-      price_per_gpu_hour: numberOption(options.price || options.bidPricePerGpuHour, "--price"),
-      start_date: requiredOption(options.startDate, "--start-date"),
+      start_date: startDate,
     };
-    const reservation = await cliRequest({
+    await fetchInventory(id, context);
+    const created = await cliRequest({
       body: payload,
-      endpoint: computeEndpoint("/reservations"),
+      endpoint: computeEndpoint("/tenants/me/bids"),
       env: context.env,
       fetchImpl: context.fetchImpl,
       method: "POST",
     });
-    writeOutput(context.stdout, reservation);
+    const opened = await openFabricPage(context, `/checkout?bid=${encodeURIComponent(created.id)}`, {
+      label: "bid checkout",
+      noOpen: options.noOpen,
+    });
+    if (options.json) {
+      writeJson(context.stdout, { bid: created, opened: opened.opened, url: opened.url });
+    } else {
+      context.stdout.write("Bid created\n");
+      context.stdout.write(`Bid: ${created.id}\n`);
+      writeCheckoutOpenResult(context.stdout, opened, "Bid checkout");
+    }
     return 0;
   }
 
-  throw new Error("Usage: fabric reserve view|create");
-}
-
-async function portfolio(args, context) {
-  const [area, subcommand, ...rest] = args;
-
-  if (area === "reservations") {
-    const { options } = parseOptions([subcommand, ...rest].filter(Boolean), { boolean: ["json"] });
-    const query = buildQuery({ status: options.status });
-    const reservations = await cliRequest({
-      endpoint: computeEndpoint(`/tenants/me/reservations${query}`),
+  if (subcommand === "update" && id) {
+    const options = parseCommandOptions(
+      rest,
+      {
+        boolean: ["json"],
+        value: ["bid-price-per-gpu-hour", "end-date", "gpu-count", "min-gpu-count", "price", "start-date"],
+      },
+      "Usage: fabric bid update <bid-id> --gpu-count <n> --min-gpu-count <n> --start-date <yyyy-mm-dd> --end-date <yyyy-mm-dd> --price <usd>",
+    );
+    const { endDate, startDate } = dateRangeOptions(options);
+    const gpuCount = positiveIntegerOption(options.gpuCount, "--gpu-count");
+    const minGpuCount = positiveIntegerOption(options.minGpuCount, "--min-gpu-count");
+    validateMinGpuCount(minGpuCount, gpuCount);
+    const payload = {
+      bid_price_per_gpu_hour: bidPriceOption(options),
+      end_date: endDate,
+      gpu_count: gpuCount,
+      min_gpu_count: minGpuCount,
+      start_date: startDate,
+    };
+    const updated = await cliRequest({
+      body: payload,
+      endpoint: computeEndpoint(`/tenants/me/bids/${id}`),
       env: context.env,
       fetchImpl: context.fetchImpl,
+      method: "PATCH",
     });
-    writeOutput(context.stdout, reservations, { json: options.json });
+    if (options.json) {
+      writeJson(context.stdout, updated);
+    } else {
+      context.stdout.write("Bid updated.\n");
+      writeBidDetail(context.stdout, updated);
+    }
     return 0;
   }
 
-  if (area === "bids") {
-    const { options } = parseOptions([subcommand, ...rest].filter(Boolean), { boolean: ["json"] });
-    const bids = await cliRequest({
-      endpoint: computeEndpoint("/tenants/me/bids"),
+  if ((subcommand === "withdraw" || subcommand === "delete") && id) {
+    const options = parseCommandOptions(
+      rest,
+      { boolean: ["json"] },
+      "Usage: fabric bid withdraw <bid-id> [--json]",
+    );
+    const response = await cliRequest({
+      endpoint: computeEndpoint(`/tenants/me/bids/${id}`),
       env: context.env,
       fetchImpl: context.fetchImpl,
+      method: "DELETE",
     });
-    writeOutput(context.stdout, bids, { json: options.json });
+    if (options.json) {
+      writeJson(context.stdout, response ?? { ok: true });
+    } else {
+      context.stdout.write(`Bid withdrawn: ${id}\n`);
+    }
     return 0;
   }
 
-  if (area === "bid") {
-    return portfolioBid(subcommand, rest, context);
-  }
-
-  if (area === "reservation") {
-    return portfolioReservation(subcommand, rest, context);
-  }
-
-  throw new Error("Usage: fabric portfolio reservations|bids|bid|reservation");
+  throw new Error("Usage: fabric bid list|show|create|update|withdraw");
 }
 
-async function portfolioBid(action, args, context) {
-  const [bidId, ...rest] = args;
-  if (!action || !bidId) {
-    throw new Error("Usage: fabric portfolio bid update|withdraw <bid-id>");
-  }
+async function reservations(args, context) {
+  const [subcommand = "list", id, ...rest] = args;
 
-  if (action === "withdraw" || action === "delete") {
-    const response = await cliRequest({
-      endpoint: computeEndpoint(`/tenants/me/bids/${bidId}`),
+  if (subcommand === "list") {
+    const options = parseCommandOptions(
+      [id, ...rest].filter(Boolean),
+      { boolean: ["json"], value: ["status"] },
+      "Usage: fabric reservations list [--status <status>] [--json]",
+    );
+    const query = buildQuery({ status: options.status });
+    const rows = await cliRequest({
+      endpoint: computeEndpoint(`/tenants/me/reservations${query}`),
       env: context.env,
       fetchImpl: context.fetchImpl,
-      method: "DELETE",
     });
-    writeOutput(context.stdout, response ?? { ok: true });
+    if (options.json) {
+      writeJson(context.stdout, rows);
+    } else {
+      writeReservationList(context.stdout, requireArrayPayload(rows, "reservations"));
+    }
     return 0;
   }
 
-  if (action === "update") {
-    const { options } = parseOptions(rest);
-    const payload = {
-      bid_price_per_gpu_hour: numberOption(options.price || options.bidPricePerGpuHour, "--price"),
-      end_date: requiredOption(options.endDate, "--end-date"),
-      gpu_count: numberOption(options.gpuCount, "--gpu-count"),
-      min_gpu_count: numberOption(options.minGpuCount, "--min-gpu-count"),
-      start_date: requiredOption(options.startDate, "--start-date"),
-    };
-    const bid = await cliRequest({
-      body: payload,
-      endpoint: computeEndpoint(`/tenants/me/bids/${bidId}`),
-      env: context.env,
-      fetchImpl: context.fetchImpl,
-      method: "PATCH",
+  if (subcommand === "show" && id) {
+    const options = parseCommandOptions(
+      rest,
+      { boolean: ["json", "open"] },
+      "Usage: fabric reservations show <reservation-id> [--open] [--json]",
+    );
+    const found = await findReservation(id, context);
+    if (options.json) {
+      writeJson(context.stdout, found);
+    } else {
+      writeReservationDetail(context.stdout, found);
+    }
+    if (options.open) {
+      await openFabricPage(context, `/portfolio/${encodeURIComponent(found.id)}`, {
+        label: "reservation",
+        noOpen: false,
+      });
+    }
+    return 0;
+  }
+
+  if (subcommand === "checkout" && id) {
+    const options = parseCommandOptions(
+      rest,
+      { boolean: ["json", "no-open"] },
+      "Usage: fabric reservations checkout <reservation-id> [--no-open] [--json]",
+    );
+    const found = await findReservation(id, context);
+    if (found.status !== "pending_payment") {
+      throw new Error("This reservation is not awaiting checkout.");
+    }
+    const opened = await openFabricPage(context, `/checkout?reservation=${encodeURIComponent(id)}`, {
+      json: options.json,
+      label: "checkout",
+      noOpen: options.noOpen,
+      payload: { reservation: found },
     });
-    writeOutput(context.stdout, bid);
+    if (!options.json) {
+      writeCheckoutOpenResult(context.stdout, opened, "Reservation checkout");
+    }
     return 0;
   }
 
