@ornncompute/cli 0.1.7 → 0.1.9

package/src/cli.mjs

@@ -1,11 +1,21 @@
 import { spawn } from "node:child_process";
 import { randomUUID } from "node:crypto";
 import { createReadStream } from "node:fs";
-import { mkdir, mkdtemp, readFile, rm, stat, writeFile } from "node:fs/promises";
+import {
+  chmod,
+  mkdir,
+  mkdtemp,
+  open,
+  readFile,
+  rename,
+  rm,
+  stat,
+  writeFile,
+} from "node:fs/promises";
 import { createRequire } from "node:module";
 import { isIP } from "node:net";
-import { homedir, tmpdir } from "node:os";
-import { basename, join } from "node:path";
+import { homedir, hostname, tmpdir } from "node:os";
+import { basename, dirname, join } from "node:path";
 
 import {
   CliApiError,
@@ -132,11 +142,12 @@ Usage:
   ornn tokens list [--json]
   ornn tokens create --operator <id> [--facility <id>] [--expires-in <seconds>] [--mode bare-metal|vm] [--ip <addr>] [--force] [--json]
   ornn tokens revoke <token-id> [--json]
-  ornn fleet clean <ip>... --operator <id-or-slug> --ib-island <name> --identity-file <path> --dry-run [--source-user <user>]... [--preserve-user <user>]... [--ssh-user ubuntu|admin|ornn] [--json]
-  ornn fleet clean <failed-fleet-id> --identity-file <path> --dry-run [--source-user <user>]... [--preserve-user <user>]... [--json]
-  ornn fleet clean <fleet-id> --identity-file <path> --confirm-clean <plan-hash> [--source-user <user>]... [--preserve-user <user>]... [--json]
+  ornn fleet clean <ip>... --operator <id-or-slug> --ib-island <name> --identity-file <path> --dry-run [--policy <path>] [--policy-out <path>] [--ssh-user <non-root-linux-user>] [--json]
+  ornn fleet clean <fleet-id> --identity-file <path> --dry-run [--policy <path>] [--policy-out <path>] [--json]
+  ornn fleet clean <fleet-id> --identity-file <path> --confirm-clean <plan-hash> [--json]
   ornn fleet enroll <fleet-id> --identity-file <path> [--confirm-takeover <ip[,ip...]>] [--json]
   ornn fleet deploy <fleet-id> --tenant <email> [--user <email-or-id>] --commerce-reservation <id> [--network public|private] [--json]
+  ornn fleet delete <fleet-id> --confirm-delete <fleet-id> [--json]
   ornn reservations withdraw <reservation-id> [--json]
   ornn reservations transfer <reservation-id> --target-tenant <id> [--target-user <id>] [--node <id>] [--strategy reject|park] [--confirm] [--json]
   ornn reservations commerce list --tenant <email-or-id> [--fleet <fleet-id>] [--json]
@@ -350,7 +361,10 @@ async function dispatch(argv = [], io = {}) {
 
   try {
     if (args.includes("--help") || args.includes("-h")) {
-      const helpError = validateHelpInvocation(command, args.filter((arg) => arg !== "--help" && arg !== "-h"));
+      const helpError = validateHelpInvocation(
+        command,
+        args.filter((arg) => arg !== "--help" && arg !== "-h")
+      );
       if (helpError) {
         throw new Error(helpError);
       }
@@ -392,7 +406,13 @@ async function dispatch(argv = [], io = {}) {
     }
 
     if (LISTINGS_COMMANDS.has(command)) {
-      return await availability(args, { commandName: command, env, fetchImpl, openBrowserImpl, stdout });
+      return await availability(args, {
+        commandName: command,
+        env,
+        fetchImpl,
+        openBrowserImpl,
+        stdout,
+      });
     }
 
     if (command === "buy") {
@@ -479,7 +499,14 @@ async function dispatch(argv = [], io = {}) {
       const session = await loadAuthSession({ env });
       if (session?.accessToken) {
         try {
-          await cliRequest({ endpoint: "/api/cli/session", env, fetchImpl, method: "DELETE", raw: true, session });
+          await cliRequest({
+            endpoint: "/api/cli/session",
+            env,
+            fetchImpl,
+            method: "DELETE",
+            raw: true,
+            session,
+          });
         } catch {
           // Best effort: revoke server-side if reachable, but always clear locally.
         }
@@ -508,8 +535,16 @@ function validateHelpInvocation(command, args) {
   }
 
   if (command === "login") {
-    const parsed = parseHelpArgs(args, { booleanOptions: ["--no-browser"], valueOptions: ["--auth-base", "--poll-interval", "--timeout"] });
-    return parsed.error || (parsed.positionals.length ? "Usage: ornn login [--auth-base <url>] [--no-browser] [--timeout <seconds>]" : null);
+    const parsed = parseHelpArgs(args, {
+      booleanOptions: ["--no-browser"],
+      valueOptions: ["--auth-base", "--poll-interval", "--timeout"],
+    });
+    return (
+      parsed.error ||
+      (parsed.positionals.length
+        ? "Usage: ornn login [--auth-base <url>] [--no-browser] [--timeout <seconds>]"
+        : null)
+    );
   }
 
   if (command === "logout") {
@@ -521,15 +556,22 @@ function validateHelpInvocation(command, args) {
   }
 
   if (command === "whoami" || command === "account") {
-    return validateNoPositionals(args, "Usage: ornn whoami [--json]", { booleanOptions: ["--json"] });
+    return validateNoPositionals(args, "Usage: ornn whoami [--json]", {
+      booleanOptions: ["--json"],
+    });
   }
 
   if (command === "status") {
-    return validateNoPositionals(args, "Usage: ornn status [--json]", { booleanOptions: ["--json"] });
+    return validateNoPositionals(args, "Usage: ornn status [--json]", {
+      booleanOptions: ["--json"],
+    });
   }
 
   if (command === "api") {
-    const parsed = parseHelpArgs(args, { booleanOptions: ["--json", "--raw"], valueOptions: ["--data"] });
+    const parsed = parseHelpArgs(args, {
+      booleanOptions: ["--json", "--raw"],
+      valueOptions: ["--data"],
+    });
     if (parsed.error) {
       return parsed.error;
     }
@@ -540,21 +582,30 @@ function validateHelpInvocation(command, args) {
     if (!path || extra.length) {
       return "Usage: ornn api <get|post|patch|put|delete> <compute-path> [--data <json>] [--raw]";
     }
-    return ["delete", "get", "patch", "post", "put"].includes(method.toLowerCase()) ? null : `Unsupported API method: ${method}`;
+    return ["delete", "get", "patch", "post", "put"].includes(method.toLowerCase())
+      ? null
+      : `Unsupported API method: ${method}`;
   }
 
   if (LISTINGS_COMMANDS.has(command)) {
-    const parsed = parseHelpArgs(args, { booleanOptions: ["--json", "--open"], valueOptions: ["--facility", "--gpu-type", "--operator"] });
+    const parsed = parseHelpArgs(args, {
+      booleanOptions: ["--json", "--open"],
+      valueOptions: ["--facility", "--gpu-type", "--operator"],
+    });
     if (parsed.error) {
       return parsed.error;
     }
     const [subcommand, id, ...extra] = parsed.positionals;
     const usageCommand = command === "availability" ? "availability" : "listings";
     if (!subcommand || subcommand === "list") {
-      return id || extra.length ? `Usage: ornn ${usageCommand} list [--gpu-type <type>] [--facility <name>] [--operator <name>] [--json]` : null;
+      return id || extra.length
+        ? `Usage: ornn ${usageCommand} list [--gpu-type <type>] [--facility <name>] [--operator <name>] [--json]`
+        : null;
     }
     if (subcommand === "show") {
-      return !id || extra.length ? `Usage: ornn ${usageCommand} show <listing-id> [--open] [--json]` : null;
+      return !id || extra.length
+        ? `Usage: ornn ${usageCommand} show <listing-id> [--open] [--json]`
+        : null;
     }
     return `Usage: ornn ${usageCommand} list|show`;
   }
@@ -564,21 +615,38 @@ function validateHelpInvocation(command, args) {
     if (parsed.error) {
       return parsed.error;
     }
-    return parsed.positionals.length === 1 ? null : "Usage: ornn buy <listing-id> [--no-open] [--json]";
+    return parsed.positionals.length === 1
+      ? null
+      : "Usage: ornn buy <listing-id> [--no-open] [--json]";
   }
 
   if (EXCHANGE_COMMANDS.has(command)) {
-    const parsed = parseHelpArgs(args, { booleanOptions: ["--json", "--no-open", "--open"], valueOptions: ["--cursor", "--end-date", "--gpu-count", "--limit", "--min-gpu-count", "--price", "--start-date"] });
+    const parsed = parseHelpArgs(args, {
+      booleanOptions: ["--json", "--no-open", "--open"],
+      valueOptions: [
+        "--cursor",
+        "--end-date",
+        "--gpu-count",
+        "--limit",
+        "--min-gpu-count",
+        "--price",
+        "--start-date",
+      ],
+    });
     if (parsed.error) {
       return parsed.error;
     }
     const [subcommand, id, ...extra] = parsed.positionals;
     const usageCommand = command === "exchange" ? "exchange" : "bid";
     if (!subcommand || subcommand === "list") {
-      return id || extra.length ? `Usage: ornn ${usageCommand} list|show|create|update|withdraw` : null;
+      return id || extra.length
+        ? `Usage: ornn ${usageCommand} list|show|create|update|withdraw`
+        : null;
     }
     if (["create", "show", "update", "withdraw", "delete"].includes(subcommand)) {
-      return !id || extra.length ? `Usage: ornn ${usageCommand} list|show|create|update|withdraw` : null;
+      return !id || extra.length
+        ? `Usage: ornn ${usageCommand} list|show|create|update|withdraw`
+        : null;
     }
     return `Usage: ornn ${usageCommand} list|show|create|update|withdraw`;
   }
@@ -645,7 +713,12 @@ function validateHelpInvocation(command, args) {
         "--ib-island",
         "--identity-file",
         "--confirm-clean",
+        "--confirm-delete",
         "--confirm-takeover",
+        "--policy",
+        "--policy-out",
+        "--source-user",
+        "--preserve-user",
         "--ssh-user",
         "--ssh-port",
         "--parallel",
@@ -675,7 +748,12 @@ function validateHelpInvocation(command, args) {
         ? null
         : "Usage: ornn fleet deploy <fleet-id> --tenant <email> [--user <email-or-id>] --commerce-reservation <id>";
     }
-    return "Usage: ornn fleet clean|enroll|deploy";
+    if (subcommand === "delete") {
+      return positionals.length === 1
+        ? null
+        : "Usage: ornn fleet delete <fleet-id> --confirm-delete <fleet-id>";
+    }
+    return "Usage: ornn fleet clean|enroll|deploy|delete";
   }
 
   if (command === "nodes") {
@@ -731,17 +809,31 @@ function validateHelpInvocation(command, args) {
   }
 
   if (command === "ssh") {
-    const parsed = parseHelpArgs(args, { booleanOptions: ["--json", "--print"], valueOptions: ["--identity-file", "--user"] });
+    const parsed = parseHelpArgs(args, {
+      booleanOptions: ["--json", "--print"],
+      valueOptions: ["--identity-file", "--user"],
+    });
     if (parsed.error) {
       return parsed.error;
     }
-    return parsed.positionals.length <= 1 ? null : "Usage: ornn ssh <node-or-reservation-id> [--print] [--identity-file <path>] [--user <name>] [--json]";
+    return parsed.positionals.length <= 1
+      ? null
+      : "Usage: ornn ssh <node-or-reservation-id> [--print] [--identity-file <path>] [--user <name>] [--json]";
   }
 
   if (command === "metrics") {
     const parsed = parseHelpArgs(args, {
       booleanOptions: ["--json"],
-      valueOptions: ["--count", "--end", "--interval", "--max-points", "--start", "--timeout", "--watch-interval", "--watch-timeout"],
+      valueOptions: [
+        "--count",
+        "--end",
+        "--interval",
+        "--max-points",
+        "--start",
+        "--timeout",
+        "--watch-interval",
+        "--watch-timeout",
+      ],
     });
     if (parsed.error) {
       return parsed.error;
@@ -751,9 +843,7 @@ function validateHelpInvocation(command, args) {
       return id || extra.length ? "Usage: ornn metrics nodes [--json]" : null;
     }
     if (["history", "node", "show", "watch"].includes(subcommand)) {
-      return !id || extra.length
-        ? "Usage: ornn metrics nodes|node|history|watch"
-        : null;
+      return !id || extra.length ? "Usage: ornn metrics nodes|node|history|watch" : null;
     }
     return "Usage: ornn metrics nodes|node|history|watch";
   }
@@ -805,7 +895,9 @@ function validateHelpInvocation(command, args) {
         return "Usage: ornn clusters list|reservations|eligible-nodes|create|show|wait|credentials|kubeconfig|ssh-command|ssh|add-node|remove-node|teardown";
       }
       if (["add-node", "remove-node"].includes(subcommand)) {
-        return extra.length ? "Usage: ornn clusters add-node|remove-node <reservation-id> --node <node-id>" : null;
+        return extra.length
+          ? "Usage: ornn clusters add-node|remove-node <reservation-id> --node <node-id>"
+          : null;
       }
       return nested || extra.length
         ? "Usage: ornn clusters list|reservations|eligible-nodes|create|show|wait|credentials|kubeconfig|ssh-command|ssh|add-node|remove-node|teardown"
@@ -836,7 +928,9 @@ function validateHelpInvocation(command, args) {
       if (!id) {
         return "Usage: ornn slurm launch|teardown|status|credentials|ssh <reservation-id>";
       }
-      return extra.length ? "Usage: ornn slurm launch|teardown|status|credentials|ssh <reservation-id>" : null;
+      return extra.length
+        ? "Usage: ornn slurm launch|teardown|status|credentials|ssh <reservation-id>"
+        : null;
     }
     return "Usage: ornn slurm launch|teardown|status|credentials|ssh <reservation-id>";
   }
@@ -862,7 +956,9 @@ function validateHelpInvocation(command, args) {
       if (!id) {
         return "Usage: ornn kubernetes launch|teardown|status|credentials|kubeconfig <reservation-id>";
       }
-      return extra.length ? "Usage: ornn kubernetes launch|teardown|status|credentials|kubeconfig <reservation-id>" : null;
+      return extra.length
+        ? "Usage: ornn kubernetes launch|teardown|status|credentials|kubeconfig <reservation-id>"
+        : null;
     }
     return "Usage: ornn kubernetes launch|teardown|status|credentials|kubeconfig <reservation-id>";
   }
@@ -879,10 +975,16 @@ function validateHelpInvocation(command, args) {
     if (!subcommand || subcommand === "list") {
       return id || extra.length ? "Usage: ornn networks list [--json]" : null;
     }
-    if (["attach", "create", "delete", "detach", "reservation", "show", "update"].includes(subcommand)) {
+    if (
+      ["attach", "create", "delete", "detach", "reservation", "show", "update"].includes(subcommand)
+    ) {
       return subcommand === "create"
-        ? id || extra.length ? "Usage: ornn networks create --name <name> [--cidr <cidr>] [--description <text>] [--json]" : null
-        : !id || extra.length ? "Usage: ornn networks list|show|create|update|delete|reservation|attach|detach" : null;
+        ? id || extra.length
+          ? "Usage: ornn networks create --name <name> [--cidr <cidr>] [--description <text>] [--json]"
+          : null
+        : !id || extra.length
+          ? "Usage: ornn networks list|show|create|update|delete|reservation|attach|detach"
+          : null;
     }
     return "Usage: ornn networks list|show|create|update|delete|reservation|attach|detach";
   }
@@ -950,7 +1052,9 @@ function validateHelpInvocation(command, args) {
           : null;
       }
       if (subcommand === "verify") {
-        return !id || extra.length ? "Usage: ornn storage buckets verify <drive-id> [--json]" : null;
+        return !id || extra.length
+          ? "Usage: ornn storage buckets verify <drive-id> [--json]"
+          : null;
       }
       if (subcommand === "update-credentials") {
         return !id || extra.length
@@ -958,7 +1062,9 @@ function validateHelpInvocation(command, args) {
           : null;
       }
       if (subcommand === "disconnect") {
-        return !id || extra.length ? "Usage: ornn storage buckets disconnect <drive-id> [--json]" : null;
+        return !id || extra.length
+          ? "Usage: ornn storage buckets disconnect <drive-id> [--json]"
+          : null;
       }
       return "Usage: ornn storage buckets list|show|connect|verify|update-credentials|disconnect";
     }
@@ -969,16 +1075,23 @@ function validateHelpInvocation(command, args) {
       return id || extra.length ? "Usage: ornn storage volumes list [--json]" : null;
     }
     if (subcommand === "create") {
-      return id || extra.length ? "Usage: ornn storage volumes create --name <name> [--source <drive-id>] [--json]" : null;
+      return id || extra.length
+        ? "Usage: ornn storage volumes create --name <name> [--source <drive-id>] [--json]"
+        : null;
     }
     if (["show", "refresh", "clear", "delete"].includes(subcommand)) {
-      return !id || extra.length ? "Usage: ornn storage volumes list|show|create|refresh|clear|delete" : null;
+      return !id || extra.length
+        ? "Usage: ornn storage volumes list|show|create|refresh|clear|delete"
+        : null;
     }
     return "Usage: ornn storage volumes list|show|create|refresh|clear|delete";
   }
 
   if (command === "keys") {
-    const parsed = parseHelpArgs(args, { booleanOptions: ["--json"], valueOptions: ["--label", "--public-key", "--public-key-file"] });
+    const parsed = parseHelpArgs(args, {
+      booleanOptions: ["--json"],
+      valueOptions: ["--label", "--public-key", "--public-key-file"],
+    });
     if (parsed.error) {
       return parsed.error;
     }
@@ -987,7 +1100,9 @@ function validateHelpInvocation(command, args) {
       return id || extra || rest.length ? "Usage: ornn keys list|add|delete" : null;
     }
     if (subcommand === "add") {
-      return extra || rest.length ? "Usage: ornn keys add [<public-key-file>] [--public-key <key>] [--label <label>] [--json]" : null;
+      return extra || rest.length
+        ? "Usage: ornn keys add [<public-key-file>] [--public-key <key>] [--label <label>] [--json]"
+        : null;
     }
     if (["delete", "remove"].includes(subcommand)) {
       return !id || extra || rest.length ? "Usage: ornn keys delete <key-id> [--json]" : null;
@@ -996,14 +1111,37 @@ function validateHelpInvocation(command, args) {
   }
 
   if (command === "access") {
-    const parsed = parseHelpArgs(args, { booleanOptions: ["--json", "--no-open", "--wait"], valueOptions: ["--key", "--key-id", "--label", "--machine-count", "--mode", "--network", "--network-mode", "--public-key", "--public-key-file", "--request-id", "--ssh-key-id", "--storage-load-drive-id", "--storage-save-drive-id", "--tenant-username", "--username", "--wait-interval", "--wait-timeout"] });
+    const parsed = parseHelpArgs(args, {
+      booleanOptions: ["--json", "--no-open", "--wait"],
+      valueOptions: [
+        "--key",
+        "--key-id",
+        "--label",
+        "--machine-count",
+        "--mode",
+        "--network",
+        "--network-mode",
+        "--public-key",
+        "--public-key-file",
+        "--request-id",
+        "--ssh-key-id",
+        "--storage-load-drive-id",
+        "--storage-save-drive-id",
+        "--tenant-username",
+        "--username",
+        "--wait-interval",
+        "--wait-timeout",
+      ],
+    });
     if (parsed.error) {
       return parsed.error;
     }
     const [subcommand, id, nestedId, ...extra] = parsed.positionals;
     if (subcommand === "keys") {
       if (["list", "add", "push", "status"].includes(id)) {
-        return !nestedId || extra.length ? "Usage: ornn access keys list|add|push|status <reservation-id>" : null;
+        return !nestedId || extra.length
+          ? "Usage: ornn access keys list|add|push|status <reservation-id>"
+          : null;
       }
       return !id ? null : "Usage: ornn access keys list|add|push|status <reservation-id>";
     }
@@ -1012,11 +1150,16 @@ function validateHelpInvocation(command, args) {
         ? "Usage: ornn access show|activate|switch|push-keys <reservation-id>"
         : null;
     }
-    return !subcommand ? null : "Usage: ornn access show|activate|switch|push-keys|keys <reservation-id>";
+    return !subcommand
+      ? null
+      : "Usage: ornn access show|activate|switch|push-keys|keys <reservation-id>";
   }
 
   if (command === "billing") {
-    const parsed = parseHelpArgs(args, { booleanOptions: ["--json", "--no-open"], valueOptions: ["--end", "--start"] });
+    const parsed = parseHelpArgs(args, {
+      booleanOptions: ["--json", "--no-open"],
+      valueOptions: ["--end", "--start"],
+    });
     if (parsed.error) {
       return parsed.error;
     }
@@ -1028,13 +1171,18 @@ function validateHelpInvocation(command, args) {
       return extra.length ? "Usage: ornn billing summary|invoices|showback|open" : null;
     }
     if (subcommand === "showback") {
-      return extra.length ? "Usage: ornn billing showback --start <yyyy-mm-dd> --end <yyyy-mm-dd> [--json]" : null;
+      return extra.length
+        ? "Usage: ornn billing showback --start <yyyy-mm-dd> --end <yyyy-mm-dd> [--json]"
+        : null;
     }
     return "Usage: ornn billing summary|invoices|showback|open";
   }
 
   if (command === "ssh-keys") {
-    const parsed = parseHelpArgs(args, { booleanOptions: ["--json"], valueOptions: ["--label", "--public-key", "--public-key-file"] });
+    const parsed = parseHelpArgs(args, {
+      booleanOptions: ["--json"],
+      valueOptions: ["--label", "--public-key", "--public-key-file"],
+    });
     if (parsed.error) {
       return parsed.error;
     }
@@ -1056,13 +1204,7 @@ function validateHelpInvocation(command, args) {
     // handlers do the strict validation. Just surface parse errors here.
     const parsed = parseHelpArgs(args, {
       booleanOptions: ["--json", "--confirm", "--force"],
-      valueOptions: [
-        "--operator",
-        "--facility",
-        "--expires-in",
-        "--mode",
-        "--ip",
-      ],
+      valueOptions: ["--operator", "--facility", "--expires-in", "--mode", "--ip"],
     });
     return parsed.error || null;
   }
@@ -1180,7 +1322,9 @@ async function whoami(args, { env, fetchImpl, stderr, stdout }) {
     } else {
       stdout.write(`${formatUser(serverSession.user)}\n`);
       stdout.write(`Organization: ${serverSession.organization?.name || "none"}\n`);
-      stdout.write(`Tenant: ${serverSession.tenant?.company_name || serverSession.tenant?.id || "none"}\n`);
+      stdout.write(
+        `Tenant: ${serverSession.tenant?.company_name || serverSession.tenant?.id || "none"}\n`
+      );
       stdout.write(`Role: ${serverSession.role || "none"}\n`);
       stdout.write(`Approved: ${serverSession.routeState.isApproved ? "yes" : "no"}\n`);
     }
@@ -1228,7 +1372,9 @@ async function status(args, { env, fetchImpl, stdout }) {
 async function api(args, { env, fetchImpl, stdout }) {
   const [method, path, ...rest] = args;
   if (!method || !path) {
-    throw new Error("Usage: ornn api <get|post|patch|put|delete> <compute-path> [--data <json>] [--raw]");
+    throw new Error(
+      "Usage: ornn api <get|post|patch|put|delete> <compute-path> [--data <json>] [--raw]"
+    );
   }
   const normalizedMethod = method.toUpperCase();
   if (!["DELETE", "GET", "PATCH", "POST", "PUT"].includes(normalizedMethod)) {
@@ -1237,7 +1383,7 @@ async function api(args, { env, fetchImpl, stdout }) {
   const options = parseCommandOptions(
     rest,
     { boolean: ["raw", "json"], value: ["data"] },
-    "Usage: ornn api <get|post|patch|put|delete> <compute-path> [--data <json>] [--raw]",
+    "Usage: ornn api <get|post|patch|put|delete> <compute-path> [--data <json>] [--raw]"
   );
   const body = await readJsonOption(options.data);
   const response = await cliRequest({
@@ -1261,7 +1407,7 @@ async function availability(args, context) {
     const options = parseCommandOptions(
       [id, ...rest].filter(Boolean),
       { boolean: ["json"], value: ["facility", "gpu-type", "operator"] },
-      listUsage,
+      listUsage
     );
     const listings = await loadAvailabilityListings(context);
     const filtered = filterAvailabilityListings(listings, options);
@@ -1274,11 +1420,7 @@ async function availability(args, context) {
   }
 
   if (subcommand === "show" && id) {
-    const options = parseCommandOptions(
-      rest,
-      { boolean: ["json", "open"] },
-      showUsage,
-    );
+    const options = parseCommandOptions(rest, { boolean: ["json", "open"] }, showUsage);
     const listing = await resolveListing(id, context);
     if (options.json) {
       writeJson(context.stdout, listing);
@@ -1306,16 +1448,20 @@ async function buy(args, context) {
   const options = parseCommandOptions(
     rest,
     { boolean: ["json", "no-open"] },
-    "Usage: ornn buy <listing-id> [--no-open] [--json]",
+    "Usage: ornn buy <listing-id> [--no-open] [--json]"
   );
   const listing = await resolveListing(listingId, context);
 
