@ornncompute/cli 0.1.2 → 0.1.3

package/src/cli.mjs

@@ -1,4 +1,8 @@
-import { readFile } from "node:fs/promises";
+import { spawn } from "node:child_process";
+import { readFile, writeFile } from "node:fs/promises";
+import { createRequire } from "node:module";
+import { homedir } from "node:os";
+import { join } from "node:path";
 
 import {
   CliApiError,
@@ -14,7 +18,7 @@ import {
   waitForDeviceApproval,
 } from "./device-auth.mjs";
 
-const VERSION = "0.1.2";
+const { version: VERSION } = createRequire(import.meta.url)("../package.json");
 const DEFAULT_BUY_NOW_USD_PER_GPU_HOUR = 10;
 
 function resolveBuyNowUsdPerGpuHour(record) {
@@ -40,15 +44,21 @@ function resolveBuyNowUsdPerGpuHour(record) {
 
 const CONCISE_HELP = `Ornn CLI
 
-Find, buy, access, and resell bare-metal compute.
+Browse Listings, bid in Exchange, manage GPUs, and open SSH access.
 
 Usage:
   ornn <command> [options]
 
 Examples:
-  ornn availability list
+  ornn listings list
   ornn buy <listing-id>
-  ornn access activate <reservation-id> --ssh-key-id <key-id>
+  ornn gpus list
+  ornn nodes launch <reservation-id> --key ~/.ssh/id_ed25519.pub --wait
+  ornn metrics node <machine-id>
+  ornn clusters create <reservation-id> --type kubernetes --wait
+  ornn networks list
+  ornn storage volumes list
+  ornn ssh <machine-id>
 
 Run \`ornn --help\` for all commands, or \`ornn help <command>\`.
 `;
@@ -60,37 +70,87 @@ Usage:
   ornn login [--auth-base <url>] [--no-browser] [--timeout <seconds>]
   ornn whoami [--json]
   ornn status [--json]
-  ornn availability list [--gpu-type <type>] [--facility <name>] [--operator <name>] [--json]
-  ornn availability show <listing-id> [--open] [--json]
+  ornn listings list [--gpu-type <type>] [--facility <name>] [--operator <name>] [--json]
+  ornn listings show <listing-id> [--open] [--json]
   ornn buy <listing-id> [--no-open] [--json]
-  ornn bid create <listing-id> --gpu-count <n> --min-gpu-count <n> --start-date <yyyy-mm-dd> --end-date <yyyy-mm-dd> --price <usd> [--no-open] [--json]
-  ornn bid list [--json]
-  ornn bid show <bid-id> [--open] [--json]
-  ornn bid update <bid-id> --gpu-count <n> --min-gpu-count <n> --start-date <yyyy-mm-dd> --end-date <yyyy-mm-dd> --price <usd>
-  ornn bid withdraw <bid-id>
-  ornn reservations list [--status <status>] [--json]
-  ornn reservations show <reservation-id> [--open] [--json]
-  ornn reservations checkout <reservation-id> [--no-open] [--json]
+  ornn exchange create <listing-id> --gpu-count <n> --min-gpu-count <n> --start-date <yyyy-mm-dd> --end-date <yyyy-mm-dd> --price <usd> [--no-open] [--json]
+  ornn exchange list [--json]
+  ornn exchange show <exchange-id> [--open] [--json]
+  ornn exchange update <exchange-id> --gpu-count <n> --min-gpu-count <n> --start-date <yyyy-mm-dd> --end-date <yyyy-mm-dd> --price <usd>
+  ornn exchange withdraw <exchange-id>
+  ornn gpus list [--status <status>] [--json]
+  ornn gpus show <gpu-id> [--open] [--json]
+  ornn gpus checkout <gpu-id> [--no-open] [--json]
+  ornn nodes list [--json]
+  ornn nodes show <node-id> [--json]
+  ornn nodes launch <reservation-id> --key <path|id|label> [--mode bare-metal|vm] [--username <name>] [--network public|private] [--storage-load-drive-id <id>] [--storage-save-drive-id <id>] [--wait] [--json]
+  ornn nodes wait <node-or-reservation-id> [--timeout <seconds>] [--json]
+  ornn nodes start <node-id> [--json]
+  ornn nodes stop <node-id> [--json]
+  ornn nodes teardown <node-id> [--json]
+  ornn nodes revoke <node-id> [--json]
+  ornn nodes ssh-command <node-or-reservation-id> [--json]
+  ornn nodes keys attach <node-id> --key <path|id|label> [--json]
+  ornn nodes keys list <node-id> [--json]
+  ornn ssh <node-or-reservation-id> [--print] [--identity-file <path>] [--user <name>] [--json]
+  ornn metrics nodes [--json]
+  ornn metrics node <node-id> [--json]
+  ornn metrics history <node-id> [--start <iso>] [--end <iso>] [--max-points <n>] [--json]
+  ornn metrics watch <node-id> [--interval <seconds>] [--count <n>] [--timeout <seconds>] [--json]
+  ornn clusters list [--json]
+  ornn clusters reservations [--json]
+  ornn clusters eligible-nodes <reservation-id> [--type kubernetes|slurm] [--network public|private] [--json]
+  ornn clusters create <reservation-id> --type kubernetes|slurm [--network public|private] [--node <node-id>] [--node-count <n>] [--wait] [--json]
+  ornn clusters show <reservation-id> [--type kubernetes|slurm] [--json]
+  ornn clusters wait <reservation-id> [--type kubernetes|slurm] [--timeout <seconds>] [--json]
+  ornn clusters credentials <reservation-id> [--type kubernetes|slurm] [--json]
+  ornn clusters kubeconfig <reservation-id> [--output <path>] [--json]
+  ornn clusters ssh-command <reservation-id> [--identity-file <path>] [--user <name>] [--json]
+  ornn clusters ssh <reservation-id> [--print] [--identity-file <path>] [--user <name>] [--json]
+  ornn clusters add-node <reservation-id> --node <node-id> [--json]
+  ornn clusters remove-node <reservation-id> --node <node-id> [--json]
+  ornn clusters teardown <reservation-id> [--type kubernetes|slurm] [--json]
+  ornn networks list [--json]
+  ornn networks show <network-id> [--json]
+  ornn networks create --name <name> [--cidr <cidr>] [--description <text>] [--json]
+  ornn networks update <network-id> [--name <name>] [--description <text>] [--clear-description] [--json]
+  ornn networks delete <network-id> [--json]
+  ornn networks reservation <reservation-id> [--json]
+  ornn networks attach <reservation-id> --network <network-id> [--json]
+  ornn networks detach <reservation-id> [--json]
+  ornn storage volumes list [--json]
+  ornn storage volumes show <drive-id> [--json]
+  ornn storage volumes create --name <name> [--source <drive-id>] [--json]
+  ornn storage volumes refresh <drive-id> [--json]
+  ornn storage volumes clear <drive-id> [--json]
+  ornn storage volumes delete <drive-id> [--json]
+  ornn keys list [--json]
+  ornn keys add [<public-key-file>] [--public-key <key>] [--label <label>] [--json]
+  ornn keys delete <key-id> [--json]
   ornn access show <reservation-id> [--json]
-  ornn access activate <reservation-id> --ssh-key-id <id> [--username <name>] [--no-open] [--json]
+  ornn access activate <reservation-id> --key <path|id|label> [--mode bare-metal|vm] [--username <name>] [--network public|private] [--storage-load-drive-id <id>] [--storage-save-drive-id <id>] [--wait] [--no-open] [--json]
   ornn access push-keys <reservation-id> --ssh-key-id <id> [--json]
   ornn access keys list <reservation-id> [--json]
   ornn access keys add <reservation-id> --public-key <key> [--label <label>] [--json]
   ornn access keys add <reservation-id> --public-key-file <path> [--label <label>] [--json]
   ornn access keys push <reservation-id> --ssh-key-id <id> [--json]
   ornn access keys status <reservation-id> [--json]
-  ornn resale browse [--json]
-  ornn resale list <reservation-id> --ask-price <usd> [--no-open] [--json]
-  ornn resale update <reservation-id> --ask-price <usd> [--no-open] [--json]
-  ornn resale delist <reservation-id> [--no-open] [--json]
   ornn ssh-keys list [--json]
   ornn ssh-keys add --public-key <key> [--label <label>] [--json]
   ornn ssh-keys add --public-key-file <path> [--label <label>] [--json]
   ornn ssh-keys delete <key-id> [--json]
+  ornn billing summary [--json]
+  ornn billing invoices [--json]
+  ornn billing showback --start <yyyy-mm-dd> --end <yyyy-mm-dd> [--json]
   ornn billing open [--no-open] [--json]
   ornn api <get|post|patch|put|delete> <compute-path> [--data <json>] [--raw]
   ornn logout
 
+Aliases:
+  listings = availability
+  exchange = bid
+  gpus = reservations
+
 Environment:
   ORNN_AUTH_BASE_URL  Web/auth server origin. Defaults to http://localhost:3000.
   ORNN_API_BASE_URL   Optional web API origin. Defaults to ORNN_AUTH_BASE_URL.
@@ -111,22 +171,40 @@ const HELP_TOPICS = new Set([
   "bids",
   "billing",
   "buy",
+  "cluster",
+  "clusters",
+  "exchange",
+  "gpu",
+  "gpus",
   "help",
+  "listing",
+  "listings",
   "login",
   "logout",
+  "keys",
+  "metrics",
+  "network",
+  "networks",
+  "nodes",
   "reservations",
-  "resale",
+  "ssh",
   "ssh-keys",
   "status",
+  "storage",
   "whoami",
 ]);
 
+const LISTINGS_COMMANDS = new Set(["availability", "listing", "listings"]);
+const EXCHANGE_COMMANDS = new Set(["bid", "bids", "exchange"]);
+const GPU_COMMANDS = new Set(["gpu", "gpus", "reservations"]);
+
 export async function run(argv = [], io = {}) {
   const stdout = io.stdout ?? process.stdout;
   const stderr = io.stderr ?? process.stderr;
   const env = io.env ?? process.env;
   const fetchImpl = io.fetch ?? fetch;
   const openBrowserImpl = io.openBrowser ?? openBrowser;
+  const spawnProcess = io.spawnProcess ?? spawn;
   const [command, ...args] = argv;
 
   if (!command) {
@@ -178,28 +256,52 @@ export async function run(argv = [], io = {}) {
       return await api(args, { env, fetchImpl, stdout });
     }
 
-    if (command === "availability") {
-      return await availability(args, { env, fetchImpl, openBrowserImpl, stdout });
+    if (LISTINGS_COMMANDS.has(command)) {
+      return await availability(args, { commandName: command, env, fetchImpl, openBrowserImpl, stdout });
     }
 
     if (command === "buy") {
       return await buy(args, { env, fetchImpl, openBrowserImpl, stdout });
     }
 
-    if (command === "bid" || command === "bids") {
-      return await bid(args, { env, fetchImpl, openBrowserImpl, stdout });
+    if (EXCHANGE_COMMANDS.has(command)) {
+      return await bid(args, { commandName: command, env, fetchImpl, openBrowserImpl, stdout });
     }
 
-    if (command === "reservations") {
-      return await reservations(args, { env, fetchImpl, openBrowserImpl, stdout });
+    if (GPU_COMMANDS.has(command)) {
+      return await reservations(args, { commandName: command, env, fetchImpl, openBrowserImpl, stdout });
     }
 
-    if (command === "access") {
-      return await access(args, { env, fetchImpl, openBrowserImpl, stdout });
+    if (command === "nodes") {
+      return await nodes(args, { env, fetchImpl, openBrowserImpl, spawnProcess, stdout });
+    }
+
+    if (command === "ssh") {
+      return await ssh(args, { env, fetchImpl, spawnProcess, stdout });
+    }
+
+    if (command === "metrics") {
+      return await metrics(args, { env, fetchImpl, stdout });
+    }
+
+    if (command === "clusters" || command === "cluster") {
+      return await clusters(args, { env, fetchImpl, spawnProcess, stdout });
+    }
+
+    if (command === "networks" || command === "network") {
+      return await networks(args, { env, fetchImpl, stdout });
+    }
+
+    if (command === "storage") {
+      return await storage(args, { env, fetchImpl, stdout });
+    }
+
+    if (command === "keys") {
+      return await keys(args, { env, fetchImpl, stdout });
     }
 
-    if (command === "resale") {
-      return await resale(args, { env, fetchImpl, openBrowserImpl, stdout });
+    if (command === "access") {
+      return await access(args, { env, fetchImpl, openBrowserImpl, stdout });
     }
 
     if (command === "billing") {
@@ -212,6 +314,14 @@ export async function run(argv = [], io = {}) {
 
     if (command === "logout") {
       parseCommandOptions(args, {}, "Usage: ornn logout");
+      const session = await loadAuthSession({ env });
+      if (session?.accessToken) {
+        try {
+          await cliRequest({ endpoint: "/api/cli/session", env, fetchImpl, method: "DELETE", raw: true, session });
+        } catch {
+          // Best effort: revoke server-side if reachable, but always clear locally.
+        }
+      }
       await clearAuthSession({ env });
       stdout.write("Logged out of Ornn.\n");
       return 0;
@@ -267,19 +377,20 @@ function validateHelpInvocation(command, args) {
     return ["delete", "get", "patch", "post", "put"].includes(method.toLowerCase()) ? null : `Unsupported API method: ${method}`;
   }
 
-  if (command === "availability") {
+  if (LISTINGS_COMMANDS.has(command)) {
     const parsed = parseHelpArgs(args, { booleanOptions: ["--json", "--open"], valueOptions: ["--facility", "--gpu-type", "--operator"] });
     if (parsed.error) {
       return parsed.error;
     }
     const [subcommand, id, ...extra] = parsed.positionals;
+    const usageCommand = command === "availability" ? "availability" : "listings";
     if (!subcommand || subcommand === "list") {
-      return id || extra.length ? "Usage: ornn availability list [--gpu-type <type>] [--facility <name>] [--operator <name>] [--json]" : null;
+      return id || extra.length ? `Usage: ornn ${usageCommand} list [--gpu-type <type>] [--facility <name>] [--operator <name>] [--json]` : null;
     }
     if (subcommand === "show") {
-      return !id || extra.length ? "Usage: ornn availability show <listing-id> [--open] [--json]" : null;
+      return !id || extra.length ? `Usage: ornn ${usageCommand} show <listing-id> [--open] [--json]` : null;
     }
-    return "Usage: ornn availability list|show";
+    return `Usage: ornn ${usageCommand} list|show`;
   }
 
   if (command === "buy") {
@@ -290,38 +401,237 @@ function validateHelpInvocation(command, args) {
     return parsed.positionals.length === 1 ? null : "Usage: ornn buy <listing-id> [--no-open] [--json]";
   }
 
-  if (command === "bid" || command === "bids") {
+  if (EXCHANGE_COMMANDS.has(command)) {
     const parsed = parseHelpArgs(args, { booleanOptions: ["--json", "--no-open", "--open"], valueOptions: ["--end-date", "--gpu-count", "--min-gpu-count", "--price", "--start-date"] });
     if (parsed.error) {
       return parsed.error;
     }
     const [subcommand, id, ...extra] = parsed.positionals;
+    const usageCommand = command === "exchange" ? "exchange" : "bid";
     if (!subcommand || subcommand === "list") {
-      return id || extra.length ? "Usage: ornn bid list|show|create|update|withdraw" : null;
+      return id || extra.length ? `Usage: ornn ${usageCommand} list|show|create|update|withdraw` : null;
     }
     if (["create", "show", "update", "withdraw", "delete"].includes(subcommand)) {
-      return !id || extra.length ? "Usage: ornn bid list|show|create|update|withdraw" : null;
+      return !id || extra.length ? `Usage: ornn ${usageCommand} list|show|create|update|withdraw` : null;
     }
-    return "Usage: ornn bid list|show|create|update|withdraw";
+    return `Usage: ornn ${usageCommand} list|show|create|update|withdraw`;
   }
 