-  throw new Error(`Unsupported portfolio bid action: ${action}`);
+  throw new Error("Usage: fabric reservations list|show|checkout");
 }
 
-async function portfolioReservation(action, args, context) {
-  const [reservationId, ...rest] = args;
-  if (!action || !reservationId) {
-    throw new Error("Usage: fabric portfolio reservation access-mode|list|ask-price|delist|buy <reservation-id>");
+async function access(args, context) {
+  const [subcommand, reservationId, ...rest] = args;
+  if (!subcommand || !reservationId) {
+    throw new Error("Usage: fabric access show|activate|push-keys <reservation-id>");
   }
 
-  const { options } = parseOptions(rest);
-  const basePath = `/tenants/me/reservations/${reservationId}`;
+  if (subcommand === "show") {
+    const options = parseCommandOptions(
+      rest,
+      { boolean: ["json"] },
+      "Usage: fabric access show <reservation-id> [--json]",
+    );
+    const payload = await getReservationMachines(reservationId, context);
+    if (options.json) {
+      writeJson(context.stdout, payload);
+    } else {
+      writeAccessDetail(context.stdout, payload);
+    }
+    return 0;
+  }
 
-  if (action === "access-mode") {
-    const payload = {
-      access_mode: requiredOption(options.mode, "--mode"),
-      image_id: options.imageId || null,
+  if (subcommand === "activate") {
+    const options = parseCommandOptions(
+      rest,
+      {
+        boolean: ["json", "no-open"],
+        value: ["machine-count", "request-id", "ssh-key-id", "tenant-username", "username"],
+      },
+      "Usage: fabric access activate <reservation-id> --ssh-key-id <id> [--username <name>] [--no-open] [--json]",
+    );
+    const sshKeyIds = requiredArrayOption(options.sshKeyId, "--ssh-key-id");
+    const launchPayload = {
+      image_id: null,
+      machine_count: optionProvided(options.machineCount) ? positiveIntegerOption(options.machineCount, "--machine-count") : 1,
+      machine_type: null,
+      request_id: options.requestId || null,
+      ssh_key_ids: sshKeyIds,
+      tenant_username: options.username || options.tenantUsername || null,
+      zone: null,
     };
-    const access = await cliRequest({
-      body: payload,
-      endpoint: computeEndpoint(`${basePath}/access-mode`),
+    const accessMode = await cliRequest({
+      body: { access_mode: "bare-metal", image_id: null },
+      endpoint: computeEndpoint(`/tenants/me/reservations/${reservationId}/access-mode`),
       env: context.env,
       fetchImpl: context.fetchImpl,
       method: "POST",
     });
-    writeOutput(context.stdout, access);
-    return 0;
-  }
-
-  if (action === "list") {
-    const reservation = await cliRequest({
-      body: { ask_price_per_gpu_hour: numberOption(options.askPrice, "--ask-price") },
-      endpoint: computeEndpoint(`${basePath}/list`),
+    const launch = await cliRequest({
+      body: launchPayload,
+      endpoint: computeEndpoint(`/standalone-vms/reservations/${reservationId}/launch`),
       env: context.env,
       fetchImpl: context.fetchImpl,
       method: "POST",
     });
-    writeOutput(context.stdout, reservation);
+    const opened = await openFabricPage(context, `/portfolio/${encodeURIComponent(reservationId)}`, {
+      label: "reservation",
+      noOpen: options.noOpen,
+    });
+    if (options.json) {
+      writeJson(context.stdout, { access: accessMode, launch, opened: opened.opened, url: opened.url });
+    } else {
+      context.stdout.write("Bare-metal access activation queued\n");
+      writeAccessLaunchSummary(context.stdout, launch);
+      writeCheckoutOpenResult(context.stdout, opened, "Reservation page");
+    }
+    return 0;
+  }
+
+  if (subcommand === "push-keys") {
+    const options = parseCommandOptions(
+      rest,
+      { boolean: ["json"], value: ["request-id", "ssh-key-id"] },
+      "Usage: fabric access push-keys <reservation-id> --ssh-key-id <id> [--json]",
+    );
+    const sshKeyIds = requiredArrayOption(options.sshKeyId, "--ssh-key-id");
+    const machinesPayload = await getReservationMachines(reservationId, context);
+    const machines = activeMachines(machinesPayload.machines || []);
+    if (!machines.length) {
+      throw new Error("No active bare-metal machines were found for this reservation.");
+    }
+    const pushed = [];
+    for (const machine of machines) {
+      const response = await cliRequest({
+        body: {
+          request_id: options.requestId || `cli-push-keys:${machine.id}:${Date.now()}`,
+          ssh_key_ids: sshKeyIds,
+        },
+        endpoint: computeEndpoint(`/standalone-vms/${machine.id}/push-keys`),
+        env: context.env,
+        fetchImpl: context.fetchImpl,
+        method: "POST",
+      });
+      pushed.push(response);
+    }
+    if (options.json) {
+      writeJson(context.stdout, { machines: pushed });
+    } else {
+      context.stdout.write(`SSH key update queued for ${pushed.length} machine${pushed.length === 1 ? "" : "s"}.\n`);
+    }
+    return 0;
+  }
+
+  throw new Error(`Unsupported access action: ${subcommand}`);
+}
+
+async function resale(args, context) {
+  const [subcommand = "browse", reservationId, ...rest] = args;
+
+  if (subcommand === "browse") {
+    const options = parseCommandOptions(
+      [reservationId, ...rest].filter(Boolean),
+      { boolean: ["json"] },
+      "Usage: fabric resale browse [--json]",
+    );
+    const listings = (await loadAvailabilityListings(context)).filter((listing) => listing.kind === "resale");
+    if (options.json) {
+      writeJson(context.stdout, listings);
+    } else if (!listings.length) {
+      context.stdout.write("No resale listings found.\n");
+    } else {
+      writeAvailabilityList(context.stdout, listings);
+    }
     return 0;
   }
 
-  if (action === "ask-price") {
+  if (subcommand === "list" && reservationId) {
+    const options = parseCommandOptions(
+      rest,
+      { boolean: ["json", "no-open"], value: ["ask-price"] },
+      "Usage: fabric resale list <reservation-id> --ask-price <usd> [--no-open] [--json]",
+    );
     const reservation = await cliRequest({
-      body: { ask_price_per_gpu_hour: numberOption(options.askPrice, "--ask-price") },
-      endpoint: computeEndpoint(`${basePath}/ask-price`),
+      body: { ask_price_per_gpu_hour: positiveNumberOption(options.askPrice, "--ask-price") },
+      endpoint: computeEndpoint(`/tenants/me/reservations/${reservationId}/list`),
       env: context.env,
       fetchImpl: context.fetchImpl,
-      method: "PATCH",
+      method: "POST",
+    });
+    const opened = await openFabricPage(context, `/marketplace/resale-${encodeURIComponent(reservationId)}`, {
+      label: "resale listing",
+      noOpen: options.noOpen,
     });
-    writeOutput(context.stdout, reservation);
+    writeMutationWithOpen(context.stdout, reservation, opened, options, "Resale listing");
     return 0;
   }
 