-  const checkout = await openFabricPage(context, `/checkout?inventory=${encodeURIComponent(listing.id)}`, {
-    json: options.json,
-    label: "checkout",
-    noOpen: options.noOpen,
-    payload: { listing },
-  });
+  const checkout = await openFabricPage(
+    context,
+    `/checkout?inventory=${encodeURIComponent(listing.id)}`,
+    {
+      json: options.json,
+      label: "checkout",
+      noOpen: options.noOpen,
+      payload: { listing },
+    }
+  );
   if (!options.json) {
     writeCheckoutOpenResult(context.stdout, checkout, "Checkout");
   }
@@ -1331,7 +1477,7 @@ async function bid(args, context) {
     const options = parseCommandOptions(
       [id, ...rest].filter(Boolean),
       { boolean: ["json"], value: ["limit", "cursor"] },
-      `Usage: ornn ${commandName} list [--limit <1-500>] [--cursor <last-id>] [--json]`,
+      `Usage: ornn ${commandName} list [--limit <1-500>] [--cursor <last-id>] [--json]`
     );
     const { limit, cursor } = listPaginationOptions(options);
     const bids = await cliRequest({
@@ -1351,7 +1497,7 @@ async function bid(args, context) {
     const options = parseCommandOptions(
       rest,
       { boolean: ["json", "open"] },
-      `Usage: ornn ${commandName} show <bid-id> [--open] [--json]`,
+      `Usage: ornn ${commandName} show <bid-id> [--open] [--json]`
     );
     const found = await findBid(id, context);
     if (options.json) {
@@ -1373,13 +1519,22 @@ async function bid(args, context) {
       rest,
       {
         boolean: ["json", "no-open"],
-        value: ["bid-price-per-gpu-hour", "end-date", "gpu-count", "min-gpu-count", "price", "start-date"],
+        value: [
+          "bid-price-per-gpu-hour",
+          "end-date",
+          "gpu-count",
+          "min-gpu-count",
+          "price",
+          "start-date",
+        ],
       },
-      `Usage: ornn ${commandName} create <listing-id> --gpu-count <n> --min-gpu-count <n> --start-date <yyyy-mm-dd> --end-date <yyyy-mm-dd> --price <usd> [--no-open] [--json]`,
+      `Usage: ornn ${commandName} create <listing-id> --gpu-count <n> --min-gpu-count <n> --start-date <yyyy-mm-dd> --end-date <yyyy-mm-dd> --price <usd> [--no-open] [--json]`
     );
     const { endDate, startDate } = dateRangeOptions(options);
     const gpuCount = positiveIntegerOption(options.gpuCount, "--gpu-count");
-    const minGpuCount = optionProvided(options.minGpuCount) ? positiveIntegerOption(options.minGpuCount, "--min-gpu-count") : gpuCount;
+    const minGpuCount = optionProvided(options.minGpuCount)
+      ? positiveIntegerOption(options.minGpuCount, "--min-gpu-count")
+      : gpuCount;
     validateMinGpuCount(minGpuCount, gpuCount);
     const payload = {
       bid_price_per_gpu_hour: bidPriceOption(options),
@@ -1397,10 +1552,14 @@ async function bid(args, context) {
       fetchImpl: context.fetchImpl,
       method: "POST",
     });
-    const opened = await openFabricPage(context, `/checkout?bid=${encodeURIComponent(created.id)}`, {
-      label: "bid checkout",
-      noOpen: options.noOpen,
-    });
+    const opened = await openFabricPage(
+      context,
+      `/checkout?bid=${encodeURIComponent(created.id)}`,
+      {
+        label: "bid checkout",
+        noOpen: options.noOpen,
+      }
+    );
     if (options.json) {
       writeJson(context.stdout, { bid: created, opened: opened.opened, url: opened.url });
     } else {
@@ -1416,9 +1575,16 @@ async function bid(args, context) {
       rest,
       {
         boolean: ["json"],
-        value: ["bid-price-per-gpu-hour", "end-date", "gpu-count", "min-gpu-count", "price", "start-date"],
+        value: [
+          "bid-price-per-gpu-hour",
+          "end-date",
+          "gpu-count",
+          "min-gpu-count",
+          "price",
+          "start-date",
+        ],
       },
-      `Usage: ornn ${commandName} update <bid-id> --gpu-count <n> --min-gpu-count <n> --start-date <yyyy-mm-dd> --end-date <yyyy-mm-dd> --price <usd>`,
+      `Usage: ornn ${commandName} update <bid-id> --gpu-count <n> --min-gpu-count <n> --start-date <yyyy-mm-dd> --end-date <yyyy-mm-dd> --price <usd>`
     );
     const { endDate, startDate } = dateRangeOptions(options);
     const gpuCount = positiveIntegerOption(options.gpuCount, "--gpu-count");
@@ -1451,7 +1617,7 @@ async function bid(args, context) {
     const options = parseCommandOptions(
       rest,
       { boolean: ["json"] },
-      `Usage: ornn ${commandName} withdraw <bid-id> [--json]`,
+      `Usage: ornn ${commandName} withdraw <bid-id> [--json]`
     );
     const response = await cliRequest({
       endpoint: computeEndpoint(`/tenants/me/bids/${id}`),
@@ -1483,11 +1649,11 @@ async function reservationOp(subcommand, id, rest, context) {
       const options = parseCommandOptions(
         rest,
         { boolean: ["json"], value: ["tenant", "fleet"] },
-        listUsage,
+        listUsage
       );
       const tenant = await resolveCommerceTenant(
         requiredOption(options.tenant, "--tenant"),
-        context,
+        context
       );
       const fleetId = optionalStringOption(options.fleet);
       if (fleetId && !isUuid(fleetId)) {
@@ -1512,12 +1678,12 @@ async function reservationOp(subcommand, id, rest, context) {
           boolean: ["json"],
           value: ["tenant", "listing", "fleet", "start-at", "end-at", "price-per-gpu-hour"],
         },
-        createUsage,
+        createUsage
       );
       const tenant = await resolveFleetTenant(
         requiredOption(options.tenant, "--tenant"),
         context,
-        webOperatorRequest,
+        webOperatorRequest
       );
       const listingId = requiredOption(options.listing, "--listing");
       const fleetId = requiredOption(options.fleet, "--fleet");
@@ -1544,7 +1710,7 @@ async function reservationOp(subcommand, id, rest, context) {
         const price = optionalStringOption(options.pricePerGpuHour);
         if (!/^\d+(\.\d{1,6})?$/.test(price)) {
           throw new Error(
-            "--price-per-gpu-hour must be zero or a positive decimal with at most 6 decimal places.",
+            "--price-per-gpu-hour must be zero or a positive decimal with at most 6 decimal places."
           );
         }
         body.price_per_gpu_hr = price;
@@ -1599,7 +1765,7 @@ async function reservationOp(subcommand, id, rest, context) {
         boolean: ["json", "confirm"],
         value: ["target-tenant", "target-user", "node", "strategy"],
       },
-      usage,
+      usage
     );
     const targetTenant = optionalStringOption(options.targetTenant);
     if (!targetTenant) {
@@ -1649,7 +1815,7 @@ async function reservationOp(subcommand, id, rest, context) {
         boolean: ["json"],
         value: ["commerce-reservation", "target-tenant", "target-user", "network"],
       },
-      usage,
+      usage
     );
     const targetTenant = optionalStringOption(options.targetTenant);
     if (!targetTenant) {
@@ -1657,7 +1823,7 @@ async function reservationOp(subcommand, id, rest, context) {
     }
     const commerceReservationId = requiredOption(
       options.commerceReservation,
-      "--commerce-reservation",
+      "--commerce-reservation"
     );
     if (!isUuid(commerceReservationId)) {
       throw new Error("--commerce-reservation must be a UUID returned by Commerce.");
@@ -1710,7 +1876,7 @@ async function reservations(args, context) {
     const options = parseCommandOptions(
       [id, ...rest].filter(Boolean),
       { boolean: ["json"], value: ["status", "limit", "cursor"] },
-      `Usage: ornn ${commandName} list [--status <status>] [--limit <1-500>] [--cursor <last-id>] [--json]`,
+      `Usage: ornn ${commandName} list [--status <status>] [--limit <1-500>] [--cursor <last-id>] [--json]`
     );
     const { limit, cursor } = listPaginationOptions(options);
     const query = buildQuery({ status: options.status, limit, cursor });
@@ -1731,7 +1897,7 @@ async function reservations(args, context) {
     const options = parseCommandOptions(
       rest,
       { boolean: ["json", "open"] },
-      `Usage: ornn ${commandName} show <reservation-id> [--open] [--json]`,
+      `Usage: ornn ${commandName} show <reservation-id> [--open] [--json]`
     );
     const found = await findReservation(id, context);
     if (options.json) {
@@ -1752,18 +1918,22 @@ async function reservations(args, context) {
     const options = parseCommandOptions(
       rest,
       { boolean: ["json", "no-open"] },
-      `Usage: ornn ${commandName} checkout <reservation-id> [--no-open] [--json]`,
+      `Usage: ornn ${commandName} checkout <reservation-id> [--no-open] [--json]`
     );
     const found = await findReservation(id, context);
     if (found.status !== "pending_payment") {
       throw new Error("This reservation is not awaiting checkout.");
     }
-    const opened = await openFabricPage(context, `/checkout?reservation=${encodeURIComponent(id)}`, {
-      json: options.json,
-      label: "checkout",
-      noOpen: options.noOpen,
-      payload: { reservation: found },
-    });
+    const opened = await openFabricPage(
+      context,
+      `/checkout?reservation=${encodeURIComponent(id)}`,
+      {
+        json: options.json,
+        label: "checkout",
+        noOpen: options.noOpen,
+        payload: { reservation: found },
+      }
+    );
     if (!options.json) {
       writeCheckoutOpenResult(context.stdout, opened, "Reservation checkout");
     }
@@ -1783,7 +1953,10 @@ async function nodeOps(args, context) {
   }
 
   if (subcommand === "list") {
-    return await nodeOpList([id, ...rest].filter((value) => value !== undefined), context);
+    return await nodeOpList(
+      [id, ...rest].filter((value) => value !== undefined),
+      context
+    );
   }
 
   if (!id) {
@@ -1879,7 +2052,7 @@ async function nodeOpList(rest, context) {
   const options = parseCommandOptions(
     rest,
     { boolean: ["json"], value: ["operator", "facility"] },
-    nodeOpUsage("list"),
+    nodeOpUsage("list")
   );
   const query = new URLSearchParams();
   const operator = optionalStringOption(options.operator);
@@ -1899,13 +2072,16 @@ async function nodeOpList(rest, context) {
   });
   const rows = Array.isArray(nodesList) ? nodesList : [];
   if (options.json) {
-    writeJson(context.stdout, rows.map((node) => redactNodeSecrets(node)));
+    writeJson(
+      context.stdout,
+      rows.map((node) => redactNodeSecrets(node))
+    );
   } else if (!rows.length) {
     context.stdout.write("No nodes found.\n");
   } else {
     for (const node of rows) {
       context.stdout.write(
-        `${node?.id ?? "unknown"}  ${node?.k8s_node_name ?? ""}  ${node?.gpu_type ?? ""} x${node?.gpu_count ?? 0}  ${node?.status ?? ""}\n`,
+        `${node?.id ?? "unknown"}  ${node?.k8s_node_name ?? ""}  ${node?.gpu_type ?? ""} x${node?.gpu_count ?? 0}  ${node?.status ?? ""}\n`
       );
     }
   }
@@ -1930,7 +2106,7 @@ async function nodeRebootOp(subcommand, id, rest, context) {
     context.stdout.write(
       subcommand === "hard-reset"
         ? `Hard reset queued for node ${id} (storage/users wiped, keys re-pushed on reconnect; tenant keeps ownership).\n`
-        : `Reboot queued for node ${id} (storage and keys preserved).\n`,
+        : `Reboot queued for node ${id} (storage and keys preserved).\n`
     );
     writeOptionalStatusLine(context.stdout, "Instance", instanceId);
     writeOptionalStatusLine(context.stdout, "State", result?.state);
@@ -1944,7 +2120,7 @@ async function nodeOffGridOp(id, rest, context) {
   const options = parseCommandOptions(
     rest,
     { boolean: ["json"], value: ["reason"] },
-    nodeOpUsage("off-grid"),
+    nodeOpUsage("off-grid")
   );
   const reason = optionalStringOption(options.reason);
   const result = await operatorRequest({
@@ -1973,7 +2149,7 @@ async function nodeOnGridOp(id, rest, context) {
   const options = parseCommandOptions(
     rest,
     { boolean: ["json"], value: ["ssh-username", "ssh-port"] },
-    nodeOpUsage("on-grid"),
+    nodeOpUsage("on-grid")
   );
   const body = {};
   const sshUsername = optionalStringOption(options.sshUsername);
@@ -2006,7 +2182,7 @@ async function nodeTerminateOp(id, rest, context) {
   const options = parseCommandOptions(
     rest,
     { boolean: ["json", "force"], value: ["reason"] },
-    nodeOpUsage("terminate"),
+    nodeOpUsage("terminate")
   );
   const reason = optionalStringOption(options.reason) || "cli-terminate";
   const result = await operatorRequest({
@@ -2080,26 +2256,29 @@ async function resolveNodeInstanceId(nodeId, context) {
   const nodeRefs = new Set(
     [nodeId, node?.id, node?.k8s_node_name]
       .filter((value) => value !== null && value !== undefined && String(value) !== "")
-      .map(String),
+      .map(String)
   );
-  const matches = rows.filter(
-    (machine) =>
-      nodeRefs.has(String(machine?.machine_node_id ?? machine?.node_id ?? "")),
+  const matches = rows.filter((machine) =>
+    nodeRefs.has(String(machine?.machine_node_id ?? machine?.node_id ?? ""))
   );
   if (matches.length > 1) {
     throw new CliApiError(
-      `Multiple live machines found for node ${nodeId} (reservation ${reservationId}).`,
+      `Multiple live machines found for node ${nodeId} (reservation ${reservationId}).`
     );
   }
   const instanceId = matches[0]?.id;
   if (!instanceId) {
-    throw new CliApiError(`No live machine found for node ${nodeId} (reservation ${reservationId}).`);
+    throw new CliApiError(
+      `No live machine found for node ${nodeId} (reservation ${reservationId}).`
+    );
   }
   return instanceId;
 }
 
 function isUuid(value) {
-  return /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(String(value ?? ""));
+  return /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(
+    String(value ?? "")
+  );
 }
 
 async function resolveOperatorId(operatorFilter, context) {
@@ -2112,7 +2291,7 @@ async function resolveOperatorId(operatorFilter, context) {
     fetchImpl: context.fetchImpl,
   });
   const match = (Array.isArray(operators) ? operators : []).find(
-    (operator) => operator?.slug === operatorFilter,
+    (operator) => operator?.slug === operatorFilter
   );
   if (!match?.id) {
     throw new CliApiError(`No operator found for "${operatorFilter}".`);
@@ -2155,7 +2334,7 @@ async function operatorsList(args, context) {
   } else {
     for (const operator of rows) {
       context.stdout.write(
-        `${operator?.id ?? "unknown"}  ${operator?.slug ?? ""}  ${operator?.display_name ?? ""}\n`,
+        `${operator?.id ?? "unknown"}  ${operator?.slug ?? ""}  ${operator?.display_name ?? ""}\n`
       );
     }
   }
@@ -2187,7 +2366,7 @@ async function facilitiesList(args, context) {
   } else {
     for (const facility of rows) {
       context.stdout.write(
-        `${facility?.id ?? "unknown"}  ${facility?.slug ?? ""}  ${facility?.display_name ?? ""}  ${facility?.region ?? ""}\n`,
+        `${facility?.id ?? "unknown"}  ${facility?.slug ?? ""}  ${facility?.display_name ?? ""}  ${facility?.region ?? ""}\n`
       );
     }
   }
@@ -2198,7 +2377,11 @@ async function tokensCommand(args, context) {
   const usage = "Usage: ornn tokens list|create|revoke ...";
   const [subcommand, ...rest] = args;
   if (subcommand === "list" || subcommand === undefined) {
-    const options = parseCommandOptions(rest, { boolean: ["json"] }, "Usage: ornn tokens list [--json]");
+    const options = parseCommandOptions(
+      rest,
+      { boolean: ["json"] },
+      "Usage: ornn tokens list [--json]"
+    );
     const tokens = await operatorRequest({
       endpoint: "/enrollment/tokens",
       env: context.env,
@@ -2212,7 +2395,7 @@ async function tokensCommand(args, context) {
     } else {
       for (const token of rows) {
         context.stdout.write(
-          `${token?.id ?? "unknown"}  ${token?.status ?? ""}  operator=${token?.operator_id ?? ""}  expires=${token?.expires_at ?? ""}\n`,
+          `${token?.id ?? "unknown"}  ${token?.status ?? ""}  operator=${token?.operator_id ?? ""}  expires=${token?.expires_at ?? ""}\n`
         );
       }
     }
@@ -2228,7 +2411,7 @@ async function tokensCommand(args, context) {
         boolean: ["json", "force"],
         value: ["operator", "facility", "expires-in", "mode", "ip"],
       },
-      createUsage,
+      createUsage
     );
     const operatorFilter = optionalStringOption(options.operator);
     if (!operatorFilter) {
@@ -2270,7 +2453,7 @@ async function tokensCommand(args, context) {
         context.stdout.write(`Install command:\n${installCommand}\n`);
       } else {
         context.stdout.write(
-          "Install command unavailable: set ORNN_COMPUTE_BASE_URL / ORNN_INSTALLER_URL, or ORNN_AUTH_BASE_URL so the CLI can derive the compute origin.\n",
+          "Install command unavailable: set ORNN_COMPUTE_BASE_URL / ORNN_INSTALLER_URL, or ORNN_AUTH_BASE_URL so the CLI can derive the compute origin.\n"
         );
       }
     }
@@ -2338,6 +2521,21 @@ const FLEET_DEFAULT_PARALLEL = 4;
 const FLEET_DEFAULT_TIMEOUT_SECONDS = 600;
 const FLEET_RESULT_ERROR_MAX_LENGTH = 4000;
 const FLEET_MANAGEMENT_USERS = ["ubuntu", "admin", "ornn"];
+const FLEET_RUNNER_INPUT_MAX_BYTES = 64 * 1024 * 1024;
+const FLEET_RUNNER_OUTPUT_MAX_BYTES = 64 * 1024 * 1024;
+const FLEET_RUNNER_BOOTSTRAP = `import json
+import sys
+
+bundle = json.load(sys.stdin)
+runner = bundle.get("runner")
+argv = bundle.get("argv")
+if not isinstance(runner, str) or not runner:
+    raise RuntimeError("cleanup runner source is missing")
+if not isinstance(argv, list) or not all(isinstance(value, str) for value in argv):
+    raise RuntimeError("cleanup runner arguments are invalid")
+sys.argv = ["ornn-fleet-cleanup", *argv]
+exec(compile(runner, "<ornn-fleet-cleanup>", "exec"), {"__name__": "__main__"})
+`;
 
 function fleetAccountOptions(value, optionName) {
   if (!optionProvided(value)) return [];
@@ -2351,6 +2549,76 @@ function fleetAccountOptions(value, optionName) {
   return [...new Set(normalized)].sort();
 }
 
+function fleetManagementUserOption(value) {
+  if (!optionProvided(value)) return null;
+  const [user] = fleetAccountOptions(value, "--ssh-user");
+  if (user === "root") {
+    throw new Error("--ssh-user must be a non-root Linux account name.");
+  }
+  return user;
+}
+
+async function readFleetCleanupPolicy(pathValue) {
+  if (!optionProvided(pathValue)) return null;
+  const path = expandUserPath(optionalStringOption(pathValue));
+  let policy;
+  try {
+    policy = JSON.parse(await readFile(path, "utf8"));
+  } catch (error) {
+    throw new Error(`Could not read cleanup policy ${path}: ${fleetResultError(error)}`);
+  }
+  if (!policy || typeof policy !== "object" || Array.isArray(policy)) {
+    throw new Error("Cleanup policy must be a JSON object.");
+  }
+  if (policy.schema_version !== 1) {
+    throw new Error("Cleanup policy schema_version must be 1.");
+  }
+  const direct =
+    policy.resources && typeof policy.resources === "object" && !Array.isArray(policy.resources);
+  const perNode = policy.nodes && typeof policy.nodes === "object" && !Array.isArray(policy.nodes);
+  if (Boolean(direct) === Boolean(perNode)) {
+    throw new Error("Cleanup policy must contain exactly one of resources or nodes.");
+  }
+  return { path, policy };
+}
+
+function fleetRunnerInput(script, mode, args) {
+  const payload = JSON.stringify({ argv: [mode, ...args], runner: script });
+  if (Buffer.byteLength(payload, "utf8") > FLEET_RUNNER_INPUT_MAX_BYTES) {
+    throw new Error("Cleanup runner input exceeded the 64 MiB safety limit.");
+  }
+  return payload;
+}
+
+function fleetRunnerCommand(mode) {
+  return `sudo -n python3 -c ${shellQuote(FLEET_RUNNER_BOOTSTRAP)} -- ${mode} --`;
+}
+
+function cleanupPolicyForNode(loaded, node, nodeCount) {
+  if (!loaded) return null;
+  if (loaded.policy.resources) {
+    if (nodeCount !== 1) {
+      throw new Error(
+        "A direct resources policy can only be used for one node; use nodes keyed by IP for a fleet."
+      );
+    }
+    return loaded.policy;
+  }
+  const policy = loaded.policy.nodes[node.ip_address] || loaded.policy.nodes[node.id];
+  if (!policy) {
+    throw new Error(`Cleanup policy has no entry for ${node.ip_address}.`);
+  }
+  if (
+    policy.schema_version !== 1 ||
+    !policy.resources ||
+    typeof policy.resources !== "object" ||
+    Array.isArray(policy.resources)
+  ) {
+    throw new Error(`Cleanup policy entry for ${node.ip_address} is invalid.`);
+  }
+  return policy;
+}
+
 async function fleet(args, context) {
   const [subcommand, ...rest] = args;
   if (subcommand === "clean") {
@@ -2362,12 +2630,75 @@ async function fleet(args, context) {
   if (subcommand === "deploy") {
     return await fleetDeploy(rest, context);
   }
-  throw new Error("Usage: ornn fleet clean|enroll|deploy");
+  if (subcommand === "delete") {
+    return await fleetDelete(rest, context);
+  }
+  throw new Error("Usage: ornn fleet clean|enroll|deploy|delete");
+}
+
+async function fleetDelete(args, context) {
+  const usage = "Usage: ornn fleet delete <fleet-id> --confirm-delete <fleet-id> [--json]";
+  const { options, positionals } = parseOptions(args, {
+    boolean: ["json"],
+    value: ["confirm-delete"],
+  });
+  if (positionals.length !== 1) {
+    throw new Error(usage);
+  }
+  const fleetId = positionals[0];
+  if (!isUuid(fleetId)) {
+    throw new Error("<fleet-id> must be a UUID.");
+  }
+  const confirmation = requiredOption(options.confirmDelete, "--confirm-delete");
+  if (confirmation !== fleetId) {
+    throw new Error("--confirm-delete must exactly match <fleet-id>.");
+  }
+
+  const preview = await operatorRequest({
+    endpoint: `/internal/fleets/${encodeURIComponent(fleetId)}`,
+    env: context.env,
+    fetchImpl: context.fetchImpl,
+  });
+  if (String(preview?.id || "") !== fleetId) {
+    throw new Error("Fleet lookup returned a different fleet id; deletion stopped.");
+  }
+  const manifestPath = await saveFleetManifest(
+    {
+      ...preview,
+      deletion: { requested_at: new Date().toISOString(), status: "requested" },
+    },
+    context.env
+  );
+  const result = await operatorRequest({
+    body: { confirm_fleet_id: confirmation },
+    endpoint: `/internal/fleets/${encodeURIComponent(fleetId)}`,
+    env: context.env,
+    fetchImpl: context.fetchImpl,
+    method: "DELETE",
+  });
+  const archived = {
+    ...(result?.fleet || preview),
+    deletion: {
+      deleted_at: result?.deleted_at || new Date().toISOString(),
+      status: "deleted",
+    },
+  };
+  await saveFleetManifest(archived, context.env);
+  if (options.json) {
+    writeJson(context.stdout, { ...result, audit_manifest: manifestPath });
+  } else {
+    context.stdout.write(`Deleted fleet ${fleetId}.\n`);
+    context.stdout.write(
+      `Released members: ${Array.isArray(archived.nodes) ? archived.nodes.length : 0}\n`
+    );
+    context.stdout.write(`Audit manifest: ${manifestPath}\n`);
+  }
+  return 0;
 }
 
