npm - @ornncompute/cli - Versions diffs - 0.1.8 → 0.1.9 - Mend

@ornncompute/cli 0.1.8 → 0.1.9

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (4) hide show

package/src/cli.mjs CHANGED Viewed

@@ -1,10 +1,20 @@
 import { spawn } from "node:child_process";
 import { randomUUID } from "node:crypto";
 import { createReadStream } from "node:fs";
-import { chmod, mkdir, mkdtemp, readFile, rm, stat, writeFile } from "node:fs/promises";
+import {
+  chmod,
+  mkdir,
+  mkdtemp,
+  open,
+  readFile,
+  rename,
+  rm,
+  stat,
+  writeFile,
+} from "node:fs/promises";
 import { createRequire } from "node:module";
 import { isIP } from "node:net";
-import { homedir, tmpdir } from "node:os";
+import { homedir, hostname, tmpdir } from "node:os";
 import { basename, dirname, join } from "node:path";
 import {
@@ -132,7 +142,7 @@ Usage:
   ornn tokens list [--json]
   ornn tokens create --operator <id> [--facility <id>] [--expires-in <seconds>] [--mode bare-metal|vm] [--ip <addr>] [--force] [--json]
   ornn tokens revoke <token-id> [--json]
-  ornn fleet clean <ip>... --operator <id-or-slug> --ib-island <name> --identity-file <path> --dry-run [--policy <path>] [--policy-out <path>] [--ssh-user ubuntu|admin|ornn] [--json]
+  ornn fleet clean <ip>... --operator <id-or-slug> --ib-island <name> --identity-file <path> --dry-run [--policy <path>] [--policy-out <path>] [--ssh-user <non-root-linux-user>] [--json]
   ornn fleet clean <fleet-id> --identity-file <path> --dry-run [--policy <path>] [--policy-out <path>] [--json]
   ornn fleet clean <fleet-id> --identity-file <path> --confirm-clean <plan-hash> [--json]
   ornn fleet enroll <fleet-id> --identity-file <path> [--confirm-takeover <ip[,ip...]>] [--json]
@@ -351,7 +361,10 @@ async function dispatch(argv = [], io = {}) {
   try {
     if (args.includes("--help") || args.includes("-h")) {
-      const helpError = validateHelpInvocation(command, args.filter((arg) => arg !== "--help" && arg !== "-h"));
+      const helpError = validateHelpInvocation(
+        command,
+        args.filter((arg) => arg !== "--help" && arg !== "-h")
+      );
       if (helpError) {
         throw new Error(helpError);
       }
@@ -393,7 +406,13 @@ async function dispatch(argv = [], io = {}) {
     }
     if (LISTINGS_COMMANDS.has(command)) {
-      return await availability(args, { commandName: command, env, fetchImpl, openBrowserImpl, stdout });
+      return await availability(args, {
+        commandName: command,
+        env,
+        fetchImpl,
+        openBrowserImpl,
+        stdout,
+      });
     }
     if (command === "buy") {
@@ -480,7 +499,14 @@ async function dispatch(argv = [], io = {}) {
       const session = await loadAuthSession({ env });
       if (session?.accessToken) {
         try {
-          await cliRequest({ endpoint: "/api/cli/session", env, fetchImpl, method: "DELETE", raw: true, session });
+          await cliRequest({
+            endpoint: "/api/cli/session",
+            env,
+            fetchImpl,
+            method: "DELETE",
+            raw: true,
+            session,
+          });
         } catch {
           // Best effort: revoke server-side if reachable, but always clear locally.
         }
@@ -509,8 +535,16 @@ function validateHelpInvocation(command, args) {
   }
   if (command === "login") {
-    const parsed = parseHelpArgs(args, { booleanOptions: ["--no-browser"], valueOptions: ["--auth-base", "--poll-interval", "--timeout"] });
-    return parsed.error || (parsed.positionals.length ? "Usage: ornn login [--auth-base <url>] [--no-browser] [--timeout <seconds>]" : null);
+    const parsed = parseHelpArgs(args, {
+      booleanOptions: ["--no-browser"],
+      valueOptions: ["--auth-base", "--poll-interval", "--timeout"],
+    });
+    return (
+      parsed.error ||
+      (parsed.positionals.length
+        ? "Usage: ornn login [--auth-base <url>] [--no-browser] [--timeout <seconds>]"
+        : null)
+    );
   }
   if (command === "logout") {
@@ -522,15 +556,22 @@ function validateHelpInvocation(command, args) {
   }
   if (command === "whoami" || command === "account") {
-    return validateNoPositionals(args, "Usage: ornn whoami [--json]", { booleanOptions: ["--json"] });
+    return validateNoPositionals(args, "Usage: ornn whoami [--json]", {
+      booleanOptions: ["--json"],
+    });
   }
   if (command === "status") {
-    return validateNoPositionals(args, "Usage: ornn status [--json]", { booleanOptions: ["--json"] });
+    return validateNoPositionals(args, "Usage: ornn status [--json]", {
+      booleanOptions: ["--json"],
+    });
   }
   if (command === "api") {
-    const parsed = parseHelpArgs(args, { booleanOptions: ["--json", "--raw"], valueOptions: ["--data"] });
+    const parsed = parseHelpArgs(args, {
+      booleanOptions: ["--json", "--raw"],
+      valueOptions: ["--data"],
+    });
     if (parsed.error) {
       return parsed.error;
     }
@@ -541,21 +582,30 @@ function validateHelpInvocation(command, args) {
     if (!path || extra.length) {
       return "Usage: ornn api <get|post|patch|put|delete> <compute-path> [--data <json>] [--raw]";
     }
-    return ["delete", "get", "patch", "post", "put"].includes(method.toLowerCase()) ? null : `Unsupported API method: ${method}`;
+    return ["delete", "get", "patch", "post", "put"].includes(method.toLowerCase())
+      ? null
+      : `Unsupported API method: ${method}`;
   }
   if (LISTINGS_COMMANDS.has(command)) {
-    const parsed = parseHelpArgs(args, { booleanOptions: ["--json", "--open"], valueOptions: ["--facility", "--gpu-type", "--operator"] });
+    const parsed = parseHelpArgs(args, {
+      booleanOptions: ["--json", "--open"],
+      valueOptions: ["--facility", "--gpu-type", "--operator"],
+    });
     if (parsed.error) {
       return parsed.error;
     }
     const [subcommand, id, ...extra] = parsed.positionals;
     const usageCommand = command === "availability" ? "availability" : "listings";
     if (!subcommand || subcommand === "list") {
-      return id || extra.length ? `Usage: ornn ${usageCommand} list [--gpu-type <type>] [--facility <name>] [--operator <name>] [--json]` : null;
+      return id || extra.length
+        ? `Usage: ornn ${usageCommand} list [--gpu-type <type>] [--facility <name>] [--operator <name>] [--json]`
+        : null;
     }
     if (subcommand === "show") {
-      return !id || extra.length ? `Usage: ornn ${usageCommand} show <listing-id> [--open] [--json]` : null;
+      return !id || extra.length
+        ? `Usage: ornn ${usageCommand} show <listing-id> [--open] [--json]`
+        : null;
     }
     return `Usage: ornn ${usageCommand} list|show`;
   }
@@ -565,21 +615,38 @@ function validateHelpInvocation(command, args) {
     if (parsed.error) {
       return parsed.error;
     }
-    return parsed.positionals.length === 1 ? null : "Usage: ornn buy <listing-id> [--no-open] [--json]";
+    return parsed.positionals.length === 1
+      ? null
+      : "Usage: ornn buy <listing-id> [--no-open] [--json]";
   }
   if (EXCHANGE_COMMANDS.has(command)) {
-    const parsed = parseHelpArgs(args, { booleanOptions: ["--json", "--no-open", "--open"], valueOptions: ["--cursor", "--end-date", "--gpu-count", "--limit", "--min-gpu-count", "--price", "--start-date"] });
+    const parsed = parseHelpArgs(args, {
+      booleanOptions: ["--json", "--no-open", "--open"],
+      valueOptions: [
+        "--cursor",
+        "--end-date",
+        "--gpu-count",
+        "--limit",
+        "--min-gpu-count",
+        "--price",
+        "--start-date",
+      ],
+    });
     if (parsed.error) {
       return parsed.error;
     }
     const [subcommand, id, ...extra] = parsed.positionals;
     const usageCommand = command === "exchange" ? "exchange" : "bid";
     if (!subcommand || subcommand === "list") {
-      return id || extra.length ? `Usage: ornn ${usageCommand} list|show|create|update|withdraw` : null;
+      return id || extra.length
+        ? `Usage: ornn ${usageCommand} list|show|create|update|withdraw`
+        : null;
     }
     if (["create", "show", "update", "withdraw", "delete"].includes(subcommand)) {
-      return !id || extra.length ? `Usage: ornn ${usageCommand} list|show|create|update|withdraw` : null;
+      return !id || extra.length
+        ? `Usage: ornn ${usageCommand} list|show|create|update|withdraw`
+        : null;
     }
     return `Usage: ornn ${usageCommand} list|show|create|update|withdraw`;
   }
@@ -742,17 +809,31 @@ function validateHelpInvocation(command, args) {
   }
   if (command === "ssh") {
-    const parsed = parseHelpArgs(args, { booleanOptions: ["--json", "--print"], valueOptions: ["--identity-file", "--user"] });
+    const parsed = parseHelpArgs(args, {
+      booleanOptions: ["--json", "--print"],
+      valueOptions: ["--identity-file", "--user"],
+    });
     if (parsed.error) {
       return parsed.error;
     }
-    return parsed.positionals.length <= 1 ? null : "Usage: ornn ssh <node-or-reservation-id> [--print] [--identity-file <path>] [--user <name>] [--json]";
+    return parsed.positionals.length <= 1
+      ? null
+      : "Usage: ornn ssh <node-or-reservation-id> [--print] [--identity-file <path>] [--user <name>] [--json]";
   }
   if (command === "metrics") {
     const parsed = parseHelpArgs(args, {
       booleanOptions: ["--json"],
-      valueOptions: ["--count", "--end", "--interval", "--max-points", "--start", "--timeout", "--watch-interval", "--watch-timeout"],
+      valueOptions: [
+        "--count",
+        "--end",
+        "--interval",
+        "--max-points",
+        "--start",
+        "--timeout",
+        "--watch-interval",
+        "--watch-timeout",
+      ],
     });
     if (parsed.error) {
       return parsed.error;
@@ -762,9 +843,7 @@ function validateHelpInvocation(command, args) {
