@ornncompute/cli 0.1.6 → 0.1.8

package/src/cli.mjs

@@ -1,10 +1,11 @@
 import { spawn } from "node:child_process";
 import { randomUUID } from "node:crypto";
-import { mkdir, mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
+import { createReadStream } from "node:fs";
+import { chmod, mkdir, mkdtemp, readFile, rm, stat, writeFile } from "node:fs/promises";
 import { createRequire } from "node:module";
 import { isIP } from "node:net";
 import { homedir, tmpdir } from "node:os";
-import { basename, join } from "node:path";
+import { basename, dirname, join } from "node:path";
 
 import {
   CliApiError,
@@ -12,6 +13,7 @@ import {
   computeEndpoint,
   operatorRequest,
   resolveInstallerBaseUrl,
+  webOperatorRequest,
 } from "./api-client.mjs";
 import {
   clearAuthSession,
@@ -71,9 +73,9 @@ Examples:
   ornn kubernetes launch <reservation-id> --wait
   ornn networks list
   ornn storage volumes list
-  ornn storage deploy <drive-id> --reservation <reservation-id>
+  ornn storage files upload <drive-id> <local-file> [--destination <path>]
+  ornn storage deploy <drive-id> --reservation <reservation-id> [--all-nodes]
   ornn storage deploy status --reservation <reservation-id>
-  ornn storage unmount --reservation <reservation-id>
   ornn storage undeploy --reservation <reservation-id>
   ornn storage filesystem deploy --reservation <reservation-id>
   ornn storage filesystem delete --reservation <reservation-id>
@@ -130,14 +132,17 @@ Usage:
   ornn tokens list [--json]
   ornn tokens create --operator <id> [--facility <id>] [--expires-in <seconds>] [--mode bare-metal|vm] [--ip <addr>] [--force] [--json]
   ornn tokens revoke <token-id> [--json]
-  ornn fleet clean <ip>... --operator <id-or-slug> --ib-island <name> --identity-file <path> --dry-run [--source-user <user>]... [--preserve-user <user>]... [--ssh-user ubuntu|admin|ornn] [--json]
-  ornn fleet clean <failed-fleet-id> --identity-file <path> --dry-run [--source-user <user>]... [--preserve-user <user>]... [--json]
-  ornn fleet clean <fleet-id> --identity-file <path> --confirm-clean <plan-hash> [--source-user <user>]... [--preserve-user <user>]... [--json]
+  ornn fleet clean <ip>... --operator <id-or-slug> --ib-island <name> --identity-file <path> --dry-run [--policy <path>] [--policy-out <path>] [--ssh-user ubuntu|admin|ornn] [--json]
+  ornn fleet clean <fleet-id> --identity-file <path> --dry-run [--policy <path>] [--policy-out <path>] [--json]
+  ornn fleet clean <fleet-id> --identity-file <path> --confirm-clean <plan-hash> [--json]
   ornn fleet enroll <fleet-id> --identity-file <path> [--confirm-takeover <ip[,ip...]>] [--json]
-  ornn fleet deploy <fleet-id> --tenant <email> --user <email-or-id> [--commerce-reservation <id>] [--network public|private] [--json]
+  ornn fleet deploy <fleet-id> --tenant <email> [--user <email-or-id>] --commerce-reservation <id> [--network public|private] [--json]
+  ornn fleet delete <fleet-id> --confirm-delete <fleet-id> [--json]
   ornn reservations withdraw <reservation-id> [--json]
   ornn reservations transfer <reservation-id> --target-tenant <id> [--target-user <id>] [--node <id>] [--strategy reject|park] [--confirm] [--json]
-  ornn reservations deploy <node-id> --target-tenant <id> [--target-user <id>] [--network public|private] [--json]
+  ornn reservations commerce list --tenant <email-or-id> [--fleet <fleet-id>] [--json]
+  ornn reservations commerce create --tenant <email> --listing <listing-id> --fleet <fleet-id> [--start-at <timestamp>] [--end-at <timestamp>] [--price-per-gpu-hour <rate>] [--json]
+  ornn reservations deploy <node-id> --target-tenant <id> --commerce-reservation <id> [--target-user <id>] [--network public|private] [--json]
   ornn ssh <node-or-reservation-id> [--print] [--identity-file <path>] [--user <name>] [--json]
   ornn metrics nodes [--json]
   ornn metrics node <node-id> [--json]
@@ -175,14 +180,14 @@ Usage:
   ornn networks attach <reservation-id> --network <network-id> [--json]
   ornn networks detach <reservation-id> [--json]
   ornn storage volumes list [--json]
+  ornn storage files upload <drive-id> <local-file> [--destination <path>] [--content-type <type>] [--json]
   ornn storage volumes show <drive-id> [--json]
   ornn storage volumes create --name <name> [--source <drive-id>] [--json]
   ornn storage volumes refresh <drive-id> [--json]
   ornn storage volumes clear <drive-id> [--json]
   ornn storage volumes delete <drive-id> [--json]
-  ornn storage deploy <drive-id> --reservation <reservation-id> [--mount-path <path>] [--read-only|--read-write] [--json]
+  ornn storage deploy <drive-id> --reservation <reservation-id> [--all-nodes] [--mount-path <path>] [--read-only|--read-write] [--json]
   ornn storage deploy status --reservation <reservation-id> [--json]
-  ornn storage unmount --reservation <reservation-id> [--json]
   ornn storage undeploy --reservation <reservation-id> [--json]
   ornn storage filesystem deploy --reservation <reservation-id> [--performance-tier <tier>] [--capacity-gib <gib>] [--json]
   ornn storage filesystem status --reservation <reservation-id> [--json]
@@ -300,7 +305,7 @@ const EXCHANGE_COMMANDS = new Set(["bid", "bids", "exchange"]);
 const GPU_COMMANDS = new Set(["gpu", "gpus", "reservations"]);
 // Operator-only verbs layered onto `ornn reservations`; distinct from the
 // tenant list|show|checkout verbs, which route through the /api/cli proxy.
-const RESERVATION_OP_SUBCOMMANDS = new Set(["withdraw", "transfer", "deploy"]);
+const RESERVATION_OP_SUBCOMMANDS = new Set(["withdraw", "transfer", "deploy", "commerce"]);
 
 export async function run(argv = [], io = {}) {
   const exitCode = await dispatch(argv, io);
@@ -400,7 +405,14 @@ async function dispatch(argv = [], io = {}) {
     }
 
     if (GPU_COMMANDS.has(command)) {
-      return await reservations(args, { commandName: command, env, fetchImpl, openBrowserImpl, stdout });
+      return await reservations(args, {
+        commandName: command,
+        env,
+        fetchImpl,
+        openBrowserImpl,
+        stderr,
+        stdout,
+      });
     }
 
     if (command === "node") {
@@ -584,6 +596,12 @@ function validateHelpInvocation(command, args) {
         "--node",
         "--strategy",
         "--network",
+        "--tenant",
+        "--fleet",
+        "--listing",
+        "--start-at",
+        "--end-at",
+        "--price-per-gpu-hour",
       ],
     });
     if (parsed.error) {
@@ -628,7 +646,12 @@ function validateHelpInvocation(command, args) {
         "--ib-island",
         "--identity-file",
         "--confirm-clean",
+        "--confirm-delete",
         "--confirm-takeover",
+        "--policy",
+        "--policy-out",
+        "--source-user",
+        "--preserve-user",
         "--ssh-user",
         "--ssh-port",
         "--parallel",
@@ -656,9 +679,14 @@ function validateHelpInvocation(command, args) {
     if (subcommand === "deploy") {
       return positionals.length === 1
         ? null
-        : "Usage: ornn fleet deploy <fleet-id> --tenant <email> --user <email-or-id> [--commerce-reservation <id>]";
+        : "Usage: ornn fleet deploy <fleet-id> --tenant <email> [--user <email-or-id>] --commerce-reservation <id>";
     }
-    return "Usage: ornn fleet clean|enroll|deploy";
+    if (subcommand === "delete") {
+      return positionals.length === 1
+        ? null
+        : "Usage: ornn fleet delete <fleet-id> --confirm-delete <fleet-id>";
+    }
+    return "Usage: ornn fleet clean|enroll|deploy|delete";
   }
 
   if (command === "nodes") {
@@ -872,8 +900,26 @@ function validateHelpInvocation(command, args) {
 