-  if (action === "delist") {
+  if (subcommand === "update" && reservationId) {
+    const options = parseCommandOptions(
+      rest,
+      { boolean: ["json", "no-open"], value: ["ask-price"] },
+      "Usage: fabric resale update <reservation-id> --ask-price <usd> [--no-open] [--json]",
+    );
     const reservation = await cliRequest({
-      endpoint: computeEndpoint(`${basePath}/delist`),
+      body: { ask_price_per_gpu_hour: positiveNumberOption(options.askPrice, "--ask-price") },
+      endpoint: computeEndpoint(`/tenants/me/reservations/${reservationId}/ask-price`),
       env: context.env,
       fetchImpl: context.fetchImpl,
-      method: "POST",
+      method: "PATCH",
     });
-    writeOutput(context.stdout, reservation);
+    const opened = await openFabricPage(context, `/marketplace/resale-${encodeURIComponent(reservationId)}`, {
+      label: "resale listing",
+      noOpen: options.noOpen,
+    });
+    writeMutationWithOpen(context.stdout, reservation, opened, options, "Resale listing");
     return 0;
   }
 
-  if (action === "buy") {
-    const transaction = await cliRequest({
-      body: { buyer_tenant_id: "me" },
-      endpoint: computeEndpoint(`${basePath}/buy`),
+  if (subcommand === "delist" && reservationId) {
+    const options = parseCommandOptions(
+      rest,
+      { boolean: ["json", "no-open"] },
+      "Usage: fabric resale delist <reservation-id> [--no-open] [--json]",
+    );
+    const reservation = await cliRequest({
+      endpoint: computeEndpoint(`/tenants/me/reservations/${reservationId}/delist`),
       env: context.env,
       fetchImpl: context.fetchImpl,
       method: "POST",
     });
-    writeOutput(context.stdout, transaction);
+    const opened = await openFabricPage(context, `/portfolio/${encodeURIComponent(reservationId)}`, {
+      label: "reservation",
+      noOpen: options.noOpen,
+    });
+    writeMutationWithOpen(context.stdout, reservation, opened, options, "Reservation");
     return 0;
   }
 
-  throw new Error(`Unsupported portfolio reservation action: ${action}`);
+  throw new Error("Usage: fabric resale browse|list|update|delist");
 }
 
-async function machines(args, context) {
-  const [subcommand, id, action, ...rest] = args;
-  if (subcommand === "list" && id) {
-    const { options } = parseOptions([action, ...rest].filter(Boolean), { boolean: ["json"] });
-    const machinesPayload = await cliRequest({
-      endpoint: computeEndpoint(`/standalone-vms/reservations/${id}/machines`),
-      env: context.env,
-      fetchImpl: context.fetchImpl,
+async function billing(args, context) {
+  const [subcommand = "open", ...rest] = args;
+  if (subcommand === "open") {
+    const options = parseCommandOptions(
+      rest,
+      { boolean: ["json", "no-open"] },
+      "Usage: fabric billing open [--no-open] [--json]",
+    );
+    const opened = await openFabricPage(context, "/account?tab=billing", {
+      json: options.json,
+      label: "billing",
+      noOpen: options.noOpen,
     });
-    writeOutput(context.stdout, machinesPayload, { json: options.json });
+    if (!options.json) {
+      writeCheckoutOpenResult(context.stdout, opened, "Billing");
+    }
     return 0;
   }
+  throw new Error("Usage: fabric billing open [--no-open] [--json]");
+}
 
-  if (subcommand === "get" && id) {
-    const { options } = parseOptions([action, ...rest].filter(Boolean), { boolean: ["json"] });
-    const machine = await cliRequest({
-      endpoint: computeEndpoint(`/standalone-vms/${id}`),
+async function sshKeys(args, context) {
+  const [subcommand, id, ...rest] = args;
+  if (subcommand === "list") {
+    const options = parseCommandOptions(
+      [id, ...rest].filter(Boolean),
+      { boolean: ["json"] },
+      "Usage: fabric ssh-keys list [--json]",
+    );
+    const keys = await cliRequest({
+      endpoint: computeEndpoint("/standalone-vms/tenants/me/ssh-keys"),
       env: context.env,
       fetchImpl: context.fetchImpl,
     });
-    writeOutput(context.stdout, machine, { json: options.json });
+    if (options.json) {
+      writeJson(context.stdout, keys);
+    } else {
+      writeSshKeyList(context.stdout, sshKeysFromPayload(keys));
+    }
     return 0;
   }
 
-  if (subcommand === "cost" && id) {
-    const { options } = parseOptions([action, ...rest].filter(Boolean), { boolean: ["json"] });
-    const cost = await cliRequest({
-      endpoint: computeEndpoint(`/standalone-vms/reservations/${id}/cost`),
+  if (subcommand === "add") {
+    const options = parseCommandOptions(
+      [id, ...rest].filter(Boolean),
+      { boolean: ["json"], value: ["label", "public-key", "public-key-file"] },
+      "Usage: fabric ssh-keys add --public-key <key> [--label <label>] [--json]",
+    );
+    const publicKey = options.publicKeyFile
+      ? (await readFile(options.publicKeyFile, "utf8")).trim()
+      : requiredOption(options.publicKey, "--public-key");
+    const key = await cliRequest({
+      body: {
+        label: options.label || null,
+        public_key: publicKey,
+      },
+      endpoint: computeEndpoint("/standalone-vms/tenants/me/ssh-keys"),
       env: context.env,
       fetchImpl: context.fetchImpl,
+      method: "POST",
     });
-    writeOutput(context.stdout, cost, { json: options.json });
+    if (options.json) {
+      writeJson(context.stdout, key);
+    } else {
+      context.stdout.write("SSH key added.\n");
+      if (key?.id) {
+        context.stdout.write(`Key: ${key.id}\n`);
+      }
+    }
     return 0;
   }
 
-  if (subcommand === "launch" && id) {
-    const { options } = parseOptions([action, ...rest].filter(Boolean));
-    const payload = {
-      image_id: options.imageId || null,
-      machine_count: options.machineCount ? numberOption(options.machineCount, "--machine-count") : 1,
-      machine_type: options.machineType || null,
-      request_id: options.requestId || null,
-      ssh_key_ids: arrayOption(options.sshKeyId),
-      tenant_username: options.username || options.tenantUsername || null,
-      zone: options.zone || null,
-    };
+  if ((subcommand === "delete" || subcommand === "remove") && id) {
+    const options = parseCommandOptions(
+      rest,
+      { boolean: ["json"] },
+      "Usage: fabric ssh-keys delete <key-id> [--json]",
+    );
     const response = await cliRequest({
-      body: payload,
-      endpoint: computeEndpoint(`/standalone-vms/reservations/${id}/launch`),
+      endpoint: computeEndpoint(`/standalone-vms/tenants/me/ssh-keys/${id}`),
       env: context.env,
       fetchImpl: context.fetchImpl,
-      method: "POST",
+      method: "DELETE",
     });
-    writeOutput(context.stdout, response);
+    if (options.json) {
+      writeJson(context.stdout, response);
+    } else {
+      context.stdout.write(`SSH key deleted: ${id}\n`);
+    }
     return 0;
   }
 