       return id || extra.length ? "Usage: ornn metrics nodes [--json]" : null;
     }
     if (["history", "node", "show", "watch"].includes(subcommand)) {
-      return !id || extra.length
-        ? "Usage: ornn metrics nodes|node|history|watch"
-        : null;
+      return !id || extra.length ? "Usage: ornn metrics nodes|node|history|watch" : null;
     }
     return "Usage: ornn metrics nodes|node|history|watch";
   }
@@ -816,7 +895,9 @@ function validateHelpInvocation(command, args) {
         return "Usage: ornn clusters list|reservations|eligible-nodes|create|show|wait|credentials|kubeconfig|ssh-command|ssh|add-node|remove-node|teardown";
       }
       if (["add-node", "remove-node"].includes(subcommand)) {
-        return extra.length ? "Usage: ornn clusters add-node|remove-node <reservation-id> --node <node-id>" : null;
+        return extra.length
+          ? "Usage: ornn clusters add-node|remove-node <reservation-id> --node <node-id>"
+          : null;
       }
       return nested || extra.length
         ? "Usage: ornn clusters list|reservations|eligible-nodes|create|show|wait|credentials|kubeconfig|ssh-command|ssh|add-node|remove-node|teardown"
@@ -847,7 +928,9 @@ function validateHelpInvocation(command, args) {
       if (!id) {
         return "Usage: ornn slurm launch|teardown|status|credentials|ssh <reservation-id>";
       }
-      return extra.length ? "Usage: ornn slurm launch|teardown|status|credentials|ssh <reservation-id>" : null;
+      return extra.length
+        ? "Usage: ornn slurm launch|teardown|status|credentials|ssh <reservation-id>"
+        : null;
     }
     return "Usage: ornn slurm launch|teardown|status|credentials|ssh <reservation-id>";
   }
@@ -873,7 +956,9 @@ function validateHelpInvocation(command, args) {
       if (!id) {
         return "Usage: ornn kubernetes launch|teardown|status|credentials|kubeconfig <reservation-id>";
       }
-      return extra.length ? "Usage: ornn kubernetes launch|teardown|status|credentials|kubeconfig <reservation-id>" : null;
+      return extra.length
+        ? "Usage: ornn kubernetes launch|teardown|status|credentials|kubeconfig <reservation-id>"
+        : null;
     }
     return "Usage: ornn kubernetes launch|teardown|status|credentials|kubeconfig <reservation-id>";
   }
@@ -890,10 +975,16 @@ function validateHelpInvocation(command, args) {
     if (!subcommand || subcommand === "list") {
       return id || extra.length ? "Usage: ornn networks list [--json]" : null;
     }
-    if (["attach", "create", "delete", "detach", "reservation", "show", "update"].includes(subcommand)) {
+    if (
+      ["attach", "create", "delete", "detach", "reservation", "show", "update"].includes(subcommand)
+    ) {
       return subcommand === "create"
-        ? id || extra.length ? "Usage: ornn networks create --name <name> [--cidr <cidr>] [--description <text>] [--json]" : null
-        : !id || extra.length ? "Usage: ornn networks list|show|create|update|delete|reservation|attach|detach" : null;
+        ? id || extra.length
+          ? "Usage: ornn networks create --name <name> [--cidr <cidr>] [--description <text>] [--json]"
+          : null
+        : !id || extra.length
+          ? "Usage: ornn networks list|show|create|update|delete|reservation|attach|detach"
+          : null;
     }
     return "Usage: ornn networks list|show|create|update|delete|reservation|attach|detach";
   }
@@ -961,7 +1052,9 @@ function validateHelpInvocation(command, args) {
           : null;
       }
       if (subcommand === "verify") {
-        return !id || extra.length ? "Usage: ornn storage buckets verify <drive-id> [--json]" : null;
+        return !id || extra.length
+          ? "Usage: ornn storage buckets verify <drive-id> [--json]"
+          : null;
       }
       if (subcommand === "update-credentials") {
         return !id || extra.length
@@ -969,7 +1062,9 @@ function validateHelpInvocation(command, args) {
           : null;
       }
       if (subcommand === "disconnect") {
-        return !id || extra.length ? "Usage: ornn storage buckets disconnect <drive-id> [--json]" : null;
+        return !id || extra.length
+          ? "Usage: ornn storage buckets disconnect <drive-id> [--json]"
+          : null;
       }
       return "Usage: ornn storage buckets list|show|connect|verify|update-credentials|disconnect";
     }
@@ -980,16 +1075,23 @@ function validateHelpInvocation(command, args) {
       return id || extra.length ? "Usage: ornn storage volumes list [--json]" : null;
     }
     if (subcommand === "create") {
-      return id || extra.length ? "Usage: ornn storage volumes create --name <name> [--source <drive-id>] [--json]" : null;
+      return id || extra.length
+        ? "Usage: ornn storage volumes create --name <name> [--source <drive-id>] [--json]"
+        : null;
     }
     if (["show", "refresh", "clear", "delete"].includes(subcommand)) {
-      return !id || extra.length ? "Usage: ornn storage volumes list|show|create|refresh|clear|delete" : null;
+      return !id || extra.length
+        ? "Usage: ornn storage volumes list|show|create|refresh|clear|delete"
+        : null;
     }
     return "Usage: ornn storage volumes list|show|create|refresh|clear|delete";
   }
   if (command === "keys") {
-    const parsed = parseHelpArgs(args, { booleanOptions: ["--json"], valueOptions: ["--label", "--public-key", "--public-key-file"] });
+    const parsed = parseHelpArgs(args, {
+      booleanOptions: ["--json"],
+      valueOptions: ["--label", "--public-key", "--public-key-file"],
+    });
     if (parsed.error) {
       return parsed.error;
     }
@@ -998,7 +1100,9 @@ function validateHelpInvocation(command, args) {
       return id || extra || rest.length ? "Usage: ornn keys list|add|delete" : null;
     }
     if (subcommand === "add") {
-      return extra || rest.length ? "Usage: ornn keys add [<public-key-file>] [--public-key <key>] [--label <label>] [--json]" : null;
+      return extra || rest.length
+        ? "Usage: ornn keys add [<public-key-file>] [--public-key <key>] [--label <label>] [--json]"
+        : null;
     }
     if (["delete", "remove"].includes(subcommand)) {
       return !id || extra || rest.length ? "Usage: ornn keys delete <key-id> [--json]" : null;
@@ -1007,14 +1111,37 @@ function validateHelpInvocation(command, args) {
   }
   if (command === "access") {
-    const parsed = parseHelpArgs(args, { booleanOptions: ["--json", "--no-open", "--wait"], valueOptions: ["--key", "--key-id", "--label", "--machine-count", "--mode", "--network", "--network-mode", "--public-key", "--public-key-file", "--request-id", "--ssh-key-id", "--storage-load-drive-id", "--storage-save-drive-id", "--tenant-username", "--username", "--wait-interval", "--wait-timeout"] });
+    const parsed = parseHelpArgs(args, {
+      booleanOptions: ["--json", "--no-open", "--wait"],
+      valueOptions: [
+        "--key",
+        "--key-id",
+        "--label",
+        "--machine-count",
+        "--mode",
+        "--network",
+        "--network-mode",
+        "--public-key",
+        "--public-key-file",
+        "--request-id",
+        "--ssh-key-id",
+        "--storage-load-drive-id",
+        "--storage-save-drive-id",
+        "--tenant-username",
+        "--username",
+        "--wait-interval",
+        "--wait-timeout",
+      ],
+    });
     if (parsed.error) {
       return parsed.error;
     }
     const [subcommand, id, nestedId, ...extra] = parsed.positionals;
     if (subcommand === "keys") {
       if (["list", "add", "push", "status"].includes(id)) {
-        return !nestedId || extra.length ? "Usage: ornn access keys list|add|push|status <reservation-id>" : null;
+        return !nestedId || extra.length
+          ? "Usage: ornn access keys list|add|push|status <reservation-id>"
+          : null;
       }
       return !id ? null : "Usage: ornn access keys list|add|push|status <reservation-id>";
     }
@@ -1023,11 +1150,16 @@ function validateHelpInvocation(command, args) {
         ? "Usage: ornn access show|activate|switch|push-keys <reservation-id>"
         : null;
     }
-    return !subcommand ? null : "Usage: ornn access show|activate|switch|push-keys|keys <reservation-id>";
+    return !subcommand
+      ? null
+      : "Usage: ornn access show|activate|switch|push-keys|keys <reservation-id>";
   }
   if (command === "billing") {
-    const parsed = parseHelpArgs(args, { booleanOptions: ["--json", "--no-open"], valueOptions: ["--end", "--start"] });
+    const parsed = parseHelpArgs(args, {
+      booleanOptions: ["--json", "--no-open"],
+      valueOptions: ["--end", "--start"],
+    });
     if (parsed.error) {
       return parsed.error;
     }
@@ -1039,13 +1171,18 @@ function validateHelpInvocation(command, args) {
       return extra.length ? "Usage: ornn billing summary|invoices|showback|open" : null;
     }
     if (subcommand === "showback") {
-      return extra.length ? "Usage: ornn billing showback --start <yyyy-mm-dd> --end <yyyy-mm-dd> [--json]" : null;
+      return extra.length
+        ? "Usage: ornn billing showback --start <yyyy-mm-dd> --end <yyyy-mm-dd> [--json]"
+        : null;
     }
     return "Usage: ornn billing summary|invoices|showback|open";
   }
   if (command === "ssh-keys") {
-    const parsed = parseHelpArgs(args, { booleanOptions: ["--json"], valueOptions: ["--label", "--public-key", "--public-key-file"] });
+    const parsed = parseHelpArgs(args, {
+      booleanOptions: ["--json"],
+      valueOptions: ["--label", "--public-key", "--public-key-file"],
+    });
     if (parsed.error) {
       return parsed.error;
     }
@@ -1067,13 +1204,7 @@ function validateHelpInvocation(command, args) {
     // handlers do the strict validation. Just surface parse errors here.
