@ornncompute/cli 0.1.3 → 0.1.5

package/src/cli.mjs

@@ -1,15 +1,25 @@
 import { spawn } from "node:child_process";
-import { readFile, writeFile } from "node:fs/promises";
+import { randomUUID } from "node:crypto";
+import { mkdir, mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
 import { createRequire } from "node:module";
-import { homedir } from "node:os";
-import { join } from "node:path";
+import { isIP } from "node:net";
+import { homedir, tmpdir } from "node:os";
+import { basename, join } from "node:path";
 
 import {
   CliApiError,
   cliRequest,
   computeEndpoint,
+  operatorRequest,
+  resolveInstallerBaseUrl,
 } from "./api-client.mjs";
-import { clearAuthSession, getAuthConfigPath, loadAuthSession, saveAuthSession } from "./auth-store.mjs";
+import {
+  clearAuthSession,
+  getAuthConfigPath,
+  getFleetConfigDir,
+  loadAuthSession,
+  saveAuthSession,
+} from "./auth-store.mjs";
 import {
   DeviceAuthError,
   openBrowser,
@@ -17,6 +27,7 @@ import {
   startDeviceFlow,
   waitForDeviceApproval,
 } from "./device-auth.mjs";
+import { maybeNotifyUpdate, updateCommand } from "./update.mjs";
 
 const { version: VERSION } = createRequire(import.meta.url)("../package.json");
 const DEFAULT_BUY_NOW_USD_PER_GPU_HOUR = 10;
@@ -56,8 +67,20 @@ Examples:
   ornn nodes launch <reservation-id> --key ~/.ssh/id_ed25519.pub --wait
   ornn metrics node <machine-id>
   ornn clusters create <reservation-id> --type kubernetes --wait
+  ornn slurm launch <reservation-id> --wait
+  ornn kubernetes launch <reservation-id> --wait
   ornn networks list
   ornn storage volumes list
+  ornn storage deploy <drive-id> --reservation <reservation-id>
+  ornn storage deploy status --reservation <reservation-id>
+  ornn storage unmount --reservation <reservation-id>
+  ornn storage undeploy --reservation <reservation-id>
+  ornn storage filesystem deploy --reservation <reservation-id>
+  ornn storage filesystem delete --reservation <reservation-id>
+  ornn storage buckets connect gcs --bucket <bucket>
+  ornn storage buckets connect s3 --bucket <bucket> [--access-key-id <id> --secret-access-key-file <path>]
+  ornn storage buckets connect r2 --bucket <bucket> --account-id <id> [--access-key-id <id> --secret-access-key-file <path>]
+  ornn storage buckets verify <drive-id>
   ornn ssh <machine-id>
 
 Run \`ornn --help\` for all commands, or \`ornn help <command>\`.
@@ -68,30 +91,53 @@ const HELP = `Ornn CLI
 Usage:
   ornn help [command]
   ornn login [--auth-base <url>] [--no-browser] [--timeout <seconds>]
+  ornn update
   ornn whoami [--json]
   ornn status [--json]
   ornn listings list [--gpu-type <type>] [--facility <name>] [--operator <name>] [--json]
   ornn listings show <listing-id> [--open] [--json]
   ornn buy <listing-id> [--no-open] [--json]
   ornn exchange create <listing-id> --gpu-count <n> --min-gpu-count <n> --start-date <yyyy-mm-dd> --end-date <yyyy-mm-dd> --price <usd> [--no-open] [--json]
-  ornn exchange list [--json]
+  ornn exchange list [--limit <1-500>] [--cursor <last-id>] [--json]
   ornn exchange show <exchange-id> [--open] [--json]
   ornn exchange update <exchange-id> --gpu-count <n> --min-gpu-count <n> --start-date <yyyy-mm-dd> --end-date <yyyy-mm-dd> --price <usd>
   ornn exchange withdraw <exchange-id>
-  ornn gpus list [--status <status>] [--json]
+  ornn gpus list [--status <status>] [--limit <1-500>] [--cursor <last-id>] [--json]
   ornn gpus show <gpu-id> [--open] [--json]
   ornn gpus checkout <gpu-id> [--no-open] [--json]
   ornn nodes list [--json]
   ornn nodes show <node-id> [--json]
   ornn nodes launch <reservation-id> --key <path|id|label> [--mode bare-metal|vm] [--username <name>] [--network public|private] [--storage-load-drive-id <id>] [--storage-save-drive-id <id>] [--wait] [--json]
+  ornn nodes switch <reservation-id> --network public|private --key <path|id|label> [--mode bare-metal|vm] [--username <name>] [--wait] [--json]
   ornn nodes wait <node-or-reservation-id> [--timeout <seconds>] [--json]
-  ornn nodes start <node-id> [--json]
-  ornn nodes stop <node-id> [--json]
-  ornn nodes teardown <node-id> [--json]
-  ornn nodes revoke <node-id> [--json]
+  ornn nodes reboot <node-id> [--json]
+  ornn nodes hard-reset <node-id> [--json]
   ornn nodes ssh-command <node-or-reservation-id> [--json]
   ornn nodes keys attach <node-id> --key <path|id|label> [--json]
   ornn nodes keys list <node-id> [--json]
+  ornn node health <node-id> [--json]
+  ornn node diagnose <node-id> [--json]
+  ornn node deenroll <node-id> [--reason <text>] [--keep-record] [--json]
+  ornn node list [--operator <id-or-slug>] [--facility <id>] [--json]
+  ornn node reboot <node-id> [--json]
+  ornn node hard-reset <node-id> [--json]
+  ornn node off-grid <node-id> [--reason <text>] [--json]
+  ornn node on-grid <node-id> [--json]
+  ornn node terminate <node-id> [--reason <text>] [--force] [--json]
+  ornn node admin-key <node-id> [--json]
+  ornn operators list [--json]
+  ornn facilities list [--operator <id-or-slug>] [--json]
+  ornn tokens list [--json]
+  ornn tokens create --operator <id> [--facility <id>] [--expires-in <seconds>] [--mode bare-metal|vm] [--ip <addr>] [--force] [--json]
+  ornn tokens revoke <token-id> [--json]
+  ornn fleet clean <ip>... --operator <id-or-slug> --ib-island <name> --identity-file <path> --dry-run [--ssh-user ubuntu|admin|ornn] [--json]
+  ornn fleet clean <failed-fleet-id> --identity-file <path> --dry-run [--json]
+  ornn fleet clean <fleet-id> --identity-file <path> --confirm-clean <plan-hash> [--json]
+  ornn fleet enroll <fleet-id> --identity-file <path> [--confirm-takeover <ip[,ip...]>] [--json]
+  ornn fleet deploy <fleet-id> --tenant <email> --user <email-or-id> [--commerce-reservation <id>] [--network public|private] [--json]
+  ornn reservations withdraw <reservation-id> [--json]
+  ornn reservations transfer <reservation-id> --target-tenant <id> [--target-user <id>] [--node <id>] [--strategy reject|park] [--confirm] [--json]
+  ornn reservations deploy <node-id> --target-tenant <id> [--target-user <id>] [--network public|private] [--json]
   ornn ssh <node-or-reservation-id> [--print] [--identity-file <path>] [--user <name>] [--json]
   ornn metrics nodes [--json]
   ornn metrics node <node-id> [--json]
@@ -110,6 +156,16 @@ Usage:
   ornn clusters add-node <reservation-id> --node <node-id> [--json]
   ornn clusters remove-node <reservation-id> --node <node-id> [--json]
   ornn clusters teardown <reservation-id> [--type kubernetes|slurm] [--json]
+  ornn slurm launch <reservation-id> [--network public|private] [--node <node-id>] [--node-count <n>] [--wait] [--wait-timeout <seconds>] [--json]
+  ornn slurm teardown <reservation-id> [--json]
+  ornn slurm status <reservation-id> [--json]
+  ornn slurm credentials <reservation-id> [--json]
+  ornn slurm ssh <reservation-id> [--print] [--identity-file <path>] [--user <name>] [--json]
+  ornn kubernetes launch <reservation-id> [--network public|private] [--node <node-id>] [--node-count <n>] [--wait] [--wait-timeout <seconds>] [--json]
+  ornn kubernetes teardown <reservation-id> [--json]
+  ornn kubernetes status <reservation-id> [--json]
+  ornn kubernetes credentials <reservation-id> [--json]
+  ornn kubernetes kubeconfig <reservation-id> [--output <path>] [--json]
   ornn networks list [--json]
   ornn networks show <network-id> [--json]
   ornn networks create --name <name> [--cidr <cidr>] [--description <text>] [--json]
@@ -124,11 +180,25 @@ Usage:
   ornn storage volumes refresh <drive-id> [--json]
   ornn storage volumes clear <drive-id> [--json]
   ornn storage volumes delete <drive-id> [--json]
+  ornn storage deploy <drive-id> --reservation <reservation-id> [--mount-path <path>] [--read-only|--read-write] [--json]
+  ornn storage deploy status --reservation <reservation-id> [--json]
+  ornn storage unmount --reservation <reservation-id> [--json]
+  ornn storage undeploy --reservation <reservation-id> [--json]
+  ornn storage filesystem deploy --reservation <reservation-id> [--performance-tier <tier>] [--capacity-gib <gib>] [--json]
+  ornn storage filesystem status --reservation <reservation-id> [--json]
+  ornn storage filesystem delete --reservation <reservation-id> [--json]
+  ornn storage buckets list [--json]
+  ornn storage buckets show <drive-id> [--json]
+  ornn storage buckets connect gcs|s3|r2 --bucket <bucket>|--url <url> [--name <name>] [--prefix <prefix>] [--region <region>] [--account-id <id>|--endpoint-url <url>] [--access-key-id <id> --secret-access-key-file <path>] [--read-only|--read-write] [--verify] [--json]
+  ornn storage buckets update-credentials <drive-id> --access-key-id <id> --secret-access-key-file <path> [--json]
+  ornn storage buckets verify <drive-id> [--json]
+  ornn storage buckets disconnect <drive-id> [--json]
   ornn keys list [--json]
   ornn keys add [<public-key-file>] [--public-key <key>] [--label <label>] [--json]
   ornn keys delete <key-id> [--json]
   ornn access show <reservation-id> [--json]
   ornn access activate <reservation-id> --key <path|id|label> [--mode bare-metal|vm] [--username <name>] [--network public|private] [--storage-load-drive-id <id>] [--storage-save-drive-id <id>] [--wait] [--no-open] [--json]
+  ornn access switch <reservation-id> --network public|private --key <path|id|label> [--mode bare-metal|vm] [--username <name>] [--wait] [--json]
   ornn access push-keys <reservation-id> --ssh-key-id <id> [--json]
   ornn access keys list <reservation-id> [--json]
   ornn access keys add <reservation-id> --public-key <key> [--label <label>] [--json]
@@ -151,10 +221,20 @@ Aliases:
   exchange = bid
   gpus = reservations
 
+Operator commands:
+  The \`ornn node\` / operator reservation verbs are for Ornn staff. Prefer
+  \`ornn login\` as an internal-allowed user (ORNN_AUTH_BASE_URL); the CLI
+  proxies through web and the server attaches the review secret. Optionally set
+  ORNN_INTERNAL_REVIEW_SECRET + ORNN_COMPUTE_BASE_URL for direct compute access
+  (CI / break-glass).
+
 Environment:
-  ORNN_AUTH_BASE_URL  Web/auth server origin. Defaults to http://localhost:3000.
-  ORNN_API_BASE_URL   Optional web API origin. Defaults to ORNN_AUTH_BASE_URL.
-  ORNN_CONFIG_HOME    Directory for CLI auth state. Defaults to ~/.config/ornn.
+  ORNN_AUTH_BASE_URL         Web/auth server origin. Falls back to authBaseUrl in
+                             config.json, then http://localhost:3000.
+  ORNN_API_BASE_URL          Optional web API origin. Defaults to ORNN_AUTH_BASE_URL.
+  ORNN_CONFIG_HOME           Directory for CLI auth state. Defaults to ~/.config/ornn.
+  ORNN_COMPUTE_BASE_URL      Optional compute origin when using ORNN_INTERNAL_REVIEW_SECRET.
+  ORNN_INTERNAL_REVIEW_SECRET  Optional reviewer secret for direct compute operator calls.
 
 Output:
   Commands print human-readable output by default.
@@ -174,9 +254,12 @@ const HELP_TOPICS = new Set([
   "cluster",
   "clusters",
   "exchange",
+  "facilities",
+  "fleet",
   "gpu",
   "gpus",
   "help",
+  "kubernetes",
   "listing",
   "listings",
   "login",
@@ -185,20 +268,55 @@ const HELP_TOPICS = new Set([
   "metrics",
   "network",
   "networks",
+  "node",
   "nodes",
+  "operators",
   "reservations",
   "ssh",
   "ssh-keys",
+  "slurm",
   "status",
   "storage",
+  "tokens",
+  "update",
   "whoami",
 ]);
 
+const NODE_OP_SUBCOMMANDS = new Set([
+  "health",
+  "diagnose",
+  "deenroll",
+  "list",
+  "reboot",
+  "hard-reset",
+  "off-grid",
+  "on-grid",
+  "terminate",
+  "admin-key",
+]);
+const OPERATOR_COMMANDS = new Set(["operators", "facilities", "tokens"]);
 const LISTINGS_COMMANDS = new Set(["availability", "listing", "listings"]);
 const EXCHANGE_COMMANDS = new Set(["bid", "bids", "exchange"]);
 const GPU_COMMANDS = new Set(["gpu", "gpus", "reservations"]);
+// Operator-only verbs layered onto `ornn reservations`; distinct from the
+// tenant list|show|checkout verbs, which route through the /api/cli proxy.
+const RESERVATION_OP_SUBCOMMANDS = new Set(["withdraw", "transfer", "deploy"]);
 
 export async function run(argv = [], io = {}) {
+  const exitCode = await dispatch(argv, io);
+  if (argv[0] !== "update") {
+    await maybeNotifyUpdate({
+      binPath: io.binPath ?? process.argv[1],
+      currentVersion: VERSION,
+      env: io.env ?? process.env,
+      fetchImpl: io.fetch ?? fetch,
+      stderr: io.stderr ?? process.stderr,
+    });
+  }
+  return exitCode;
+}
+
+async function dispatch(argv = [], io = {}) {
   const stdout = io.stdout ?? process.stdout;
   const stderr = io.stderr ?? process.stderr;
   const env = io.env ?? process.env;
@@ -244,6 +362,19 @@ export async function run(argv = [], io = {}) {
       return await login(args, { env, fetchImpl, openBrowserImpl, stderr, stdout });
     }
 
+    if (command === "update") {
+      parseCommandOptions(args, {}, "Usage: ornn update");
+      return await updateCommand({
+        binPath: io.binPath ?? process.argv[1],
+        currentVersion: VERSION,
+        env,
+        fetchImpl,
+        spawnProcess,
+        stderr,
+        stdout,
+      });
+    }
+
     if (command === "whoami" || command === "account") {
       return await whoami(args, { env, fetchImpl, stderr, stdout });
     }
@@ -272,8 +403,20 @@ export async function run(argv = [], io = {}) {
       return await reservations(args, { commandName: command, env, fetchImpl, openBrowserImpl, stdout });
     }
 
+    if (command === "node") {
+      return await nodeOps(args, { env, fetchImpl, stdout });
+    }
+
+    if (command === "fleet") {
+      return await fleet(args, { env, fetchImpl, spawnProcess, stderr, stdout, sleep: io.sleep });
+    }
+
+    if (OPERATOR_COMMANDS.has(command)) {
+      return await operatorResource(command, args, { env, fetchImpl, stdout });
+    }
+
     if (command === "nodes") {
-      return await nodes(args, { env, fetchImpl, openBrowserImpl, spawnProcess, stdout });
+      return await nodes(args, { env, fetchImpl, openBrowserImpl, spawnProcess, stderr, stdout });
     }
 
     if (command === "ssh") {
@@ -281,13 +424,21 @@ export async function run(argv = [], io = {}) {
     }
 
     if (command === "metrics") {
-      return await metrics(args, { env, fetchImpl, stdout });
+      return await metrics(args, { env, fetchImpl, stderr, stdout });
     }
 
     if (command === "clusters" || command === "cluster") {
       return await clusters(args, { env, fetchImpl, spawnProcess, stdout });
     }
 
+    if (command === "slurm") {
+      return await slurm(args, { env, fetchImpl, spawnProcess, stdout });
+    }
+
+    if (command === "kubernetes") {
+      return await kubernetes(args, { env, fetchImpl, spawnProcess, stdout });
+    }
+
     if (command === "networks" || command === "network") {
       return await networks(args, { env, fetchImpl, stdout });
     }
@@ -354,6 +505,10 @@ function validateHelpInvocation(command, args) {
     return validateNoPositionals(args, "Usage: ornn logout");
   }
 
+  if (command === "update") {
+    return validateNoPositionals(args, "Usage: ornn update");
+  }
+
   if (command === "whoami" || command === "account") {
     return validateNoPositionals(args, "Usage: ornn whoami [--json]", { booleanOptions: ["--json"] });
   }
@@ -402,7 +557,7 @@ function validateHelpInvocation(command, args) {
   }
 
   if (EXCHANGE_COMMANDS.has(command)) {
-    const parsed = parseHelpArgs(args, { booleanOptions: ["--json", "--no-open", "--open"], valueOptions: ["--end-date", "--gpu-count", "--min-gpu-count", "--price", "--start-date"] });
+    const parsed = parseHelpArgs(args, { booleanOptions: ["--json", "--no-open", "--open"], valueOptions: ["--cursor", "--end-date", "--gpu-count", "--limit", "--min-gpu-count", "--price", "--start-date"] });
     if (parsed.error) {
       return parsed.error;
     }
@@ -418,12 +573,29 @@ function validateHelpInvocation(command, args) {
   }
 
   if (GPU_COMMANDS.has(command)) {
-    const parsed = parseHelpArgs(args, { booleanOptions: ["--json", "--no-open", "--open"], valueOptions: ["--status"] });
+    const parsed = parseHelpArgs(args, {
+      booleanOptions: ["--json", "--no-open", "--open", "--confirm"],
+      valueOptions: [
+        "--cursor",
+        "--limit",
+        "--status",
+        "--target-tenant",
+        "--target-user",
+        "--node",
+        "--strategy",
+        "--network",
+      ],
+    });
     if (parsed.error) {
       return parsed.error;
     }
     const [subcommand, id, ...extra] = parsed.positionals;
     const usageCommand = command === "reservations" ? "reservations" : "gpus";
+    // Operator-only verbs are exposed under `ornn reservations`; leave strict
+    // validation to the handler and just surface parse errors.
+    if (usageCommand === "reservations" && RESERVATION_OP_SUBCOMMANDS.has(subcommand)) {
+      return null;
+    }
     if (!subcommand || subcommand === "list") {
       return id || extra.length ? `Usage: ornn ${usageCommand} list|show|checkout` : null;
     }
@@ -433,6 +605,62 @@ function validateHelpInvocation(command, args) {
     return `Usage: ornn ${usageCommand} list|show|checkout`;
   }
 
+  if (command === "node") {
+    const parsed = parseHelpArgs(args, {
+      booleanOptions: ["--json", "--keep-record", "--force"],
+      valueOptions: ["--reason", "--operator", "--facility", "--ssh-username", "--ssh-port"],
+    });
+    if (parsed.error) {
+      return parsed.error;
+    }
+    const [subcommand, , ...extra] = parsed.positionals;
+    if (!subcommand || !NODE_OP_SUBCOMMANDS.has(subcommand)) {
+      return "Usage: ornn node list|health|diagnose|reboot|hard-reset|off-grid|on-grid|terminate|admin-key|deenroll <node-id>";
+    }
+    return extra.length ? nodeOpUsage(subcommand) : null;
+  }
+
+  if (command === "fleet") {
+    const parsed = parseHelpArgs(args, {
+      booleanOptions: ["--dry-run", "--json"],
+      valueOptions: [
+        "--operator",
+        "--ib-island",
+        "--identity-file",
+        "--confirm-clean",
+        "--confirm-takeover",
+        "--ssh-user",
+        "--ssh-port",
+        "--parallel",
+        "--timeout",
+        "--tenant",
+        "--user",
+        "--commerce-reservation",
+        "--network",
+      ],
+    });
+    if (parsed.error) {
+      return parsed.error;
+    }
+    const [subcommand, ...positionals] = parsed.positionals;
+    if (subcommand === "clean") {
+      return positionals.length
+        ? null
+        : "Usage: ornn fleet clean <ip>... --operator <id-or-slug> --ib-island <name> --identity-file <path> --dry-run";
+    }
+    if (subcommand === "enroll") {
+      return positionals.length === 1
+        ? null
+        : "Usage: ornn fleet enroll <fleet-id> --identity-file <path>";
+    }
+    if (subcommand === "deploy") {
+      return positionals.length === 1
+        ? null
+        : "Usage: ornn fleet deploy <fleet-id> --tenant <email> --user <email-or-id> [--commerce-reservation <id>]";
+    }
+    return "Usage: ornn fleet clean|enroll|deploy";
+  }
+
   if (command === "nodes") {
     const parsed = parseHelpArgs(args, {
       booleanOptions: ["--json", "--no-open", "--open", "--wait"],
@@ -472,13 +700,17 @@ function validateHelpInvocation(command, args) {
       }
       return !id ? null : "Usage: ornn nodes keys list|attach|push|status <node-id>";
     }
-    if (["show", "wait", "start", "stop", "teardown", "revoke", "ssh-command"].includes(subcommand)) {
-      return nested || extra.length ? "Usage: ornn nodes list|show|launch|wait|start|stop|teardown|revoke|ssh-command|keys" : null;
+    if (["show", "wait", "reboot", "hard-reset", "ssh-command"].includes(subcommand)) {
+      return nested || extra.length
+        ? "Usage: ornn nodes list|show|launch|switch|wait|reboot|hard-reset|ssh-command|keys"
+        : null;
     }
-    if (subcommand === "launch") {
-      return nested || extra.length ? "Usage: ornn nodes launch <reservation-id> --key <path|id|label>" : null;
+    if (subcommand === "launch" || subcommand === "switch") {
+      return nested || extra.length
+        ? `Usage: ornn nodes ${subcommand} <reservation-id> --key <path|id|label>`
+        : null;
     }
-    return "Usage: ornn nodes list|show|launch|wait|start|stop|teardown|revoke|ssh-command|keys";
+    return "Usage: ornn nodes list|show|launch|switch|wait|reboot|hard-reset|ssh-command|keys";
   }
 
   if (command === "ssh") {
@@ -565,6 +797,59 @@ function validateHelpInvocation(command, args) {
     return "Usage: ornn clusters list|reservations|eligible-nodes|create|show|wait|credentials|kubeconfig|ssh-command|ssh|add-node|remove-node|teardown";
   }
 