-  if (command === "reservations") {
+  if (GPU_COMMANDS.has(command)) {
     const parsed = parseHelpArgs(args, { booleanOptions: ["--json", "--no-open", "--open"], valueOptions: ["--status"] });
     if (parsed.error) {
       return parsed.error;
     }
     const [subcommand, id, ...extra] = parsed.positionals;
+    const usageCommand = command === "reservations" ? "reservations" : "gpus";
     if (!subcommand || subcommand === "list") {
-      return id || extra.length ? "Usage: ornn reservations list|show|checkout" : null;
+      return id || extra.length ? `Usage: ornn ${usageCommand} list|show|checkout` : null;
     }
     if (["show", "checkout"].includes(subcommand)) {
-      return !id || extra.length ? "Usage: ornn reservations list|show|checkout" : null;
+      return !id || extra.length ? `Usage: ornn ${usageCommand} list|show|checkout` : null;
+    }
+    return `Usage: ornn ${usageCommand} list|show|checkout`;
+  }
+
+  if (command === "nodes") {
+    const parsed = parseHelpArgs(args, {
+      booleanOptions: ["--json", "--no-open", "--open", "--wait"],
+      valueOptions: [
+        "--identity-file",
+        "--key",
+        "--key-id",
+        "--label",
+        "--machine-count",
+        "--mode",
+        "--network",
+        "--network-mode",
+        "--public-key",
+        "--public-key-file",
+        "--request-id",
+        "--ssh-key-id",
+        "--storage-load-drive-id",
+        "--storage-save-drive-id",
+        "--tenant-username",
+        "--timeout",
+        "--user",
+        "--username",
+        "--wait-interval",
+        "--wait-timeout",
+      ],
+    });
+    if (parsed.error) {
+      return parsed.error;
+    }
+    const [subcommand, id, nested, ...extra] = parsed.positionals;
+    if (!subcommand || subcommand === "list") {
+      return id || nested || extra.length ? "Usage: ornn nodes list [--json]" : null;
+    }
+    if (subcommand === "keys") {
+      if (["list", "status", "attach", "push"].includes(id)) {
+        return extra.length ? "Usage: ornn nodes keys list|attach|push|status <node-id>" : null;
+      }
+      return !id ? null : "Usage: ornn nodes keys list|attach|push|status <node-id>";
+    }
+    if (["show", "wait", "start", "stop", "teardown", "revoke", "ssh-command"].includes(subcommand)) {
+      return nested || extra.length ? "Usage: ornn nodes list|show|launch|wait|start|stop|teardown|revoke|ssh-command|keys" : null;
+    }
+    if (subcommand === "launch") {
+      return nested || extra.length ? "Usage: ornn nodes launch <reservation-id> --key <path|id|label>" : null;
+    }
+    return "Usage: ornn nodes list|show|launch|wait|start|stop|teardown|revoke|ssh-command|keys";
+  }
+
+  if (command === "ssh") {
+    const parsed = parseHelpArgs(args, { booleanOptions: ["--json", "--print"], valueOptions: ["--identity-file", "--user"] });
+    if (parsed.error) {
+      return parsed.error;
+    }
+    return parsed.positionals.length <= 1 ? null : "Usage: ornn ssh <node-or-reservation-id> [--print] [--identity-file <path>] [--user <name>] [--json]";
+  }
+
+  if (command === "metrics") {
+    const parsed = parseHelpArgs(args, {
+      booleanOptions: ["--json"],
+      valueOptions: ["--count", "--end", "--interval", "--max-points", "--start", "--timeout", "--watch-interval", "--watch-timeout"],
+    });
+    if (parsed.error) {
+      return parsed.error;
+    }
+    const [subcommand, id, ...extra] = parsed.positionals;
+    if (!subcommand || subcommand === "nodes") {
+      return id || extra.length ? "Usage: ornn metrics nodes [--json]" : null;
+    }
+    if (["history", "node", "show", "watch"].includes(subcommand)) {
+      return !id || extra.length
+        ? "Usage: ornn metrics nodes|node|history|watch"
+        : null;
+    }
+    return "Usage: ornn metrics nodes|node|history|watch";
+  }
+
+  if (command === "clusters" || command === "cluster") {
+    const parsed = parseHelpArgs(args, {
+      booleanOptions: ["--json", "--print", "--wait"],
+      valueOptions: [
+        "--identity-file",
+        "--mode",
+        "--network",
+        "--network-mode",
+        "--node",
+        "--node-count",
+        "--node-id",
+        "--node-ids",
+        "--output",
+        "--storage-load-size-bytes",
+        "--timeout",
+        "--type",
+        "--user",
+        "--wait-interval",
+        "--wait-timeout",
+      ],
+    });
+    if (parsed.error) {
+      return parsed.error;
+    }
+    const [subcommand, id, nested, ...extra] = parsed.positionals;
+    if (!subcommand || subcommand === "list" || subcommand === "reservations") {
+      return id || nested || extra.length ? "Usage: ornn clusters list|reservations" : null;
+    }
+    if (
+      [
+        "add-node",
+        "create",
+        "credentials",
+        "eligible-nodes",
+        "kubeconfig",
+        "remove-node",
+        "show",
+        "ssh",
+        "ssh-command",
+        "teardown",
+        "wait",
+      ].includes(subcommand)
+    ) {
+      if (!id) {
+        return "Usage: ornn clusters list|reservations|eligible-nodes|create|show|wait|credentials|kubeconfig|ssh-command|ssh|add-node|remove-node|teardown";
+      }
+      if (["add-node", "remove-node"].includes(subcommand)) {
+        return extra.length ? "Usage: ornn clusters add-node|remove-node <reservation-id> --node <node-id>" : null;
+      }
+      return nested || extra.length
+        ? "Usage: ornn clusters list|reservations|eligible-nodes|create|show|wait|credentials|kubeconfig|ssh-command|ssh|add-node|remove-node|teardown"
+        : null;
+    }
+    return "Usage: ornn clusters list|reservations|eligible-nodes|create|show|wait|credentials|kubeconfig|ssh-command|ssh|add-node|remove-node|teardown";
+  }
+
+  if (command === "networks" || command === "network") {
+    const parsed = parseHelpArgs(args, {
+      booleanOptions: ["--clear-description", "--json"],
+      valueOptions: ["--cidr", "--description", "--name", "--network", "--network-id"],
+    });
+    if (parsed.error) {
+      return parsed.error;
+    }
+    const [subcommand, id, ...extra] = parsed.positionals;
+    if (!subcommand || subcommand === "list") {
+      return id || extra.length ? "Usage: ornn networks list [--json]" : null;
+    }
+    if (["attach", "create", "delete", "detach", "reservation", "show", "update"].includes(subcommand)) {
+      return subcommand === "create"
+        ? id || extra.length ? "Usage: ornn networks create --name <name> [--cidr <cidr>] [--description <text>] [--json]" : null
+        : !id || extra.length ? "Usage: ornn networks list|show|create|update|delete|reservation|attach|detach" : null;
+    }
+    return "Usage: ornn networks list|show|create|update|delete|reservation|attach|detach";
+  }
+
+  if (command === "storage") {
+    const parsed = parseHelpArgs(args, {
+      booleanOptions: ["--json"],
+      valueOptions: ["--name", "--source", "--source-drive-id"],
+    });
+    if (parsed.error) {
+      return parsed.error;
+    }
+    const [resource, subcommand, id, ...extra] = parsed.positionals;
+    if (!resource) {
+      return null;
+    }
+    if (!["drives", "volumes"].includes(resource)) {
+      return "Usage: ornn storage volumes list|show|create|refresh|clear|delete";
+    }
+    if (!subcommand || subcommand === "list") {
+      return id || extra.length ? "Usage: ornn storage volumes list [--json]" : null;
+    }
+    if (subcommand === "create") {
+      return id || extra.length ? "Usage: ornn storage volumes create --name <name> [--source <drive-id>] [--json]" : null;
+    }
+    if (["show", "refresh", "clear", "delete"].includes(subcommand)) {
+      return !id || extra.length ? "Usage: ornn storage volumes list|show|create|refresh|clear|delete" : null;
+    }
+    return "Usage: ornn storage volumes list|show|create|refresh|clear|delete";
+  }
+
+  if (command === "keys") {
+    const parsed = parseHelpArgs(args, { booleanOptions: ["--json"], valueOptions: ["--label", "--public-key", "--public-key-file"] });
+    if (parsed.error) {
+      return parsed.error;
+    }
+    const [subcommand, id, extra, ...rest] = parsed.positionals;
+    if (!subcommand || subcommand === "list") {
+      return id || extra || rest.length ? "Usage: ornn keys list|add|delete" : null;
+    }
+    if (subcommand === "add") {
+      return extra || rest.length ? "Usage: ornn keys add [<public-key-file>] [--public-key <key>] [--label <label>] [--json]" : null;
+    }
+    if (["delete", "remove"].includes(subcommand)) {
+      return !id || extra || rest.length ? "Usage: ornn keys delete <key-id> [--json]" : null;
     }
-    return "Usage: ornn reservations list|show|checkout";
+    return "Usage: ornn keys list|add|delete";
   }
 
   if (command === "access") {
-    const parsed = parseHelpArgs(args, { booleanOptions: ["--json", "--no-open"], valueOptions: ["--label", "--machine-count", "--public-key", "--public-key-file", "--request-id", "--ssh-key-id", "--tenant-username", "--username"] });
+    const parsed = parseHelpArgs(args, { booleanOptions: ["--json", "--no-open", "--wait"], valueOptions: ["--key", "--key-id", "--label", "--machine-count", "--mode", "--network", "--network-mode", "--public-key", "--public-key-file", "--request-id", "--ssh-key-id", "--storage-load-drive-id", "--storage-save-drive-id", "--tenant-username", "--username", "--wait-interval", "--wait-timeout"] });
     if (parsed.error) {
       return parsed.error;
     }
@@ -338,23 +648,8 @@ function validateHelpInvocation(command, args) {
     return !subcommand ? null : "Usage: ornn access show|activate|push-keys|keys <reservation-id>";
   }
 
-  if (command === "resale") {
-    const parsed = parseHelpArgs(args, { booleanOptions: ["--json", "--no-open"], valueOptions: ["--ask-price"] });
-    if (parsed.error) {
-      return parsed.error;
-    }
-    const [subcommand, id, ...extra] = parsed.positionals;
-    if (!subcommand || subcommand === "browse") {
-      return id || extra.length ? "Usage: ornn resale browse|list|update|delist" : null;
-    }
-    if (["list", "update", "delist"].includes(subcommand)) {
-      return !id || extra.length ? "Usage: ornn resale browse|list|update|delist" : null;
-    }
-    return "Usage: ornn resale browse|list|update|delist";
-  }
-
   if (command === "billing") {
-    const parsed = parseHelpArgs(args, { booleanOptions: ["--json", "--no-open"] });
+    const parsed = parseHelpArgs(args, { booleanOptions: ["--json", "--no-open"], valueOptions: ["--end", "--start"] });
     if (parsed.error) {
       return parsed.error;
     }
@@ -362,7 +657,13 @@ function validateHelpInvocation(command, args) {
     if (!subcommand || subcommand === "open") {
       return extra.length ? "Usage: ornn billing open [--no-open] [--json]" : null;
     }
-    return "Usage: ornn billing open [--no-open] [--json]";
+    if (["invoices", "summary"].includes(subcommand)) {
+      return extra.length ? "Usage: ornn billing summary|invoices|showback|open" : null;
+    }
+    if (subcommand === "showback") {
+      return extra.length ? "Usage: ornn billing showback --start <yyyy-mm-dd> --end <yyyy-mm-dd> [--json]" : null;
+    }
+    return "Usage: ornn billing summary|invoices|showback|open";
   }
 
   if (command === "ssh-keys") {
@@ -501,6 +802,11 @@ async function whoami(args, { env, fetchImpl, stderr, stdout }) {
       stdout.write(`Approved: ${serverSession.routeState.isApproved ? "yes" : "no"}\n`);
     }
   } catch (error) {
+    if (error instanceof CliApiError && error.status === 401) {
+      // Token was rejected (expired/revoked) and has now been cleared locally.
+      stderr.write(`${error.message}\n`);
+      return 1;
+    }
     if (options.json) {
       writeJson(stdout, session);
     } else {
@@ -564,12 +870,15 @@ async function api(args, { env, fetchImpl, stdout }) {
 }
 
 async function availability(args, context) {
+  const commandName = context.commandName === "availability" ? "availability" : "listings";
+  const listUsage = `Usage: ornn ${commandName} list [--gpu-type <type>] [--facility <name>] [--operator <name>] [--json]`;
+  const showUsage = `Usage: ornn ${commandName} show <listing-id> [--open] [--json]`;
   const [subcommand = "list", id, ...rest] = args;
   if (subcommand === "list") {
     const options = parseCommandOptions(
       [id, ...rest].filter(Boolean),
       { boolean: ["json"], value: ["facility", "gpu-type", "operator"] },
-      "Usage: ornn availability list [--gpu-type <type>] [--facility <name>] [--operator <name>] [--json]",
+      listUsage,
     );
     const listings = await loadAvailabilityListings(context);
     const filtered = filterAvailabilityListings(listings, options);
@@ -585,7 +894,7 @@ async function availability(args, context) {
     const options = parseCommandOptions(
       rest,
       { boolean: ["json", "open"] },
-      "Usage: ornn availability show <listing-id> [--open] [--json]",
+      showUsage,
     );
     const listing = await resolveListing(id, context);
     if (options.json) {
@@ -603,7 +912,7 @@ async function availability(args, context) {
     return 0;
   }
 
-  throw new Error("Usage: ornn availability list|show");
+  throw new Error(`Usage: ornn ${commandName} list|show`);
 }
 
 async function buy(args, context) {
@@ -625,19 +934,21 @@ async function buy(args, context) {
     payload: { listing },
   });
   if (!options.json) {
-    writeCheckoutOpenResult(context.stdout, checkout, listing.kind === "resale" ? "Resale checkout" : "Checkout");
+    writeCheckoutOpenResult(context.stdout, checkout, "Checkout");
   }
   return 0;
 }
 
 async function bid(args, context) {
+  const commandName = context.commandName === "exchange" ? "exchange" : "bid";
+  const commandUsage = `Usage: ornn ${commandName} list|show|create|update|withdraw`;
   const [subcommand = "list", id, ...rest] = args;
 
   if (subcommand === "list") {
     const options = parseCommandOptions(
       [id, ...rest].filter(Boolean),
       { boolean: ["json"] },
-      "Usage: ornn bid list [--json]",
+      `Usage: ornn ${commandName} list [--json]`,
     );
     const bids = await cliRequest({
       endpoint: computeEndpoint("/tenants/me/bids"),
@@ -656,7 +967,7 @@ async function bid(args, context) {
     const options = parseCommandOptions(
       rest,
       { boolean: ["json", "open"] },
-      "Usage: ornn bid show <bid-id> [--open] [--json]",
+      `Usage: ornn ${commandName} show <bid-id> [--open] [--json]`,
     );
     const found = await findBid(id, context);
     if (options.json) {
@@ -680,11 +991,8 @@ async function bid(args, context) {
         boolean: ["json", "no-open"],
         value: ["bid-price-per-gpu-hour", "end-date", "gpu-count", "min-gpu-count", "price", "start-date"],
       },
-      "Usage: ornn bid create <listing-id> --gpu-count <n> --min-gpu-count <n> --start-date <yyyy-mm-dd> --end-date <yyyy-mm-dd> --price <usd> [--no-open] [--json]",
+      `Usage: ornn ${commandName} create <listing-id> --gpu-count <n> --min-gpu-count <n> --start-date <yyyy-mm-dd> --end-date <yyyy-mm-dd> --price <usd> [--no-open] [--json]`,
     );
-    if (id.startsWith("resale-")) {
-      throw new Error("Bids can only be placed on primary availability listings, not resale listings.");
-    }
     const { endDate, startDate } = dateRangeOptions(options);
     const gpuCount = positiveIntegerOption(options.gpuCount, "--gpu-count");
     const minGpuCount = optionProvided(options.minGpuCount) ? positiveIntegerOption(options.minGpuCount, "--min-gpu-count") : gpuCount;
@@ -712,8 +1020,8 @@ async function bid(args, context) {
     if (options.json) {
       writeJson(context.stdout, { bid: created, opened: opened.opened, url: opened.url });
     } else {
-      context.stdout.write("Bid created\n");
-      context.stdout.write(`Bid: ${created.id}\n`);
+      context.stdout.write("Exchange bid created\n");
+      context.stdout.write(`Exchange bid: ${created.id}\n`);
       writeCheckoutOpenResult(context.stdout, opened, "Bid checkout");
     }
     return 0;
@@ -726,7 +1034,7 @@ async function bid(args, context) {
         boolean: ["json"],
         value: ["bid-price-per-gpu-hour", "end-date", "gpu-count", "min-gpu-count", "price", "start-date"],
       },
-      "Usage: ornn bid update <bid-id> --gpu-count <n> --min-gpu-count <n> --start-date <yyyy-mm-dd> --end-date <yyyy-mm-dd> --price <usd>",
+      `Usage: ornn ${commandName} update <bid-id> --gpu-count <n> --min-gpu-count <n> --start-date <yyyy-mm-dd> --end-date <yyyy-mm-dd> --price <usd>`,
     );
     const { endDate, startDate } = dateRangeOptions(options);
     const gpuCount = positiveIntegerOption(options.gpuCount, "--gpu-count");
@@ -749,7 +1057,7 @@ async function bid(args, context) {
     if (options.json) {
       writeJson(context.stdout, updated);
     } else {
-      context.stdout.write("Bid updated.\n");
+      context.stdout.write("Exchange bid updated.\n");
       writeBidDetail(context.stdout, updated);
     }
     return 0;
@@ -759,7 +1067,7 @@ async function bid(args, context) {
     const options = parseCommandOptions(
       rest,
       { boolean: ["json"] },
-      "Usage: ornn bid withdraw <bid-id> [--json]",
+      `Usage: ornn ${commandName} withdraw <bid-id> [--json]`,
     );
     const response = await cliRequest({
       endpoint: computeEndpoint(`/tenants/me/bids/${id}`),
@@ -770,22 +1078,24 @@ async function bid(args, context) {
     if (options.json) {
       writeJson(context.stdout, response ?? { ok: true });
     } else {
-      context.stdout.write(`Bid withdrawn: ${id}\n`);
+      context.stdout.write(`Exchange bid withdrawn: ${id}\n`);
     }
     return 0;
   }
 
-  throw new Error("Usage: ornn bid list|show|create|update|withdraw");
+  throw new Error(commandUsage);
 }
 
 async function reservations(args, context) {
+  const commandName = context.commandName === "reservations" ? "reservations" : "gpus";
+  const commandUsage = `Usage: ornn ${commandName} list|show|checkout`;
   const [subcommand = "list", id, ...rest] = args;
 
   if (subcommand === "list") {
     const options = parseCommandOptions(
       [id, ...rest].filter(Boolean),
       { boolean: ["json"], value: ["status"] },
-      "Usage: ornn reservations list [--status <status>] [--json]",
+      `Usage: ornn ${commandName} list [--status <status>] [--json]`,
     );
     const query = buildQuery({ status: options.status });
     const rows = await cliRequest({
@@ -805,7 +1115,7 @@ async function reservations(args, context) {
     const options = parseCommandOptions(
       rest,
       { boolean: ["json", "open"] },
-      "Usage: ornn reservations show <reservation-id> [--open] [--json]",
+      `Usage: ornn ${commandName} show <reservation-id> [--open] [--json]`,
     );
     const found = await findReservation(id, context);
     if (options.json) {
@@ -826,7 +1136,7 @@ async function reservations(args, context) {
     const options = parseCommandOptions(
       rest,
       { boolean: ["json", "no-open"] },
-      "Usage: ornn reservations checkout <reservation-id> [--no-open] [--json]",
+      `Usage: ornn ${commandName} checkout <reservation-id> [--no-open] [--json]`,
     );
     const found = await findReservation(id, context);
     if (found.status !== "pending_payment") {
@@ -844,274 +1154,1119 @@ async function reservations(args, context) {
     return 0;
   }
 
-  throw new Error("Usage: ornn reservations list|show|checkout");
+  throw new Error(commandUsage);
 }
 
-async function access(args, context) {
-  const [subcommand, ...subcommandArgs] = args;
-  if (subcommand === "keys") {
-    return await accessKeys(subcommandArgs, context);
-  }
+async function nodes(args, context) {
+  const [subcommand = "list", id, nested, ...rest] = args;
 
-  const [reservationId, ...rest] = subcommandArgs;
-  if (!subcommand || !reservationId) {
-    throw new Error("Usage: ornn access show|activate|push-keys|keys <reservation-id>");
+  if (subcommand === "list") {
+    const options = parseCommandOptions(
+      [id, nested, ...rest].filter(Boolean),
+      { boolean: ["json"] },
+      "Usage: ornn nodes list [--json]",
+    );
+    const machines = await fetchTenantMachines(context);
+    if (options.json) {
+      writeJson(context.stdout, machines);
+    } else {
+      writeNodeList(context.stdout, machines);
+    }
+    return 0;
   }
 
-  if (subcommand === "show") {
+  if (subcommand === "show" && id) {
     const options = parseCommandOptions(
-      rest,
+      [nested, ...rest].filter(Boolean),
       { boolean: ["json"] },
-      "Usage: ornn access show <reservation-id> [--json]",
+      "Usage: ornn nodes show <node-id> [--json]",
     );
-    const payload = await getReservationMachines(reservationId, context);
+    const machine = await fetchMachine(id, context);
     if (options.json) {
-      writeJson(context.stdout, payload);
+      writeJson(context.stdout, machine);
     } else {
-      writeAccessDetail(context.stdout, payload);
+      writeNodeDetail(context.stdout, machine);
     }
     return 0;
   }
 