     const parsed = parseHelpArgs(args, {
       booleanOptions: ["--json", "--confirm", "--force"],
-      valueOptions: [
-        "--operator",
-        "--facility",
-        "--expires-in",
-        "--mode",
-        "--ip",
-      ],
+      valueOptions: ["--operator", "--facility", "--expires-in", "--mode", "--ip"],
     });
     return parsed.error || null;
   }
@@ -1191,7 +1322,9 @@ async function whoami(args, { env, fetchImpl, stderr, stdout }) {
     } else {
       stdout.write(`${formatUser(serverSession.user)}\n`);
       stdout.write(`Organization: ${serverSession.organization?.name || "none"}\n`);
-      stdout.write(`Tenant: ${serverSession.tenant?.company_name || serverSession.tenant?.id || "none"}\n`);
+      stdout.write(
+        `Tenant: ${serverSession.tenant?.company_name || serverSession.tenant?.id || "none"}\n`
+      );
       stdout.write(`Role: ${serverSession.role || "none"}\n`);
       stdout.write(`Approved: ${serverSession.routeState.isApproved ? "yes" : "no"}\n`);
     }
@@ -1239,7 +1372,9 @@ async function status(args, { env, fetchImpl, stdout }) {
 async function api(args, { env, fetchImpl, stdout }) {
   const [method, path, ...rest] = args;
   if (!method || !path) {
-    throw new Error("Usage: ornn api <get|post|patch|put|delete> <compute-path> [--data <json>] [--raw]");
+    throw new Error(
+      "Usage: ornn api <get|post|patch|put|delete> <compute-path> [--data <json>] [--raw]"
+    );
   }
   const normalizedMethod = method.toUpperCase();
   if (!["DELETE", "GET", "PATCH", "POST", "PUT"].includes(normalizedMethod)) {
@@ -1248,7 +1383,7 @@ async function api(args, { env, fetchImpl, stdout }) {
   const options = parseCommandOptions(
     rest,
     { boolean: ["raw", "json"], value: ["data"] },
-    "Usage: ornn api <get|post|patch|put|delete> <compute-path> [--data <json>] [--raw]",
+    "Usage: ornn api <get|post|patch|put|delete> <compute-path> [--data <json>] [--raw]"
   );
   const body = await readJsonOption(options.data);
   const response = await cliRequest({
@@ -1272,7 +1407,7 @@ async function availability(args, context) {
     const options = parseCommandOptions(
       [id, ...rest].filter(Boolean),
       { boolean: ["json"], value: ["facility", "gpu-type", "operator"] },
-      listUsage,
+      listUsage
     );
     const listings = await loadAvailabilityListings(context);
     const filtered = filterAvailabilityListings(listings, options);
@@ -1285,11 +1420,7 @@ async function availability(args, context) {
   }
   if (subcommand === "show" && id) {
-    const options = parseCommandOptions(
-      rest,
-      { boolean: ["json", "open"] },
-      showUsage,
-    );
+    const options = parseCommandOptions(rest, { boolean: ["json", "open"] }, showUsage);
     const listing = await resolveListing(id, context);
     if (options.json) {
       writeJson(context.stdout, listing);
@@ -1317,16 +1448,20 @@ async function buy(args, context) {
   const options = parseCommandOptions(
     rest,
     { boolean: ["json", "no-open"] },
-    "Usage: ornn buy <listing-id> [--no-open] [--json]",
+    "Usage: ornn buy <listing-id> [--no-open] [--json]"
   );
   const listing = await resolveListing(listingId, context);
-  const checkout = await openFabricPage(context, `/checkout?inventory=${encodeURIComponent(listing.id)}`, {
-    json: options.json,
-    label: "checkout",
-    noOpen: options.noOpen,
-    payload: { listing },
-  });
+  const checkout = await openFabricPage(
+    context,
+    `/checkout?inventory=${encodeURIComponent(listing.id)}`,
+    {
+      json: options.json,
+      label: "checkout",
+      noOpen: options.noOpen,
+      payload: { listing },
+    }
+  );
   if (!options.json) {
     writeCheckoutOpenResult(context.stdout, checkout, "Checkout");
   }
@@ -1342,7 +1477,7 @@ async function bid(args, context) {
     const options = parseCommandOptions(
       [id, ...rest].filter(Boolean),
       { boolean: ["json"], value: ["limit", "cursor"] },
-      `Usage: ornn ${commandName} list [--limit <1-500>] [--cursor <last-id>] [--json]`,
+      `Usage: ornn ${commandName} list [--limit <1-500>] [--cursor <last-id>] [--json]`
     );
     const { limit, cursor } = listPaginationOptions(options);
     const bids = await cliRequest({
@@ -1362,7 +1497,7 @@ async function bid(args, context) {
     const options = parseCommandOptions(
       rest,
       { boolean: ["json", "open"] },
-      `Usage: ornn ${commandName} show <bid-id> [--open] [--json]`,
+      `Usage: ornn ${commandName} show <bid-id> [--open] [--json]`
     );
     const found = await findBid(id, context);
     if (options.json) {
@@ -1384,13 +1519,22 @@ async function bid(args, context) {
       rest,
       {
         boolean: ["json", "no-open"],
-        value: ["bid-price-per-gpu-hour", "end-date", "gpu-count", "min-gpu-count", "price", "start-date"],
+        value: [
+          "bid-price-per-gpu-hour",
+          "end-date",
+          "gpu-count",
+          "min-gpu-count",
+          "price",
+          "start-date",
+        ],
       },
-      `Usage: ornn ${commandName} create <listing-id> --gpu-count <n> --min-gpu-count <n> --start-date <yyyy-mm-dd> --end-date <yyyy-mm-dd> --price <usd> [--no-open] [--json]`,
+      `Usage: ornn ${commandName} create <listing-id> --gpu-count <n> --min-gpu-count <n> --start-date <yyyy-mm-dd> --end-date <yyyy-mm-dd> --price <usd> [--no-open] [--json]`
     );
     const { endDate, startDate } = dateRangeOptions(options);
     const gpuCount = positiveIntegerOption(options.gpuCount, "--gpu-count");
-    const minGpuCount = optionProvided(options.minGpuCount) ? positiveIntegerOption(options.minGpuCount, "--min-gpu-count") : gpuCount;
+    const minGpuCount = optionProvided(options.minGpuCount)
+      ? positiveIntegerOption(options.minGpuCount, "--min-gpu-count")
+      : gpuCount;
     validateMinGpuCount(minGpuCount, gpuCount);
     const payload = {
       bid_price_per_gpu_hour: bidPriceOption(options),
@@ -1408,10 +1552,14 @@ async function bid(args, context) {
       fetchImpl: context.fetchImpl,
       method: "POST",
     });
-    const opened = await openFabricPage(context, `/checkout?bid=${encodeURIComponent(created.id)}`, {
-      label: "bid checkout",
-      noOpen: options.noOpen,
-    });
+    const opened = await openFabricPage(
+      context,
+      `/checkout?bid=${encodeURIComponent(created.id)}`,
+      {
+        label: "bid checkout",
+        noOpen: options.noOpen,
+      }
+    );
     if (options.json) {
       writeJson(context.stdout, { bid: created, opened: opened.opened, url: opened.url });
     } else {
@@ -1427,9 +1575,16 @@ async function bid(args, context) {
       rest,
       {
         boolean: ["json"],
-        value: ["bid-price-per-gpu-hour", "end-date", "gpu-count", "min-gpu-count", "price", "start-date"],
+        value: [
+          "bid-price-per-gpu-hour",
+          "end-date",
+          "gpu-count",
+          "min-gpu-count",
+          "price",
+          "start-date",
+        ],
       },
-      `Usage: ornn ${commandName} update <bid-id> --gpu-count <n> --min-gpu-count <n> --start-date <yyyy-mm-dd> --end-date <yyyy-mm-dd> --price <usd>`,
+      `Usage: ornn ${commandName} update <bid-id> --gpu-count <n> --min-gpu-count <n> --start-date <yyyy-mm-dd> --end-date <yyyy-mm-dd> --price <usd>`
     );
     const { endDate, startDate } = dateRangeOptions(options);
     const gpuCount = positiveIntegerOption(options.gpuCount, "--gpu-count");
@@ -1462,7 +1617,7 @@ async function bid(args, context) {
     const options = parseCommandOptions(
       rest,
       { boolean: ["json"] },
-      `Usage: ornn ${commandName} withdraw <bid-id> [--json]`,
+      `Usage: ornn ${commandName} withdraw <bid-id> [--json]`
     );
     const response = await cliRequest({
       endpoint: computeEndpoint(`/tenants/me/bids/${id}`),
@@ -1494,11 +1649,11 @@ async function reservationOp(subcommand, id, rest, context) {
       const options = parseCommandOptions(
         rest,
         { boolean: ["json"], value: ["tenant", "fleet"] },
-        listUsage,
+        listUsage
       );
       const tenant = await resolveCommerceTenant(
         requiredOption(options.tenant, "--tenant"),
-        context,
+        context
       );
       const fleetId = optionalStringOption(options.fleet);
       if (fleetId && !isUuid(fleetId)) {
@@ -1523,12 +1678,12 @@ async function reservationOp(subcommand, id, rest, context) {
           boolean: ["json"],
           value: ["tenant", "listing", "fleet", "start-at", "end-at", "price-per-gpu-hour"],
         },
-        createUsage,
+        createUsage
       );
       const tenant = await resolveFleetTenant(
         requiredOption(options.tenant, "--tenant"),
         context,
-        webOperatorRequest,
+        webOperatorRequest
       );
       const listingId = requiredOption(options.listing, "--listing");
       const fleetId = requiredOption(options.fleet, "--fleet");
@@ -1555,7 +1710,7 @@ async function reservationOp(subcommand, id, rest, context) {
         const price = optionalStringOption(options.pricePerGpuHour);
         if (!/^\d+(\.\d{1,6})?$/.test(price)) {
           throw new Error(
-            "--price-per-gpu-hour must be zero or a positive decimal with at most 6 decimal places.",
+            "--price-per-gpu-hour must be zero or a positive decimal with at most 6 decimal places."