-  if (subcommand === "switch-access" && id) {
-    const { options } = parseOptions([action, ...rest].filter(Boolean));
-    const payload = {
-      access_mode: requiredOption(options.mode, "--mode"),
-      image_id: options.imageId || null,
-      request_id: options.requestId || null,
-      ssh_key_ids: arrayOption(options.sshKeyId),
-      tenant_username: options.username || options.tenantUsername || null,
-    };
-    const response = await cliRequest({
-      body: payload,
-      endpoint: computeEndpoint(`/standalone-vms/reservations/${id}/switch-access`),
-      env: context.env,
-      fetchImpl: context.fetchImpl,
-      method: "POST",
-    });
-    writeOutput(context.stdout, response);
-    return 0;
+  throw new Error("Usage: fabric ssh-keys list|add|delete");
+}
+
+async function loadAvailabilityListings(context) {
+  const [inventoryRecords, resaleReservations] = await Promise.all([
+    fetchInventoryList(context),
+    fetchResaleListings(context),
+  ]);
+  const inventoryById = new Map(inventoryRecords.map((record) => [record.id, record]));
+  const primaryListings = inventoryRecords
+    .filter((record) => isTermEndDateActive(record.available_to))
+    .map(normalizeInventoryListing);
+  const resaleListings = resaleReservations
+    .filter((reservation) => reservation.is_marketplace_listed !== false)
+    .filter((reservation) => reservation.ask_price_per_gpu_hour !== undefined && reservation.ask_price_per_gpu_hour !== null)
+    .filter((reservation) => isTermEndDateActive(reservation.end_date))
+    .map((reservation) => normalizeResaleListing(reservation, inventoryById.get(reservation.deployment_id) ?? null));
+  return [...primaryListings, ...resaleListings];
+}
+
+async function fetchInventoryList(context) {
+  const payload = await cliRequest({
+    authRequired: false,
+    endpoint: computeEndpoint("/inventory"),
+    env: context.env,
+    fetchImpl: context.fetchImpl,
+  });
+  return requireArrayPayload(payload, "inventory");
+}
+
+async function fetchInventory(id, context) {
+  return await cliRequest({
+    authRequired: false,
+    endpoint: computeEndpoint(`/inventory/${encodeURIComponent(id)}`),
+    env: context.env,
+    fetchImpl: context.fetchImpl,
+  });
+}
+
+async function fetchResaleListings(context) {
+  const payload = await cliRequest({
+    authRequired: false,
+    endpoint: computeEndpoint("/marketplace/resale-listings"),
+    env: context.env,
+    fetchImpl: context.fetchImpl,
+  });
+  return requireArrayPayload(payload, "resale listings");
+}
+
+function requireArrayPayload(payload, label) {
+  if (!Array.isArray(payload)) {
+    throw new Error(`Fabric returned invalid ${label} data.`);
+  }
+  return payload;
+}
+
+function sshKeysFromPayload(payload) {
+  if (Array.isArray(payload)) {
+    return payload;
+  }
+  if (Array.isArray(payload?.ssh_keys)) {
+    return payload.ssh_keys;
+  }
+  if (Array.isArray(payload?.keys)) {
+    return payload.keys;
+  }
+  throw new Error("Fabric returned invalid SSH keys data.");
+}
+
+function normalizeInventoryListing(record) {
+  return {
+    id: record.id,
+    kind: "inventory",
+    source: "primary",
+    gpu_type: record.gpu_type ?? "GPU",
+    gpu_count: record.gpu_count ?? null,
+    operator: record.site_operator ?? record.operator ?? "Unknown operator",
+    facility: record.site_nickname ?? record.facility ?? record.site ?? "Unknown facility",
+    location: record.location ?? record.region ?? null,
+    network: record.fabric_type ?? record.network_hardware ?? record.internet ?? null,
+    start_date: record.available_from ?? null,
+    end_date: record.available_to ?? null,
+    price_per_gpu_hour: DEFAULT_BUY_NOW_USD_PER_GPU_HOUR,
+    checkout_url: `/checkout?inventory=${encodeURIComponent(record.id)}`,
+    marketplace_url: `/marketplace/${encodeURIComponent(record.id)}`,
+    inventory: record,
+  };
+}
+
+function normalizeResaleListing(reservation, inventory) {
+  const id = `resale-${reservation.id}`;
+  return {
+    id,
+    kind: "resale",
+    source: "resale",
+    reservation_id: reservation.id,
+    seller_tenant_id: reservation.tenant_id ?? null,
+    gpu_type: inventory?.gpu_type ?? reservation.gpu_type ?? "GPU",
+    gpu_count: reservation.gpu_count ?? null,
+    operator: inventory?.site_operator ?? "Resale",
+    facility: inventory?.site_nickname ?? "Resale",
+    location: inventory?.location ?? inventory?.region ?? null,
+    network: inventory?.fabric_type ?? inventory?.network_hardware ?? inventory?.internet ?? null,
+    start_date: reservation.start_date ?? null,
+    end_date: reservation.end_date ?? null,
+    price_per_gpu_hour: reservation.ask_price_per_gpu_hour ?? null,
+    checkout_url: `/checkout?inventory=${encodeURIComponent(id)}`,
+    marketplace_url: `/marketplace/${encodeURIComponent(id)}`,
+    inventory,
+    reservation,
+  };
+}
+
+function isTermEndDateActive(endDate, today = new Date()) {
+  if (!endDate) {
+    return true;
+  }
+  const parsed = parseDateOnly(endDate);
+  if (!parsed) {
+    return true;
+  }
+  const todayUtc = Date.UTC(today.getUTCFullYear(), today.getUTCMonth(), today.getUTCDate());
+  return parsed.getTime() >= todayUtc;
+}
+
+function parseDateOnly(value) {
+  if (typeof value !== "string" || !value.trim()) {
+    return null;
+  }
+  const match = value.trim().match(/^(\d{4})-(\d{2})-(\d{2})/);
+  if (!match) {
+    return null;
+  }
+  const parsed = new Date(Date.UTC(Number(match[1]), Number(match[2]) - 1, Number(match[3])));
+  return Number.isNaN(parsed.getTime()) ? null : parsed;
+}
+
+function filterAvailabilityListings(listings, options) {
+  return listings.filter((listing) => {
+    return (
+      textMatches(listing.gpu_type, options.gpuType) &&
+      textMatches(listing.facility, options.facility) &&
+      textMatches(listing.operator, options.operator)
+    );
+  });
+}
+
+function textMatches(value, filter) {
+  if (!filter) {
+    return true;
   }
+  return String(value ?? "").toLowerCase().includes(String(filter).toLowerCase());
+}
 
-  if (subcommand === "action" && id && action) {
-    if (!["extend", "start", "stop", "teardown"].includes(action)) {
-      throw new Error("Machine action must be start, stop, extend, or teardown.");
+async function resolveListing(listingId, context) {
+  if (listingId.startsWith("resale-")) {
+    const reservationId = listingId.replace(/^resale-/, "");
+    const listings = await loadAvailabilityListings(context);
+    const listing = listings.find(
+      (candidate) => candidate.id === listingId || candidate.reservation_id === reservationId,
+    );
+    if (!listing) {
+      throw new Error(`Listing not found: ${listingId}`);
     }
-    const { options } = parseOptions(rest);
-    const body = action === "extend"
-      ? { extend_by_minutes: numberOption(options.extendByMinutes || 60, "--extend-by-minutes") }
-      : undefined;
-    const response = await cliRequest({
-      body,
-      endpoint: computeEndpoint(`/standalone-vms/${id}/${action}`),
-      env: context.env,
-      fetchImpl: context.fetchImpl,
-      method: "POST",
-    });
-    writeOutput(context.stdout, response);
-    return 0;
+    return listing;
   }
 