 async function fleetClean(args, context) {
   const usage =
-    "Usage: ornn fleet clean <ip>... --operator <id-or-slug> --ib-island <name> --identity-file <path> --dry-run [--source-user <user>]... [--preserve-user <user>]... [--ssh-user ubuntu|admin|ornn] OR ornn fleet clean <failed-fleet-id> --identity-file <path> --dry-run [--source-user <user>]... [--preserve-user <user>]... OR ornn fleet clean <fleet-id> --identity-file <path> --confirm-clean <plan-hash> [--source-user <user>]... [--preserve-user <user>]...";
+    "Usage: ornn fleet clean <ip>... --operator <id-or-slug> --ib-island <name> --identity-file <path> --dry-run [--policy <path>] [--policy-out <path>] [--ssh-user <non-root-linux-user>] OR ornn fleet clean <fleet-id> --identity-file <path> --dry-run [--policy <path>] [--policy-out <path>] OR ornn fleet clean <fleet-id> --identity-file <path> --confirm-clean <plan-hash>";
   const { options, positionals } = parseOptions(args, {
     boolean: ["dry-run", "json"],
     value: [
@@ -2375,6 +2706,8 @@ async function fleetClean(args, context) {
       "ib-island",
       "identity-file",
       "confirm-clean",
+      "policy",
+      "policy-out",
       "source-user",
       "preserve-user",
       "ssh-user",
@@ -2402,33 +2735,58 @@ async function fleetClean(args, context) {
     : FLEET_DEFAULT_TIMEOUT_SECONDS;
   const sourceUsers = fleetAccountOptions(options.sourceUser, "--source-user");
   const preserveUsers = fleetAccountOptions(options.preserveUser, "--preserve-user");
+  const loadedPolicy = await readFleetCleanupPolicy(options.policy);
+  const policyOut = optionProvided(options.policyOut)
+    ? expandUserPath(optionalStringOption(options.policyOut))
+    : null;
   const accountOverlap = sourceUsers.filter((user) => preserveUsers.includes(user));
   if (accountOverlap.length) {
     throw new Error(`Users cannot be both source and preserved: ${accountOverlap.join(", ")}.`);
   }
+  if (loadedPolicy && (sourceUsers.length || preserveUsers.length)) {
+    throw new Error("Use either --policy or the legacy user shortcuts, not both.");
+  }
   const confirmHash = optionalStringOption(options.confirmClean);
   if (confirmHash) {
-    if (positionals.length !== 1 || options.dryRun || options.operator || options.ibIsland) {
+    if (
+      positionals.length !== 1 ||
+      options.dryRun ||
+      options.operator ||
+      options.ibIsland ||
+      loadedPolicy ||
+      policyOut ||
+      sourceUsers.length ||
+      preserveUsers.length
+    ) {
       throw new Error(usage);
     }
     if (!/^[0-9a-f]{64}$/.test(confirmHash)) {
       throw new Error("--confirm-clean must be the exact 64-character cleanup plan hash.");
     }
     const fleetId = positionals[0];
-    const approved = await operatorRequest({
-      body: {
-        plan_hash: confirmHash,
-        source_users: sourceUsers,
-        preserve_users: preserveUsers,
-      },
-      endpoint: `/internal/fleets/${encodeURIComponent(fleetId)}/cleanup/approve`,
-      env: context.env,
-      fetchImpl: context.fetchImpl,
-      method: "POST",
-    });
+    let approved;
+    try {
+      approved = await operatorRequest({
+        body: {
+          plan_hash: confirmHash,
+        },
+        endpoint: `/internal/fleets/${encodeURIComponent(fleetId)}/cleanup/approve`,
+        env: context.env,
+        fetchImpl: context.fetchImpl,
+        method: "POST",
+      });
+    } catch (error) {
+      if (error instanceof CliApiError && error.detail?.detail === "cleanup_plan_replan_required") {
+        throw new Error(
+          `Fleet ${fleetId} has a legacy cleanup plan that the current runner cannot safely execute. Re-run the same fleet with --dry-run, review the generated resource policy, then approve the new plan hash.`
+        );
+      }
+      throw error;
+    }
     context.stderr.write(`Cleaning ${approved.nodes.length} node(s)...\n`);
     const results = await mapLimit(approved.nodes, parallel, async (node) => {
       let cleanupResult;
+      let partialEvidence = null;
       try {
         const preCanary = await runFleetSsh({
           context,
@@ -2450,24 +2808,36 @@ async function fleetClean(args, context) {
           timeoutSeconds: Math.min(timeoutSeconds, 30),
           user: node.ssh_user,
         });
-        const encodedPlan = Buffer.from(JSON.stringify(node.plan), "utf8").toString("base64");
         let result;
-        let duringCanaryChecks = 0;
+        let duringCanary = { failedChecks: 0, successfulChecks: 0 };
         try {
           result = await runFleetSshCapture({
             context,
             identityFile,
             ip: node.ip_address,
             port: sshPort,
-            remoteCommand: `sudo -n python3 - execute --management-ip ${node.ip_address} --management-user ${node.ssh_user} --management-public-key-b64 ${managementPublicKeyB64} --approved-plan-b64 ${encodedPlan}`,
-            stdin: approved.script,
+            remoteCommand: fleetRunnerCommand("execute"),
+            stdin: fleetRunnerInput(approved.script, "execute", [
+              "--management-ip",
+              node.ip_address,
+              "--management-user",
+              node.ssh_user,
+              "--management-public-key-b64",
+              managementPublicKeyB64,
+              "--approved-plan-b64",
+              Buffer.from(JSON.stringify(node.plan), "utf8").toString("base64"),
+            ]),
             timeoutSeconds,
             user: node.ssh_user,
           });
         } finally {
-          duringCanaryChecks = await stopCanary();
+          duringCanary = await stopCanary();
+        }
+        if (result.exitCode === 124) {
+          throw new Error(`cleanup_execution_deferred: ${result.stderr}`);
         }
         const payload = fleetCleanupJson(result.stdout);
+        partialEvidence = payload.partial_evidence || null;
         if (result.exitCode !== 0 || !payload.evidence) {
           throw new Error(payload.error || result.stderr || "Cleanup failed.");
         }
@@ -2485,7 +2855,8 @@ async function fleetClean(args, context) {
         }
         payload.evidence.management_ssh_canary = {
           before: true,
-          during_checks: duringCanaryChecks,
+          during_checks: duringCanary.successfulChecks,
+          during_failures: duringCanary.failedChecks,
           after: true,
         };
         cleanupResult = {
@@ -2498,7 +2869,12 @@ async function fleetClean(args, context) {
         cleanupResult = {
           cleanup_run_id: node.cleanup_run_id,
           succeeded: false,
-          ...(message.includes("cleanup_already_running") ? { deferred: true } : {}),
+          ...(partialEvidence ? { evidence: partialEvidence } : {}),
+          ...(/cleanup_already_running|cleanup_execution_deferred|SSH command timed out/i.test(
+            message
+          )
+            ? { deferred: true }
+            : {}),
           error: message,
         };
       }
@@ -2526,10 +2902,7 @@ async function fleetClean(args, context) {
   if (options.dryRun !== true) {
     throw new Error("--dry-run is required before destructive cleanup.");
   }
-  const requestedUser = optionalStringOption(options.sshUser);
-  if (requestedUser && !FLEET_MANAGEMENT_USERS.includes(requestedUser)) {
-    throw new Error(`--ssh-user must be one of ${FLEET_MANAGEMENT_USERS.join(", ")}.`);
-  }
+  const requestedUser = fleetManagementUserOption(options.sshUser);
   const existingFleetId =
     positionals.length === 1 && isUuid(positionals[0]) && !options.operator && !options.ibIsland
       ? positionals[0]
@@ -2543,12 +2916,16 @@ async function fleetClean(args, context) {
       env: context.env,
       fetchImpl: context.fetchImpl,
     });
-    if (fleetRecord.status !== "failed") {
-      throw new Error("Only a failed fleet can be replanned; resume an approved cleanup with --confirm-clean.");
+    if (!["failed", "cleaning"].includes(fleetRecord.status)) {
+      throw new Error("Only a failed or still-planning fleet can be replanned.");
     }
-    planningNodes = fleetRecord.nodes.filter((node) => node.status === "failed");
+    planningNodes = fleetRecord.nodes.filter((node) =>
+      fleetRecord.status === "failed"
+        ? node.status === "failed"
+        : ["pending_clean", "clean_planned"].includes(node.status)
+    );
     if (!planningNodes.length) {
-      throw new Error("This fleet has no failed cleanup members to replan.");
+      throw new Error("This fleet has no cleanup members eligible for replanning.");
     }
   } else {
     const ips = uniqueFleetIps(positionals);
@@ -2585,17 +2962,30 @@ async function fleetClean(args, context) {
           requestedUser: requestedUser || node.ssh_user || null,
           timeoutSeconds: Math.min(timeoutSeconds, 30),
         });
-        const accountArguments = [
-          ...sourceUsers.map((user) => `--source-user ${shellQuote(user)}`),
-          ...preserveUsers.map((user) => `--preserve-user ${shellQuote(user)}`),
-        ].join(" ");
+        const runnerArguments = [
+          "--management-ip",
+          node.ip_address,
+          "--management-user",
+          sshUser,
+          "--management-public-key-b64",
+          managementPublicKeyB64,
+          ...sourceUsers.flatMap((user) => ["--source-user", user]),
+          ...preserveUsers.flatMap((user) => ["--preserve-user", user]),
+        ];
+        const nodePolicy = cleanupPolicyForNode(loadedPolicy, node, planningNodes.length);
+        if (nodePolicy) {
+          runnerArguments.push(
+            "--policy-b64",
+            Buffer.from(JSON.stringify(nodePolicy), "utf8").toString("base64")
+          );
+        }
         const result = await runFleetSshCapture({
           context,
           identityFile,
           ip: node.ip_address,
           port: sshPort,
-          remoteCommand: `sudo -n python3 - plan --management-ip ${node.ip_address} --management-user ${sshUser} --management-public-key-b64 ${managementPublicKeyB64}${accountArguments ? ` ${accountArguments}` : ""}`,
-          stdin: runner.script,
+          remoteCommand: fleetRunnerCommand("plan"),
+          stdin: fleetRunnerInput(runner.script, "plan", runnerArguments),
           timeoutSeconds,
           user: sshUser,
         });
@@ -2604,6 +2994,9 @@ async function fleetClean(args, context) {
           throw new Error(payload.error || result.stderr || "Cleanup plan failed.");
         }
         return {
+          ip: node.ip_address,
+          observations: payload.observations || {},
+          policyTemplate: payload.policy_template,
           plan: {
             fleet_node_id: node.id,
             ssh_user: sshUser,
@@ -2618,10 +3011,24 @@ async function fleetClean(args, context) {
     const planFailures = planned.filter((result) => result.error);
     if (planFailures.length) {
       throw new Error(
-        `Cleanup planning failed: ${planFailures.map((result) => `${result.ip}: ${result.error}`).join("; ")}`,
+        `Cleanup planning failed: ${planFailures.map((result) => `${result.ip}: ${result.error}`).join("; ")}`
       );
     }
     const plans = planned.map((result) => result.plan);
+    const policyTemplate = {
+      schema_version: 1,
+      nodes: { ...(loadedPolicy?.policy?.nodes || {}) },
+    };
+    const observations = {};
+    for (const result of [...planned].sort((left, right) => left.ip.localeCompare(right.ip))) {
+      policyTemplate.nodes[result.ip] = result.policyTemplate;
+      observations[result.ip] = result.observations;
+    }
+    const savedPolicyPath =
+      policyOut || join(getFleetConfigDir(context.env), `${fleetRecord.id}.cleanup-policy.json`);
+    await writePrivateJsonAtomic(savedPolicyPath, policyTemplate, {
+      privateDirectory: !policyOut,
+    });
     recorded = await operatorRequest({
       body: { nodes: plans },
       endpoint: `/internal/fleets/${encodeURIComponent(fleetRecord.id)}/cleanup/plans`,
@@ -2629,10 +3036,15 @@ async function fleetClean(args, context) {
       fetchImpl: context.fetchImpl,
       method: "POST",
     });
+    recorded.policy_template = policyTemplate;
+    recorded.observations = observations;
+    recorded.policy_file = savedPolicyPath;
   } catch (error) {
     const planningError = fleetResultError(error);
     if (!createdFleet) {
-      throw new Error(`${planningError} Fleet ${fleetRecord.id} remains failed and can be replanned.`);
+      throw new Error(
+        `${planningError} Fleet ${fleetRecord.id} can be replanned after correction.`
+      );
     }
     let failedFleet;
     try {
@@ -2645,14 +3057,14 @@ async function fleetClean(args, context) {
       });
     } catch (abortError) {
       throw new Error(
-        `${planningError} Fleet ${fleetRecord.id} could not be marked failed: ${fleetResultError(abortError)}`,
+        `${planningError} Fleet ${fleetRecord.id} could not be marked failed: ${fleetResultError(abortError)}`
       );
     }
     try {
       await saveFleetManifest(failedFleet, context.env);
     } catch (manifestError) {
       throw new Error(
-        `${planningError} Fleet ${fleetRecord.id} was marked failed, but its local manifest could not be saved: ${fleetResultError(manifestError)}`,
+        `${planningError} Fleet ${fleetRecord.id} was marked failed, but its local manifest could not be saved: ${fleetResultError(manifestError)}`
       );
     }
     if (options.json) {
@@ -2673,14 +3085,44 @@ async function fleetClean(args, context) {
       }
     }
     context.stdout.write(`Cleanup plan: ${recorded.plan_hash}\n`);
-    context.stdout.write(
-      `Approve exactly this plan with: ornn fleet clean ${fleetRecord.id} --identity-file ${shellQuote(identityFile)} --confirm-clean ${recorded.plan_hash}${sourceUsers.map((user) => ` --source-user ${shellQuote(user)}`).join("")}${preserveUsers.map((user) => ` --preserve-user ${shellQuote(user)}`).join("")}\n`
+    context.stdout.write(`Policy template: ${recorded.policy_file}\n`);
+    const unresolved = recorded.fleet.nodes.reduce(
+      (count, node) => count + (node.cleanup?.plan?.unresolved?.length || 0),
+      0
     );
+    const conflicts = recorded.fleet.nodes.reduce(
+      (count, node) => count + (node.cleanup?.plan?.conflicts?.length || 0),
+      0
+    );
+    if (unresolved || conflicts) {
+      context.stdout.write(
+        `Decisions required: ${unresolved}; policy conflicts: ${conflicts}. Edit the policy template and re-run the dry-run for fleet ${fleetRecord.id}.\n`
+      );
+    } else {
+      context.stdout.write(
+        `Approve exactly this plan with: ornn fleet clean ${fleetRecord.id} --identity-file ${shellQuote(identityFile)} --confirm-clean ${recorded.plan_hash}\n`
+      );
+    }
   }
   return 0;
 }
 
 async function fleetEnroll(args, context) {
+  const usage =
+    "Usage: ornn fleet enroll <fleet-id> --identity-file <path> [--confirm-takeover <ip[,ip...]>] [--ssh-port <port>] [--parallel <n>] [--timeout <seconds>] [--json]";
+  const { positionals } = parseOptions(args, {
+    boolean: ["json"],
+    value: ["identity-file", "confirm-takeover", "ssh-port", "parallel", "timeout"],
+  });
+  if (positionals.length !== 1) {
+    throw new Error(usage);
+  }
+  return await withFleetEnrollmentLock(positionals[0], context.env, async () =>
+    fleetEnrollLocked(args, context)
+  );
+}
+
+async function fleetEnrollLocked(args, context) {
   const usage =
     "Usage: ornn fleet enroll <fleet-id> --identity-file <path> [--confirm-takeover <ip[,ip...]>] [--ssh-port <port>] [--parallel <n>] [--timeout <seconds>] [--json]";
   const { options, positionals } = parseOptions(args, {
@@ -2710,24 +3152,269 @@ async function fleetEnroll(args, context) {
   });
   const ips = fleetPreview.nodes.map((node) => String(node.ip_address));
   const takeoverIps = fleetTakeoverIps(options.confirmTakeover, ips);
-  const enrollmentAttemptId = randomUUID();
+  if (
+    fleetPreview.status === "enrolled" &&
+    fleetPreview.nodes.length > 0 &&
+    fleetPreview.nodes.every((member) => member.status === "enrolled")
+  ) {
+    await saveFleetManifest(fleetPreview, context.env);
+    writeFleetRecord(context, fleetPreview, options.json);
+    return 0;
+  }
+  const session = await loadAuthSession({ env: context.env }).catch(() => null);
+  const installerBase = resolveInstallerBaseUrl({ env: context.env, session });
+  if (!installerBase) {
+    throw new Error("Installer URL is unavailable.");
+  }
+  const leaseExpiry = Date.parse(String(fleetPreview.enrollment_lease_expires_at || ""));
+  const resumingActiveAttempt =
+    fleetPreview.status === "enrolling" &&
+    isUuid(fleetPreview.enrollment_attempt_id) &&
+    Number.isFinite(leaseExpiry) &&
+    leaseExpiry > Date.now();
+  const priorManifest = await loadFleetManifest(fleetId, context.env);
+  const manifestExecutorToken = resumingActiveAttempt
+    ? String(priorManifest?.enrollment_executor_token || "")
+    : "";
+  const serverRotationId = resumingActiveAttempt
+    ? String(fleetPreview.enrollment_executor_rotation_id || "")
+    : "";
+  const manifestRotationId = resumingActiveAttempt
+    ? String(priorManifest?.enrollment_executor_rotation_id || "")
+    : "";
+  const pendingPriorRotationId = resumingActiveAttempt
+    ? String(priorManifest?.enrollment_prior_executor_rotation_id || "")
+    : "";
+  const pendingPriorToken = String(priorManifest?.enrollment_prior_executor_token || "");
+  if (
+    resumingActiveAttempt &&
+    (priorManifest?.enrollment_attempt_id !== fleetPreview.enrollment_attempt_id ||
+      manifestExecutorToken.length < 32 ||
+      !isUuid(serverRotationId) ||
+      !isUuid(manifestRotationId))
+  ) {
+    throw new Error(
+      "This enrollment lease is owned by another CLI executor. Resume it from the private manifest that started the attempt, or wait for the lease to expire."
+    );
+  }
+  const enrollmentAttemptId = resumingActiveAttempt
+    ? fleetPreview.enrollment_attempt_id
+    : randomUUID();
+  let priorExecutorToken = null;
+  if (resumingActiveAttempt) {
+    if (serverRotationId === manifestRotationId) {
+      priorExecutorToken = manifestExecutorToken;
+    } else if (serverRotationId === pendingPriorRotationId && pendingPriorToken.length >= 32) {
+      priorExecutorToken = pendingPriorToken;
+    } else {
+      throw new Error(
+        "The enrollment executor rotation changed outside this private manifest. Refusing to share or guess ownership of the active lease."
+      );
+    }
+  }
+  const enrollmentExecutorToken = `${randomUUID()}${randomUUID()}`;
+  const enrollmentExecutorRotationId = randomUUID();
+  const managementPublicKey = await deriveFleetManagementPublicKey({ context, identityFile });
+  const pendingMemberCount = fleetPreview.nodes.filter(
+    (member) => member.status !== "enrolled"
+  ).length;
+  const fleetBatches = Math.max(1, Math.ceil(pendingMemberCount / parallel));
+  const leaseSeconds = (fleetBatches * 2 + 2) * timeoutSeconds + 600;
+  if (leaseSeconds > 86400) {
+    throw new Error(
+      "The requested fleet size, parallelism, and timeout need an enrollment lease longer than 24 hours. Increase --parallel, reduce --timeout, or split the fleet."
+    );
+  }
+  await saveFleetManifest(
+    {
+      ...fleetPreview,
+      enrollment_attempt_id: enrollmentAttemptId,
+      enrollment_executor_token: enrollmentExecutorToken,
+      enrollment_executor_rotation_id: enrollmentExecutorRotationId,
+      ...(priorExecutorToken ? { enrollment_prior_executor_token: priorExecutorToken } : {}),
+      ...(serverRotationId ? { enrollment_prior_executor_rotation_id: serverRotationId } : {}),
+      enrollment_state: "starting",
+    },
+    context.env
+  );
   const fleetRecord = await operatorRequest({
     body: {
       attempt_id: enrollmentAttemptId,
-      lease_seconds: Math.min(timeoutSeconds * 2 + 300, 86400),
+      rotation_id: enrollmentExecutorRotationId,
+      executor_token: enrollmentExecutorToken,
+      lease_seconds: leaseSeconds,
+      ...(priorExecutorToken ? { prior_executor_token: priorExecutorToken } : {}),
     },
     endpoint: `/internal/fleets/${encodeURIComponent(fleetId)}/enrollment/start`,
     env: context.env,
     fetchImpl: context.fetchImpl,
     method: "POST",
   });
-  const session = await loadAuthSession({ env: context.env }).catch(() => null);
-  const installerBase = resolveInstallerBaseUrl({ env: context.env, session });
-  if (!installerBase) {
-    throw new Error("Installer URL is unavailable.");
+  if (String(fleetRecord.enrollment_executor_rotation_id || "") !== enrollmentExecutorRotationId) {
+    throw new Error(
+      "Enrollment start returned a different executor rotation; refusing to proceed."
+    );
+  }
+  await saveFleetManifest(
+    {
+      ...fleetRecord,
+      enrollment_executor_token: enrollmentExecutorToken,
+      enrollment_executor_rotation_id: enrollmentExecutorRotationId,
+    },
+    context.env
+  );
+  const enrollingMembers = fleetRecord.nodes.filter((member) => member.status === "enrolling");
+  const recoveredNodesByMemberId = new Map();
+  if (resumingActiveAttempt && enrollingMembers.length) {
+    const rows = await operatorRequest({
+      endpoint: `/provisioning/nodes?operator_id=${encodeURIComponent(fleetRecord.operator_id)}`,
+      env: context.env,
+      fetchImpl: context.fetchImpl,
+    });
+    const candidatesByIp = fleetNodesByIp(
+      rows,
+      enrollingMembers.map((member) => String(member.ip_address))
+    );
+    for (const member of enrollingMembers) {
+      const node = candidatesByIp.get(String(member.ip_address));
+      const labels = node?.labels && typeof node.labels === "object" ? node.labels : {};
+      if (
+        node &&
+        labels["ornn.ai/fleet-enrollment-attempt"] === enrollmentAttemptId &&
+        labels["ornn.ai/fleet-node-id"] === member.id &&
+        String(node.hardware_fingerprint || "") === String(member.hardware_fingerprint || "")
+      ) {
+        recoveredNodesByMemberId.set(member.id, node);
+      }
+    }
+  }
+  const verificationMembers = enrollingMembers.filter(
+    (member) => !recoveredNodesByMemberId.has(member.id)
+  );
+  const cleanupRunner = verificationMembers.length
+    ? await operatorRequest({
+        endpoint: `/internal/fleets/${encodeURIComponent(fleetId)}/cleanup-runner`,
+        env: context.env,
+        fetchImpl: context.fetchImpl,
+      })
+    : null;
+  let verificationResults;
+  try {
+    verificationResults = await mapLimit(verificationMembers, parallel, async (member) => {
+      const plan = member.cleanup?.plan;
+      if (member.cleanup?.status !== "succeeded" || !plan) {
+        throw new Error(`Node ${member.ip_address} has no completed cleanup plan to verify.`);
+      }
+      if (plan.management_public_key !== managementPublicKey) {
+        throw new Error(
+          `Node ${member.ip_address} cleanup proof is bound to a different management key.`
+        );
+      }
+      const verificationArguments = [
+        "--management-ip",
+        String(member.ip_address),
+        "--management-user",
+        member.ssh_user,
+        "--management-public-key-b64",
+        Buffer.from(plan.management_public_key, "utf8").toString("base64"),
+        "--approved-plan-b64",
+        Buffer.from(JSON.stringify(plan), "utf8").toString("base64"),
+        "--verification-challenge",
+        enrollmentAttemptId,
+      ];
+      const before = await runFleetSsh({
+        context,
+        identityFile,
+        ip: String(member.ip_address),
+        port: sshPort,
+        remoteCommand: "sudo -n true",
+        timeoutSeconds: Math.min(timeoutSeconds, 30),
+        user: member.ssh_user,
+      });
+      if (before !== 0) {
+        throw new Error(`Node ${member.ip_address} failed the pre-enrollment SSH canary.`);
+      }
+      const stopCanary = startFleetSshCanary({
+        context,
+        identityFile,
+        ip: String(member.ip_address),
+        port: sshPort,
+        timeoutSeconds: Math.min(timeoutSeconds, 30),
+        user: member.ssh_user,
+      });
+      let verification;
+      let duringCanary;
+      try {
+        verification = await runFleetSshCapture({
+          context,
+          identityFile,
+          ip: String(member.ip_address),
+          port: sshPort,
+          remoteCommand: fleetRunnerCommand("verify"),
+          stdin: fleetRunnerInput(cleanupRunner.script, "verify", verificationArguments),
+          timeoutSeconds,
+          user: member.ssh_user,
+        });
+      } finally {
+        duringCanary = await stopCanary();
+      }
+      const payload = fleetCleanupJson(verification.stdout);
+      if (verification.exitCode !== 0 || !payload.evidence?.receipt_live_revalidated) {
+        throw new Error(
+          `Node ${member.ip_address} cleanup proof is stale: ${payload.error || verification.stderr || "live verification failed"}`
+        );
+      }
+      if (payload.evidence.verification_challenge !== enrollmentAttemptId) {
+        throw new Error(`Node ${member.ip_address} returned the wrong verification challenge.`);
+      }
+      if (duringCanary.failedChecks !== 0 || duringCanary.successfulChecks < 1) {
+        throw new Error(
+          `Node ${member.ip_address} management SSH was not continuously reachable during verification.`
+        );
+      }
+      const after = await runFleetSsh({
+        context,
+        identityFile,
+        ip: String(member.ip_address),
+        port: sshPort,
+        remoteCommand: "sudo -n true",
+        timeoutSeconds: Math.min(timeoutSeconds, 30),
+        user: member.ssh_user,
+      });
+      if (after !== 0) {
+        throw new Error(`Node ${member.ip_address} failed the post-verification SSH canary.`);
+      }
+      payload.evidence.management_ssh_canary = {
+        before: true,
+        during_checks: duringCanary.successfulChecks,
+        during_failures: duringCanary.failedChecks,
+        after: true,
+      };
+      return {
+        cleanup_run_id: member.cleanup.id,
+        evidence: payload.evidence,
+      };
+    });
+  } catch (error) {
+    throw error;
+  }
+  if (verificationResults.length) {
+    await operatorRequest({
+      body: {
+        attempt_id: enrollmentAttemptId,
+        executor_token: enrollmentExecutorToken,
+        nodes: verificationResults,
+      },
+      endpoint: `/internal/fleets/${encodeURIComponent(fleetId)}/cleanup/verification`,
+      env: context.env,
+      fetchImpl: context.fetchImpl,
+      method: "POST",
+    });
   }
-  const enrollmentMembers = fleetRecord.nodes.filter((member) => member.status === "enrolling");
-  const installed = await mapLimit(enrollmentMembers, parallel, async (member) => {
+  const installationMembers = enrollingMembers.filter(
+    (member) => !recoveredNodesByMemberId.has(member.id)
+  );
+  const installedNew = await mapLimit(installationMembers, parallel, async (member) => {
     let issuedToken = null;
     let outcome;
     try {
@@ -2735,7 +3422,9 @@ async function fleetEnroll(args, context) {
         body: {
           operator_id: fleetRecord.operator_id,
           fleet_node_id: member.id,
-          expires_in_seconds: Math.min(timeoutSeconds + 300, 86400),
+          enrollment_attempt_id: enrollmentAttemptId,
+          enrollment_executor_token: enrollmentExecutorToken,
+          expires_in_seconds: Math.min(timeoutSeconds * 2 + 300, 86400),
         },
         endpoint: "/enrollment/tokens",
         env: context.env,
@@ -2783,19 +3472,30 @@ async function fleetEnroll(args, context) {
     }
     return outcome;
   });
-  let nodesByIp = new Map();
+  const installed = [
+    ...enrollingMembers
+      .filter((member) => recoveredNodesByMemberId.has(member.id))
+      .map((member) => ({ member, ok: true })),
+    ...installedNew,
+  ];
+  let nodesByIp = new Map(
+    enrollingMembers
+      .filter((member) => recoveredNodesByMemberId.has(member.id))
+      .map((member) => [String(member.ip_address), recoveredNodesByMemberId.get(member.id)])
+  );
   let nodeDiscoveryError = null;
-  const installedIps = installed
+  const installedIps = installedNew
     .filter((result) => result.ok)
     .map((result) => String(result.member.ip_address));
   if (installedIps.length > 0) {
     try {
-      nodesByIp = await waitForFleetNodes({
+      const discovered = await waitForFleetNodes({
         context,
         ips: installedIps,
         operatorId: fleetRecord.operator_id,
         timeoutSeconds,
       });
+      nodesByIp = new Map([...nodesByIp, ...discovered]);
     } catch (error) {
       nodeDiscoveryError = formatCliError(error);
     }
@@ -2849,7 +3549,11 @@ async function fleetEnroll(args, context) {
     }
   });
   const completed = await operatorRequest({
-    body: { attempt_id: enrollmentAttemptId, nodes: results },
+    body: {
+      attempt_id: enrollmentAttemptId,
+      executor_token: enrollmentExecutorToken,
+      nodes: results,
+    },
     endpoint: `/internal/fleets/${encodeURIComponent(fleetId)}/enrollment/results`,
     env: context.env,
     fetchImpl: context.fetchImpl,
@@ -2871,7 +3575,7 @@ async function fleetDeploy(args, context) {
   const fleetId = positionals[0];
   const commerceReservationId = requiredOption(
     options.commerceReservation,
-    "--commerce-reservation",
+    "--commerce-reservation"
   );
   if (!isUuid(commerceReservationId)) {
     throw new Error("--commerce-reservation must be a UUID returned by Commerce.");
@@ -2894,14 +3598,10 @@ async function fleetDeploy(args, context) {
       : null;
   if (!targetUser) {
     throw new Error(
-      `Tenant ${tenant.email} has no primary administrator. Provide --user after fixing tenant membership.`,
+      `Tenant ${tenant.email} has no primary administrator. Provide --user after fixing tenant membership.`
     );
   }
-  const activeKeys = await fetchFleetTenantActiveKeys(
-    tenant.id,
-    context,
-    webOperatorRequest,
-  );
+  const activeKeys = await fetchFleetTenantActiveKeys(tenant.id, context, webOperatorRequest);
   if (!activeKeys.length) {
     throw new Error(
       `Tenant ${tenant.email} has no active SSH keys. Add a tenant SSH key before deploying this fleet.`
@@ -3138,7 +3838,9 @@ async function waitForFleetDeployment({
       await sleepImpl(2000);
       continue;
     }
-    const machines = (Array.isArray(machinePayload?.machines) ? machinePayload.machines : []).filter(
+    const machines = (
+      Array.isArray(machinePayload?.machines) ? machinePayload.machines : []
+    ).filter(
       (machine) => String(machine?.machine_node_id || machine?.node_id || "") === String(nodeId)
     );
     if (machines.length > 1) {
@@ -3247,9 +3949,7 @@ async function waitForFleetDeployment({
       ssh_key_count: activeKeys.length,
     };
   }
-  throw new Error(
-    `Timed out after ${timeoutSeconds}s waiting for node ${nodeId}: ${lastReason}.`
-  );
+  throw new Error(`Timed out after ${timeoutSeconds}s waiting for node ${nodeId}: ${lastReason}.`);
 }
 