           );
         }
         body.price_per_gpu_hr = price;
@@ -1610,7 +1765,7 @@ async function reservationOp(subcommand, id, rest, context) {
         boolean: ["json", "confirm"],
         value: ["target-tenant", "target-user", "node", "strategy"],
       },
-      usage,
+      usage
     );
     const targetTenant = optionalStringOption(options.targetTenant);
     if (!targetTenant) {
@@ -1660,7 +1815,7 @@ async function reservationOp(subcommand, id, rest, context) {
         boolean: ["json"],
         value: ["commerce-reservation", "target-tenant", "target-user", "network"],
       },
-      usage,
+      usage
     );
     const targetTenant = optionalStringOption(options.targetTenant);
     if (!targetTenant) {
@@ -1668,7 +1823,7 @@ async function reservationOp(subcommand, id, rest, context) {
     }
     const commerceReservationId = requiredOption(
       options.commerceReservation,
-      "--commerce-reservation",
+      "--commerce-reservation"
     );
     if (!isUuid(commerceReservationId)) {
       throw new Error("--commerce-reservation must be a UUID returned by Commerce.");
@@ -1721,7 +1876,7 @@ async function reservations(args, context) {
     const options = parseCommandOptions(
       [id, ...rest].filter(Boolean),
       { boolean: ["json"], value: ["status", "limit", "cursor"] },
-      `Usage: ornn ${commandName} list [--status <status>] [--limit <1-500>] [--cursor <last-id>] [--json]`,
+      `Usage: ornn ${commandName} list [--status <status>] [--limit <1-500>] [--cursor <last-id>] [--json]`
     );
     const { limit, cursor } = listPaginationOptions(options);
     const query = buildQuery({ status: options.status, limit, cursor });
@@ -1742,7 +1897,7 @@ async function reservations(args, context) {
     const options = parseCommandOptions(
       rest,
       { boolean: ["json", "open"] },
-      `Usage: ornn ${commandName} show <reservation-id> [--open] [--json]`,
+      `Usage: ornn ${commandName} show <reservation-id> [--open] [--json]`
     );
     const found = await findReservation(id, context);
     if (options.json) {
@@ -1763,18 +1918,22 @@ async function reservations(args, context) {
     const options = parseCommandOptions(
       rest,
       { boolean: ["json", "no-open"] },
-      `Usage: ornn ${commandName} checkout <reservation-id> [--no-open] [--json]`,
+      `Usage: ornn ${commandName} checkout <reservation-id> [--no-open] [--json]`
     );
     const found = await findReservation(id, context);
     if (found.status !== "pending_payment") {
       throw new Error("This reservation is not awaiting checkout.");
     }
-    const opened = await openFabricPage(context, `/checkout?reservation=${encodeURIComponent(id)}`, {
-      json: options.json,
-      label: "checkout",
-      noOpen: options.noOpen,
-      payload: { reservation: found },
-    });
+    const opened = await openFabricPage(
+      context,
+      `/checkout?reservation=${encodeURIComponent(id)}`,
+      {
+        json: options.json,
+        label: "checkout",
+        noOpen: options.noOpen,
+        payload: { reservation: found },
+      }
+    );
     if (!options.json) {
       writeCheckoutOpenResult(context.stdout, opened, "Reservation checkout");
     }
@@ -1794,7 +1953,10 @@ async function nodeOps(args, context) {
   }
   if (subcommand === "list") {
-    return await nodeOpList([id, ...rest].filter((value) => value !== undefined), context);
+    return await nodeOpList(
+      [id, ...rest].filter((value) => value !== undefined),
+      context
+    );
   }
   if (!id) {
@@ -1890,7 +2052,7 @@ async function nodeOpList(rest, context) {
   const options = parseCommandOptions(
     rest,
     { boolean: ["json"], value: ["operator", "facility"] },
-    nodeOpUsage("list"),
+    nodeOpUsage("list")
   );
   const query = new URLSearchParams();
   const operator = optionalStringOption(options.operator);
@@ -1910,13 +2072,16 @@ async function nodeOpList(rest, context) {
   });
   const rows = Array.isArray(nodesList) ? nodesList : [];
   if (options.json) {
-    writeJson(context.stdout, rows.map((node) => redactNodeSecrets(node)));
+    writeJson(
+      context.stdout,
+      rows.map((node) => redactNodeSecrets(node))
+    );
   } else if (!rows.length) {
     context.stdout.write("No nodes found.\n");
   } else {
     for (const node of rows) {
       context.stdout.write(
-        `${node?.id ?? "unknown"}  ${node?.k8s_node_name ?? ""}  ${node?.gpu_type ?? ""} x${node?.gpu_count ?? 0}  ${node?.status ?? ""}\n`,
+        `${node?.id ?? "unknown"}  ${node?.k8s_node_name ?? ""}  ${node?.gpu_type ?? ""} x${node?.gpu_count ?? 0}  ${node?.status ?? ""}\n`
       );
     }
   }
@@ -1941,7 +2106,7 @@ async function nodeRebootOp(subcommand, id, rest, context) {
     context.stdout.write(
       subcommand === "hard-reset"
         ? `Hard reset queued for node ${id} (storage/users wiped, keys re-pushed on reconnect; tenant keeps ownership).\n`
-        : `Reboot queued for node ${id} (storage and keys preserved).\n`,
+        : `Reboot queued for node ${id} (storage and keys preserved).\n`
     );
     writeOptionalStatusLine(context.stdout, "Instance", instanceId);
     writeOptionalStatusLine(context.stdout, "State", result?.state);
@@ -1955,7 +2120,7 @@ async function nodeOffGridOp(id, rest, context) {
   const options = parseCommandOptions(
     rest,
     { boolean: ["json"], value: ["reason"] },
-    nodeOpUsage("off-grid"),
+    nodeOpUsage("off-grid")
   );
   const reason = optionalStringOption(options.reason);
   const result = await operatorRequest({
@@ -1984,7 +2149,7 @@ async function nodeOnGridOp(id, rest, context) {
   const options = parseCommandOptions(
     rest,
     { boolean: ["json"], value: ["ssh-username", "ssh-port"] },
-    nodeOpUsage("on-grid"),
+    nodeOpUsage("on-grid")
   );
   const body = {};
   const sshUsername = optionalStringOption(options.sshUsername);
@@ -2017,7 +2182,7 @@ async function nodeTerminateOp(id, rest, context) {
   const options = parseCommandOptions(
     rest,
     { boolean: ["json", "force"], value: ["reason"] },
-    nodeOpUsage("terminate"),
+    nodeOpUsage("terminate")
   );
   const reason = optionalStringOption(options.reason) || "cli-terminate";
   const result = await operatorRequest({
@@ -2091,26 +2256,29 @@ async function resolveNodeInstanceId(nodeId, context) {
   const nodeRefs = new Set(
     [nodeId, node?.id, node?.k8s_node_name]
       .filter((value) => value !== null && value !== undefined && String(value) !== "")
-      .map(String),
+      .map(String)
   );