-  if (subcommand === "activate") {
+  if (subcommand === "launch" && id) {
     const options = parseCommandOptions(
-      rest,
+      [nested, ...rest].filter(Boolean),
       {
-        boolean: ["json", "no-open"],
-        value: ["machine-count", "request-id", "ssh-key-id", "tenant-username", "username"],
+        boolean: ["json", "no-open", "open", "wait"],
+        value: [
+          "key",
+          "key-id",
+          "label",
+          "machine-count",
+          "mode",
+          "network",
+          "network-mode",
+          "public-key",
+          "public-key-file",
+          "request-id",
+          "ssh-key-id",
+          "storage-load-drive-id",
+          "storage-save-drive-id",
+          "tenant-username",
+          "username",
+          "wait-interval",
+          "wait-timeout",
+        ],
       },
-      "Usage: ornn access activate <reservation-id> --ssh-key-id <id> [--username <name>] [--no-open] [--json]",
+      "Usage: ornn nodes launch <reservation-id> --key <path|id|label> [--mode bare-metal|vm] [--username <name>] [--network public|private] [--storage-load-drive-id <id>] [--storage-save-drive-id <id>] [--wait] [--json]",
     );
-    const sshKeyIds = requiredArrayOption(options.sshKeyId, "--ssh-key-id");
-    const launchPayload = {
-      image_id: null,
-      machine_count: optionProvided(options.machineCount) ? positiveIntegerOption(options.machineCount, "--machine-count") : 1,
-      machine_type: null,
-      request_id: options.requestId || null,
-      ssh_key_ids: sshKeyIds,
-      tenant_username: options.username || options.tenantUsername || null,
-      zone: null,
-    };
-    const accessMode = await cliRequest({
-      body: { access_mode: "bare-metal", image_id: null },
-      endpoint: computeEndpoint(`/tenants/me/reservations/${reservationId}/access-mode`),
-      env: context.env,
-      fetchImpl: context.fetchImpl,
-      method: "POST",
-    });
-    const launch = await cliRequest({
-      body: launchPayload,
-      endpoint: computeEndpoint(`/standalone-vms/reservations/${reservationId}/launch`),
-      env: context.env,
-      fetchImpl: context.fetchImpl,
-      method: "POST",
-    });
-    const opened = await openFabricPage(context, `/portfolio/${encodeURIComponent(reservationId)}`, {
-      label: "reservation",
-      noOpen: options.noOpen,
-    });
+    const result = await launchReservationAccess(id, options, context, { openDefault: false });
     if (options.json) {
-      writeJson(context.stdout, { access: accessMode, launch, opened: opened.opened, url: opened.url });
+      writeJson(context.stdout, result);
     } else {
-      context.stdout.write("Bare-metal access activation queued\n");
-      writeAccessLaunchSummary(context.stdout, launch);
-      writeCheckoutOpenResult(context.stdout, opened, "Reservation page");
+      writeNodeLaunchResult(context.stdout, result);
     }
     return 0;
   }
 
-  if (subcommand === "push-keys") {
+  if (subcommand === "launch") {
+    throw new Error("Usage: ornn nodes launch <reservation-id> --key <path|id|label> [--mode bare-metal|vm] [--username <name>] [--network public|private] [--storage-load-drive-id <id>] [--storage-save-drive-id <id>] [--wait] [--json]");
+  }
+
+  if (subcommand === "wait" && id) {
     const options = parseCommandOptions(
-      rest,
-      { boolean: ["json"], value: ["request-id", "ssh-key-id"] },
-      "Usage: ornn access push-keys <reservation-id> --ssh-key-id <id> [--json]",
+      [nested, ...rest].filter(Boolean),
+      { boolean: ["json"], value: ["timeout", "wait-interval", "wait-timeout"] },
+      "Usage: ornn nodes wait <node-or-reservation-id> [--timeout <seconds>] [--json]",
     );
-    const sshKeyIds = requiredArrayOption(options.sshKeyId, "--ssh-key-id");
-    const pushed = await pushReservationKeys(reservationId, sshKeyIds, options.requestId, context);
+    const result = await waitForSshReady(id, waitOptions(options), context);
     if (options.json) {
-      writeJson(context.stdout, { machines: pushed });
+      writeJson(context.stdout, result);
     } else {
-      context.stdout.write(`SSH key update queued for ${pushed.length} machine${pushed.length === 1 ? "" : "s"}.\n`);
+      writeWaitResult(context.stdout, result);
     }
     return 0;
   }
 
-  throw new Error(`Unsupported access action: ${subcommand}`);
+  if (["start", "stop", "teardown", "revoke"].includes(subcommand) && id) {
+    const options = parseCommandOptions(
+      [nested, ...rest].filter(Boolean),
+      { boolean: ["json"], value: ["request-id"] },
+      `Usage: ornn nodes ${subcommand} <node-id> [--json]`,
+    );
+    const machine = await runNodeAction(id, subcommand, options, context);
+    if (options.json) {
+      writeJson(context.stdout, machine);
+    } else {
+      context.stdout.write(`Node ${subcommand} requested: ${machineId(machine)}\n`);
+      writeNodeDetail(context.stdout, machine);
+    }
+    return 0;
+  }
+
+  if (subcommand === "ssh-command" && id) {
+    const options = parseCommandOptions(
+      [nested, ...rest].filter(Boolean),
+      { boolean: ["json"], value: ["identity-file", "user"] },
+      "Usage: ornn nodes ssh-command <node-or-reservation-id> [--json]",
+    );
+    const { machine } = await resolveSshTarget(id, context);
+    const invocation = sshInvocationForMachine(machine, options);
+    if (!invocation) {
+      throw new Error(`Node is not SSH-ready yet: ${machineId(machine)}`);
+    }
+    const command = commandText(invocation);
+    if (options.json) {
+      writeJson(context.stdout, { command, machine });
+    } else {
+      context.stdout.write(`${command}\n`);
+    }
+    return 0;
+  }
+
+  if (subcommand === "keys") {
+    return await nodeKeys([id, nested, ...rest].filter((item) => item !== undefined), context);
+  }
+
+  throw new Error("Usage: ornn nodes list|show|launch|wait|start|stop|teardown|revoke|ssh-command|keys");
 }
 
-async function accessKeys(args, context) {
-  const [action, reservationId, ...rest] = args;
-  if (!action || !reservationId) {
-    throw new Error("Usage: ornn access keys list|add|push|status <reservation-id>");
+async function ssh(args, context) {
+  const [identifier, ...rest] = args;
+  if (!identifier) {
+    throw new Error("Usage: ornn ssh <node-or-reservation-id> [--print] [--identity-file <path>] [--user <name>] [--json]");
+  }
+  const options = parseCommandOptions(
+    rest,
+    { boolean: ["json", "print"], value: ["identity-file", "user"] },
+    "Usage: ornn ssh <node-or-reservation-id> [--print] [--identity-file <path>] [--user <name>] [--json]",
+  );
+  const { machine } = await resolveSshTarget(identifier, context);
+  const invocation = sshInvocationForMachine(machine, options);
+  if (!invocation) {
+    throw new Error(`Node is not SSH-ready yet: ${machineId(machine)}`);
+  }
+  const command = commandText(invocation);
+  if (options.json) {
+    writeJson(context.stdout, { command, machine });
+    return 0;
+  }
+  if (options.print) {
+    context.stdout.write(`${command}\n`);
+    return 0;
   }
+  return await spawnCommand(invocation, context);
+}
 
-  if (action === "list") {
+async function metrics(args, context) {
+  const [subcommand = "nodes", nodeId, ...rest] = args;
+
+  if (subcommand === "nodes") {
     const options = parseCommandOptions(
-      rest,
+      [nodeId, ...rest].filter(Boolean),
       { boolean: ["json"] },
-      "Usage: ornn access keys list <reservation-id> [--json]",
+      "Usage: ornn metrics nodes [--json]",
     );
-    const payload = await fetchReservationSshKeys(reservationId, context);
+    const snapshots = await fetchTenantMetricSnapshots(context);
     if (options.json) {
-      writeJson(context.stdout, payload);
+      writeJson(context.stdout, snapshots);
     } else {
-      writeReservationSshKeyList(context.stdout, sshKeysFromPayload(payload), reservationId);
+      writeMetricSnapshotList(context.stdout, snapshots);
     }
     return 0;
   }
 
-  if (action === "add") {
+  if ((subcommand === "node" || subcommand === "show") && nodeId) {
     const options = parseCommandOptions(
       rest,
-      { boolean: ["json"], value: ["label", "public-key", "public-key-file"] },
-      "Usage: ornn access keys add <reservation-id> --public-key <key> [--label <label>] [--json]",
+      { boolean: ["json"] },
+      "Usage: ornn metrics node <node-id> [--json]",
     );
-    const publicKey = options.publicKeyFile
-      ? (await readFile(options.publicKeyFile, "utf8")).trim()
-      : requiredOption(options.publicKey, "--public-key");
-    const key = await cliRequest({
-      body: {
-        label: options.label || null,
-        public_key: publicKey,
-      },
-      endpoint: reservationSshKeysEndpoint(reservationId),
-      env: context.env,
-      fetchImpl: context.fetchImpl,
-      method: "POST",
-    });
+    const snapshot = await fetchMetricSnapshotForNode(nodeId, context);
     if (options.json) {
-      writeJson(context.stdout, key);
+      writeJson(context.stdout, snapshot);
     } else {
-      context.stdout.write("Reservation SSH key added.\n");
-      context.stdout.write(`Reservation: ${reservationId}\n`);
-      if (key?.id) {
-        context.stdout.write(`Key: ${key.id}\n`);
-      }
+      writeMetricSnapshotDetail(context.stdout, snapshot);
     }
     return 0;
   }
 
-  if (action === "push") {
+  if (subcommand === "history" && nodeId) {
     const options = parseCommandOptions(
       rest,
-      { boolean: ["json"], value: ["request-id", "ssh-key-id"] },
-      "Usage: ornn access keys push <reservation-id> --ssh-key-id <id> [--json]",
+      { boolean: ["json"], value: ["end", "max-points", "start"] },
+      "Usage: ornn metrics history <node-id> [--start <iso>] [--end <iso>] [--max-points <n>] [--json]",
     );
-    const sshKeyIds = requiredArrayOption(options.sshKeyId, "--ssh-key-id");
-    const pushed = await pushReservationKeys(reservationId, sshKeyIds, options.requestId, context);
+    const result = await fetchMetricHistoryForNode(nodeId, options, context);
     if (options.json) {
-      writeJson(context.stdout, { machines: pushed });
+      writeJson(context.stdout, result);
     } else {
-      context.stdout.write(`SSH key update queued for ${pushed.length} machine${pushed.length === 1 ? "" : "s"}.\n`);
+      writeMetricHistory(context.stdout, result);
     }
     return 0;
   }
 
-  if (action === "status") {
+  if (subcommand === "watch" && nodeId) {
     const options = parseCommandOptions(
       rest,
-      { boolean: ["json"] },
-      "Usage: ornn access keys status <reservation-id> [--json]",
+      {
+        boolean: ["json"],
+        value: ["count", "interval", "timeout", "watch-interval", "watch-timeout"],
+      },
+      "Usage: ornn metrics watch <node-id> [--interval <seconds>] [--count <n>] [--timeout <seconds>] [--json]",
     );
-    const status = await buildReservationKeyStatus(reservationId, context);
-    if (options.json) {
-      writeJson(context.stdout, status);
-    } else {
-      writeReservationKeyStatus(context.stdout, status);
-    }
+    await watchNodeMetrics(nodeId, options, context);
     return 0;
   }
 
-  throw new Error("Usage: ornn access keys list|add|push|status <reservation-id>");
+  if (subcommand === "node" || subcommand === "show") {
+    throw new Error("Usage: ornn metrics node <node-id> [--json]");
+  }
+  if (subcommand === "history") {
+    throw new Error("Usage: ornn metrics history <node-id> [--start <iso>] [--end <iso>] [--max-points <n>] [--json]");
+  }
+  if (subcommand === "watch") {
+    throw new Error("Usage: ornn metrics watch <node-id> [--interval <seconds>] [--count <n>] [--timeout <seconds>] [--json]");
+  }
+
+  throw new Error("Usage: ornn metrics nodes|node|history|watch");
 }
 
-async function resale(args, context) {
-  const [subcommand = "browse", reservationId, ...rest] = args;
+async function clusters(args, context) {
+  const [subcommand = "list", reservationId, maybeNodeId, ...rest] = args;
 
-  if (subcommand === "browse") {
+  if (subcommand === "list") {
     const options = parseCommandOptions(
-      [reservationId, ...rest].filter(Boolean),
+      [reservationId, maybeNodeId, ...rest].filter(Boolean),
       { boolean: ["json"] },
-      "Usage: ornn resale browse [--json]",
+      "Usage: ornn clusters list [--json]",
     );
-    const listings = (await loadAvailabilityListings(context)).filter((listing) => listing.kind === "resale");
+    const rows = await fetchTenantClusters(context);
     if (options.json) {
-      writeJson(context.stdout, listings);
-    } else if (!listings.length) {
-      context.stdout.write("No resale listings found.\n");
+      writeJson(context.stdout, rows);
     } else {
-      writeAvailabilityList(context.stdout, listings);
+      writeClusterList(context.stdout, requireArrayPayload(rows, "clusters"));
     }
     return 0;
   }
 
-  if (subcommand === "list" && reservationId) {
+  if (subcommand === "reservations") {
     const options = parseCommandOptions(
-      rest,
-      { boolean: ["json", "no-open"], value: ["ask-price"] },
-      "Usage: ornn resale list <reservation-id> --ask-price <usd> [--no-open] [--json]",
+      [reservationId, maybeNodeId, ...rest].filter(Boolean),
+      { boolean: ["json"] },
+      "Usage: ornn clusters reservations [--json]",
     );
-    const reservation = await cliRequest({
-      body: { ask_price_per_gpu_hour: positiveNumberOption(options.askPrice, "--ask-price") },
-      endpoint: computeEndpoint(`/tenants/me/reservations/${reservationId}/list`),
+    const rows = await cliRequest({
+      endpoint: computeEndpoint("/clusters/reservations"),
       env: context.env,
       fetchImpl: context.fetchImpl,
-      method: "POST",
-    });
-    const opened = await openFabricPage(context, `/marketplace/resale-${encodeURIComponent(reservationId)}`, {
-      label: "resale listing",
-      noOpen: options.noOpen,
     });
-    writeMutationWithOpen(context.stdout, reservation, opened, options, "Resale listing");
+    if (options.json) {
+      writeJson(context.stdout, rows);
+    } else {
+      writeClusterReservationList(context.stdout, requireArrayPayload(rows, "cluster reservations"));
+    }
     return 0;
   }
 