+  if (command === "slurm") {
+    const parsed = parseHelpArgs(args, {
+      booleanOptions: ["--json", "--print", "--wait"],
+      valueOptions: [
+        "--identity-file",
+        "--network",
+        "--node",
+        "--node-count",
+        "--timeout",
+        "--user",
+        "--wait-interval",
+        "--wait-timeout",
+      ],
+    });
+    if (parsed.error) {
+      return parsed.error;
+    }
+    const [subcommand, id, ...extra] = parsed.positionals;
+    if (["credentials", "launch", "ssh", "status", "teardown"].includes(subcommand)) {
+      if (!id) {
+        return "Usage: ornn slurm launch|teardown|status|credentials|ssh <reservation-id>";
+      }
+      return extra.length ? "Usage: ornn slurm launch|teardown|status|credentials|ssh <reservation-id>" : null;
+    }
+    return "Usage: ornn slurm launch|teardown|status|credentials|ssh <reservation-id>";
+  }
+
+  if (command === "kubernetes") {
+    const parsed = parseHelpArgs(args, {
+      booleanOptions: ["--json", "--wait"],
+      valueOptions: [
+        "--network",
+        "--node",
+        "--node-count",
+        "--output",
+        "--timeout",
+        "--wait-interval",
+        "--wait-timeout",
+      ],
+    });
+    if (parsed.error) {
+      return parsed.error;
+    }
+    const [subcommand, id, ...extra] = parsed.positionals;
+    if (["credentials", "kubeconfig", "launch", "status", "teardown"].includes(subcommand)) {
+      if (!id) {
+        return "Usage: ornn kubernetes launch|teardown|status|credentials|kubeconfig <reservation-id>";
+      }
+      return extra.length ? "Usage: ornn kubernetes launch|teardown|status|credentials|kubeconfig <reservation-id>" : null;
+    }
+    return "Usage: ornn kubernetes launch|teardown|status|credentials|kubeconfig <reservation-id>";
+  }
+
   if (command === "networks" || command === "network") {
     const parsed = parseHelpArgs(args, {
       booleanOptions: ["--clear-description", "--json"],
@@ -587,8 +872,8 @@ function validateHelpInvocation(command, args) {
 
   if (command === "storage") {
     const parsed = parseHelpArgs(args, {
-      booleanOptions: ["--json"],
-      valueOptions: ["--name", "--source", "--source-drive-id"],
+      booleanOptions: ["--json", "--read-only", "--read-write", "--verify"],
+      valueOptions: ["--access-key-id", "--account-id", "--bucket", "--endpoint-url", "--mount-path", "--name", "--prefix", "--region", "--reservation", "--reservation-id", "--secret-access-key", "--secret-access-key-file", "--source", "--source-drive-id", "--url"],
     });
     if (parsed.error) {
       return parsed.error;
@@ -597,8 +882,48 @@ function validateHelpInvocation(command, args) {
     if (!resource) {
       return null;
     }
+    if (resource === "deploy") {
+      if (subcommand === "status") {
+        return id || extra.length
+          ? "Usage: ornn storage deploy status --reservation <reservation-id> [--json]"
+          : null;
+      }
+      return !subcommand || id || extra.length
+        ? "Usage: ornn storage deploy <drive-id> --reservation <reservation-id> [--mount-path <path>] [--read-only|--read-write] [--json]"
+        : null;
+    }
+    if (resource === "unmount" || resource === "undeploy") {
+      return subcommand || id || extra.length
+        ? `Usage: ornn storage ${resource} --reservation <reservation-id> [--json]`
+        : null;
+    }
+    if (resource === "buckets") {
+      if (!subcommand || subcommand === "list") {
+        return id || extra.length ? "Usage: ornn storage buckets list [--json]" : null;
+      }
+      if (subcommand === "show") {
+        return !id || extra.length ? "Usage: ornn storage buckets show <drive-id> [--json]" : null;
+      }
+      if (subcommand === "connect") {
+        return !["gcs", "s3", "r2"].includes(id) || extra.length
+          ? "Usage: ornn storage buckets connect gcs|s3|r2 --bucket <bucket>|--url <url> [--name <name>] [--prefix <prefix>] [--region <region>] [--account-id <id>|--endpoint-url <url>] [--access-key-id <id> --secret-access-key-file <path>] [--read-only|--read-write] [--verify] [--json]"
+          : null;
+      }
+      if (subcommand === "verify") {
+        return !id || extra.length ? "Usage: ornn storage buckets verify <drive-id> [--json]" : null;
+      }
+      if (subcommand === "update-credentials") {
+        return !id || extra.length
+          ? "Usage: ornn storage buckets update-credentials <drive-id> --access-key-id <id> --secret-access-key-file <path> [--json]"
+          : null;
+      }
+      if (subcommand === "disconnect") {
+        return !id || extra.length ? "Usage: ornn storage buckets disconnect <drive-id> [--json]" : null;
+      }
+      return "Usage: ornn storage buckets list|show|connect|verify|update-credentials|disconnect";
+    }
     if (!["drives", "volumes"].includes(resource)) {
-      return "Usage: ornn storage volumes list|show|create|refresh|clear|delete";
+      return "Usage: ornn storage volumes list|show|create|refresh|clear|delete; ornn storage buckets connect gcs|s3|r2 --bucket <bucket>";
     }
     if (!subcommand || subcommand === "list") {
       return id || extra.length ? "Usage: ornn storage volumes list [--json]" : null;
@@ -642,10 +967,12 @@ function validateHelpInvocation(command, args) {
       }
       return !id ? null : "Usage: ornn access keys list|add|push|status <reservation-id>";
     }
-    if (["show", "activate", "push-keys"].includes(subcommand)) {
-      return !id || nestedId || extra.length ? "Usage: ornn access show|activate|push-keys <reservation-id>" : null;
+    if (["show", "activate", "switch", "push-keys"].includes(subcommand)) {
+      return !id || nestedId || extra.length
+        ? "Usage: ornn access show|activate|switch|push-keys <reservation-id>"
+        : null;
     }
-    return !subcommand ? null : "Usage: ornn access show|activate|push-keys|keys <reservation-id>";
+    return !subcommand ? null : "Usage: ornn access show|activate|switch|push-keys|keys <reservation-id>";
   }
 
   if (command === "billing") {
@@ -684,6 +1011,22 @@ function validateHelpInvocation(command, args) {
     return "Usage: ornn ssh-keys list|add|delete";
   }
 
+  if (OPERATOR_COMMANDS.has(command)) {
+    // Operator resource commands accept a small, permissive option set; the
+    // handlers do the strict validation. Just surface parse errors here.
+    const parsed = parseHelpArgs(args, {
+      booleanOptions: ["--json", "--confirm", "--force"],
+      valueOptions: [
+        "--operator",
+        "--facility",
+        "--expires-in",
+        "--mode",
+        "--ip",
+      ],
+    });
+    return parsed.error || null;
+  }
+
   return `Unknown command: ${command}`;
 }
 
@@ -947,11 +1290,12 @@ async function bid(args, context) {
   if (subcommand === "list") {
     const options = parseCommandOptions(
       [id, ...rest].filter(Boolean),
-      { boolean: ["json"] },
-      `Usage: ornn ${commandName} list [--json]`,
+      { boolean: ["json"], value: ["limit", "cursor"] },
+      `Usage: ornn ${commandName} list [--limit <1-500>] [--cursor <last-id>] [--json]`,
     );
+    const { limit, cursor } = listPaginationOptions(options);
     const bids = await cliRequest({
-      endpoint: computeEndpoint("/tenants/me/bids"),
+      endpoint: computeEndpoint(`/tenants/me/bids${buildQuery({ limit, cursor })}`),
       env: context.env,
       fetchImpl: context.fetchImpl,
     });
@@ -1086,18 +1430,144 @@ async function bid(args, context) {
   throw new Error(commandUsage);
 }
 
+// Operator-only reservation verbs under `ornn reservations`: withdraw a node's
+// acceptance, transfer a reservation to another tenant, or deploy a specific
+// node to a tenant. All authenticate via operatorRequest (staff session proxy
+// or optional ORNN_INTERNAL_REVIEW_SECRET).
+async function reservationOp(subcommand, id, rest, context) {
+  if (subcommand === "withdraw") {
+    const usage = "Usage: ornn reservations withdraw <reservation-id> [--json]";
+    if (!id) {
+      throw new Error(usage);
+    }
+    const options = parseCommandOptions(rest, { boolean: ["json"] }, usage);
+    const result = await operatorRequest({
+      endpoint: `/internal/reservations/${encodeURIComponent(id)}/withdraw`,
+      env: context.env,
+      fetchImpl: context.fetchImpl,
+      method: "POST",
+    });
+    if (options.json) {
+      writeJson(context.stdout, result);
+    } else {
+      context.stdout.write(`Reservation ${id} acceptance withdrawn.\n`);
+      writeOptionalStatusLine(context.stdout, "Status", result?.status);
+    }
+    return 0;
+  }
+
+  if (subcommand === "transfer") {
+    const usage =
+      "Usage: ornn reservations transfer <reservation-id> --target-tenant <id> [--target-user <id>] [--node <id>] [--strategy reject|park] [--confirm] [--json]";
+    if (!id) {
+      throw new Error(usage);
+    }
+    const options = parseCommandOptions(
+      rest,
+      {
+        boolean: ["json", "confirm"],
+        value: ["target-tenant", "target-user", "node", "strategy"],
+      },
+      usage,
+    );
+    const targetTenant = optionalStringOption(options.targetTenant);
+    if (!targetTenant) {
+      throw new Error(usage);
+    }
+    const strategy = optionalStringOption(options.strategy) || "reject";
+    if (strategy !== "reject" && strategy !== "park") {
+      throw new Error(usage);
+    }
+    const body = {
+      target_tenant_id: targetTenant,
+      reserved_strategy: strategy,
+      confirm_reserved_transfer: options.confirm === true,
+    };
+    const targetUser = optionalStringOption(options.targetUser);
+    const nodeId = optionalStringOption(options.node);
+    if (targetUser) {
+      body.target_auth_user_id = targetUser;
+    }
+    if (nodeId) {
+      body.node_id = nodeId;
+    }
+    const result = await operatorRequest({
+      body,
+      endpoint: `/internal/reservations/${encodeURIComponent(id)}/transfer`,
+      env: context.env,
+      fetchImpl: context.fetchImpl,
+      method: "POST",
+    });
+    if (options.json) {
+      writeJson(context.stdout, result);
+    } else {
+      context.stdout.write(`Reservation ${id} transferred to tenant ${targetTenant}.\n`);
+    }
+    return 0;
+  }
+
+  if (subcommand === "deploy") {
+    const usage =
+      "Usage: ornn reservations deploy <node-id> --target-tenant <id> [--target-user <id>] [--network public|private] [--json]";
+    if (!id) {
+      throw new Error(usage);
+    }
+    const options = parseCommandOptions(
+      rest,
+      { boolean: ["json"], value: ["target-tenant", "target-user", "network"] },
+      usage,
+    );
+    const targetTenant = optionalStringOption(options.targetTenant);
+    if (!targetTenant) {
+      throw new Error(usage);
+    }
+    const network = optionalStringOption(options.network) || "public";
+    if (network !== "public" && network !== "private") {
+      throw new Error(usage);
+    }
+    const body = { target_tenant_id: targetTenant, network_mode: network };
+    const targetUser = optionalStringOption(options.targetUser);
+    if (targetUser) {
+      body.target_auth_user_id = targetUser;
+    }
+    const result = await operatorRequest({
+      body,
+      endpoint: `/internal/nodes/${encodeURIComponent(id)}/deploy`,
+      env: context.env,
+      fetchImpl: context.fetchImpl,
+      method: "POST",
+    });
+    if (options.json) {
+      writeJson(context.stdout, result);
+    } else {
+      context.stdout.write(`Node ${id} deployed to tenant ${targetTenant}.\n`);
+    }
+    return 0;
+  }
+
+  throw new Error("Usage: ornn reservations withdraw|transfer|deploy ...");
+}
+
 async function reservations(args, context) {
   const commandName = context.commandName === "reservations" ? "reservations" : "gpus";
   const commandUsage = `Usage: ornn ${commandName} list|show|checkout`;
   const [subcommand = "list", id, ...rest] = args;
 
+  // Operator-only verbs (withdraw|transfer|deploy) are exposed under
+  // `ornn reservations <verb>` and authenticate to compute with the reviewer
+  // secret; the tenant list|show|checkout verbs stay on the /api/cli proxy.
+  if (commandName === "reservations" && RESERVATION_OP_SUBCOMMANDS.has(subcommand)) {
+    return await reservationOp(subcommand, id, rest, context);
+  }
+
   if (subcommand === "list") {
     const options = parseCommandOptions(
       [id, ...rest].filter(Boolean),
-      { boolean: ["json"], value: ["status"] },
-      `Usage: ornn ${commandName} list [--status <status>] [--json]`,
+      { boolean: ["json"], value: ["status", "limit", "cursor"] },
+      `Usage: ornn ${commandName} list [--status <status>] [--limit <1-500>] [--cursor <last-id>] [--json]`,
     );
-    const query = buildQuery({ status: options.status });
+    const { limit, cursor } = listPaginationOptions(options);
+    const query = buildQuery({ status: options.status, limit, cursor });
     const rows = await cliRequest({
       endpoint: computeEndpoint(`/tenants/me/reservations${query}`),
       env: context.env,
@@ -1157,80 +1627,2146 @@ async function reservations(args, context) {
   throw new Error(commandUsage);
 }
 
-async function nodes(args, context) {
-  const [subcommand = "list", id, nested, ...rest] = args;
+// Operator-only surface (`ornn node`); distinct from tenant `ornn nodes`.
+async function nodeOps(args, context) {
+  const usage =
+    "Usage: ornn node list|health|diagnose|reboot|hard-reset|off-grid|on-grid|terminate|admin-key|deenroll <node-id>";
+  const [subcommand, id, ...rest] = args;
+  if (!subcommand || !NODE_OP_SUBCOMMANDS.has(subcommand)) {
+    throw new Error(usage);
+  }
 
   if (subcommand === "list") {
-    const options = parseCommandOptions(
-      [id, nested, ...rest].filter(Boolean),
-      { boolean: ["json"] },
-      "Usage: ornn nodes list [--json]",
-    );
-    const machines = await fetchTenantMachines(context);
-    if (options.json) {
-      writeJson(context.stdout, machines);
-    } else {
-      writeNodeList(context.stdout, machines);
-    }
-    return 0;
+    return await nodeOpList([id, ...rest].filter((value) => value !== undefined), context);
   }
 
-  if (subcommand === "show" && id) {
-    const options = parseCommandOptions(
-      [nested, ...rest].filter(Boolean),
-      { boolean: ["json"] },
-      "Usage: ornn nodes show <node-id> [--json]",
-    );
-    const machine = await fetchMachine(id, context);
+  if (!id) {
+    throw new Error(nodeOpUsage(subcommand));
+  }
+
+  if (subcommand === "deenroll") {
+    return await nodeDeenroll(id, rest, context);
+  }
+
+  if (subcommand === "reboot" || subcommand === "hard-reset") {
+    return await nodeRebootOp(subcommand, id, rest, context);
+  }
+
+  if (subcommand === "off-grid") {
+    return await nodeOffGridOp(id, rest, context);
+  }
+
+  if (subcommand === "on-grid") {
+    return await nodeOnGridOp(id, rest, context);
+  }
+
+  if (subcommand === "terminate") {
+    return await nodeTerminateOp(id, rest, context);
+  }
+
+  if (subcommand === "admin-key") {
+    return await nodeAdminKeyOp(id, rest, context);
+  }
+
+  if (subcommand === "health") {
+    const options = parseCommandOptions(rest, { boolean: ["json"] }, nodeOpUsage(subcommand));
+    const node = await operatorRequest({
+      endpoint: `/provisioning/nodes/${encodeURIComponent(id)}`,
+      env: context.env,
+      fetchImpl: context.fetchImpl,
+    });
     if (options.json) {
-      writeJson(context.stdout, machine);
+      writeJson(context.stdout, redactNodeSecrets(node));
     } else {
-      writeNodeDetail(context.stdout, machine);
+      writeNodeHealth(context.stdout, node);
     }
     return 0;
   }
 
-  if (subcommand === "launch" && id) {
-    const options = parseCommandOptions(
-      [nested, ...rest].filter(Boolean),
-      {
-        boolean: ["json", "no-open", "open", "wait"],
-        value: [
-          "key",
-          "key-id",
-          "label",
-          "machine-count",
-          "mode",
-          "network",
-          "network-mode",
-          "public-key",
-          "public-key-file",
-          "request-id",
-          "ssh-key-id",
-          "storage-load-drive-id",
-          "storage-save-drive-id",
-          "tenant-username",
-          "username",
-          "wait-interval",
-          "wait-timeout",
-        ],
-      },
-      "Usage: ornn nodes launch <reservation-id> --key <path|id|label> [--mode bare-metal|vm] [--username <name>] [--network public|private] [--storage-load-drive-id <id>] [--storage-save-drive-id <id>] [--wait] [--json]",
-    );
-    const result = await launchReservationAccess(id, options, context, { openDefault: false });
+  if (subcommand === "diagnose") {
+    const options = parseCommandOptions(rest, { boolean: ["json"] }, nodeOpUsage(subcommand));
+    // source.mode tags the validation run as CLI-originated for compute audit.
+    const packet = await operatorRequest({
+      body: { source: { mode: "cli" } },
+      endpoint: `/provisioning/nodes/${encodeURIComponent(id)}/tests`,
+      env: context.env,
+      fetchImpl: context.fetchImpl,
+      method: "POST",
+    });
     if (options.json) {
-      writeJson(context.stdout, result);
+      writeJson(context.stdout, packet);
     } else {
-      writeNodeLaunchResult(context.stdout, result);
+      context.stdout.write(`Node validation test run queued for node ${id}.\n`);
+      writeOptionalStatusLine(context.stdout, "Packet", packet?.packet_id ?? packet?.id);
+      writeOptionalStatusLine(context.stdout, "Request", packet?.request_id);
     }
     return 0;
   }
 
-  if (subcommand === "launch") {
-    throw new Error("Usage: ornn nodes launch <reservation-id> --key <path|id|label> [--mode bare-metal|vm] [--username <name>] [--network public|private] [--storage-load-drive-id <id>] [--storage-save-drive-id <id>] [--wait] [--json]");
-  }
+  throw new Error(usage);
+}
 