-  const matches = rows.filter(
-    (machine) =>
-      nodeRefs.has(String(machine?.machine_node_id ?? machine?.node_id ?? "")),
+  const matches = rows.filter((machine) =>
+    nodeRefs.has(String(machine?.machine_node_id ?? machine?.node_id ?? ""))
   );
   if (matches.length > 1) {
     throw new CliApiError(
-      `Multiple live machines found for node ${nodeId} (reservation ${reservationId}).`,
+      `Multiple live machines found for node ${nodeId} (reservation ${reservationId}).`
     );
   }
   const instanceId = matches[0]?.id;
   if (!instanceId) {
-    throw new CliApiError(`No live machine found for node ${nodeId} (reservation ${reservationId}).`);
+    throw new CliApiError(
+      `No live machine found for node ${nodeId} (reservation ${reservationId}).`
+    );
   }
   return instanceId;
 }
 function isUuid(value) {
-  return /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(String(value ?? ""));
+  return /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(
+    String(value ?? "")
+  );
 }
 async function resolveOperatorId(operatorFilter, context) {
@@ -2123,7 +2291,7 @@ async function resolveOperatorId(operatorFilter, context) {
     fetchImpl: context.fetchImpl,
   });
   const match = (Array.isArray(operators) ? operators : []).find(
-    (operator) => operator?.slug === operatorFilter,
+    (operator) => operator?.slug === operatorFilter
   );
   if (!match?.id) {
     throw new CliApiError(`No operator found for "${operatorFilter}".`);
@@ -2166,7 +2334,7 @@ async function operatorsList(args, context) {
   } else {
     for (const operator of rows) {
       context.stdout.write(
-        `${operator?.id ?? "unknown"}  ${operator?.slug ?? ""}  ${operator?.display_name ?? ""}\n`,
+        `${operator?.id ?? "unknown"}  ${operator?.slug ?? ""}  ${operator?.display_name ?? ""}\n`
       );
     }
   }
@@ -2198,7 +2366,7 @@ async function facilitiesList(args, context) {
   } else {
     for (const facility of rows) {
       context.stdout.write(
-        `${facility?.id ?? "unknown"}  ${facility?.slug ?? ""}  ${facility?.display_name ?? ""}  ${facility?.region ?? ""}\n`,
+        `${facility?.id ?? "unknown"}  ${facility?.slug ?? ""}  ${facility?.display_name ?? ""}  ${facility?.region ?? ""}\n`
       );
     }
   }
@@ -2209,7 +2377,11 @@ async function tokensCommand(args, context) {
   const usage = "Usage: ornn tokens list|create|revoke ...";
   const [subcommand, ...rest] = args;
   if (subcommand === "list" || subcommand === undefined) {
-    const options = parseCommandOptions(rest, { boolean: ["json"] }, "Usage: ornn tokens list [--json]");
+    const options = parseCommandOptions(
+      rest,
+      { boolean: ["json"] },
+      "Usage: ornn tokens list [--json]"
+    );
     const tokens = await operatorRequest({
       endpoint: "/enrollment/tokens",
       env: context.env,
@@ -2223,7 +2395,7 @@ async function tokensCommand(args, context) {
     } else {
       for (const token of rows) {
         context.stdout.write(
-          `${token?.id ?? "unknown"}  ${token?.status ?? ""}  operator=${token?.operator_id ?? ""}  expires=${token?.expires_at ?? ""}\n`,
+          `${token?.id ?? "unknown"}  ${token?.status ?? ""}  operator=${token?.operator_id ?? ""}  expires=${token?.expires_at ?? ""}\n`
         );
       }
     }
@@ -2239,7 +2411,7 @@ async function tokensCommand(args, context) {
         boolean: ["json", "force"],
         value: ["operator", "facility", "expires-in", "mode", "ip"],
       },
-      createUsage,
+      createUsage
     );
     const operatorFilter = optionalStringOption(options.operator);
     if (!operatorFilter) {
@@ -2281,7 +2453,7 @@ async function tokensCommand(args, context) {
         context.stdout.write(`Install command:\n${installCommand}\n`);
       } else {
         context.stdout.write(
-          "Install command unavailable: set ORNN_COMPUTE_BASE_URL / ORNN_INSTALLER_URL, or ORNN_AUTH_BASE_URL so the CLI can derive the compute origin.\n",
+          "Install command unavailable: set ORNN_COMPUTE_BASE_URL / ORNN_INSTALLER_URL, or ORNN_AUTH_BASE_URL so the CLI can derive the compute origin.\n"
         );
       }
     }
@@ -2349,6 +2521,21 @@ const FLEET_DEFAULT_PARALLEL = 4;
 const FLEET_DEFAULT_TIMEOUT_SECONDS = 600;
 const FLEET_RESULT_ERROR_MAX_LENGTH = 4000;
 const FLEET_MANAGEMENT_USERS = ["ubuntu", "admin", "ornn"];
+const FLEET_RUNNER_INPUT_MAX_BYTES = 64 * 1024 * 1024;
+const FLEET_RUNNER_OUTPUT_MAX_BYTES = 64 * 1024 * 1024;
+const FLEET_RUNNER_BOOTSTRAP = `import json
+import sys
+bundle = json.load(sys.stdin)
+runner = bundle.get("runner")
+argv = bundle.get("argv")
+if not isinstance(runner, str) or not runner:
+    raise RuntimeError("cleanup runner source is missing")
+if not isinstance(argv, list) or not all(isinstance(value, str) for value in argv):
+    raise RuntimeError("cleanup runner arguments are invalid")
+sys.argv = ["ornn-fleet-cleanup", *argv]
+exec(compile(runner, "<ornn-fleet-cleanup>", "exec"), {"__name__": "__main__"})
+`;
 function fleetAccountOptions(value, optionName) {
   if (!optionProvided(value)) return [];
@@ -2362,6 +2549,15 @@ function fleetAccountOptions(value, optionName) {
   return [...new Set(normalized)].sort();
 }
+function fleetManagementUserOption(value) {
+  if (!optionProvided(value)) return null;
+  const [user] = fleetAccountOptions(value, "--ssh-user");
+  if (user === "root") {
+    throw new Error("--ssh-user must be a non-root Linux account name.");
+  }
+  return user;
+}
 async function readFleetCleanupPolicy(pathValue) {
   if (!optionProvided(pathValue)) return null;
   const path = expandUserPath(optionalStringOption(pathValue));
@@ -2386,12 +2582,24 @@ async function readFleetCleanupPolicy(pathValue) {
   return { path, policy };
 }
+function fleetRunnerInput(script, mode, args) {
+  const payload = JSON.stringify({ argv: [mode, ...args], runner: script });
+  if (Buffer.byteLength(payload, "utf8") > FLEET_RUNNER_INPUT_MAX_BYTES) {
+    throw new Error("Cleanup runner input exceeded the 64 MiB safety limit.");
+  }
+  return payload;
+}
+function fleetRunnerCommand(mode) {
+  return `sudo -n python3 -c ${shellQuote(FLEET_RUNNER_BOOTSTRAP)} -- ${mode} --`;
+}
 function cleanupPolicyForNode(loaded, node, nodeCount) {
   if (!loaded) return null;
   if (loaded.policy.resources) {
     if (nodeCount !== 1) {
       throw new Error(
-        "A direct resources policy can only be used for one node; use nodes keyed by IP for a fleet.",
+        "A direct resources policy can only be used for one node; use nodes keyed by IP for a fleet."