-  if (subcommand === "update" && reservationId) {
+  if (subcommand === "eligible-nodes" && reservationId) {
     const options = parseCommandOptions(
-      rest,
-      { boolean: ["json", "no-open"], value: ["ask-price"] },
-      "Usage: ornn resale update <reservation-id> --ask-price <usd> [--no-open] [--json]",
+      [maybeNodeId, ...rest].filter(Boolean),
+      { boolean: ["json"], value: ["network", "network-mode", "type", "mode"] },
+      "Usage: ornn clusters eligible-nodes <reservation-id> [--type kubernetes|slurm] [--network public|private] [--json]",
     );
-    const reservation = await cliRequest({
-      body: { ask_price_per_gpu_hour: positiveNumberOption(options.askPrice, "--ask-price") },
-      endpoint: computeEndpoint(`/tenants/me/reservations/${reservationId}/ask-price`),
-      env: context.env,
-      fetchImpl: context.fetchImpl,
-      method: "PATCH",
-    });
-    const opened = await openFabricPage(context, `/marketplace/resale-${encodeURIComponent(reservationId)}`, {
-      label: "resale listing",
-      noOpen: options.noOpen,
+    const type = normalizeClusterType(options.type || options.mode || "kubernetes");
+    const networkMode = normalizeClusterNetwork(options.network || options.networkMode || "public");
+    const payload = await fetchEligibleClusterNodes(reservationId, type, networkMode, context);
+    if (options.json) {
+      writeJson(context.stdout, payload);
+    } else {
+      writeEligibleClusterNodes(context.stdout, payload);
+    }
+    return 0;
+  }
+
+  if (subcommand === "create" && reservationId) {
+    const options = parseCommandOptions(
+      [maybeNodeId, ...rest].filter(Boolean),
+      {
+        boolean: ["json", "wait"],
+        value: [
+          "network",
+          "network-mode",
+          "node",
+          "node-count",
+          "node-id",
+          "node-ids",
+          "storage-load-size-bytes",
+          "type",
+          "mode",
+          "wait-interval",
+          "wait-timeout",
+          "timeout",
+        ],
+      },
+      "Usage: ornn clusters create <reservation-id> --type kubernetes|slurm [--network public|private] [--node <node-id>] [--node-count <n>] [--wait] [--json]",
+    );
+    const type = normalizeClusterType(requiredOption(options.type || options.mode, "--type"));
+    const launch = await launchCluster(reservationId, type, options, context);
+    const wait = options.wait
+      ? await waitForClusterActive(reservationId, type, waitOptions(options), context)
+      : null;
+    const result = { cluster: launch, reservation_id: reservationId, type, wait };
+    if (options.json) {
+      writeJson(context.stdout, result);
+    } else {
+      writeClusterLaunchResult(context.stdout, result);
+    }
+    return 0;
+  }
+
+  if (subcommand === "show" && reservationId) {
+    const options = parseCommandOptions(
+      [maybeNodeId, ...rest].filter(Boolean),
+      { boolean: ["json"], value: ["type", "mode"] },
+      "Usage: ornn clusters show <reservation-id> [--type kubernetes|slurm] [--json]",
+    );
+    const type = await resolveClusterTypeForReservation(reservationId, options, context);
+    const cluster = await fetchCluster(reservationId, type, context);
+    if (options.json) {
+      writeJson(context.stdout, cluster);
+    } else {
+      writeClusterDetail(context.stdout, cluster);
+    }
+    return 0;
+  }
+
+  if (subcommand === "wait" && reservationId) {
+    const options = parseCommandOptions(
+      [maybeNodeId, ...rest].filter(Boolean),
+      { boolean: ["json"], value: ["timeout", "type", "mode", "wait-interval", "wait-timeout"] },
+      "Usage: ornn clusters wait <reservation-id> [--type kubernetes|slurm] [--timeout <seconds>] [--json]",
+    );
+    const type = await resolveClusterTypeForReservation(reservationId, options, context);
+    const result = await waitForClusterActive(reservationId, type, waitOptions(options), context);
+    if (options.json) {
+      writeJson(context.stdout, result);
+    } else {
+      writeClusterWaitResult(context.stdout, result);
+    }
+    return 0;
+  }
+
+  if (subcommand === "credentials" && reservationId) {
+    const options = parseCommandOptions(
+      [maybeNodeId, ...rest].filter(Boolean),
+      { boolean: ["json"], value: ["type", "mode"] },
+      "Usage: ornn clusters credentials <reservation-id> [--type kubernetes|slurm] [--json]",
+    );
+    const type = await resolveClusterTypeForReservation(reservationId, options, context);
+    const credentials = await fetchClusterCredentials(reservationId, type, context);
+    if (options.json) {
+      writeJson(context.stdout, credentials);
+    } else {
+      writeClusterCredentials(context.stdout, credentials, type, reservationId);
+    }
+    return 0;
+  }
+
+  if (subcommand === "kubeconfig" && reservationId) {
+    const options = parseCommandOptions(
+      [maybeNodeId, ...rest].filter(Boolean),
+      { boolean: ["json"], value: ["output"] },
+      "Usage: ornn clusters kubeconfig <reservation-id> [--output <path>] [--json]",
+    );
+    const credentials = await fetchClusterCredentials(reservationId, "kubernetes", context);
+    const kubeconfig = String(credentials?.kubeconfig || "");
+    if (!kubeconfig.trim()) {
+      throw new Error("Kubernetes kubeconfig is not ready yet.");
+    }
+    const outputPath = options.output ? expandUserPath(String(options.output)) : null;
+    if (outputPath) {
+      await writeFile(outputPath, kubeconfig.endsWith("\n") ? kubeconfig : `${kubeconfig}\n`, "utf8");
+    }
+    if (options.json) {
+      writeJson(context.stdout, { credentials, output: outputPath });
+    } else if (outputPath) {
+      context.stdout.write(`Kubeconfig written: ${outputPath}\n`);
+    } else {
+      context.stdout.write(kubeconfig.endsWith("\n") ? kubeconfig : `${kubeconfig}\n`);
+    }
+    return 0;
+  }
+
+  if (subcommand === "ssh-command" && reservationId) {
+    const options = parseCommandOptions(
+      [maybeNodeId, ...rest].filter(Boolean),
+      { boolean: ["json"], value: ["identity-file", "user"] },
+      "Usage: ornn clusters ssh-command <reservation-id> [--identity-file <path>] [--user <name>] [--json]",
+    );
+    const credentials = await fetchClusterCredentials(reservationId, "slurm", context);
+    const invocation = slurmSshInvocation(credentials, options);
+    if (!invocation) {
+      throw new Error("Slurm SSH login is not ready yet.");
+    }
+    const command = commandText(invocation);
+    if (options.json) {
+      writeJson(context.stdout, { command, credentials });
+    } else {
+      context.stdout.write(`${command}\n`);
+    }
+    return 0;
+  }
+
+  if (subcommand === "ssh" && reservationId) {
+    const options = parseCommandOptions(
+      [maybeNodeId, ...rest].filter(Boolean),
+      { boolean: ["json", "print"], value: ["identity-file", "user"] },
+      "Usage: ornn clusters ssh <reservation-id> [--print] [--identity-file <path>] [--user <name>] [--json]",
+    );
+    const credentials = await fetchClusterCredentials(reservationId, "slurm", context);
+    const invocation = slurmSshInvocation(credentials, options);
+    if (!invocation) {
+      throw new Error("Slurm SSH login is not ready yet.");
+    }
+    const command = commandText(invocation);
+    if (options.json) {
+      writeJson(context.stdout, { command, credentials });
+      return 0;
+    }
+    if (options.print) {
+      context.stdout.write(`${command}\n`);
+      return 0;
+    }
+    return await spawnCommand(invocation, context);
+  }
+
+  if ((subcommand === "add-node" || subcommand === "remove-node") && reservationId) {
+    const trailing = [maybeNodeId, ...rest].filter((item) => item !== undefined);
+    const nodeIdArg = trailing[0] && !trailing[0].startsWith("--") ? trailing.shift() : null;
+    const options = parseCommandOptions(
+      trailing,
+      { boolean: ["json"], value: ["node", "node-id"] },
+      `Usage: ornn clusters ${subcommand} <reservation-id> --node <node-id> [--json]`,
+    );
+    const nodeId = requiredOption(options.node || options.nodeId || nodeIdArg, "--node");
+    const cluster = subcommand === "add-node"
+      ? await addClusterNode(reservationId, nodeId, context)
+      : await removeClusterNode(reservationId, nodeId, context);
+    if (options.json) {
+      writeJson(context.stdout, cluster);
+    } else {
+      context.stdout.write(`Cluster node ${subcommand === "add-node" ? "add" : "remove"} queued.\n`);
+      writeClusterDetail(context.stdout, cluster);
+    }
+    return 0;
+  }
+
+  if (subcommand === "teardown" && reservationId) {
+    const options = parseCommandOptions(
+      [maybeNodeId, ...rest].filter(Boolean),
+      { boolean: ["json"], value: ["type", "mode"] },
+      "Usage: ornn clusters teardown <reservation-id> [--type kubernetes|slurm] [--json]",
+    );
+    const type = await resolveClusterTypeForReservation(reservationId, options, context);
+    const cluster = await teardownCluster(reservationId, type, context);
+    if (options.json) {
+      writeJson(context.stdout, cluster);
+    } else {
+      context.stdout.write(`${displayClusterType(type)} cluster teardown queued.\n`);
+      writeClusterDetail(context.stdout, cluster);
+    }
+    return 0;
+  }
+
+  if (subcommand === "create") {
+    throw new Error("Usage: ornn clusters create <reservation-id> --type kubernetes|slurm [--network public|private] [--node <node-id>] [--node-count <n>] [--wait] [--json]");
+  }
+
+  throw new Error("Usage: ornn clusters list|reservations|eligible-nodes|create|show|wait|credentials|kubeconfig|ssh-command|ssh|add-node|remove-node|teardown");
+}
+
+async function networks(args, context) {
+  const [subcommand = "list", id, ...rest] = args;
+
+  if (subcommand === "list") {
+    const options = parseCommandOptions(
+      [id, ...rest].filter(Boolean),
+      { boolean: ["json"] },
+      "Usage: ornn networks list [--json]",
+    );
+    const payload = await cliRequest({
+      endpoint: computeEndpoint("/networks"),
+      env: context.env,
+      fetchImpl: context.fetchImpl,
+    });
+    const rows = networksFromPayload(payload);
+    if (options.json) {
+      writeJson(context.stdout, payload);
+    } else {
+      writeNetworkList(context.stdout, rows);
+    }
+    return 0;
+  }
+
+  if (subcommand === "show" && id) {
+    const options = parseCommandOptions(
+      rest,
+      { boolean: ["json"] },
+      "Usage: ornn networks show <network-id> [--json]",
+    );
+    const network = await cliRequest({
+      endpoint: computeEndpoint(`/networks/${encodeURIComponent(id)}`),
+      env: context.env,
+      fetchImpl: context.fetchImpl,
+    });
+    if (options.json) {
+      writeJson(context.stdout, network);
+    } else {
+      writeNetworkDetail(context.stdout, network);
+    }
+    return 0;
+  }
+
+  if (subcommand === "create") {
+    const options = parseCommandOptions(
+      [id, ...rest].filter(Boolean),
+      { boolean: ["json"], value: ["cidr", "description", "name"] },
+      "Usage: ornn networks create --name <name> [--cidr <cidr>] [--description <text>] [--json]",
+    );
+    const payload = {
+      cidr: optionalStringOption(options.cidr),
+      description: optionalStringOption(options.description),
+      name: requiredOption(options.name, "--name"),
+    };
+    const created = await cliRequest({
+      body: payload,
+      endpoint: computeEndpoint("/networks"),
+      env: context.env,
+      fetchImpl: context.fetchImpl,
+      method: "POST",
+    });
+    const network = networkFromMutationPayload(created);
+    if (options.json) {
+      writeJson(context.stdout, created);
+    } else {
+      context.stdout.write("Network created.\n");
+      writeNetworkDetail(context.stdout, network);
+    }
+    return 0;
+  }
+
+  if (subcommand === "update" && id) {
+    const options = parseCommandOptions(
+      rest,
+      { boolean: ["clear-description", "json"], value: ["description", "name"] },
+      "Usage: ornn networks update <network-id> [--name <name>] [--description <text>] [--clear-description] [--json]",
+    );
+    if (options.clearDescription && optionProvided(options.description)) {
+      throw new Error("Use either --description or --clear-description, not both.");
+    }
+    const payload = {};
+    if (optionProvided(options.name)) {
+      payload.name = requiredOption(options.name, "--name");
+    }
+    if (options.clearDescription) {
+      payload.description = null;
+    } else if (optionProvided(options.description)) {
+      payload.description = optionalStringOption(options.description);
+    }
+    if (!Object.keys(payload).length) {
+      throw new Error("Provide --name, --description, or --clear-description.");
+    }
+    const updated = await cliRequest({
+      body: payload,
+      endpoint: computeEndpoint(`/networks/${encodeURIComponent(id)}`),
+      env: context.env,
+      fetchImpl: context.fetchImpl,
+      method: "PATCH",
+    });
+    const network = networkFromMutationPayload(updated);
+    if (options.json) {
+      writeJson(context.stdout, updated);
+    } else {
+      context.stdout.write("Network updated.\n");
+      writeNetworkDetail(context.stdout, network);
+    }
+    return 0;
+  }
+
+  if (subcommand === "delete" && id) {
+    const options = parseCommandOptions(
+      rest,
+      { boolean: ["json"] },
+      "Usage: ornn networks delete <network-id> [--json]",
+    );
+    await cliRequest({
+      endpoint: computeEndpoint(`/networks/${encodeURIComponent(id)}`),
+      env: context.env,
+      fetchImpl: context.fetchImpl,
+      method: "DELETE",
+    });
+    const result = { deleted: true, network_id: id };
+    if (options.json) {
+      writeJson(context.stdout, result);
+    } else {
+      context.stdout.write(`Network deleted: ${id}\n`);
+    }
+    return 0;
+  }
+
+  if (subcommand === "reservation" && id) {
+    const options = parseCommandOptions(
+      rest,
+      { boolean: ["json"] },
+      "Usage: ornn networks reservation <reservation-id> [--json]",
+    );
+    const payload = await cliRequest({
+      endpoint: computeEndpoint(`/standalone-vms/reservations/${encodeURIComponent(id)}/network`),
+      env: context.env,
+      fetchImpl: context.fetchImpl,
+    });
+    if (options.json) {
+      writeJson(context.stdout, payload);
+    } else {
+      writeReservationNetwork(context.stdout, payload);
+    }
+    return 0;
+  }
+
+  if (subcommand === "attach" && id) {
+    const options = parseCommandOptions(
+      rest,
+      { boolean: ["json"], value: ["network", "network-id"] },
+      "Usage: ornn networks attach <reservation-id> --network <network-id> [--json]",
+    );
+    const networkId = requiredOption(options.network || options.networkId, "--network");
+    const payload = await cliRequest({
+      body: { tenant_network_id: networkId },
+      endpoint: computeEndpoint(`/standalone-vms/reservations/${encodeURIComponent(id)}/network`),
+      env: context.env,
+      fetchImpl: context.fetchImpl,
+      method: "POST",
+    });
+    if (options.json) {
+      writeJson(context.stdout, payload);
+    } else {
+      context.stdout.write("Reservation network attached.\n");
+      writeReservationNetwork(context.stdout, payload);
+    }
+    return 0;
+  }
+
+  if (subcommand === "detach" && id) {
+    const options = parseCommandOptions(
+      rest,
+      { boolean: ["json"] },
+      "Usage: ornn networks detach <reservation-id> [--json]",
+    );
+    const payload = await cliRequest({
+      body: { tenant_network_id: null },
+      endpoint: computeEndpoint(`/standalone-vms/reservations/${encodeURIComponent(id)}/network`),
+      env: context.env,
+      fetchImpl: context.fetchImpl,
+      method: "POST",
+    });
+    if (options.json) {
+      writeJson(context.stdout, payload);
+    } else {
+      context.stdout.write("Reservation network detached.\n");
+      writeReservationNetwork(context.stdout, payload);
+    }
+    return 0;
+  }
+
+  throw new Error("Usage: ornn networks list|show|create|update|delete|reservation|attach|detach");
+}
+
+async function storage(args, context) {
+  const [resource = "volumes", subcommand = "list", id, ...rest] = args;
+  if (!["drives", "volumes"].includes(resource)) {
+    throw new Error("Usage: ornn storage volumes list|show|create|refresh|clear|delete");
+  }
+
+  if (subcommand === "list") {
+    const options = parseCommandOptions(
+      [id, ...rest].filter(Boolean),
+      { boolean: ["json"] },
+      "Usage: ornn storage volumes list [--json]",
+    );
+    const payload = await fetchStorageDrives(context);
+    if (options.json) {
+      writeJson(context.stdout, payload);
+    } else {
+      writeStorageDriveList(context.stdout, storageDrivesFromPayload(payload));
+    }
+    return 0;
+  }
+
+  if (subcommand === "show" && id) {
+    const options = parseCommandOptions(
+      rest,
+      { boolean: ["json"] },
+      "Usage: ornn storage volumes show <drive-id> [--json]",
+    );
+    const drive = await findStorageDrive(id, context);
+    if (options.json) {
+      writeJson(context.stdout, drive);
+    } else {
+      writeStorageDriveDetail(context.stdout, drive);
+    }
+    return 0;
+  }
+
+  if (subcommand === "create") {
+    const options = parseCommandOptions(
+      [id, ...rest].filter(Boolean),
+      { boolean: ["json"], value: ["name", "source", "source-drive-id"] },
+      "Usage: ornn storage volumes create --name <name> [--source <drive-id>] [--json]",
+    );
+    const sourceDriveId = optionProvided(options.sourceDriveId)
+      ? requiredOption(options.sourceDriveId, "--source-drive-id")
+      : optionalStringOption(options.source);
+    const drive = await cliRequest({
+      body: {
+        name: requiredOption(options.name, "--name"),
+        source_drive_id: sourceDriveId,
+      },
+      endpoint: computeEndpoint("/standalone-vms/storage-drives"),
+      env: context.env,
+      fetchImpl: context.fetchImpl,
+      method: "POST",
+    });
+    if (options.json) {
+      writeJson(context.stdout, drive);
+    } else {
+      context.stdout.write("Storage volume created.\n");
+      writeStorageDriveDetail(context.stdout, drive);
+    }
+    return 0;
+  }
+
+  if (subcommand === "refresh" && id) {
+    const options = parseCommandOptions(
+      rest,
+      { boolean: ["json"] },
+      "Usage: ornn storage volumes refresh <drive-id> [--json]",
+    );
+    const drive = await cliRequest({
+      endpoint: computeEndpoint(`/standalone-vms/storage-drives/${encodeURIComponent(id)}/refresh`),
+      env: context.env,
+      fetchImpl: context.fetchImpl,
+      method: "POST",
     });
-    writeMutationWithOpen(context.stdout, reservation, opened, options, "Resale listing");
+    if (options.json) {
+      writeJson(context.stdout, drive);
+    } else {
+      context.stdout.write("Storage volume refreshed.\n");
+      writeStorageDriveDetail(context.stdout, drive);
+    }
     return 0;
   }
 