-  if (subcommand === "wait" && id) {
+function nodeOpUsage(subcommand) {
+  if (subcommand === "deenroll") {
+    return "Usage: ornn node deenroll <node-id> [--reason <text>] [--keep-record] [--json]";
+  }
+  if (subcommand === "list") {
+    return "Usage: ornn node list [--operator <id-or-slug>] [--facility <id>] [--json]";
+  }
+  if (subcommand === "off-grid") {
+    return "Usage: ornn node off-grid <node-id> [--reason <text>] [--json]";
+  }
+  if (subcommand === "on-grid") {
+    return "Usage: ornn node on-grid <node-id> [--json]";
+  }
+  if (subcommand === "terminate") {
+    return "Usage: ornn node terminate <node-id> [--reason <text>] [--force] [--json]";
+  }
+  if (subcommand === "admin-key") {
+    return "Usage: ornn node admin-key <node-id> [--json]";
+  }
+  return `Usage: ornn node ${subcommand} <node-id> [--json]`;
+}
+
+// List GPU nodes (operator surface), optionally filtered by operator and/or facility.
+async function nodeOpList(rest, context) {
+  const options = parseCommandOptions(
+    rest,
+    { boolean: ["json"], value: ["operator", "facility"] },
+    nodeOpUsage("list"),
+  );
+  const query = new URLSearchParams();
+  const operator = optionalStringOption(options.operator);
+  const facility = optionalStringOption(options.facility);
+  if (operator) {
+    // A UUID is treated as operator_id; anything else is the operator slug.
+    query.set(isUuid(operator) ? "operator_id" : "operator", operator);
+  }
+  if (facility) {
+    query.set("facility_id", facility);
+  }
+  const suffix = query.toString() ? `?${query.toString()}` : "";
+  const nodesList = await operatorRequest({
+    endpoint: `/provisioning/nodes${suffix}`,
+    env: context.env,
+    fetchImpl: context.fetchImpl,
+  });
+  const rows = Array.isArray(nodesList) ? nodesList : [];
+  if (options.json) {
+    writeJson(context.stdout, rows.map((node) => redactNodeSecrets(node)));
+  } else if (!rows.length) {
+    context.stdout.write("No nodes found.\n");
+  } else {
+    for (const node of rows) {
+      context.stdout.write(
+        `${node?.id ?? "unknown"}  ${node?.k8s_node_name ?? ""}  ${node?.gpu_type ?? ""} x${node?.gpu_count ?? 0}  ${node?.status ?? ""}\n`,
+      );
+    }
+  }
+  return 0;
+}
+
+// Reboot / hard-reset the live machine backing a node. The reboot endpoint is
+// instance-scoped, so resolve the node's assigned reservation -> machine first.
+async function nodeRebootOp(subcommand, id, rest, context) {
+  const options = parseCommandOptions(rest, { boolean: ["json"] }, nodeOpUsage(subcommand));
+  const instanceId = await resolveNodeInstanceId(id, context);
+  const result = await operatorRequest({
+    body: { mode: subcommand === "hard-reset" ? "hard_reset" : "reboot" },
+    endpoint: `/nodes/${encodeURIComponent(instanceId)}/reboot`,
+    env: context.env,
+    fetchImpl: context.fetchImpl,
+    method: "POST",
+  });
+  if (options.json) {
+    writeJson(context.stdout, result);
+  } else {
+    context.stdout.write(
+      subcommand === "hard-reset"
+        ? `Hard reset queued for node ${id} (storage/users wiped, keys re-pushed on reconnect; tenant keeps ownership).\n`
+        : `Reboot queued for node ${id} (storage and keys preserved).\n`,
+    );
+    writeOptionalStatusLine(context.stdout, "Instance", instanceId);
+    writeOptionalStatusLine(context.stdout, "State", result?.state);
+  }
+  return 0;
+}
+
+// Take a node off-grid: queue the agentless handoff that removes Ornn agent
+// management from the still-powered-on host.
+async function nodeOffGridOp(id, rest, context) {
+  const options = parseCommandOptions(
+    rest,
+    { boolean: ["json"], value: ["reason"] },
+    nodeOpUsage("off-grid"),
+  );
+  const reason = optionalStringOption(options.reason);
+  const result = await operatorRequest({
+    body: {
+      request_id: `cli-off-grid:${id}:${Date.now()}`,
+      ...(reason ? { reason } : {}),
+    },
+    endpoint: `/enrollment/nodes/${encodeURIComponent(id)}/agentless-handoff`,
+    env: context.env,
+    fetchImpl: context.fetchImpl,
+    method: "POST",
+  });
+  if (options.json) {
+    writeJson(context.stdout, result);
+  } else {
+    context.stdout.write(`Off-grid handoff queued for node ${id}.\n`);
+    writeOptionalStatusLine(context.stdout, "Status", result?.status);
+    writeOptionalStatusLine(context.stdout, "Request", result?.packet_request_id);
+  }
+  return 0;
+}
+
+// Bring an off-grid node back on-grid: SSH in with the stored admin key and
+// re-run the installer to restore Ornn agent management.
+async function nodeOnGridOp(id, rest, context) {
+  const options = parseCommandOptions(
+    rest,
+    { boolean: ["json"], value: ["ssh-username", "ssh-port"] },
+    nodeOpUsage("on-grid"),
+  );
+  const body = {};
+  const sshUsername = optionalStringOption(options.sshUsername);
+  const sshPort = optionalStringOption(options.sshPort);
+  if (sshUsername) {
+    body.ssh_username = sshUsername;
+  }
+  if (sshPort) {
+    body.ssh_port = Number.parseInt(sshPort, 10);
+  }
+  const result = await operatorRequest({
+    body,
+    endpoint: `/enrollment/nodes/${encodeURIComponent(id)}/agentless-handoff/on-grid`,
+    env: context.env,
+    fetchImpl: context.fetchImpl,
+    method: "POST",
+  });
+  if (options.json) {
+    writeJson(context.stdout, result);
+  } else {
+    context.stdout.write(`On-grid restore queued for node ${id}.\n`);
+    writeOptionalStatusLine(context.stdout, "Status", result?.status);
+  }
+  return 0;
+}
+
+// Terminate a node: best-effort clean the host, remove the Ornn agent, and
+// hard-delete the node record from the platform. Does NOT return it to a tenant.
+async function nodeTerminateOp(id, rest, context) {
+  const options = parseCommandOptions(
+    rest,
+    { boolean: ["json", "force"], value: ["reason"] },
+    nodeOpUsage("terminate"),
+  );
+  const reason = optionalStringOption(options.reason) || "cli-terminate";
+  const result = await operatorRequest({
+    body: {
+      request_id: `cli-terminate:${id}:${Date.now()}`,
+      reason,
+      force: options.force === true,
+    },
+    endpoint: `/enrollment/nodes/${encodeURIComponent(id)}/terminate`,
+    env: context.env,
+    fetchImpl: context.fetchImpl,
+    method: "POST",
+  });
+  if (options.json) {
+    writeJson(context.stdout, result);
+  } else {
+    context.stdout.write(`Termination queued for node ${id}.\n`);
+    writeOptionalStatusLine(context.stdout, "Status", result?.status);
+    writeOptionalStatusLine(context.stdout, "Request", result?.packet_request_id);
+  }
+  return 0;
+}
+
+// Fetch the Ornn admin SSH keypair for a node, including the private key, so an
+// operator can SSH into the host directly. Prints the private key; handle it as
+// a secret.
+async function nodeAdminKeyOp(id, rest, context) {
+  const options = parseCommandOptions(rest, { boolean: ["json"] }, nodeOpUsage("admin-key"));
+  const result = await operatorRequest({
+    endpoint: `/enrollment/admin-ssh-key?node_id=${encodeURIComponent(id)}`,
+    env: context.env,
+    fetchImpl: context.fetchImpl,
+  });
+  if (options.json) {
+    // Intentionally NOT redacted: this command exists to reveal the private key.
+    writeJson(context.stdout, result);
+  } else {
+    writeOptionalStatusLine(context.stdout, "Fingerprint", result?.fingerprint);
+    if (result?.public_key) {
+      context.stdout.write(`Public key:\n${result.public_key}\n`);
+    }
+    if (result?.private_key) {
+      context.stdout.write(`Private key:\n${result.private_key}\n`);
+    } else {
+      context.stdout.write("No private key returned (are you authenticated as a reviewer?).\n");
+    }
+  }
+  return 0;
+}
+
+// Resolve a node id to the id of its live standalone machine (instance) via the
+// node's assigned reservation, mirroring the reviewer node->reservation->machine
+// chain the internal dashboard uses.
+async function resolveNodeInstanceId(nodeId, context) {
+  const node = await operatorRequest({
+    endpoint: `/provisioning/nodes/${encodeURIComponent(nodeId)}`,
+    env: context.env,
+    fetchImpl: context.fetchImpl,
+  });
+  const labels = node?.labels && typeof node.labels === "object" ? node.labels : {};
+  const reservationId = labels["ornn.ai/assigned-reservation"];
+  if (!reservationId) {
+    throw new CliApiError(`Node ${nodeId} has no assigned reservation to reboot.`);
+  }
+  const machines = await operatorRequest({
+    endpoint: `/nodes/reservations/${encodeURIComponent(reservationId)}/machines`,
+    env: context.env,
+    fetchImpl: context.fetchImpl,
+  });
+  const rows = Array.isArray(machines?.machines) ? machines.machines : [];
+  const nodeRefs = new Set(
+    [nodeId, node?.id, node?.k8s_node_name]
+      .filter((value) => value !== null && value !== undefined && String(value) !== "")
+      .map(String),
+  );
+  const matches = rows.filter(
+    (machine) =>
+      nodeRefs.has(String(machine?.machine_node_id ?? machine?.node_id ?? "")),
+  );
+  if (matches.length > 1) {
+    throw new CliApiError(
+      `Multiple live machines found for node ${nodeId} (reservation ${reservationId}).`,
+    );
+  }
+  const instanceId = matches[0]?.id;
+  if (!instanceId) {
+    throw new CliApiError(`No live machine found for node ${nodeId} (reservation ${reservationId}).`);
+  }
+  return instanceId;
+}
+
+function isUuid(value) {
+  return /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(String(value ?? ""));
+}
+
+async function resolveOperatorId(operatorFilter, context) {
+  if (!operatorFilter || isUuid(operatorFilter)) {
+    return operatorFilter;
+  }
+  const operators = await operatorRequest({
+    endpoint: "/provisioning/operators",
+    env: context.env,
+    fetchImpl: context.fetchImpl,
+  });
+  const match = (Array.isArray(operators) ? operators : []).find(
+    (operator) => operator?.slug === operatorFilter,
+  );
+  if (!match?.id) {
+    throw new CliApiError(`No operator found for "${operatorFilter}".`);
+  }
+  return match.id;
+}
+
+// Operator-only resource commands: `ornn operators`, `ornn facilities`,
+// `ornn tokens`. All authenticate to compute directly with the reviewer secret.
+async function operatorResource(command, args, context) {
+  if (command === "operators") {
+    return await operatorsList(args, context);
+  }
+  if (command === "facilities") {
+    return await facilitiesList(args, context);
+  }
+  if (command === "tokens") {
+    return await tokensCommand(args, context);
+  }
+  throw new Error("Usage: ornn operators|facilities|tokens ...");
+}
+
+async function operatorsList(args, context) {
+  const usage = "Usage: ornn operators list [--json]";
+  const [subcommand = "list", ...rest] = args;
+  if (subcommand !== "list") {
+    throw new Error(usage);
+  }
+  const options = parseCommandOptions(rest, { boolean: ["json"] }, usage);
+  const operators = await operatorRequest({
+    endpoint: "/provisioning/operators",
+    env: context.env,
+    fetchImpl: context.fetchImpl,
+  });
+  const rows = Array.isArray(operators) ? operators : [];
+  if (options.json) {
+    writeJson(context.stdout, rows);
+  } else if (!rows.length) {
+    context.stdout.write("No operators found.\n");
+  } else {
+    for (const operator of rows) {
+      context.stdout.write(
+        `${operator?.id ?? "unknown"}  ${operator?.slug ?? ""}  ${operator?.display_name ?? ""}\n`,
+      );
+    }
+  }
+  return 0;
+}
+
+async function facilitiesList(args, context) {
+  const usage = "Usage: ornn facilities list [--operator <id-or-slug>] [--json]";
+  const [subcommand = "list", ...rest] = args;
+  if (subcommand !== "list") {
+    throw new Error(usage);
+  }
+  const options = parseCommandOptions(rest, { boolean: ["json"], value: ["operator"] }, usage);
+  const facilities = await operatorRequest({
+    endpoint: "/provisioning/facilities",
+    env: context.env,
+    fetchImpl: context.fetchImpl,
+  });
+  let rows = Array.isArray(facilities) ? facilities : [];
+  const operatorFilter = optionalStringOption(options.operator);
+  if (operatorFilter) {
+    const operatorId = await resolveOperatorId(operatorFilter, context);
+    rows = rows.filter((facility) => String(facility?.operator_id ?? "") === String(operatorId));
+  }
+  if (options.json) {
+    writeJson(context.stdout, rows);
+  } else if (!rows.length) {
+    context.stdout.write("No facilities found.\n");
+  } else {
+    for (const facility of rows) {
+      context.stdout.write(
+        `${facility?.id ?? "unknown"}  ${facility?.slug ?? ""}  ${facility?.display_name ?? ""}  ${facility?.region ?? ""}\n`,
+      );
+    }
+  }
+  return 0;
+}
+
+async function tokensCommand(args, context) {
+  const usage = "Usage: ornn tokens list|create|revoke ...";
+  const [subcommand, ...rest] = args;
+  if (subcommand === "list" || subcommand === undefined) {
+    const options = parseCommandOptions(rest, { boolean: ["json"] }, "Usage: ornn tokens list [--json]");
+    const tokens = await operatorRequest({
+      endpoint: "/enrollment/tokens",
+      env: context.env,
+      fetchImpl: context.fetchImpl,
+    });
+    const rows = Array.isArray(tokens) ? tokens : [];
+    if (options.json) {
+      writeJson(context.stdout, rows);
+    } else if (!rows.length) {
+      context.stdout.write("No enrollment tokens found.\n");
+    } else {
+      for (const token of rows) {
+        context.stdout.write(
+          `${token?.id ?? "unknown"}  ${token?.status ?? ""}  operator=${token?.operator_id ?? ""}  expires=${token?.expires_at ?? ""}\n`,
+        );
+      }
+    }
+    return 0;
+  }
+
+  if (subcommand === "create") {
+    const createUsage =
+      "Usage: ornn tokens create --operator <id-or-slug> [--facility <id>] [--expires-in <seconds>] [--mode bare-metal|vm] [--ip <addr>] [--force] [--json]";
+    const options = parseCommandOptions(
+      rest,
+      {
+        boolean: ["json", "force"],
+        value: ["operator", "facility", "expires-in", "mode", "ip"],
+      },
+      createUsage,
+    );
+    const operatorFilter = optionalStringOption(options.operator);
+    if (!operatorFilter) {
+      throw new Error(createUsage);
+    }
+    const operatorId = await resolveOperatorId(operatorFilter, context);
+    const body = { operator_id: operatorId };
+    const facility = optionalStringOption(options.facility);
+    const expiresIn = optionalStringOption(options.expiresIn);
+    if (facility) {
+      body.facility_id = facility;
+    }
+    if (expiresIn) {
+      body.expires_in_seconds = Number.parseInt(expiresIn, 10);
+    }
+    const token = await operatorRequest({
+      body,
+      endpoint: "/enrollment/tokens",
+      env: context.env,
+      fetchImpl: context.fetchImpl,
+      method: "POST",
+    });
+    const installCommand = buildEnrollmentInstallCommand({
+      env: context.env,
+      // The token already exists, so an unreadable session file must not stop it printing.
+      session: await loadAuthSession({ env: context.env }).catch(() => null),
+      token: token?.token,
+      mode: optionalStringOption(options.mode),
+      ip: optionalStringOption(options.ip),
+      force: options.force === true,
+    });
+    if (options.json) {
+      writeJson(context.stdout, { ...token, install_command: installCommand });
+    } else {
+      context.stdout.write(`Enrollment token created: ${token?.id ?? "unknown"}\n`);
+      writeOptionalStatusLine(context.stdout, "Token", token?.token);
+      writeOptionalStatusLine(context.stdout, "Expires", token?.expires_at);
+      if (installCommand) {
+        context.stdout.write(`Install command:\n${installCommand}\n`);
+      } else {
+        context.stdout.write(
+          "Install command unavailable: set ORNN_COMPUTE_BASE_URL / ORNN_INSTALLER_URL, or ORNN_AUTH_BASE_URL so the CLI can derive the compute origin.\n",
+        );
+      }
+    }
+    return 0;
+  }
+
+  if (subcommand === "revoke") {
+    const revokeUsage = "Usage: ornn tokens revoke <token-id> [--json]";
+    const [id, ...revokeRest] = rest;
+    if (!id) {
+      throw new Error(revokeUsage);
+    }
+    const options = parseCommandOptions(revokeRest, { boolean: ["json"] }, revokeUsage);
+    const result = await operatorRequest({
+      endpoint: `/enrollment/tokens/${encodeURIComponent(id)}/revoke`,
+      env: context.env,
+      fetchImpl: context.fetchImpl,
+      method: "POST",
+    });
+    if (options.json) {
+      writeJson(context.stdout, result);
+    } else {
+      context.stdout.write(`Enrollment token ${id} revoked.\n`);
+    }
+    return 0;
+  }
+
+  throw new Error(usage);
+}
+
+// Mirrors apps/web/lib/operator-enrollment.ts and the MCP token tool: the
+// compute /enrollment/tokens response has no ready-to-run command, so build it
+// from the issued token against the compute/installer origin (explicit or
+// derived from ORNN_AUTH_BASE_URL when using the staff operator proxy).
+function buildEnrollmentInstallCommand({
+  env = process.env,
+  session,
+  token,
+  mode,
+  ip,
+  force = false,
+} = {}) {
+  if (!token) {
+    return null;
+  }
+  const base = resolveInstallerBaseUrl({ env, session });
+  if (!base) {
+    return null;
+  }
+  const url = new URL("/enrollment/install", `${base}/`);
+  url.searchParams.set("token", token);
+  if (mode) {
+    url.searchParams.set("node_mode", mode);
+  }
+  if (ip) {
+    url.searchParams.set("ip", ip);
+  }
+  if (force) {
+    url.searchParams.set("force", "true");
+  }
+  return `curl -fsSL '${url.toString().replace(/'/g, "'\\''")}' | sudo bash`;
+}
+
+const FLEET_DEFAULT_PARALLEL = 4;
+const FLEET_DEFAULT_TIMEOUT_SECONDS = 600;
+const FLEET_RESULT_ERROR_MAX_LENGTH = 4000;
+const FLEET_MANAGEMENT_USERS = ["ubuntu", "admin", "ornn"];
+
+async function fleet(args, context) {
+  const [subcommand, ...rest] = args;
+  if (subcommand === "clean") {
+    return await fleetClean(rest, context);
+  }
+  if (subcommand === "enroll") {
+    return await fleetEnroll(rest, context);
+  }
+  if (subcommand === "deploy") {
+    return await fleetDeploy(rest, context);
+  }
+  throw new Error("Usage: ornn fleet clean|enroll|deploy");
+}
+
+async function fleetClean(args, context) {
+  const usage =
+    "Usage: ornn fleet clean <ip>... --operator <id-or-slug> --ib-island <name> --identity-file <path> --dry-run [--ssh-user ubuntu|admin|ornn] OR ornn fleet clean <failed-fleet-id> --identity-file <path> --dry-run OR ornn fleet clean <fleet-id> --identity-file <path> --confirm-clean <plan-hash>";
+  const { options, positionals } = parseOptions(args, {
+    boolean: ["dry-run", "json"],
+    value: [
+      "operator",
+      "ib-island",
+      "identity-file",
+      "confirm-clean",
+      "ssh-user",
+      "ssh-port",
+      "parallel",
+      "timeout",
+    ],
+  });
+  if (!positionals.length) {
+    throw new Error(usage);
+  }
+  const identityFile = expandUserPath(requiredOption(options.identityFile, "--identity-file"));
+  await readFile(identityFile);
+  const managementPublicKey = await deriveFleetManagementPublicKey({ context, identityFile });
+  const managementPublicKeyB64 = Buffer.from(managementPublicKey, "utf8").toString("base64");
+  const sshPort = optionProvided(options.sshPort)
+    ? positiveIntegerOption(options.sshPort, "--ssh-port")
+    : 22;
+  if (sshPort > 65535) {
+    throw new Error("--ssh-port must be at most 65535.");
+  }
+  const parallel = fleetParallelOption(options.parallel);
+  const timeoutSeconds = optionProvided(options.timeout)
+    ? positiveIntegerOption(options.timeout, "--timeout")
+    : FLEET_DEFAULT_TIMEOUT_SECONDS;
+  const confirmHash = optionalStringOption(options.confirmClean);
+  if (confirmHash) {
+    if (positionals.length !== 1 || options.dryRun || options.operator || options.ibIsland) {
+      throw new Error(usage);
+    }
+    if (!/^[0-9a-f]{64}$/.test(confirmHash)) {
+      throw new Error("--confirm-clean must be the exact 64-character cleanup plan hash.");
+    }
+    const fleetId = positionals[0];
+    const approved = await operatorRequest({
+      body: { plan_hash: confirmHash },
+      endpoint: `/internal/fleets/${encodeURIComponent(fleetId)}/cleanup/approve`,
+      env: context.env,
+      fetchImpl: context.fetchImpl,
+      method: "POST",
+    });
+    context.stderr.write(`Cleaning ${approved.nodes.length} node(s)...\n`);
+    const results = await mapLimit(approved.nodes, parallel, async (node) => {
+      let cleanupResult;
+      try {
+        const preCanary = await runFleetSsh({
+          context,
+          identityFile,
+          ip: node.ip_address,
+          port: sshPort,
+          remoteCommand: "sudo -n true",
+          timeoutSeconds: Math.min(timeoutSeconds, 30),
+          user: node.ssh_user,
+        });
+        if (preCanary !== 0) {
+          throw new Error("Management SSH canary failed before cleanup.");
+        }
+        const stopCanary = startFleetSshCanary({
+          context,
+          identityFile,
+          ip: node.ip_address,
+          port: sshPort,
+          timeoutSeconds: Math.min(timeoutSeconds, 30),
+          user: node.ssh_user,
+        });
+        const encodedPlan = Buffer.from(JSON.stringify(node.plan), "utf8").toString("base64");
+        let result;
+        let duringCanaryChecks = 0;
+        try {
+          result = await runFleetSshCapture({
+            context,
+            identityFile,
+            ip: node.ip_address,
+            port: sshPort,
+            remoteCommand: `sudo -n python3 - execute --management-ip ${node.ip_address} --management-user ${node.ssh_user} --management-public-key-b64 ${managementPublicKeyB64} --approved-plan-b64 ${encodedPlan}`,
+            stdin: approved.script,
+            timeoutSeconds,
+            user: node.ssh_user,
+          });
+        } finally {
+          duringCanaryChecks = await stopCanary();
+        }
+        const payload = fleetCleanupJson(result.stdout);
+        if (result.exitCode !== 0 || !payload.evidence) {
+          throw new Error(payload.error || result.stderr || "Cleanup failed.");
+        }
+        const canary = await runFleetSsh({
+          context,
+          identityFile,
+          ip: node.ip_address,
+          port: sshPort,
+          remoteCommand: "sudo -n true",
+          timeoutSeconds: Math.min(timeoutSeconds, 30),
+          user: node.ssh_user,
+        });
+        if (canary !== 0) {
+          throw new Error("Management SSH canary failed after cleanup.");
+        }
+        payload.evidence.management_ssh_canary = {
+          before: true,
+          during_checks: duringCanaryChecks,
+          after: true,
+        };
+        cleanupResult = {
+          cleanup_run_id: node.cleanup_run_id,
+          succeeded: true,
+          evidence: payload.evidence,
+        };
+      } catch (error) {
+        const message = fleetResultError(error);
+        cleanupResult = {
+          cleanup_run_id: node.cleanup_run_id,
+          succeeded: false,
+          ...(message.includes("cleanup_already_running") ? { deferred: true } : {}),
+          error: message,
+        };
+      }
+      if (!cleanupResult.deferred) {
+        await operatorRequest({
+          body: { nodes: [cleanupResult] },
+          endpoint: `/internal/fleets/${encodeURIComponent(fleetId)}/cleanup/results`,
+          env: context.env,
+          fetchImpl: context.fetchImpl,
+          method: "POST",
+        });
+      }
+      return cleanupResult;
+    });
+    const fleetRecord = await operatorRequest({
+      endpoint: `/internal/fleets/${encodeURIComponent(fleetId)}`,
+      env: context.env,
+      fetchImpl: context.fetchImpl,
+    });
+    await saveFleetManifest(fleetRecord, context.env);
+    writeFleetRecord(context, fleetRecord, options.json);
+    return results.some((result) => !result.succeeded) ? 1 : 0;
+  }
+
+  if (options.dryRun !== true) {
+    throw new Error("--dry-run is required before destructive cleanup.");
+  }
+  const requestedUser = optionalStringOption(options.sshUser);
+  if (requestedUser && !FLEET_MANAGEMENT_USERS.includes(requestedUser)) {
+    throw new Error(`--ssh-user must be one of ${FLEET_MANAGEMENT_USERS.join(", ")}.`);
+  }
+  const existingFleetId =
+    positionals.length === 1 && isUuid(positionals[0]) && !options.operator && !options.ibIsland
+      ? positionals[0]
+      : null;
+  let createdFleet = false;
+  let fleetRecord;
+  let planningNodes;
+  if (existingFleetId) {
+    fleetRecord = await operatorRequest({
+      endpoint: `/internal/fleets/${encodeURIComponent(existingFleetId)}`,
+      env: context.env,