       );
     }
     return loaded.policy;
@@ -2459,7 +2667,7 @@ async function fleetDelete(args, context) {
       ...preview,
       deletion: { requested_at: new Date().toISOString(), status: "requested" },
     },
-    context.env,
+    context.env
   );
   const result = await operatorRequest({
     body: { confirm_fleet_id: confirmation },
@@ -2481,7 +2689,7 @@ async function fleetDelete(args, context) {
   } else {
     context.stdout.write(`Deleted fleet ${fleetId}.\n`);
     context.stdout.write(
-      `Released members: ${Array.isArray(archived.nodes) ? archived.nodes.length : 0}\n`,
+      `Released members: ${Array.isArray(archived.nodes) ? archived.nodes.length : 0}\n`
     );
     context.stdout.write(`Audit manifest: ${manifestPath}\n`);
   }
@@ -2490,7 +2698,7 @@ async function fleetDelete(args, context) {
 async function fleetClean(args, context) {
   const usage =
-    "Usage: ornn fleet clean <ip>... --operator <id-or-slug> --ib-island <name> --identity-file <path> --dry-run [--policy <path>] [--policy-out <path>] [--ssh-user ubuntu|admin|ornn] OR ornn fleet clean <fleet-id> --identity-file <path> --dry-run [--policy <path>] [--policy-out <path>] OR ornn fleet clean <fleet-id> --identity-file <path> --confirm-clean <plan-hash>";
+    "Usage: ornn fleet clean <ip>... --operator <id-or-slug> --ib-island <name> --identity-file <path> --dry-run [--policy <path>] [--policy-out <path>] [--ssh-user <non-root-linux-user>] OR ornn fleet clean <fleet-id> --identity-file <path> --dry-run [--policy <path>] [--policy-out <path>] OR ornn fleet clean <fleet-id> --identity-file <path> --confirm-clean <plan-hash>";
   const { options, positionals } = parseOptions(args, {
     boolean: ["dry-run", "json"],
     value: [
@@ -2568,12 +2776,9 @@ async function fleetClean(args, context) {
         method: "POST",
       });
     } catch (error) {
-      if (
-        error instanceof CliApiError &&
-        error.detail?.detail === "cleanup_plan_replan_required"
-      ) {
+      if (error instanceof CliApiError && error.detail?.detail === "cleanup_plan_replan_required") {
         throw new Error(
-          `Fleet ${fleetId} has a legacy cleanup plan that the current runner cannot safely execute. Re-run the same fleet with --dry-run, review the generated resource policy, then approve the new plan hash.`,
+          `Fleet ${fleetId} has a legacy cleanup plan that the current runner cannot safely execute. Re-run the same fleet with --dry-run, review the generated resource policy, then approve the new plan hash.`
         );
       }
       throw error;
@@ -2581,6 +2786,7 @@ async function fleetClean(args, context) {
     context.stderr.write(`Cleaning ${approved.nodes.length} node(s)...\n`);
     const results = await mapLimit(approved.nodes, parallel, async (node) => {
       let cleanupResult;
+      let partialEvidence = null;
       try {
         const preCanary = await runFleetSsh({
           context,
@@ -2602,7 +2808,6 @@ async function fleetClean(args, context) {
           timeoutSeconds: Math.min(timeoutSeconds, 30),
           user: node.ssh_user,
         });
-        const encodedPlan = Buffer.from(JSON.stringify(node.plan), "utf8").toString("base64");
         let result;
         let duringCanary = { failedChecks: 0, successfulChecks: 0 };
         try {
@@ -2611,8 +2816,17 @@ async function fleetClean(args, context) {
             identityFile,
             ip: node.ip_address,
             port: sshPort,
-            remoteCommand: `sudo -n python3 - execute --management-ip ${node.ip_address} --management-user ${node.ssh_user} --management-public-key-b64 ${managementPublicKeyB64} --approved-plan-b64 ${encodedPlan}`,
-            stdin: approved.script,
+            remoteCommand: fleetRunnerCommand("execute"),
+            stdin: fleetRunnerInput(approved.script, "execute", [
+              "--management-ip",
+              node.ip_address,
+              "--management-user",
+              node.ssh_user,
+              "--management-public-key-b64",
+              managementPublicKeyB64,
+              "--approved-plan-b64",
+              Buffer.from(JSON.stringify(node.plan), "utf8").toString("base64"),
+            ]),
             timeoutSeconds,
             user: node.ssh_user,
           });
@@ -2623,6 +2837,7 @@ async function fleetClean(args, context) {
           throw new Error(`cleanup_execution_deferred: ${result.stderr}`);
         }
         const payload = fleetCleanupJson(result.stdout);
+        partialEvidence = payload.partial_evidence || null;
         if (result.exitCode !== 0 || !payload.evidence) {
           throw new Error(payload.error || result.stderr || "Cleanup failed.");
         }
@@ -2654,8 +2869,9 @@ async function fleetClean(args, context) {
         cleanupResult = {
           cleanup_run_id: node.cleanup_run_id,
           succeeded: false,
+          ...(partialEvidence ? { evidence: partialEvidence } : {}),
           ...(/cleanup_already_running|cleanup_execution_deferred|SSH command timed out/i.test(
-            message,
+            message
           )
             ? { deferred: true }
             : {}),
@@ -2686,10 +2902,7 @@ async function fleetClean(args, context) {
   if (options.dryRun !== true) {
     throw new Error("--dry-run is required before destructive cleanup.");
   }
-  const requestedUser = optionalStringOption(options.sshUser);
-  if (requestedUser && !FLEET_MANAGEMENT_USERS.includes(requestedUser)) {
-    throw new Error(`--ssh-user must be one of ${FLEET_MANAGEMENT_USERS.join(", ")}.`);
-  }
+  const requestedUser = fleetManagementUserOption(options.sshUser);
   const existingFleetId =
     positionals.length === 1 && isUuid(positionals[0]) && !options.operator && !options.ibIsland
       ? positionals[0]
@@ -2709,7 +2922,7 @@ async function fleetClean(args, context) {
     planningNodes = fleetRecord.nodes.filter((node) =>
       fleetRecord.status === "failed"
         ? node.status === "failed"
-        : ["pending_clean", "clean_planned"].includes(node.status),
+        : ["pending_clean", "clean_planned"].includes(node.status)
     );
     if (!planningNodes.length) {
       throw new Error("This fleet has no cleanup members eligible for replanning.");
@@ -2749,21 +2962,30 @@ async function fleetClean(args, context) {
           requestedUser: requestedUser || node.ssh_user || null,
           timeoutSeconds: Math.min(timeoutSeconds, 30),
         });
-        const accountArguments = [
-          ...sourceUsers.map((user) => `--source-user ${shellQuote(user)}`),
-          ...preserveUsers.map((user) => `--preserve-user ${shellQuote(user)}`),
-        ].join(" ");
+        const runnerArguments = [
+          "--management-ip",
+          node.ip_address,
+          "--management-user",
+          sshUser,
+          "--management-public-key-b64",
+          managementPublicKeyB64,
+          ...sourceUsers.flatMap((user) => ["--source-user", user]),
+          ...preserveUsers.flatMap((user) => ["--preserve-user", user]),
+        ];
         const nodePolicy = cleanupPolicyForNode(loadedPolicy, node, planningNodes.length);
-        const policyArgument = nodePolicy
-          ? ` --policy-b64 ${shellQuote(Buffer.from(JSON.stringify(nodePolicy), "utf8").toString("base64"))}`
-          : "";
+        if (nodePolicy) {
+          runnerArguments.push(
+            "--policy-b64",
+            Buffer.from(JSON.stringify(nodePolicy), "utf8").toString("base64")
+          );
+        }
         const result = await runFleetSshCapture({
           context,
           identityFile,
           ip: node.ip_address,
           port: sshPort,
-          remoteCommand: `sudo -n python3 - plan --management-ip ${node.ip_address} --management-user ${sshUser} --management-public-key-b64 ${managementPublicKeyB64}${accountArguments ? ` ${accountArguments}` : ""}${policyArgument}`,
-          stdin: runner.script,
+          remoteCommand: fleetRunnerCommand("plan"),
+          stdin: fleetRunnerInput(runner.script, "plan", runnerArguments),
           timeoutSeconds,
           user: sshUser,
         });
@@ -2789,7 +3011,7 @@ async function fleetClean(args, context) {
     const planFailures = planned.filter((result) => result.error);
     if (planFailures.length) {
       throw new Error(
-        `Cleanup planning failed: ${planFailures.map((result) => `${result.ip}: ${result.error}`).join("; ")}`,
+        `Cleanup planning failed: ${planFailures.map((result) => `${result.ip}: ${result.error}`).join("; ")}`
       );
     }
     const plans = planned.map((result) => result.plan);
@@ -2804,12 +3026,9 @@ async function fleetClean(args, context) {
     }
     const savedPolicyPath =
       policyOut || join(getFleetConfigDir(context.env), `${fleetRecord.id}.cleanup-policy.json`);
-    await mkdir(dirname(savedPolicyPath), { recursive: true, mode: 0o700 });
-    await writeFile(savedPolicyPath, `${JSON.stringify(policyTemplate, null, 2)}\n`, {