-  if (subcommand === "push-keys" && id) {
-    const { options } = parseOptions([action, ...rest].filter(Boolean));
-    const payload = {
-      request_id: options.requestId || null,
-      ssh_key_ids: requiredArrayOption(options.sshKeyId, "--ssh-key-id"),
-    };
-    const response = await cliRequest({
-      body: payload,
-      endpoint: computeEndpoint(`/standalone-vms/${id}/push-keys`),
-      env: context.env,
-      fetchImpl: context.fetchImpl,
-      method: "POST",
-    });
-    writeOutput(context.stdout, response);
-    return 0;
+  const inventory = await fetchInventory(listingId, context);
+  if (!isTermEndDateActive(inventory.available_to)) {
+    throw new Error(`Listing is no longer available: ${listingId}`);
   }
+  return normalizeInventoryListing(inventory);
+}
 
-  if (subcommand === "revoke" && id) {
-    const { options } = parseOptions([action, ...rest].filter(Boolean));
-    const response = await cliRequest({
-      body: { request_id: options.requestId || null },
-      endpoint: computeEndpoint(`/standalone-vms/${id}/revoke`),
-      env: context.env,
-      fetchImpl: context.fetchImpl,
-      method: "POST",
-    });
-    writeOutput(context.stdout, response);
-    return 0;
+function marketplacePathForListing(listing) {
+  return listing.marketplace_url || `/marketplace/${encodeURIComponent(listing.id)}`;
+}
+
+async function openFabricPage(context, pathOrUrl, { json = false, label = "page", noOpen = false, payload = {} } = {}) {
+  const url = await resolveFabricUrl(context, pathOrUrl);
+  const opened = noOpen ? false : await context.openBrowserImpl(url);
+  const result = { ...payload, label, opened, url };
+  if (json) {
+    writeJson(context.stdout, result);
   }
+  return result;
+}
 
-  throw new Error("Usage: fabric machines list|get|cost|launch|switch-access|action|push-keys|revoke");
+async function resolveFabricUrl(context, pathOrUrl) {
+  if (/^https?:\/\//i.test(pathOrUrl)) {
+    return pathOrUrl;
+  }
+  const baseUrl = await resolveFabricBaseUrl(context);
+  return new URL(pathOrUrl, `${baseUrl}/`).toString();
 }
 
-async function sshKeys(args, context) {
-  const [subcommand, id, ...rest] = args;
-  if (subcommand === "list") {
-    const keys = await cliRequest({
-      endpoint: computeEndpoint("/standalone-vms/tenants/me/ssh-keys"),
-      env: context.env,
-      fetchImpl: context.fetchImpl,
-    });
-    writeOutput(context.stdout, keys);
-    return 0;
+async function resolveFabricBaseUrl(context) {
+  const env = context.env ?? {};
+  const configured = env.ORNN_AUTH_BASE_URL?.trim() || env.BETTER_AUTH_URL?.trim();
+  if (configured) {
+    return configured.replace(/\/+$/, "");
   }
 
-  if (subcommand === "add") {
-    const { options } = parseOptions([id, ...rest].filter(Boolean));
-    const publicKey = options.publicKeyFile
-      ? (await readFile(options.publicKeyFile, "utf8")).trim()
-      : requiredOption(options.publicKey, "--public-key");
-    const key = await cliRequest({
-      body: {
-        label: options.label || null,
-        public_key: publicKey,
-      },
-      endpoint: computeEndpoint("/standalone-vms/tenants/me/ssh-keys"),
-      env: context.env,
-      fetchImpl: context.fetchImpl,
-      method: "POST",
-    });
-    writeOutput(context.stdout, key);
-    return 0;
+  try {
+    const session = await loadAuthSession({ env });
+    if (session?.authBaseUrl?.trim()) {
+      return session.authBaseUrl.trim().replace(/\/+$/, "");
+    }
+  } catch {
+    // Browser handoff URLs should still work for unauthenticated flows.
   }
 
-  if ((subcommand === "delete" || subcommand === "remove") && id) {
-    const response = await cliRequest({
-      endpoint: computeEndpoint(`/standalone-vms/tenants/me/ssh-keys/${id}`),
-      env: context.env,
-      fetchImpl: context.fetchImpl,
-      method: "DELETE",
-    });
-    writeOutput(context.stdout, response);
-    return 0;
+  return resolveAuthBaseUrl({ env });
+}
+
+function writeCheckoutOpenResult(stdout, result, label) {
+  stdout.write(`${label} URL: ${result.url}\n`);
+  if (result.opened) {
+    stdout.write(`Opened ${label.toLowerCase()} in your browser.\n`);
+  } else {
+    stdout.write("Open the URL above in your browser.\n");
   }
+}
 
-  throw new Error("Usage: fabric ssh-keys list|add|delete");
+function writeAvailabilityList(stdout, listings) {
+  if (!listings.length) {
+    stdout.write("No available bare-metal compute found.\n");
+    return;
+  }
+  stdout.write("Available bare-metal compute:\n");
+  for (const listing of listings) {
+    stdout.write(`- ${listing.id} [${listing.source}] ${formatGpuSummary(listing)}`);
+    stdout.write(` at ${listing.operator} / ${listing.facility}`);
+    stdout.write(`, ${formatDateRange(listing.start_date, listing.end_date)}`);
+    if (listing.price_per_gpu_hour !== null && listing.price_per_gpu_hour !== undefined) {
+      stdout.write(`, ${formatUsd(listing.price_per_gpu_hour)}/GPU-hr`);
+    }
+    stdout.write("\n");
+  }
 }
 
-async function images(args, context) {
-  const [subcommand, id, ...rest] = args;
-  if (subcommand === "list") {
-    const { options } = parseOptions([id, ...rest].filter(Boolean), { boolean: ["json"] });
-    const imagesPayload = await cliRequest({
-      endpoint: computeEndpoint("/account/images"),
-      env: context.env,
-      fetchImpl: context.fetchImpl,
-    });
-    writeOutput(context.stdout, imagesPayload, { json: options.json });
-    return 0;
+function writeAvailabilityDetail(stdout, listing) {
+  stdout.write(`${listing.id}\n`);
+  stdout.write(`Type: ${listing.source}\n`);
+  stdout.write(`Compute: ${formatGpuSummary(listing)}\n`);
+  stdout.write(`Operator: ${listing.operator}\n`);
+  stdout.write(`Facility: ${listing.facility}\n`);
+  if (listing.location) {
+    stdout.write(`Location: ${listing.location}\n`);
+  }
+  if (listing.network) {
+    stdout.write(`Network: ${listing.network}\n`);
+  }
+  stdout.write(`Term: ${formatDateRange(listing.start_date, listing.end_date)}\n`);
+  if (listing.price_per_gpu_hour !== null && listing.price_per_gpu_hour !== undefined) {
+    stdout.write(`Price: ${formatUsd(listing.price_per_gpu_hour)}/GPU-hr\n`);
   }
+  stdout.write(`Checkout: ${listing.checkout_url}\n`);
+  stdout.write(`Marketplace: ${listing.marketplace_url}\n`);
+}
 