+      fetchImpl: context.fetchImpl,
+    });
+    if (fleetRecord.status !== "failed") {
+      throw new Error("Only a failed fleet can be replanned; resume an approved cleanup with --confirm-clean.");
+    }
+    planningNodes = fleetRecord.nodes.filter((node) => node.status === "failed");
+    if (!planningNodes.length) {
+      throw new Error("This fleet has no failed cleanup members to replan.");
+    }
+  } else {
+    const ips = uniqueFleetIps(positionals);
+    const operatorInput = requiredOption(options.operator, "--operator");
+    const operatorId = await resolveOperatorId(operatorInput, context);
+    const ibIsland = validateIbIsland(requiredOption(options.ibIsland, "--ib-island"));
+    fleetRecord = await operatorRequest({
+      body: { operator_id: operatorId, ib_island: ibIsland, ip_addresses: ips },
+      endpoint: "/internal/fleets",
+      env: context.env,
+      fetchImpl: context.fetchImpl,
+      method: "POST",
+    });
+    planningNodes = fleetRecord.nodes;
+    createdFleet = true;
+  }
+  context.stderr.write(`Fleet: ${fleetRecord.id}\n`);
+  let recorded;
+  try {
+    await saveFleetManifest(fleetRecord, context.env);
+    const runner = await operatorRequest({
+      endpoint: `/internal/fleets/${encodeURIComponent(fleetRecord.id)}/cleanup-runner`,
+      env: context.env,
+      fetchImpl: context.fetchImpl,
+    });
+    context.stderr.write(`Planning cleanup for ${planningNodes.length} node(s)...\n`);
+    const planned = await mapLimit(planningNodes, parallel, async (node) => {
+      try {
+        const sshUser = await discoverFleetSshUser({
+          context,
+          identityFile,
+          ip: node.ip_address,
+          port: sshPort,
+          requestedUser: requestedUser || node.ssh_user || null,
+          timeoutSeconds: Math.min(timeoutSeconds, 30),
+        });
+        const result = await runFleetSshCapture({
+          context,
+          identityFile,
+          ip: node.ip_address,
+          port: sshPort,
+          remoteCommand: `sudo -n python3 - plan --management-ip ${node.ip_address} --management-user ${sshUser} --management-public-key-b64 ${managementPublicKeyB64}`,
+          stdin: runner.script,
+          timeoutSeconds,
+          user: sshUser,
+        });
+        if (result.exitCode !== 0) {
+          throw new Error(result.stderr || "Cleanup plan failed.");
+        }
+        const payload = fleetCleanupJson(result.stdout);
+        if (!payload.plan || !payload.plan_hash) {
+          throw new Error(payload.error || result.stderr || "Cleanup plan failed.");
+        }
+        return {
+          plan: {
+            fleet_node_id: node.id,
+            ssh_user: sshUser,
+            plan_hash: payload.plan_hash,
+            plan: payload.plan,
+          },
+        };
+      } catch (error) {
+        return { error: fleetResultError(error), ip: node.ip_address };
+      }
+    });
+    const planFailures = planned.filter((result) => result.error);
+    if (planFailures.length) {
+      throw new Error(
+        `Cleanup planning failed: ${planFailures.map((result) => `${result.ip}: ${result.error}`).join("; ")}`,
+      );
+    }
+    const plans = planned.map((result) => result.plan);
+    recorded = await operatorRequest({
+      body: { nodes: plans },
+      endpoint: `/internal/fleets/${encodeURIComponent(fleetRecord.id)}/cleanup/plans`,
+      env: context.env,
+      fetchImpl: context.fetchImpl,
+      method: "POST",
+    });
+  } catch (error) {
+    const planningError = fleetResultError(error);
+    if (!createdFleet) {
+      throw new Error(`${planningError} Fleet ${fleetRecord.id} remains failed and can be replanned.`);
+    }
+    let failedFleet;
+    try {
+      failedFleet = await operatorRequest({
+        body: { error: planningError },
+        endpoint: `/internal/fleets/${encodeURIComponent(fleetRecord.id)}/cleanup/abort`,
+        env: context.env,
+        fetchImpl: context.fetchImpl,
+        method: "POST",
+      });
+    } catch (abortError) {
+      throw new Error(
+        `${planningError} Fleet ${fleetRecord.id} could not be marked failed: ${fleetResultError(abortError)}`,
+      );
+    }
+    try {
+      await saveFleetManifest(failedFleet, context.env);
+    } catch (manifestError) {
+      throw new Error(
+        `${planningError} Fleet ${fleetRecord.id} was marked failed, but its local manifest could not be saved: ${fleetResultError(manifestError)}`,
+      );
+    }
+    throw new Error(`${planningError} Fleet ${fleetRecord.id} was marked failed.`);
+  }
+  await saveFleetManifest(recorded.fleet, context.env);
+  if (options.json) {
+    writeJson(context.stdout, recorded);
+  } else {
+    context.stdout.write(`Fleet: ${fleetRecord.id}\n`);
+    for (const node of recorded.fleet.nodes) {
+      if (node.cleanup?.plan) {
+        context.stdout.write(`\nNode ${node.ip_address} deletion plan:\n`);
+        context.stdout.write(`${JSON.stringify(node.cleanup.plan, null, 2)}\n`);
+      }
+    }
+    context.stdout.write(`Cleanup plan: ${recorded.plan_hash}\n`);
+    context.stdout.write(
+      `Approve exactly this plan with: ornn fleet clean ${fleetRecord.id} --identity-file ${shellQuote(identityFile)} --confirm-clean ${recorded.plan_hash}\n`
+    );
+  }
+  return 0;
+}
+
+async function fleetEnroll(args, context) {
+  const usage =
+    "Usage: ornn fleet enroll <fleet-id> --identity-file <path> [--confirm-takeover <ip[,ip...]>] [--ssh-port <port>] [--parallel <n>] [--timeout <seconds>] [--json]";
+  const { options, positionals } = parseOptions(args, {
+    boolean: ["json"],
+    value: ["identity-file", "confirm-takeover", "ssh-port", "parallel", "timeout"],
+  });
+  if (positionals.length !== 1) {
+    throw new Error(usage);
+  }
+  const fleetId = positionals[0];
+  const identityFile = expandUserPath(requiredOption(options.identityFile, "--identity-file"));
+  await readFile(identityFile);
+  const sshPort = optionProvided(options.sshPort)
+    ? positiveIntegerOption(options.sshPort, "--ssh-port")
+    : 22;
+  if (sshPort > 65535) {
+    throw new Error("--ssh-port must be at most 65535.");
+  }
+  const parallel = fleetParallelOption(options.parallel);
+  const timeoutSeconds = optionProvided(options.timeout)
+    ? positiveIntegerOption(options.timeout, "--timeout")
+    : FLEET_DEFAULT_TIMEOUT_SECONDS;
+  const fleetPreview = await operatorRequest({
+    endpoint: `/internal/fleets/${encodeURIComponent(fleetId)}`,
+    env: context.env,
+    fetchImpl: context.fetchImpl,
+  });
+  const ips = fleetPreview.nodes.map((node) => String(node.ip_address));
+  const takeoverIps = fleetTakeoverIps(options.confirmTakeover, ips);
+  const enrollmentAttemptId = randomUUID();
+  const fleetRecord = await operatorRequest({
+    body: {
+      attempt_id: enrollmentAttemptId,
+      lease_seconds: Math.min(timeoutSeconds * 2 + 300, 86400),
+    },
+    endpoint: `/internal/fleets/${encodeURIComponent(fleetId)}/enrollment/start`,
+    env: context.env,
+    fetchImpl: context.fetchImpl,
+    method: "POST",
+  });
+  const session = await loadAuthSession({ env: context.env }).catch(() => null);
+  const installerBase = resolveInstallerBaseUrl({ env: context.env, session });
+  if (!installerBase) {
+    throw new Error("Installer URL is unavailable.");
+  }
+  const enrollmentMembers = fleetRecord.nodes.filter((member) => member.status === "enrolling");
+  const installed = await mapLimit(enrollmentMembers, parallel, async (member) => {
+    let issuedToken = null;
+    let outcome;
+    try {
+      issuedToken = await operatorRequest({
+        body: {
+          operator_id: fleetRecord.operator_id,
+          fleet_node_id: member.id,
+          expires_in_seconds: Math.min(timeoutSeconds + 300, 86400),
+        },
+        endpoint: "/enrollment/tokens",
+        env: context.env,
+        fetchImpl: context.fetchImpl,
+        method: "POST",
+      });
+      if (!issuedToken?.id || !issuedToken?.token) {
+        throw new Error("Enrollment token response was incomplete.");
+      }
+      const script = await fetchFleetInstaller({
+        baseUrl: installerBase,
+        fetchImpl: context.fetchImpl,
+        forceTakeover: takeoverIps.has(String(member.ip_address)),
+        ip: String(member.ip_address),
+        token: issuedToken.token,
+      });
+      const exitCode = await runFleetSsh({
+        context,
+        identityFile,
+        ip: String(member.ip_address),
+        port: sshPort,
+        remoteCommand: "sudo -n bash -s",
+        stdin: script,
+        timeoutSeconds,
+        user: member.ssh_user,
+      });
+      if (exitCode !== 0) throw new Error(`Installer exited with status ${exitCode}.`);
+      outcome = { member, ok: true };
+    } catch (error) {
+      outcome = { member, ok: false, error: fleetResultError(error) };
+    }
+    if (issuedToken?.id) {
+      try {
+        await revokeFleetEnrollmentToken({ context, tokenId: issuedToken.id });
+      } catch (error) {
+        const revocationError = fleetResultError(error);
+        outcome = {
+          member,
+          ok: false,
+          error: outcome.ok
+            ? revocationError
+            : combineFleetResultErrors(outcome.error, revocationError),
+        };
+      }
+    }
+    return outcome;
+  });
+  let nodesByIp = new Map();
+  let nodeDiscoveryError = null;
+  const installedIps = installed
+    .filter((result) => result.ok)
+    .map((result) => String(result.member.ip_address));
+  if (installedIps.length > 0) {
+    try {
+      nodesByIp = await waitForFleetNodes({
+        context,
+        ips: installedIps,
+        operatorId: fleetRecord.operator_id,
+        timeoutSeconds,
+      });
+    } catch (error) {
+      nodeDiscoveryError = formatCliError(error);
+    }
+  }
+  const results = await mapLimit(installed, parallel, async (result) => {
+    if (!result.ok) {
+      return { fleet_node_id: result.member.id, succeeded: false, error: result.error };
+    }
+    try {
+      const node = nodesByIp.get(String(result.member.ip_address));
+      if (!node) {
+        throw new Error(nodeDiscoveryError || "Enrolled node did not appear in Fabric.");
+      }
+      if (
+        !node.hardware_fingerprint ||
+        String(node.hardware_fingerprint) !== String(result.member.hardware_fingerprint || "")
+      ) {
+        throw new Error("Enrolled node hardware identity did not match its cleanup receipt.");
+      }
+      const updated = await operatorRequest({
+        body: { ib_island: fleetRecord.ib_island },
+        endpoint: `/provisioning/nodes/${encodeURIComponent(node.id)}/scheduler-metadata`,
+        env: context.env,
+        fetchImpl: context.fetchImpl,
+        method: "PATCH",
+      });
+      if (updated?.labels?.["ornn.ai/ib-island"] !== fleetRecord.ib_island) {
+        throw new Error("Fabric did not retain the requested IB-island label.");
+      }
+      await verifyFleetManagementSsh({
+        context,
+        identityFile,
+        ip: String(result.member.ip_address),
+        port: sshPort,
+        timeoutSeconds: Math.min(timeoutSeconds, 30),
+        user: result.member.ssh_user,
+      });
+      return {
+        fleet_node_id: result.member.id,
+        gpu_node_id: node.id,
+        succeeded: true,
+        hardware_fingerprint: node.hardware_fingerprint,
+        management_ssh_verified: true,
+      };
+    } catch (error) {
+      return {
+        fleet_node_id: result.member.id,
+        succeeded: false,
+        error: fleetResultError(error),
+      };
+    }
+  });
+  const completed = await operatorRequest({
+    body: { attempt_id: enrollmentAttemptId, nodes: results },
+    endpoint: `/internal/fleets/${encodeURIComponent(fleetId)}/enrollment/results`,
+    env: context.env,
+    fetchImpl: context.fetchImpl,
+    method: "POST",
+  });
+  await saveFleetManifest(completed, context.env);
+  writeFleetRecord(context, completed, options.json);
+  return results.some((result) => !result.succeeded) ? 1 : 0;
+}
+
+async function fleetDeploy(args, context) {
+  const usage =
+    "Usage: ornn fleet deploy <fleet-id> --tenant <email> --user <email-or-id> [--commerce-reservation <id>] [--network public|private] [--parallel <n>] [--timeout <seconds>] [--json]";
+  const { options, positionals } = parseOptions(args, {
+    boolean: ["json"],
+    value: ["commerce-reservation", "tenant", "user", "network", "parallel", "timeout"],
+  });
+  if (positionals.length !== 1) throw new Error(usage);
+  const fleetId = positionals[0];
+  const commerceReservationId = optionalStringOption(options.commerceReservation);
+  if (commerceReservationId && !isUuid(commerceReservationId)) {
+    throw new Error("--commerce-reservation must be a UUID returned by Commerce.");
+  }
+  const tenantInput = requiredOption(options.tenant, "--tenant");
+  const userInput = requiredOption(options.user, "--user");
+  const network = optionalStringOption(options.network) || "public";
+  if (!new Set(["public", "private"]).has(network)) {
+    throw new Error("--network must be public or private.");
+  }
+  const parallel = fleetParallelOption(options.parallel);
+  const timeoutSeconds = optionProvided(options.timeout)
+    ? positiveIntegerOption(options.timeout, "--timeout")
+    : FLEET_DEFAULT_TIMEOUT_SECONDS;
+  const tenant = await resolveFleetTenant(tenantInput, context);
+  const targetUser = await resolveFleetUser(tenant.id, userInput, context);
+  const activeKeys = await fetchFleetTenantActiveKeys(tenant.id, context);
+  if (!activeKeys.length) {
+    throw new Error(
+      `Tenant ${tenant.email} has no active SSH keys. Add a tenant SSH key before deploying this fleet.`
+    );
+  }
+  const fleetRecord = await operatorRequest({
+    body: {
+      tenant_id: tenant.id,
+      target_auth_user_id: targetUser.id,
+      network_mode: network,
+      ...(commerceReservationId
+        ? { commerce_reservation_id: commerceReservationId }
+        : {}),
+    },
+    endpoint: `/internal/fleets/${encodeURIComponent(fleetId)}/deploy/start`,
+    env: context.env,
+    fetchImpl: context.fetchImpl,
+    method: "POST",
+  });
+  const deployed = await mapLimit(fleetRecord.nodes, parallel, async (entry) => {
+    try {
+      const response = await operatorRequest({
+        body: {
+          fleet_node_id: entry.id,
+          target_auth_user_id: targetUser.id,
+          target_tenant_id: tenant.id,
+          network_mode: network,
+          notes: `CLI fleet ${fleetRecord.id}; IB island ${fleetRecord.ib_island}`,
+          ...(commerceReservationId
+            ? { commerce_reservation_id: commerceReservationId }
+            : {}),
+        },
+        endpoint: `/internal/nodes/${encodeURIComponent(entry.gpu_node_id)}/deploy`,
+        env: context.env,
+        fetchImpl: context.fetchImpl,
+        method: "POST",
+      });
+      if (!response?.reservation_id) {
+        throw new Error("Deployment response did not include a reservation id.");
+      }
+      if (String(response.target_auth_user_id) !== String(targetUser.id)) {
+        throw new Error("Deployment response did not retain the intended tenant administrator.");
+      }
+      if (Number(response.ssh_keys_associated || 0) < activeKeys.length) {
+        throw new Error("Deployment did not associate every active tenant SSH key.");
+      }
+      assertFleetDeployKeySnapshot(response, activeKeys);
+      return {
+        entry,
+        ok: true,
+        reservation_id: String(response.reservation_id),
+        response,
+        status: "accepted",
+      };
+    } catch (error) {
+      return { entry, ok: false, error: fleetResultError(error), status: "failed" };
+    }
+  });
+
+  context.stderr.write("Waiting for user, SSH-key, and passwordless-sudo provisioning...\n");
+  const provisioned = await mapLimit(deployed, parallel, async (result) => {
+    if (!result.ok) {
+      return result;
+    }
+    try {
+      const readiness = await waitForFleetDeployment({
+        activeKeys,
+        context,
+        entry: result.entry,
+        network,
+        reservationId: result.reservation_id,
+        targetUserId: targetUser.id,
+        timeoutSeconds,
+      });
+      return {
+        ...result,
+        readiness,
+        status: "provisioned",
+      };
+    } catch (error) {
+      return { ...result, ok: false, error: fleetResultError(error), status: "failed" };
+    }
+  });
+  const completed = await operatorRequest({
+    body: {
+      nodes: provisioned.map((result) => ({
+        fleet_node_id: result.entry.id,
+        succeeded: result.ok,
+        ...(result.ok
+          ? {
+              compute_reservation_id: result.reservation_id,
+              node_instance_id: result.readiness.machine_id,
+            }
+          : { error: result.error }),
+      })),
+    },
+    endpoint: `/internal/fleets/${encodeURIComponent(fleetId)}/deploy/results`,
+    env: context.env,
+    fetchImpl: context.fetchImpl,
+    method: "POST",
+  });
+  await saveFleetManifest(completed, context.env);
+  writeFleetRecord(context, completed, options.json);
+  return provisioned.some((result) => !result.ok) ? 1 : 0;
+}
+
+function uniqueFleetIps(values) {
+  const ips = values.map((value) => String(value).trim());
+  for (const ip of ips) {
+    if (!isIP(ip)) {
+      throw new Error(`Invalid IP address: ${ip}`);
+    }
+  }
+  if (new Set(ips).size !== ips.length) {
+    throw new Error("Duplicate IP addresses are not allowed in a fleet.");
+  }
+  return ips;
+}
+
+function validateIbIsland(value) {
+  const island = String(value).trim();
+  if (!island || island.length > 120 || /[\u0000-\u001f\u007f]/.test(island)) {
+    throw new Error("--ib-island must be a non-empty name of at most 120 characters.");
+  }
+  return island;
+}
+
+function fleetParallelOption(value) {
+  const parallel = optionProvided(value)
+    ? positiveIntegerOption(value, "--parallel")
+    : FLEET_DEFAULT_PARALLEL;
+  if (parallel > 16) {
+    throw new Error("--parallel must be at most 16.");
+  }
+  return parallel;
+}
+
+function fleetTakeoverIps(value, fleetIps) {
+  if (!optionProvided(value)) {
+    return new Set();
+  }
+  const approved = uniqueFleetIps(
+    String(value)
+      .split(",")
+      .map((ip) => ip.trim())
+      .filter(Boolean)
+  );
+  const fleet = new Set(fleetIps);
+  const outsideFleet = approved.filter((ip) => !fleet.has(ip));
+  if (outsideFleet.length) {
+    throw new Error(
+      `--confirm-takeover may name only fleet IPs; unexpected: ${outsideFleet.join(", ")}.`
+    );
+  }
+  return new Set(approved);
+}
+
+async function fetchFleetTenantActiveKeys(tenantId, context) {
+  const payload = await operatorRequest({
+    endpoint: `/nodes/tenants/${encodeURIComponent(tenantId)}/ssh-keys`,
+    env: context.env,
+    fetchImpl: context.fetchImpl,
+  });
+  const rows = Array.isArray(payload?.ssh_keys) ? payload.ssh_keys : [];
+  return rows.filter((key) => key?.status === "active" && !key?.revoked_at && key?.id);
+}
+
+function assertFleetDeployKeySnapshot(response, activeKeys) {
+  const expectedIds = activeKeys.map((key) => String(key.id));
+  const expectedFingerprints = activeKeys.map((key) => String(key.fingerprint || ""));
+  const acceptedIds = Array.isArray(response?.accepted_ssh_key_ids)
+    ? response.accepted_ssh_key_ids.map(String)
+    : [];
+  const acceptedFingerprints = Array.isArray(response?.accepted_ssh_key_fingerprints)
+    ? response.accepted_ssh_key_fingerprints.map(String)
+    : [];
+  const exactSet = (expected, actual) => {
+    const expectedSet = new Set(expected);
+    const actualSet = new Set(actual);
+    return (
+      expected.length === actual.length &&
+      expectedSet.size === expected.length &&
+      actualSet.size === actual.length &&
+      expected.every((value) => actualSet.has(value))
+    );
+  };
+  if (
+    !exactSet(expectedIds, acceptedIds) ||
+    !exactSet(expectedFingerprints, acceptedFingerprints)
+  ) {
+    throw new Error("Deployment accepted a different SSH-key snapshot than fleet preflight.");
+  }
+}
+
+async function waitForFleetDeployment({
+  activeKeys,
+  context,
+  entry,
+  network,
+  reservationId,
+  targetUserId,
+  timeoutSeconds,
+}) {
+  const nodeId = entry.gpu_node_id || entry.node_id;
+  if (!reservationId) {
+    throw new Error(`Node ${nodeId} has no reservation to verify.`);
+  }
+  const deadline = Date.now() + timeoutSeconds * 1000;
+  const sleepImpl = context.sleep ?? sleep;
+  let lastReason = "provisioning has not reported ready";
+  while (Date.now() <= deadline) {
+    let access;
+    let machinePayload;
+    try {
+      [access, machinePayload] = await Promise.all([
+        operatorRequest({
+          endpoint: `/internal/nodes/${encodeURIComponent(nodeId)}/reservation-access?reservation_id=${encodeURIComponent(reservationId)}`,
+          env: context.env,
+          fetchImpl: context.fetchImpl,
+        }),
+        operatorRequest({
+          endpoint: `/nodes/reservations/${encodeURIComponent(reservationId)}/machines?include_vm_eligibility=false`,
+          env: context.env,
+          fetchImpl: context.fetchImpl,
+        }),
+      ]);
+    } catch (error) {
+      if (!isTransientFleetApiError(error)) {
+        throw error;
+      }
+      lastReason = `the readiness API is temporarily unavailable: ${formatCliError(error)}`;
+      await sleepImpl(2000);
+      continue;
+    }
+    if (String(access?.reservation_id || "") !== String(reservationId)) {
+      lastReason = "reservation ownership is not visible yet";
+      await sleepImpl(2000);
+      continue;
+    }
+    const machines = (Array.isArray(machinePayload?.machines) ? machinePayload.machines : []).filter(
+      (machine) => String(machine?.machine_node_id || machine?.node_id || "") === String(nodeId)
+    );
+    if (machines.length > 1) {
+      throw new Error(`Multiple live machines matched node ${nodeId}.`);
+    }
+    const machine = machines[0];
+    if (!machine) {
+      lastReason = "the bare-metal machine has not been created yet";
+      await sleepImpl(2000);
+      continue;
+    }
+    if (String(machine.network_mode || "public") !== network) {
+      throw new Error(
+        `Node ${nodeId} is provisioned with network ${machine.network_mode || "unknown"}, not ${network}.`
+      );
+    }
+    const targetRows = (Array.isArray(access?.ssh_keys) ? access.ssh_keys : []).filter(
+      (row) => String(row?.user_id || "") === String(targetUserId)
+    );
+    const rowsByKeyId = new Map(targetRows.map((row) => [String(row.id), row]));
+    const missingKey = activeKeys.find((key) => !rowsByKeyId.has(String(key.id)));
+    if (missingKey) {
+      lastReason = `SSH key ${missingKey.id} is not associated with the intended user`;
+      await sleepImpl(2000);
+      continue;
+    }
+    const installedFingerprints = new Set(
+      (Array.isArray(machine.authorized_key_fingerprints)
+        ? machine.authorized_key_fingerprints
+        : []
+      ).map(String)
+    );
+    let linuxUsername = machine.linux_username || machine.tenant_username || null;
+    const associatedUsernames = new Set();
+    let associationUsernamePending = false;
+    for (const key of activeKeys) {
+      const row = rowsByKeyId.get(String(key.id));
+      const state = row?.instance_state?.[String(machine.id)];
+      const associatedUsername = state?.linux_username || row?.linux_username || null;
+      if (state?.status === "failed") {
+        throw new Error(
+          `SSH-key provisioning failed on node ${nodeId}: ${state.failure_reason || "unknown error"}.`
+        );
+      }
+      if (
+        associatedUsername &&
+        linuxUsername &&
+        String(associatedUsername) !== String(linuxUsername)
+      ) {
+        throw new Error(`SSH keys on node ${nodeId} resolved to different Linux users.`);
+      }
+      linuxUsername = linuxUsername || associatedUsername;
+      if (state?.status === "installed") {
+        if (!associatedUsername) {
+          associationUsernamePending = true;
+          continue;
+        }
+      } else if (state?.status) {
+        associationUsernamePending = true;
+        continue;
+      } else if (
+        !associatedUsername ||
+        !machine.keys_pushed_at ||
+        !installedFingerprints.has(String(key.fingerprint))
+      ) {
+        // Initial provisioning installs the selected user's keys as part of the
+        // machine-level provision command. That legacy/shared acknowledgement
+        // intentionally leaves per-key instance_state empty, so use its exact