-      encoding: "utf8",
-      mode: 0o600,
+    await writePrivateJsonAtomic(savedPolicyPath, policyTemplate, {
+      privateDirectory: !policyOut,
     });
-    await chmod(savedPolicyPath, 0o600);
     recorded = await operatorRequest({
       body: { nodes: plans },
       endpoint: `/internal/fleets/${encodeURIComponent(fleetRecord.id)}/cleanup/plans`,
@@ -2823,7 +3042,9 @@ async function fleetClean(args, context) {
   } catch (error) {
     const planningError = fleetResultError(error);
     if (!createdFleet) {
-      throw new Error(`${planningError} Fleet ${fleetRecord.id} can be replanned after correction.`);
+      throw new Error(
+        `${planningError} Fleet ${fleetRecord.id} can be replanned after correction.`
+      );
     }
     let failedFleet;
     try {
@@ -2836,14 +3057,14 @@ async function fleetClean(args, context) {
       });
     } catch (abortError) {
       throw new Error(
-        `${planningError} Fleet ${fleetRecord.id} could not be marked failed: ${fleetResultError(abortError)}`,
+        `${planningError} Fleet ${fleetRecord.id} could not be marked failed: ${fleetResultError(abortError)}`
       );
     }
     try {
       await saveFleetManifest(failedFleet, context.env);
     } catch (manifestError) {
       throw new Error(
-        `${planningError} Fleet ${fleetRecord.id} was marked failed, but its local manifest could not be saved: ${fleetResultError(manifestError)}`,
+        `${planningError} Fleet ${fleetRecord.id} was marked failed, but its local manifest could not be saved: ${fleetResultError(manifestError)}`
       );
     }
     if (options.json) {
@@ -2867,19 +3088,19 @@ async function fleetClean(args, context) {
     context.stdout.write(`Policy template: ${recorded.policy_file}\n`);
     const unresolved = recorded.fleet.nodes.reduce(
       (count, node) => count + (node.cleanup?.plan?.unresolved?.length || 0),
-      0,
+      0
     );
     const conflicts = recorded.fleet.nodes.reduce(
       (count, node) => count + (node.cleanup?.plan?.conflicts?.length || 0),
-      0,
+      0
     );
     if (unresolved || conflicts) {
       context.stdout.write(
-        `Decisions required: ${unresolved}; policy conflicts: ${conflicts}. Edit the policy template and re-run the dry-run for fleet ${fleetRecord.id}.\n`,
+        `Decisions required: ${unresolved}; policy conflicts: ${conflicts}. Edit the policy template and re-run the dry-run for fleet ${fleetRecord.id}.\n`
       );
     } else {
       context.stdout.write(
-        `Approve exactly this plan with: ornn fleet clean ${fleetRecord.id} --identity-file ${shellQuote(identityFile)} --confirm-clean ${recorded.plan_hash}\n`,
+        `Approve exactly this plan with: ornn fleet clean ${fleetRecord.id} --identity-file ${shellQuote(identityFile)} --confirm-clean ${recorded.plan_hash}\n`
       );
     }
   }
@@ -2887,6 +3108,21 @@ async function fleetClean(args, context) {
 }
 async function fleetEnroll(args, context) {
+  const usage =
+    "Usage: ornn fleet enroll <fleet-id> --identity-file <path> [--confirm-takeover <ip[,ip...]>] [--ssh-port <port>] [--parallel <n>] [--timeout <seconds>] [--json]";
+  const { positionals } = parseOptions(args, {
+    boolean: ["json"],
+    value: ["identity-file", "confirm-takeover", "ssh-port", "parallel", "timeout"],
+  });
+  if (positionals.length !== 1) {
+    throw new Error(usage);
+  }
+  return await withFleetEnrollmentLock(positionals[0], context.env, async () =>
+    fleetEnrollLocked(args, context)
+  );
+}
+async function fleetEnrollLocked(args, context) {
   const usage =
     "Usage: ornn fleet enroll <fleet-id> --identity-file <path> [--confirm-takeover <ip[,ip...]>] [--ssh-port <port>] [--parallel <n>] [--timeout <seconds>] [--json]";
   const { options, positionals } = parseOptions(args, {
@@ -2916,24 +3152,269 @@ async function fleetEnroll(args, context) {
   });
   const ips = fleetPreview.nodes.map((node) => String(node.ip_address));
   const takeoverIps = fleetTakeoverIps(options.confirmTakeover, ips);
-  const enrollmentAttemptId = randomUUID();
+  if (
+    fleetPreview.status === "enrolled" &&
+    fleetPreview.nodes.length > 0 &&
+    fleetPreview.nodes.every((member) => member.status === "enrolled")
+  ) {
+    await saveFleetManifest(fleetPreview, context.env);
+    writeFleetRecord(context, fleetPreview, options.json);
+    return 0;
+  }
+  const session = await loadAuthSession({ env: context.env }).catch(() => null);
+  const installerBase = resolveInstallerBaseUrl({ env: context.env, session });
+  if (!installerBase) {
+    throw new Error("Installer URL is unavailable.");
+  }
+  const leaseExpiry = Date.parse(String(fleetPreview.enrollment_lease_expires_at || ""));
+  const resumingActiveAttempt =
+    fleetPreview.status === "enrolling" &&
+    isUuid(fleetPreview.enrollment_attempt_id) &&
+    Number.isFinite(leaseExpiry) &&
+    leaseExpiry > Date.now();
+  const priorManifest = await loadFleetManifest(fleetId, context.env);
+  const manifestExecutorToken = resumingActiveAttempt
+    ? String(priorManifest?.enrollment_executor_token || "")
+    : "";
+  const serverRotationId = resumingActiveAttempt
+    ? String(fleetPreview.enrollment_executor_rotation_id || "")
+    : "";
+  const manifestRotationId = resumingActiveAttempt
+    ? String(priorManifest?.enrollment_executor_rotation_id || "")
+    : "";
+  const pendingPriorRotationId = resumingActiveAttempt
+    ? String(priorManifest?.enrollment_prior_executor_rotation_id || "")
+    : "";
+  const pendingPriorToken = String(priorManifest?.enrollment_prior_executor_token || "");
+  if (
+    resumingActiveAttempt &&
+    (priorManifest?.enrollment_attempt_id !== fleetPreview.enrollment_attempt_id ||
+      manifestExecutorToken.length < 32 ||
+      !isUuid(serverRotationId) ||
+      !isUuid(manifestRotationId))
+  ) {
+    throw new Error(
+      "This enrollment lease is owned by another CLI executor. Resume it from the private manifest that started the attempt, or wait for the lease to expire."
+    );
+  }
+  const enrollmentAttemptId = resumingActiveAttempt
+    ? fleetPreview.enrollment_attempt_id
+    : randomUUID();
+  let priorExecutorToken = null;
+  if (resumingActiveAttempt) {
+    if (serverRotationId === manifestRotationId) {
+      priorExecutorToken = manifestExecutorToken;
+    } else if (serverRotationId === pendingPriorRotationId && pendingPriorToken.length >= 32) {
+      priorExecutorToken = pendingPriorToken;
+    } else {
+      throw new Error(
+        "The enrollment executor rotation changed outside this private manifest. Refusing to share or guess ownership of the active lease."
+      );
+    }
+  }
+  const enrollmentExecutorToken = `${randomUUID()}${randomUUID()}`;
+  const enrollmentExecutorRotationId = randomUUID();
+  const managementPublicKey = await deriveFleetManagementPublicKey({ context, identityFile });
+  const pendingMemberCount = fleetPreview.nodes.filter(
+    (member) => member.status !== "enrolled"
+  ).length;
+  const fleetBatches = Math.max(1, Math.ceil(pendingMemberCount / parallel));
+  const leaseSeconds = (fleetBatches * 2 + 2) * timeoutSeconds + 600;
+  if (leaseSeconds > 86400) {
+    throw new Error(
+      "The requested fleet size, parallelism, and timeout need an enrollment lease longer than 24 hours. Increase --parallel, reduce --timeout, or split the fleet."
+    );
+  }
+  await saveFleetManifest(
+    {
+      ...fleetPreview,
+      enrollment_attempt_id: enrollmentAttemptId,
+      enrollment_executor_token: enrollmentExecutorToken,
+      enrollment_executor_rotation_id: enrollmentExecutorRotationId,
+      ...(priorExecutorToken ? { enrollment_prior_executor_token: priorExecutorToken } : {}),
+      ...(serverRotationId ? { enrollment_prior_executor_rotation_id: serverRotationId } : {}),
+      enrollment_state: "starting",
+    },
+    context.env
+  );
   const fleetRecord = await operatorRequest({
     body: {
       attempt_id: enrollmentAttemptId,
-      lease_seconds: Math.min(timeoutSeconds * 2 + 300, 86400),
+      rotation_id: enrollmentExecutorRotationId,
+      executor_token: enrollmentExecutorToken,
+      lease_seconds: leaseSeconds,
+      ...(priorExecutorToken ? { prior_executor_token: priorExecutorToken } : {}),
     },
     endpoint: `/internal/fleets/${encodeURIComponent(fleetId)}/enrollment/start`,
     env: context.env,
     fetchImpl: context.fetchImpl,
     method: "POST",
   });
-  const session = await loadAuthSession({ env: context.env }).catch(() => null);
-  const installerBase = resolveInstallerBaseUrl({ env: context.env, session });
-  if (!installerBase) {
-    throw new Error("Installer URL is unavailable.");
+  if (String(fleetRecord.enrollment_executor_rotation_id || "") !== enrollmentExecutorRotationId) {
+    throw new Error(
+      "Enrollment start returned a different executor rotation; refusing to proceed."