   if (command === "storage") {
     const parsed = parseHelpArgs(args, {
-      booleanOptions: ["--json", "--read-only", "--read-write", "--verify"],
-      valueOptions: ["--access-key-id", "--account-id", "--bucket", "--endpoint-url", "--mount-path", "--name", "--prefix", "--region", "--reservation", "--reservation-id", "--secret-access-key", "--secret-access-key-file", "--source", "--source-drive-id", "--url"],
+      booleanOptions: ["--all-nodes", "--json", "--read-only", "--read-write", "--verify"],
+      valueOptions: [
+        "--access-key-id",
+        "--account-id",
+        "--bucket",
+        "--content-type",
+        "--destination",
+        "--endpoint-url",
+        "--mount-path",
+        "--name",
+        "--prefix",
+        "--region",
+        "--reservation",
+        "--reservation-id",
+        "--secret-access-key",
+        "--secret-access-key-file",
+        "--source",
+        "--source-drive-id",
+        "--url",
+      ],
     });
     if (parsed.error) {
       return parsed.error;
@@ -889,12 +935,17 @@ function validateHelpInvocation(command, args) {
           : null;
       }
       return !subcommand || id || extra.length
-        ? "Usage: ornn storage deploy <drive-id> --reservation <reservation-id> [--mount-path <path>] [--read-only|--read-write] [--json]"
+        ? "Usage: ornn storage deploy <drive-id> --reservation <reservation-id> [--all-nodes] [--mount-path <path>] [--read-only|--read-write] [--json]"
         : null;
     }
-    if (resource === "unmount" || resource === "undeploy") {
+    if (resource === "undeploy") {
       return subcommand || id || extra.length
-        ? `Usage: ornn storage ${resource} --reservation <reservation-id> [--json]`
+        ? "Usage: ornn storage undeploy --reservation <reservation-id> [--json]"
+        : null;
+    }
+    if (resource === "files") {
+      return subcommand !== "upload" || !id || extra.length !== 1
+        ? "Usage: ornn storage files upload <drive-id> <local-file> [--destination <path>] [--content-type <type>] [--json]"
         : null;
     }
     if (resource === "buckets") {
@@ -923,7 +974,7 @@ function validateHelpInvocation(command, args) {
       return "Usage: ornn storage buckets list|show|connect|verify|update-credentials|disconnect";
     }
     if (!["drives", "volumes"].includes(resource)) {
-      return "Usage: ornn storage volumes list|show|create|refresh|clear|delete; ornn storage buckets connect gcs|s3|r2 --bucket <bucket>";
+      return "Usage: ornn storage volumes list|show|create|refresh|clear|delete; ornn storage files upload <drive-id> <local-file>; ornn storage buckets connect gcs|s3|r2 --bucket <bucket>";
     }
     if (!subcommand || subcommand === "list") {
       return id || extra.length ? "Usage: ornn storage volumes list [--json]" : null;
@@ -1430,11 +1481,102 @@ async function bid(args, context) {
   throw new Error(commandUsage);
 }
 
-// Operator-only reservation verbs under `ornn reservations`: withdraw a node's
-// acceptance, transfer a reservation to another tenant, or deploy a specific
-// node to a tenant. All authenticate via operatorRequest (staff session proxy
-// or optional ORNN_INTERNAL_REVIEW_SECRET).
+// Operator-only reservation verbs under `ornn reservations`. Commerce actions
+// always use the authenticated staff Web proxy because Web owns the validation
+// boundary; the remaining actions retain operatorRequest's break-glass path.
 async function reservationOp(subcommand, id, rest, context) {
+  if (subcommand === "commerce") {
+    const listUsage =
+      "Usage: ornn reservations commerce list --tenant <email-or-id> [--fleet <fleet-id>] [--json]";
+    const createUsage =
+      "Usage: ornn reservations commerce create --tenant <email> --listing <listing-id> --fleet <fleet-id> [--start-at <timestamp>] [--end-at <timestamp>] [--price-per-gpu-hour <rate>] [--json]";
+    if (id === "list") {
+      const options = parseCommandOptions(
+        rest,
+        { boolean: ["json"], value: ["tenant", "fleet"] },
+        listUsage,
+      );
+      const tenant = await resolveCommerceTenant(
+        requiredOption(options.tenant, "--tenant"),
+        context,
+      );
+      const fleetId = optionalStringOption(options.fleet);
+      if (fleetId && !isUuid(fleetId)) {
+        throw new Error("--fleet must be a fleet UUID.");
+      }
+      const result = await webOperatorRequest({
+        endpoint: `/internal/commerce-reservations/deployable${buildQuery({ tenant_id: tenant.id, fleet_id: fleetId })}`,
+        env: context.env,
+        fetchImpl: context.fetchImpl,
+      });
+      if (options.json) {
+        writeJson(context.stdout, result);
+      } else {
+        writeDeployableCommerceReservations(context.stdout, result);
+      }
+      return 0;
+    }
+    if (id === "create") {
+      const options = parseCommandOptions(
+        rest,
+        {
+          boolean: ["json"],
+          value: ["tenant", "listing", "fleet", "start-at", "end-at", "price-per-gpu-hour"],
+        },
+        createUsage,
+      );
+      const tenant = await resolveFleetTenant(
+        requiredOption(options.tenant, "--tenant"),
+        context,
+        webOperatorRequest,
+      );
+      const listingId = requiredOption(options.listing, "--listing");
+      const fleetId = requiredOption(options.fleet, "--fleet");
+      if (!isUuid(listingId)) {
+        throw new Error("--listing must be a Commerce listing UUID.");
+      }
+      if (!isUuid(fleetId)) {
+        throw new Error("--fleet must be a fleet UUID.");
+      }
+      const body = { tenant_id: tenant.id, listing_id: listingId, fleet_id: fleetId };
+      for (const [optionName, bodyName, label] of [
+        ["startAt", "start_at", "--start-at"],
+        ["endAt", "end_at", "--end-at"],
+      ]) {
+        if (!optionProvided(options[optionName])) continue;
+        const raw = optionalStringOption(options[optionName]);
+        const timestamp = Date.parse(raw);
+        if (!Number.isFinite(timestamp)) {
+          throw new Error(`${label} must be an ISO timestamp.`);
+        }
+        body[bodyName] = new Date(timestamp).toISOString();
+      }
+      if (optionProvided(options.pricePerGpuHour)) {
+        const price = optionalStringOption(options.pricePerGpuHour);
+        if (!/^\d+(\.\d{1,6})?$/.test(price)) {
+          throw new Error(
+            "--price-per-gpu-hour must be zero or a positive decimal with at most 6 decimal places.",
+          );
+        }
+        body.price_per_gpu_hr = price;
+      }
+      const result = await webOperatorRequest({
+        body,
+        endpoint: "/internal/commerce-reservations",
+        env: context.env,
+        fetchImpl: context.fetchImpl,
+        method: "POST",
+      });
+      if (options.json) {
+        writeJson(context.stdout, result);
+      } else {
+        writeCreatedCommerceReservation(context.stdout, result, tenant.email || tenant.id);
+      }
+      return 0;
+    }
+    throw new Error(`${listUsage}\n${createUsage}`);
+  }
+
   if (subcommand === "withdraw") {
     const usage = "Usage: ornn reservations withdraw <reservation-id> [--json]";
     if (!id) {
@@ -1508,35 +1650,50 @@ async function reservationOp(subcommand, id, rest, context) {
 
   if (subcommand === "deploy") {
     const usage =
-      "Usage: ornn reservations deploy <node-id> --target-tenant <id> [--target-user <id>] [--network public|private] [--json]";
+      "Usage: ornn reservations deploy <node-id> --target-tenant <id> --commerce-reservation <id> [--target-user <id>] [--network public|private] [--json]";
     if (!id) {
       throw new Error(usage);
     }
     const options = parseCommandOptions(
       rest,
-      { boolean: ["json"], value: ["target-tenant", "target-user", "network"] },
+      {
+        boolean: ["json"],
+        value: ["commerce-reservation", "target-tenant", "target-user", "network"],
+      },
       usage,
     );
     const targetTenant = optionalStringOption(options.targetTenant);
     if (!targetTenant) {
       throw new Error(usage);
     }
+    const commerceReservationId = requiredOption(
+      options.commerceReservation,
+      "--commerce-reservation",
+    );
+    if (!isUuid(commerceReservationId)) {
+      throw new Error("--commerce-reservation must be a UUID returned by Commerce.");
+    }
     const network = optionalStringOption(options.network) || "public";
     if (network !== "public" && network !== "private") {
       throw new Error(usage);
     }
-    const body = { target_tenant_id: targetTenant, network_mode: network };
+    const body = {
+      target_tenant_id: targetTenant,
+      network_mode: network,
+      commerce_reservation_id: commerceReservationId,
+    };
     const targetUser = optionalStringOption(options.targetUser);
     if (targetUser) {
       body.target_auth_user_id = targetUser;
     }
-    const result = await operatorRequest({
+    const result = await webOperatorRequest({
       body,
       endpoint: `/internal/nodes/${encodeURIComponent(id)}/deploy`,
       env: context.env,
       fetchImpl: context.fetchImpl,
       method: "POST",
     });
+    warnIfCommerceDeployStampMissed(result, context);
     if (options.json) {
       writeJson(context.stdout, result);
     } else {
@@ -2205,6 +2362,55 @@ function fleetAccountOptions(value, optionName) {
   return [...new Set(normalized)].sort();
 }
 