-  if (subcommand === "upload") {
-    const { options } = parseOptions([id, ...rest].filter(Boolean), {
-      boolean: ["json", "operator-approved-large-image"],
-    });
-    const payload = await buildImageUploadPayload(options);
-    const image = await cliRequest({
-      body: payload,
-      endpoint: computeEndpoint("/vm-images"),
-      env: context.env,
-      fetchImpl: context.fetchImpl,
-      method: "POST",
-    });
-    writeOutput(context.stdout, image, { json: options.json });
-    return 0;
+function formatGpuSummary(record) {
+  const count = record.gpu_count ?? "?";
+  const type = record.gpu_type ?? "GPU";
+  return `${count}x ${type}`;
+}
+
+function formatDateRange(startDate, endDate) {
+  return `${startDate || "TBD"} to ${endDate || "TBD"}`;
+}
+
+function formatUsd(value) {
+  const numeric = Number(value);
+  if (!Number.isFinite(numeric)) {
+    return String(value);
   }
+  return `$${numeric.toFixed(2)}`;
+}
 
-  if ((subcommand === "revoke" || subcommand === "delete") && id) {
-    const { options } = parseOptions(rest, { boolean: ["json"] });
-    const response = await cliRequest({
-      endpoint: computeEndpoint(`/vm-images/${id}/revoke`),
-      env: context.env,
-      fetchImpl: context.fetchImpl,
-      method: "POST",
-    });
-    writeOutput(context.stdout, response, { json: options.json });
-    return 0;
+async function findBid(id, context) {
+  const bids = await cliRequest({
+    endpoint: computeEndpoint("/tenants/me/bids"),
+    env: context.env,
+    fetchImpl: context.fetchImpl,
+  });
+  const found = requireArrayPayload(bids, "bids").find((candidate) => candidate.id === id);
+  if (!found) {
+    throw new Error(`Bid not found: ${id}`);
+  }
+  return found;
+}
+
+function writeBidList(stdout, bids) {
+  if (!bids.length) {
+    stdout.write("No bids found.\n");
+    return;
+  }
+  stdout.write("Bids:\n");
+  for (const bid of bids) {
+    stdout.write(`- ${bid.id} ${bid.status || "unknown"} ${bid.gpu_count ?? "?"} GPUs`);
+    stdout.write(` ${bid.start_date || "TBD"} to ${bid.end_date || "TBD"}`);
+    if (bid.bid_price_per_gpu_hour !== undefined && bid.bid_price_per_gpu_hour !== null) {
+      stdout.write(` at ${formatUsd(bid.bid_price_per_gpu_hour)}/GPU-hr`);
+    }
+    stdout.write("\n");
+  }
+}
+
+function writeBidDetail(stdout, bid) {
+  stdout.write(`${bid.id}\n`);
+  stdout.write(`Status: ${bid.status || "unknown"}\n`);
+  stdout.write(`Deployment: ${bid.deployment_id || "unknown"}\n`);
+  stdout.write(`GPU count: ${bid.gpu_count ?? "unknown"}\n`);
+  stdout.write(`Minimum GPU count: ${bid.min_gpu_count ?? bid.gpu_count ?? "unknown"}\n`);
+  stdout.write(`Term: ${formatDateRange(bid.start_date, bid.end_date)}\n`);
+  if (bid.bid_price_per_gpu_hour !== undefined && bid.bid_price_per_gpu_hour !== null) {
+    stdout.write(`Price: ${formatUsd(bid.bid_price_per_gpu_hour)}/GPU-hr\n`);
+  }
+  stdout.write(`Checkout: /checkout?bid=${encodeURIComponent(bid.id)}\n`);
+}
+
+async function findReservation(id, context) {
+  const reservations = await cliRequest({
+    endpoint: computeEndpoint("/tenants/me/reservations"),
+    env: context.env,
+    fetchImpl: context.fetchImpl,
+  });
+  const found = requireArrayPayload(reservations, "reservations").find((candidate) => candidate.id === id);
+  if (!found) {
+    throw new Error(`Reservation not found: ${id}`);
+  }
+  return found;
+}
+
+function writeReservationList(stdout, reservations) {
+  if (!reservations.length) {
+    stdout.write("No reservations found.\n");
+    return;
+  }
+  stdout.write("Reservations:\n");
+  for (const reservation of reservations) {
+    stdout.write(`- ${reservation.id} ${reservation.status || "unknown"} ${reservation.gpu_count ?? "?"} GPUs`);
+    stdout.write(` ${reservation.start_date || "TBD"} to ${reservation.end_date || "TBD"}`);
+    if (reservation.price_per_gpu_hour !== undefined && reservation.price_per_gpu_hour !== null) {
+      stdout.write(` at ${formatUsd(reservation.price_per_gpu_hour)}/GPU-hr`);
+    }
+    stdout.write("\n");
+  }
+}
+
+function writeReservationDetail(stdout, reservation) {
+  stdout.write(`${reservation.id}\n`);
+  stdout.write(`Status: ${reservation.status || "unknown"}\n`);
+  stdout.write(`Deployment: ${reservation.deployment_id || "unknown"}\n`);
+  stdout.write(`GPU count: ${reservation.gpu_count ?? "unknown"}\n`);
+  stdout.write(`Term: ${formatDateRange(reservation.start_date, reservation.end_date)}\n`);
+  if (reservation.price_per_gpu_hour !== undefined && reservation.price_per_gpu_hour !== null) {
+    stdout.write(`Price: ${formatUsd(reservation.price_per_gpu_hour)}/GPU-hr\n`);
+  }
+  if (reservation.is_marketplace_listed) {
+    stdout.write(`Resale listing: /marketplace/resale-${encodeURIComponent(reservation.id)}\n`);
+  }
+  if (reservation.status === "pending_payment") {
+    stdout.write(`Checkout: /checkout?reservation=${encodeURIComponent(reservation.id)}\n`);
+  }
+}
+
+async function getReservationMachines(reservationId, context) {
+  const payload = await cliRequest({
+    endpoint: computeEndpoint(`/standalone-vms/reservations/${reservationId}/machines`),
+    env: context.env,
+    fetchImpl: context.fetchImpl,
+  });
+  return Array.isArray(payload) ? { machines: payload } : payload;
+}
+
+function writeAccessDetail(stdout, payload = {}) {
+  const machines = Array.isArray(payload.machines) ? payload.machines : [];
+  if (!machines.length) {
+    stdout.write("No bare-metal access machines found for this reservation.\n");
+    return;
+  }
+  stdout.write("Bare-metal access:\n");
+  for (const machine of machines) {
+    stdout.write(`- ${machineId(machine)} ${machineState(machine)}\n`);
+    const username = machineUsername(machine);
+    const host = machineHost(machine);
+    const port = machinePort(machine);
+    stdout.write(`  Ready: ${host ? "yes" : "no"}\n`);
+    if (username) {
+      stdout.write(`  Username: ${username}\n`);
+    }
+    if (host) {
+      stdout.write(`  Host: ${host}\n`);
+      stdout.write(`  Port: ${port}\n`);
+    }
+    const sshCommand = sshCommandForMachine(machine);
+    if (sshCommand) {
+      stdout.write(`  SSH: ${sshCommand}\n`);
+    }
   }
+}
 