 function isTransientFleetApiError(error) {
@@ -3267,6 +3967,10 @@ function fleetSshArgs({ identityFile, ip, port, remoteCommand, user }) {
     "-o",
     "ConnectTimeout=10",
     "-o",
+    "ServerAliveInterval=5",
+    "-o",
+    "ServerAliveCountMax=3",
+    "-o",
     "IdentitiesOnly=yes",
     "-o",
     "StrictHostKeyChecking=yes",
@@ -3326,7 +4030,7 @@ async function runFleetSsh({
   });
 }
 
-async function runFleetSshCapture({
+export async function runFleetSshCapture({
   context,
   identityFile,
   ip,
@@ -3342,9 +4046,10 @@ async function runFleetSshCapture({
     let stdout = "";
     let stderr = "";
     let outputExceeded = false;
+    let outputBytes = 0;
     let timedOut = false;
     let killTimer = null;
-    const maxOutputBytes = 4 * 1024 * 1024;
+    const maxOutputBytes = FLEET_RUNNER_OUTPUT_MAX_BYTES;
     const timer = timeoutSeconds
       ? setTimeout(() => {
           timedOut = true;
@@ -3362,13 +4067,17 @@ async function runFleetSshCapture({
       }
     };
     const append = (current, chunk) => {
-      const next = current + String(chunk);
-      if (Buffer.byteLength(next, "utf8") > maxOutputBytes) {
+      if (outputExceeded) return current;
+      const chunkBytes = Buffer.isBuffer(chunk)
+        ? chunk.byteLength
+        : Buffer.byteLength(String(chunk), "utf8");
+      if (outputBytes + chunkBytes > maxOutputBytes) {
         outputExceeded = true;
         terminate();
         return current;
       }
-      return next;
+      outputBytes += chunkBytes;
+      return current + String(chunk);
     };
     child.stdout?.on("data", (chunk) => {
       stdout = append(stdout, chunk);
@@ -3385,9 +4094,9 @@ async function runFleetSshCapture({
       if (timer) clearTimeout(timer);
       if (killTimer) clearTimeout(killTimer);
       if (timedOut) stderr = `SSH command timed out after ${timeoutSeconds}s.`;
-      if (outputExceeded) stderr = "SSH command output exceeded 4 MiB.";
+      if (outputExceeded) stderr = "SSH command output exceeded the 64 MiB safety limit.";
       resolve({
-        exitCode: timedOut ? 124 : (signal || outputExceeded ? 1 : (code ?? 0)),
+        exitCode: timedOut ? 124 : signal || outputExceeded ? 1 : (code ?? 0),
         stderr,
         stdout,
       });
@@ -3430,37 +4139,51 @@ async function deriveFleetManagementPublicKey({ context, identityFile }) {
   });
 }
 
-function startFleetSshCanary({ context, identityFile, ip, port, timeoutSeconds, user }) {
-  let failure = null;
+export function startFleetSshCanary({ context, identityFile, ip, port, timeoutSeconds, user }) {
+  let failedChecks = 0;
   let successfulChecks = 0;
-  let inFlight = Promise.resolve();
+  let inFlight = null;
+  let stopped = false;
+  const setIntervalImpl = context.setInterval ?? setInterval;
+  const clearIntervalImpl = context.clearInterval ?? clearInterval;
+  const checkTimeoutSeconds = Math.max(1, Math.min(Number(timeoutSeconds) || 30, 30));
   const check = () => {
-    inFlight = inFlight.then(async () => {
-      if (failure) return;
-      const exitCode = await runFleetSsh({
-        context,
-        identityFile,
-        ip,
-        port,
-        remoteCommand: "sudo -n true",
-        timeoutSeconds,
-        user,
+    if (stopped || inFlight) return;
+    const operation = runFleetSsh({
+      context,
+      identityFile,
+      ip,
+      port,
+      remoteCommand: "sudo -n true",
+      timeoutSeconds: checkTimeoutSeconds,
+      user,
+    })
+      .then((exitCode) => {
+        if (exitCode !== 0) {
+          failedChecks += 1;
+        } else {
+          successfulChecks += 1;
+        }
+      })
+      .catch(() => {
+        failedChecks += 1;
       });
-      if (exitCode !== 0) {
-        failure = new Error("Management SSH canary failed during cleanup.");
-      } else {
-        successfulChecks += 1;
+    const tracked = operation.finally(() => {
+      if (inFlight === tracked) {
+        inFlight = null;
       }
     });
+    inFlight = tracked;
   };
   check();
-  const timer = setInterval(check, 2000);
+  const timer = setIntervalImpl(check, 2000);
   timer.unref?.();
   return async () => {
-    clearInterval(timer);
-    await inFlight;
-    if (failure) throw failure;
-    return successfulChecks;
+    stopped = true;
+    clearIntervalImpl(timer);
+    const activeCheck = inFlight;
+    if (activeCheck) await activeCheck;
+    return { failedChecks, successfulChecks };
   };
 }
 
@@ -3562,21 +4285,7 @@ async function waitForFleetNodes({ context, ips, operatorId, timeoutSeconds }) {
       env: context.env,
       fetchImpl: context.fetchImpl,
     });
-    const matches = new Map();
-    for (const ip of ips) {
-      const candidates = (Array.isArray(rows) ? rows : []).filter((node) => {
-        const labels = node?.labels && typeof node.labels === "object" ? node.labels : {};
-        return [labels["ornn.ai/public-ip"], labels["ornn.ai/configured-ip"]]
-          .filter(Boolean)
-          .some((candidate) => String(candidate) === ip);
-      });
-      if (candidates.length > 1) {
-        throw new Error(`Multiple Fabric nodes matched IP ${ip}; refusing ambiguous enrollment.`);
-      }
-      if (candidates.length === 1) {
-        matches.set(ip, candidates[0]);
-      }
-    }
+    const matches = fleetNodesByIp(rows, ips);
     for (const [ip, node] of matches) {
       const prior = latestMatches.get(ip);
       if (prior && String(prior.id || "") !== String(node.id || "")) {
@@ -3601,14 +4310,30 @@ async function waitForFleetNodes({ context, ips, operatorId, timeoutSeconds }) {
   return latestMatches;
 }
 
-async function verifyFleetManagementSsh({
-  context,
-  identityFile,
-  ip,
-  port,
-  timeoutSeconds,
-  user,
-}) {
+function fleetNodesByIp(rows, ips) {
+  const matches = new Map();
+  for (const ip of ips) {
+    const candidates = (Array.isArray(rows) ? rows : []).filter((node) => {
+      const labels = node?.labels && typeof node.labels === "object" ? node.labels : {};
+      return [labels["ornn.ai/public-ip"], labels["ornn.ai/configured-ip"]]
+        .filter(Boolean)
+        .some((candidate) => String(candidate) === ip);
+    });
+    if (candidates.length > 1) {
+      throw new Error(`Multiple Fabric nodes matched IP ${ip}; refusing ambiguous enrollment.`);
+    }
+    if (candidates.length === 1) matches.set(ip, candidates[0]);
+  }
+  const nodeIds = [...matches.values()].map((node) => String(node.id || ""));
+  if (nodeIds.some((nodeId) => !nodeId) || new Set(nodeIds).size !== matches.size) {
+    throw new Error(
+      "Multiple fleet IPs resolved to the same Fabric node; refusing a duplicate enrollment mapping."
+    );
+  }
+  return matches;
+}
+
+async function verifyFleetManagementSsh({ context, identityFile, ip, port, timeoutSeconds, user }) {
   const exitCode = await runFleetSsh({
     context,
     identityFile,
@@ -3645,15 +4370,120 @@ function fleetManifestPath(fleetId, env) {
   return join(getFleetConfigDir(env), `${normalized}.json`);
 }
 
+function fleetEnrollmentLockPath(fleetId, env) {
+  return `${fleetManifestPath(fleetId, env)}.enroll.lock`;
+}
+
+function localProcessIsAlive(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error) {
+    return error?.code !== "ESRCH";
+  }
+}
+
+async function acquireFleetEnrollmentLock(fleetId, env) {
+  const path = fleetEnrollmentLockPath(fleetId, env);
+  const directory = dirname(path);
+  const ownerId = randomUUID();
+  await mkdir(directory, { recursive: true, mode: 0o700 });
+  await chmod(directory, 0o700);
+  for (let attempt = 0; attempt < 2; attempt += 1) {
+    let handle;
+    let created = false;
+    try {
+      handle = await open(path, "wx", 0o600);
+      created = true;
+      await handle.writeFile(
+        `${JSON.stringify({
+          host: hostname(),
+          owner_id: ownerId,
+          pid: process.pid,
+          started_at: new Date().toISOString(),
+        })}\n`,
+        "utf8"
+      );
+      await handle.sync();
+      return async () => {
+        await handle.close().catch(() => {});
+        try {
+          const current = JSON.parse(await readFile(path, "utf8"));
+          if (current?.owner_id === ownerId) await rm(path, { force: true });
+        } catch (error) {
+          if (error?.code !== "ENOENT") throw error;
+        }
+      };
+    } catch (error) {
+      await handle?.close().catch(() => {});
+      if (created) await rm(path, { force: true });
+      if (error?.code !== "EEXIST") throw error;
+      let existing;
+      try {
+        existing = JSON.parse(await readFile(path, "utf8"));
+      } catch (readError) {
+        if (readError?.code === "ENOENT") continue;
+        throw new Error("Another fleet enrollment owns the unreadable local lock file.");
+      }
+      const sameHost = existing?.host === hostname();
+      const pid = Number(existing?.pid);
+      if (sameHost && Number.isSafeInteger(pid) && pid > 0 && !localProcessIsAlive(pid)) {
+        await rm(path, { force: true });
+        if (attempt === 0) continue;
+      }
+      throw new Error(
+        `Another ornn fleet enroll process owns ${path}. Wait for it to finish before retrying.`
+      );
+    }
+  }
+  throw new Error("Could not acquire the fleet enrollment lock.");
+}
+
+async function withFleetEnrollmentLock(fleetId, env, operation) {
+  const release = await acquireFleetEnrollmentLock(fleetId, env);
+  try {
+    return await operation();
+  } finally {
+    await release();
+  }
+}
+
+async function loadFleetManifest(fleetId, env) {
+  const path = fleetManifestPath(fleetId, env);
+  try {
+    const value = JSON.parse(await readFile(path, "utf8"));
+    return value && typeof value === "object" && value.id === fleetId ? value : null;
+  } catch (error) {
+    if (error?.code === "ENOENT") return null;
+    throw new Error(`Could not read the private fleet manifest: ${fleetResultError(error)}`);
+  }
+}
+
+async function writePrivateJsonAtomic(path, value, { privateDirectory = false } = {}) {
+  const directory = dirname(path);
+  const temporaryPath = join(directory, `.${basename(path)}.${randomUUID()}.tmp`);
+  await mkdir(directory, { recursive: true, mode: 0o700 });
+  if (privateDirectory) await chmod(directory, 0o700);
+  let handle;
+  try {
+    handle = await open(temporaryPath, "wx", 0o600);
+    await handle.writeFile(`${JSON.stringify(value, null, 2)}\n`, "utf8");
+    await handle.sync();
+    await handle.close();
+    handle = null;
+    await rename(temporaryPath, path);
+    await chmod(path, 0o600);
+  } catch (error) {
+    await handle?.close().catch(() => {});
+    await rm(temporaryPath, { force: true });
+    throw error;
+  }
+}
+
 async function saveFleetManifest(manifest, env) {
-  const directory = getFleetConfigDir(env);
   const path = fleetManifestPath(manifest.id, env);
   manifest.updated_at = new Date().toISOString();
-  await mkdir(directory, { recursive: true, mode: 0o700 });
-  await writeFile(path, `${JSON.stringify(manifest, null, 2)}\n`, {
-    encoding: "utf8",
-    mode: 0o600,
-  });
+  await writePrivateJsonAtomic(path, manifest, { privateDirectory: true });
   return path;
 }
 
@@ -3677,14 +4507,15 @@ async function resolveFleetTenant(tenantInput, context, request = operatorReques
   });
   const normalized = input.toLowerCase();
   const matches = (Array.isArray(rows) ? rows : []).filter(
-    (row) => String(row?.contact_email || "").trim().toLowerCase() === normalized
+    (row) =>
+      String(row?.contact_email || "")
+        .trim()
+        .toLowerCase() === normalized
   );
   const tenantIds = [
     ...new Set(
-      matches
-        .map((row) => String(row.organization_id ?? row.tenant_id ?? ""))
-        .filter(Boolean)
-    )
+      matches.map((row) => String(row.organization_id ?? row.tenant_id ?? "")).filter(Boolean)
+    ),
   ];
   if (tenantIds.length !== 1) {
     throw new Error(
@@ -3714,7 +4545,9 @@ async function resolveFleetUser(tenantId, userInput, context, request = operator
   const matches = (Array.isArray(members) ? members : []).filter(
     (member) =>
       String(member?.auth_user_id || "") === input ||
-      String(member?.contact_email || "").trim().toLowerCase() === normalized
+      String(member?.contact_email || "")
+        .trim()
+        .toLowerCase() === normalized
   );
   if (matches.length !== 1) {
     throw new Error(
@@ -3753,7 +4586,7 @@ async function nodeDeenroll(id, rest, context) {
   const options = parseCommandOptions(
     rest,
     { boolean: ["json", "keep-record", "force"], value: ["reason"] },
-    nodeOpUsage("deenroll"),
+    nodeOpUsage("deenroll")
   );
   const reason = optionalStringOption(options.reason) || "cli-deenroll";
   // Dead/unreachable test nodes can't drain workloads, so default to force.
@@ -3811,7 +4644,7 @@ async function nodeDeenroll(id, rest, context) {
       writeOptionalStatusLine(
         context.stdout,
         "Record removed",
-        options.keepRecord ? "kept" : result.dereferenced ? "yes" : "already gone",
+        options.keepRecord ? "kept" : result.dereferenced ? "yes" : "already gone"
       );
     }
   }
@@ -3859,7 +4692,7 @@ async function nodes(args, context) {
     const options = parseCommandOptions(
       [id, nested, ...rest].filter(Boolean),
       { boolean: ["json"] },
-      "Usage: ornn nodes list [--json]",
+      "Usage: ornn nodes list [--json]"
     );
     const machines = await fetchTenantMachines(context);
     if (options.json) {
@@ -3874,7 +4707,7 @@ async function nodes(args, context) {
     const options = parseCommandOptions(
       [nested, ...rest].filter(Boolean),
       { boolean: ["json"] },
-      "Usage: ornn nodes show <node-id> [--json]",
+      "Usage: ornn nodes show <node-id> [--json]"
     );
     const machine = await fetchMachine(id, context);
     if (options.json) {
@@ -3910,7 +4743,7 @@ async function nodes(args, context) {
           "wait-timeout",
         ],
       },
-      "Usage: ornn nodes launch <reservation-id> --key <path|id|label> [--mode bare-metal|vm] [--username <name>] [--network public|private] [--storage-load-drive-id <id>] [--storage-save-drive-id <id>] [--wait] [--json]",
+      "Usage: ornn nodes launch <reservation-id> --key <path|id|label> [--mode bare-metal|vm] [--username <name>] [--network public|private] [--storage-load-drive-id <id>] [--storage-save-drive-id <id>] [--wait] [--json]"
     );
     const result = await launchReservationAccess(id, options, context, { openDefault: false });
     if (options.json) {
@@ -3922,7 +4755,9 @@ async function nodes(args, context) {
   }
 
   if (subcommand === "launch") {
-    throw new Error("Usage: ornn nodes launch <reservation-id> --key <path|id|label> [--mode bare-metal|vm] [--username <name>] [--network public|private] [--storage-load-drive-id <id>] [--storage-save-drive-id <id>] [--wait] [--json]");
+    throw new Error(
+      "Usage: ornn nodes launch <reservation-id> --key <path|id|label> [--mode bare-metal|vm] [--username <name>] [--network public|private] [--storage-load-drive-id <id>] [--storage-save-drive-id <id>] [--wait] [--json]"
+    );
   }
 
   if (subcommand === "switch" && id) {
@@ -3947,14 +4782,14 @@ async function nodes(args, context) {
           "wait-timeout",
         ],
       },
-      "Usage: ornn nodes switch <reservation-id> --network public|private --key <path|id|label> [--mode bare-metal|vm] [--username <name>] [--wait] [--json]",
+      "Usage: ornn nodes switch <reservation-id> --network public|private --key <path|id|label> [--mode bare-metal|vm] [--username <name>] [--wait] [--json]"
     );
     const result = await switchReservationAccess(id, options, context);
     if (options.json) {
       writeJson(context.stdout, result);
     } else {
       context.stdout.write(
-        `Switched to ${displayAccessMode(result.mode)} / ${result.network_mode} on reservation ${id}.\n`,
+        `Switched to ${displayAccessMode(result.mode)} / ${result.network_mode} on reservation ${id}.\n`
       );
       writeAccessLaunchSummary(context.stdout, { machines: result.machines });
       if (result.wait) {
@@ -3966,7 +4801,7 @@ async function nodes(args, context) {
 
   if (subcommand === "switch") {
     throw new Error(
-      "Usage: ornn nodes switch <reservation-id> --network public|private --key <path|id|label> [--mode bare-metal|vm] [--username <name>] [--wait] [--json]",
+      "Usage: ornn nodes switch <reservation-id> --network public|private --key <path|id|label> [--mode bare-metal|vm] [--username <name>] [--wait] [--json]"
     );
   }
 
@@ -3974,7 +4809,7 @@ async function nodes(args, context) {
     const options = parseCommandOptions(
       [nested, ...rest].filter(Boolean),
       { boolean: ["json"], value: ["timeout", "wait-interval", "wait-timeout"] },
-      "Usage: ornn nodes wait <node-or-reservation-id> [--timeout <seconds>] [--json]",
+      "Usage: ornn nodes wait <node-or-reservation-id> [--timeout <seconds>] [--json]"
     );
     const result = await waitForSshReady(id, waitOptions(options), context);
     if (options.json) {
@@ -3989,7 +4824,7 @@ async function nodes(args, context) {
     const options = parseCommandOptions(
       [nested, ...rest].filter(Boolean),
       { boolean: ["json"], value: ["request-id"] },
-      `Usage: ornn nodes ${subcommand} <node-id> [--json]`,
+      `Usage: ornn nodes ${subcommand} <node-id> [--json]`
     );
     const machine = await runNodeAction(id, subcommand, options, context);
     if (options.json) {
@@ -4005,7 +4840,7 @@ async function nodes(args, context) {
     const options = parseCommandOptions(
       [nested, ...rest].filter(Boolean),
       { boolean: ["json"], value: ["identity-file", "user"] },
-      "Usage: ornn nodes ssh-command <node-or-reservation-id> [--json]",
+      "Usage: ornn nodes ssh-command <node-or-reservation-id> [--json]"
     );
     const { machine } = await resolveSshTarget(id, context);
     const invocation = sshInvocationForMachine(machine, options);
@@ -4022,21 +4857,28 @@ async function nodes(args, context) {
   }
 
   if (subcommand === "keys") {
-    return await nodeKeys([id, nested, ...rest].filter((item) => item !== undefined), context);
+    return await nodeKeys(
+      [id, nested, ...rest].filter((item) => item !== undefined),
+      context
+    );
   }
 