-  if (subcommand === "delist" && reservationId) {
+  if (subcommand === "clear" && id) {
     const options = parseCommandOptions(
       rest,
-      { boolean: ["json", "no-open"] },
-      "Usage: ornn resale delist <reservation-id> [--no-open] [--json]",
+      { boolean: ["json"] },
+      "Usage: ornn storage volumes clear <drive-id> [--json]",
     );
-    const reservation = await cliRequest({
-      endpoint: computeEndpoint(`/tenants/me/reservations/${reservationId}/delist`),
+    await cliRequest({
+      endpoint: computeEndpoint(`/standalone-vms/storage-drives/${encodeURIComponent(id)}/contents`),
       env: context.env,
       fetchImpl: context.fetchImpl,
-      method: "POST",
+      method: "DELETE",
     });
-    const opened = await openFabricPage(context, `/portfolio/${encodeURIComponent(reservationId)}`, {
-      label: "reservation",
-      noOpen: options.noOpen,
+    const result = { cleared: true, drive_id: id };
+    if (options.json) {
+      writeJson(context.stdout, result);
+    } else {
+      context.stdout.write(`Storage volume cleared: ${id}\n`);
+    }
+    return 0;
+  }
+
+  if (subcommand === "delete" && id) {
+    const options = parseCommandOptions(
+      rest,
+      { boolean: ["json"] },
+      "Usage: ornn storage volumes delete <drive-id> [--json]",
+    );
+    await cliRequest({
+      endpoint: computeEndpoint(`/standalone-vms/storage-drives/${encodeURIComponent(id)}`),
+      env: context.env,
+      fetchImpl: context.fetchImpl,
+      method: "DELETE",
+    });
+    const result = { deleted: true, drive_id: id };
+    if (options.json) {
+      writeJson(context.stdout, result);
+    } else {
+      context.stdout.write(`Storage volume deleted: ${id}\n`);
+    }
+    return 0;
+  }
+
+  throw new Error("Usage: ornn storage volumes list|show|create|refresh|clear|delete");
+}
+
+async function keys(args, context) {
+  const [subcommand = "list", maybePath, ...rest] = args;
+  if (subcommand === "add" && maybePath && !maybePath.startsWith("--")) {
+    const options = parseCommandOptions(
+      rest,
+      { boolean: ["json"], value: ["label", "public-key", "public-key-file"] },
+      "Usage: ornn keys add [<public-key-file>] [--public-key <key>] [--label <label>] [--json]",
+    );
+    const publicKey = await publicKeyFromRef(maybePath);
+    const key = await ensureAccountSshKey(publicKey, options.label, context);
+    if (options.json) {
+      writeJson(context.stdout, key);
+    } else {
+      context.stdout.write("SSH key saved.\n");
+      if (key?.id) {
+        context.stdout.write(`Key: ${key.id}\n`);
+      }
+    }
+    return 0;
+  }
+  return await sshKeys(args, context);
+}
+
+async function nodeKeys(args, context) {
+  const [action, nodeId, ...rest] = args;
+  if (!action || !nodeId) {
+    throw new Error("Usage: ornn nodes keys list|attach|push|status <node-id>");
+  }
+
+  if (action === "list" || action === "status") {
+    const options = parseCommandOptions(
+      rest,
+      { boolean: ["json"] },
+      `Usage: ornn nodes keys ${action} <node-id> [--json]`,
+    );
+    const machine = await fetchMachine(nodeId, context);
+    const status = nodeKeyStatus(machine);
+    if (options.json) {
+      writeJson(context.stdout, status);
+    } else {
+      writeNodeKeyStatus(context.stdout, status);
+    }
+    return 0;
+  }
+
+  if (action === "attach" || action === "push") {
+    const options = parseCommandOptions(
+      rest,
+      {
+        boolean: ["json"],
+        value: ["key", "key-id", "label", "public-key", "public-key-file", "request-id", "ssh-key-id"],
+      },
+      `Usage: ornn nodes keys ${action} <node-id> --key <path|id|label> [--json]`,
+    );
+    const sshKeyIds = await resolveAccountSshKeyIds(options, context);
+    if (!sshKeyIds.length) {
+      throw new Error("--key is required.");
+    }
+    const machine = await pushNodeKeys(nodeId, sshKeyIds, options.requestId, context);
+    if (options.json) {
+      writeJson(context.stdout, { machine, ssh_key_ids: sshKeyIds });
+    } else {
+      context.stdout.write(`SSH key update queued for node ${machineId(machine)}.\n`);
+      writeNodeDetail(context.stdout, machine);
+    }
+    return 0;
+  }
+
+  throw new Error("Usage: ornn nodes keys list|attach|push|status <node-id>");
+}
+
+async function access(args, context) {
+  const [subcommand, ...subcommandArgs] = args;
+  if (subcommand === "keys") {
+    return await accessKeys(subcommandArgs, context);
+  }
+
+  const [reservationId, ...rest] = subcommandArgs;
+  if (!subcommand || !reservationId) {
+    throw new Error("Usage: ornn access show|activate|push-keys|keys <reservation-id>");
+  }
+
+  if (subcommand === "show") {
+    const options = parseCommandOptions(
+      rest,
+      { boolean: ["json"] },
+      "Usage: ornn access show <reservation-id> [--json]",
+    );
+    const payload = await getReservationMachines(reservationId, context);
+    if (options.json) {
+      writeJson(context.stdout, payload);
+    } else {
+      writeAccessDetail(context.stdout, payload);
+    }
+    return 0;
+  }
+
+  if (subcommand === "activate") {
+    const options = parseCommandOptions(
+      rest,
+      {
+        boolean: ["json", "no-open", "wait"],
+        value: [
+          "key",
+          "key-id",
+          "label",
+          "machine-count",
+          "mode",
+          "network",
+          "network-mode",
+          "public-key",
+          "public-key-file",
+          "request-id",
+          "ssh-key-id",
+          "storage-load-drive-id",
+          "storage-save-drive-id",
+          "tenant-username",
+          "username",
+          "wait-interval",
+          "wait-timeout",
+        ],
+      },
+      "Usage: ornn access activate <reservation-id> --key <path|id|label> [--mode bare-metal|vm] [--username <name>] [--network public|private] [--storage-load-drive-id <id>] [--storage-save-drive-id <id>] [--no-open] [--json]",
+    );
+    const result = await launchReservationAccess(reservationId, options, context, { openDefault: true });
+    if (options.json) {
+      writeJson(context.stdout, accessActivateJsonResult(result));
+    } else {
+      context.stdout.write(`${displayAccessMode(result.mode)} access activation queued\n`);
+      writeAccessLaunchSummary(context.stdout, result.launch);
+      if (result.wait) {
+        writeWaitResult(context.stdout, result.wait);
+      }
+      if (result.opened) {
+        writeCheckoutOpenResult(context.stdout, result.opened, "Reservation page");
+      }
+    }
+    return 0;
+  }
+
+  if (subcommand === "push-keys") {
+    const options = parseCommandOptions(
+      rest,
+      { boolean: ["json"], value: ["request-id", "ssh-key-id"] },
+      "Usage: ornn access push-keys <reservation-id> --ssh-key-id <id> [--json]",
+    );
+    const sshKeyIds = requiredArrayOption(options.sshKeyId, "--ssh-key-id");
+    const pushed = await pushReservationKeys(reservationId, sshKeyIds, options.requestId, context);
+    if (options.json) {
+      writeJson(context.stdout, { machines: pushed });
+    } else {
+      context.stdout.write(`SSH key update queued for ${pushed.length} machine${pushed.length === 1 ? "" : "s"}.\n`);
+    }
+    return 0;
+  }
+
+  throw new Error(`Unsupported access action: ${subcommand}`);
+}
+
+async function accessKeys(args, context) {
+  const [action, reservationId, ...rest] = args;
+  if (!action || !reservationId) {
+    throw new Error("Usage: ornn access keys list|add|push|status <reservation-id>");
+  }
+
+  if (action === "list") {
+    const options = parseCommandOptions(
+      rest,
+      { boolean: ["json"] },
+      "Usage: ornn access keys list <reservation-id> [--json]",
+    );
+    const payload = await fetchReservationSshKeys(reservationId, context);
+    if (options.json) {
+      writeJson(context.stdout, payload);
+    } else {
+      writeReservationSshKeyList(context.stdout, sshKeysFromPayload(payload), reservationId);
+    }
+    return 0;
+  }
+
+  if (action === "add") {
+    const options = parseCommandOptions(
+      rest,
+      { boolean: ["json"], value: ["label", "public-key", "public-key-file"] },
+      "Usage: ornn access keys add <reservation-id> --public-key <key> [--label <label>] [--json]",
+    );
+    const publicKey = options.publicKeyFile
+      ? (await readFile(options.publicKeyFile, "utf8")).trim()
+      : requiredOption(options.publicKey, "--public-key");
+    const key = await cliRequest({
+      body: {
+        label: options.label || null,
+        public_key: publicKey,
+      },
+      endpoint: reservationSshKeysEndpoint(reservationId),
+      env: context.env,
+      fetchImpl: context.fetchImpl,
+      method: "POST",
     });
-    writeMutationWithOpen(context.stdout, reservation, opened, options, "Reservation");
+    if (options.json) {
+      writeJson(context.stdout, key);
+    } else {
+      context.stdout.write("Reservation SSH key added.\n");
+      context.stdout.write(`Reservation: ${reservationId}\n`);
+      if (key?.id) {
+        context.stdout.write(`Key: ${key.id}\n`);
+      }
+    }
+    return 0;
+  }
+
+  if (action === "push") {
+    const options = parseCommandOptions(
+      rest,
+      { boolean: ["json"], value: ["request-id", "ssh-key-id"] },
+      "Usage: ornn access keys push <reservation-id> --ssh-key-id <id> [--json]",
+    );
+    const sshKeyIds = requiredArrayOption(options.sshKeyId, "--ssh-key-id");
+    const pushed = await pushReservationKeys(reservationId, sshKeyIds, options.requestId, context);
+    if (options.json) {
+      writeJson(context.stdout, { machines: pushed });
+    } else {
+      context.stdout.write(`SSH key update queued for ${pushed.length} machine${pushed.length === 1 ? "" : "s"}.\n`);
+    }
+    return 0;
+  }
+
+  if (action === "status") {
+    const options = parseCommandOptions(
+      rest,
+      { boolean: ["json"] },
+      "Usage: ornn access keys status <reservation-id> [--json]",
+    );
+    const status = await buildReservationKeyStatus(reservationId, context);
+    if (options.json) {
+      writeJson(context.stdout, status);
+    } else {
+      writeReservationKeyStatus(context.stdout, status);
+    }
     return 0;
   }
 
-  throw new Error("Usage: ornn resale browse|list|update|delist");
+  throw new Error("Usage: ornn access keys list|add|push|status <reservation-id>");
 }
 
 async function billing(args, context) {
   const [subcommand = "open", ...rest] = args;
+  if (subcommand === "summary") {
+    const options = parseCommandOptions(
+      rest,
+      { boolean: ["json"] },
+      "Usage: ornn billing summary [--json]",
+    );
+    const invoices = await fetchBillingInvoices(context);
+    const summary = billingSummaryFromInvoices(invoices);
+    if (options.json) {
+      writeJson(context.stdout, summary);
+    } else {
+      writeBillingSummary(context.stdout, summary);
+    }
+    return 0;
+  }
+
+  if (subcommand === "invoices") {
+    const options = parseCommandOptions(
+      rest,
+      { boolean: ["json"] },
+      "Usage: ornn billing invoices [--json]",
+    );
+    const invoices = await fetchBillingInvoices(context);
+    if (options.json) {
+      writeJson(context.stdout, invoices);
+    } else {
+      writeInvoiceList(context.stdout, invoices);
+    }
+    return 0;
+  }
+
+  if (subcommand === "showback") {
+    const options = parseCommandOptions(
+      rest,
+      { boolean: ["json"], value: ["end", "start"] },
+      "Usage: ornn billing showback --start <yyyy-mm-dd> --end <yyyy-mm-dd> [--json]",
+    );
+    const { endDate, startDate } = dateRangeOptions({
+      endDate: options.end,
+      startDate: options.start,
+    });
+    const report = await cliRequest({
+      endpoint: computeEndpoint(`/tenants/me/showback${buildQuery({ end: endDate, start: startDate })}`),
+      env: context.env,
+      fetchImpl: context.fetchImpl,
+    });
+    if (options.json) {
+      writeJson(context.stdout, report);
+    } else {
+      writeShowbackReport(context.stdout, report);
+    }
+    return 0;
+  }
+
   if (subcommand === "open") {
     const options = parseCommandOptions(
       rest,
@@ -1128,7 +2283,7 @@ async function billing(args, context) {
     }
     return 0;
   }
-  throw new Error("Usage: ornn billing open [--no-open] [--json]");
+  throw new Error("Usage: ornn billing summary|invoices|showback|open");
 }
 
 async function sshKeys(args, context) {
@@ -1206,21 +2361,11 @@ async function sshKeys(args, context) {
 }
 
 async function loadAvailabilityListings(context) {
-  const [inventoryRecords, resaleReservations] = await Promise.all([
-    fetchInventoryList(context),
-    fetchResaleListings(context),
-  ]);
-  const inventoryById = new Map(inventoryRecords.map((record) => [record.id, record]));
-  const primaryListings = inventoryRecords
+  const inventoryRecords = await fetchInventoryList(context);
+  return inventoryRecords
     .filter((record) => isTermEndDateActive(record.available_to))
     .filter((record) => inventoryAvailableGpuCount(record) > 0)
     .map(normalizeInventoryListing);
-  const resaleListings = resaleReservations
-    .filter((reservation) => reservation.is_marketplace_listed !== false)
-    .filter((reservation) => reservation.ask_price_per_gpu_hour !== undefined && reservation.ask_price_per_gpu_hour !== null)
-    .filter((reservation) => isTermEndDateActive(reservation.end_date))
-    .map((reservation) => normalizeResaleListing(reservation, inventoryById.get(reservation.deployment_id) ?? null));
-  return [...primaryListings, ...resaleListings];
 }
 
 async function fetchInventoryList(context) {
@@ -1234,22 +2379,12 @@ async function fetchInventoryList(context) {
 }
 
 async function fetchInventory(id, context) {
-  return await cliRequest({
-    authRequired: false,
-    endpoint: computeEndpoint(`/inventory/${encodeURIComponent(id)}`),
-    env: context.env,
-    fetchImpl: context.fetchImpl,
-  });
-}
-
-async function fetchResaleListings(context) {
-  const payload = await cliRequest({
+  return await cliRequest({
     authRequired: false,
-    endpoint: computeEndpoint("/marketplace/resale-listings"),
+    endpoint: computeEndpoint(`/inventory/${encodeURIComponent(id)}`),
     env: context.env,
     fetchImpl: context.fetchImpl,
   });
-  return requireArrayPayload(payload, "resale listings");
 }
 
 function requireArrayPayload(payload, label) {
@@ -1301,30 +2436,6 @@ function normalizeInventoryListing(record) {
   };
 }
 
-function normalizeResaleListing(reservation, inventory) {
-  const id = `resale-${reservation.id}`;
-  return {
-    id,
-    kind: "resale",
-    source: "resale",
-    reservation_id: reservation.id,
-    seller_tenant_id: reservation.tenant_id ?? null,
-    gpu_type: inventory?.gpu_type ?? reservation.gpu_type ?? "GPU",
-    gpu_count: reservation.gpu_count ?? null,
-    operator: inventory?.site_operator ?? "Resale",
-    facility: inventory?.site_nickname ?? "Resale",
-    location: inventory?.location ?? inventory?.region ?? null,
-    network: inventory?.fabric_type ?? inventory?.network_hardware ?? inventory?.internet ?? null,
-    start_date: reservation.start_date ?? null,
-    end_date: reservation.end_date ?? null,
-    price_per_gpu_hour: reservation.ask_price_per_gpu_hour ?? null,
-    checkout_url: `/checkout?inventory=${encodeURIComponent(id)}`,
-    marketplace_url: `/marketplace/${encodeURIComponent(id)}`,
-    inventory,
-    reservation,
-  };
-}
-
 function isTermEndDateActive(endDate, today = new Date()) {
   if (!endDate) {
     return true;
@@ -1367,18 +2478,6 @@ function textMatches(value, filter) {
 }
 
 async function resolveListing(listingId, context) {
-  if (listingId.startsWith("resale-")) {
-    const reservationId = listingId.replace(/^resale-/, "");
-    const listings = await loadAvailabilityListings(context);
-    const listing = listings.find(
-      (candidate) => candidate.id === listingId || candidate.reservation_id === reservationId,
-    );
-    if (!listing) {
-      throw new Error(`Listing not found: ${listingId}`);
-    }
-    return listing;
-  }
-
   const inventory = await fetchInventory(listingId, context);
   if (!isTermEndDateActive(inventory.available_to)) {
     throw new Error(`Listing is no longer available: ${listingId}`);
@@ -1438,10 +2537,10 @@ function writeCheckoutOpenResult(stdout, result, label) {
 
 function writeAvailabilityList(stdout, listings) {
   if (!listings.length) {
-    stdout.write("No available bare-metal compute found.\n");
+    stdout.write("No listings match your filters.\n");
     return;
   }
-  stdout.write("Available bare-metal compute:\n");
+  stdout.write("Listings:\n");
   for (const listing of listings) {
     stdout.write(`- ${listing.id} [${listing.source}] ${formatGpuSummary(listing)}`);
     stdout.write(` at ${listing.operator} / ${listing.facility}`);
@@ -1470,7 +2569,7 @@ function writeAvailabilityDetail(stdout, listing) {
     stdout.write(`Price: ${formatUsd(listing.price_per_gpu_hour)}/GPU-hr\n`);
   }
   stdout.write(`Checkout: ${listing.checkout_url}\n`);
-  stdout.write(`Marketplace: ${listing.marketplace_url}\n`);
+  stdout.write(`Exchange: ${listing.marketplace_url}\n`);
 }
 
 function formatGpuSummary(record) {
@@ -1491,6 +2590,30 @@ function formatUsd(value) {
   return `$${numeric.toFixed(2)}`;
 }
 
+function formatCents(value, currency = "usd") {
+  const numeric = Number(value || 0);
+  const amount = Number.isFinite(numeric) ? numeric / 100 : 0;
+  const currencyCode = String(currency || "usd");
+  const prefix = currencyCode.toLowerCase() === "usd" ? "$" : `${currencyCode.toUpperCase()} `;
+  return `${prefix}${amount.toFixed(2)}`;
+}
+
+function formatBytes(value) {
+  const numeric = Number(value || 0);
+  if (!Number.isFinite(numeric) || numeric <= 0) {
+    return "Empty";
+  }
+  const units = ["B", "KB", "MB", "GB", "TB", "PB"];
+  let scaled = numeric;
+  let unitIndex = 0;
+  while (scaled >= 1024 && unitIndex < units.length - 1) {
+    scaled /= 1024;
+    unitIndex += 1;
+  }
+  const digits = scaled >= 10 || unitIndex === 0 ? 0 : 1;
+  return `${scaled.toFixed(digits)} ${units[unitIndex]}`;
+}
+
 async function findBid(id, context) {
   const bids = await cliRequest({
     endpoint: computeEndpoint("/tenants/me/bids"),
@@ -1509,7 +2632,7 @@ function writeBidList(stdout, bids) {
     stdout.write("No bids found.\n");
     return;
   }
-  stdout.write("Bids:\n");
+  stdout.write("Exchange bids:\n");
   for (const bid of bids) {
     stdout.write(`- ${bid.id} ${bid.status || "unknown"} ${bid.gpu_count ?? "?"} GPUs`);
     stdout.write(` ${bid.start_date || "TBD"} to ${bid.end_date || "TBD"}`);
@@ -1523,7 +2646,7 @@ function writeBidList(stdout, bids) {
 function writeBidDetail(stdout, bid) {
   stdout.write(`${bid.id}\n`);
   stdout.write(`Status: ${bid.status || "unknown"}\n`);
-  stdout.write(`Deployment: ${bid.deployment_id || "unknown"}\n`);
+  stdout.write(`Listing: ${bid.deployment_id || "unknown"}\n`);
   stdout.write(`GPU count: ${bid.gpu_count ?? "unknown"}\n`);
   stdout.write(`Minimum GPU count: ${bid.min_gpu_count ?? bid.gpu_count ?? "unknown"}\n`);
   stdout.write(`Term: ${formatDateRange(bid.start_date, bid.end_date)}\n`);
@@ -1548,10 +2671,10 @@ async function findReservation(id, context) {
 
 function writeReservationList(stdout, reservations) {
   if (!reservations.length) {
-    stdout.write("No reservations found.\n");
+    stdout.write("No GPU reservations found.\n");
     return;
   }
-  stdout.write("Reservations:\n");
+  stdout.write("GPU reservations:\n");
   for (const reservation of reservations) {
     stdout.write(`- ${reservation.id} ${reservation.status || "unknown"} ${reservation.gpu_count ?? "?"} GPUs`);
     stdout.write(` ${reservation.start_date || "TBD"} to ${reservation.end_date || "TBD"}`);
@@ -1565,15 +2688,12 @@ function writeReservationList(stdout, reservations) {
 function writeReservationDetail(stdout, reservation) {
   stdout.write(`${reservation.id}\n`);
   stdout.write(`Status: ${reservation.status || "unknown"}\n`);
-  stdout.write(`Deployment: ${reservation.deployment_id || "unknown"}\n`);
+  stdout.write(`Listing: ${reservation.deployment_id || "unknown"}\n`);
   stdout.write(`GPU count: ${reservation.gpu_count ?? "unknown"}\n`);
   stdout.write(`Term: ${formatDateRange(reservation.start_date, reservation.end_date)}\n`);
   if (reservation.price_per_gpu_hour !== undefined && reservation.price_per_gpu_hour !== null) {
     stdout.write(`Price: ${formatUsd(reservation.price_per_gpu_hour)}/GPU-hr\n`);
   }
-  if (reservation.is_marketplace_listed) {
-    stdout.write(`Resale listing: /marketplace/resale-${encodeURIComponent(reservation.id)}\n`);
-  }
   if (reservation.status === "pending_payment") {
     stdout.write(`Checkout: /checkout?reservation=${encodeURIComponent(reservation.id)}\n`);
   }
@@ -1588,6 +2708,32 @@ async function getReservationMachines(reservationId, context) {
   return Array.isArray(payload) ? { machines: payload } : payload;
 }
 