-  throw new Error("Usage: fabric images list|upload|revoke");
+function writeAccessLaunchSummary(stdout, launch = {}) {
+  const machines = Array.isArray(launch.machines) ? launch.machines : [];
+  if (!machines.length) {
+    stdout.write("Provisioning response received.\n");
+    return;
+  }
+  stdout.write(`Machines: ${machines.length}\n`);
+  for (const machine of machines) {
+    stdout.write(`- ${machineId(machine)} ${machineState(machine, "queued")}\n`);
+    const sshCommand = sshCommandForMachine(machine);
+    if (sshCommand) {
+      stdout.write(`  SSH: ${sshCommand}\n`);
+    }
+  }
 }
 
-async function buildImageUploadPayload(options) {
-  const imageFile = options.imageFile ? requiredOption(options.imageFile, "--image-file") : null;
-  const registryRef = options.registryRef ? requiredOption(options.registryRef, "--registry-ref") : null;
-  if (!imageFile && !registryRef) {
-    throw new Error("Provide --image-file or --registry-ref for image upload.");
+function sshCommandForMachine(machine) {
+  if (machine.ssh_command) {
+    return machine.ssh_command;
+  }
+  if (machine.iap_ssh_command) {
+    return machine.iap_ssh_command;
+  }
+
+  if (machine.ssh_endpoint) {
+    const port = machinePort(machine);
+    return port === 22 ? `ssh ${machine.ssh_endpoint}` : `ssh -p ${port} ${machine.ssh_endpoint}`;
   }
 
-  let imageBuffer = null;
-  if (imageFile) {
-    imageBuffer = await readFile(imageFile);
+  const host = machineHost(machine);
+  if (!host) {
+    return "";
   }
+  const username = machineUsername(machine) || "root";
+  const port = machinePort(machine);
+  return port === 22 ? `ssh ${username}@${host}` : `ssh -p ${port} ${username}@${host}`;
+}
+
+function machineId(machine) {
+  return machine.id || machine.machine_id || machine.instance_id || machine.instance_name || "machine";
+}
+
+function machineState(machine, fallback = "unknown") {
+  return machine.status || machine.state || machine.actual_state || machine.desired_state || fallback;
+}
 
-  const sha256 = options.sha256
-    ? requiredOption(options.sha256, "--sha256")
-    : imageBuffer
-      ? createHash("sha256").update(imageBuffer).digest("hex")
-      : requiredOption(options.sha256, "--sha256");
-  const sizeBytes = options.sizeBytes
-    ? numberOption(options.sizeBytes, "--size-bytes")
-    : imageBuffer
-      ? imageBuffer.byteLength
-      : numberOption(options.sizeBytes, "--size-bytes");
+function machineUsername(machine) {
+  return machine.tenant_username || machine.username || machine.user || splitSshEndpoint(machine.ssh_endpoint).user;
+}
+
+function machineHost(machine) {
+  return (
+    splitSshEndpoint(machine.ssh_endpoint).host ||
+    machine.ssh_host ||
+    machine.public_ip ||
+    machine.external_ip ||
+    machine.ip_address ||
+    machine.ip ||
+    machine.hostname ||
+    machine.access_host
+  );
+}
 
+function machinePort(machine) {
+  const parsed = Number(machine.ssh_port || machine.port || 22);
+  return Number.isFinite(parsed) && parsed > 0 ? parsed : 22;
+}
+
+function splitSshEndpoint(endpoint) {
+  if (typeof endpoint !== "string" || !endpoint.trim()) {
+    return { host: "", user: "" };
+  }
+  const trimmed = endpoint.trim();
+  const atIndex = trimmed.indexOf("@");
+  if (atIndex <= 0 || atIndex === trimmed.length - 1) {
+    return { host: trimmed, user: "" };
+  }
   return {
-    cosign_signature: requiredOption(options.cosignSignature, "--cosign-signature"),
-    image_b64: imageBuffer ? imageBuffer.toString("base64") : undefined,
-    name: requiredOption(options.name, "--name"),
-    operator_approved_large_image: Boolean(options.operatorApprovedLargeImage),
-    os_family: requiredOption(options.osFamily, "--os-family"),
-    registry_ref: registryRef,
-    sha256,
-    size_bytes: sizeBytes,
+    host: trimmed.slice(atIndex + 1),
+    user: trimmed.slice(0, atIndex),
   };
 }
 
+function activeMachines(machines) {
+  const terminalStates = new Set([
+    "deleted",
+    "deleting",
+    "error",
+    "failed",
+    "revoked",
+    "revoking",
+    "teardown",
+    "terminated",
+    "terminating",
+    "torn_down",
+  ]);
+  return machines.filter((machine) => {
+    const status = String(machineState(machine, "")).toLowerCase();
+    return !terminalStates.has(status);
+  });
+}
+
+function writeMutationWithOpen(stdout, resource, opened, options, label) {
+  if (options.json) {
+    writeJson(stdout, { resource, opened: opened.opened, url: opened.url });
+    return;
+  }
+  stdout.write(`${label} updated.\n`);
+  if (resource?.id) {
+    stdout.write(`ID: ${resource.id}\n`);
+  }
+  writeCheckoutOpenResult(stdout, opened, label);
+}
+
+function writeSshKeyList(stdout, keys) {
+  const activeKeys = activeSshKeys(keys);
+  if (!activeKeys.length) {
+    stdout.write("No SSH keys found.\n");
+    return;
+  }
+  stdout.write("SSH keys:\n");
+  for (const key of activeKeys) {
+    const label = key.label ? ` ${key.label}` : "";
+    const fingerprint = key.fingerprint ? ` ${key.fingerprint}` : "";
+    stdout.write(`- ${key.id || "key"}${label}${fingerprint}\n`);
+  }
+}
+
+function activeSshKeys(keys) {
+  return keys.filter((key) => String(key.status || "active").toLowerCase() === "active" && !key.revoked_at);
+}
+
 function requiredArrayOption(value, name) {
-  const values = arrayOption(value);
-  if (!values.length) {
+  const values = arrayOption(value).map((item) => String(item).trim());
+  if (!values.length || values.some((item) => !item)) {
     throw new Error(`${name} is required.`);
   }
   return values;
@@ -780,13 +1689,25 @@ function parsePositiveNumber(value, option) {
 }
 
 function formatUser(user = {}) {
-  const name = user.name ? `${user.name} ` : "";
   const email = user.email || "unknown user";
+  if (!user.name) {
+    return email;
+  }
+  const name = `${user.name} `;
   return `${name}<${email}>`;
 }
 
-function parseOptions(args, { boolean = [] } = {}) {
+function parseCommandOptions(args, optionSpec, usage) {
+  const { options, positionals } = parseOptions(args, optionSpec);
+  if (positionals.length) {
+    throw new Error(usage);
+  }
+  return options;
+}
+
+function parseOptions(args, { boolean = [], value } = {}) {
   const booleanSet = new Set(boolean.map(toCamelCase));
+  const valueSet = new Set((value ?? []).map(toCamelCase));
   const options = {};
   const positionals = [];
 
@@ -802,10 +1723,19 @@ function parseOptions(args, { boolean = [] } = {}) {
     const key = toCamelCase(rawKey);
     let value;
     if (inlineValue !== null) {
+      if (booleanSet.has(key)) {
+        throw new Error(`Unsupported value for --${rawKey}.`);
+      }
+      if (!valueSet.has(key)) {
+        throw new Error(`Unsupported option: --${rawKey}.`);
+      }
       value = inlineValue;
     } else if (booleanSet.has(key)) {
       value = true;
     } else {
+      if (!valueSet.has(key)) {
+        throw new Error(`Unsupported option: --${rawKey}.`);
+      }
       value = requireValue(args, index, arg);
       index += 1;
     }
@@ -855,6 +1785,76 @@ function numberOption(value, name) {
   return parsed;
 }
 