+async function readFleetCleanupPolicy(pathValue) {
+  if (!optionProvided(pathValue)) return null;
+  const path = expandUserPath(optionalStringOption(pathValue));
+  let policy;
+  try {
+    policy = JSON.parse(await readFile(path, "utf8"));
+  } catch (error) {
+    throw new Error(`Could not read cleanup policy ${path}: ${fleetResultError(error)}`);
+  }
+  if (!policy || typeof policy !== "object" || Array.isArray(policy)) {
+    throw new Error("Cleanup policy must be a JSON object.");
+  }
+  if (policy.schema_version !== 1) {
+    throw new Error("Cleanup policy schema_version must be 1.");
+  }
+  const direct =
+    policy.resources && typeof policy.resources === "object" && !Array.isArray(policy.resources);
+  const perNode = policy.nodes && typeof policy.nodes === "object" && !Array.isArray(policy.nodes);
+  if (Boolean(direct) === Boolean(perNode)) {
+    throw new Error("Cleanup policy must contain exactly one of resources or nodes.");
+  }
+  return { path, policy };
+}
+
+function cleanupPolicyForNode(loaded, node, nodeCount) {
+  if (!loaded) return null;
+  if (loaded.policy.resources) {
+    if (nodeCount !== 1) {
+      throw new Error(
+        "A direct resources policy can only be used for one node; use nodes keyed by IP for a fleet.",
+      );
+    }
+    return loaded.policy;
+  }
+  const policy = loaded.policy.nodes[node.ip_address] || loaded.policy.nodes[node.id];
+  if (!policy) {
+    throw new Error(`Cleanup policy has no entry for ${node.ip_address}.`);
+  }
+  if (
+    policy.schema_version !== 1 ||
+    !policy.resources ||
+    typeof policy.resources !== "object" ||
+    Array.isArray(policy.resources)
+  ) {
+    throw new Error(`Cleanup policy entry for ${node.ip_address} is invalid.`);
+  }
+  return policy;
+}
+
 async function fleet(args, context) {
   const [subcommand, ...rest] = args;
   if (subcommand === "clean") {
@@ -2216,12 +2422,75 @@ async function fleet(args, context) {
   if (subcommand === "deploy") {
     return await fleetDeploy(rest, context);
   }
-  throw new Error("Usage: ornn fleet clean|enroll|deploy");
+  if (subcommand === "delete") {
+    return await fleetDelete(rest, context);
+  }
+  throw new Error("Usage: ornn fleet clean|enroll|deploy|delete");
+}
+
+async function fleetDelete(args, context) {
+  const usage = "Usage: ornn fleet delete <fleet-id> --confirm-delete <fleet-id> [--json]";
+  const { options, positionals } = parseOptions(args, {
+    boolean: ["json"],
+    value: ["confirm-delete"],
+  });
+  if (positionals.length !== 1) {
+    throw new Error(usage);
+  }
+  const fleetId = positionals[0];
+  if (!isUuid(fleetId)) {
+    throw new Error("<fleet-id> must be a UUID.");
+  }
+  const confirmation = requiredOption(options.confirmDelete, "--confirm-delete");
+  if (confirmation !== fleetId) {
+    throw new Error("--confirm-delete must exactly match <fleet-id>.");
+  }
+
+  const preview = await operatorRequest({
+    endpoint: `/internal/fleets/${encodeURIComponent(fleetId)}`,
+    env: context.env,
+    fetchImpl: context.fetchImpl,
+  });
+  if (String(preview?.id || "") !== fleetId) {
+    throw new Error("Fleet lookup returned a different fleet id; deletion stopped.");
+  }
+  const manifestPath = await saveFleetManifest(
+    {
+      ...preview,
+      deletion: { requested_at: new Date().toISOString(), status: "requested" },
+    },
+    context.env,
+  );
+  const result = await operatorRequest({
+    body: { confirm_fleet_id: confirmation },
+    endpoint: `/internal/fleets/${encodeURIComponent(fleetId)}`,
+    env: context.env,
+    fetchImpl: context.fetchImpl,
+    method: "DELETE",
+  });
+  const archived = {
+    ...(result?.fleet || preview),
+    deletion: {
+      deleted_at: result?.deleted_at || new Date().toISOString(),
+      status: "deleted",
+    },
+  };
+  await saveFleetManifest(archived, context.env);
+  if (options.json) {
+    writeJson(context.stdout, { ...result, audit_manifest: manifestPath });
+  } else {
+    context.stdout.write(`Deleted fleet ${fleetId}.\n`);
+    context.stdout.write(
+      `Released members: ${Array.isArray(archived.nodes) ? archived.nodes.length : 0}\n`,
+    );
+    context.stdout.write(`Audit manifest: ${manifestPath}\n`);
+  }
+  return 0;
 }
 