+async function fetchBillingInvoices(context) {
+  const payload = await cliRequest({
+    endpoint: computeEndpoint("/tenants/me/invoices"),
+    env: context.env,
+    fetchImpl: context.fetchImpl,
+  });
+  return Array.isArray(payload) ? payload : [];
+}
+
+async function fetchStorageDrives(context) {
+  return await cliRequest({
+    endpoint: computeEndpoint("/standalone-vms/storage-drives"),
+    env: context.env,
+    fetchImpl: context.fetchImpl,
+  });
+}
+
+async function findStorageDrive(driveId, context) {
+  const payload = await fetchStorageDrives(context);
+  const drive = storageDrivesFromPayload(payload).find((item) => String(item.id) === String(driveId));
+  if (!drive) {
+    throw new Error(`Storage volume not found: ${driveId}`);
+  }
+  return drive;
+}
+
 function reservationSshKeysEndpoint(reservationId) {
   return computeEndpoint(`/standalone-vms/reservations/${reservationId}/ssh-keys`);
 }
@@ -1600,6 +2746,590 @@ async function fetchReservationSshKeys(reservationId, context) {
   });
 }
 
+async function launchReservationAccess(reservationId, options, context, { openDefault = false } = {}) {
+  const mode = normalizeAccessMode(options.mode || "bare-metal");
+  const networkOption = optionProvided(options.networkMode) ? options.networkMode : options.network;
+  const sshKeyIds = await resolveAccountSshKeyIds(options, context);
+  if (!sshKeyIds.length) {
+    throw new Error("--key is required.");
+  }
+  const launchPayload = {
+    image_id: null,
+    machine_count: optionProvided(options.machineCount)
+      ? positiveIntegerOption(options.machineCount, "--machine-count")
+      : 1,
+    machine_type: null,
+    request_id: options.requestId || null,
+    ssh_key_ids: sshKeyIds,
+    tenant_username: options.username || options.tenantUsername || null,
+    zone: null,
+  };
+  if (optionProvided(networkOption)) {
+    launchPayload.network_mode = normalizeNodeNetwork(networkOption);
+  }
+  if (optionProvided(options.storageLoadDriveId)) {
+    launchPayload.storage_load_drive_id = requiredOption(options.storageLoadDriveId, "--storage-load-drive-id");
+  }
+  if (optionProvided(options.storageSaveDriveId)) {
+    launchPayload.storage_save_drive_id = requiredOption(options.storageSaveDriveId, "--storage-save-drive-id");
+  }
+  const access = await cliRequest({
+    body: { access_mode: mode, image_id: null },
+    endpoint: computeEndpoint(`/tenants/me/reservations/${reservationId}/access-mode`),
+    env: context.env,
+    fetchImpl: context.fetchImpl,
+    method: "POST",
+  });
+  const launch = await cliRequest({
+    body: launchPayload,
+    endpoint: computeEndpoint(`/standalone-vms/reservations/${reservationId}/launch`),
+    env: context.env,
+    fetchImpl: context.fetchImpl,
+    method: "POST",
+  });
+  const opened = openDefault || options.open
+    ? await openFabricPage(context, `/portfolio/${encodeURIComponent(reservationId)}`, {
+        label: "reservation",
+        noOpen: Boolean(options.noOpen),
+      })
+    : null;
+  const wait = options.wait ? await waitForSshReady(reservationId, waitOptions(options), context) : null;
+  return {
+    access,
+    launch,
+    mode,
+    opened,
+    reservation_id: reservationId,
+    ssh_key_ids: sshKeyIds,
+    wait,
+  };
+}
+
+function accessActivateJsonResult(result) {
+  return {
+    access: result.access,
+    launch: result.launch,
+    opened: Boolean(result.opened?.opened),
+    url: result.opened?.url ?? null,
+  };
+}
+
+async function fetchTenantClusters(context) {
+  return await cliRequest({
+    endpoint: computeEndpoint("/clusters"),
+    env: context.env,
+    fetchImpl: context.fetchImpl,
+  });
+}
+
+async function fetchEligibleClusterNodes(reservationId, type, networkMode, context) {
+  return await cliRequest({
+    endpoint: computeEndpoint(
+      `/clusters/reservations/${encodeURIComponent(reservationId)}/eligible-nodes?access_mode=${encodeURIComponent(type)}&network_mode=${encodeURIComponent(networkMode)}`,
+    ),
+    env: context.env,
+    fetchImpl: context.fetchImpl,
+  });
+}
+
+async function fetchCluster(reservationId, type, context) {
+  return await cliRequest({
+    endpoint: computeEndpoint(clusterEndpoint(type, reservationId, "cluster")),
+    env: context.env,
+    fetchImpl: context.fetchImpl,
+  });
+}
+
+async function fetchClusterCredentials(reservationId, type, context) {
+  return await cliRequest({
+    endpoint: computeEndpoint(clusterEndpoint(type, reservationId, "credentials")),
+    env: context.env,
+    fetchImpl: context.fetchImpl,
+  });
+}
+
+async function launchCluster(reservationId, type, options, context) {
+  return await cliRequest({
+    body: clusterLaunchPayload(options),
+    endpoint: computeEndpoint(clusterEndpoint(type, reservationId, "cluster/launch")),
+    env: context.env,
+    fetchImpl: context.fetchImpl,
+    method: "POST",
+  });
+}
+
+async function teardownCluster(reservationId, type, context) {
+  return await cliRequest({
+    endpoint: computeEndpoint(clusterEndpoint(type, reservationId, "cluster/teardown")),
+    env: context.env,
+    fetchImpl: context.fetchImpl,
+    method: "POST",
+  });
+}
+
+async function addClusterNode(reservationId, nodeId, context) {
+  return await cliRequest({
+    body: { node_id: nodeId },
+    endpoint: computeEndpoint(`/clusters/reservations/${encodeURIComponent(reservationId)}/cluster/nodes`),
+    env: context.env,
+    fetchImpl: context.fetchImpl,
+    method: "POST",
+  });
+}
+
+async function removeClusterNode(reservationId, nodeId, context) {
+  return await cliRequest({
+    endpoint: computeEndpoint(
+      `/clusters/reservations/${encodeURIComponent(reservationId)}/cluster/nodes/${encodeURIComponent(nodeId)}`,
+    ),
+    env: context.env,
+    fetchImpl: context.fetchImpl,
+    method: "DELETE",
+  });
+}
+
+async function resolveClusterTypeForReservation(reservationId, options, context) {
+  if (options.type || options.mode) {
+    return normalizeClusterType(options.type || options.mode);
+  }
+  const clusters = requireArrayPayload(await fetchTenantClusters(context), "clusters");
+  const cluster = clusters.find((candidate) => String(candidate.reservation_id || "") === String(reservationId));
+  if (cluster?.access_mode) {
+    return normalizeClusterType(cluster.access_mode);
+  }
+  throw new Error("--type is required when the cluster is not listed yet.");
+}
+
+async function waitForClusterActive(reservationId, type, options, context) {
+  const deadline = Date.now() + options.timeoutSeconds * 1000;
+  let lastCluster = null;
+  let lastError = null;
+  for (;;) {
+    try {
+      const cluster = await fetchCluster(reservationId, type, context);
+      lastError = null;
+      lastCluster = cluster;
+      const state = String(cluster?.state || "").toLowerCase();
+      if (state === "active") {
+        return {
+          cluster,
+          ready: true,
+          reservation_id: reservationId,
+          type,
+        };
+      }
+      if (clusterStateIsTerminal(state)) {
+        const error = new Error(`Cluster reached terminal state: ${cluster.state}`);
+        error.terminalClusterState = true;
+        throw error;
+      }
+    } catch (error) {
+      if (error?.terminalClusterState) {
+        throw error;
+      }
+      lastError = error;
+    }
+    if (Date.now() >= deadline) {
+      const detail = lastError instanceof Error ? ` Last error: ${lastError.message}` : "";
+      const state = lastCluster?.state ? ` Last state: ${lastCluster.state}.` : "";
+      throw new Error(`Timed out waiting for ${displayClusterType(type)} cluster ${reservationId}.${state}${detail}`);
+    }
+    await sleep(options.intervalSeconds * 1000);
+  }
+}
+
+function clusterEndpoint(type, reservationId, suffix) {
+  return `/${normalizeClusterType(type)}/reservations/${encodeURIComponent(reservationId)}/${suffix}`;
+}
+
+function clusterLaunchPayload(options) {
+  const payload = {
+    network_mode: normalizeClusterNetwork(options.network || options.networkMode || "public"),
+  };
+  if (optionProvided(options.nodeCount)) {
+    payload.node_count = positiveIntegerOption(options.nodeCount, "--node-count");
+  }
+  const nodeIds = clusterNodeIdOptions(options);
+  if (nodeIds.length) {
+    payload.node_ids = nodeIds;
+  }
+  if (optionProvided(options.storageLoadSizeBytes)) {
+    payload.storage_load_size_bytes = nonNegativeIntegerOption(
+      options.storageLoadSizeBytes,
+      "--storage-load-size-bytes",
+    );
+  }
+  return payload;
+}
+
+function clusterNodeIdOptions(options) {
+  return [
+    ...arrayOption(options.node),
+    ...arrayOption(options.nodeId),
+    ...arrayOption(options.nodeIds),
+  ]
+    .flatMap((value) => String(value).split(","))
+    .map((value) => value.trim())
+    .filter(Boolean);
+}
+
+function clusterStateIsTerminal(state) {
+  return new Set(["deleted", "failed", "error", "torn_down"]).has(state);
+}
+
+async function fetchTenantMachines(context) {
+  const reservations = requireArrayPayload(
+    await cliRequest({
+      endpoint: computeEndpoint("/tenants/me/reservations"),
+      env: context.env,
+      fetchImpl: context.fetchImpl,
+    }),
+    "reservations",
+  );
+  const settled = await Promise.allSettled(
+    reservations.map(async (reservation) => {
+      const payload = await getReservationMachines(reservation.id, context);
+      return activeMachines(payload.machines || []).map((machine) => ({
+        ...machine,
+        reservation_id: machine.reservation_id || reservation.id,
+        reservation_status: reservation.status || null,
+      }));
+    }),
+  );
+  return settled.flatMap((result) => (result.status === "fulfilled" ? result.value : []));
+}
+
+async function fetchMachine(nodeId, context) {
+  return await cliRequest({
+    endpoint: computeEndpoint(`/standalone-vms/${nodeId}`),
+    env: context.env,
+    fetchImpl: context.fetchImpl,
+  });
+}
+
+async function fetchTenantMetricSnapshots(context) {
+  const machines = await fetchTenantMachines(context);
+  const settled = await Promise.allSettled(
+    machines.map((machine) => fetchMetricSnapshotForMachine(machine, context)),
+  );
+  return settled.map((result, index) => {
+    if (result.status === "fulfilled") {
+      return result.value;
+    }
+    return metricSnapshotFromMachine(machines[index], {
+      error: result.reason instanceof Error ? result.reason.message : "Metrics unavailable.",
+    });
+  });
+}
+
+async function fetchMetricSnapshotForNode(nodeId, context) {
+  const machine = await resolveMetricMachine(nodeId, context);
+  if (!machine.reservation_id) {
+    throw new Error(`Node ${nodeId} is missing reservation context for live metrics.`);
+  }
+  return await fetchMetricSnapshotForMachine(machine, context);
+}
+
+async function resolveMetricMachine(nodeId, context) {
+  let machine = null;
+  try {
+    machine = await fetchMachine(nodeId, context);
+  } catch (error) {
+    if (!(error instanceof CliApiError) || error.status !== 404) {
+      throw error;
+    }
+  }
+
+  if (!machine?.reservation_id) {
+    const machines = await fetchTenantMachines(context);
+    machine = machines.find((candidate) => String(machineId(candidate)) === String(nodeId)) ?? machine;
+  }
+
+  if (!machine) {
+    throw new Error(`Node not found: ${nodeId}`);
+  }
+  return machine;
+}
+
+async function fetchMetricHistoryForNode(nodeId, options, context) {
+  const machine = await resolveMetricMachine(nodeId, context);
+  if (!machine.reservation_id) {
+    throw new Error(`Node ${nodeId} is missing reservation context for metric history.`);
+  }
+  const maxPoints = optionProvided(options.maxPoints)
+    ? positiveIntegerOption(options.maxPoints, "--max-points")
+    : undefined;
+  const query = buildQuery({
+    end: options.end,
+    machine_id: machineId(machine),
+    max_points: maxPoints,
+    start: options.start,
+  });
+  const series = await cliRequest({
+    endpoint: computeEndpoint(
+      `/standalone-vms/reservations/${encodeURIComponent(machine.reservation_id)}/telemetry-history${query}`,
+    ),
+    env: context.env,
+    fetchImpl: context.fetchImpl,
+  });
+  return {
+    machine,
+    node_id: machineId(machine),
+    series,
+  };
+}
+
+async function fetchMetricSnapshotForMachine(machine, context) {
+  const reservationId = machine.reservation_id;
+  if (!reservationId) {
+    return metricSnapshotFromMachine(machine, { error: "Reservation context unavailable." });
+  }
+  const payload = await cliRequest({
+    endpoint: computeEndpoint(
+      `/standalone-vms/reservations/${encodeURIComponent(reservationId)}/live-metrics?machine_id=${encodeURIComponent(machineId(machine))}`,
+    ),
+    env: context.env,
+    fetchImpl: context.fetchImpl,
+  });
+  return metricSnapshotFromLivePayload(machine, payload);
+}
+
+async function watchNodeMetrics(nodeId, options, context) {
+  const intervalSeconds = optionProvided(options.watchInterval)
+    ? parsePositiveNumber(options.watchInterval, "--watch-interval")
+    : optionProvided(options.interval)
+      ? parsePositiveNumber(options.interval, "--interval")
+      : 5;
+  const timeoutSeconds = optionProvided(options.watchTimeout)
+    ? parsePositiveNumber(options.watchTimeout, "--watch-timeout")
+    : optionProvided(options.timeout)
+      ? parsePositiveNumber(options.timeout, "--timeout")
+      : null;
+  const count = optionProvided(options.count)
+    ? positiveIntegerOption(options.count, "--count")
+    : null;
+  const deadline = timeoutSeconds == null ? null : Date.now() + timeoutSeconds * 1000;
+  let samples = 0;
+
+  for (;;) {
+    const snapshot = await fetchMetricSnapshotForNode(nodeId, context);
+    samples += 1;
+    if (options.json) {
+      context.stdout.write(`${JSON.stringify(snapshot)}\n`);
+    } else {
+      context.stdout.write(`[${new Date().toISOString()}] ${formatMetricSnapshotLine(snapshot)}\n`);
+    }
+
+    if (count !== null && samples >= count) {
+      return;
+    }
+    if (deadline !== null && Date.now() >= deadline) {
+      return;
+    }
+    await sleep(intervalSeconds * 1000);
+  }
+}
+
+async function resolveSshTarget(identifier, context) {
+  try {
+    const machine = await fetchMachine(identifier, context);
+    return { machine, source: "node" };
+  } catch (error) {
+    if (!(error instanceof CliApiError) || error.status !== 404) {
+      throw error;
+    }
+  }
+  const payload = await getReservationMachines(identifier, context);
+  const machines = activeMachines(payload.machines || []);
+  const ready = machines.filter((machine) => sshInvocationForMachine(machine, {}));
+  if (ready.length === 1) {
+    return { machine: ready[0], source: "reservation" };
+  }
+  if (ready.length > 1) {
+    throw new Error(
+      `Reservation ${identifier} has ${ready.length} SSH-ready nodes. Use \`ornn nodes list\` and pass a node id.`,
+    );
+  }
+  if (machines.length) {
+    throw new Error(`No SSH-ready nodes found for reservation ${identifier}. Run \`ornn nodes wait ${identifier}\`.`);
+  }
+  throw new Error(`Node or reservation not found: ${identifier}`);
+}
+
+async function runNodeAction(nodeId, action, options, context) {
+  const body = action === "revoke" ? { request_id: options.requestId || null } : undefined;
+  return await cliRequest({
+    body,
+    endpoint: computeEndpoint(`/standalone-vms/${nodeId}/${action}`),
+    env: context.env,
+    fetchImpl: context.fetchImpl,
+    method: "POST",
+  });
+}
+
+async function pushNodeKeys(nodeId, sshKeyIds, requestId, context) {
+  return await cliRequest({
+    body: {
+      request_id: requestId || `cli-node-push-keys:${nodeId}:${Date.now()}`,
+      ssh_key_ids: sshKeyIds,
+    },
+    endpoint: computeEndpoint(`/standalone-vms/${nodeId}/push-keys`),
+    env: context.env,
+    fetchImpl: context.fetchImpl,
+    method: "POST",
+  });
+}
+
+async function waitForSshReady(identifier, options, context) {
+  const deadline = Date.now() + options.timeoutSeconds * 1000;
+  let lastError = null;
+  for (;;) {
+    try {
+      const result = await resolveSshTarget(identifier, context);
+      lastError = null;
+      const invocation = sshInvocationForMachine(result.machine, {});
+      if (invocation) {
+        return {
+          command: commandText(invocation),
+          machine: result.machine,
+          ready: true,
+          source: result.source,
+        };
+      }
+    } catch (error) {
+      lastError = error;
+    }
+    if (Date.now() >= deadline) {
+      const detail = lastError instanceof Error ? ` Last error: ${lastError.message}` : "";
+      throw new Error(`Timed out waiting for SSH access for ${identifier}.${detail}`);
+    }
+    await sleep(options.intervalSeconds * 1000);
+  }
+}
+
+function waitOptions(options) {
+  const timeoutValue = options.waitTimeout ?? options.timeout;
+  return {
+    intervalSeconds: optionProvided(options.waitInterval)
+      ? parsePositiveNumber(options.waitInterval, "--wait-interval")
+      : 5,
+    timeoutSeconds: optionProvided(timeoutValue)
+      ? parsePositiveNumber(timeoutValue, optionProvided(options.waitTimeout) ? "--wait-timeout" : "--timeout")
+      : 600,
+  };
+}
+
+async function resolveAccountSshKeyIds(options, context) {
+  const rawSshKeyIds = arrayOptionPreserveEmpty(options.sshKeyId).map((value) => String(value).trim());
+  const rawKeyIds = arrayOptionPreserveEmpty(options.keyId).map((value) => String(value).trim());
+  if (rawSshKeyIds.some((value) => !value)) {
+    throw new Error("--ssh-key-id is required.");
+  }
+  if (rawKeyIds.some((value) => !value)) {
+    throw new Error("--key-id is required.");
+  }
+  const directIds = [...rawSshKeyIds, ...rawKeyIds];
+  const refs = [
+    ...arrayOption(options.key),
+    ...arrayOption(options.publicKeyFile),
+    ...arrayOption(options.publicKey),
+  ].map((value) => String(value).trim()).filter(Boolean);
+
+  const resolved = [...directIds];
+  for (const ref of refs) {
+    const key = await resolveAccountSshKeyRef(ref, options.label, context);
+    if (key?.id) {
+      resolved.push(String(key.id));
+    }
+  }
+  return [...new Set(resolved)];
+}
+
+async function resolveAccountSshKeyRef(ref, label, context) {
+  if (looksLikePublicKey(ref)) {
+    return await ensureAccountSshKey(ref, label, context);
+  }
+  if (looksLikePath(ref)) {
+    return await ensureAccountSshKey(await publicKeyFromRef(ref), label, context);
+  }
+  const keys = activeSshKeys(sshKeysFromPayload(await fetchAccountSshKeys(context)));
+  const exact = keys.find((key) => String(key.id) === ref);
+  if (exact) {
+    return exact;
+  }
+  const byLabel = keys.filter((key) => key.label === ref);
+  if (byLabel.length === 1) {
+    return byLabel[0];
+  }
+  if (byLabel.length > 1) {
+    throw new Error(`Multiple SSH keys have label "${ref}". Use --key-id with the exact key id.`);
+  }
+  throw new Error(`SSH key not found by id or label: ${ref}`);
+}
+
+async function ensureAccountSshKey(publicKey, label, context) {
+  const normalized = String(publicKey || "").trim();
+  if (!normalized) {
+    throw new Error("SSH public key is empty.");
+  }
+  const keys = activeSshKeys(sshKeysFromPayload(await fetchAccountSshKeys(context)));
+  const existing = keys.find((key) => String(key.public_key || "").trim() === normalized);
+  if (existing) {
+    return existing;
+  }
+  return await cliRequest({
+    body: {
+      label: label || null,
+      public_key: normalized,
+    },
+    endpoint: computeEndpoint("/standalone-vms/tenants/me/ssh-keys"),
+    env: context.env,
+    fetchImpl: context.fetchImpl,
+    method: "POST",
+  });
+}
+
+async function fetchAccountSshKeys(context) {
+  return await cliRequest({
+    endpoint: computeEndpoint("/standalone-vms/tenants/me/ssh-keys"),
+    env: context.env,
+    fetchImpl: context.fetchImpl,
+  });
+}
+
+async function publicKeyFromRef(ref) {
+  if (looksLikePublicKey(ref)) {
+    return ref.trim();
+  }
+  const path = expandUserPath(ref);
+  let contents;
+  try {
+    contents = (await readFile(path, "utf8")).trim();
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    throw new Error(`Could not read SSH public key file ${ref}: ${message}`);
+  }
+  if (looksLikePublicKey(contents)) {
+    return contents;
+  }
+  if (!path.endsWith(".pub")) {
+    try {
+      const siblingPublicKey = (await readFile(`${path}.pub`, "utf8")).trim();
+      if (looksLikePublicKey(siblingPublicKey)) {
+        return siblingPublicKey;
+      }
+    } catch {
+      // Fall through to the clearer private-key/public-key error below.
+    }
+  }
+  if (/PRIVATE KEY/.test(contents)) {
+    throw new Error(
+      `Refusing to upload a private SSH key. Pass the matching public key file (${ref}.pub) or use a saved key id/label.`,
+    );
+  }
+  throw new Error("File does not contain a supported SSH public key.");
+}
+
 async function pushReservationKeys(reservationId, sshKeyIds, requestId, context) {
   const machinesPayload = await getReservationMachines(reservationId, context);
   const machines = activeMachines(machinesPayload.machines || []);
@@ -1684,10 +3414,10 @@ function reservationKeyMetadataForMachine(key, machine) {
 function writeAccessDetail(stdout, payload = {}) {
   const machines = Array.isArray(payload.machines) ? payload.machines : [];
   if (!machines.length) {
-    stdout.write("No bare-metal access machines found for this reservation.\n");
+    stdout.write("No Bare Metal access machines found for this reservation.\n");
     return;
   }
-  stdout.write("Bare-metal access:\n");
+  stdout.write("Bare Metal access:\n");
   for (const machine of machines) {
     stdout.write(`- ${machineId(machine)} ${machineState(machine)}\n`);
     const username = machineUsername(machine);
@@ -1724,7 +3454,618 @@ function writeAccessLaunchSummary(stdout, launch = {}) {
   }
 }
 