+function optionProvided(value) {
+  return value !== undefined && value !== null;
+}
+
+function bidPriceOption(options) {
+  return positiveNumberOption(optionProvided(options.price) ? options.price : options.bidPricePerGpuHour, "--price");
+}
+
+function positiveNumberOption(value, name) {
+  const parsed = numberOption(value, name);
+  if (parsed <= 0) {
+    throw new Error(`${name} must be greater than 0.`);
+  }
+  return parsed;
+}
+
+function positiveIntegerOption(value, name) {
+  const parsed = numberOption(value, name);
+  if (!Number.isInteger(parsed) || parsed <= 0) {
+    throw new Error(`${name} must be a positive integer.`);
+  }
+  return parsed;
+}
+
+function dateRangeOptions(options) {
+  const startDate = dateOption(options.startDate, "--start-date");
+  const endDate = dateOption(options.endDate, "--end-date");
+  if (compareDateOnly(startDate, endDate) > 0) {
+    throw new Error("--start-date must be on or before --end-date.");
+  }
+  return { endDate, startDate };
+}
+
+function dateOption(value, name) {
+  const text = requiredOption(value, name);
+  if (typeof text !== "string" || !/^\d{4}-\d{2}-\d{2}$/.test(text) || !parseStrictDateOnly(text)) {
+    throw new Error(`${name} must be a date in yyyy-mm-dd format.`);
+  }
+  return text;
+}
+
+function parseStrictDateOnly(value) {
+  const match = value.match(/^(\d{4})-(\d{2})-(\d{2})$/);
+  if (!match) {
+    return null;
+  }
+  const year = Number(match[1]);
+  const month = Number(match[2]);
+  const day = Number(match[3]);
+  const parsed = new Date(Date.UTC(year, month - 1, day));
+  if (
+    parsed.getUTCFullYear() !== year ||
+    parsed.getUTCMonth() !== month - 1 ||
+    parsed.getUTCDate() !== day
+  ) {
+    return null;
+  }
+  return parsed;
+}
+
+function compareDateOnly(left, right) {
+  return parseStrictDateOnly(left).getTime() - parseStrictDateOnly(right).getTime();
+}
+
+function validateMinGpuCount(minGpuCount, gpuCount) {
+  if (minGpuCount > gpuCount) {
+    throw new Error("--min-gpu-count must be less than or equal to --gpu-count.");
+  }
+}
+
 function arrayOption(value) {
   if (value === undefined || value === null || value === "") {
     return [];
@@ -900,3 +1900,144 @@ function writeOutput(stdout, payload, { json = true, raw = false } = {}) {
 function writeJson(stdout, payload) {
   stdout.write(`${JSON.stringify(payload ?? { ok: true }, null, 2)}\n`);
 }
+
+function formatCliError(error) {
+  if (error instanceof CliApiError) {
+    const structuredDetail = extractStructuredErrorDetail(error.detail);
+    if (structuredDetail) {
+      return formatStructuredProvisioningError(structuredDetail);
+    }
+  }
+  return error instanceof Error ? error.message : String(error);
+}
+
+function extractStructuredErrorDetail(detail) {
+  const candidate = detail?.detail ?? detail?.error ?? detail;
+  if (isStructuredErrorCode(candidate)) {
+    return { code: candidate };
+  }
+  if (!candidate || typeof candidate !== "object" || Array.isArray(candidate)) {
+    return null;
+  }
+  if (typeof candidate.code !== "string" && typeof candidate.summary !== "string") {
+    return null;
+  }
+  return candidate;
+}
+
+function isStructuredErrorCode(value) {
+  if (typeof value !== "string" || !value.trim()) {
+    return false;
+  }
+  const normalized = value.trim().toLowerCase();
+  if (!/^[a-z][a-z0-9_-]*$/.test(normalized)) {
+    return false;
+  }
+  return (
+    normalized.includes("unavailable") ||
+    normalized.includes("capacity") ||
+    normalized.includes("invalid") ||
+    normalized.includes("validation") ||
+    normalized.includes("auth") ||
+    normalized.includes("forbidden") ||
+    normalized.includes("unauthorized") ||
+    normalized.includes("provisioning") ||
+    normalized.includes("failure")
+  );
+}
+
+function formatStructuredProvisioningError(detail) {
+  const lines = [];
+  const summary = textValue(detail.summary) || messageForErrorCode(detail.code) || "Fabric request failed.";
+  lines.push(summary);
+
+  const code = textValue(detail.code);
+  if (code) {
+    lines.push(`Code: ${code}`);
+  }
+
+  for (const reason of listValues(detail.reasons)) {
+    lines.push(`Reason: ${humanizeErrorToken(reason)}`);
+  }
+
+  const nextSteps = nextStepsForStructuredError(detail);
+  if (nextSteps.length) {
+    const label = nextSteps.length === 1 ? "Next step" : "Next steps";
+    lines.push(`${label}: ${nextSteps.join(" ")}`);
+  } else {
+    lines.push(`Next step: ${defaultNextStepForErrorCode(code)}`);
+  }
+
+  return lines.join("\n");
+}
+
+function nextStepsForStructuredError(detail) {
+  const code = textValue(detail.code);
+  const nextSteps = listValues(detail.next_steps ?? detail.nextSteps);
+  if (code.toLowerCase() !== "bare_metal_unavailable") {
+    return nextSteps;
+  }
+  return nextSteps.filter((step) => !/\bvm\b|access mode/i.test(step));
+}
+
+function messageForErrorCode(code) {
+  if (!code) {
+    return "";
+  }
+  const normalized = String(code).toLowerCase();
+  if (normalized.includes("unavailable") || normalized.includes("capacity")) {
+    return "Requested machine capacity is not available.";
+  }
+  if (normalized.includes("invalid") || normalized.includes("validation")) {
+    return "The request is invalid.";
+  }
+  if (
+    normalized.includes("auth") ||
+    normalized.includes("forbidden") ||
+    normalized.includes("unauthorized")
+  ) {
+    return "You are not authorized to perform this machine action.";
+  }
+  return "Machine provisioning failed.";
+}
+
+function defaultNextStepForErrorCode(code) {
+  if (!code) {
+    return "Contact Ornn support with this error code.";
+  }
+  const normalized = String(code).toLowerCase();
+  if (normalized === "bare_metal_unavailable") {
+    return "Choose Bare Metal-capable capacity when available, or contact Ornn support with this error code.";
+  }
+  if (normalized.includes("unavailable") || normalized.includes("capacity")) {
+    return "Try a different access mode or contact Ornn support with this error code.";
+  }
+  if (normalized.includes("invalid") || normalized.includes("validation")) {
+    return "Check the command inputs and try again.";
+  }
+  if (
+    normalized.includes("auth") ||
+    normalized.includes("forbidden") ||
+    normalized.includes("unauthorized")
+  ) {
+    return "Run `fabric login` with an approved tenant account and try again.";
+  }
+  return "Contact Ornn support with this error code.";
+}
+
+function textValue(value) {
+  return typeof value === "string" && value.trim() ? value.trim() : "";
+}
+
+function listValues(value) {
+  if (!Array.isArray(value)) {
+    return [];
+  }
+  return value
+    .filter((item) => typeof item === "string" && item.trim())
+    .map((item) => item.trim());
+}
+
+function humanizeErrorToken(value) {
+  return value.replace(/[_-]+/g, " ");
+}