+        // username + fingerprint evidence as the equivalent installed receipt.
+        associationUsernamePending = true;
+        continue;
+      }
+      associatedUsernames.add(String(associatedUsername));
+    }
+    if (!linuxUsername) {
+      lastReason = "the intended Linux user has not been reported yet";
+      await sleepImpl(2000);
+      continue;
+    }
+    if (associationUsernamePending) {
+      lastReason = "the intended user's Linux account assignment is still pending";
+      await sleepImpl(2000);
+      continue;
+    }
+    if (associatedUsernames.size !== 1 || !associatedUsernames.has(String(linuxUsername))) {
+      throw new Error(
+        `Node ${nodeId} associated the intended user's SSH keys with a different Linux account.`
+      );
+    }
+    if (
+      machine.state !== "running" ||
+      machine.actual_state !== "running" ||
+      !machine.keys_pushed_at ||
+      machine.passwordless_sudo !== true ||
+      (network === "public" && !machine.ssh_endpoint)
+    ) {
+      lastReason = "the machine is not yet running with SSH and passwordless sudo ready";
+      await sleepImpl(2000);
+      continue;
+    }
+    return {
+      linux_username: linuxUsername,
+      machine_id: machine.id,
+      reservation_id: reservationId,
+      ssh_endpoint: machine.ssh_endpoint || null,
+      ssh_key_count: activeKeys.length,
+    };
+  }
+  throw new Error(
+    `Timed out after ${timeoutSeconds}s waiting for node ${nodeId}: ${lastReason}.`
+  );
+}
+
+function isTransientFleetApiError(error) {
+  if (!(error instanceof CliApiError)) {
+    return false;
+  }
+  const status = Number(error.status);
+  return !Number.isInteger(status) || status === 429 || status >= 500;
+}
+
+function fleetSshArgs({ identityFile, ip, port, remoteCommand, user }) {
+  return [
+    "-o",
+    "BatchMode=yes",
+    "-o",
+    "ConnectTimeout=10",
+    "-o",
+    "IdentitiesOnly=yes",
+    "-o",
+    "StrictHostKeyChecking=yes",
+    "-i",
+    identityFile,
+    "-p",
+    String(port),
+    `${user}@${ip}`,
+    remoteCommand,
+  ];
+}
+
+async function runFleetSsh({
+  context,
+  identityFile,
+  ip,
+  port,
+  remoteCommand,
+  stdin,
+  timeoutSeconds,
+  user,
+}) {
+  const args = fleetSshArgs({ identityFile, ip, port, remoteCommand, user });
+  return await new Promise((resolve, reject) => {
+    const child = context.spawnProcess("ssh", args, {
+      stdio: stdin === undefined ? "ignore" : ["pipe", "inherit", "inherit"],
+    });
+    let timedOut = false;
+    let killTimer = null;
+    const timer = timeoutSeconds
+      ? setTimeout(() => {
+          timedOut = true;
+          child.kill?.("SIGTERM");
+          killTimer = setTimeout(() => child.kill?.("SIGKILL"), 5000);
+          killTimer.unref?.();
+        }, timeoutSeconds * 1000)
+      : null;
+    timer?.unref?.();
+    child.on("error", (error) => {
+      if (timer) clearTimeout(timer);
+      if (killTimer) clearTimeout(killTimer);
+      reject(error);
+    });
+    child.on("exit", (code, signal) => {
+      if (timer) clearTimeout(timer);
+      if (killTimer) clearTimeout(killTimer);
+      resolve(timedOut ? 124 : signal ? 1 : (code ?? 0));
+    });
+    if (stdin !== undefined) {
+      if (!child.stdin) {
+        reject(new Error("SSH process did not expose stdin for the installer."));
+        return;
+      }
+      child.stdin.on?.("error", reject);
+      child.stdin.end(stdin);
+    }
+  });
+}
+
+async function runFleetSshCapture({
+  context,
+  identityFile,
+  ip,
+  port,
+  remoteCommand,
+  stdin,
+  timeoutSeconds,
+  user,
+}) {
+  const args = fleetSshArgs({ identityFile, ip, port, remoteCommand, user });
+  return await new Promise((resolve, reject) => {
+    const child = context.spawnProcess("ssh", args, { stdio: ["pipe", "pipe", "pipe"] });
+    let stdout = "";
+    let stderr = "";
+    let outputExceeded = false;
+    let timedOut = false;
+    let killTimer = null;
+    const maxOutputBytes = 4 * 1024 * 1024;
+    const timer = timeoutSeconds
+      ? setTimeout(() => {
+          timedOut = true;
+          child.kill?.("SIGTERM");
+          killTimer = setTimeout(() => child.kill?.("SIGKILL"), 5000);
+          killTimer.unref?.();
+        }, timeoutSeconds * 1000)
+      : null;
+    timer?.unref?.();
+    const terminate = () => {
+      child.kill?.("SIGTERM");
+      if (!killTimer) {
+        killTimer = setTimeout(() => child.kill?.("SIGKILL"), 5000);
+        killTimer.unref?.();
+      }
+    };
+    const append = (current, chunk) => {
+      const next = current + String(chunk);
+      if (Buffer.byteLength(next, "utf8") > maxOutputBytes) {
+        outputExceeded = true;
+        terminate();
+        return current;
+      }
+      return next;
+    };
+    child.stdout?.on("data", (chunk) => {
+      stdout = append(stdout, chunk);
+    });
+    child.stderr?.on("data", (chunk) => {
+      stderr = append(stderr, chunk);
+    });
+    child.on("error", (error) => {
+      if (timer) clearTimeout(timer);
+      if (killTimer) clearTimeout(killTimer);
+      reject(error);
+    });
+    child.on("exit", (code, signal) => {
+      if (timer) clearTimeout(timer);
+      if (killTimer) clearTimeout(killTimer);
+      if (timedOut) stderr = `SSH command timed out after ${timeoutSeconds}s.`;
+      if (outputExceeded) stderr = "SSH command output exceeded 4 MiB.";
+      resolve({
+        exitCode: timedOut ? 124 : (signal || outputExceeded ? 1 : (code ?? 0)),
+        stderr,
+        stdout,
+      });
+    });
+    if (!child.stdin) {
+      reject(new Error("SSH process did not expose stdin for the cleanup runner."));
+      return;
+    }
+    child.stdin.on?.("error", reject);
+    child.stdin.end(stdin);
+  });
+}
+
+async function deriveFleetManagementPublicKey({ context, identityFile }) {
+  return await new Promise((resolve, reject) => {
+    const child = context.spawnProcess("ssh-keygen", ["-y", "-f", identityFile], {
+      stdio: ["ignore", "pipe", "pipe"],
+    });
+    let stdout = "";
+    let stderr = "";
+    child.stdout?.on("data", (chunk) => {
+      stdout += String(chunk);
+    });
+    child.stderr?.on("data", (chunk) => {
+      stderr += String(chunk);
+    });
+    child.on("error", reject);
+    child.on("exit", (code, signal) => {
+      const publicKey = stdout.trim();
+      if (signal || code !== 0 || !publicKey) {
+        reject(
+          new Error(
+            `Could not derive the management public key from ${identityFile}: ${stderr.trim() || "ssh-keygen failed"}.`
+          )
+        );
+        return;
+      }
+      resolve(publicKey);
+    });
+  });
+}
+
+function startFleetSshCanary({ context, identityFile, ip, port, timeoutSeconds, user }) {
+  let failure = null;
+  let successfulChecks = 0;
+  let inFlight = Promise.resolve();
+  const check = () => {
+    inFlight = inFlight.then(async () => {
+      if (failure) return;
+      const exitCode = await runFleetSsh({
+        context,
+        identityFile,
+        ip,
+        port,
+        remoteCommand: "sudo -n true",
+        timeoutSeconds,
+        user,
+      });
+      if (exitCode !== 0) {
+        failure = new Error("Management SSH canary failed during cleanup.");
+      } else {
+        successfulChecks += 1;
+      }
+    });
+  };
+  check();
+  const timer = setInterval(check, 2000);
+  timer.unref?.();
+  return async () => {
+    clearInterval(timer);
+    await inFlight;
+    if (failure) throw failure;
+    return successfulChecks;
+  };
+}
+
+async function discoverFleetSshUser({
+  context,
+  identityFile,
+  ip,
+  port,
+  requestedUser,
+  timeoutSeconds,
+}) {
+  const candidates = requestedUser ? [requestedUser] : FLEET_MANAGEMENT_USERS;
+  for (const user of candidates) {
+    const exitCode = await runFleetSsh({
+      context,
+      identityFile,
+      ip,
+      port,
+      remoteCommand: "sudo -n true",
+      timeoutSeconds,
+      user,
+    });
+    if (exitCode === 0) return user;
+  }
+  throw new Error(
+    `No management account with key authentication and passwordless sudo was reachable at ${ip}; tried ${candidates.join(", ")}.`
+  );
+}
+
+function fleetCleanupJson(stdout) {
+  const lines = String(stdout || "")
+    .split(/\r?\n/)
+    .map((line) => line.trim())
+    .filter(Boolean)
+    .reverse();
+  for (const line of lines) {
+    try {
+      return JSON.parse(line);
+    } catch {
+      // The runner emits one final JSON line; ignore incidental SSH output.
+    }
+  }
+  return { error: "Cleanup runner did not return JSON evidence." };
+}
+
+async function fetchFleetInstaller({ baseUrl, fetchImpl, forceTakeover, ip, token }) {
+  const url = new URL("/enrollment/install", `${baseUrl}/`);
+  url.searchParams.set("token", token);
+  url.searchParams.set("ip", ip);
+  url.searchParams.set("node_mode", "bare-metal");
+  url.searchParams.set("force", forceTakeover ? "true" : "false");
+  url.searchParams.set("burn-time", "0");
+  const response = await fetchImpl(url, { headers: { Accept: "text/plain" } });
+  const script = await response.text();
+  if (!response.ok) {
+    throw new CliApiError(`Could not fetch the enrollment installer for ${ip}.`, {
+      status: response.status,
+    });
+  }
+  if (!script.trim()) {
+    throw new Error(`Enrollment installer for ${ip} was empty.`);
+  }
+  return script;
+}
+
+async function revokeFleetEnrollmentToken({ context, tokenId }) {
+  const sleepImpl = context.sleep ?? sleep;
+  const maxAttempts = 3;
+  for (let attempt = 1; attempt <= maxAttempts; attempt += 1) {
+    try {
+      await operatorRequest({
+        endpoint: `/enrollment/tokens/${encodeURIComponent(tokenId)}/revoke`,
+        env: context.env,
+        fetchImpl: context.fetchImpl,
+        method: "POST",
+      });
+      return;
+    } catch (error) {
+      const retry = isTransientFleetApiError(error) && attempt < maxAttempts;
+      if (!retry) {
+        throw new Error(
+          attempt === maxAttempts
+            ? `Enrollment token revocation could not be confirmed after ${maxAttempts} attempts.`
+            : "Enrollment token revocation could not be confirmed."
+        );
+      }
+      await sleepImpl(500 * attempt);
+    }
+  }
+}
+
+async function waitForFleetNodes({ context, ips, operatorId, timeoutSeconds }) {
+  const deadline = Date.now() + timeoutSeconds * 1000;
+  const sleepImpl = context.sleep ?? sleep;
+  let latestMatches = new Map();
+  while (Date.now() <= deadline) {
+    const rows = await operatorRequest({
+      endpoint: `/provisioning/nodes?operator_id=${encodeURIComponent(operatorId)}`,
+      env: context.env,
+      fetchImpl: context.fetchImpl,
+    });
+    const matches = new Map();
+    for (const ip of ips) {
+      const candidates = (Array.isArray(rows) ? rows : []).filter((node) => {
+        const labels = node?.labels && typeof node.labels === "object" ? node.labels : {};
+        return [labels["ornn.ai/public-ip"], labels["ornn.ai/configured-ip"]]
+          .filter(Boolean)
+          .some((candidate) => String(candidate) === ip);
+      });
+      if (candidates.length > 1) {
+        throw new Error(`Multiple Fabric nodes matched IP ${ip}; refusing ambiguous enrollment.`);
+      }
+      if (candidates.length === 1) {
+        matches.set(ip, candidates[0]);
+      }
+    }
+    for (const [ip, node] of matches) {
+      const prior = latestMatches.get(ip);
+      if (prior && String(prior.id || "") !== String(node.id || "")) {
+        throw new Error(`Fabric node identity changed while enrolling IP ${ip}.`);
+      }
+      latestMatches.set(ip, node);
+    }
+    const matchedNodeIds = [...latestMatches.values()].map((node) => String(node.id || ""));
+    if (
+      matchedNodeIds.some((nodeId) => !nodeId) ||
+      new Set(matchedNodeIds).size !== latestMatches.size
+    ) {
+      throw new Error(
+        "Multiple fleet IPs resolved to the same Fabric node; refusing a duplicate enrollment mapping."
+      );
+    }
+    if (latestMatches.size === ips.length) {
+      return latestMatches;
+    }
+    await sleepImpl(2000);
+  }
+  return latestMatches;
+}
+
+async function verifyFleetManagementSsh({
+  context,
+  identityFile,
+  ip,
+  port,
+  timeoutSeconds,
+  user,
+}) {
+  const exitCode = await runFleetSsh({
+    context,
+    identityFile,
+    ip,
+    port,
+    remoteCommand: "sudo -n true",
+    timeoutSeconds,
+    user,
+  });
+  if (exitCode !== 0) {
+    throw new Error("Post-enrollment management SSH verification failed.");
+  }
+}
+
+async function mapLimit(items, limit, worker) {
+  const results = new Array(items.length);
+  let cursor = 0;
+  async function consume() {
+    while (cursor < items.length) {
+      const index = cursor;
+      cursor += 1;
+      results[index] = await worker(items[index], index);
+    }
+  }
+  await Promise.all(Array.from({ length: Math.min(limit, items.length) }, () => consume()));
+  return results;
+}
+
+function fleetManifestPath(fleetId, env) {
+  const normalized = String(fleetId || "").trim();
+  if (!/^[A-Za-z0-9._-]+$/.test(normalized) || basename(normalized) !== normalized) {
+    throw new Error("Invalid fleet id.");
+  }
+  return join(getFleetConfigDir(env), `${normalized}.json`);
+}
+
+async function saveFleetManifest(manifest, env) {
+  const directory = getFleetConfigDir(env);
+  const path = fleetManifestPath(manifest.id, env);
+  manifest.updated_at = new Date().toISOString();
+  await mkdir(directory, { recursive: true, mode: 0o700 });
+  await writeFile(path, `${JSON.stringify(manifest, null, 2)}\n`, {
+    encoding: "utf8",
+    mode: 0o600,
+  });
+  return path;
+}
+
+async function resolveFleetTenant(tenantInput, context) {
+  const input = String(tenantInput).trim();
+  if (!/^[^@\s]+@[^@\s]+\.[^@\s]+$/.test(input)) {
+    throw new Error("--tenant must be the tenant contact email address.");
+  }
+  const rows = await operatorRequest({
+    endpoint: `/internal/users?q=${encodeURIComponent(input)}&approved=true&limit=1000`,
+    env: context.env,
+    fetchImpl: context.fetchImpl,
+  });
+  const normalized = input.toLowerCase();
+  const matches = (Array.isArray(rows) ? rows : []).filter(
+    (row) => String(row?.contact_email || "").trim().toLowerCase() === normalized
+  );
+  const tenantIds = [...new Set(matches.map((row) => String(row.tenant_id)).filter(Boolean))];
+  if (tenantIds.length !== 1) {
+    throw new Error(
+      tenantIds.length
+        ? `Tenant email ${input} matched multiple tenant accounts.`
+        : `No tenant account matched ${input}.`
+    );
+  }
+  const tenant = matches.find((row) => String(row.tenant_id) === tenantIds[0]);
+  return {
+    auth_user_id: tenant?.auth_user_id ? String(tenant.auth_user_id) : null,
+    id: tenantIds[0],
+    email: normalized,
+  };
+}
+
+async function resolveFleetUser(tenantId, userInput, context) {
+  const input = String(userInput || "").trim();
+  const members = await operatorRequest({
+    endpoint: `/internal/tenants/${encodeURIComponent(tenantId)}/members`,
+    env: context.env,
+    fetchImpl: context.fetchImpl,
+  });
+  const normalized = input.toLowerCase();
+  const matches = (Array.isArray(members) ? members : []).filter(
+    (member) =>
+      String(member?.auth_user_id || "") === input ||
+      String(member?.contact_email || "").trim().toLowerCase() === normalized
+  );
+  if (matches.length !== 1) {
+    throw new Error(
+      matches.length
+        ? `User ${input} matched multiple members of tenant ${tenantId}.`
+        : `User ${input} is not a member of tenant ${tenantId}.`
+    );
+  }
+  return {
+    id: String(matches[0].auth_user_id),
+    email: String(matches[0].contact_email || "").toLowerCase() || null,
+  };
+}
+
+function writeFleetRecord(context, fleetRecord, json) {
+  if (json) {
+    writeJson(context.stdout, fleetRecord);
+    return;
+  }
+  context.stdout.write(`Fleet ${fleetRecord.id}: ${fleetRecord.status}\n`);
+  context.stdout.write(`Operator: ${fleetRecord.operator_id}\n`);
+  context.stdout.write(`IB island: ${fleetRecord.ib_island}\n`);
+  context.stdout.write(`Record: ${fleetManifestPath(fleetRecord.id, context.env)}\n`);
+  for (const node of Array.isArray(fleetRecord.nodes) ? fleetRecord.nodes : []) {
+    context.stdout.write(
+      `${node.ip_address}  ${node.gpu_node_id || "pending"}  ${node.status}${node.error ? `  ${node.error}` : ""}\n`
+    );
+  }
+}
+
+// De-enroll a node: gracefully terminate its enrollment (revoke claim, retire
+// listing, queue the agent self-uninstall packet) and, unless --keep-record is
+// set, dereference (hard-delete) the gpu_nodes row so nothing lingers in the
+// environment. Both steps are idempotent: a 404 means the node is already gone.
+async function nodeDeenroll(id, rest, context) {
+  const options = parseCommandOptions(
+    rest,
+    { boolean: ["json", "keep-record", "force"], value: ["reason"] },
+    nodeOpUsage("deenroll"),
+  );
+  const reason = optionalStringOption(options.reason) || "cli-deenroll";
+  // Dead/unreachable test nodes can't drain workloads, so default to force.
+  const force = options.force !== false;
+  const result = { node_id: id, terminated: false, dereferenced: false };
+
+  try {
+    const terminate = await operatorRequest({
+      body: {
+        request_id: `cli-deenroll:${id}:${Date.now()}`,
+        reason,
+        force,
+      },
+      endpoint: `/enrollment/nodes/${encodeURIComponent(id)}/terminate`,
+      env: context.env,
+      fetchImpl: context.fetchImpl,
+      method: "POST",
+    });
+    result.terminated = true;
+    result.terminate = terminate;
+  } catch (error) {
+    // Already-terminated / unknown node is a success for an idempotent teardown.
+    if (!(error instanceof CliApiError) || error.status !== 404) {
+      throw error;
+    }
+    result.already_gone = true;
+  }
+
+  if (!options.keepRecord) {
+    try {
+      const dereference = await operatorRequest({
+        endpoint: `/enrollment/nodes/${encodeURIComponent(id)}?force=${force ? "true" : "false"}`,
+        env: context.env,
+        fetchImpl: context.fetchImpl,
+        method: "DELETE",
+      });
+      result.dereferenced = true;
+      result.dereference = dereference;
+    } catch (error) {
+      if (!(error instanceof CliApiError) || error.status !== 404) {
+        throw error;
+      }
+      result.already_gone = true;
+    }
+  }
+
+  if (options.json) {
+    writeJson(context.stdout, result);
+  } else {
+    if (result.already_gone && !result.terminated && !result.dereferenced) {
+      context.stdout.write(`Node ${id} already de-enrolled (nothing to remove).\n`);
+    } else {
+      context.stdout.write(`Node ${id} de-enrolled.\n`);
+      writeOptionalStatusLine(context.stdout, "Terminated", result.terminated ? "yes" : "skipped");
+      writeOptionalStatusLine(
+        context.stdout,
+        "Record removed",
+        options.keepRecord ? "kept" : result.dereferenced ? "yes" : "already gone",
+      );
+    }
+  }
+  return 0;
+}
+
+function writeNodeHealth(stdout, node) {
+  stdout.write(`${node?.id ?? "unknown"}\n`);
+  stdout.write(`Status: ${node?.status || "unknown"}\n`);
+
+  const readiness = node?.health_readiness;
+  const reasons = Array.isArray(readiness?.reasons) ? readiness.reasons : [];
+  const readyLabel = readiness?.ready ? "ready" : readiness?.status || "blocked";
+  stdout.write(`Launch readiness: ${readyLabel}\n`);
+  // Compute encodes passive faults as `passive_fault:<name>` in readiness.reasons.
+  const blockers = reasons.filter((reason) => !String(reason).startsWith("passive_fault:"));
+  if (blockers.length) {
+    stdout.write("Blockers:\n");
+    for (const reason of blockers) {
+      stdout.write(`    - ${reason}\n`);
+    }
+  }
+
+  const passiveFaults = reasons
+    .filter((reason) => String(reason).startsWith("passive_fault:"))
+    .map((reason) => String(reason).slice("passive_fault:".length));
+  if (passiveFaults.length) {
+    stdout.write("Passive faults:\n");
+    for (const fault of passiveFaults) {
+      stdout.write(`    - ${fault}\n`);
+    }
+  } else {
+    stdout.write("Passive faults: none\n");
+  }
+
+  stdout.write(`Validation: ${node?.validation_status || "unknown"}\n`);
+  writeOptionalStatusLine(stdout, "Validation checked", node?.validation_checked_at);
+  writeOptionalStatusLine(stdout, "Last heartbeat", node?.last_heartbeat_at);
+}
+
+async function nodes(args, context) {
+  const [subcommand = "list", id, nested, ...rest] = args;
+
+  if (subcommand === "list") {
+    const options = parseCommandOptions(
+      [id, nested, ...rest].filter(Boolean),
+      { boolean: ["json"] },
+      "Usage: ornn nodes list [--json]",
+    );
+    const machines = await fetchTenantMachines(context);
+    if (options.json) {
+      writeJson(context.stdout, machines);
+    } else {
+      writeNodeList(context.stdout, machines);
+    }
+    return 0;
+  }
+
+  if (subcommand === "show" && id) {
+    const options = parseCommandOptions(
+      [nested, ...rest].filter(Boolean),
+      { boolean: ["json"] },
+      "Usage: ornn nodes show <node-id> [--json]",
+    );
+    const machine = await fetchMachine(id, context);
+    if (options.json) {
+      writeJson(context.stdout, machine);
+    } else {
+      writeNodeDetail(context.stdout, machine);
+    }
+    return 0;
+  }
+
+  if (subcommand === "launch" && id) {
+    const options = parseCommandOptions(
+      [nested, ...rest].filter(Boolean),
+      {
+        boolean: ["json", "no-open", "open", "wait"],
+        value: [
+          "key",
+          "key-id",
+          "label",
+          "machine-count",
+          "mode",
+          "network",
+          "network-mode",
+          "public-key",
+          "public-key-file",
+          "request-id",
+          "ssh-key-id",
+          "storage-load-drive-id",
+          "storage-save-drive-id",
+          "tenant-username",
+          "username",
+          "wait-interval",
+          "wait-timeout",
+        ],
+      },
+      "Usage: ornn nodes launch <reservation-id> --key <path|id|label> [--mode bare-metal|vm] [--username <name>] [--network public|private] [--storage-load-drive-id <id>] [--storage-save-drive-id <id>] [--wait] [--json]",
+    );
+    const result = await launchReservationAccess(id, options, context, { openDefault: false });
+    if (options.json) {
+      writeJson(context.stdout, result);
+    } else {
+      writeNodeLaunchResult(context.stdout, result);
+    }
+    return 0;
+  }
+
+  if (subcommand === "launch") {
+    throw new Error("Usage: ornn nodes launch <reservation-id> --key <path|id|label> [--mode bare-metal|vm] [--username <name>] [--network public|private] [--storage-load-drive-id <id>] [--storage-save-drive-id <id>] [--wait] [--json]");
+  }
+
+  if (subcommand === "switch" && id) {
+    const options = parseCommandOptions(
+      [nested, ...rest].filter(Boolean),
+      {
+        boolean: ["json", "wait"],
+        value: [
+          "key",
+          "key-id",
+          "label",
+          "mode",
+          "network",
+          "network-mode",
+          "public-key",
+          "public-key-file",
+          "request-id",
+          "ssh-key-id",
+          "tenant-username",
+          "username",
+          "wait-interval",
+          "wait-timeout",
+        ],
+      },
+      "Usage: ornn nodes switch <reservation-id> --network public|private --key <path|id|label> [--mode bare-metal|vm] [--username <name>] [--wait] [--json]",
+    );
+    const result = await switchReservationAccess(id, options, context);
+    if (options.json) {
+      writeJson(context.stdout, result);
+    } else {
+      context.stdout.write(
+        `Switched to ${displayAccessMode(result.mode)} / ${result.network_mode} on reservation ${id}.\n`,
+      );
+      writeAccessLaunchSummary(context.stdout, { machines: result.machines });
+      if (result.wait) {
+        writeWaitResult(context.stdout, result.wait);
+      }
+    }
+    return 0;
+  }
+
+  if (subcommand === "switch") {
+    throw new Error(
+      "Usage: ornn nodes switch <reservation-id> --network public|private --key <path|id|label> [--mode bare-metal|vm] [--username <name>] [--wait] [--json]",
+    );
+  }
+
+  if (subcommand === "wait" && id) {
     const options = parseCommandOptions(
       [nested, ...rest].filter(Boolean),
       { boolean: ["json"], value: ["timeout", "wait-interval", "wait-timeout"] },
@@ -1245,7 +3781,7 @@ async function nodes(args, context) {
     return 0;
   }
 