 async function fleetClean(args, context) {
   const usage =
-    "Usage: ornn fleet clean <ip>... --operator <id-or-slug> --ib-island <name> --identity-file <path> --dry-run [--source-user <user>]... [--preserve-user <user>]... [--ssh-user ubuntu|admin|ornn] OR ornn fleet clean <failed-fleet-id> --identity-file <path> --dry-run [--source-user <user>]... [--preserve-user <user>]... OR ornn fleet clean <fleet-id> --identity-file <path> --confirm-clean <plan-hash> [--source-user <user>]... [--preserve-user <user>]...";
+    "Usage: ornn fleet clean <ip>... --operator <id-or-slug> --ib-island <name> --identity-file <path> --dry-run [--policy <path>] [--policy-out <path>] [--ssh-user ubuntu|admin|ornn] OR ornn fleet clean <fleet-id> --identity-file <path> --dry-run [--policy <path>] [--policy-out <path>] OR ornn fleet clean <fleet-id> --identity-file <path> --confirm-clean <plan-hash>";
   const { options, positionals } = parseOptions(args, {
     boolean: ["dry-run", "json"],
     value: [
@@ -2229,6 +2498,8 @@ async function fleetClean(args, context) {
       "ib-island",
       "identity-file",
       "confirm-clean",
+      "policy",
+      "policy-out",
       "source-user",
       "preserve-user",
       "ssh-user",
@@ -2256,30 +2527,57 @@ async function fleetClean(args, context) {
     : FLEET_DEFAULT_TIMEOUT_SECONDS;
   const sourceUsers = fleetAccountOptions(options.sourceUser, "--source-user");
   const preserveUsers = fleetAccountOptions(options.preserveUser, "--preserve-user");
+  const loadedPolicy = await readFleetCleanupPolicy(options.policy);
+  const policyOut = optionProvided(options.policyOut)
+    ? expandUserPath(optionalStringOption(options.policyOut))
+    : null;
   const accountOverlap = sourceUsers.filter((user) => preserveUsers.includes(user));
   if (accountOverlap.length) {
     throw new Error(`Users cannot be both source and preserved: ${accountOverlap.join(", ")}.`);
   }
+  if (loadedPolicy && (sourceUsers.length || preserveUsers.length)) {
+    throw new Error("Use either --policy or the legacy user shortcuts, not both.");
+  }
   const confirmHash = optionalStringOption(options.confirmClean);
   if (confirmHash) {
-    if (positionals.length !== 1 || options.dryRun || options.operator || options.ibIsland) {
+    if (
+      positionals.length !== 1 ||
+      options.dryRun ||
+      options.operator ||
+      options.ibIsland ||
+      loadedPolicy ||
+      policyOut ||
+      sourceUsers.length ||
+      preserveUsers.length
+    ) {
       throw new Error(usage);
     }
     if (!/^[0-9a-f]{64}$/.test(confirmHash)) {
       throw new Error("--confirm-clean must be the exact 64-character cleanup plan hash.");
     }
     const fleetId = positionals[0];
-    const approved = await operatorRequest({
-      body: {
-        plan_hash: confirmHash,
-        source_users: sourceUsers,
-        preserve_users: preserveUsers,
-      },
-      endpoint: `/internal/fleets/${encodeURIComponent(fleetId)}/cleanup/approve`,
-      env: context.env,
-      fetchImpl: context.fetchImpl,
-      method: "POST",
-    });
+    let approved;
+    try {
+      approved = await operatorRequest({
+        body: {
+          plan_hash: confirmHash,
+        },
+        endpoint: `/internal/fleets/${encodeURIComponent(fleetId)}/cleanup/approve`,
+        env: context.env,
+        fetchImpl: context.fetchImpl,
+        method: "POST",
+      });
+    } catch (error) {
+      if (
+        error instanceof CliApiError &&
+        error.detail?.detail === "cleanup_plan_replan_required"
+      ) {
+        throw new Error(
+          `Fleet ${fleetId} has a legacy cleanup plan that the current runner cannot safely execute. Re-run the same fleet with --dry-run, review the generated resource policy, then approve the new plan hash.`,
+        );
+      }
+      throw error;
+    }
     context.stderr.write(`Cleaning ${approved.nodes.length} node(s)...\n`);
     const results = await mapLimit(approved.nodes, parallel, async (node) => {
       let cleanupResult;
@@ -2306,7 +2604,7 @@ async function fleetClean(args, context) {
         });
         const encodedPlan = Buffer.from(JSON.stringify(node.plan), "utf8").toString("base64");
         let result;
-        let duringCanaryChecks = 0;
+        let duringCanary = { failedChecks: 0, successfulChecks: 0 };
         try {
           result = await runFleetSshCapture({
             context,
@@ -2319,7 +2617,10 @@ async function fleetClean(args, context) {
             user: node.ssh_user,
           });
         } finally {
-          duringCanaryChecks = await stopCanary();
+          duringCanary = await stopCanary();
+        }
+        if (result.exitCode === 124) {
+          throw new Error(`cleanup_execution_deferred: ${result.stderr}`);
         }
         const payload = fleetCleanupJson(result.stdout);
         if (result.exitCode !== 0 || !payload.evidence) {
@@ -2339,7 +2640,8 @@ async function fleetClean(args, context) {
         }
         payload.evidence.management_ssh_canary = {
           before: true,
-          during_checks: duringCanaryChecks,
+          during_checks: duringCanary.successfulChecks,
+          during_failures: duringCanary.failedChecks,
           after: true,
         };
         cleanupResult = {
@@ -2352,7 +2654,11 @@ async function fleetClean(args, context) {
         cleanupResult = {
           cleanup_run_id: node.cleanup_run_id,
           succeeded: false,
-          ...(message.includes("cleanup_already_running") ? { deferred: true } : {}),
+          ...(/cleanup_already_running|cleanup_execution_deferred|SSH command timed out/i.test(
+            message,
+          )
+            ? { deferred: true }
+            : {}),
           error: message,
         };
       }
@@ -2397,12 +2703,16 @@ async function fleetClean(args, context) {
       env: context.env,
       fetchImpl: context.fetchImpl,
     });
-    if (fleetRecord.status !== "failed") {
-      throw new Error("Only a failed fleet can be replanned; resume an approved cleanup with --confirm-clean.");
+    if (!["failed", "cleaning"].includes(fleetRecord.status)) {
+      throw new Error("Only a failed or still-planning fleet can be replanned.");
     }
-    planningNodes = fleetRecord.nodes.filter((node) => node.status === "failed");
+    planningNodes = fleetRecord.nodes.filter((node) =>
+      fleetRecord.status === "failed"
+        ? node.status === "failed"
+        : ["pending_clean", "clean_planned"].includes(node.status),
+    );
     if (!planningNodes.length) {
-      throw new Error("This fleet has no failed cleanup members to replan.");
+      throw new Error("This fleet has no cleanup members eligible for replanning.");
     }
   } else {
     const ips = uniqueFleetIps(positionals);
@@ -2443,12 +2753,16 @@ async function fleetClean(args, context) {
           ...sourceUsers.map((user) => `--source-user ${shellQuote(user)}`),
           ...preserveUsers.map((user) => `--preserve-user ${shellQuote(user)}`),
         ].join(" ");
+        const nodePolicy = cleanupPolicyForNode(loadedPolicy, node, planningNodes.length);
+        const policyArgument = nodePolicy
+          ? ` --policy-b64 ${shellQuote(Buffer.from(JSON.stringify(nodePolicy), "utf8").toString("base64"))}`
+          : "";
         const result = await runFleetSshCapture({
           context,
           identityFile,
           ip: node.ip_address,
           port: sshPort,
-          remoteCommand: `sudo -n python3 - plan --management-ip ${node.ip_address} --management-user ${sshUser} --management-public-key-b64 ${managementPublicKeyB64}${accountArguments ? ` ${accountArguments}` : ""}`,
+          remoteCommand: `sudo -n python3 - plan --management-ip ${node.ip_address} --management-user ${sshUser} --management-public-key-b64 ${managementPublicKeyB64}${accountArguments ? ` ${accountArguments}` : ""}${policyArgument}`,
           stdin: runner.script,
           timeoutSeconds,
           user: sshUser,
@@ -2458,6 +2772,9 @@ async function fleetClean(args, context) {
           throw new Error(payload.error || result.stderr || "Cleanup plan failed.");
         }
         return {
+          ip: node.ip_address,
+          observations: payload.observations || {},
+          policyTemplate: payload.policy_template,
           plan: {
             fleet_node_id: node.id,
             ssh_user: sshUser,
@@ -2476,6 +2793,23 @@ async function fleetClean(args, context) {
       );
     }
     const plans = planned.map((result) => result.plan);
+    const policyTemplate = {
+      schema_version: 1,
+      nodes: { ...(loadedPolicy?.policy?.nodes || {}) },
+    };
+    const observations = {};
+    for (const result of [...planned].sort((left, right) => left.ip.localeCompare(right.ip))) {
+      policyTemplate.nodes[result.ip] = result.policyTemplate;
+      observations[result.ip] = result.observations;
+    }
+    const savedPolicyPath =
+      policyOut || join(getFleetConfigDir(context.env), `${fleetRecord.id}.cleanup-policy.json`);
+    await mkdir(dirname(savedPolicyPath), { recursive: true, mode: 0o700 });
+    await writeFile(savedPolicyPath, `${JSON.stringify(policyTemplate, null, 2)}\n`, {
+      encoding: "utf8",
+      mode: 0o600,
+    });
+    await chmod(savedPolicyPath, 0o600);
     recorded = await operatorRequest({
       body: { nodes: plans },
       endpoint: `/internal/fleets/${encodeURIComponent(fleetRecord.id)}/cleanup/plans`,
@@ -2483,10 +2817,13 @@ async function fleetClean(args, context) {
       fetchImpl: context.fetchImpl,
       method: "POST",
     });
+    recorded.policy_template = policyTemplate;
+    recorded.observations = observations;
+    recorded.policy_file = savedPolicyPath;
   } catch (error) {
     const planningError = fleetResultError(error);
     if (!createdFleet) {
-      throw new Error(`${planningError} Fleet ${fleetRecord.id} remains failed and can be replanned.`);
+      throw new Error(`${planningError} Fleet ${fleetRecord.id} can be replanned after correction.`);
     }
     let failedFleet;
     try {
@@ -2527,9 +2864,24 @@ async function fleetClean(args, context) {
       }
     }
     context.stdout.write(`Cleanup plan: ${recorded.plan_hash}\n`);
-    context.stdout.write(
-      `Approve exactly this plan with: ornn fleet clean ${fleetRecord.id} --identity-file ${shellQuote(identityFile)} --confirm-clean ${recorded.plan_hash}${sourceUsers.map((user) => ` --source-user ${shellQuote(user)}`).join("")}${preserveUsers.map((user) => ` --preserve-user ${shellQuote(user)}`).join("")}\n`
+    context.stdout.write(`Policy template: ${recorded.policy_file}\n`);
+    const unresolved = recorded.fleet.nodes.reduce(
+      (count, node) => count + (node.cleanup?.plan?.unresolved?.length || 0),
+      0,
+    );
+    const conflicts = recorded.fleet.nodes.reduce(
+      (count, node) => count + (node.cleanup?.plan?.conflicts?.length || 0),
+      0,
     );
+    if (unresolved || conflicts) {
+      context.stdout.write(
+        `Decisions required: ${unresolved}; policy conflicts: ${conflicts}. Edit the policy template and re-run the dry-run for fleet ${fleetRecord.id}.\n`,
+      );
+    } else {
+      context.stdout.write(
+        `Approve exactly this plan with: ornn fleet clean ${fleetRecord.id} --identity-file ${shellQuote(identityFile)} --confirm-clean ${recorded.plan_hash}\n`,
+      );
+    }
   }
   return 0;
 }
@@ -2716,19 +3068,22 @@ async function fleetEnroll(args, context) {
 