-  throw new Error("Usage: ornn nodes list|show|launch|switch|wait|reboot|hard-reset|ssh-command|keys");
+  throw new Error(
+    "Usage: ornn nodes list|show|launch|switch|wait|reboot|hard-reset|ssh-command|keys"
+  );
 }
 
 async function ssh(args, context) {
   const [identifier, ...rest] = args;
   if (!identifier) {
-    throw new Error("Usage: ornn ssh <node-or-reservation-id> [--print] [--identity-file <path>] [--user <name>] [--json]");
+    throw new Error(
+      "Usage: ornn ssh <node-or-reservation-id> [--print] [--identity-file <path>] [--user <name>] [--json]"
+    );
   }
   const options = parseCommandOptions(
     rest,
     { boolean: ["json", "print"], value: ["identity-file", "user"] },
-    "Usage: ornn ssh <node-or-reservation-id> [--print] [--identity-file <path>] [--user <name>] [--json]",
+    "Usage: ornn ssh <node-or-reservation-id> [--print] [--identity-file <path>] [--user <name>] [--json]"
   );
   const { machine } = await resolveSshTarget(identifier, context);
   const invocation = sshInvocationForMachine(machine, options);
@@ -4062,7 +4904,7 @@ async function metrics(args, context) {
     const options = parseCommandOptions(
       [nodeId, ...rest].filter(Boolean),
       { boolean: ["json"] },
-      "Usage: ornn metrics nodes [--json]",
+      "Usage: ornn metrics nodes [--json]"
     );
     const snapshots = await fetchTenantMetricSnapshots(context);
     if (options.json) {
@@ -4077,7 +4919,7 @@ async function metrics(args, context) {
     const options = parseCommandOptions(
       rest,
       { boolean: ["json"] },
-      "Usage: ornn metrics node <node-id> [--json]",
+      "Usage: ornn metrics node <node-id> [--json]"
     );
     const snapshot = await fetchMetricSnapshotForNode(nodeId, context);
     if (options.json) {
@@ -4092,7 +4934,7 @@ async function metrics(args, context) {
     const options = parseCommandOptions(
       rest,
       { boolean: ["json"], value: ["end", "max-points", "start"] },
-      "Usage: ornn metrics history <node-id> [--start <iso>] [--end <iso>] [--max-points <n>] [--json]",
+      "Usage: ornn metrics history <node-id> [--start <iso>] [--end <iso>] [--max-points <n>] [--json]"
     );
     const result = await fetchMetricHistoryForNode(nodeId, options, context);
     if (options.json) {
@@ -4110,7 +4952,7 @@ async function metrics(args, context) {
         boolean: ["json"],
         value: ["count", "interval", "timeout", "watch-interval", "watch-timeout"],
       },
-      "Usage: ornn metrics watch <node-id> [--interval <seconds>] [--count <n>] [--timeout <seconds>] [--json]",
+      "Usage: ornn metrics watch <node-id> [--interval <seconds>] [--count <n>] [--timeout <seconds>] [--json]"
     );
     await watchNodeMetrics(nodeId, options, context);
     return 0;
@@ -4120,10 +4962,14 @@ async function metrics(args, context) {
     throw new Error("Usage: ornn metrics node <node-id> [--json]");
   }
   if (subcommand === "history") {
-    throw new Error("Usage: ornn metrics history <node-id> [--start <iso>] [--end <iso>] [--max-points <n>] [--json]");
+    throw new Error(
+      "Usage: ornn metrics history <node-id> [--start <iso>] [--end <iso>] [--max-points <n>] [--json]"
+    );
   }
   if (subcommand === "watch") {
-    throw new Error("Usage: ornn metrics watch <node-id> [--interval <seconds>] [--count <n>] [--timeout <seconds>] [--json]");
+    throw new Error(
+      "Usage: ornn metrics watch <node-id> [--interval <seconds>] [--count <n>] [--timeout <seconds>] [--json]"
+    );
   }
 
   throw new Error("Usage: ornn metrics nodes|node|history|watch");
@@ -4136,7 +4982,7 @@ async function clusters(args, context) {
     const options = parseCommandOptions(
       [reservationId, maybeNodeId, ...rest].filter(Boolean),
       { boolean: ["json"] },
-      "Usage: ornn clusters list [--json]",
+      "Usage: ornn clusters list [--json]"
     );
     const rows = await fetchTenantClusters(context);
     if (options.json) {
@@ -4151,7 +4997,7 @@ async function clusters(args, context) {
     const options = parseCommandOptions(
       [reservationId, maybeNodeId, ...rest].filter(Boolean),
       { boolean: ["json"] },
-      "Usage: ornn clusters reservations [--json]",
+      "Usage: ornn clusters reservations [--json]"
     );
     const rows = await cliRequest({
       endpoint: computeEndpoint("/clusters/reservations"),
@@ -4161,7 +5007,10 @@ async function clusters(args, context) {
     if (options.json) {
       writeJson(context.stdout, rows);
     } else {
-      writeClusterReservationList(context.stdout, requireArrayPayload(rows, "cluster reservations"));
+      writeClusterReservationList(
+        context.stdout,
+        requireArrayPayload(rows, "cluster reservations")
+      );
     }
     return 0;
   }
@@ -4170,7 +5019,7 @@ async function clusters(args, context) {
     const options = parseCommandOptions(
       [maybeNodeId, ...rest].filter(Boolean),
       { boolean: ["json"], value: ["network", "network-mode", "type", "mode"] },
-      "Usage: ornn clusters eligible-nodes <reservation-id> [--type kubernetes|slurm] [--network public|private] [--json]",
+      "Usage: ornn clusters eligible-nodes <reservation-id> [--type kubernetes|slurm] [--network public|private] [--json]"
     );
     const type = normalizeClusterType(options.type || options.mode || "kubernetes");
     const networkMode = normalizeClusterNetwork(options.network || options.networkMode || "public");
@@ -4203,7 +5052,7 @@ async function clusters(args, context) {
           "timeout",
         ],
       },
-      "Usage: ornn clusters create <reservation-id> --type kubernetes|slurm [--network public|private] [--node <node-id>] [--node-count <n>] [--wait] [--json]",
+      "Usage: ornn clusters create <reservation-id> --type kubernetes|slurm [--network public|private] [--node <node-id>] [--node-count <n>] [--wait] [--json]"
     );
     const type = normalizeClusterType(requiredOption(options.type || options.mode, "--type"));
     const launch = await launchCluster(reservationId, type, options, context);
@@ -4223,7 +5072,7 @@ async function clusters(args, context) {
     const options = parseCommandOptions(
       [maybeNodeId, ...rest].filter(Boolean),
       { boolean: ["json"], value: ["type", "mode"] },
-      "Usage: ornn clusters show <reservation-id> [--type kubernetes|slurm] [--json]",
+      "Usage: ornn clusters show <reservation-id> [--type kubernetes|slurm] [--json]"
     );
     const type = await resolveClusterTypeForReservation(reservationId, options, context);
     const cluster = await fetchCluster(reservationId, type, context);
@@ -4239,7 +5088,7 @@ async function clusters(args, context) {
     const options = parseCommandOptions(
       [maybeNodeId, ...rest].filter(Boolean),
       { boolean: ["json"], value: ["timeout", "type", "mode", "wait-interval", "wait-timeout"] },
-      "Usage: ornn clusters wait <reservation-id> [--type kubernetes|slurm] [--timeout <seconds>] [--json]",
+      "Usage: ornn clusters wait <reservation-id> [--type kubernetes|slurm] [--timeout <seconds>] [--json]"
     );
     const type = await resolveClusterTypeForReservation(reservationId, options, context);
     const result = await waitForClusterActive(reservationId, type, waitOptions(options), context);
@@ -4255,7 +5104,7 @@ async function clusters(args, context) {
     const options = parseCommandOptions(
       [maybeNodeId, ...rest].filter(Boolean),
       { boolean: ["json"], value: ["type", "mode"] },
-      "Usage: ornn clusters credentials <reservation-id> [--type kubernetes|slurm] [--json]",
+      "Usage: ornn clusters credentials <reservation-id> [--type kubernetes|slurm] [--json]"
     );
     const type = await resolveClusterTypeForReservation(reservationId, options, context);
     const credentials = await fetchClusterCredentials(reservationId, type, context);
@@ -4271,7 +5120,7 @@ async function clusters(args, context) {
     const options = parseCommandOptions(
       [maybeNodeId, ...rest].filter(Boolean),
       { boolean: ["json"], value: ["output"] },
-      "Usage: ornn clusters kubeconfig <reservation-id> [--output <path>] [--json]",
+      "Usage: ornn clusters kubeconfig <reservation-id> [--output <path>] [--json]"
     );
     const credentials = await fetchClusterCredentials(reservationId, "kubernetes", context);
     const kubeconfig = String(credentials?.kubeconfig || "");
@@ -4280,7 +5129,11 @@ async function clusters(args, context) {
     }
     const outputPath = options.output ? expandUserPath(String(options.output)) : null;
     if (outputPath) {
-      await writeFile(outputPath, kubeconfig.endsWith("\n") ? kubeconfig : `${kubeconfig}\n`, "utf8");
+      await writeFile(
+        outputPath,
+        kubeconfig.endsWith("\n") ? kubeconfig : `${kubeconfig}\n`,
+        "utf8"
+      );
     }
     if (options.json) {
       writeJson(context.stdout, { credentials, output: outputPath });
@@ -4296,7 +5149,7 @@ async function clusters(args, context) {
     const options = parseCommandOptions(
       [maybeNodeId, ...rest].filter(Boolean),
       { boolean: ["json"], value: ["identity-file", "user"] },
-      "Usage: ornn clusters ssh-command <reservation-id> [--identity-file <path>] [--user <name>] [--json]",
+      "Usage: ornn clusters ssh-command <reservation-id> [--identity-file <path>] [--user <name>] [--json]"
     );
     const credentials = await fetchClusterCredentials(reservationId, "slurm", context);
     const invocation = slurmSshInvocation(credentials, options);
@@ -4316,7 +5169,7 @@ async function clusters(args, context) {
     const options = parseCommandOptions(
       [maybeNodeId, ...rest].filter(Boolean),
       { boolean: ["json", "print"], value: ["identity-file", "user"] },
-      "Usage: ornn clusters ssh <reservation-id> [--print] [--identity-file <path>] [--user <name>] [--json]",
+      "Usage: ornn clusters ssh <reservation-id> [--print] [--identity-file <path>] [--user <name>] [--json]"
     );
     const credentials = await fetchClusterCredentials(reservationId, "slurm", context);
     const invocation = slurmSshInvocation(credentials, options);
@@ -4341,16 +5194,19 @@ async function clusters(args, context) {
     const options = parseCommandOptions(
       trailing,
       { boolean: ["json"], value: ["node", "node-id"] },
-      `Usage: ornn clusters ${subcommand} <reservation-id> --node <node-id> [--json]`,
+      `Usage: ornn clusters ${subcommand} <reservation-id> --node <node-id> [--json]`
     );
     const nodeId = requiredOption(options.node || options.nodeId || nodeIdArg, "--node");
-    const cluster = subcommand === "add-node"
-      ? await addClusterNode(reservationId, nodeId, context)
-      : await removeClusterNode(reservationId, nodeId, context);
+    const cluster =
+      subcommand === "add-node"
+        ? await addClusterNode(reservationId, nodeId, context)
+        : await removeClusterNode(reservationId, nodeId, context);
     if (options.json) {
       writeJson(context.stdout, cluster);
     } else {
-      context.stdout.write(`Cluster node ${subcommand === "add-node" ? "add" : "remove"} queued.\n`);
+      context.stdout.write(
+        `Cluster node ${subcommand === "add-node" ? "add" : "remove"} queued.\n`
+      );
       writeClusterDetail(context.stdout, cluster);
     }
     return 0;
@@ -4360,7 +5216,7 @@ async function clusters(args, context) {
     const options = parseCommandOptions(
       [maybeNodeId, ...rest].filter(Boolean),
       { boolean: ["json"], value: ["type", "mode"] },
-      "Usage: ornn clusters teardown <reservation-id> [--type kubernetes|slurm] [--json]",
+      "Usage: ornn clusters teardown <reservation-id> [--type kubernetes|slurm] [--json]"
     );
     const type = await resolveClusterTypeForReservation(reservationId, options, context);
     const cluster = await teardownCluster(reservationId, type, context);
@@ -4374,10 +5230,14 @@ async function clusters(args, context) {
   }
 
   if (subcommand === "create") {
-    throw new Error("Usage: ornn clusters create <reservation-id> --type kubernetes|slurm [--network public|private] [--node <node-id>] [--node-count <n>] [--wait] [--json]");
+    throw new Error(
+      "Usage: ornn clusters create <reservation-id> --type kubernetes|slurm [--network public|private] [--node <node-id>] [--node-count <n>] [--wait] [--json]"
+    );
   }
 
-  throw new Error("Usage: ornn clusters list|reservations|eligible-nodes|create|show|wait|credentials|kubeconfig|ssh-command|ssh|add-node|remove-node|teardown");
+  throw new Error(
+    "Usage: ornn clusters list|reservations|eligible-nodes|create|show|wait|credentials|kubeconfig|ssh-command|ssh|add-node|remove-node|teardown"
+  );
 }
 
 async function slurm(args, context) {
@@ -4390,7 +5250,7 @@ async function slurm(args, context) {
         boolean: ["json", "wait"],
         value: ["network", "node", "node-count", "wait-interval", "wait-timeout", "timeout"],
       },
-      "Usage: ornn slurm launch <reservation-id> [--network public|private] [--node <node-id>] [--node-count <n>] [--wait] [--wait-timeout <seconds>] [--json]",
+      "Usage: ornn slurm launch <reservation-id> [--network public|private] [--node <node-id>] [--node-count <n>] [--wait] [--wait-timeout <seconds>] [--json]"
     );
     const launch = await launchCluster(reservationId, "slurm", options, context);
     const wait = options.wait
@@ -4409,7 +5269,7 @@ async function slurm(args, context) {
     const options = parseCommandOptions(
       rest,
       { boolean: ["json"] },
-      "Usage: ornn slurm teardown <reservation-id> [--json]",
+      "Usage: ornn slurm teardown <reservation-id> [--json]"
     );
     const cluster = await teardownCluster(reservationId, "slurm", context);
     if (options.json) {
@@ -4425,7 +5285,7 @@ async function slurm(args, context) {
     const options = parseCommandOptions(
       rest,
       { boolean: ["json"] },
-      "Usage: ornn slurm status <reservation-id> [--json]",
+      "Usage: ornn slurm status <reservation-id> [--json]"
     );
     const cluster = await fetchCluster(reservationId, "slurm", context);
     if (options.json) {
@@ -4440,7 +5300,7 @@ async function slurm(args, context) {
     const options = parseCommandOptions(
       rest,
       { boolean: ["json"] },
-      "Usage: ornn slurm credentials <reservation-id> [--json]",
+      "Usage: ornn slurm credentials <reservation-id> [--json]"
     );
     const credentials = await fetchClusterCredentials(reservationId, "slurm", context);
     if (options.json) {
@@ -4455,7 +5315,7 @@ async function slurm(args, context) {
     const options = parseCommandOptions(
       rest,
       { boolean: ["json", "print"], value: ["identity-file", "user"] },
-      "Usage: ornn slurm ssh <reservation-id> [--print] [--identity-file <path>] [--user <name>] [--json]",
+      "Usage: ornn slurm ssh <reservation-id> [--print] [--identity-file <path>] [--user <name>] [--json]"
     );
     const credentials = await fetchClusterCredentials(reservationId, "slurm", context);
     const invocation = slurmSshInvocation(credentials, options);
@@ -4487,7 +5347,7 @@ async function kubernetes(args, context) {
         boolean: ["json", "wait"],
         value: ["network", "node", "node-count", "wait-interval", "wait-timeout", "timeout"],
       },
-      "Usage: ornn kubernetes launch <reservation-id> [--network public|private] [--node <node-id>] [--node-count <n>] [--wait] [--wait-timeout <seconds>] [--json]",
+      "Usage: ornn kubernetes launch <reservation-id> [--network public|private] [--node <node-id>] [--node-count <n>] [--wait] [--wait-timeout <seconds>] [--json]"
     );
     const launch = await launchCluster(reservationId, "kubernetes", options, context);
     const wait = options.wait
@@ -4506,7 +5366,7 @@ async function kubernetes(args, context) {
     const options = parseCommandOptions(
       rest,
       { boolean: ["json"] },
-      "Usage: ornn kubernetes teardown <reservation-id> [--json]",
+      "Usage: ornn kubernetes teardown <reservation-id> [--json]"
     );
     const cluster = await teardownCluster(reservationId, "kubernetes", context);
     if (options.json) {
@@ -4522,7 +5382,7 @@ async function kubernetes(args, context) {
     const options = parseCommandOptions(
       rest,
       { boolean: ["json"] },
-      "Usage: ornn kubernetes status <reservation-id> [--json]",
+      "Usage: ornn kubernetes status <reservation-id> [--json]"
     );
     const cluster = await fetchCluster(reservationId, "kubernetes", context);
     if (options.json) {
@@ -4537,7 +5397,7 @@ async function kubernetes(args, context) {
     const options = parseCommandOptions(
       rest,
       { boolean: ["json"] },
-      "Usage: ornn kubernetes credentials <reservation-id> [--json]",
+      "Usage: ornn kubernetes credentials <reservation-id> [--json]"
     );
     const credentials = await fetchClusterCredentials(reservationId, "kubernetes", context);
     if (options.json) {
@@ -4552,7 +5412,7 @@ async function kubernetes(args, context) {
     const options = parseCommandOptions(
       rest,
       { boolean: ["json"], value: ["output"] },
-      "Usage: ornn kubernetes kubeconfig <reservation-id> [--output <path>] [--json]",
+      "Usage: ornn kubernetes kubeconfig <reservation-id> [--output <path>] [--json]"
     );
     const credentials = await fetchClusterCredentials(reservationId, "kubernetes", context);
     const kubeconfig = String(credentials?.kubeconfig || "");
@@ -4561,7 +5421,11 @@ async function kubernetes(args, context) {
     }
     const outputPath = options.output ? expandUserPath(String(options.output)) : null;
     if (outputPath) {
-      await writeFile(outputPath, kubeconfig.endsWith("\n") ? kubeconfig : `${kubeconfig}\n`, "utf8");
+      await writeFile(
+        outputPath,
+        kubeconfig.endsWith("\n") ? kubeconfig : `${kubeconfig}\n`,
+        "utf8"
+      );
     }
     if (options.json) {
       writeJson(context.stdout, { credentials, output: outputPath });
@@ -4573,7 +5437,9 @@ async function kubernetes(args, context) {
     return 0;
   }
 
-  throw new Error("Usage: ornn kubernetes launch|teardown|status|credentials|kubeconfig <reservation-id>");
+  throw new Error(
+    "Usage: ornn kubernetes launch|teardown|status|credentials|kubeconfig <reservation-id>"
+  );
 }
 
 async function networks(args, context) {
@@ -4583,7 +5449,7 @@ async function networks(args, context) {
     const options = parseCommandOptions(
       [id, ...rest].filter(Boolean),
       { boolean: ["json"] },
-      "Usage: ornn networks list [--json]",
+      "Usage: ornn networks list [--json]"
     );
     const payload = await cliRequest({
       endpoint: computeEndpoint("/networks"),
@@ -4603,7 +5469,7 @@ async function networks(args, context) {
     const options = parseCommandOptions(
       rest,
       { boolean: ["json"] },
-      "Usage: ornn networks show <network-id> [--json]",
+      "Usage: ornn networks show <network-id> [--json]"
     );
     const network = await cliRequest({
       endpoint: computeEndpoint(`/networks/${encodeURIComponent(id)}`),
@@ -4622,7 +5488,7 @@ async function networks(args, context) {
     const options = parseCommandOptions(
       [id, ...rest].filter(Boolean),
       { boolean: ["json"], value: ["cidr", "description", "name"] },
-      "Usage: ornn networks create --name <name> [--cidr <cidr>] [--description <text>] [--json]",
+      "Usage: ornn networks create --name <name> [--cidr <cidr>] [--description <text>] [--json]"
     );
     const payload = {
       cidr: optionalStringOption(options.cidr),
@@ -4650,7 +5516,7 @@ async function networks(args, context) {
     const options = parseCommandOptions(
       rest,
       { boolean: ["clear-description", "json"], value: ["description", "name"] },
-      "Usage: ornn networks update <network-id> [--name <name>] [--description <text>] [--clear-description] [--json]",
+      "Usage: ornn networks update <network-id> [--name <name>] [--description <text>] [--clear-description] [--json]"
     );
     if (options.clearDescription && optionProvided(options.description)) {
       throw new Error("Use either --description or --clear-description, not both.");
@@ -4688,7 +5554,7 @@ async function networks(args, context) {
     const options = parseCommandOptions(
       rest,
       { boolean: ["json"] },
-      "Usage: ornn networks delete <network-id> [--json]",
+      "Usage: ornn networks delete <network-id> [--json]"
     );
     await cliRequest({
       endpoint: computeEndpoint(`/networks/${encodeURIComponent(id)}`),
@@ -4709,7 +5575,7 @@ async function networks(args, context) {
     const options = parseCommandOptions(
       rest,
       { boolean: ["json"] },
-      "Usage: ornn networks reservation <reservation-id> [--json]",
+      "Usage: ornn networks reservation <reservation-id> [--json]"
     );
     const payload = await cliRequest({
       endpoint: computeEndpoint(`/nodes/reservations/${encodeURIComponent(id)}/network`),
@@ -4728,7 +5594,7 @@ async function networks(args, context) {
     const options = parseCommandOptions(
       rest,
       { boolean: ["json"], value: ["network", "network-id"] },
-      "Usage: ornn networks attach <reservation-id> --network <network-id> [--json]",
+      "Usage: ornn networks attach <reservation-id> --network <network-id> [--json]"
     );
     const networkId = requiredOption(options.network || options.networkId, "--network");
     const payload = await cliRequest({
@@ -4751,7 +5617,7 @@ async function networks(args, context) {
     const options = parseCommandOptions(
       rest,
       { boolean: ["json"] },
-      "Usage: ornn networks detach <reservation-id> [--json]",
+      "Usage: ornn networks detach <reservation-id> [--json]"
     );
     const payload = await cliRequest({
       body: { tenant_network_id: null },
@@ -4783,12 +5649,21 @@ function normalizeStorageDestination(value) {
     normalized.endsWith("/") ||
     parts.some((part) => !part || part === "." || part === "..")
   ) {
-    throw new Error("Destination must be a relative path inside the volume and cannot contain . or .. segments.");
+    throw new Error(
+      "Destination must be a relative path inside the volume and cannot contain . or .. segments."
+    );
   }
   return normalized;
 }
 