-  if (["start", "stop", "teardown", "revoke"].includes(subcommand) && id) {
+  if (["reboot", "hard-reset"].includes(subcommand) && id) {
     const options = parseCommandOptions(
       [nested, ...rest].filter(Boolean),
       { boolean: ["json"], value: ["request-id"] },
@@ -1285,7 +3821,7 @@ async function nodes(args, context) {
     return await nodeKeys([id, nested, ...rest].filter((item) => item !== undefined), context);
   }
 
-  throw new Error("Usage: ornn nodes list|show|launch|wait|start|stop|teardown|revoke|ssh-command|keys");
+  throw new Error("Usage: ornn nodes list|show|launch|switch|wait|reboot|hard-reset|ssh-command|keys");
 }
 
 async function ssh(args, context) {
@@ -1640,6 +4176,202 @@ async function clusters(args, context) {
   throw new Error("Usage: ornn clusters list|reservations|eligible-nodes|create|show|wait|credentials|kubeconfig|ssh-command|ssh|add-node|remove-node|teardown");
 }
 
+async function slurm(args, context) {
+  const [subcommand = "status", reservationId, ...rest] = args;
+
+  if (subcommand === "launch" && reservationId) {
+    const options = parseCommandOptions(
+      rest,
+      {
+        boolean: ["json", "wait"],
+        value: ["network", "node", "node-count", "wait-interval", "wait-timeout", "timeout"],
+      },
+      "Usage: ornn slurm launch <reservation-id> [--network public|private] [--node <node-id>] [--node-count <n>] [--wait] [--wait-timeout <seconds>] [--json]",
+    );
+    const launch = await launchCluster(reservationId, "slurm", options, context);
+    const wait = options.wait
+      ? await waitForClusterActive(reservationId, "slurm", waitOptions(options), context)
+      : null;
+    const result = { cluster: launch, reservation_id: reservationId, type: "slurm", wait };
+    if (options.json) {
+      writeJson(context.stdout, result);
+    } else {
+      writeClusterLaunchResult(context.stdout, result);
+    }
+    return 0;
+  }
+
+  if (subcommand === "teardown" && reservationId) {
+    const options = parseCommandOptions(
+      rest,
+      { boolean: ["json"] },
+      "Usage: ornn slurm teardown <reservation-id> [--json]",
+    );
+    const cluster = await teardownCluster(reservationId, "slurm", context);
+    if (options.json) {
+      writeJson(context.stdout, cluster);
+    } else {
+      context.stdout.write("Slurm cluster teardown queued.\n");
+      writeClusterDetail(context.stdout, cluster);
+    }
+    return 0;
+  }
+
+  if (subcommand === "status" && reservationId) {
+    const options = parseCommandOptions(
+      rest,
+      { boolean: ["json"] },
+      "Usage: ornn slurm status <reservation-id> [--json]",
+    );
+    const cluster = await fetchCluster(reservationId, "slurm", context);
+    if (options.json) {
+      writeJson(context.stdout, cluster);
+    } else {
+      writeClusterDetail(context.stdout, cluster);
+    }
+    return 0;
+  }
+
+  if (subcommand === "credentials" && reservationId) {
+    const options = parseCommandOptions(
+      rest,
+      { boolean: ["json"] },
+      "Usage: ornn slurm credentials <reservation-id> [--json]",
+    );
+    const credentials = await fetchClusterCredentials(reservationId, "slurm", context);
+    if (options.json) {
+      writeJson(context.stdout, credentials);
+    } else {
+      writeClusterCredentials(context.stdout, credentials, "slurm", reservationId);
+    }
+    return 0;
+  }
+
+  if (subcommand === "ssh" && reservationId) {
+    const options = parseCommandOptions(
+      rest,
+      { boolean: ["json", "print"], value: ["identity-file", "user"] },
+      "Usage: ornn slurm ssh <reservation-id> [--print] [--identity-file <path>] [--user <name>] [--json]",
+    );
+    const credentials = await fetchClusterCredentials(reservationId, "slurm", context);
+    const invocation = slurmSshInvocation(credentials, options);
+    if (!invocation) {
+      throw new Error("Slurm SSH login is not ready yet.");
+    }
+    const command = commandText(invocation);
+    if (options.json) {
+      writeJson(context.stdout, { command, credentials });
+      return 0;
+    }
+    if (options.print) {
+      context.stdout.write(`${command}\n`);
+      return 0;
+    }
+    return await spawnCommand(invocation, context);
+  }
+
+  throw new Error("Usage: ornn slurm launch|teardown|status|credentials|ssh <reservation-id>");
+}
+
+async function kubernetes(args, context) {
+  const [subcommand = "status", reservationId, ...rest] = args;
+
+  if (subcommand === "launch" && reservationId) {
+    const options = parseCommandOptions(
+      rest,
+      {
+        boolean: ["json", "wait"],
+        value: ["network", "node", "node-count", "wait-interval", "wait-timeout", "timeout"],
+      },
+      "Usage: ornn kubernetes launch <reservation-id> [--network public|private] [--node <node-id>] [--node-count <n>] [--wait] [--wait-timeout <seconds>] [--json]",
+    );
+    const launch = await launchCluster(reservationId, "kubernetes", options, context);
+    const wait = options.wait
+      ? await waitForClusterActive(reservationId, "kubernetes", waitOptions(options), context)
+      : null;
+    const result = { cluster: launch, reservation_id: reservationId, type: "kubernetes", wait };
+    if (options.json) {
+      writeJson(context.stdout, result);
+    } else {
+      writeClusterLaunchResult(context.stdout, result);
+    }
+    return 0;
+  }
+
+  if (subcommand === "teardown" && reservationId) {
+    const options = parseCommandOptions(
+      rest,
+      { boolean: ["json"] },
+      "Usage: ornn kubernetes teardown <reservation-id> [--json]",
+    );
+    const cluster = await teardownCluster(reservationId, "kubernetes", context);
+    if (options.json) {
+      writeJson(context.stdout, cluster);
+    } else {
+      context.stdout.write("Kubernetes cluster teardown queued.\n");
+      writeClusterDetail(context.stdout, cluster);
+    }
+    return 0;
+  }
+
+  if (subcommand === "status" && reservationId) {
+    const options = parseCommandOptions(
+      rest,
+      { boolean: ["json"] },
+      "Usage: ornn kubernetes status <reservation-id> [--json]",
+    );
+    const cluster = await fetchCluster(reservationId, "kubernetes", context);
+    if (options.json) {
+      writeJson(context.stdout, cluster);
+    } else {
+      writeClusterDetail(context.stdout, cluster);
+    }
+    return 0;
+  }
+
+  if (subcommand === "credentials" && reservationId) {
+    const options = parseCommandOptions(
+      rest,
+      { boolean: ["json"] },
+      "Usage: ornn kubernetes credentials <reservation-id> [--json]",
+    );
+    const credentials = await fetchClusterCredentials(reservationId, "kubernetes", context);
+    if (options.json) {
+      writeJson(context.stdout, credentials);
+    } else {
+      writeClusterCredentials(context.stdout, credentials, "kubernetes", reservationId);
+    }
+    return 0;
+  }
+
+  if (subcommand === "kubeconfig" && reservationId) {
+    const options = parseCommandOptions(
+      rest,
+      { boolean: ["json"], value: ["output"] },
+      "Usage: ornn kubernetes kubeconfig <reservation-id> [--output <path>] [--json]",
+    );
+    const credentials = await fetchClusterCredentials(reservationId, "kubernetes", context);
+    const kubeconfig = String(credentials?.kubeconfig || "");
+    if (!kubeconfig.trim()) {
+      throw new Error("Kubernetes kubeconfig is not ready yet.");
+    }
+    const outputPath = options.output ? expandUserPath(String(options.output)) : null;
+    if (outputPath) {
+      await writeFile(outputPath, kubeconfig.endsWith("\n") ? kubeconfig : `${kubeconfig}\n`, "utf8");
+    }
+    if (options.json) {
+      writeJson(context.stdout, { credentials, output: outputPath });
+    } else if (outputPath) {
+      context.stdout.write(`Kubeconfig written: ${outputPath}\n`);
+    } else {
+      context.stdout.write(kubeconfig.endsWith("\n") ? kubeconfig : `${kubeconfig}\n`);
+    }
+    return 0;
+  }
+
+  throw new Error("Usage: ornn kubernetes launch|teardown|status|credentials|kubeconfig <reservation-id>");
+}
+
 async function networks(args, context) {
   const [subcommand = "list", id, ...rest] = args;
 
@@ -1776,7 +4508,7 @@ async function networks(args, context) {
       "Usage: ornn networks reservation <reservation-id> [--json]",
     );
     const payload = await cliRequest({
-      endpoint: computeEndpoint(`/standalone-vms/reservations/${encodeURIComponent(id)}/network`),
+      endpoint: computeEndpoint(`/nodes/reservations/${encodeURIComponent(id)}/network`),
       env: context.env,
       fetchImpl: context.fetchImpl,
     });
@@ -1797,7 +4529,7 @@ async function networks(args, context) {
     const networkId = requiredOption(options.network || options.networkId, "--network");
     const payload = await cliRequest({
       body: { tenant_network_id: networkId },
-      endpoint: computeEndpoint(`/standalone-vms/reservations/${encodeURIComponent(id)}/network`),
+      endpoint: computeEndpoint(`/nodes/reservations/${encodeURIComponent(id)}/network`),
       env: context.env,
       fetchImpl: context.fetchImpl,
       method: "POST",
@@ -1810,36 +4542,410 @@ async function networks(args, context) {
     }
     return 0;
   }
-
-  if (subcommand === "detach" && id) {
+
+  if (subcommand === "detach" && id) {
+    const options = parseCommandOptions(
+      rest,
+      { boolean: ["json"] },
+      "Usage: ornn networks detach <reservation-id> [--json]",
+    );
+    const payload = await cliRequest({
+      body: { tenant_network_id: null },
+      endpoint: computeEndpoint(`/nodes/reservations/${encodeURIComponent(id)}/network`),
+      env: context.env,
+      fetchImpl: context.fetchImpl,
+      method: "POST",
+    });
+    if (options.json) {
+      writeJson(context.stdout, payload);
+    } else {
+      context.stdout.write("Reservation network detached.\n");
+      writeReservationNetwork(context.stdout, payload);
+    }
+    return 0;
+  }
+
+  throw new Error("Usage: ornn networks list|show|create|update|delete|reservation|attach|detach");
+}
+
+async function storage(args, context) {
+  const [resource = "volumes", rawSubcommand, id, ...rest] = args;
+  const subcommand =
+    rawSubcommand ?? (resource === "buckets" || ["drives", "volumes"].includes(resource) ? "list" : undefined);
+  if (resource === "unmount" || resource === "undeploy") {
+    const options = parseCommandOptions(
+      [rawSubcommand, id, ...rest].filter(Boolean),
+      {
+        boolean: ["json"],
+        value: ["reservation", "reservation-id"],
+      },
+      `Usage: ornn storage ${resource} --reservation <reservation-id> [--json]`,
+    );
+    const reservationId = requiredOption(options.reservation || options.reservationId, "--reservation");
+    const endpoint = computeEndpoint(
+      `/nodes/reservations/${encodeURIComponent(reservationId)}/storage-attachment${
+        resource === "unmount" ? "/unmount" : ""
+      }`,
+    );
+    const payload = await cliRequest({
+      endpoint,
+      env: context.env,
+      fetchImpl: context.fetchImpl,
+      method: resource === "unmount" ? "POST" : "DELETE",
+    });
+    if (options.json) {
+      writeJson(context.stdout, payload);
+    } else if (resource === "unmount") {
+      context.stdout.write("Storage unmount requested.\n");
+      writeReservationStorageAttachment(context.stdout, payload.attachment);
+    } else {
+      context.stdout.write("Storage undeployed (attachment detached).\n");
+      if (payload?.attachment) {
+        writeReservationStorageAttachment(context.stdout, payload.attachment);
+      }
+    }
+    return 0;
+  }
+  if (resource === "filesystem" || resource === "fileshare") {
+    if (subcommand === "deploy") {
+      const options = parseCommandOptions(
+        [id, ...rest].filter(Boolean),
+        {
+          boolean: ["json"],
+          value: ["capacity-gib", "performance-tier", "reservation", "reservation-id"],
+        },
+        "Usage: ornn storage filesystem deploy --reservation <reservation-id> [--performance-tier <tier>] [--capacity-gib <gib>] [--json]",
+      );
+      const reservationId = requiredOption(options.reservation || options.reservationId, "--reservation");
+      const payload = await cliRequest({
+        body: {
+          ...(optionProvided(options.performanceTier) ? { performance_tier: requiredOption(options.performanceTier, "--performance-tier") } : {}),
+          ...(optionProvided(options.capacityGib) ? { capacity_gib: positiveIntegerOption(options.capacityGib, "--capacity-gib") } : {}),
+        },
+        endpoint: computeEndpoint(`/nodes/reservations/${encodeURIComponent(reservationId)}/filesystem-deployment`),
+        env: context.env,
+        fetchImpl: context.fetchImpl,
+        method: "POST",
+      });
+      if (options.json) {
+        writeJson(context.stdout, payload);
+      } else {
+        context.stdout.write("Filesystem deployment started.\n");
+        writeReservationStorageAttachment(context.stdout, payload.attachment);
+      }
+      return 0;
+    }
+    if (subcommand === "status") {
+      const options = parseCommandOptions(
+        [id, ...rest].filter(Boolean),
+        {
+          boolean: ["json"],
+          value: ["reservation", "reservation-id"],
+        },
+        "Usage: ornn storage filesystem status --reservation <reservation-id> [--json]",
+      );
+      const reservationId = requiredOption(options.reservation || options.reservationId, "--reservation");
+      const payload = await cliRequest({
+        endpoint: computeEndpoint(`/nodes/reservations/${encodeURIComponent(reservationId)}/storage-attachment`),
+        env: context.env,
+        fetchImpl: context.fetchImpl,
+      });
+      if (options.json) {
+        writeJson(context.stdout, payload);
+      } else {
+        context.stdout.write("Filesystem deployment status.\n");
+        writeReservationStorageAttachment(context.stdout, payload.attachment);
+      }
+      return 0;
+    }
+    if (subcommand === "delete" || subcommand === "teardown") {
+      const options = parseCommandOptions(
+        [id, ...rest].filter(Boolean),
+        {
+          boolean: ["json"],
+          value: ["reservation", "reservation-id"],
+        },
+        "Usage: ornn storage filesystem delete --reservation <reservation-id> [--json]",
+      );
+      const reservationId = requiredOption(options.reservation || options.reservationId, "--reservation");
+      const payload = await cliRequest({
+        endpoint: computeEndpoint(`/nodes/reservations/${encodeURIComponent(reservationId)}/filesystem-deployment`),
+        env: context.env,
+        fetchImpl: context.fetchImpl,
+        method: "DELETE",
+      });
+      if (options.json) {
+        writeJson(context.stdout, payload);
+      } else {
+        context.stdout.write("Filesystem deletion requested.\n");
+        writeReservationStorageAttachment(context.stdout, payload.attachment);
+      }
+      return 0;
+    }
+    throw new Error("Usage: ornn storage filesystem deploy|status|delete --reservation <reservation-id> [--json]");
+  }
+  if (resource === "deploy" && subcommand === "status") {
+    const options = parseCommandOptions(
+      [id, ...rest].filter(Boolean),
+      {
+        boolean: ["json"],
+        value: ["reservation", "reservation-id"],
+      },
+      "Usage: ornn storage deploy status --reservation <reservation-id> [--json]",
+    );
+    const reservationId = requiredOption(options.reservation || options.reservationId, "--reservation");
+    const payload = await cliRequest({
+      endpoint: computeEndpoint(`/nodes/reservations/${encodeURIComponent(reservationId)}/storage-attachment`),
+      env: context.env,
+      fetchImpl: context.fetchImpl,
+    });
+    if (options.json) {
+      writeJson(context.stdout, payload);
+    } else {
+      context.stdout.write("Storage deployment status.\n");
+      writeReservationStorageAttachment(context.stdout, payload.attachment);
+    }
+    return 0;
+  }
+  if (resource === "deploy" && subcommand) {
+    const options = parseCommandOptions(
+      [id, ...rest].filter(Boolean),
+      {
+        boolean: ["json", "read-only", "read-write"],
+        value: ["mount-path", "reservation", "reservation-id"],
+      },
+      "Usage: ornn storage deploy <drive-id> --reservation <reservation-id> [--mount-path <path>] [--read-only|--read-write] [--json]",
+    );
+    if (options.readOnly && options.readWrite) {
+      throw new Error("Choose only one of --read-only or --read-write.");
+    }
+    const reservationId = requiredOption(options.reservation || options.reservationId, "--reservation");
+    const payload = await cliRequest({
+      body: {
+        drive_id: subcommand,
+        ...(optionProvided(options.mountPath) ? { mount_path: requiredOption(options.mountPath, "--mount-path") } : {}),
+        access_mode: options.readOnly ? "read-only" : "read-write",
+      },
+      endpoint: computeEndpoint(`/nodes/reservations/${encodeURIComponent(reservationId)}/storage-deployment`),
+      env: context.env,
+      fetchImpl: context.fetchImpl,
+      method: "POST",
+    });
+    if (options.json) {
+      writeJson(context.stdout, payload);
+    } else {
+      context.stdout.write("Storage deployment started.\n");
+      writeReservationStorageAttachment(context.stdout, payload.attachment);
+    }
+    return 0;
+  }
+  if (resource === "deploy") {
+    throw new Error("Usage: ornn storage deploy <drive-id> --reservation <reservation-id> [--mount-path <path>] [--read-only|--read-write] [--json]");
+  }
+  if (resource === "buckets") {
+    if (subcommand === "list") {
+      const options = parseCommandOptions(
+        [id, ...rest].filter(Boolean),
+        { boolean: ["json"] },
+        "Usage: ornn storage buckets list [--json]",
+      );
+      const payload = await fetchStorageDrives(context);
+      const buckets = storageBucketsFromPayload(payload);
+      if (options.json) {
+        writeJson(context.stdout, { buckets });
+      } else {
+        writeStorageBucketList(context.stdout, buckets);
+      }
+      return 0;
+    }
+    if (subcommand === "show" && id) {
+      const options = parseCommandOptions(
+        rest,
+        { boolean: ["json"] },
+        "Usage: ornn storage buckets show <drive-id> [--json]",
+      );
+      const bucket = await findStorageBucket(id, context);
+      if (options.json) {
+        writeJson(context.stdout, bucket);
+      } else {
+        writeStorageDriveDetail(context.stdout, bucket);
+      }
+      return 0;
+    }
+    if (subcommand === "verify" && id) {
+      const options = parseCommandOptions(
+        rest,
+        { boolean: ["json"] },
+        "Usage: ornn storage buckets verify <drive-id> [--json]",
+      );
+      const drive = await cliRequest({
+        endpoint: computeEndpoint(`/nodes/storage-drives/${encodeURIComponent(id)}/verify-source`),
+        env: context.env,
+        fetchImpl: context.fetchImpl,
+        method: "POST",
+      });
+      const verificationFailed = drive?.source?.connection_status === "verification_failed";
+      if (options.json) {
+        writeJson(context.stdout, drive);
+      } else {
+        context.stdout.write(
+          verificationFailed ? "Bucket source verification failed.\n" : "Bucket source verified.\n",
+        );
+        writeStorageDriveDetail(context.stdout, drive);
+      }
+      return verificationFailed ? 1 : 0;
+    }
+    if (subcommand === "update-credentials" && id) {
+      const options = parseCommandOptions(
+        rest,
+        {
+          boolean: ["json"],
+          value: ["access-key-id", "secret-access-key", "secret-access-key-file"],
+        },
+        "Usage: ornn storage buckets update-credentials <drive-id> --access-key-id <id> --secret-access-key-file <path> [--json]",
+      );
+      if (options.secretAccessKey && options.secretAccessKeyFile) {
+        throw new Error("Use only one of --secret-access-key or --secret-access-key-file.");
+      }
+      const secretAccessKey = options.secretAccessKeyFile
+        ? (await readFile(options.secretAccessKeyFile, "utf8")).trim()
+        : optionalStringOption(options.secretAccessKey);
+      if (!secretAccessKey) {
+        throw new Error("--secret-access-key-file or --secret-access-key is required.");
+      }
+      const drive = await cliRequest({
+        body: {
+          external_access_key_id: requiredOption(options.accessKeyId, "--access-key-id"),
+          external_secret_access_key: secretAccessKey,
+        },
+        endpoint: computeEndpoint(`/nodes/storage-drives/${encodeURIComponent(id)}/source-credentials`),
+        env: context.env,
+        fetchImpl: context.fetchImpl,
+        method: "PATCH",
+      });
+      if (options.json) {
+        writeJson(context.stdout, drive);
+      } else {
+        context.stdout.write("Bucket credentials updated.\n");
+        writeStorageDriveDetail(context.stdout, drive);
+      }
+      return 0;
+    }
+    if (subcommand === "disconnect" && id) {
+      const options = parseCommandOptions(
+        rest,
+        { boolean: ["json"] },
+        "Usage: ornn storage buckets disconnect <drive-id> [--json]",
+      );
+      await cliRequest({
+        endpoint: computeEndpoint(`/nodes/storage-drives/${encodeURIComponent(id)}`),
+        env: context.env,
+        fetchImpl: context.fetchImpl,
+        method: "DELETE",
+      });
+      const result = { disconnected: true, drive_id: id };
+      if (options.json) {
+        writeJson(context.stdout, result);
+      } else {
+        context.stdout.write(`Bucket disconnected: ${id}\n`);
+      }
+      return 0;
+    }
+    if (subcommand !== "connect" || !["gcs", "s3", "r2"].includes(id)) {
+      throw new Error(
+        "Usage: ornn storage buckets list|show|connect|verify|update-credentials|disconnect",
+      );
+    }
     const options = parseCommandOptions(
       rest,
-      { boolean: ["json"] },
-      "Usage: ornn networks detach <reservation-id> [--json]",
+      {
+        boolean: ["json", "read-only", "read-write", "verify"],
+        value: ["access-key-id", "account-id", "bucket", "endpoint-url", "name", "prefix", "region", "secret-access-key", "secret-access-key-file", "url"],
+      },
+      "Usage: ornn storage buckets connect gcs|s3|r2 --bucket <bucket>|--url <url> [--name <name>] [--prefix <prefix>] [--region <region>] [--account-id <id>|--endpoint-url <url>] [--access-key-id <id> --secret-access-key-file <path>] [--read-only|--read-write] [--verify] [--json]",
     );
-    const payload = await cliRequest({
-      body: { tenant_network_id: null },
-      endpoint: computeEndpoint(`/standalone-vms/reservations/${encodeURIComponent(id)}/network`),
+    if (options.readOnly && options.readWrite) {
+      throw new Error("Choose only one of --read-only or --read-write.");
+    }
+    if (options.bucket && options.url) {
+      throw new Error("Use only one of --bucket or --url.");
+    }
+    if (id === "gcs" && options.verify) {
+      throw new Error("--verify is only supported for S3-compatible buckets.");
+    }
+    if (options.secretAccessKey && options.secretAccessKeyFile) {
+      throw new Error("Use only one of --secret-access-key or --secret-access-key-file.");
+    }
+    if (id === "gcs" && (options.accessKeyId || options.secretAccessKey || options.secretAccessKeyFile)) {
+      throw new Error("Access key credentials are only supported for S3-compatible buckets.");
+    }
+    const secretAccessKey = options.secretAccessKeyFile
+      ? (await readFile(options.secretAccessKeyFile, "utf8")).trim()
+      : optionalStringOption(options.secretAccessKey);
+    if (Boolean(options.accessKeyId) !== Boolean(secretAccessKey)) {
+      throw new Error("Use --access-key-id with --secret-access-key-file or --secret-access-key.");
+    }
+    const source = storageBucketSourceFromOptions(id, options);
+    const prefix = optionalStringOption(options.prefix) ?? source.prefix;
+    const endpointOptions = { ...options };
+    if (!optionProvided(endpointOptions.accountId) && source.accountId && !optionProvided(endpointOptions.endpointUrl)) {
+      endpointOptions.accountId = source.accountId;
+    }
+    const endpointUrl = storageBucketEndpointUrl(id, endpointOptions);
+    const sourceProvider = id === "gcs" ? "external_gcs" : "s3";
+    const bucketName = source.bucket;
+    let drive = await cliRequest({
+      body: {
+        name: optionalStringOption(options.name) ?? bucketName,
+        provider: "ornn_volume",
+        source_provider: sourceProvider,
+        external_bucket: bucketName,
+        external_prefix: prefix,
+        external_region: optionalStringOption(options.region) ?? source.region ?? (id === "r2" ? "auto" : null),
+        external_read_only: options.readWrite ? false : true,
+        ...(id === "r2" ? { external_s3_provider: "cloudflare_r2" } : {}),
+        ...(id === "s3" ? { external_s3_provider: "aws_s3" } : {}),
+        ...(endpointUrl ? { external_endpoint_url: endpointUrl } : {}),
+        ...(options.accessKeyId ? { external_access_key_id: options.accessKeyId } : {}),
+        ...(secretAccessKey ? { external_secret_access_key: secretAccessKey } : {}),
+      },
+      endpoint: computeEndpoint("/nodes/storage-drives"),
       env: context.env,
       fetchImpl: context.fetchImpl,
       method: "POST",
     });
+    if (options.verify) {
+      drive = await verifyStorageBucketSource(drive.id, context);
+    }
+    const commands = storageBucketImportCommands({
+      bucket: bucketName,
+      endpointUrl,
+      prefix,
+      provider: id,
+      region: optionalStringOption(options.region) ?? source.region ?? (id === "r2" ? "auto" : null),
+      target: drive.import_target,
+    });
     if (options.json) {
-      writeJson(context.stdout, payload);
+      writeJson(context.stdout, { ...drive, import_commands: commands });
     } else {
-      context.stdout.write("Reservation network detached.\n");
-      writeReservationNetwork(context.stdout, payload);
+      context.stdout.write("Bucket connected.\n");
+      if (options.verify) {
+        context.stdout.write(
+          drive?.source?.connection_status === "verification_failed"
+            ? "Bucket source verification failed.\n"
+            : "Bucket source verified.\n",
+        );
+      }
+      writeStorageDriveDetail(context.stdout, drive);
+      if (id === "r2") {
+        context.stdout.write("\nCloudflare R2 deployment is coming soon.\n");
+      }
+      writeStorageImportCommands(context.stdout, commands);
     }
-    return 0;
+    return drive?.source?.connection_status === "verification_failed" ? 1 : 0;
   }
-
-  throw new Error("Usage: ornn networks list|show|create|update|delete|reservation|attach|detach");
-}
-
-async function storage(args, context) {
-  const [resource = "volumes", subcommand = "list", id, ...rest] = args;
   if (!["drives", "volumes"].includes(resource)) {
-    throw new Error("Usage: ornn storage volumes list|show|create|refresh|clear|delete");
+    throw new Error("Usage: ornn storage volumes list|show|create|refresh|clear|delete; ornn storage buckets connect gcs|s3|r2 --bucket <bucket>");
   }
 