 async function fleetDeploy(args, context) {
   const usage =
-    "Usage: ornn fleet deploy <fleet-id> --tenant <email> --user <email-or-id> [--commerce-reservation <id>] [--network public|private] [--parallel <n>] [--timeout <seconds>] [--json]";
+    "Usage: ornn fleet deploy <fleet-id> --tenant <email> [--user <email-or-id>] --commerce-reservation <id> [--network public|private] [--parallel <n>] [--timeout <seconds>] [--json]";
   const { options, positionals } = parseOptions(args, {
     boolean: ["json"],
     value: ["commerce-reservation", "tenant", "user", "network", "parallel", "timeout"],
   });
   if (positionals.length !== 1) throw new Error(usage);
   const fleetId = positionals[0];
-  const commerceReservationId = optionalStringOption(options.commerceReservation);
-  if (commerceReservationId && !isUuid(commerceReservationId)) {
+  const commerceReservationId = requiredOption(
+    options.commerceReservation,
+    "--commerce-reservation",
+  );
+  if (!isUuid(commerceReservationId)) {
     throw new Error("--commerce-reservation must be a UUID returned by Commerce.");
   }
   const tenantInput = requiredOption(options.tenant, "--tenant");
-  const userInput = requiredOption(options.user, "--user");
+  const userInput = optionalStringOption(options.user);
   const network = optionalStringOption(options.network) || "public";
   if (!new Set(["public", "private"]).has(network)) {
     throw new Error("--network must be public or private.");
@@ -2737,22 +3092,33 @@ async function fleetDeploy(args, context) {
   const timeoutSeconds = optionProvided(options.timeout)
     ? positiveIntegerOption(options.timeout, "--timeout")
     : FLEET_DEFAULT_TIMEOUT_SECONDS;
-  const tenant = await resolveFleetTenant(tenantInput, context);
-  const targetUser = await resolveFleetUser(tenant.id, userInput, context);
-  const activeKeys = await fetchFleetTenantActiveKeys(tenant.id, context);
+  const tenant = await resolveFleetTenant(tenantInput, context, webOperatorRequest);
+  const targetUser = userInput
+    ? await resolveFleetUser(tenant.id, userInput, context, webOperatorRequest)
+    : tenant.auth_user_id
+      ? { id: tenant.auth_user_id, email: tenant.email }
+      : null;
+  if (!targetUser) {
+    throw new Error(
+      `Tenant ${tenant.email} has no primary administrator. Provide --user after fixing tenant membership.`,
+    );
+  }
+  const activeKeys = await fetchFleetTenantActiveKeys(
+    tenant.id,
+    context,
+    webOperatorRequest,
+  );
   if (!activeKeys.length) {
     throw new Error(
       `Tenant ${tenant.email} has no active SSH keys. Add a tenant SSH key before deploying this fleet.`
     );
   }
-  const fleetRecord = await operatorRequest({
+  const fleetRecord = await webOperatorRequest({
     body: {
-      tenant_id: tenant.id,
+      organization_id: tenant.id,
       target_auth_user_id: targetUser.id,
       network_mode: network,
-      ...(commerceReservationId
-        ? { commerce_reservation_id: commerceReservationId }
-        : {}),
+      commerce_reservation_id: commerceReservationId,
     },
     endpoint: `/internal/fleets/${encodeURIComponent(fleetId)}/deploy/start`,
     env: context.env,
@@ -2761,16 +3127,14 @@ async function fleetDeploy(args, context) {
   });
   const deployed = await mapLimit(fleetRecord.nodes, parallel, async (entry) => {
     try {
-      const response = await operatorRequest({
+      const response = await webOperatorRequest({
         body: {
           fleet_node_id: entry.id,
           target_auth_user_id: targetUser.id,
           target_tenant_id: tenant.id,
           network_mode: network,
           notes: `CLI fleet ${fleetRecord.id}; IB island ${fleetRecord.ib_island}`,
-          ...(commerceReservationId
-            ? { commerce_reservation_id: commerceReservationId }
-            : {}),
+          commerce_reservation_id: commerceReservationId,
         },
         endpoint: `/internal/nodes/${encodeURIComponent(entry.gpu_node_id)}/deploy`,
         env: context.env,
@@ -2823,7 +3187,7 @@ async function fleetDeploy(args, context) {
       return { ...result, ok: false, error: fleetResultError(error), status: "failed" };
     }
   });
-  const completed = await operatorRequest({
+  const completed = await webOperatorRequest({
     body: {
       nodes: provisioned.map((result) => ({
         fleet_node_id: result.entry.id,
@@ -2841,6 +3205,7 @@ async function fleetDeploy(args, context) {
     fetchImpl: context.fetchImpl,
     method: "POST",
   });
+  warnIfCommerceDeployStampMissed(completed, context);
   await saveFleetManifest(completed, context.env);
   writeFleetRecord(context, completed, options.json);
   return provisioned.some((result) => !result.ok) ? 1 : 0;
@@ -2897,9 +3262,9 @@ function fleetTakeoverIps(value, fleetIps) {
   return new Set(approved);
 }
 
-async function fetchFleetTenantActiveKeys(tenantId, context) {
-  const payload = await operatorRequest({
-    endpoint: `/nodes/tenants/${encodeURIComponent(tenantId)}/ssh-keys`,
+async function fetchFleetTenantActiveKeys(tenantId, context, request = operatorRequest) {
+  const payload = await request({
+    endpoint: `/nodes/organizations/${encodeURIComponent(tenantId)}/ssh-keys`,
     env: context.env,
     fetchImpl: context.fetchImpl,
   });
@@ -3272,12 +3637,11 @@ async function deriveFleetManagementPublicKey({ context, identityFile }) {
 }
 
 function startFleetSshCanary({ context, identityFile, ip, port, timeoutSeconds, user }) {
-  let failure = null;
+  let failedChecks = 0;
   let successfulChecks = 0;
   let inFlight = Promise.resolve();
   const check = () => {
     inFlight = inFlight.then(async () => {
-      if (failure) return;
       const exitCode = await runFleetSsh({
         context,
         identityFile,
@@ -3288,7 +3652,7 @@ function startFleetSshCanary({ context, identityFile, ip, port, timeoutSeconds,
         user,
       });
       if (exitCode !== 0) {
-        failure = new Error("Management SSH canary failed during cleanup.");
+        failedChecks += 1;
       } else {
         successfulChecks += 1;
       }
@@ -3300,8 +3664,7 @@ function startFleetSshCanary({ context, identityFile, ip, port, timeoutSeconds,
   return async () => {
     clearInterval(timer);
     await inFlight;
-    if (failure) throw failure;
-    return successfulChecks;
+    return { failedChecks, successfulChecks };
   };
 }
 
@@ -3498,12 +3861,20 @@ async function saveFleetManifest(manifest, env) {
   return path;
 }
 
-async function resolveFleetTenant(tenantInput, context) {
+async function resolveCommerceTenant(tenantInput, context) {
+  const input = String(tenantInput || "").trim();
+  if (isUuid(input)) {
+    return { id: input };
+  }
+  return await resolveFleetTenant(input, context, webOperatorRequest);
+}
+
+async function resolveFleetTenant(tenantInput, context, request = operatorRequest) {
   const input = String(tenantInput).trim();
   if (!/^[^@\s]+@[^@\s]+\.[^@\s]+$/.test(input)) {
     throw new Error("--tenant must be the tenant contact email address.");
   }
-  const rows = await operatorRequest({
+  const rows = await request({
     endpoint: `/internal/users?q=${encodeURIComponent(input)}&approved=true&limit=1000`,
     env: context.env,
     fetchImpl: context.fetchImpl,
@@ -3512,7 +3883,13 @@ async function resolveFleetTenant(tenantInput, context) {
   const matches = (Array.isArray(rows) ? rows : []).filter(
     (row) => String(row?.contact_email || "").trim().toLowerCase() === normalized
   );
-  const tenantIds = [...new Set(matches.map((row) => String(row.tenant_id)).filter(Boolean))];
+  const tenantIds = [
+    ...new Set(
+      matches
+        .map((row) => String(row.organization_id ?? row.tenant_id ?? ""))
+        .filter(Boolean)
+    )
+  ];
   if (tenantIds.length !== 1) {
     throw new Error(
       tenantIds.length
@@ -3520,7 +3897,9 @@ async function resolveFleetTenant(tenantInput, context) {
         : `No tenant account matched ${input}.`
     );
   }
-  const tenant = matches.find((row) => String(row.tenant_id) === tenantIds[0]);
+  const tenant = matches.find(
+    (row) => String(row.organization_id ?? row.tenant_id ?? "") === tenantIds[0]
+  );
   return {
     auth_user_id: tenant?.auth_user_id ? String(tenant.auth_user_id) : null,
     id: tenantIds[0],
@@ -3528,10 +3907,10 @@ async function resolveFleetTenant(tenantInput, context) {
   };
 }
 