-async function putSignedStorageUpload({ contentType, fetchImpl, headers, localFile, sizeBytes, uploadUrl }) {
+async function putSignedStorageUpload({
+  contentType,
+  fetchImpl,
+  headers,
+  localFile,
+  sizeBytes,
+  uploadUrl,
+}) {
   let url;
   try {
     url = new URL(uploadUrl);
@@ -4830,13 +5705,16 @@ async function putSignedStorageUpload({ contentType, fetchImpl, headers, localFi
     if (response.status === 403) {
       throw new CliApiError(
         "The upload link expired before the file finished uploading. Try again; the volume does not need to be remounted.",
-        { status: response.status },
+        { status: response.status }
       );
     }
     if (response.status === 409 || response.status === 412) {
-      throw new CliApiError("This file changed while your upload was in progress. Refresh the volume and try again.", {
-        status: response.status,
-      });
+      throw new CliApiError(
+        "This file changed while your upload was in progress. Refresh the volume and try again.",
+        {
+          status: response.status,
+        }
+      );
     }
     throw new CliApiError("Storage could not accept the file. Try the upload again.", {
       status: response.status,
@@ -4849,7 +5727,7 @@ async function cancelStorageUploadSession({ driveId, env, fetchImpl, uploadId })
   try {
     await cliRequest({
       endpoint: computeEndpoint(
-        `/nodes/storage-drives/${encodeURIComponent(driveId)}/file-uploads/${encodeURIComponent(uploadId)}`,
+        `/nodes/storage-drives/${encodeURIComponent(driveId)}/file-uploads/${encodeURIComponent(uploadId)}`
       ),
       env,
       fetchImpl,
@@ -4864,18 +5742,19 @@ async function cancelStorageUploadSession({ driveId, env, fetchImpl, uploadId })
 async function storage(args, context) {
   const [resource = "volumes", rawSubcommand, id, ...rest] = args;
   const subcommand =
-    rawSubcommand ?? (resource === "buckets" || ["drives", "volumes"].includes(resource) ? "list" : undefined);
+    rawSubcommand ??
+    (resource === "buckets" || ["drives", "volumes"].includes(resource) ? "list" : undefined);
   if (resource === "files" && subcommand === "upload" && id) {
     const [localFile, ...optionArgs] = rest;
     if (!localFile) {
       throw new Error(
-        "Usage: ornn storage files upload <drive-id> <local-file> [--destination <path>] [--content-type <type>] [--json]",
+        "Usage: ornn storage files upload <drive-id> <local-file> [--destination <path>] [--content-type <type>] [--json]"
       );
     }
     const options = parseCommandOptions(
       optionArgs,
       { boolean: ["json"], value: ["content-type", "destination"] },
-      "Usage: ornn storage files upload <drive-id> <local-file> [--destination <path>] [--content-type <type>] [--json]",
+      "Usage: ornn storage files upload <drive-id> <local-file> [--destination <path>] [--content-type <type>] [--json]"
     );
     let fileInfo;
     try {
@@ -4886,7 +5765,9 @@ async function storage(args, context) {
     if (!fileInfo.isFile()) {
       throw new Error("Upload expects a file, not a directory.");
     }
-    const destination = normalizeStorageDestination(optionalStringOption(options.destination) ?? basename(localFile));
+    const destination = normalizeStorageDestination(
+      optionalStringOption(options.destination) ?? basename(localFile)
+    );
     const contentType = optionalStringOption(options.contentType) ?? "application/octet-stream";
     const session = await cliRequest({
       body: { path: destination, content_type: contentType, size_bytes: fileInfo.size },
@@ -4906,7 +5787,7 @@ async function storage(args, context) {
         uploadUrl: session.upload_url,
       });
       const completionEndpoint = computeEndpoint(
-        `/nodes/storage-drives/${encodeURIComponent(id)}/file-uploads/${encodeURIComponent(session.upload_id)}/complete`,
+        `/nodes/storage-drives/${encodeURIComponent(id)}/file-uploads/${encodeURIComponent(session.upload_id)}/complete`
       );
       try {
         result = await cliRequest({
@@ -4940,7 +5821,9 @@ async function storage(args, context) {
     if (options.json) {
       writeJson(context.stdout, result);
     } else {
-      context.stdout.write(`Uploaded ${localFile} to ${destination}. Mounted nodes can use it without remounting.\n`);
+      context.stdout.write(
+        `Uploaded ${localFile} to ${destination}. Mounted nodes can use it without remounting.\n`
+      );
     }
     return 0;
   }
@@ -4951,11 +5834,16 @@ async function storage(args, context) {
         boolean: ["json"],
         value: ["reservation", "reservation-id"],
       },
-      "Usage: ornn storage undeploy --reservation <reservation-id> [--json]",
+      "Usage: ornn storage undeploy --reservation <reservation-id> [--json]"
+    );
+    const reservationId = requiredOption(
+      options.reservation || options.reservationId,
+      "--reservation"
     );
-    const reservationId = requiredOption(options.reservation || options.reservationId, "--reservation");
     const payload = await cliRequest({
-      endpoint: computeEndpoint(`/nodes/reservations/${encodeURIComponent(reservationId)}/storage-attachment`),
+      endpoint: computeEndpoint(
+        `/nodes/reservations/${encodeURIComponent(reservationId)}/storage-attachment`
+      ),
       env: context.env,
       fetchImpl: context.fetchImpl,
       method: "DELETE",
@@ -4964,7 +5852,7 @@ async function storage(args, context) {
       writeJson(context.stdout, payload);
     } else {
       context.stdout.write(
-        "Storage detach requested. Ornn will flush every mounted node before releasing the volume.\n",
+        "Storage detach requested. Ornn will flush every mounted node before releasing the volume.\n"
       );
       if (payload?.attachment) {
         writeReservationStorageAttachment(context.stdout, payload.attachment);
@@ -4980,15 +5868,24 @@ async function storage(args, context) {
           boolean: ["json"],
           value: ["capacity-gib", "performance-tier", "reservation", "reservation-id"],
         },
-        "Usage: ornn storage filesystem deploy --reservation <reservation-id> [--performance-tier <tier>] [--capacity-gib <gib>] [--json]",
+        "Usage: ornn storage filesystem deploy --reservation <reservation-id> [--performance-tier <tier>] [--capacity-gib <gib>] [--json]"
+      );
+      const reservationId = requiredOption(
+        options.reservation || options.reservationId,
+        "--reservation"
       );
-      const reservationId = requiredOption(options.reservation || options.reservationId, "--reservation");
       const payload = await cliRequest({
         body: {
-          ...(optionProvided(options.performanceTier) ? { performance_tier: requiredOption(options.performanceTier, "--performance-tier") } : {}),
-          ...(optionProvided(options.capacityGib) ? { capacity_gib: positiveIntegerOption(options.capacityGib, "--capacity-gib") } : {}),
+          ...(optionProvided(options.performanceTier)
+            ? { performance_tier: requiredOption(options.performanceTier, "--performance-tier") }
+            : {}),
+          ...(optionProvided(options.capacityGib)
+            ? { capacity_gib: positiveIntegerOption(options.capacityGib, "--capacity-gib") }
+            : {}),
         },
-        endpoint: computeEndpoint(`/nodes/reservations/${encodeURIComponent(reservationId)}/filesystem-deployment`),
+        endpoint: computeEndpoint(
+          `/nodes/reservations/${encodeURIComponent(reservationId)}/filesystem-deployment`
+        ),
         env: context.env,
         fetchImpl: context.fetchImpl,
         method: "POST",
@@ -5008,11 +5905,16 @@ async function storage(args, context) {
           boolean: ["json"],
           value: ["reservation", "reservation-id"],
         },
-        "Usage: ornn storage filesystem status --reservation <reservation-id> [--json]",
+        "Usage: ornn storage filesystem status --reservation <reservation-id> [--json]"
+      );
+      const reservationId = requiredOption(
+        options.reservation || options.reservationId,
+        "--reservation"
       );
-      const reservationId = requiredOption(options.reservation || options.reservationId, "--reservation");
       const payload = await cliRequest({
-        endpoint: computeEndpoint(`/nodes/reservations/${encodeURIComponent(reservationId)}/storage-attachment`),
+        endpoint: computeEndpoint(
+          `/nodes/reservations/${encodeURIComponent(reservationId)}/storage-attachment`
+        ),
         env: context.env,
         fetchImpl: context.fetchImpl,
       });
@@ -5031,11 +5933,16 @@ async function storage(args, context) {
           boolean: ["json"],
           value: ["reservation", "reservation-id"],
         },
-        "Usage: ornn storage filesystem delete --reservation <reservation-id> [--json]",
+        "Usage: ornn storage filesystem delete --reservation <reservation-id> [--json]"
+      );
+      const reservationId = requiredOption(
+        options.reservation || options.reservationId,
+        "--reservation"
       );
-      const reservationId = requiredOption(options.reservation || options.reservationId, "--reservation");
       const payload = await cliRequest({
-        endpoint: computeEndpoint(`/nodes/reservations/${encodeURIComponent(reservationId)}/filesystem-deployment`),
+        endpoint: computeEndpoint(
+          `/nodes/reservations/${encodeURIComponent(reservationId)}/filesystem-deployment`
+        ),
         env: context.env,
         fetchImpl: context.fetchImpl,
         method: "DELETE",
@@ -5048,7 +5955,9 @@ async function storage(args, context) {
       }
       return 0;
     }
-    throw new Error("Usage: ornn storage filesystem deploy|status|delete --reservation <reservation-id> [--json]");
+    throw new Error(
+      "Usage: ornn storage filesystem deploy|status|delete --reservation <reservation-id> [--json]"
+    );
   }
   if (resource === "deploy" && subcommand === "status") {
     const options = parseCommandOptions(
@@ -5057,11 +5966,16 @@ async function storage(args, context) {
         boolean: ["json"],
         value: ["reservation", "reservation-id"],
       },
-      "Usage: ornn storage deploy status --reservation <reservation-id> [--json]",
+      "Usage: ornn storage deploy status --reservation <reservation-id> [--json]"
+    );
+    const reservationId = requiredOption(
+      options.reservation || options.reservationId,
+      "--reservation"
     );
-    const reservationId = requiredOption(options.reservation || options.reservationId, "--reservation");
     const payload = await cliRequest({
-      endpoint: computeEndpoint(`/nodes/reservations/${encodeURIComponent(reservationId)}/storage-attachment`),
+      endpoint: computeEndpoint(
+        `/nodes/reservations/${encodeURIComponent(reservationId)}/storage-attachment`
+      ),
       env: context.env,
       fetchImpl: context.fetchImpl,
     });
@@ -5080,12 +5994,15 @@ async function storage(args, context) {
         boolean: ["all-nodes", "json", "read-only", "read-write"],
         value: ["mount-path", "reservation", "reservation-id"],
       },
-      "Usage: ornn storage deploy <drive-id> --reservation <reservation-id> [--all-nodes] [--mount-path <path>] [--read-only|--read-write] [--json]",
+      "Usage: ornn storage deploy <drive-id> --reservation <reservation-id> [--all-nodes] [--mount-path <path>] [--read-only|--read-write] [--json]"
     );
     if (options.readOnly && options.readWrite) {
       throw new Error("Choose only one of --read-only or --read-write.");
     }
-    const reservationId = requiredOption(options.reservation || options.reservationId, "--reservation");
+    const reservationId = requiredOption(
+      options.reservation || options.reservationId,
+      "--reservation"
+    );
     const drive = await findStorageBucket(subcommand, context);
     const deploymentBlockReason = storageDeploymentBlockReason(drive);
     if (deploymentBlockReason) {
@@ -5094,11 +6011,15 @@ async function storage(args, context) {
     const payload = await cliRequest({
       body: {
         drive_id: subcommand,
-        ...(optionProvided(options.mountPath) ? { mount_path: requiredOption(options.mountPath, "--mount-path") } : {}),
+        ...(optionProvided(options.mountPath)
+          ? { mount_path: requiredOption(options.mountPath, "--mount-path") }
+          : {}),
         access_mode: options.readOnly ? "read-only" : "read-write",
         ...(options.allNodes ? { all_nodes: true } : {}),
       },
-      endpoint: computeEndpoint(`/nodes/reservations/${encodeURIComponent(reservationId)}/storage-deployment`),
+      endpoint: computeEndpoint(
+        `/nodes/reservations/${encodeURIComponent(reservationId)}/storage-deployment`
+      ),
       env: context.env,
       fetchImpl: context.fetchImpl,
       method: "POST",
@@ -5109,21 +6030,23 @@ async function storage(args, context) {
       context.stdout.write(
         options.allNodes
           ? "Storage deployment started for every compatible node in the group.\n"
-          : "Storage deployment started.\n",
+          : "Storage deployment started.\n"
       );
       writeReservationStorageAttachment(context.stdout, payload.attachment);
     }
     return 0;
   }
   if (resource === "deploy") {
-    throw new Error("Usage: ornn storage deploy <drive-id> --reservation <reservation-id> [--all-nodes] [--mount-path <path>] [--read-only|--read-write] [--json]");
+    throw new Error(
+      "Usage: ornn storage deploy <drive-id> --reservation <reservation-id> [--all-nodes] [--mount-path <path>] [--read-only|--read-write] [--json]"
+    );
   }
   if (resource === "buckets") {
     if (subcommand === "list") {
       const options = parseCommandOptions(
         [id, ...rest].filter(Boolean),
         { boolean: ["json"] },
-        "Usage: ornn storage buckets list [--json]",
+        "Usage: ornn storage buckets list [--json]"
       );
       const payload = await fetchStorageDrives(context);
       const buckets = storageBucketsFromPayload(payload);
@@ -5138,7 +6061,7 @@ async function storage(args, context) {
       const options = parseCommandOptions(
         rest,
         { boolean: ["json"] },
-        "Usage: ornn storage buckets show <drive-id> [--json]",
+        "Usage: ornn storage buckets show <drive-id> [--json]"
       );
       const bucket = await findStorageBucket(id, context);
       if (options.json) {
@@ -5152,7 +6075,7 @@ async function storage(args, context) {
       const options = parseCommandOptions(
         rest,
         { boolean: ["json"] },
-        "Usage: ornn storage buckets verify <drive-id> [--json]",
+        "Usage: ornn storage buckets verify <drive-id> [--json]"
       );
       const drive = await cliRequest({
         endpoint: computeEndpoint(`/nodes/storage-drives/${encodeURIComponent(id)}/verify-source`),
@@ -5165,7 +6088,7 @@ async function storage(args, context) {
         writeJson(context.stdout, drive);
       } else {
         context.stdout.write(
-          verificationFailed ? "Bucket source verification failed.\n" : "Bucket source verified.\n",
+          verificationFailed ? "Bucket source verification failed.\n" : "Bucket source verified.\n"
         );
         writeStorageDriveDetail(context.stdout, drive);
       }
@@ -5178,7 +6101,7 @@ async function storage(args, context) {
           boolean: ["json"],
           value: ["access-key-id", "secret-access-key", "secret-access-key-file"],
         },
-        "Usage: ornn storage buckets update-credentials <drive-id> --access-key-id <id> --secret-access-key-file <path> [--json]",
+        "Usage: ornn storage buckets update-credentials <drive-id> --access-key-id <id> --secret-access-key-file <path> [--json]"
       );
       if (options.secretAccessKey && options.secretAccessKeyFile) {
         throw new Error("Use only one of --secret-access-key or --secret-access-key-file.");
@@ -5194,7 +6117,9 @@ async function storage(args, context) {
           external_access_key_id: requiredOption(options.accessKeyId, "--access-key-id"),
           external_secret_access_key: secretAccessKey,
         },
-        endpoint: computeEndpoint(`/nodes/storage-drives/${encodeURIComponent(id)}/source-credentials`),
+        endpoint: computeEndpoint(
+          `/nodes/storage-drives/${encodeURIComponent(id)}/source-credentials`
+        ),
         env: context.env,
         fetchImpl: context.fetchImpl,
         method: "PATCH",
@@ -5211,7 +6136,7 @@ async function storage(args, context) {
       const options = parseCommandOptions(
         rest,
         { boolean: ["json"] },
-        "Usage: ornn storage buckets disconnect <drive-id> [--json]",
+        "Usage: ornn storage buckets disconnect <drive-id> [--json]"
       );
       await cliRequest({
         endpoint: computeEndpoint(`/nodes/storage-drives/${encodeURIComponent(id)}`),
@@ -5229,16 +6154,27 @@ async function storage(args, context) {
     }
     if (subcommand !== "connect" || !["gcs", "s3", "r2"].includes(id)) {
       throw new Error(
-        "Usage: ornn storage buckets list|show|connect|verify|update-credentials|disconnect",
+        "Usage: ornn storage buckets list|show|connect|verify|update-credentials|disconnect"
       );
     }
     const options = parseCommandOptions(
       rest,
       {
         boolean: ["json", "read-only", "read-write", "verify"],
-        value: ["access-key-id", "account-id", "bucket", "endpoint-url", "name", "prefix", "region", "secret-access-key", "secret-access-key-file", "url"],
+        value: [
+          "access-key-id",
+          "account-id",
+          "bucket",
+          "endpoint-url",
+          "name",
+          "prefix",
+          "region",
+          "secret-access-key",
+          "secret-access-key-file",
+          "url",
+        ],
       },
-      "Usage: ornn storage buckets connect gcs|s3|r2 --bucket <bucket>|--url <url> [--name <name>] [--prefix <prefix>] [--region <region>] [--account-id <id>|--endpoint-url <url>] [--access-key-id <id> --secret-access-key-file <path>] [--read-only|--read-write] [--verify] [--json]",
+      "Usage: ornn storage buckets connect gcs|s3|r2 --bucket <bucket>|--url <url> [--name <name>] [--prefix <prefix>] [--region <region>] [--account-id <id>|--endpoint-url <url>] [--access-key-id <id> --secret-access-key-file <path>] [--read-only|--read-write] [--verify] [--json]"
     );
     if (options.readOnly && options.readWrite) {
       throw new Error("Choose only one of --read-only or --read-write.");
@@ -5252,7 +6188,10 @@ async function storage(args, context) {
     if (options.secretAccessKey && options.secretAccessKeyFile) {
       throw new Error("Use only one of --secret-access-key or --secret-access-key-file.");
     }
-    if (id === "gcs" && (options.accessKeyId || options.secretAccessKey || options.secretAccessKeyFile)) {
+    if (
+      id === "gcs" &&
+      (options.accessKeyId || options.secretAccessKey || options.secretAccessKeyFile)
+    ) {
       throw new Error("Access key credentials are only supported for S3-compatible buckets.");
     }
     const secretAccessKey = options.secretAccessKeyFile
@@ -5264,7 +6203,11 @@ async function storage(args, context) {
     const source = storageBucketSourceFromOptions(id, options);
     const prefix = optionalStringOption(options.prefix) ?? source.prefix;
     const endpointOptions = { ...options };
-    if (!optionProvided(endpointOptions.accountId) && source.accountId && !optionProvided(endpointOptions.endpointUrl)) {
+    if (
+      !optionProvided(endpointOptions.accountId) &&
+      source.accountId &&
+      !optionProvided(endpointOptions.endpointUrl)
+    ) {
       endpointOptions.accountId = source.accountId;
     }
     const endpointUrl = storageBucketEndpointUrl(id, endpointOptions);
@@ -5277,7 +6220,8 @@ async function storage(args, context) {
         source_provider: sourceProvider,
         external_bucket: bucketName,
         external_prefix: prefix,
-        external_region: optionalStringOption(options.region) ?? source.region ?? (id === "r2" ? "auto" : null),
+        external_region:
+          optionalStringOption(options.region) ?? source.region ?? (id === "r2" ? "auto" : null),
         external_read_only: options.readWrite ? false : true,
         ...(id === "r2" ? { external_s3_provider: "cloudflare_r2" } : {}),
         ...(id === "s3" ? { external_s3_provider: "aws_s3" } : {}),
@@ -5298,7 +6242,8 @@ async function storage(args, context) {
       endpointUrl,
       prefix,
       provider: id,
-      region: optionalStringOption(options.region) ?? source.region ?? (id === "r2" ? "auto" : null),
+      region:
+        optionalStringOption(options.region) ?? source.region ?? (id === "r2" ? "auto" : null),
       target: drive.import_target,
     });
     if (options.json) {
@@ -5309,7 +6254,7 @@ async function storage(args, context) {
         context.stdout.write(
           drive?.source?.connection_status === "verification_failed"
             ? "Bucket source verification failed.\n"
-            : "Bucket source verified.\n",
+            : "Bucket source verified.\n"
         );
       }
       writeStorageDriveDetail(context.stdout, drive);
@@ -5322,7 +6267,7 @@ async function storage(args, context) {
   }
   if (!["drives", "volumes"].includes(resource)) {
     throw new Error(
-      "Usage: ornn storage volumes list|show|create|refresh|clear|delete; ornn storage files upload <drive-id> <local-file>; ornn storage buckets connect gcs|s3|r2 --bucket <bucket>",
+      "Usage: ornn storage volumes list|show|create|refresh|clear|delete; ornn storage files upload <drive-id> <local-file>; ornn storage buckets connect gcs|s3|r2 --bucket <bucket>"
     );
   }
 