   if (subcommand === "list") {
@@ -1886,7 +4992,7 @@ async function storage(args, context) {
         name: requiredOption(options.name, "--name"),
         source_drive_id: sourceDriveId,
       },
-      endpoint: computeEndpoint("/standalone-vms/storage-drives"),
+      endpoint: computeEndpoint("/nodes/storage-drives"),
       env: context.env,
       fetchImpl: context.fetchImpl,
       method: "POST",
@@ -1907,7 +5013,7 @@ async function storage(args, context) {
       "Usage: ornn storage volumes refresh <drive-id> [--json]",
     );
     const drive = await cliRequest({
-      endpoint: computeEndpoint(`/standalone-vms/storage-drives/${encodeURIComponent(id)}/refresh`),
+      endpoint: computeEndpoint(`/nodes/storage-drives/${encodeURIComponent(id)}/refresh`),
       env: context.env,
       fetchImpl: context.fetchImpl,
       method: "POST",
@@ -1928,7 +5034,7 @@ async function storage(args, context) {
       "Usage: ornn storage volumes clear <drive-id> [--json]",
     );
     await cliRequest({
-      endpoint: computeEndpoint(`/standalone-vms/storage-drives/${encodeURIComponent(id)}/contents`),
+      endpoint: computeEndpoint(`/nodes/storage-drives/${encodeURIComponent(id)}/contents`),
       env: context.env,
       fetchImpl: context.fetchImpl,
       method: "DELETE",
@@ -1949,7 +5055,7 @@ async function storage(args, context) {
       "Usage: ornn storage volumes delete <drive-id> [--json]",
     );
     await cliRequest({
-      endpoint: computeEndpoint(`/standalone-vms/storage-drives/${encodeURIComponent(id)}`),
+      endpoint: computeEndpoint(`/nodes/storage-drives/${encodeURIComponent(id)}`),
       env: context.env,
       fetchImpl: context.fetchImpl,
       method: "DELETE",
@@ -2045,7 +5151,7 @@ async function access(args, context) {
 
   const [reservationId, ...rest] = subcommandArgs;
   if (!subcommand || !reservationId) {
-    throw new Error("Usage: ornn access show|activate|push-keys|keys <reservation-id>");
+    throw new Error("Usage: ornn access show|activate|switch|push-keys|keys <reservation-id>");
   }
 
   if (subcommand === "show") {
@@ -2106,6 +5212,45 @@ async function access(args, context) {
     return 0;
   }
 
+  if (subcommand === "switch") {
+    const options = parseCommandOptions(
+      rest,
+      {
+        boolean: ["json", "wait"],
+        value: [
+          "key",
+          "key-id",
+          "label",
+          "mode",
+          "network",
+          "network-mode",
+          "public-key",
+          "public-key-file",
+          "request-id",
+          "ssh-key-id",
+          "tenant-username",
+          "username",
+          "wait-interval",
+          "wait-timeout",
+        ],
+      },
+      "Usage: ornn access switch <reservation-id> --network public|private --key <path|id|label> [--mode bare-metal|vm] [--username <name>] [--wait] [--json]",
+    );
+    const result = await switchReservationAccess(reservationId, options, context);
+    if (options.json) {
+      writeJson(context.stdout, result);
+    } else {
+      context.stdout.write(
+        `Switched to ${displayAccessMode(result.mode)} / ${result.network_mode} on reservation ${reservationId}.\n`,
+      );
+      writeAccessLaunchSummary(context.stdout, { machines: result.machines });
+      if (result.wait) {
+        writeWaitResult(context.stdout, result.wait);
+      }
+    }
+    return 0;
+  }
+
   if (subcommand === "push-keys") {
     const options = parseCommandOptions(
       rest,
@@ -2295,7 +5440,7 @@ async function sshKeys(args, context) {
       "Usage: ornn ssh-keys list [--json]",
     );
     const keys = await cliRequest({
-      endpoint: computeEndpoint("/standalone-vms/tenants/me/ssh-keys"),
+      endpoint: computeEndpoint("/nodes/tenants/me/ssh-keys"),
       env: context.env,
       fetchImpl: context.fetchImpl,
     });
@@ -2321,7 +5466,7 @@ async function sshKeys(args, context) {
         label: options.label || null,
         public_key: publicKey,
       },
-      endpoint: computeEndpoint("/standalone-vms/tenants/me/ssh-keys"),
+      endpoint: computeEndpoint("/nodes/tenants/me/ssh-keys"),
       env: context.env,
       fetchImpl: context.fetchImpl,
       method: "POST",
@@ -2344,7 +5489,7 @@ async function sshKeys(args, context) {
       "Usage: ornn ssh-keys delete <key-id> [--json]",
     );
     const response = await cliRequest({
-      endpoint: computeEndpoint(`/standalone-vms/tenants/me/ssh-keys/${id}`),
+      endpoint: computeEndpoint(`/nodes/tenants/me/ssh-keys/${id}`),
       env: context.env,
       fetchImpl: context.fetchImpl,
       method: "DELETE",
@@ -2509,9 +5654,8 @@ async function resolveFabricUrl(context, pathOrUrl) {
 
 async function resolveFabricBaseUrl(context) {
   const env = context.env ?? {};
-  const configured = env.ORNN_AUTH_BASE_URL?.trim() || env.BETTER_AUTH_URL?.trim();
-  if (configured) {
-    return configured.replace(/\/+$/, "");
+  if (env.ORNN_AUTH_BASE_URL?.trim()) {
+    return env.ORNN_AUTH_BASE_URL.trim().replace(/\/+$/, "");
   }
 
   try {
@@ -2523,6 +5667,7 @@ async function resolveFabricBaseUrl(context) {
     // Browser handoff URLs should still work for unauthenticated flows.
   }
 
+  // Shared resolver, so handoffs cannot drift from where the API calls go.
   return resolveAuthBaseUrl({ env });
 }
 
@@ -2615,13 +5760,20 @@ function formatBytes(value) {
 }
 
 async function findBid(id, context) {
-  const bids = await cliRequest({
-    endpoint: computeEndpoint("/tenants/me/bids"),
-    env: context.env,
-    fetchImpl: context.fetchImpl,
-  });
-  const found = requireArrayPayload(bids, "bids").find((candidate) => candidate.id === id);
-  if (!found) {
+  let found;
+  try {
+    found = await cliRequest({
+      endpoint: computeEndpoint(`/tenants/me/bids/${encodeURIComponent(id)}`),
+      env: context.env,
+      fetchImpl: context.fetchImpl,
+    });
+  } catch (error) {
+    if (error instanceof CliApiError && error.status === 404) {
+      throw new Error(`Bid not found: ${id}`);
+    }
+    throw error;
+  }
+  if (!found || typeof found !== "object" || Array.isArray(found) || found.id !== id) {
     throw new Error(`Bid not found: ${id}`);
   }
   return found;
@@ -2657,18 +5809,56 @@ function writeBidDetail(stdout, bid) {
 }
 
 async function findReservation(id, context) {
-  const reservations = await cliRequest({
-    endpoint: computeEndpoint("/tenants/me/reservations"),
-    env: context.env,
-    fetchImpl: context.fetchImpl,
-  });
-  const found = requireArrayPayload(reservations, "reservations").find((candidate) => candidate.id === id);
-  if (!found) {
+  let found;
+  try {
+    found = await cliRequest({
+      endpoint: computeEndpoint(`/tenants/me/reservations/${encodeURIComponent(id)}`),
+      env: context.env,
+      fetchImpl: context.fetchImpl,
+    });
+  } catch (error) {
+    if (error instanceof CliApiError && error.status === 404) {
+      throw new Error(`Reservation not found: ${id}`);
+    }
+    throw error;
+  }
+  if (!found || typeof found !== "object" || Array.isArray(found) || found.id !== id) {
     throw new Error(`Reservation not found: ${id}`);
   }
   return found;
 }
 
+export async function fetchAllTenantReservations(context) {
+  const all = [];
+  const limit = 500;
+  const seenCursors = new Set();
+  let cursor;
+  for (let page = 0; page < 201; page += 1) {
+    const batch = requireArrayPayload(
+      await cliRequest({
+        endpoint: computeEndpoint(`/tenants/me/reservations${buildQuery({ limit, cursor })}`),
+        env: context.env,
+        fetchImpl: context.fetchImpl,
+      }),
+      "reservations",
+    );
+    all.push(...batch);
+    if (batch.length < limit) {
+      return all;
+    }
+    const nextCursor = batch.at(-1)?.id;
+    if (typeof nextCursor !== "string" || !nextCursor.trim() || nextCursor === cursor || seenCursors.has(nextCursor)) {
+      throw new Error("Reservation cursor pagination did not advance.");
+    }
+    cursor = nextCursor;
+    seenCursors.add(cursor);
+  }
+  context.stderr?.write(
+    `Warning: reservation scan reached its pagination safety limit; continuing with the first ${all.length} records.\n`,
+  );
+  return all;
+}
+
 function writeReservationList(stdout, reservations) {
   if (!reservations.length) {
     stdout.write("No GPU reservations found.\n");
@@ -2701,7 +5891,7 @@ function writeReservationDetail(stdout, reservation) {
 
 async function getReservationMachines(reservationId, context) {
   const payload = await cliRequest({
-    endpoint: computeEndpoint(`/standalone-vms/reservations/${reservationId}/machines`),
+    endpoint: computeEndpoint(`/nodes/reservations/${reservationId}/machines`),
     env: context.env,
     fetchImpl: context.fetchImpl,
   });
@@ -2719,9 +5909,18 @@ async function fetchBillingInvoices(context) {
 
 async function fetchStorageDrives(context) {
   return await cliRequest({
-    endpoint: computeEndpoint("/standalone-vms/storage-drives"),
+    endpoint: computeEndpoint("/nodes/storage-drives"),
+    env: context.env,
+    fetchImpl: context.fetchImpl,
+  });
+}
+
+async function verifyStorageBucketSource(driveId, context) {
+  return await cliRequest({
+    endpoint: computeEndpoint(`/nodes/storage-drives/${encodeURIComponent(driveId)}/verify-source`),
     env: context.env,
     fetchImpl: context.fetchImpl,
+    method: "POST",
   });
 }
 
@@ -2734,8 +5933,17 @@ async function findStorageDrive(driveId, context) {
   return drive;
 }
 
+async function findStorageBucket(driveId, context) {
+  const payload = await fetchStorageDrives(context);
+  const bucket = storageBucketsFromPayload(payload).find((item) => String(item.id) === String(driveId));
+  if (!bucket) {
+    throw new Error(`Storage bucket not found: ${driveId}`);
+  }
+  return bucket;
+}
+
 function reservationSshKeysEndpoint(reservationId) {
-  return computeEndpoint(`/standalone-vms/reservations/${reservationId}/ssh-keys`);
+  return computeEndpoint(`/nodes/reservations/${reservationId}/ssh-keys`);
 }
 
 async function fetchReservationSshKeys(reservationId, context) {
@@ -2782,7 +5990,7 @@ async function launchReservationAccess(reservationId, options, context, { openDe
   });
   const launch = await cliRequest({
     body: launchPayload,
-    endpoint: computeEndpoint(`/standalone-vms/reservations/${reservationId}/launch`),
+    endpoint: computeEndpoint(`/nodes/reservations/${reservationId}/launch`),
     env: context.env,
     fetchImpl: context.fetchImpl,
     method: "POST",
@@ -2805,6 +6013,45 @@ async function launchReservationAccess(reservationId, options, context, { openDe
   };
 }
 