-async function resolveFleetUser(tenantId, userInput, context) {
+async function resolveFleetUser(tenantId, userInput, context, request = operatorRequest) {
   const input = String(userInput || "").trim();
-  const members = await operatorRequest({
-    endpoint: `/internal/tenants/${encodeURIComponent(tenantId)}/members`,
+  const members = await request({
+    endpoint: `/internal/organizations/${encodeURIComponent(tenantId)}/members`,
     env: context.env,
     fetchImpl: context.fetchImpl,
   });
@@ -4597,38 +4976,200 @@ async function networks(args, context) {
   throw new Error("Usage: ornn networks list|show|create|update|delete|reservation|attach|detach");
 }
 
+function normalizeStorageDestination(value) {
+  const normalized = String(value ?? "")
+    .trim()
+    .replaceAll("\\", "/");
+  const parts = normalized.split("/");
+  if (
+    !normalized ||
+    normalized.startsWith("/") ||
+    normalized.endsWith("/") ||
+    parts.some((part) => !part || part === "." || part === "..")
+  ) {
+    throw new Error("Destination must be a relative path inside the volume and cannot contain . or .. segments.");
+  }
+  return normalized;
+}
+
+async function putSignedStorageUpload({ contentType, fetchImpl, headers, localFile, sizeBytes, uploadUrl }) {
+  let url;
+  try {
+    url = new URL(uploadUrl);
+  } catch {
+    throw new CliApiError("Ornn returned an invalid upload link. Try the upload again.");
+  }
+  if (
+    url.protocol !== "https:" ||
+    !(url.hostname === "storage.googleapis.com" || url.hostname.endsWith(".storage.googleapis.com"))
+  ) {
+    throw new CliApiError("Ornn returned an unsafe upload link. Try the upload again.");
+  }
+  const approvedHeaders = new Headers();
+  for (const [name, value] of Object.entries(headers ?? {})) {
+    if (name.toLowerCase() === "content-type" && typeof value === "string") {
+      approvedHeaders.set(name, value);
+    }
+  }
+  if (!approvedHeaders.has("content-type")) {
+    approvedHeaders.set("content-type", contentType);
+  }
+  approvedHeaders.set("content-length", String(sizeBytes));
+  let response;
+  try {
+    response = await fetchImpl(url, {
+      body: createReadStream(localFile),
+      duplex: "half",
+      headers: approvedHeaders,
+      method: "PUT",
+      redirect: "manual",
+    });
+  } catch {
+    // The object store can accept every byte while the final HTTP response is
+    // lost. Finalization checks the staged object directly, so let compute
+    // decide whether the upload arrived instead of sending the bytes twice.
+    return null;
+  }
+  if (!response.ok) {
+    if (response.status === 403) {
+      throw new CliApiError(
+        "The upload link expired before the file finished uploading. Try again; the volume does not need to be remounted.",
+        { status: response.status },
+      );
+    }
+    if (response.status === 409 || response.status === 412) {
+      throw new CliApiError("This file changed while your upload was in progress. Refresh the volume and try again.", {
+        status: response.status,
+      });
+    }
+    throw new CliApiError("Storage could not accept the file. Try the upload again.", {
+      status: response.status,
+    });
+  }
+  return response.headers.get("x-goog-generation");
+}
+
+async function cancelStorageUploadSession({ driveId, env, fetchImpl, uploadId }) {
+  try {
+    await cliRequest({
+      endpoint: computeEndpoint(
+        `/nodes/storage-drives/${encodeURIComponent(driveId)}/file-uploads/${encodeURIComponent(uploadId)}`,
+      ),
+      env,
+      fetchImpl,
+      method: "DELETE",
+    });
+  } catch {
+    // Preserve the original upload error. A finalizing upload rejects cancellation
+    // and remains recoverable by the server-side reconciler.
+  }
+}
+
 async function storage(args, context) {
   const [resource = "volumes", rawSubcommand, id, ...rest] = args;
   const subcommand =
     rawSubcommand ?? (resource === "buckets" || ["drives", "volumes"].includes(resource) ? "list" : undefined);
-  if (resource === "unmount" || resource === "undeploy") {
+  if (resource === "files" && subcommand === "upload" && id) {
+    const [localFile, ...optionArgs] = rest;
+    if (!localFile) {
+      throw new Error(
+        "Usage: ornn storage files upload <drive-id> <local-file> [--destination <path>] [--content-type <type>] [--json]",
+      );
+    }
+    const options = parseCommandOptions(
+      optionArgs,
+      { boolean: ["json"], value: ["content-type", "destination"] },
+      "Usage: ornn storage files upload <drive-id> <local-file> [--destination <path>] [--content-type <type>] [--json]",
+    );
+    let fileInfo;
+    try {
+      fileInfo = await stat(localFile);
+    } catch {
+      throw new Error("File not found. Check the local path and try again.");
+    }
+    if (!fileInfo.isFile()) {
+      throw new Error("Upload expects a file, not a directory.");
+    }
+    const destination = normalizeStorageDestination(optionalStringOption(options.destination) ?? basename(localFile));
+    const contentType = optionalStringOption(options.contentType) ?? "application/octet-stream";
+    const session = await cliRequest({
+      body: { path: destination, content_type: contentType, size_bytes: fileInfo.size },
+      endpoint: computeEndpoint(`/nodes/storage-drives/${encodeURIComponent(id)}/file-upload-url`),
+      env: context.env,
+      fetchImpl: context.fetchImpl,
+      method: "POST",
+    });
+    let result;
+    try {
+      const uploadedGeneration = await putSignedStorageUpload({
+        contentType,
+        fetchImpl: context.fetchImpl,
+        headers: session.headers,
+        localFile,
+        sizeBytes: fileInfo.size,
+        uploadUrl: session.upload_url,
+      });
+      const completionEndpoint = computeEndpoint(
+        `/nodes/storage-drives/${encodeURIComponent(id)}/file-uploads/${encodeURIComponent(session.upload_id)}/complete`,
+      );
+      try {
+        result = await cliRequest({
+          body: { uploaded_generation: uploadedGeneration },
+          endpoint: completionEndpoint,
+          env: context.env,
+          fetchImpl: context.fetchImpl,
+          method: "POST",
+        });
+      } catch (error) {
+        if (!(error instanceof CliApiError) || (error.status && error.status < 500)) {
+          throw error;
+        }
+        result = await cliRequest({
+          body: { uploaded_generation: uploadedGeneration },
+          endpoint: completionEndpoint,
+          env: context.env,
+          fetchImpl: context.fetchImpl,
+          method: "POST",
+        });
+      }
+    } catch (error) {
+      await cancelStorageUploadSession({
+        driveId: id,
+        env: context.env,
+        fetchImpl: context.fetchImpl,
+        uploadId: session.upload_id,
+      });
+      throw error;
+    }
+    if (options.json) {
+      writeJson(context.stdout, result);
+    } else {
+      context.stdout.write(`Uploaded ${localFile} to ${destination}. Mounted nodes can use it without remounting.\n`);
+    }
+    return 0;
+  }
+  if (resource === "undeploy") {
     const options = parseCommandOptions(
       [rawSubcommand, id, ...rest].filter(Boolean),
       {
         boolean: ["json"],
         value: ["reservation", "reservation-id"],
       },
-      `Usage: ornn storage ${resource} --reservation <reservation-id> [--json]`,
+      "Usage: ornn storage undeploy --reservation <reservation-id> [--json]",
     );
     const reservationId = requiredOption(options.reservation || options.reservationId, "--reservation");
-    const endpoint = computeEndpoint(
-      `/nodes/reservations/${encodeURIComponent(reservationId)}/storage-attachment${
-        resource === "unmount" ? "/unmount" : ""
-      }`,
-    );
     const payload = await cliRequest({
-      endpoint,
+      endpoint: computeEndpoint(`/nodes/reservations/${encodeURIComponent(reservationId)}/storage-attachment`),
       env: context.env,
       fetchImpl: context.fetchImpl,
-      method: resource === "unmount" ? "POST" : "DELETE",
+      method: "DELETE",
     });
     if (options.json) {
       writeJson(context.stdout, payload);
-    } else if (resource === "unmount") {
-      context.stdout.write("Storage unmount requested.\n");
-      writeReservationStorageAttachment(context.stdout, payload.attachment);
     } else {
-      context.stdout.write("Storage undeployed (attachment detached).\n");
+      context.stdout.write(
+        "Storage detach requested. Ornn will flush every mounted node before releasing the volume.\n",
+      );
       if (payload?.attachment) {
         writeReservationStorageAttachment(context.stdout, payload.attachment);
       }
@@ -4740,20 +5281,26 @@ async function storage(args, context) {
     const options = parseCommandOptions(
       [id, ...rest].filter(Boolean),
       {
-        boolean: ["json", "read-only", "read-write"],
+        boolean: ["all-nodes", "json", "read-only", "read-write"],
         value: ["mount-path", "reservation", "reservation-id"],
       },
-      "Usage: ornn storage deploy <drive-id> --reservation <reservation-id> [--mount-path <path>] [--read-only|--read-write] [--json]",
+      "Usage: ornn storage deploy <drive-id> --reservation <reservation-id> [--all-nodes] [--mount-path <path>] [--read-only|--read-write] [--json]",
     );
     if (options.readOnly && options.readWrite) {
       throw new Error("Choose only one of --read-only or --read-write.");
     }
     const reservationId = requiredOption(options.reservation || options.reservationId, "--reservation");
+    const drive = await findStorageBucket(subcommand, context);
+    const deploymentBlockReason = storageDeploymentBlockReason(drive);
+    if (deploymentBlockReason) {
+      throw new Error(deploymentBlockReason);
+    }
     const payload = await cliRequest({
       body: {
         drive_id: subcommand,
         ...(optionProvided(options.mountPath) ? { mount_path: requiredOption(options.mountPath, "--mount-path") } : {}),
         access_mode: options.readOnly ? "read-only" : "read-write",
+        ...(options.allNodes ? { all_nodes: true } : {}),
       },
       endpoint: computeEndpoint(`/nodes/reservations/${encodeURIComponent(reservationId)}/storage-deployment`),
       env: context.env,
@@ -4763,13 +5310,17 @@ async function storage(args, context) {
     if (options.json) {
       writeJson(context.stdout, payload);
     } else {
-      context.stdout.write("Storage deployment started.\n");
+      context.stdout.write(
+        options.allNodes
+          ? "Storage deployment started for every compatible node in the group.\n"
+          : "Storage deployment started.\n",
+      );
       writeReservationStorageAttachment(context.stdout, payload.attachment);
     }
     return 0;
   }
   if (resource === "deploy") {
-    throw new Error("Usage: ornn storage deploy <drive-id> --reservation <reservation-id> [--mount-path <path>] [--read-only|--read-write] [--json]");
+    throw new Error("Usage: ornn storage deploy <drive-id> --reservation <reservation-id> [--all-nodes] [--mount-path <path>] [--read-only|--read-write] [--json]");
   }
   if (resource === "buckets") {
     if (subcommand === "list") {
@@ -4974,7 +5525,9 @@ async function storage(args, context) {
     return drive?.source?.connection_status === "verification_failed" ? 1 : 0;
   }
   if (!["drives", "volumes"].includes(resource)) {
-    throw new Error("Usage: ornn storage volumes list|show|create|refresh|clear|delete; ornn storage buckets connect gcs|s3|r2 --bucket <bucket>");
+    throw new Error(
+      "Usage: ornn storage volumes list|show|create|refresh|clear|delete; ornn storage files upload <drive-id> <local-file>; ornn storage buckets connect gcs|s3|r2 --bucket <bucket>",
+    );
   }
 