@@ -5330,7 +6275,7 @@ async function storage(args, context) {
     const options = parseCommandOptions(
       [id, ...rest].filter(Boolean),
       { boolean: ["json"] },
-      "Usage: ornn storage volumes list [--json]",
+      "Usage: ornn storage volumes list [--json]"
     );
     const payload = await fetchStorageDrives(context);
     if (options.json) {
@@ -5345,7 +6290,7 @@ async function storage(args, context) {
     const options = parseCommandOptions(
       rest,
       { boolean: ["json"] },
-      "Usage: ornn storage volumes show <drive-id> [--json]",
+      "Usage: ornn storage volumes show <drive-id> [--json]"
     );
     const drive = await findStorageDrive(id, context);
     if (options.json) {
@@ -5360,7 +6305,7 @@ async function storage(args, context) {
     const options = parseCommandOptions(
       [id, ...rest].filter(Boolean),
       { boolean: ["json"], value: ["name", "source", "source-drive-id"] },
-      "Usage: ornn storage volumes create --name <name> [--source <drive-id>] [--json]",
+      "Usage: ornn storage volumes create --name <name> [--source <drive-id>] [--json]"
     );
     const sourceDriveId = optionProvided(options.sourceDriveId)
       ? requiredOption(options.sourceDriveId, "--source-drive-id")
@@ -5388,7 +6333,7 @@ async function storage(args, context) {
     const options = parseCommandOptions(
       rest,
       { boolean: ["json"] },
-      "Usage: ornn storage volumes refresh <drive-id> [--json]",
+      "Usage: ornn storage volumes refresh <drive-id> [--json]"
     );
     const drive = await cliRequest({
       endpoint: computeEndpoint(`/nodes/storage-drives/${encodeURIComponent(id)}/refresh`),
@@ -5409,7 +6354,7 @@ async function storage(args, context) {
     const options = parseCommandOptions(
       rest,
       { boolean: ["json"] },
-      "Usage: ornn storage volumes clear <drive-id> [--json]",
+      "Usage: ornn storage volumes clear <drive-id> [--json]"
     );
     await cliRequest({
       endpoint: computeEndpoint(`/nodes/storage-drives/${encodeURIComponent(id)}/contents`),
@@ -5430,7 +6375,7 @@ async function storage(args, context) {
     const options = parseCommandOptions(
       rest,
       { boolean: ["json"] },
-      "Usage: ornn storage volumes delete <drive-id> [--json]",
+      "Usage: ornn storage volumes delete <drive-id> [--json]"
     );
     await cliRequest({
       endpoint: computeEndpoint(`/nodes/storage-drives/${encodeURIComponent(id)}`),
@@ -5456,7 +6401,7 @@ async function keys(args, context) {
     const options = parseCommandOptions(
       rest,
       { boolean: ["json"], value: ["label", "public-key", "public-key-file"] },
-      "Usage: ornn keys add [<public-key-file>] [--public-key <key>] [--label <label>] [--json]",
+      "Usage: ornn keys add [<public-key-file>] [--public-key <key>] [--label <label>] [--json]"
     );
     const publicKey = await publicKeyFromRef(maybePath);
     const key = await ensureAccountSshKey(publicKey, options.label, context);
@@ -5483,7 +6428,7 @@ async function nodeKeys(args, context) {
     const options = parseCommandOptions(
       rest,
       { boolean: ["json"] },
-      `Usage: ornn nodes keys ${action} <node-id> [--json]`,
+      `Usage: ornn nodes keys ${action} <node-id> [--json]`
     );
     const machine = await fetchMachine(nodeId, context);
     const status = nodeKeyStatus(machine);
@@ -5500,9 +6445,17 @@ async function nodeKeys(args, context) {
       rest,
       {
         boolean: ["json"],
-        value: ["key", "key-id", "label", "public-key", "public-key-file", "request-id", "ssh-key-id"],
+        value: [
+          "key",
+          "key-id",
+          "label",
+          "public-key",
+          "public-key-file",
+          "request-id",
+          "ssh-key-id",
+        ],
       },
-      `Usage: ornn nodes keys ${action} <node-id> --key <path|id|label> [--json]`,
+      `Usage: ornn nodes keys ${action} <node-id> --key <path|id|label> [--json]`
     );
     const sshKeyIds = await resolveAccountSshKeyIds(options, context);
     if (!sshKeyIds.length) {
@@ -5536,7 +6489,7 @@ async function access(args, context) {
     const options = parseCommandOptions(
       rest,
       { boolean: ["json"] },
-      "Usage: ornn access show <reservation-id> [--json]",
+      "Usage: ornn access show <reservation-id> [--json]"
     );
     const payload = await getReservationMachines(reservationId, context);
     if (options.json) {
@@ -5572,9 +6525,11 @@ async function access(args, context) {
           "wait-timeout",
         ],
       },
-      "Usage: ornn access activate <reservation-id> --key <path|id|label> [--mode bare-metal|vm] [--username <name>] [--network public|private] [--storage-load-drive-id <id>] [--storage-save-drive-id <id>] [--no-open] [--json]",
+      "Usage: ornn access activate <reservation-id> --key <path|id|label> [--mode bare-metal|vm] [--username <name>] [--network public|private] [--storage-load-drive-id <id>] [--storage-save-drive-id <id>] [--no-open] [--json]"
     );
-    const result = await launchReservationAccess(reservationId, options, context, { openDefault: true });
+    const result = await launchReservationAccess(reservationId, options, context, {
+      openDefault: true,
+    });
     if (options.json) {
       writeJson(context.stdout, accessActivateJsonResult(result));
     } else {
@@ -5612,14 +6567,14 @@ async function access(args, context) {
           "wait-timeout",
         ],
       },
-      "Usage: ornn access switch <reservation-id> --network public|private --key <path|id|label> [--mode bare-metal|vm] [--username <name>] [--wait] [--json]",
+      "Usage: ornn access switch <reservation-id> --network public|private --key <path|id|label> [--mode bare-metal|vm] [--username <name>] [--wait] [--json]"
     );
     const result = await switchReservationAccess(reservationId, options, context);
     if (options.json) {
       writeJson(context.stdout, result);
     } else {
       context.stdout.write(
-        `Switched to ${displayAccessMode(result.mode)} / ${result.network_mode} on reservation ${reservationId}.\n`,
+        `Switched to ${displayAccessMode(result.mode)} / ${result.network_mode} on reservation ${reservationId}.\n`
       );
       writeAccessLaunchSummary(context.stdout, { machines: result.machines });
       if (result.wait) {
@@ -5633,14 +6588,16 @@ async function access(args, context) {
     const options = parseCommandOptions(
       rest,
       { boolean: ["json"], value: ["request-id", "ssh-key-id"] },
-      "Usage: ornn access push-keys <reservation-id> --ssh-key-id <id> [--json]",
+      "Usage: ornn access push-keys <reservation-id> --ssh-key-id <id> [--json]"
     );
     const sshKeyIds = requiredArrayOption(options.sshKeyId, "--ssh-key-id");
     const pushed = await pushReservationKeys(reservationId, sshKeyIds, options.requestId, context);
     if (options.json) {
       writeJson(context.stdout, { machines: pushed });
     } else {
-      context.stdout.write(`SSH key update queued for ${pushed.length} machine${pushed.length === 1 ? "" : "s"}.\n`);
+      context.stdout.write(
+        `SSH key update queued for ${pushed.length} machine${pushed.length === 1 ? "" : "s"}.\n`
+      );
     }
     return 0;
   }
@@ -5658,7 +6615,7 @@ async function accessKeys(args, context) {
     const options = parseCommandOptions(
       rest,
       { boolean: ["json"] },
-      "Usage: ornn access keys list <reservation-id> [--json]",
+      "Usage: ornn access keys list <reservation-id> [--json]"
     );
     const payload = await fetchReservationSshKeys(reservationId, context);
     if (options.json) {
@@ -5673,7 +6630,7 @@ async function accessKeys(args, context) {
     const options = parseCommandOptions(
       rest,
       { boolean: ["json"], value: ["label", "public-key", "public-key-file"] },
-      "Usage: ornn access keys add <reservation-id> --public-key <key> [--label <label>] [--json]",
+      "Usage: ornn access keys add <reservation-id> --public-key <key> [--label <label>] [--json]"
     );
     const publicKey = options.publicKeyFile
       ? (await readFile(options.publicKeyFile, "utf8")).trim()
@@ -5704,14 +6661,16 @@ async function accessKeys(args, context) {
     const options = parseCommandOptions(
       rest,
       { boolean: ["json"], value: ["request-id", "ssh-key-id"] },
-      "Usage: ornn access keys push <reservation-id> --ssh-key-id <id> [--json]",
+      "Usage: ornn access keys push <reservation-id> --ssh-key-id <id> [--json]"
     );
     const sshKeyIds = requiredArrayOption(options.sshKeyId, "--ssh-key-id");
     const pushed = await pushReservationKeys(reservationId, sshKeyIds, options.requestId, context);
     if (options.json) {
       writeJson(context.stdout, { machines: pushed });
     } else {
-      context.stdout.write(`SSH key update queued for ${pushed.length} machine${pushed.length === 1 ? "" : "s"}.\n`);
+      context.stdout.write(
+        `SSH key update queued for ${pushed.length} machine${pushed.length === 1 ? "" : "s"}.\n`
+      );
     }
     return 0;
   }
@@ -5720,7 +6679,7 @@ async function accessKeys(args, context) {
     const options = parseCommandOptions(
       rest,
       { boolean: ["json"] },
-      "Usage: ornn access keys status <reservation-id> [--json]",
+      "Usage: ornn access keys status <reservation-id> [--json]"
     );
     const status = await buildReservationKeyStatus(reservationId, context);
     if (options.json) {
@@ -5740,7 +6699,7 @@ async function billing(args, context) {
     const options = parseCommandOptions(
       rest,
       { boolean: ["json"] },
-      "Usage: ornn billing summary [--json]",
+      "Usage: ornn billing summary [--json]"
     );
     const invoices = await fetchBillingInvoices(context);
     const summary = billingSummaryFromInvoices(invoices);
@@ -5756,7 +6715,7 @@ async function billing(args, context) {
     const options = parseCommandOptions(
       rest,
       { boolean: ["json"] },
-      "Usage: ornn billing invoices [--json]",
+      "Usage: ornn billing invoices [--json]"
     );
     const invoices = await fetchBillingInvoices(context);
     if (options.json) {
@@ -5771,14 +6730,16 @@ async function billing(args, context) {
     const options = parseCommandOptions(
       rest,
       { boolean: ["json"], value: ["end", "start"] },
-      "Usage: ornn billing showback --start <yyyy-mm-dd> --end <yyyy-mm-dd> [--json]",
+      "Usage: ornn billing showback --start <yyyy-mm-dd> --end <yyyy-mm-dd> [--json]"
     );
     const { endDate, startDate } = dateRangeOptions({
       endDate: options.end,
       startDate: options.start,
     });
     const report = await cliRequest({
-      endpoint: computeEndpoint(`/tenants/me/showback${buildQuery({ end: endDate, start: startDate })}`),
+      endpoint: computeEndpoint(
+        `/tenants/me/showback${buildQuery({ end: endDate, start: startDate })}`
+      ),
       env: context.env,
       fetchImpl: context.fetchImpl,
     });
@@ -5794,7 +6755,7 @@ async function billing(args, context) {
     const options = parseCommandOptions(
       rest,
       { boolean: ["json", "no-open"] },
-      "Usage: ornn billing open [--no-open] [--json]",
+      "Usage: ornn billing open [--no-open] [--json]"
     );
     const opened = await openFabricPage(context, "/account?tab=billing", {
       json: options.json,
@@ -5815,7 +6776,7 @@ async function sshKeys(args, context) {
     const options = parseCommandOptions(
       [id, ...rest].filter(Boolean),
       { boolean: ["json"] },
-      "Usage: ornn ssh-keys list [--json]",
+      "Usage: ornn ssh-keys list [--json]"
     );
     const keys = await cliRequest({
       endpoint: computeEndpoint("/nodes/tenants/me/ssh-keys"),
@@ -5834,7 +6795,7 @@ async function sshKeys(args, context) {
     const options = parseCommandOptions(
       [id, ...rest].filter(Boolean),
       { boolean: ["json"], value: ["label", "public-key", "public-key-file"] },
-      "Usage: ornn ssh-keys add --public-key <key> [--label <label>] [--json]",
+      "Usage: ornn ssh-keys add --public-key <key> [--label <label>] [--json]"
     );
     const publicKey = options.publicKeyFile
       ? (await readFile(options.publicKeyFile, "utf8")).trim()
@@ -5864,7 +6825,7 @@ async function sshKeys(args, context) {
     const options = parseCommandOptions(
       rest,
       { boolean: ["json"] },
-      "Usage: ornn ssh-keys delete <key-id> [--json]",
+      "Usage: ornn ssh-keys delete <key-id> [--json]"
     );
     const response = await cliRequest({
       endpoint: computeEndpoint(`/nodes/tenants/me/ssh-keys/${id}`),
@@ -5940,14 +6901,17 @@ function inventoryAvailableGpuCount(record) {
 
 function normalizeInventoryListing(record) {
   const gpuCount = inventoryAvailableGpuCount(record);
+  const facility = record.site_nickname ?? record.facility ?? record.site ?? "Unknown facility";
+  // Customer availability never exposes real supplier/operator identity.
+  const operator = "Ornn Compute";
   return {
     id: record.id,
     kind: "inventory",
     source: "primary",
     gpu_type: record.gpu_type ?? "GPU",
     gpu_count: gpuCount || null,
-    operator: record.site_operator ?? record.operator ?? "Unknown operator",
-    facility: record.site_nickname ?? record.facility ?? record.site ?? "Unknown facility",
+    operator,
+    facility,
     location: record.location ?? record.region ?? null,
     network: record.fabric_type ?? record.network_hardware ?? record.internet ?? null,
     start_date: record.available_from ?? null,
@@ -5955,7 +6919,8 @@ function normalizeInventoryListing(record) {
     price_per_gpu_hour: resolveBuyNowUsdPerGpuHour(record),
     checkout_url: `/checkout?inventory=${encodeURIComponent(record.id)}`,
     marketplace_url: `/marketplace/${encodeURIComponent(record.id)}`,
-    inventory: record,
+    // Strip supplier identity before echoing the raw inventory row in --json.
+    inventory: { ...record, site_operator: operator },
   };
 }
 
@@ -5997,7 +6962,9 @@ function textMatches(value, filter) {
   if (!filter) {
     return true;
   }
-  return String(value ?? "").toLowerCase().includes(String(filter).toLowerCase());
+  return String(value ?? "")
+    .toLowerCase()
+    .includes(String(filter).toLowerCase());
 }
 
 async function resolveListing(listingId, context) {
@@ -6012,7 +6979,11 @@ function marketplacePathForListing(listing) {
   return listing.marketplace_url || `/marketplace/${encodeURIComponent(listing.id)}`;
 }
 
-async function openFabricPage(context, pathOrUrl, { json = false, label = "page", noOpen = false, payload = {} } = {}) {
+async function openFabricPage(
+  context,
+  pathOrUrl,
+  { json = false, label = "page", noOpen = false, payload = {} } = {}
+) {
   const url = await resolveFabricUrl(context, pathOrUrl);
   const opened = noOpen ? false : await context.openBrowserImpl(url);
   const result = { ...payload, label, opened, url };
@@ -6218,21 +7189,26 @@ export async function fetchAllTenantReservations(context) {
         env: context.env,
         fetchImpl: context.fetchImpl,
       }),
-      "reservations",
+      "reservations"
     );
     all.push(...batch);
     if (batch.length < limit) {
       return all;
     }
     const nextCursor = batch.at(-1)?.id;
-    if (typeof nextCursor !== "string" || !nextCursor.trim() || nextCursor === cursor || seenCursors.has(nextCursor)) {
+    if (
+      typeof nextCursor !== "string" ||
+      !nextCursor.trim() ||
+      nextCursor === cursor ||
+      seenCursors.has(nextCursor)
+    ) {
       throw new Error("Reservation cursor pagination did not advance.");
     }
     cursor = nextCursor;
     seenCursors.add(cursor);
   }
   context.stderr?.write(
-    `Warning: reservation scan reached its pagination safety limit; continuing with the first ${all.length} records.\n`,
+    `Warning: reservation scan reached its pagination safety limit; continuing with the first ${all.length} records.\n`
   );
   return all;
 }
@@ -6244,7 +7220,9 @@ function writeReservationList(stdout, reservations) {
   }
   stdout.write("GPU reservations:\n");
   for (const reservation of reservations) {
-    stdout.write(`- ${reservation.id} ${reservation.status || "unknown"} ${reservation.gpu_count ?? "?"} GPUs`);
+    stdout.write(
+      `- ${reservation.id} ${reservation.status || "unknown"} ${reservation.gpu_count ?? "?"} GPUs`
+    );
     stdout.write(` ${reservation.start_date || "TBD"} to ${reservation.end_date || "TBD"}`);
     if (reservation.price_per_gpu_hour !== undefined && reservation.price_per_gpu_hour !== null) {
       stdout.write(` at ${formatUsd(reservation.price_per_gpu_hour)}/GPU-hr`);
@@ -6262,7 +7240,7 @@ function writeDeployableCommerceReservations(stdout, payload) {
   stdout.write("Deployable Commerce reservations:\n");
   for (const reservation of reservations) {
     stdout.write(
-      `- ${reservation.reservation_id}  listing=${reservation.listing_id}  ${reservation.gpu_count} GPUs  ${formatDateRange(reservation.start_at, reservation.end_at)}\n`,
+      `- ${reservation.reservation_id}  listing=${reservation.listing_id}  ${reservation.gpu_count} GPUs  ${formatDateRange(reservation.start_at, reservation.end_at)}\n`
     );
   }
   if (payload?.scan_truncated) {
@@ -6273,7 +7251,7 @@ function writeDeployableCommerceReservations(stdout, payload) {
 function warnIfCommerceDeployStampMissed(payload, context) {
   if (payload?.commerce_first_deployed_recorded === false) {
     context.stderr.write(
-      "Warning: deployment succeeded, but Commerce did not record first_deployed_at. Review and repair the Commerce reservation.\n",
+      "Warning: deployment succeeded, but Commerce did not record first_deployed_at. Review and repair the Commerce reservation.\n"
     );
   }
 }
@@ -6291,7 +7269,7 @@ function writeCreatedCommerceReservation(stdout, payload, tenantLabel) {
   stdout.write(`Window: ${formatDateRange(reservation.startAt, reservation.endAt)}\n`);
   stdout.write(`Price: ${formatUsd(reservation.pricePerGpuHr)}/GPU-hr\n`);
   stdout.write(
-    `Deploy with: ornn fleet deploy ${payload?.fleet_id || "<fleet-id>"} --tenant ${shellQuote(tenantLabel)} --commerce-reservation ${reservation.reservationId}\n`,
+    `Deploy with: ornn fleet deploy ${payload?.fleet_id || "<fleet-id>"} --tenant ${shellQuote(tenantLabel)} --commerce-reservation ${reservation.reservationId}\n`
   );
 }
 
@@ -6346,7 +7324,9 @@ async function verifyStorageBucketSource(driveId, context) {
 
 async function findStorageDrive(driveId, context) {
   const payload = await fetchStorageDrives(context);
-  const drive = storageDrivesFromPayload(payload).find((item) => String(item.id) === String(driveId));
+  const drive = storageDrivesFromPayload(payload).find(
+    (item) => String(item.id) === String(driveId)
+  );
   if (!drive) {
     throw new Error(`Storage volume not found: ${driveId}`);
   }
@@ -6355,7 +7335,9 @@ async function findStorageDrive(driveId, context) {
 
 async function findStorageBucket(driveId, context) {
   const payload = await fetchStorageDrives(context);
-  const bucket = storageBucketsFromPayload(payload).find((item) => String(item.id) === String(driveId));
+  const bucket = storageBucketsFromPayload(payload).find(
+    (item) => String(item.id) === String(driveId)
+  );
   if (!bucket) {
     throw new Error(`Storage bucket not found: ${driveId}`);
   }
@@ -6374,7 +7356,12 @@ async function fetchReservationSshKeys(reservationId, context) {
   });
 }
 
-async function launchReservationAccess(reservationId, options, context, { openDefault = false } = {}) {
+async function launchReservationAccess(
+  reservationId,
+  options,
+  context,
+  { openDefault = false } = {}
+) {
   const mode = normalizeAccessMode(options.mode || "bare-metal");
   const networkOption = optionProvided(options.networkMode) ? options.networkMode : options.network;
   const sshKeyIds = await resolveAccountSshKeyIds(options, context);
@@ -6396,10 +7383,16 @@ async function launchReservationAccess(reservationId, options, context, { openDe
     launchPayload.network_mode = normalizeNodeNetwork(networkOption);
   }
   if (optionProvided(options.storageLoadDriveId)) {
-    launchPayload.storage_load_drive_id = requiredOption(options.storageLoadDriveId, "--storage-load-drive-id");
+    launchPayload.storage_load_drive_id = requiredOption(
+      options.storageLoadDriveId,
+      "--storage-load-drive-id"
+    );
   }
   if (optionProvided(options.storageSaveDriveId)) {
-    launchPayload.storage_save_drive_id = requiredOption(options.storageSaveDriveId, "--storage-save-drive-id");
+    launchPayload.storage_save_drive_id = requiredOption(
+      options.storageSaveDriveId,
+      "--storage-save-drive-id"
+    );
   }
   const access = await cliRequest({
     body: { access_mode: mode, image_id: null },
@@ -6415,13 +7408,16 @@ async function launchReservationAccess(reservationId, options, context, { openDe
     fetchImpl: context.fetchImpl,
     method: "POST",
   });
-  const opened = openDefault || options.open
-    ? await openFabricPage(context, `/portfolio/${encodeURIComponent(reservationId)}`, {
-        label: "reservation",
-        noOpen: Boolean(options.noOpen),
-      })
+  const opened =
+    openDefault || options.open
+      ? await openFabricPage(context, `/portfolio/${encodeURIComponent(reservationId)}`, {
+          label: "reservation",
+          noOpen: Boolean(options.noOpen),
+        })
+      : null;
+  const wait = options.wait
+    ? await waitForSshReady(reservationId, waitOptions(options), context)
     : null;
-  const wait = options.wait ? await waitForSshReady(reservationId, waitOptions(options), context) : null;
   return {
     access,
     launch,
@@ -6459,7 +7455,9 @@ async function switchReservationAccess(reservationId, options, context) {
     method: "POST",
   });
   const machines = Array.isArray(switched?.machines) ? switched.machines : [];
-  const wait = options.wait ? await waitForSshReady(reservationId, waitOptions(options), context) : null;
+  const wait = options.wait
+    ? await waitForSshReady(reservationId, waitOptions(options), context)
+    : null;
   return {
     machines,
     mode,
@@ -6492,7 +7490,7 @@ async function fetchTenantClusters(context) {
 async function fetchEligibleClusterNodes(reservationId, type, networkMode, context) {
   return await cliRequest({
     endpoint: computeEndpoint(
-      `/clusters/reservations/${encodeURIComponent(reservationId)}/eligible-nodes?access_mode=${encodeURIComponent(type)}&network_mode=${encodeURIComponent(networkMode)}`,
+      `/clusters/reservations/${encodeURIComponent(reservationId)}/eligible-nodes?access_mode=${encodeURIComponent(type)}&network_mode=${encodeURIComponent(networkMode)}`
     ),
     env: context.env,
     fetchImpl: context.fetchImpl,
@@ -6537,7 +7535,9 @@ async function teardownCluster(reservationId, type, context) {
 async function addClusterNode(reservationId, nodeId, context) {
   return await cliRequest({
     body: { node_id: nodeId },
-    endpoint: computeEndpoint(`/clusters/reservations/${encodeURIComponent(reservationId)}/cluster/nodes`),
+    endpoint: computeEndpoint(
+      `/clusters/reservations/${encodeURIComponent(reservationId)}/cluster/nodes`
+    ),
     env: context.env,
     fetchImpl: context.fetchImpl,
     method: "POST",
@@ -6547,7 +7547,7 @@ async function addClusterNode(reservationId, nodeId, context) {
 async function removeClusterNode(reservationId, nodeId, context) {
   return await cliRequest({
     endpoint: computeEndpoint(
-      `/clusters/reservations/${encodeURIComponent(reservationId)}/cluster/nodes/${encodeURIComponent(nodeId)}`,
+      `/clusters/reservations/${encodeURIComponent(reservationId)}/cluster/nodes/${encodeURIComponent(nodeId)}`
     ),
     env: context.env,
     fetchImpl: context.fetchImpl,
@@ -6560,7 +7560,9 @@ async function resolveClusterTypeForReservation(reservationId, options, context)
     return normalizeClusterType(options.type || options.mode);
   }
   const clusters = requireArrayPayload(await fetchTenantClusters(context), "clusters");
-  const cluster = clusters.find((candidate) => String(candidate.reservation_id || "") === String(reservationId));
+  const cluster = clusters.find(
+    (candidate) => String(candidate.reservation_id || "") === String(reservationId)
+  );
   if (cluster?.access_mode) {
     return normalizeClusterType(cluster.access_mode);
   }
@@ -6599,7 +7601,9 @@ async function waitForClusterActive(reservationId, type, options, context) {
     if (Date.now() >= deadline) {
       const detail = lastError instanceof Error ? ` Last error: ${lastError.message}` : "";
       const state = lastCluster?.state ? ` Last state: ${lastCluster.state}.` : "";
-      throw new Error(`Timed out waiting for ${displayClusterType(type)} cluster ${reservationId}.${state}${detail}`);
+      throw new Error(
+        `Timed out waiting for ${displayClusterType(type)} cluster ${reservationId}.${state}${detail}`
+      );
     }
     await sleep(options.intervalSeconds * 1000);
   }
@@ -6623,7 +7627,7 @@ function clusterLaunchPayload(options) {
   if (optionProvided(options.storageLoadSizeBytes)) {
     payload.storage_load_size_bytes = nonNegativeIntegerOption(
       options.storageLoadSizeBytes,
-      "--storage-load-size-bytes",
+      "--storage-load-size-bytes"
     );
   }
   return payload;
@@ -6654,7 +7658,7 @@ async function fetchTenantMachines(context) {
         reservation_id: machine.reservation_id || reservation.id,
         reservation_status: reservation.status || null,
       }));
-    }),
+    })
   );
   return settled.flatMap((result) => (result.status === "fulfilled" ? result.value : []));
 }
@@ -6670,7 +7674,7 @@ async function fetchMachine(nodeId, context) {
 async function fetchTenantMetricSnapshots(context) {
   const machines = await fetchTenantMachines(context);
   const settled = await Promise.allSettled(
-    machines.map((machine) => fetchMetricSnapshotForMachine(machine, context)),
+    machines.map((machine) => fetchMetricSnapshotForMachine(machine, context))
   );
   return settled.map((result, index) => {
     if (result.status === "fulfilled") {
@@ -6702,7 +7706,8 @@ async function resolveMetricMachine(nodeId, context) {
 
   if (!machine?.reservation_id) {
     const machines = await fetchTenantMachines(context);
-    machine = machines.find((candidate) => String(machineId(candidate)) === String(nodeId)) ?? machine;
+    machine =
+      machines.find((candidate) => String(machineId(candidate)) === String(nodeId)) ?? machine;
   }
 
   if (!machine) {
@@ -6727,7 +7732,7 @@ async function fetchMetricHistoryForNode(nodeId, options, context) {
   });
   const series = await cliRequest({
     endpoint: computeEndpoint(
-      `/nodes/reservations/${encodeURIComponent(machine.reservation_id)}/telemetry-history${query}`,
+      `/nodes/reservations/${encodeURIComponent(machine.reservation_id)}/telemetry-history${query}`
     ),
     env: context.env,
     fetchImpl: context.fetchImpl,
@@ -6746,7 +7751,7 @@ async function fetchMetricSnapshotForMachine(machine, context) {
   }
   const payload = await cliRequest({
     endpoint: computeEndpoint(
-      `/nodes/reservations/${encodeURIComponent(reservationId)}/live-metrics?machine_id=${encodeURIComponent(machineId(machine))}`,
+      `/nodes/reservations/${encodeURIComponent(reservationId)}/live-metrics?machine_id=${encodeURIComponent(machineId(machine))}`
     ),
     env: context.env,
     fetchImpl: context.fetchImpl,
@@ -6807,11 +7812,13 @@ async function resolveSshTarget(identifier, context) {
   }
   if (ready.length > 1) {
     throw new Error(
-      `Reservation ${identifier} has ${ready.length} SSH-ready nodes. Use \`ornn nodes list\` and pass a node id.`,
+      `Reservation ${identifier} has ${ready.length} SSH-ready nodes. Use \`ornn nodes list\` and pass a node id.`
     );
   }
   if (machines.length) {
-    throw new Error(`No SSH-ready nodes found for reservation ${identifier}. Run \`ornn nodes wait ${identifier}\`.`);
+    throw new Error(
+      `No SSH-ready nodes found for reservation ${identifier}. Run \`ornn nodes wait ${identifier}\`.`
+    );
   }
   throw new Error(`Node or reservation not found: ${identifier}`);
 }
@@ -6877,13 +7884,18 @@ function waitOptions(options) {
       ? parsePositiveNumber(options.waitInterval, "--wait-interval")
       : 5,
     timeoutSeconds: optionProvided(timeoutValue)
-      ? parsePositiveNumber(timeoutValue, optionProvided(options.waitTimeout) ? "--wait-timeout" : "--timeout")
+      ? parsePositiveNumber(
+          timeoutValue,
+          optionProvided(options.waitTimeout) ? "--wait-timeout" : "--timeout"
+        )
       : 600,
   };
 }
 
 async function resolveAccountSshKeyIds(options, context) {
-  const rawSshKeyIds = arrayOptionPreserveEmpty(options.sshKeyId).map((value) => String(value).trim());
+  const rawSshKeyIds = arrayOptionPreserveEmpty(options.sshKeyId).map((value) =>
+    String(value).trim()
+  );
   const rawKeyIds = arrayOptionPreserveEmpty(options.keyId).map((value) => String(value).trim());
   if (rawSshKeyIds.some((value) => !value)) {
     throw new Error("--ssh-key-id is required.");
@@ -6896,7 +7908,9 @@ async function resolveAccountSshKeyIds(options, context) {
     ...arrayOption(options.key),
     ...arrayOption(options.publicKeyFile),
     ...arrayOption(options.publicKey),
-  ].map((value) => String(value).trim()).filter(Boolean);
+  ]
+    .map((value) => String(value).trim())
+    .filter(Boolean);
 