+function writeNodeList(stdout, machines) {
+  if (!machines.length) {
+    stdout.write("No launched machines found.\n");
+    return;
+  }
+  stdout.write("Machines:\n");
+  for (const machine of machines) {
+    stdout.write(`- ${machineId(machine)} ${machineState(machine)}`);
+    if (machine.reservation_id) {
+      stdout.write(` reservation=${machine.reservation_id}`);
+    }
+    const sshCommand = sshCommandForMachine(machine);
+    if (sshCommand) {
+      stdout.write(` ssh="${sshCommand}"`);
+    }
+    stdout.write("\n");
+  }
+}
+
+function writeNodeDetail(stdout, machine) {
+  stdout.write(`${machineId(machine)}\n`);
+  stdout.write(`State: ${machineState(machine)}\n`);
+  writeOptionalStatusLine(stdout, "Reservation", machine.reservation_id);
+  writeOptionalStatusLine(stdout, "Access mode", machine.access_mode);
+  writeOptionalStatusLine(stdout, "Network", machine.network_mode);
+  const username = machineUsername(machine);
+  const host = machineHost(machine);
+  const port = machinePort(machine);
+  stdout.write(`SSH ready: ${host ? "yes" : "no"}\n`);
+  if (username) {
+    stdout.write(`Username: ${username}\n`);
+  }
+  if (host) {
+    stdout.write(`Host: ${host}\n`);
+    stdout.write(`Port: ${port}\n`);
+  }
+  const sshCommand = sshCommandForMachine(machine);
+  if (sshCommand) {
+    stdout.write(`SSH: ${sshCommand}\n`);
+  }
+}
+
+function writeMetricSnapshotList(stdout, snapshots) {
+  if (!snapshots.length) {
+    stdout.write("No launched machines found.\n");
+    return;
+  }
+  stdout.write("Machine metrics:\n");
+  for (const snapshot of snapshots) {
+    stdout.write(`- ${formatMetricSnapshotLine(snapshot)}\n`);
+    if (snapshot.error) {
+      stdout.write(`  Metrics error: ${snapshot.error}\n`);
+    }
+  }
+}
+
+function writeMetricSnapshotDetail(stdout, snapshot) {
+  stdout.write(`${snapshot.node_id}\n`);
+  stdout.write(`State: ${snapshot.state || "unknown"}\n`);
+  writeOptionalStatusLine(stdout, "Reservation", snapshot.reservation_id);
+  stdout.write(`Connection: ${snapshot.connection_status || "unknown"}\n`);
+  writeOptionalStatusLine(stdout, "Last heartbeat", snapshot.last_heartbeat_at);
+  writeOptionalStatusLine(stdout, "Reported", snapshot.reported_at);
+  stdout.write(`GPU utilization: ${formatMetricValue(snapshot.metrics.gpu_utilization, "%")}\n`);
+  stdout.write(`GPU memory: ${formatMetricValue(snapshot.metrics.gpu_memory_utilization, "%")}\n`);
+  stdout.write(`GPU power: ${formatMetricValue(snapshot.metrics.gpu_power_w, "W")}\n`);
+  stdout.write(`GPU throughput: ${formatMetricValue(snapshot.metrics.gpu_tflops, "TFLOP/s")}\n`);
+  stdout.write(`CPU utilization: ${formatMetricValue(snapshot.metrics.cpu_utilization, "%")}\n`);
+  stdout.write(`Memory: ${formatMetricValue(snapshot.metrics.memory_utilization, "%")}\n`);
+  stdout.write(`Storage: ${formatMetricValue(snapshot.metrics.storage_utilization, "%")}\n`);
+  if (snapshot.error) {
+    stdout.write(`Metrics error: ${snapshot.error}\n`);
+  }
+}
+
+function writeMetricHistory(stdout, result) {
+  const points = Array.isArray(result.series?.points) ? result.series.points : [];
+  stdout.write(`Telemetry history for ${result.node_id}\n`);
+  writeOptionalStatusLine(stdout, "Reservation", result.series?.reservation_id || result.machine?.reservation_id);
+  stdout.write(`Points: ${points.length}\n`);
+  if (!points.length) {
+    return;
+  }
+  const visiblePoints = points.slice(-10);
+  if (points.length > visiblePoints.length) {
+    stdout.write(`Showing latest ${visiblePoints.length} points.\n`);
+  }
+  for (const point of visiblePoints) {
+    const metrics = point.metrics || {};
+    stdout.write(`- ${point.observed_at || "unknown"}`);
+    stdout.write(` samples=${point.samples ?? 1}`);
+    stdout.write(` gpu=${formatMetricValue(metricValue(metrics, "gpu_utilization"), "%")}`);
+    stdout.write(` gpu_mem=${formatMetricValue(metricValue(metrics, "gpu_memory_utilization"), "%")}`);
+    stdout.write(` power=${formatMetricValue(metricValue(metrics, "gpu_power_w"), "W")}`);
+    stdout.write(` tflops=${formatMetricValue(metricValue(metrics, "gpu_tflops"), "TFLOP/s")}`);
+    stdout.write("\n");
+  }
+}
+
+function formatMetricSnapshotLine(snapshot) {
+  return [
+    snapshot.node_id,
+    snapshot.state || "unknown",
+    snapshot.connection_status || "unknown",
+    `gpu=${formatMetricValue(snapshot.metrics.gpu_utilization, "%")}`,
+    `gpu_mem=${formatMetricValue(snapshot.metrics.gpu_memory_utilization, "%")}`,
+    `power=${formatMetricValue(snapshot.metrics.gpu_power_w, "W")}`,
+    `tflops=${formatMetricValue(snapshot.metrics.gpu_tflops, "TFLOP/s")}`,
+    `heartbeat=${snapshot.last_heartbeat_at || "none"}`,
+  ].join(" ");
+}
+
+function writeNetworkList(stdout, networks) {
+  if (!networks.length) {
+    stdout.write("No private networks found.\n");
+    return;
+  }
+  stdout.write("Private networks:\n");
+  for (const network of networks) {
+    stdout.write(`- ${network.id} ${network.name || "unnamed"} ${network.status || "unknown"}`);
+    stdout.write(` cidr=${network.cidr || "unknown"}`);
+    stdout.write(` attached=${network.attached_reservation_count ?? 0}`);
+    const gatewayStatus = network.gateway?.status;
+    if (gatewayStatus) {
+      stdout.write(` gateway=${gatewayStatus}`);
+    }
+    stdout.write("\n");
+  }
+}
+
+function writeNetworkDetail(stdout, network = {}) {
+  stdout.write(`${network.id || "network"}\n`);
+  stdout.write(`Name: ${network.name || "unnamed"}\n`);
+  stdout.write(`Status: ${network.status || "unknown"}\n`);
+  stdout.write(`CIDR: ${network.cidr || "unknown"}\n`);
+  stdout.write(`Attached reservations: ${network.attached_reservation_count ?? 0}\n`);
+  writeOptionalStatusLine(stdout, "Description", network.description);
+  if (network.gateway) {
+    stdout.write(`Gateway: ${network.gateway.status || "unknown"}\n`);
+    writeOptionalStatusLine(stdout, "Endpoint", network.gateway.endpoint);
+  }
+  writeOptionalStatusLine(stdout, "Created", network.created_at);
+  writeOptionalStatusLine(stdout, "Updated", network.updated_at);
+}
+
+function writeReservationNetwork(stdout, payload = {}) {
+  stdout.write(`${payload.reservation_id || "reservation"}\n`);
+  if (!payload.tenant_network_id || !payload.network) {
+    stdout.write("Network: shared\n");
+    return;
+  }
+  stdout.write(`Network: ${payload.network.name || payload.tenant_network_id}\n`);
+  stdout.write(`Network ID: ${payload.tenant_network_id}\n`);
+  writeOptionalStatusLine(stdout, "CIDR", payload.network.cidr);
+  writeOptionalStatusLine(stdout, "Status", payload.network.status);
+}
+
+function writeStorageDriveList(stdout, drives) {
+  if (!drives.length) {
+    stdout.write("No storage volumes found.\n");
+    return;
+  }
+  stdout.write("Storage volumes:\n");
+  for (const drive of drives) {
+    stdout.write(`- ${drive.id} ${drive.name || "unnamed"} ${drive.status || "unknown"}`);
+    stdout.write(` size=${formatBytes(drive.size_bytes)}`);
+    if (drive.source_drive_id) {
+      stdout.write(` source=${drive.source_drive_id}`);
+    }
+    if (drive.active_mount) {
+      stdout.write(` mounted=${drive.active_mount.reservation_id || "yes"}`);
+    }
+    stdout.write("\n");
+  }
+}
+
+function writeStorageDriveDetail(stdout, drive = {}) {
+  stdout.write(`${drive.id || "drive"}\n`);
+  stdout.write(`Name: ${drive.name || "unnamed"}\n`);
+  stdout.write(`Status: ${drive.status || "unknown"}\n`);
+  stdout.write(`Size: ${formatBytes(drive.size_bytes)}\n`);
+  writeOptionalStatusLine(stdout, "Source", drive.source_drive_id);
+  writeOptionalStatusLine(stdout, "File tree", drive.file_tree_status);
+  if (drive.file_tree_truncated) {
+    stdout.write("    File tree: truncated\n");
+  }
+  if (drive.active_mount) {
+    stdout.write("Active mount:\n");
+    writeOptionalStatusLine(stdout, "Reservation", drive.active_mount.reservation_id);
+    writeOptionalStatusLine(stdout, "Node", drive.active_mount.node_label || drive.active_mount.node_id);
+    writeOptionalStatusLine(stdout, "Path", drive.active_mount.mount_path);
+    writeOptionalStatusLine(stdout, "Access", drive.active_mount.access);
+    writeOptionalStatusLine(stdout, "State", drive.active_mount.state);
+  }
+  writeOptionalStatusLine(stdout, "Created", drive.created_at);
+  writeOptionalStatusLine(stdout, "Updated", drive.updated_at);
+}
+
+function writeBillingSummary(stdout, summary = {}) {
+  stdout.write("Billing summary:\n");
+  stdout.write(`Open balance: ${formatCents(summary.open_balance_cents)}\n`);
+  stdout.write(`Earliest due date: ${summary.earliest_due_date || "none"}\n`);
+  stdout.write(`This month: ${formatCents(summary.this_month_total_cents)} (${summary.this_month_count || 0} invoices)\n`);
+  stdout.write(`Last month: ${formatCents(summary.last_month_total_cents)} (${summary.last_month_count || 0} invoices)\n`);
+}
+
+function writeInvoiceList(stdout, invoices) {
+  if (!invoices.length) {
+    stdout.write("No invoices found.\n");
+    return;
+  }
+  stdout.write("Invoices:\n");
+  for (const invoice of invoices) {
+    stdout.write(`- ${invoice.id} ${invoice.status || "unknown"} ${invoice.type || "invoice"} ${formatCents(invoice.amount_cents, invoice.currency)}`);
+    if (invoice.due_date) {
+      stdout.write(` due=${invoice.due_date}`);
+    }
+    if (invoice.reservation_id) {
+      stdout.write(` reservation=${invoice.reservation_id}`);
+    }
+    stdout.write("\n");
+    writeOptionalStatusLine(stdout, "Hosted invoice", invoice.hosted_invoice_url);
+    writeOptionalStatusLine(stdout, "PDF", invoice.invoice_pdf_url);
+  }
+}
+
+function writeShowbackReport(stdout, report = {}) {
+  const rows = Array.isArray(report.rows) ? report.rows : [];
+  stdout.write(`Showback ${report.window_start || "unknown"} to ${report.window_end || "unknown"}\n`);
+  stdout.write(`Total GPU hours: ${report.total_gpu_hours ?? 0}\n`);
+  stdout.write(`Total cost: ${formatCents(report.total_cost_cents)}\n`);
+  if (!rows.length) {
+    stdout.write("No reservation usage in this window.\n");
+    return;
+  }
+  stdout.write("Reservations:\n");
+  for (const row of rows) {
+    stdout.write(`- ${row.reservation_id} ${row.status || "unknown"}`);
+    stdout.write(` ${row.gpu_hours ?? 0} GPU-hours`);
+    stdout.write(` ${formatCents(row.cost_cents)}`);
+    stdout.write(` share=${row.share_pct ?? "0"}%\n`);
+  }
+}
+
+function billingSummaryFromInvoices(invoices) {
+  const now = new Date();
+  const thisMonthStart = new Date(now.getFullYear(), now.getMonth(), 1);
+  const lastMonthStart = new Date(now.getFullYear(), now.getMonth() - 1, 1);
+  const summary = {
+    earliest_due_date: null,
+    last_month_count: 0,
+    last_month_total_cents: 0,
+    open_balance_cents: 0,
+    this_month_count: 0,
+    this_month_total_cents: 0,
+  };
+  for (const invoice of invoices) {
+    const amount = Number(invoice.amount_cents || 0);
+    if (invoice.status === "open") {
+      summary.open_balance_cents += amount;
+      if (invoice.due_date && (!summary.earliest_due_date || invoice.due_date < summary.earliest_due_date)) {
+        summary.earliest_due_date = invoice.due_date;
+      }
+    }
+    const created = new Date(invoice.created_at);
+    if (Number.isNaN(created.getTime())) {
+      continue;
+    }
+    if (created >= thisMonthStart) {
+      summary.this_month_total_cents += amount;
+      summary.this_month_count += 1;
+    } else if (created >= lastMonthStart && created < thisMonthStart) {
+      summary.last_month_total_cents += amount;
+      summary.last_month_count += 1;
+    }
+  }
+  return summary;
+}
+
+function networksFromPayload(payload) {
+  return Array.isArray(payload) ? payload : Array.isArray(payload?.networks) ? payload.networks : [];
+}
+
+function networkFromMutationPayload(payload) {
+  return payload?.network || payload || {};
+}
+
+function storageDrivesFromPayload(payload) {
+  return Array.isArray(payload) ? payload : Array.isArray(payload?.drives) ? payload.drives : [];
+}
+
+function metricSnapshotFromLivePayload(fallbackMachine, payload = {}) {
+  const liveMachine = payload?.machine || null;
+  const machine = liveMachine
+    ? {
+        ...fallbackMachine,
+        ...liveMachine,
+        reservation_id: fallbackMachine.reservation_id || payload.reservation_id,
+      }
+    : {
+        ...fallbackMachine,
+        resource_metrics: null,
+        reservation_id: fallbackMachine.reservation_id || payload.reservation_id,
+      };
+  return metricSnapshotFromMachine(machine);
+}
+
+function metricSnapshotFromMachine(machine, extras = {}) {
+  const resourceMetrics = machine.resource_metrics || machine.resourceMetrics || {};
+  const lastHeartbeatAt =
+    resourceMetrics.last_heartbeat_at ||
+    resourceMetrics.lastHeartbeatAt ||
+    machine.last_heartbeat_at ||
+    machine.lastHeartbeatAt ||
+    null;
+  return {
+    connection_status: resourceMetrics.connection_status || resourceMetrics.connectionStatus || "pending",
+    error: extras.error || null,
+    last_heartbeat_at: lastHeartbeatAt,
+    metrics: {
+      cpu_utilization: numericMetric(resourceMetrics.cpu_utilization ?? resourceMetrics.cpuUtilization),
+      gpu_memory_utilization: numericMetric(
+        resourceMetrics.gpu_memory_utilization ?? resourceMetrics.gpuMemoryUtilization,
+      ),
+      gpu_power_w: numericMetric(resourceMetrics.gpu_power_w ?? resourceMetrics.gpuPowerW),
+      gpu_tflops: numericMetric(resourceMetrics.gpu_tflops ?? resourceMetrics.gpuTflops),
+      gpu_utilization: numericMetric(resourceMetrics.gpu_utilization ?? resourceMetrics.gpuUtilization),
+      memory_utilization: numericMetric(resourceMetrics.memory_utilization ?? resourceMetrics.memoryUtilization),
+      storage_utilization: numericMetric(resourceMetrics.storage_utilization ?? resourceMetrics.storageUtilization),
+    },
+    node_id: machineId(machine),
+    reported_at: resourceMetrics.reported_at || resourceMetrics.reportedAt || null,
+    reservation_id: machine.reservation_id || machine.reservationId || null,
+    state: machineState(machine),
+  };
+}
+
+function numericMetric(value) {
+  if (value === undefined || value === null || value === "") {
+    return null;
+  }
+  const numeric = Number(value);
+  return Number.isFinite(numeric) ? numeric : null;
+}
+
+function metricValue(metrics, key) {
+  if (!metrics || typeof metrics !== "object") {
+    return null;
+  }
+  const camelKey = key.replace(/_([a-z])/g, (_match, letter) => letter.toUpperCase());
+  return numericMetric(metrics[key] ?? metrics[camelKey]);
+}
+
+function formatMetricValue(value, unit) {
+  if (value === undefined || value === null || !Number.isFinite(Number(value))) {
+    return "No signal";
+  }
+  const numeric = Math.max(0, Number(value));
+  if (unit === "%") {
+    return `${Math.round(numeric)}%`;
+  }
+  if (unit === "W") {
+    return `${Math.round(numeric)} W`;
+  }
+  if (unit === "TFLOP/s") {
+    const rounded = numeric >= 100 ? numeric.toFixed(0) : numeric.toFixed(1);
+    return `${rounded.replace(/\.0$/, "")} TFLOP/s`;
+  }
+  return `${numeric} ${unit}`;
+}
+
+function writeNodeLaunchResult(stdout, result) {
+  stdout.write(`${displayAccessMode(result.mode)} machine launch queued\n`);
+  writeAccessLaunchSummary(stdout, result.launch);
+  if (result.wait) {
+    writeWaitResult(stdout, result.wait);
+  }
+}
+
+function writeWaitResult(stdout, result) {
+  stdout.write(`SSH ready: ${machineId(result.machine)}\n`);
+  stdout.write(`SSH: ${result.command}\n`);
+}
+
+function writeClusterList(stdout, clusters) {
+  if (!clusters.length) {
+    stdout.write("No clusters found.\n");
+    return;
+  }
+  stdout.write("Clusters:\n");
+  for (const cluster of clusters) {
+    stdout.write(`- ${cluster.reservation_id || cluster.id || "cluster"} ${displayClusterType(cluster.access_mode)} ${cluster.state || "unknown"}`);
+    stdout.write(` ${cluster.node_count ?? "?"} nodes/${cluster.gpu_count ?? "?"} GPUs`);
+    stdout.write(` network=${cluster.network_mode || "public"}`);
+    stdout.write(` credentials=${cluster.credential_state || "unknown"}`);
+    if (cluster.endpoint) {
+      stdout.write(` endpoint=${cluster.endpoint}`);
+    }
+    stdout.write("\n");
+  }
+}
+
+function writeClusterReservationList(stdout, reservations) {
+  if (!reservations.length) {
+    stdout.write("No cluster-ready reservations found.\n");
+    return;
+  }
+  stdout.write("Cluster-ready reservations:\n");
+  for (const reservation of reservations) {
+    stdout.write(`- ${reservation.id} ${reservation.status || "unknown"}`);
+    stdout.write(` ${reservation.node_count ?? "?"} nodes/${reservation.gpu_count ?? "?"} GPUs`);
+    if (reservation.gpu_type) {
+      stdout.write(` ${reservation.gpu_type}`);
+    }
+    if (reservation.ib_island) {
+      stdout.write(` island=${String(reservation.ib_island).slice(0, 12)}`);
+    }
+    stdout.write("\n");
+  }
+}
+
+function writeEligibleClusterNodes(stdout, payload) {
+  const nodes = requireArrayPayload(payload?.nodes || [], "eligible cluster nodes");
+  if (!nodes.length) {
+    stdout.write("No eligible cluster nodes found.\n");
+    return;
+  }
+  stdout.write(`Eligible nodes for ${payload.reservation_id || "reservation"} (${displayClusterType(payload.access_mode)} / ${payload.network_mode || "public"}):\n`);
+  for (const node of nodes) {
+    const status = node.eligible ? "eligible" : "blocked";
+    stdout.write(`- ${node.node_id} ${status}`);
+    stdout.write(` ${node.gpu_count ?? "?"}x ${node.gpu_type || payload.reservation_gpu_type || "GPU"}`);
+    if (node.site_label) {
+      stdout.write(` site=${node.site_label}`);
+    }
+    if (node.ib_island) {
+      stdout.write(` island=${String(node.ib_island).slice(0, 12)}`);
+    }
+    if (node.membership) {
+      stdout.write(` membership=${node.membership}`);
+    }
+    if (node.membership_state) {
+      stdout.write(` state=${node.membership_state}`);
+    }
+    stdout.write("\n");
+    const reasons = Array.isArray(node.blocking_reasons) ? node.blocking_reasons : [];
+    for (const reason of reasons) {
+      stdout.write(`  - ${reason}\n`);
+    }
+  }
+}
+
+function writeClusterDetail(stdout, cluster = {}) {
+  stdout.write(`${cluster.reservation_id || cluster.id || "cluster"}\n`);
+  stdout.write(`Type: ${displayClusterType(cluster.access_mode)}\n`);
+  stdout.write(`State: ${cluster.state || "unknown"}\n`);
+  stdout.write(`Network: ${cluster.network_mode || "public"}\n`);
+  stdout.write(`Nodes: ${cluster.node_count ?? "unknown"}\n`);
+  stdout.write(`GPUs: ${cluster.gpu_count ?? "unknown"}\n`);
+  writeOptionalStatusLine(stdout, "GPU type", cluster.gpu_type);
+  writeOptionalStatusLine(stdout, "Name", cluster.cluster_name);
+  writeOptionalStatusLine(stdout, "Endpoint", cluster.endpoint);
+  writeOptionalStatusLine(stdout, "Namespace", cluster.namespace);
+  writeOptionalStatusLine(stdout, "Credentials", cluster.credential_state);
+  const progress = cluster.progress && typeof cluster.progress === "object" ? cluster.progress : null;
+  if (progress) {
+    stdout.write("Progress:\n");
+    for (const [key, value] of Object.entries(progress)) {
+      if (value === undefined || value === null || typeof value === "object") {
+        continue;
+      }
+      stdout.write(`  ${key}: ${value}\n`);
+    }
+  }
+}
+
+function writeClusterLaunchResult(stdout, result) {
+  stdout.write(`${displayClusterType(result.type)} cluster launch queued.\n`);
+  writeClusterDetail(stdout, result.cluster);
+  if (result.wait) {
+    writeClusterWaitResult(stdout, result.wait);
+  }
+}
+
+function writeClusterWaitResult(stdout, result) {
+  stdout.write(`${displayClusterType(result.type)} cluster ready: ${result.reservation_id}\n`);
+  writeClusterDetail(stdout, result.cluster);
+}
+
+function writeClusterCredentials(stdout, credentials = {}, type, reservationId) {
+  if (type === "kubernetes") {
+    stdout.write(`Kubernetes credentials ready for ${reservationId}.\n`);
+    writeOptionalStatusLine(stdout, "Namespace", credentials.namespace);
+    writeOptionalStatusLine(stdout, "Endpoint", credentials.endpoint);
+    writeOptionalStatusLine(stdout, "Expires", credentials.expires_at);
+    stdout.write(`Kubeconfig: ${credentials.kubeconfig ? "available" : "not returned"}\n`);
+    if (credentials.kubeconfig) {
+      stdout.write(`Export it with: ornn clusters kubeconfig ${reservationId} --output kubeconfig.yaml\n`);
+    }
+    return;
+  }
+
+  stdout.write(`Slurm credentials ready for ${reservationId}.\n`);
+  writeOptionalStatusLine(stdout, "Login host", credentials.login_host);
+  writeOptionalStatusLine(stdout, "Login port", credentials.login_port);
+  writeOptionalStatusLine(stdout, "Login user", credentials.login_user);
+  writeOptionalStatusLine(stdout, "Host key", credentials.ssh_host_key);
+  writeOptionalStatusLine(stdout, "Expires", credentials.expires_at);
+  const invocation = slurmSshInvocation(credentials, {});
+  if (invocation) {
+    stdout.write(`SSH: ${commandText(invocation)}\n`);
+  }
+  const fingerprints = Array.isArray(credentials.authorized_key_fingerprints)
+    ? credentials.authorized_key_fingerprints
+    : [];
+  if (fingerprints.length) {
+    stdout.write("Authorized key fingerprints:\n");
+    for (const fingerprint of fingerprints) {
+      stdout.write(`- ${fingerprint}\n`);
+    }
+  }
+}
+
+function nodeKeyStatus(machine) {
+  const metadata = Array.isArray(machine.authorized_key_metadata) ? machine.authorized_key_metadata : [];
+  return {
+    machine_id: machineId(machine),
+    machine_state: machineState(machine),
+    keys: metadata.map((item) => ({
+      failed_at: item.failed_at || null,
+      failure_reason: item.failure_reason || null,
+      fingerprint: item.fingerprint || null,
+      linux_username: item.linux_username || null,
+      pushed_at: item.pushed_at || null,
+      queued_at: item.queued_at || null,
+      request_id: item.request_id || null,
+      ssh_key_id: item.ssh_key_id || null,
+      status: item.status || "associated",
+    })),
+  };
+}
+
+function writeNodeKeyStatus(stdout, status) {
+  const keys = Array.isArray(status.keys) ? status.keys : [];
+  if (!keys.length) {
+    stdout.write(`No SSH keys are recorded on node ${status.machine_id}.\n`);
+    return;
+  }
+  stdout.write(`SSH keys for node ${status.machine_id}:\n`);
+  for (const key of keys) {
+    stdout.write(`- ${key.ssh_key_id || key.fingerprint || "key"}: ${key.status}\n`);
+    writeOptionalStatusLine(stdout, "Fingerprint", key.fingerprint);
+    writeOptionalStatusLine(stdout, "Linux user", key.linux_username);
+    writeOptionalStatusLine(stdout, "Queued", key.queued_at);
+    writeOptionalStatusLine(stdout, "Pushed", key.pushed_at);
+    writeOptionalStatusLine(stdout, "Failed", key.failed_at);
+    writeOptionalStatusLine(stdout, "Reason", key.failure_reason);
+    writeOptionalStatusLine(stdout, "Request", key.request_id);
+  }
+}
+
+function sshInvocationForMachine(machine, options = {}) {
+  const host = machineHost(machine);
+  if (host) {
+    const args = [];
+    if (options.identityFile) {
+      args.push("-i", expandUserPath(String(options.identityFile)));
+    }
+    const port = machinePort(machine);
+    if (port !== 22) {
+      args.push("-p", String(port));
+    }
+    const username = options.user || machineUsername(machine) || "root";
+    args.push(`${username}@${host}`);
+    return { args, command: "ssh" };
+  }
+
+  const raw = machine.ssh_command || machine.iap_ssh_command;
+  if (typeof raw === "string" && raw.trim()) {
+    return { raw: raw.trim() };
+  }
+  return null;
+}
+
+function slurmSshInvocation(credentials, options = {}) {
+  const host = credentials?.login_host;
+  if (host) {
+    const args = [];
+    if (options.identityFile) {
+      args.push("-i", expandUserPath(String(options.identityFile)));
+    }
+    const port = Number(credentials.login_port || 22);
+    if (Number.isFinite(port) && port > 0 && port !== 22) {
+      args.push("-p", String(port));
+    }
+    const user = options.user || credentials.login_user;
+    args.push(user ? `${user}@${host}` : host);
+    return { args, command: "ssh" };
+  }
+
+  const raw = credentials?.ssh_command;
+  if (typeof raw === "string" && raw.trim()) {
+    return { raw: raw.trim() };
+  }
+  return null;
+}
+
 function sshCommandForMachine(machine) {
+  const invocation = sshInvocationForMachine(machine, {});
+  if (invocation) {
+    return commandText(invocation);
+  }
   if (machine.ssh_command) {
     return machine.ssh_command;
   }
@@ -1746,6 +4087,40 @@ function sshCommandForMachine(machine) {
   return port === 22 ? `ssh ${username}@${host}` : `ssh -p ${port} ${username}@${host}`;
 }
 