   if (subcommand === "list") {
@@ -5591,14 +6144,17 @@ function inventoryAvailableGpuCount(record) {
 
 function normalizeInventoryListing(record) {
   const gpuCount = inventoryAvailableGpuCount(record);
+  const facility = record.site_nickname ?? record.facility ?? record.site ?? "Unknown facility";
+  // Customer availability never exposes real supplier/operator identity.
+  const operator = "Ornn Compute";
   return {
     id: record.id,
     kind: "inventory",
     source: "primary",
     gpu_type: record.gpu_type ?? "GPU",
     gpu_count: gpuCount || null,
-    operator: record.site_operator ?? record.operator ?? "Unknown operator",
-    facility: record.site_nickname ?? record.facility ?? record.site ?? "Unknown facility",
+    operator,
+    facility,
     location: record.location ?? record.region ?? null,
     network: record.fabric_type ?? record.network_hardware ?? record.internet ?? null,
     start_date: record.available_from ?? null,
@@ -5606,7 +6162,8 @@ function normalizeInventoryListing(record) {
     price_per_gpu_hour: resolveBuyNowUsdPerGpuHour(record),
     checkout_url: `/checkout?inventory=${encodeURIComponent(record.id)}`,
     marketplace_url: `/marketplace/${encodeURIComponent(record.id)}`,
-    inventory: record,
+    // Strip supplier identity before echoing the raw inventory row in --json.
+    inventory: { ...record, site_operator: operator },
   };
 }
 
@@ -5904,6 +6461,48 @@ function writeReservationList(stdout, reservations) {
   }
 }
 
+function writeDeployableCommerceReservations(stdout, payload) {
+  const reservations = Array.isArray(payload?.reservations) ? payload.reservations : [];
+  if (!reservations.length) {
+    stdout.write("No deployable Commerce reservations found.\n");
+    return;
+  }
+  stdout.write("Deployable Commerce reservations:\n");
+  for (const reservation of reservations) {
+    stdout.write(
+      `- ${reservation.reservation_id}  listing=${reservation.listing_id}  ${reservation.gpu_count} GPUs  ${formatDateRange(reservation.start_at, reservation.end_at)}\n`,
+    );
+  }
+  if (payload?.scan_truncated) {
+    stdout.write(`Warning: Commerce scan stopped after ${payload.scan_limit} reservations.\n`);
+  }
+}
+
+function warnIfCommerceDeployStampMissed(payload, context) {
+  if (payload?.commerce_first_deployed_recorded === false) {
+    context.stderr.write(
+      "Warning: deployment succeeded, but Commerce did not record first_deployed_at. Review and repair the Commerce reservation.\n",
+    );
+  }
+}
+
+function writeCreatedCommerceReservation(stdout, payload, tenantLabel) {
+  const reservation = payload?.reservation;
+  if (!reservation?.reservationId) {
+    throw new Error("Ornn returned invalid Commerce reservation data.");
+  }
+  stdout.write(`Commerce reservation created: ${reservation.reservationId}\n`);
+  stdout.write(`Tenant: ${tenantLabel}\n`);
+  stdout.write(`Listing: ${reservation.listingId || "unknown"}\n`);
+  stdout.write(`Fleet: ${payload?.fleet_id || "unknown"}\n`);
+  stdout.write(`GPU count: ${reservation.gpuCount ?? "unknown"}\n`);
+  stdout.write(`Window: ${formatDateRange(reservation.startAt, reservation.endAt)}\n`);
+  stdout.write(`Price: ${formatUsd(reservation.pricePerGpuHr)}/GPU-hr\n`);
+  stdout.write(
+    `Deploy with: ornn fleet deploy ${payload?.fleet_id || "<fleet-id>"} --tenant ${shellQuote(tenantLabel)} --commerce-reservation ${reservation.reservationId}\n`,
+  );
+}
+
 function writeReservationDetail(stdout, reservation) {
   stdout.write(`${reservation.id}\n`);
   stdout.write(`Status: ${reservation.status || "unknown"}\n`);
@@ -6890,23 +7489,38 @@ function writeReservationStorageAttachment(stdout, attachment = {}) {
   }
   stdout.write(`${attachment.id || "storage-attachment"}\n`);
   writeOptionalStatusLine(stdout, "Reservation", attachment.reservation_id);
+  if (attachment.scope) {
+    writeOptionalStatusLine(stdout, "Mount scope", attachment.scope.mode);
+    writeOptionalStatusLine(stdout, "Target nodes", attachment.scope.node_count);
+  }
   writeOptionalStatusLine(stdout, "Drive", attachment.drive_id);
   writeOptionalStatusLine(stdout, "State", attachment.state);
   writeOptionalStatusLine(stdout, "Target region", attachment.target_region);
   writeOptionalStatusLine(stdout, "Mount path", attachment.mount_path);
   writeOptionalStatusLine(stdout, "Mount mode", attachment.mount_mode);
   writeOptionalStatusLine(stdout, "Access", attachment.access_mode);
+  if (attachment.mount_mode === "fuse") {
+    const mounts = Array.isArray(attachment.drive?.active_mounts)
+      ? attachment.drive.active_mounts
+      : attachment.drive?.active_mount
+        ? [attachment.drive.active_mount]
+        : [];
+    const mountedCount = mounts.filter(
+      (mount) => textValue(mount.state).toLowerCase() === "mounted",
+    ).length;
+    const expectedCount = Math.max(Number(attachment.scope?.node_count) || 0, mounts.length);
+    if (expectedCount > 0) {
+      writeOptionalStatusLine(
+        stdout,
+        "Mounted",
+        `${mountedCount} of ${expectedCount} ${expectedCount === 1 ? "node" : "nodes"}`,
+      );
+    }
+  }
   if (attachment.placement) {
     const placement = attachment.placement;
     stdout.write("Placement:\n");
     writeOptionalStatusLine(stdout, "State", placement.state);
-    writeOptionalStatusLine(
-      stdout,
-      "Target",
-      placement.target_storage_uri ||
-        placement.storage_uri ||
-        storageObjectUri("gs", placement.bucket, placement.prefix),
-    );
     writeOptionalStatusLine(stdout, "Transfer", placement.transfer_status);
     writeOptionalStatusLine(stdout, "Progress", formatStorageTransferProgress(placement.transfer_progress));
     if (
@@ -6926,9 +7540,6 @@ function writeReservationStorageAttachment(stdout, attachment = {}) {
         [objectLabel, bytesLabel].filter(Boolean).join(", "),
       );
     }
-    writeOptionalStatusLine(stdout, "Source provider", placement.source_provider);
-    writeOptionalStatusLine(stdout, "Source bucket", placement.source_bucket);
-    writeOptionalStatusLine(stdout, "Source prefix", placement.source_prefix);
   }
   const nfsBackend = attachment.drive?.nfs_backend || attachment.drive?.accelerators?.nfs;
   if (nfsBackend) {
@@ -6978,10 +7589,21 @@ function writeStorageDriveList(stdout, drives) {
         stdout.write(` bucket=${drive.source.bucket}`);
       }
     }
-    if (drive.active_mount) {
-      stdout.write(` mounted=${drive.active_mount.reservation_id || "yes"}`);
+    const activeMounts = Array.isArray(drive.active_mounts)
+      ? drive.active_mounts
+      : drive.active_mount
+        ? [drive.active_mount]
+        : [];
+    if (activeMounts.length) {
+      stdout.write(` mounted=${activeMounts.length}-node${activeMounts.length === 1 ? "" : "s"}`);
     }
     stdout.write("\n");
+    for (const mount of activeMounts) {
+      const issue = storageMountIssue(mount);
+      if (issue) {
+        stdout.write(`  Mount issue (${storageMountNodeLabel(mount)}): ${issue}\n`);
+      }
+    }
   }
 }
 