   const resolved = [...directIds];
   for (const ref of refs) {
@@ -6987,7 +8001,7 @@ async function publicKeyFromRef(ref) {
   }
   if (/PRIVATE KEY/.test(contents)) {
     throw new Error(
-      `Refusing to upload a private SSH key. Pass the matching public key file (${ref}.pub) or use a saved key id/label.`,
+      `Refusing to upload a private SSH key. Pass the matching public key file (${ref}.pub) or use a saved key id/label.`
     );
   }
   throw new Error("File does not contain a supported SSH public key.");
@@ -7052,7 +8066,8 @@ function reservationKeyMachineStatus(key, machine) {
     machine_id: machineId(machine),
     machine_state: machineState(machine),
     status: metadata?.status || (fallbackInstalled ? "installed" : "associated"),
-    linux_username: metadata?.linux_username || key.linux_username || machine.linux_username || null,
+    linux_username:
+      metadata?.linux_username || key.linux_username || machine.linux_username || null,
     queued_at: metadata?.queued_at || null,
     pushed_at: metadata?.pushed_at || (fallbackInstalled ? machine.keys_pushed_at : null),
     failed_at: metadata?.failed_at || null,
@@ -7067,9 +8082,12 @@ function reservationKeyMetadataForMachine(key, machine) {
   }
   return (
     machine.authorized_key_metadata.find((item) => {
-      const itemKeyId = item.ssh_key_id === undefined || item.ssh_key_id === null ? "" : String(item.ssh_key_id);
+      const itemKeyId =
+        item.ssh_key_id === undefined || item.ssh_key_id === null ? "" : String(item.ssh_key_id);
       const keyId = key.id === undefined || key.id === null ? "" : String(key.id);
-      return (keyId && itemKeyId === keyId) || (key.fingerprint && item.fingerprint === key.fingerprint);
+      return (
+        (keyId && itemKeyId === keyId) || (key.fingerprint && item.fingerprint === key.fingerprint)
+      );
     }) || null
   );
 }
@@ -7195,7 +8213,11 @@ function writeMetricSnapshotDetail(stdout, snapshot) {
 function writeMetricHistory(stdout, result) {
   const points = Array.isArray(result.series?.points) ? result.series.points : [];
   stdout.write(`Telemetry history for ${result.node_id}\n`);
-  writeOptionalStatusLine(stdout, "Reservation", result.series?.reservation_id || result.machine?.reservation_id);
+  writeOptionalStatusLine(
+    stdout,
+    "Reservation",
+    result.series?.reservation_id || result.machine?.reservation_id
+  );
   stdout.write(`Points: ${points.length}\n`);
   if (!points.length) {
     return;
@@ -7209,7 +8231,9 @@ function writeMetricHistory(stdout, result) {
     stdout.write(`- ${point.observed_at || "unknown"}`);
     stdout.write(` samples=${point.samples ?? 1}`);
     stdout.write(` gpu=${formatMetricValue(metricValue(metrics, "gpu_utilization"), "%")}`);
-    stdout.write(` gpu_mem=${formatMetricValue(metricValue(metrics, "gpu_memory_utilization"), "%")}`);
+    stdout.write(
+      ` gpu_mem=${formatMetricValue(metricValue(metrics, "gpu_memory_utilization"), "%")}`
+    );
     stdout.write(` power=${formatMetricValue(metricValue(metrics, "gpu_power_w"), "W")}`);
     stdout.write(` tflops=${formatMetricValue(metricValue(metrics, "gpu_tflops"), "TFLOP/s")}`);
     stdout.write("\n");
@@ -7298,14 +8322,14 @@ function writeReservationStorageAttachment(stdout, attachment = {}) {
         ? [attachment.drive.active_mount]
         : [];
     const mountedCount = mounts.filter(
-      (mount) => textValue(mount.state).toLowerCase() === "mounted",
+      (mount) => textValue(mount.state).toLowerCase() === "mounted"
     ).length;
     const expectedCount = Math.max(Number(attachment.scope?.node_count) || 0, mounts.length);
     if (expectedCount > 0) {
       writeOptionalStatusLine(
         stdout,
         "Mounted",
-        `${mountedCount} of ${expectedCount} ${expectedCount === 1 ? "node" : "nodes"}`,
+        `${mountedCount} of ${expectedCount} ${expectedCount === 1 ? "node" : "nodes"}`
       );
     }
   }
@@ -7314,7 +8338,11 @@ function writeReservationStorageAttachment(stdout, attachment = {}) {
     stdout.write("Placement:\n");
     writeOptionalStatusLine(stdout, "State", placement.state);
     writeOptionalStatusLine(stdout, "Transfer", placement.transfer_status);
-    writeOptionalStatusLine(stdout, "Progress", formatStorageTransferProgress(placement.transfer_progress));
+    writeOptionalStatusLine(
+      stdout,
+      "Progress",
+      formatStorageTransferProgress(placement.transfer_progress)
+    );
     if (
       typeof placement.transfer_object_count === "number" ||
       typeof placement.transfer_bytes === "number"
@@ -7329,7 +8357,7 @@ function writeReservationStorageAttachment(stdout, attachment = {}) {
       writeOptionalStatusLine(
         stdout,
         "Copied",
-        [objectLabel, bytesLabel].filter(Boolean).join(", "),
+        [objectLabel, bytesLabel].filter(Boolean).join(", ")
       );
     }
   }
@@ -7339,7 +8367,11 @@ function writeReservationStorageAttachment(stdout, attachment = {}) {
     writeOptionalStatusLine(stdout, "State", nfsBackend.state);
     writeOptionalStatusLine(stdout, "Region", nfsBackend.region);
     writeOptionalStatusLine(stdout, "Tier", nfsBackend.performance_tier);
-    writeOptionalStatusLine(stdout, "Capacity", nfsBackend.capacity_gib ? `${nfsBackend.capacity_gib} GiB` : null);
+    writeOptionalStatusLine(
+      stdout,
+      "Capacity",
+      nfsBackend.capacity_gib ? `${nfsBackend.capacity_gib} GiB` : null
+    );
     writeOptionalStatusLine(stdout, "Mount ready", nfsBackend.mount_ready ? "yes" : "no");
   }
 }
@@ -7347,8 +8379,12 @@ function writeReservationStorageAttachment(stdout, attachment = {}) {
 function formatStorageTransferProgress(progress) {
   if (!progress) return null;
   const parts = [];
-  if (typeof progress.completed_objects === "number" || typeof progress.total_objects === "number") {
-    const completed = typeof progress.completed_objects === "number" ? progress.completed_objects : 0;
+  if (
+    typeof progress.completed_objects === "number" ||
+    typeof progress.total_objects === "number"
+  ) {
+    const completed =
+      typeof progress.completed_objects === "number" ? progress.completed_objects : 0;
     const total = typeof progress.total_objects === "number" ? progress.total_objects : null;
     parts.push(total ? `${completed}/${total} objects` : `${completed} objects`);
   }
@@ -7445,7 +8481,7 @@ function writeStorageDriveDetail(stdout, drive = {}) {
     writeOptionalStatusLine(stdout, "Endpoint", drive.source.endpoint_url);
     if (drive.source.credentials_configured) {
       stdout.write(
-        `Credentials: configured${drive.source.access_key_id_hint ? ` (${drive.source.access_key_id_hint})` : ""}\n`,
+        `Credentials: configured${drive.source.access_key_id_hint ? ` (${drive.source.access_key_id_hint})` : ""}\n`
       );
     }
     writeOptionalStatusLine(stdout, "Connection", drive.source.connection_status);
@@ -7475,7 +8511,7 @@ function writeStorageDriveDetail(stdout, drive = {}) {
     stdout.write(`Active mounts (${activeMounts.length} nodes):\n`);
     for (const mount of activeMounts) {
       stdout.write(
-        `- ${storageMountNodeLabel(mount)} ${storageMountStateLabel(mount.state)} ${mount.access || "unknown"} ${mount.mount_path || ""}\n`,
+        `- ${storageMountNodeLabel(mount)} ${storageMountStateLabel(mount.state)} ${mount.access || "unknown"} ${mount.mount_path || ""}\n`
       );
       const issue = storageMountIssue(mount);
       if (issue) {
@@ -7533,8 +8569,12 @@ function writeBillingSummary(stdout, summary = {}) {
   stdout.write("Billing summary:\n");
   stdout.write(`Open balance: ${formatCents(summary.open_balance_cents)}\n`);
   stdout.write(`Earliest due date: ${summary.earliest_due_date || "none"}\n`);
-  stdout.write(`This month: ${formatCents(summary.this_month_total_cents)} (${summary.this_month_count || 0} invoices)\n`);
-  stdout.write(`Last month: ${formatCents(summary.last_month_total_cents)} (${summary.last_month_count || 0} invoices)\n`);
+  stdout.write(
+    `This month: ${formatCents(summary.this_month_total_cents)} (${summary.this_month_count || 0} invoices)\n`
+  );
+  stdout.write(
+    `Last month: ${formatCents(summary.last_month_total_cents)} (${summary.last_month_count || 0} invoices)\n`
+  );
 }
 
 function writeInvoiceList(stdout, invoices) {
@@ -7544,7 +8584,9 @@ function writeInvoiceList(stdout, invoices) {
   }
   stdout.write("Invoices:\n");
   for (const invoice of invoices) {
-    stdout.write(`- ${invoice.id} ${invoice.status || "unknown"} ${invoice.type || "invoice"} ${formatCents(invoice.amount_cents, invoice.currency)}`);
+    stdout.write(
+      `- ${invoice.id} ${invoice.status || "unknown"} ${invoice.type || "invoice"} ${formatCents(invoice.amount_cents, invoice.currency)}`
+    );
     if (invoice.due_date) {
       stdout.write(` due=${invoice.due_date}`);
     }
@@ -7559,7 +8601,9 @@ function writeInvoiceList(stdout, invoices) {
 
 function writeShowbackReport(stdout, report = {}) {
   const rows = Array.isArray(report.rows) ? report.rows : [];
-  stdout.write(`Showback ${report.window_start || "unknown"} to ${report.window_end || "unknown"}\n`);
+  stdout.write(
+    `Showback ${report.window_start || "unknown"} to ${report.window_end || "unknown"}\n`
+  );
   stdout.write(`Total GPU hours: ${report.total_gpu_hours ?? 0}\n`);
   stdout.write(`Total cost: ${formatCents(report.total_cost_cents)}\n`);
   if (!rows.length) {
@@ -7591,7 +8635,10 @@ function billingSummaryFromInvoices(invoices) {
     const amount = Number(invoice.amount_cents || 0);
     if (invoice.status === "open") {
       summary.open_balance_cents += amount;
-      if (invoice.due_date && (!summary.earliest_due_date || invoice.due_date < summary.earliest_due_date)) {
+      if (
+        invoice.due_date &&
+        (!summary.earliest_due_date || invoice.due_date < summary.earliest_due_date)
+      ) {
         summary.earliest_due_date = invoice.due_date;
       }
     }
@@ -7611,7 +8658,11 @@ function billingSummaryFromInvoices(invoices) {
 }
 
 function networksFromPayload(payload) {
-  return Array.isArray(payload) ? payload : Array.isArray(payload?.networks) ? payload.networks : [];
+  return Array.isArray(payload)
+    ? payload
+    : Array.isArray(payload?.networks)
+      ? payload.networks
+      : [];
 }
 
 function networkFromMutationPayload(payload) {
@@ -7680,12 +8731,15 @@ function storageBucketSourceFromConsoleUrl(provider, rawUrl) {
   const hostname = url.hostname.toLowerCase();
   const pathParts = url.pathname.split("/").filter(Boolean).map(decodeURIComponent);
   if (provider === "s3") {
-    const bucketIndex = pathParts.findIndex((part, index) => part === "buckets" && pathParts[index - 1] === "s3");
+    const bucketIndex = pathParts.findIndex(
+      (part, index) => part === "buckets" && pathParts[index - 1] === "s3"
+    );
     const bucket = bucketIndex >= 0 ? storageConsolePathValue(pathParts[bucketIndex + 1]) : null;
     const rawRegionFromHost = hostname.endsWith(".console.aws.amazon.com")
       ? hostname.slice(0, -".console.aws.amazon.com".length)
       : null;
-    const regionFromHost = rawRegionFromHost && rawRegionFromHost !== "s3" ? rawRegionFromHost : null;
+    const regionFromHost =
+      rawRegionFromHost && rawRegionFromHost !== "s3" ? rawRegionFromHost : null;
     const region = url.searchParams.get("region") || regionFromHost;
     const prefix = url.searchParams.get("prefix");
     if (!bucket) {
@@ -7698,7 +8752,9 @@ function storageBucketSourceFromConsoleUrl(provider, rawUrl) {
     const bucketIndex = pathParts.findIndex((part) => part === "buckets");
     const bucket = bucketIndex >= 0 ? storageConsolePathValue(pathParts[bucketIndex + 1]) : null;
     if (!accountId || !bucket) {
-      throw new Error("Cloudflare R2 console URL must include /<account-id>/r2/.../buckets/<bucket>.");
+      throw new Error(
+        "Cloudflare R2 console URL must include /<account-id>/r2/.../buckets/<bucket>."
+      );
     }
     return { accountId, bucket, prefix: null, region: "auto" };
   }
@@ -7719,7 +8775,9 @@ function storageConsolePathValue(value) {
 }
 
 function normalizeStoragePrefix(value) {
-  const normalized = String(value || "").trim().replace(/^\/+|\/+$/g, "");
+  const normalized = String(value || "")
+    .trim()
+    .replace(/^\/+|\/+$/g, "");
   return normalized || null;
 }
 
@@ -7745,7 +8803,9 @@ function storageBucketEndpointUrl(provider, options = {}) {
 }
 
 function storageObjectUri(scheme, bucket, prefix) {
-  const normalizedPrefix = String(prefix || "").trim().replace(/^\/+|\/+$/g, "");
+  const normalizedPrefix = String(prefix || "")
+    .trim()
+    .replace(/^\/+|\/+$/g, "");
   return normalizedPrefix ? `${scheme}://${bucket}/${normalizedPrefix}` : `${scheme}://${bucket}`;
 }
 
@@ -7820,19 +8880,28 @@ function metricSnapshotFromMachine(machine, extras = {}) {
     machine.lastHeartbeatAt ||
     null;
   return {
-    connection_status: resourceMetrics.connection_status || resourceMetrics.connectionStatus || "pending",
+    connection_status:
+      resourceMetrics.connection_status || resourceMetrics.connectionStatus || "pending",
     error: extras.error || null,
     last_heartbeat_at: lastHeartbeatAt,
     metrics: {
-      cpu_utilization: numericMetric(resourceMetrics.cpu_utilization ?? resourceMetrics.cpuUtilization),
+      cpu_utilization: numericMetric(
+        resourceMetrics.cpu_utilization ?? resourceMetrics.cpuUtilization
+      ),
       gpu_memory_utilization: numericMetric(
-        resourceMetrics.gpu_memory_utilization ?? resourceMetrics.gpuMemoryUtilization,
+        resourceMetrics.gpu_memory_utilization ?? resourceMetrics.gpuMemoryUtilization
       ),
       gpu_power_w: numericMetric(resourceMetrics.gpu_power_w ?? resourceMetrics.gpuPowerW),
       gpu_tflops: numericMetric(resourceMetrics.gpu_tflops ?? resourceMetrics.gpuTflops),
-      gpu_utilization: numericMetric(resourceMetrics.gpu_utilization ?? resourceMetrics.gpuUtilization),
-      memory_utilization: numericMetric(resourceMetrics.memory_utilization ?? resourceMetrics.memoryUtilization),
-      storage_utilization: numericMetric(resourceMetrics.storage_utilization ?? resourceMetrics.storageUtilization),
+      gpu_utilization: numericMetric(
+        resourceMetrics.gpu_utilization ?? resourceMetrics.gpuUtilization
+      ),
+      memory_utilization: numericMetric(
+        resourceMetrics.memory_utilization ?? resourceMetrics.memoryUtilization
+      ),
+      storage_utilization: numericMetric(
+        resourceMetrics.storage_utilization ?? resourceMetrics.storageUtilization
+      ),
     },
     node_id: machineId(machine),
     reported_at: resourceMetrics.reported_at || resourceMetrics.reportedAt || null,
@@ -7895,7 +8964,9 @@ function writeClusterList(stdout, clusters) {
   }
   stdout.write("Clusters:\n");
   for (const cluster of clusters) {
-    stdout.write(`- ${cluster.reservation_id || cluster.id || "cluster"} ${displayClusterType(cluster.access_mode)} ${cluster.state || "unknown"}`);
+    stdout.write(
+      `- ${cluster.reservation_id || cluster.id || "cluster"} ${displayClusterType(cluster.access_mode)} ${cluster.state || "unknown"}`
+    );
     stdout.write(` ${cluster.node_count ?? "?"} nodes/${cluster.gpu_count ?? "?"} GPUs`);
     stdout.write(` network=${cluster.network_mode || "public"}`);
     stdout.write(` credentials=${cluster.credential_state || "unknown"}`);
@@ -7931,11 +9002,15 @@ function writeEligibleClusterNodes(stdout, payload) {
     stdout.write("No eligible cluster nodes found.\n");
     return;
   }
-  stdout.write(`Eligible nodes for ${payload.reservation_id || "reservation"} (${displayClusterType(payload.access_mode)} / ${payload.network_mode || "public"}):\n`);
+  stdout.write(
+    `Eligible nodes for ${payload.reservation_id || "reservation"} (${displayClusterType(payload.access_mode)} / ${payload.network_mode || "public"}):\n`
+  );
   for (const node of nodes) {
     const status = node.eligible ? "eligible" : "blocked";
     stdout.write(`- ${node.node_id} ${status}`);
-    stdout.write(` ${node.gpu_count ?? "?"}x ${node.gpu_type || payload.reservation_gpu_type || "GPU"}`);
+    stdout.write(
+      ` ${node.gpu_count ?? "?"}x ${node.gpu_type || payload.reservation_gpu_type || "GPU"}`
+    );
     if (node.site_label) {
       stdout.write(` site=${node.site_label}`);
     }
@@ -7968,7 +9043,8 @@ function writeClusterDetail(stdout, cluster = {}) {
   writeOptionalStatusLine(stdout, "Endpoint", cluster.endpoint);
   writeOptionalStatusLine(stdout, "Namespace", cluster.namespace);
   writeOptionalStatusLine(stdout, "Credentials", cluster.credential_state);
-  const progress = cluster.progress && typeof cluster.progress === "object" ? cluster.progress : null;
+  const progress =
+    cluster.progress && typeof cluster.progress === "object" ? cluster.progress : null;
   if (progress) {
     stdout.write("Progress:\n");
     for (const [key, value] of Object.entries(progress)) {
@@ -8001,7 +9077,9 @@ function writeClusterCredentials(stdout, credentials = {}, type, reservationId)
     writeOptionalStatusLine(stdout, "Expires", credentials.expires_at);
     stdout.write(`Kubeconfig: ${credentials.kubeconfig ? "available" : "not returned"}\n`);
     if (credentials.kubeconfig) {
-      stdout.write(`Export it with: ornn clusters kubeconfig ${reservationId} --output kubeconfig.yaml\n`);
+      stdout.write(
+        `Export it with: ornn clusters kubeconfig ${reservationId} --output kubeconfig.yaml\n`
+      );
     }
     return;
   }
@@ -8028,7 +9106,9 @@ function writeClusterCredentials(stdout, credentials = {}, type, reservationId)
 }
 
 function nodeKeyStatus(machine) {
-  const metadata = Array.isArray(machine.authorized_key_metadata) ? machine.authorized_key_metadata : [];
+  const metadata = Array.isArray(machine.authorized_key_metadata)
+    ? machine.authorized_key_metadata
+    : [];
   return {
     machine_id: machineId(machine),
     machine_state: machineState(machine),
@@ -8147,7 +9227,7 @@ function commandText(invocation) {
 async function spawnCommand(invocation, context) {
   if (invocation.raw) {
     throw new Error(
-      "This node exposes a non-standard SSH command. Run `ornn ssh <node-id> --print` and execute the printed command.",
+      "This node exposes a non-standard SSH command. Run `ornn ssh <node-id> --print` and execute the printed command."
     );
   }
   return await new Promise((resolve, reject) => {
@@ -8172,11 +9252,15 @@ function shellQuote(value) {
 }
 
 function machineId(machine) {
-  return machine.id || machine.machine_id || machine.instance_id || machine.instance_name || "machine";
+  return (
+    machine.id || machine.machine_id || machine.instance_id || machine.instance_name || "machine"
+  );
 }
 
 function machineState(machine, fallback = "unknown") {
-  return machine.status || machine.state || machine.actual_state || machine.desired_state || fallback;
+  return (
+    machine.status || machine.state || machine.actual_state || machine.desired_state || fallback
+  );
 }
 
 function machineUsername(machine) {
@@ -8275,7 +9359,7 @@ function writeReservationKeyStatus(stdout, status) {
   if (!keys.length) {
     stdout.write("No reservation SSH keys found.\n");
     stdout.write(
-      `Add one with: ornn access keys add ${status.reservation_id} --public-key-file ~/.ssh/id_ed25519.pub\n`,
+      `Add one with: ornn access keys add ${status.reservation_id} --public-key-file ~/.ssh/id_ed25519.pub\n`
     );
     return;
   }
@@ -8312,11 +9396,15 @@ function writeOptionalStatusLine(stdout, label, value) {
 }
 
 function activeSshKeys(keys) {
-  return keys.filter((key) => String(key.status || "active").toLowerCase() === "active" && !key.revoked_at);
+  return keys.filter(
+    (key) => String(key.status || "active").toLowerCase() === "active" && !key.revoked_at
+  );
 }
 
 function normalizeAccessMode(value) {
-  const normalized = String(value || "").trim().toLowerCase();
+  const normalized = String(value || "")
+    .trim()
+    .toLowerCase();
   if (normalized === "bare-metal" || normalized === "baremetal" || normalized === "bare_metal") {
     return "bare-metal";
   }
@@ -8331,7 +9419,9 @@ function displayAccessMode(value) {
 }
 
 function normalizeClusterType(value) {
-  const normalized = String(value || "").trim().toLowerCase();
+  const normalized = String(value || "")
+    .trim()
+    .toLowerCase();
   if (["k8s", "kube", "kubernetes"].includes(normalized)) {
     return "kubernetes";
   }
@@ -8342,7 +9432,9 @@ function normalizeClusterType(value) {
 }
 
 function displayClusterType(value) {
-  const normalized = String(value || "").trim().toLowerCase();
+  const normalized = String(value || "")
+    .trim()
+    .toLowerCase();
   if (normalized === "slurm") {
     return "Slurm";
   }
@@ -8353,7 +9445,9 @@ function displayClusterType(value) {
 }
 
 function normalizeClusterNetwork(value) {
-  const normalized = String(value || "").trim().toLowerCase();
+  const normalized = String(value || "")
+    .trim()
+    .toLowerCase();
   if (normalized === "public") {
     return "public";
   }
@@ -8368,12 +9462,16 @@ function normalizeNodeNetwork(value) {
 }
 
 function looksLikePublicKey(value) {
-  return /^(ssh-ed25519|ssh-rsa|ecdsa-sha2-|sk-ssh-|sk-ecdsa-)\S*\s+\S+/.test(String(value || "").trim());
+  return /^(ssh-ed25519|ssh-rsa|ecdsa-sha2-|sk-ssh-|sk-ecdsa-)\S*\s+\S+/.test(
+    String(value || "").trim()
+  );
 }
 
 function looksLikePath(value) {
   const text = String(value || "").trim();
-  return text.startsWith("~") || text.startsWith(".") || text.includes("/") || text.endsWith(".pub");
+  return (
+    text.startsWith("~") || text.startsWith(".") || text.includes("/") || text.endsWith(".pub")
+  );
 }
 
 function expandUserPath(value) {
@@ -8558,7 +9656,10 @@ function optionProvided(value) {
 }
 
 function bidPriceOption(options) {
-  return positiveNumberOption(optionProvided(options.price) ? options.price : options.bidPricePerGpuHour, "--price");
+  return positiveNumberOption(
+    optionProvided(options.price) ? options.price : options.bidPricePerGpuHour,
+    "--price"
+  );
 }
 
 function positiveNumberOption(value, name) {
@@ -8586,8 +9687,12 @@ function nonNegativeIntegerOption(value, name) {
 }
 
 function listPaginationOptions(options) {
-  const limit = optionProvided(options.limit) ? positiveIntegerOption(options.limit, "--limit") : 500;
-  const cursor = optionProvided(options.cursor) ? requiredOption(options.cursor, "--cursor") : undefined;
+  const limit = optionProvided(options.limit)
+    ? positiveIntegerOption(options.limit, "--limit")
+    : 500;
+  const cursor = optionProvided(options.cursor)
+    ? requiredOption(options.cursor, "--cursor")
+    : undefined;
   if (limit > 500) {
     throw new Error("--limit must be at most 500.");
   }
@@ -8793,7 +9898,9 @@ function formatStructuredProvisioningError(detail) {
     const label = nextSteps.length === 1 ? "Next step" : "Next steps";
     lines.push(`${label}: ${nextSteps.join(" ")}`);
   } else if (detail.retryable === true) {
-    lines.push("Next step: Retry this command. If the problem continues, contact Ornn support with this error code.");
+    lines.push(
+      "Next step: Retry this command. If the problem continues, contact Ornn support with this error code."
+    );
   } else {
     lines.push(`Next step: ${defaultNextStepForErrorCode(code)}`);
   }
@@ -8881,9 +9988,7 @@ function listValues(value) {
   if (!Array.isArray(value)) {
     return [];
   }
-  return value
-    .filter((item) => typeof item === "string" && item.trim())
-    .map((item) => item.trim());
+  return value.filter((item) => typeof item === "string" && item.trim()).map((item) => item.trim());
 }
 
 function humanizeErrorToken(value) {