+async function switchReservationAccess(reservationId, options, context) {
+  const mode = normalizeAccessMode(options.mode || "bare-metal");
+  const networkOption = optionProvided(options.networkMode) ? options.networkMode : options.network;
+  if (!optionProvided(networkOption)) {
+    throw new Error("--network public|private is required.");
+  }
+  const networkMode = normalizeNodeNetwork(networkOption);
+  const sshKeyIds = await resolveAccountSshKeyIds(options, context);
+  if (!sshKeyIds.length) {
+    throw new Error("--key is required.");
+  }
+  const switchPayload = {
+    access_mode: mode,
+    network_mode: networkMode,
+    request_id: options.requestId || null,
+    ssh_key_ids: sshKeyIds,
+    tenant_username: options.username || options.tenantUsername || null,
+  };
+  const switched = await cliRequest({
+    body: switchPayload,
+    endpoint: computeEndpoint(`/nodes/reservations/${reservationId}/switch-access`),
+    env: context.env,
+    fetchImpl: context.fetchImpl,
+    method: "POST",
+  });
+  const machines = Array.isArray(switched?.machines) ? switched.machines : [];
+  const wait = options.wait ? await waitForSshReady(reservationId, waitOptions(options), context) : null;
+  return {
+    machines,
+    mode,
+    network_mode: networkMode,
+    reservation_id: reservationId,
+    ssh_key_ids: sshKeyIds,
+    switch: switched,
+    wait,
+    warnings: switched?.warnings || [],
+  };
+}
+
 function accessActivateJsonResult(result) {
   return {
     access: result.access,
@@ -2978,14 +6225,7 @@ function clusterStateIsTerminal(state) {
 }
 
 async function fetchTenantMachines(context) {
-  const reservations = requireArrayPayload(
-    await cliRequest({
-      endpoint: computeEndpoint("/tenants/me/reservations"),
-      env: context.env,
-      fetchImpl: context.fetchImpl,
-    }),
-    "reservations",
-  );
+  const reservations = await fetchAllTenantReservations(context);
   const settled = await Promise.allSettled(
     reservations.map(async (reservation) => {
       const payload = await getReservationMachines(reservation.id, context);
@@ -3001,7 +6241,7 @@ async function fetchTenantMachines(context) {
 
 async function fetchMachine(nodeId, context) {
   return await cliRequest({
-    endpoint: computeEndpoint(`/standalone-vms/${nodeId}`),
+    endpoint: computeEndpoint(`/nodes/${nodeId}`),
     env: context.env,
     fetchImpl: context.fetchImpl,
   });
@@ -3067,7 +6307,7 @@ async function fetchMetricHistoryForNode(nodeId, options, context) {
   });
   const series = await cliRequest({
     endpoint: computeEndpoint(
-      `/standalone-vms/reservations/${encodeURIComponent(machine.reservation_id)}/telemetry-history${query}`,
+      `/nodes/reservations/${encodeURIComponent(machine.reservation_id)}/telemetry-history${query}`,
     ),
     env: context.env,
     fetchImpl: context.fetchImpl,
@@ -3086,7 +6326,7 @@ async function fetchMetricSnapshotForMachine(machine, context) {
   }
   const payload = await cliRequest({
     endpoint: computeEndpoint(
-      `/standalone-vms/reservations/${encodeURIComponent(reservationId)}/live-metrics?machine_id=${encodeURIComponent(machineId(machine))}`,
+      `/nodes/reservations/${encodeURIComponent(reservationId)}/live-metrics?machine_id=${encodeURIComponent(machineId(machine))}`,
     ),
     env: context.env,
     fetchImpl: context.fetchImpl,
@@ -3157,10 +6397,13 @@ async function resolveSshTarget(identifier, context) {
 }
 
 async function runNodeAction(nodeId, action, options, context) {
-  const body = action === "revoke" ? { request_id: options.requestId || null } : undefined;
+  // Both node actions hit the shared reboot endpoint: a plain `reboot` cycles
+  // the OS (keeps storage + keys), while `hard-reset` cleans the host first
+  // (wipe storage/users/RAM) then reboots and re-pushes keys on reconnect.
+  const mode = action === "hard-reset" ? "hard_reset" : "reboot";
   return await cliRequest({
-    body,
-    endpoint: computeEndpoint(`/standalone-vms/${nodeId}/${action}`),
+    body: { mode },
+    endpoint: computeEndpoint(`/nodes/${nodeId}/reboot`),
     env: context.env,
     fetchImpl: context.fetchImpl,
     method: "POST",
@@ -3173,7 +6416,7 @@ async function pushNodeKeys(nodeId, sshKeyIds, requestId, context) {
       request_id: requestId || `cli-node-push-keys:${nodeId}:${Date.now()}`,
       ssh_key_ids: sshKeyIds,
     },
-    endpoint: computeEndpoint(`/standalone-vms/${nodeId}/push-keys`),
+    endpoint: computeEndpoint(`/nodes/${nodeId}/push-keys`),
     env: context.env,
     fetchImpl: context.fetchImpl,
     method: "POST",
@@ -3282,7 +6525,7 @@ async function ensureAccountSshKey(publicKey, label, context) {
       label: label || null,
       public_key: normalized,
     },
-    endpoint: computeEndpoint("/standalone-vms/tenants/me/ssh-keys"),
+    endpoint: computeEndpoint("/nodes/tenants/me/ssh-keys"),
     env: context.env,
     fetchImpl: context.fetchImpl,
     method: "POST",
@@ -3291,7 +6534,7 @@ async function ensureAccountSshKey(publicKey, label, context) {
 
 async function fetchAccountSshKeys(context) {
   return await cliRequest({
-    endpoint: computeEndpoint("/standalone-vms/tenants/me/ssh-keys"),
+    endpoint: computeEndpoint("/nodes/tenants/me/ssh-keys"),
     env: context.env,
     fetchImpl: context.fetchImpl,
   });
@@ -3345,7 +6588,7 @@ async function pushReservationKeys(reservationId, sshKeyIds, requestId, context)
         request_id: requestId || `cli-push-keys:${id}:${Date.now()}`,
         ssh_key_ids: sshKeyIds,
       },
-      endpoint: computeEndpoint(`/standalone-vms/${id}/push-keys`),
+      endpoint: computeEndpoint(`/nodes/${id}/push-keys`),
       env: context.env,
       fetchImpl: context.fetchImpl,
       method: "POST",
@@ -3611,6 +6854,83 @@ function writeReservationNetwork(stdout, payload = {}) {
   writeOptionalStatusLine(stdout, "Status", payload.network.status);
 }
 
+function writeReservationStorageAttachment(stdout, attachment = {}) {
+  if (!attachment) {
+    stdout.write("No reservation storage attachment.\n");
+    return;
+  }
+  stdout.write(`${attachment.id || "storage-attachment"}\n`);
+  writeOptionalStatusLine(stdout, "Reservation", attachment.reservation_id);
+  writeOptionalStatusLine(stdout, "Drive", attachment.drive_id);
+  writeOptionalStatusLine(stdout, "State", attachment.state);
+  writeOptionalStatusLine(stdout, "Target region", attachment.target_region);
+  writeOptionalStatusLine(stdout, "Mount path", attachment.mount_path);
+  writeOptionalStatusLine(stdout, "Mount mode", attachment.mount_mode);
+  writeOptionalStatusLine(stdout, "Access", attachment.access_mode);
+  if (attachment.placement) {
+    const placement = attachment.placement;
+    stdout.write("Placement:\n");
+    writeOptionalStatusLine(stdout, "State", placement.state);
+    writeOptionalStatusLine(
+      stdout,
+      "Target",
+      placement.target_storage_uri ||
+        placement.storage_uri ||
+        storageObjectUri("gs", placement.bucket, placement.prefix),
+    );
+    writeOptionalStatusLine(stdout, "Transfer", placement.transfer_status);
+    writeOptionalStatusLine(stdout, "Progress", formatStorageTransferProgress(placement.transfer_progress));
+    if (
+      typeof placement.transfer_object_count === "number" ||
+      typeof placement.transfer_bytes === "number"
+    ) {
+      const objectCount = placement.transfer_object_count;
+      const bytes = placement.transfer_bytes;
+      const objectLabel =
+        typeof objectCount === "number"
+          ? `${objectCount} ${objectCount === 1 ? "object" : "objects"}`
+          : null;
+      const bytesLabel = typeof bytes === "number" ? formatBytes(bytes) : null;
+      writeOptionalStatusLine(
+        stdout,
+        "Copied",
+        [objectLabel, bytesLabel].filter(Boolean).join(", "),
+      );
+    }
+    writeOptionalStatusLine(stdout, "Source provider", placement.source_provider);
+    writeOptionalStatusLine(stdout, "Source bucket", placement.source_bucket);
+    writeOptionalStatusLine(stdout, "Source prefix", placement.source_prefix);
+  }
+  const nfsBackend = attachment.drive?.nfs_backend || attachment.drive?.accelerators?.nfs;
+  if (nfsBackend) {
+    stdout.write("Filesystem:\n");
+    writeOptionalStatusLine(stdout, "State", nfsBackend.state);
+    writeOptionalStatusLine(stdout, "Region", nfsBackend.region);
+    writeOptionalStatusLine(stdout, "Tier", nfsBackend.performance_tier);
+    writeOptionalStatusLine(stdout, "Capacity", nfsBackend.capacity_gib ? `${nfsBackend.capacity_gib} GiB` : null);
+    writeOptionalStatusLine(stdout, "Mount ready", nfsBackend.mount_ready ? "yes" : "no");
+  }
+}
+
+function formatStorageTransferProgress(progress) {
+  if (!progress) return null;
+  const parts = [];
+  if (typeof progress.completed_objects === "number" || typeof progress.total_objects === "number") {
+    const completed = typeof progress.completed_objects === "number" ? progress.completed_objects : 0;
+    const total = typeof progress.total_objects === "number" ? progress.total_objects : null;
+    parts.push(total ? `${completed}/${total} objects` : `${completed} objects`);
+  }
+  if (typeof progress.completed_bytes === "number" || typeof progress.total_bytes === "number") {
+    const completed = typeof progress.completed_bytes === "number" ? progress.completed_bytes : 0;
+    const total = typeof progress.total_bytes === "number" ? progress.total_bytes : null;
+    parts.push(total ? `${formatBytes(completed)}/${formatBytes(total)}` : formatBytes(completed));
+  }
+  if (typeof progress.percent === "number") {
+    parts.push(`${progress.percent}%`);
+  }
+  return parts.length ? parts.join(", ") : progress.label || progress.phase || null;
+}
+
 function writeStorageDriveList(stdout, drives) {
   if (!drives.length) {
     stdout.write("No storage volumes found.\n");
@@ -3623,6 +6943,12 @@ function writeStorageDriveList(stdout, drives) {
     if (drive.source_drive_id) {
       stdout.write(` source=${drive.source_drive_id}`);
     }
+    if (drive.source?.provider && drive.source.provider !== "ornn_object") {
+      stdout.write(` source=${drive.source.provider}`);
+      if (drive.source.bucket) {
+        stdout.write(` bucket=${drive.source.bucket}`);
+      }
+    }
     if (drive.active_mount) {
       stdout.write(` mounted=${drive.active_mount.reservation_id || "yes"}`);
     }
@@ -3630,12 +6956,67 @@ function writeStorageDriveList(stdout, drives) {
   }
 }
 
+function writeStorageBucketList(stdout, buckets) {
+  if (!buckets.length) {
+    stdout.write("No storage buckets found.\n");
+    return;
+  }
+  stdout.write("Storage buckets:\n");
+  for (const drive of buckets) {
+    const source = drive.source || {};
+    stdout.write(`- ${drive.id} ${drive.name || "unnamed"} ${source.provider || "unknown"}`);
+    if (source.s3_provider) {
+      stdout.write(`/${source.s3_provider}`);
+    }
+    if (source.bucket) {
+      stdout.write(` bucket=${source.bucket}`);
+    }
+    if (source.prefix) {
+      stdout.write(` prefix=${source.prefix}`);
+    }
+    if (source.connection_status) {
+      stdout.write(` status=${source.connection_status}`);
+    }
+    if (source.access_key_id_hint) {
+      stdout.write(` key=${source.access_key_id_hint}`);
+    }
+    if (source.provider && source.provider !== "ornn_object") {
+      stdout.write(` access=${source.read_only === false ? "read-write" : "read-only"}`);
+    }
+    stdout.write("\n");
+  }
+}
+
 function writeStorageDriveDetail(stdout, drive = {}) {
   stdout.write(`${drive.id || "drive"}\n`);
   stdout.write(`Name: ${drive.name || "unnamed"}\n`);
   stdout.write(`Status: ${drive.status || "unknown"}\n`);
   stdout.write(`Size: ${formatBytes(drive.size_bytes)}\n`);
   writeOptionalStatusLine(stdout, "Source", drive.source_drive_id);
+  if (drive.source) {
+    writeOptionalStatusLine(stdout, "Source provider", drive.source.provider);
+    writeOptionalStatusLine(stdout, "Bucket", drive.source.bucket);
+    writeOptionalStatusLine(stdout, "Prefix", drive.source.prefix);
+    writeOptionalStatusLine(stdout, "Region", drive.source.region);
+    writeOptionalStatusLine(stdout, "S3 provider", drive.source.s3_provider);
+    writeOptionalStatusLine(stdout, "Endpoint", drive.source.endpoint_url);
+    if (drive.source.credentials_configured) {
+      stdout.write(`Credentials: configured${drive.source.access_key_id_hint ? ` (${drive.source.access_key_id_hint})` : ""}\n`);
+    }
+    writeOptionalStatusLine(stdout, "Connection", drive.source.connection_status);
+    writeOptionalStatusLine(stdout, "Verified", drive.source.last_verified_at);
+    if (drive.source.verification_error) {
+      const error = drive.source.verification_error;
+      stdout.write(`Verification error: ${error.code || "failed"}`);
+      if (error.message) {
+        stdout.write(` - ${error.message}`);
+      }
+      stdout.write("\n");
+    }
+    if (drive.source.provider && drive.source.provider !== "ornn_object") {
+      stdout.write(`Access: ${drive.source.read_only === false ? "read-write" : "read-only"}\n`);
+    }
+  }
   writeOptionalStatusLine(stdout, "File tree", drive.file_tree_status);
   if (drive.file_tree_truncated) {
     stdout.write("    File tree: truncated\n");
@@ -3652,6 +7033,20 @@ function writeStorageDriveDetail(stdout, drive = {}) {
   writeOptionalStatusLine(stdout, "Updated", drive.updated_at);
 }
 
+function writeStorageImportCommands(stdout, commands = []) {
+  if (!commands.length) {
+    return;
+  }
+  stdout.write("\nRun these commands to import data into Ornn object storage:\n");
+  for (const item of commands) {
+    stdout.write(`\n# ${item.label}\n`);
+    if (item.note) {
+      stdout.write(`# ${item.note}\n`);
+    }
+    stdout.write(`${item.command}\n`);
+  }
+}
+
 function writeBillingSummary(stdout, summary = {}) {
   stdout.write("Billing summary:\n");
   stdout.write(`Open balance: ${formatCents(summary.open_balance_cents)}\n`);
@@ -3745,6 +7140,168 @@ function storageDrivesFromPayload(payload) {
   return Array.isArray(payload) ? payload : Array.isArray(payload?.drives) ? payload.drives : [];
 }
 
+function storageBucketsFromPayload(payload) {
+  return storageDrivesFromPayload(payload).filter(isStorageBucketDrive);
+}
+
+function isStorageBucketDrive(drive = {}) {
+  const source = drive.source || {};
+  return (
+    source.kind === "object" ||
+    ["ornn_object", "external_gcs", "s3"].includes(String(source.provider || ""))
+  );
+}
+
+function storageBucketLocationFromInput(value) {
+  const withoutScheme = String(value || "")
+    .trim()
+    .replace(/^(gs|s3|r2):\/\//i, "")
+    .replace(/^\/+|\/+$/g, "");
+  const [bucket, ...prefixParts] = withoutScheme.split("/");
+  return {
+    bucket,
+    prefix: prefixParts.join("/") || null,
+  };
+}
+
+function storageBucketSourceFromOptions(provider, options = {}) {
+  const rawBucket = optionalStringOption(options.bucket);
+  const rawUrl = optionalStringOption(options.url);
+  const parsed = rawUrl ? storageBucketSourceFromConsoleUrl(provider, rawUrl) : {};
+  const location = rawBucket ? storageBucketLocationFromInput(rawBucket) : parsed;
+  if (!location.bucket) {
+    throw new Error("--bucket or --url is required.");
+  }
+  return {
+    accountId: parsed.accountId || null,
+    bucket: location.bucket,
+    prefix: location.prefix || null,
+    region: parsed.region || null,
+  };
+}
+
+function storageBucketSourceFromConsoleUrl(provider, rawUrl) {
+  let url;
+  try {
+    url = new URL(String(rawUrl || "").trim());
+  } catch {
+    throw new Error("--url must be a valid console URL.");
+  }
+  const hostname = url.hostname.toLowerCase();
+  const pathParts = url.pathname.split("/").filter(Boolean).map(decodeURIComponent);
+  if (provider === "s3") {
+    const bucketIndex = pathParts.findIndex((part, index) => part === "buckets" && pathParts[index - 1] === "s3");
+    const bucket = bucketIndex >= 0 ? storageConsolePathValue(pathParts[bucketIndex + 1]) : null;
+    const rawRegionFromHost = hostname.endsWith(".console.aws.amazon.com")
+      ? hostname.slice(0, -".console.aws.amazon.com".length)
+      : null;
+    const regionFromHost = rawRegionFromHost && rawRegionFromHost !== "s3" ? rawRegionFromHost : null;
+    const region = url.searchParams.get("region") || regionFromHost;
+    const prefix = url.searchParams.get("prefix");
+    if (!bucket) {
+      throw new Error("AWS S3 console URL must include /s3/buckets/<bucket>.");
+    }
+    return { bucket, prefix: normalizeStoragePrefix(prefix), region };
+  }
+  if (provider === "r2") {
+    const accountId = hostname === "dash.cloudflare.com" ? pathParts[0] : null;
+    const bucketIndex = pathParts.findIndex((part) => part === "buckets");
+    const bucket = bucketIndex >= 0 ? storageConsolePathValue(pathParts[bucketIndex + 1]) : null;
+    if (!accountId || !bucket) {
+      throw new Error("Cloudflare R2 console URL must include /<account-id>/r2/.../buckets/<bucket>.");
+    }
+    return { accountId, bucket, prefix: null, region: "auto" };
+  }
+  if (provider === "gcs") {
+    const browserIndex = pathParts.findIndex((part) => part === "browser");
+    const bucket = browserIndex >= 0 ? storageConsolePathValue(pathParts[browserIndex + 1]) : null;
+    const prefix = url.searchParams.get("prefix");
+    if (!bucket) {
+      throw new Error("GCS console URL must include /storage/browser/<bucket>.");
+    }
+    return { bucket, prefix: normalizeStoragePrefix(prefix), region: null };
+  }
+  throw new Error("Unsupported bucket provider.");
+}
+
+function storageConsolePathValue(value) {
+  return String(value || "").split(";", 1)[0] || null;
+}
+
+function normalizeStoragePrefix(value) {
+  const normalized = String(value || "").trim().replace(/^\/+|\/+$/g, "");
+  return normalized || null;
+}
+
+function storageBucketEndpointUrl(provider, options = {}) {
+  const endpointUrl = optionalStringOption(options.endpointUrl);
+  const accountId = optionalStringOption(options.accountId);
+  if (provider !== "r2") {
+    if (endpointUrl || accountId) {
+      throw new Error("--account-id and --endpoint-url are only supported for Cloudflare R2.");
+    }
+    return null;
+  }
+  if (endpointUrl && accountId) {
+    throw new Error("Use only one of --account-id or --endpoint-url.");
+  }
+  if (endpointUrl) {
+    return endpointUrl.replace(/\/+$/, "");
+  }
+  if (!accountId) {
+    throw new Error("Cloudflare R2 requires --account-id or --endpoint-url.");
+  }
+  return `https://${accountId}.r2.cloudflarestorage.com`;
+}
+
+function storageObjectUri(scheme, bucket, prefix) {
+  const normalizedPrefix = String(prefix || "").trim().replace(/^\/+|\/+$/g, "");
+  return normalizedPrefix ? `${scheme}://${bucket}/${normalizedPrefix}` : `${scheme}://${bucket}`;
+}
+
+function storageImportTargetUri(target = {}) {
+  if (target.storage_uri) {
+    return String(target.storage_uri);
+  }
+  if (target.bucket_name && target.object_prefix) {
+    return `gs://${target.bucket_name}/${String(target.object_prefix).replace(/^\/+/, "").replace(/\/?$/, "/")}`;
+  }
+  return null;
+}
+
+function storageBucketImportCommands({ bucket, endpointUrl, prefix, provider, region, target }) {
+  const targetUri = storageImportTargetUri(target);
+  if (!targetUri) {
+    return [];
+  }
+  const sourceScheme = provider === "gcs" ? "gs" : "s3";
+  const sourceUri = storageObjectUri(sourceScheme, bucket, prefix);
+  if (provider === "gcs") {
+    return [
+      {
+        label: "Import from GCS",
+        note: "Uses your active gcloud credentials.",
+        command: `gcloud storage rsync -r ${shellQuote(sourceUri)} ${shellQuote(targetUri)}`,
+      },
+    ];
+  }
+  if (provider === "s3") {
+    return [
+      {
+        label: "Check AWS S3 source",
+        note: "Uses your AWS credentials from the AWS CLI environment or ~/.aws/credentials.",
+        command: `aws s3 ls ${shellQuote(sourceUri)}`,
+      },
+      {
+        label: "Import from AWS S3",
+        note: "Uses gcloud storage interoperability with your AWS S3 credentials.",
+        command: `gcloud storage rsync -r ${shellQuote(sourceUri)} ${shellQuote(targetUri)}`,
+      },
+    ];
+  }
+  return [];
+}
+
 function metricSnapshotFromLivePayload(fallbackMachine, payload = {}) {
   const liveMachine = payload?.machine || null;
   const machine = liveMachine
@@ -4191,18 +7748,6 @@ function activeMachines(machines) {
   });
 }
 
-function writeMutationWithOpen(stdout, resource, opened, options, label) {
-  if (options.json) {
-    writeJson(stdout, { resource, opened: opened.opened, url: opened.url });
-    return;
-  }
-  stdout.write(`${label} updated.\n`);
-  if (resource?.id) {
-    stdout.write(`ID: ${resource.id}\n`);
-  }
-  writeCheckoutOpenResult(stdout, opened, label);
-}
-
 function writeSshKeyList(stdout, keys) {
   const activeKeys = activeSshKeys(keys);
   if (!activeKeys.length) {
@@ -4547,6 +8092,15 @@ function nonNegativeIntegerOption(value, name) {
   return parsed;
 }
 
+function listPaginationOptions(options) {
+  const limit = optionProvided(options.limit) ? positiveIntegerOption(options.limit, "--limit") : 500;
+  const cursor = optionProvided(options.cursor) ? requiredOption(options.cursor, "--cursor") : undefined;
+  if (limit > 500) {
+    throw new Error("--limit must be at most 500.");
+  }
+  return { limit, cursor };
+}
+
 function dateRangeOptions(options) {
   const startDate = dateOption(options.startDate, "--start-date");
   const endDate = dateOption(options.endDate, "--end-date");
@@ -4646,6 +8200,17 @@ function writeJson(stdout, payload) {
   stdout.write(`${JSON.stringify(payload ?? { ok: true }, null, 2)}\n`);
 }
 
+// Strip fields that leak into ticket pastes / CI logs on --json dumps.
+function redactNodeSecrets(node) {
+  if (!node || typeof node !== "object") {
+    return node;
+  }
+  const redacted = { ...node };
+  delete redacted.admin_private_key;
+  delete redacted.system_variables;
+  return redacted;
+}
+
 function formatCliError(error) {
   if (error instanceof CliApiError) {
     const structuredDetail = extractStructuredErrorDetail(error.detail);
@@ -4656,6 +8221,26 @@ function formatCliError(error) {
   return error instanceof Error ? error.message : String(error);
 }
 
+function fleetResultError(error) {
+  const message = String(formatCliError(error));
+  if (message.length <= FLEET_RESULT_ERROR_MAX_LENGTH) {
+    return message;
+  }
+  const suffix = "\n[truncated]";
+  return `${message.slice(0, FLEET_RESULT_ERROR_MAX_LENGTH - suffix.length)}${suffix}`;
+}
+
+function combineFleetResultErrors(primary, secondary) {
+  const first = String(primary);
+  const second = fleetResultError(secondary);
+  const combined = `${first} ${second}`;
+  if (combined.length <= FLEET_RESULT_ERROR_MAX_LENGTH) {
+    return combined;
+  }
+  const suffix = `\n[truncated]\n${second}`;
+  return `${first.slice(0, FLEET_RESULT_ERROR_MAX_LENGTH - suffix.length)}${suffix}`;
+}
+
 function extractStructuredErrorDetail(detail) {
   const candidate = detail?.detail ?? detail?.error ?? detail;
   if (isStructuredErrorCode(candidate)) {