+function commandText(invocation) {
+  if (invocation.raw) {
+    return invocation.raw;
+  }
+  return [invocation.command, ...invocation.args].map(shellQuote).join(" ");
+}
+
+async function spawnCommand(invocation, context) {
+  if (invocation.raw) {
+    throw new Error(
+      "This node exposes a non-standard SSH command. Run `ornn ssh <node-id> --print` and execute the printed command.",
+    );
+  }
+  return await new Promise((resolve, reject) => {
+    const child = context.spawnProcess(invocation.command, invocation.args, { stdio: "inherit" });
+    child.on("error", reject);
+    child.on("exit", (code, signal) => {
+      if (signal) {
+        resolve(1);
+        return;
+      }
+      resolve(code ?? 0);
+    });
+  });
+}
+
+function shellQuote(value) {
+  const text = String(value);
+  if (/^[A-Za-z0-9_./:@%+=,-]+$/.test(text)) {
+    return text;
+  }
+  return `'${text.replace(/'/g, "'\\''")}'`;
+}
+
 function machineId(machine) {
   return machine.id || machine.machine_id || machine.instance_id || machine.instance_name || "machine";
 }
@@ -1755,7 +4130,13 @@ function machineState(machine, fallback = "unknown") {
 }
 
 function machineUsername(machine) {
-  return machine.tenant_username || machine.username || machine.user || splitSshEndpoint(machine.ssh_endpoint).user;
+  return (
+    splitSshEndpoint(machine.ssh_endpoint).user ||
+    machine.linux_username ||
+    machine.tenant_username ||
+    machine.username ||
+    machine.user
+  );
 }
 
 function machineHost(machine) {
@@ -1896,6 +4277,82 @@ function activeSshKeys(keys) {
   return keys.filter((key) => String(key.status || "active").toLowerCase() === "active" && !key.revoked_at);
 }
 
+function normalizeAccessMode(value) {
+  const normalized = String(value || "").trim().toLowerCase();
+  if (normalized === "bare-metal" || normalized === "baremetal" || normalized === "bare_metal") {
+    return "bare-metal";
+  }
+  if (normalized === "vm" || normalized === "virtual-machine" || normalized === "virtual_machine") {
+    return "vm";
+  }
+  throw new Error("--mode must be bare-metal or vm.");
+}
+
+function displayAccessMode(value) {
+  return value === "vm" ? "VM" : "Bare Metal";
+}
+
+function normalizeClusterType(value) {
+  const normalized = String(value || "").trim().toLowerCase();
+  if (["k8s", "kube", "kubernetes"].includes(normalized)) {
+    return "kubernetes";
+  }
+  if (["slurm", "scheduler"].includes(normalized)) {
+    return "slurm";
+  }
+  throw new Error("--type must be kubernetes or slurm.");
+}
+
+function displayClusterType(value) {
+  const normalized = String(value || "").trim().toLowerCase();
+  if (normalized === "slurm") {
+    return "Slurm";
+  }
+  if (normalized === "kubernetes" || normalized === "k8s" || normalized === "kube") {
+    return "Kubernetes";
+  }
+  return value ? String(value) : "Cluster";
+}
+
+function normalizeClusterNetwork(value) {
+  const normalized = String(value || "").trim().toLowerCase();
+  if (normalized === "public") {
+    return "public";
+  }
+  if (normalized === "private" || normalized === "private-vpn" || normalized === "vpn") {
+    return "private";
+  }
+  throw new Error("--network must be public or private.");
+}
+
+function normalizeNodeNetwork(value) {
+  return normalizeClusterNetwork(value);
+}
+
+function looksLikePublicKey(value) {
+  return /^(ssh-ed25519|ssh-rsa|ecdsa-sha2-|sk-ssh-|sk-ecdsa-)\S*\s+\S+/.test(String(value || "").trim());
+}
+
+function looksLikePath(value) {
+  const text = String(value || "").trim();
+  return text.startsWith("~") || text.startsWith(".") || text.includes("/") || text.endsWith(".pub");
+}
+
+function expandUserPath(value) {
+  const text = String(value || "").trim();
+  if (text === "~") {
+    return homedir();
+  }
+  if (text.startsWith("~/")) {
+    return join(homedir(), text.slice(2));
+  }
+  return text;
+}
+
+function sleep(milliseconds) {
+  return new Promise((resolve) => setTimeout(resolve, Math.max(0, milliseconds)));
+}
+
 function requiredArrayOption(value, name) {
   const values = arrayOption(value).map((item) => String(item).trim());
   if (!values.length || values.some((item) => !item)) {
@@ -2041,6 +4498,15 @@ function requiredOption(value, name) {
   return value;
 }
 
+function optionalStringOption(value) {
+  if (!optionProvided(value)) {
+    return null;
+  }
+  const raw = Array.isArray(value) ? value[value.length - 1] : value;
+  const text = String(raw || "").trim();
+  return text || null;
+}
+
 function numberOption(value, name) {
   const parsed = Number(requiredOption(value, name));
   if (!Number.isFinite(parsed)) {
@@ -2073,6 +4539,14 @@ function positiveIntegerOption(value, name) {
   return parsed;
 }
 
+function nonNegativeIntegerOption(value, name) {
+  const parsed = numberOption(value, name);
+  if (!Number.isInteger(parsed) || parsed < 0) {
+    throw new Error(`${name} must be a non-negative integer.`);
+  }
+  return parsed;
+}
+
 function dateRangeOptions(options) {
   const startDate = dateOption(options.startDate, "--start-date");
   const endDate = dateOption(options.endDate, "--end-date");
@@ -2126,6 +4600,13 @@ function arrayOption(value) {
   return Array.isArray(value) ? value : [value];
 }
 
+function arrayOptionPreserveEmpty(value) {
+  if (value === undefined || value === null) {
+    return [];
+  }
+  return Array.isArray(value) ? value : [value];
+}
+
 async function readJsonOption(value) {
   if (value === undefined) {
     return undefined;