@@ -7030,7 +7652,9 @@ function writeStorageDriveDetail(stdout, drive = {}) {
     writeOptionalStatusLine(stdout, "S3 provider", drive.source.s3_provider);
     writeOptionalStatusLine(stdout, "Endpoint", drive.source.endpoint_url);
     if (drive.source.credentials_configured) {
-      stdout.write(`Credentials: configured${drive.source.access_key_id_hint ? ` (${drive.source.access_key_id_hint})` : ""}\n`);
+      stdout.write(
+        `Credentials: configured${drive.source.access_key_id_hint ? ` (${drive.source.access_key_id_hint})` : ""}\n`,
+      );
     }
     writeOptionalStatusLine(stdout, "Connection", drive.source.connection_status);
     writeOptionalStatusLine(stdout, "Verified", drive.source.last_verified_at);
@@ -7050,18 +7674,55 @@ function writeStorageDriveDetail(stdout, drive = {}) {
   if (drive.file_tree_truncated) {
     stdout.write("    File tree: truncated\n");
   }
-  if (drive.active_mount) {
-    stdout.write("Active mount:\n");
-    writeOptionalStatusLine(stdout, "Reservation", drive.active_mount.reservation_id);
-    writeOptionalStatusLine(stdout, "Node", drive.active_mount.node_label || drive.active_mount.node_id);
-    writeOptionalStatusLine(stdout, "Path", drive.active_mount.mount_path);
-    writeOptionalStatusLine(stdout, "Access", drive.active_mount.access);
-    writeOptionalStatusLine(stdout, "State", drive.active_mount.state);
+  const activeMounts = Array.isArray(drive.active_mounts)
+    ? drive.active_mounts
+    : drive.active_mount
+      ? [drive.active_mount]
+      : [];
+  if (activeMounts.length) {
+    stdout.write(`Active mounts (${activeMounts.length} nodes):\n`);
+    for (const mount of activeMounts) {
+      stdout.write(
+        `- ${storageMountNodeLabel(mount)} ${storageMountStateLabel(mount.state)} ${mount.access || "unknown"} ${mount.mount_path || ""}\n`,
+      );
+      const issue = storageMountIssue(mount);
+      if (issue) {
+        stdout.write(`  Issue: ${issue}\n`);
+      }
+    }
   }
   writeOptionalStatusLine(stdout, "Created", drive.created_at);
   writeOptionalStatusLine(stdout, "Updated", drive.updated_at);
 }
 
+function storageMountNodeLabel(mount = {}) {
+  return mount.node_label || mount.node_id || mount.instance_id || "node";
+}
+
+function storageMountStateLabel(state) {
+  const normalized = textValue(state).toLowerCase();
+  return (
+    {
+      mount_failed_unverified: "needs attention",
+      mounted: "mounted",
+      provisioning: "mounting",
+      release_pending: "unmounting",
+      reserved: "waiting",
+    }[normalized] || "unknown"
+  );
+}
+
+function storageMountIssue(mount = {}) {
+  const customerMessage = textValue(mount.error);
+  if (customerMessage && !/^[a-z][a-z0-9_-]*$/i.test(customerMessage)) {
+    return customerMessage;
+  }
+  if (mount.state === "mount_failed_unverified") {
+    return "Ornn could not confirm this node's mount. Retry the reservation mount; other mounted nodes remain available.";
+  }
+  return null;
+}
+
 function writeStorageImportCommands(stdout, commands = []) {
   if (!commands.length) {
     return;
@@ -7181,6 +7842,14 @@ function isStorageBucketDrive(drive = {}) {
   );
 }
 
+function storageDeploymentBlockReason(drive = {}) {
+  const source = drive.source || {};
+  if (source.provider === "s3" && source.s3_provider === "cloudflare_r2") {
+    return "Cloudflare R2 deployment is coming soon.";
+  }
+  return null;
+}
+
 function storageBucketLocationFromInput(value) {
   const withoutScheme = String(value || "")
     .trim()
@@ -7289,6 +7958,9 @@ function storageObjectUri(scheme, bucket, prefix) {
 }
 
 function storageImportTargetUri(target = {}) {
+  if (!target || typeof target !== "object") {
+    return null;
+  }
   if (target.storage_uri) {
     return String(target.storage_uri);
   }
@@ -8293,6 +8965,7 @@ function isStructuredErrorCode(value) {
     return false;
   }
   return (
+    normalized.startsWith("storage_") ||
     normalized.includes("unavailable") ||
     normalized.includes("capacity") ||
     normalized.includes("invalid") ||
@@ -8307,7 +8980,11 @@ function isStructuredErrorCode(value) {
 
 function formatStructuredProvisioningError(detail) {
   const lines = [];
-  const summary = textValue(detail.summary) || messageForErrorCode(detail.code) || "Ornn request failed.";
+  const summary =
+    textValue(detail.message) ||
+    textValue(detail.summary) ||
+    messageForErrorCode(detail.code) ||
+    "Ornn request failed.";
   lines.push(summary);
 
   const code = textValue(detail.code);
@@ -8323,6 +9000,8 @@ function formatStructuredProvisioningError(detail) {
   if (nextSteps.length) {
     const label = nextSteps.length === 1 ? "Next step" : "Next steps";
     lines.push(`${label}: ${nextSteps.join(" ")}`);
+  } else if (detail.retryable === true) {
+    lines.push("Next step: Retry this command. If the problem continues, contact Ornn support with this error code.");
   } else {
     lines.push(`Next step: ${defaultNextStepForErrorCode(code)}`);
   }
@@ -8344,6 +9023,15 @@ function messageForErrorCode(code) {
     return "";
   }
   const normalized = String(code).toLowerCase();
+  if (normalized === "storage_drive_not_found") {
+    return "This storage volume was not found.";
+  }
+  if (normalized === "storage_nfs_file_api_unsupported") {
+    return "CLI file uploads are not available for managed fileshares.";
+  }
+  if (normalized.startsWith("storage_")) {
+    return "Storage request failed.";
+  }
   if (normalized.includes("unavailable") || normalized.includes("capacity")) {
     return "Requested machine capacity is not available.";
   }
@@ -8365,6 +9053,15 @@ function defaultNextStepForErrorCode(code) {
     return "Contact Ornn support with this error code.";
   }
   const normalized = String(code).toLowerCase();
+  if (normalized === "storage_drive_not_found") {
+    return "Check the volume ID and try again.";
+  }
+  if (normalized === "storage_nfs_file_api_unsupported") {
+    return "Write the file through the mounted managed fileshare instead.";
+  }
+  if (normalized.startsWith("storage_")) {
+    return "Retry the storage command, or contact Ornn support with this error code.";
+  }
   if (normalized === "bare_metal_unavailable") {
     return "Choose Bare Metal-capable capacity when available, or contact Ornn support with this error code.";
   }