+    );
+  }
+  await saveFleetManifest(
+    {
+      ...fleetRecord,
+      enrollment_executor_token: enrollmentExecutorToken,
+      enrollment_executor_rotation_id: enrollmentExecutorRotationId,
+    },
+    context.env
+  );
+  const enrollingMembers = fleetRecord.nodes.filter((member) => member.status === "enrolling");
+  const recoveredNodesByMemberId = new Map();
+  if (resumingActiveAttempt && enrollingMembers.length) {
+    const rows = await operatorRequest({
+      endpoint: `/provisioning/nodes?operator_id=${encodeURIComponent(fleetRecord.operator_id)}`,
+      env: context.env,
+      fetchImpl: context.fetchImpl,
+    });
+    const candidatesByIp = fleetNodesByIp(
+      rows,
+      enrollingMembers.map((member) => String(member.ip_address))
+    );
+    for (const member of enrollingMembers) {
+      const node = candidatesByIp.get(String(member.ip_address));
+      const labels = node?.labels && typeof node.labels === "object" ? node.labels : {};
+      if (
+        node &&
+        labels["ornn.ai/fleet-enrollment-attempt"] === enrollmentAttemptId &&
+        labels["ornn.ai/fleet-node-id"] === member.id &&
+        String(node.hardware_fingerprint || "") === String(member.hardware_fingerprint || "")
+      ) {
+        recoveredNodesByMemberId.set(member.id, node);
+      }
+    }
+  }
+  const verificationMembers = enrollingMembers.filter(
+    (member) => !recoveredNodesByMemberId.has(member.id)
+  );
+  const cleanupRunner = verificationMembers.length
+    ? await operatorRequest({
+        endpoint: `/internal/fleets/${encodeURIComponent(fleetId)}/cleanup-runner`,
+        env: context.env,
+        fetchImpl: context.fetchImpl,
+      })
+    : null;
+  let verificationResults;
+  try {
+    verificationResults = await mapLimit(verificationMembers, parallel, async (member) => {
+      const plan = member.cleanup?.plan;
+      if (member.cleanup?.status !== "succeeded" || !plan) {
+        throw new Error(`Node ${member.ip_address} has no completed cleanup plan to verify.`);
+      }
+      if (plan.management_public_key !== managementPublicKey) {
+        throw new Error(
+          `Node ${member.ip_address} cleanup proof is bound to a different management key.`
+        );
+      }
+      const verificationArguments = [
+        "--management-ip",
+        String(member.ip_address),
+        "--management-user",
+        member.ssh_user,
+        "--management-public-key-b64",
+        Buffer.from(plan.management_public_key, "utf8").toString("base64"),
+        "--approved-plan-b64",
+        Buffer.from(JSON.stringify(plan), "utf8").toString("base64"),
+        "--verification-challenge",
+        enrollmentAttemptId,
+      ];
+      const before = await runFleetSsh({
+        context,
+        identityFile,
+        ip: String(member.ip_address),
+        port: sshPort,
+        remoteCommand: "sudo -n true",
+        timeoutSeconds: Math.min(timeoutSeconds, 30),
+        user: member.ssh_user,
+      });
+      if (before !== 0) {
+        throw new Error(`Node ${member.ip_address} failed the pre-enrollment SSH canary.`);
+      }
+      const stopCanary = startFleetSshCanary({
+        context,
+        identityFile,
+        ip: String(member.ip_address),
+        port: sshPort,
+        timeoutSeconds: Math.min(timeoutSeconds, 30),
+        user: member.ssh_user,
+      });
+      let verification;
+      let duringCanary;
+      try {
+        verification = await runFleetSshCapture({
+          context,
+          identityFile,
+          ip: String(member.ip_address),
+          port: sshPort,
+          remoteCommand: fleetRunnerCommand("verify"),
+          stdin: fleetRunnerInput(cleanupRunner.script, "verify", verificationArguments),
+          timeoutSeconds,
+          user: member.ssh_user,
+        });
+      } finally {
+        duringCanary = await stopCanary();
+      }
+      const payload = fleetCleanupJson(verification.stdout);
+      if (verification.exitCode !== 0 || !payload.evidence?.receipt_live_revalidated) {
+        throw new Error(
+          `Node ${member.ip_address} cleanup proof is stale: ${payload.error || verification.stderr || "live verification failed"}`
+        );
+      }
+      if (payload.evidence.verification_challenge !== enrollmentAttemptId) {
+        throw new Error(`Node ${member.ip_address} returned the wrong verification challenge.`);
+      }
+      if (duringCanary.failedChecks !== 0 || duringCanary.successfulChecks < 1) {
+        throw new Error(
+          `Node ${member.ip_address} management SSH was not continuously reachable during verification.`
+        );
+      }
+      const after = await runFleetSsh({
+        context,
+        identityFile,
+        ip: String(member.ip_address),
+        port: sshPort,
+        remoteCommand: "sudo -n true",
+        timeoutSeconds: Math.min(timeoutSeconds, 30),
+        user: member.ssh_user,
+      });
+      if (after !== 0) {
+        throw new Error(`Node ${member.ip_address} failed the post-verification SSH canary.`);
+      }
+      payload.evidence.management_ssh_canary = {
+        before: true,
+        during_checks: duringCanary.successfulChecks,
+        during_failures: duringCanary.failedChecks,
+        after: true,
+      };
+      return {
+        cleanup_run_id: member.cleanup.id,
+        evidence: payload.evidence,
+      };
+    });
+  } catch (error) {
+    throw error;
+  }
+  if (verificationResults.length) {
+    await operatorRequest({
+      body: {
+        attempt_id: enrollmentAttemptId,
+        executor_token: enrollmentExecutorToken,
+        nodes: verificationResults,
+      },
+      endpoint: `/internal/fleets/${encodeURIComponent(fleetId)}/cleanup/verification`,
+      env: context.env,
+      fetchImpl: context.fetchImpl,
+      method: "POST",
+    });
   }
-  const enrollmentMembers = fleetRecord.nodes.filter((member) => member.status === "enrolling");
-  const installed = await mapLimit(enrollmentMembers, parallel, async (member) => {
+  const installationMembers = enrollingMembers.filter(
+    (member) => !recoveredNodesByMemberId.has(member.id)
+  );
+  const installedNew = await mapLimit(installationMembers, parallel, async (member) => {
     let issuedToken = null;
     let outcome;
     try {
@@ -2941,7 +3422,9 @@ async function fleetEnroll(args, context) {
         body: {
           operator_id: fleetRecord.operator_id,
           fleet_node_id: member.id,
-          expires_in_seconds: Math.min(timeoutSeconds + 300, 86400),
+          enrollment_attempt_id: enrollmentAttemptId,
+          enrollment_executor_token: enrollmentExecutorToken,
+          expires_in_seconds: Math.min(timeoutSeconds * 2 + 300, 86400),
         },
         endpoint: "/enrollment/tokens",
         env: context.env,
@@ -2989,19 +3472,30 @@ async function fleetEnroll(args, context) {
     }
     return outcome;
   });
-  let nodesByIp = new Map();
+  const installed = [
+    ...enrollingMembers
+      .filter((member) => recoveredNodesByMemberId.has(member.id))
+      .map((member) => ({ member, ok: true })),
+    ...installedNew,
+  ];
+  let nodesByIp = new Map(
+    enrollingMembers
+      .filter((member) => recoveredNodesByMemberId.has(member.id))
+      .map((member) => [String(member.ip_address), recoveredNodesByMemberId.get(member.id)])
+  );
   let nodeDiscoveryError = null;
-  const installedIps = installed
+  const installedIps = installedNew
     .filter((result) => result.ok)
     .map((result) => String(result.member.ip_address));
   if (installedIps.length > 0) {
     try {
-      nodesByIp = await waitForFleetNodes({
+      const discovered = await waitForFleetNodes({
         context,
         ips: installedIps,
         operatorId: fleetRecord.operator_id,
         timeoutSeconds,
       });
+      nodesByIp = new Map([...nodesByIp, ...discovered]);
     } catch (error) {
       nodeDiscoveryError = formatCliError(error);
     }
@@ -3055,7 +3549,11 @@ async function fleetEnroll(args, context) {
     }
   });
   const completed = await operatorRequest({
-    body: { attempt_id: enrollmentAttemptId, nodes: results },
+    body: {
+      attempt_id: enrollmentAttemptId,
+      executor_token: enrollmentExecutorToken,
+      nodes: results,
+    },
     endpoint: `/internal/fleets/${encodeURIComponent(fleetId)}/enrollment/results`,
     env: context.env,
     fetchImpl: context.fetchImpl,
@@ -3077,7 +3575,7 @@ async function fleetDeploy(args, context) {
   const fleetId = positionals[0];
   const commerceReservationId = requiredOption(
     options.commerceReservation,
-    "--commerce-reservation",
+    "--commerce-reservation"
   );
   if (!isUuid(commerceReservationId)) {
     throw new Error("--commerce-reservation must be a UUID returned by Commerce.");
@@ -3100,14 +3598,10 @@ async function fleetDeploy(args, context) {
       : null;
   if (!targetUser) {
     throw new Error(
-      `Tenant ${tenant.email} has no primary administrator. Provide --user after fixing tenant membership.`,
+      `Tenant ${tenant.email} has no primary administrator. Provide --user after fixing tenant membership.`
     );
   }
-  const activeKeys = await fetchFleetTenantActiveKeys(
-    tenant.id,
-    context,
-    webOperatorRequest,
-  );
+  const activeKeys = await fetchFleetTenantActiveKeys(tenant.id, context, webOperatorRequest);
   if (!activeKeys.length) {
     throw new Error(
       `Tenant ${tenant.email} has no active SSH keys. Add a tenant SSH key before deploying this fleet.`
@@ -3344,7 +3838,9 @@ async function waitForFleetDeployment({
       await sleepImpl(2000);
       continue;
     }
-    const machines = (Array.isArray(machinePayload?.machines) ? machinePayload.machines : []).filter(
+    const machines = (
+      Array.isArray(machinePayload?.machines) ? machinePayload.machines : []
+    ).filter(
       (machine) => String(machine?.machine_node_id || machine?.node_id || "") === String(nodeId)
     );
     if (machines.length > 1) {
@@ -3453,9 +3949,7 @@ async function waitForFleetDeployment({
       ssh_key_count: activeKeys.length,
     };
   }
-  throw new Error(
-    `Timed out after ${timeoutSeconds}s waiting for node ${nodeId}: ${lastReason}.`
-  );
+  throw new Error(`Timed out after ${timeoutSeconds}s waiting for node ${nodeId}: ${lastReason}.`);
 }
 function isTransientFleetApiError(error) {
@@ -3473,6 +3967,10 @@ function fleetSshArgs({ identityFile, ip, port, remoteCommand, user }) {
     "-o",
     "ConnectTimeout=10",
     "-o",
+    "ServerAliveInterval=5",
+    "-o",
+    "ServerAliveCountMax=3",
+    "-o",
     "IdentitiesOnly=yes",
     "-o",
     "StrictHostKeyChecking=yes",
@@ -3532,7 +4030,7 @@ async function runFleetSsh({
   });
 }
-async function runFleetSshCapture({
+export async function runFleetSshCapture({
   context,
   identityFile,
   ip,
@@ -3548,9 +4046,10 @@ async function runFleetSshCapture({
     let stdout = "";
     let stderr = "";
     let outputExceeded = false;
+    let outputBytes = 0;
     let timedOut = false;
     let killTimer = null;
-    const maxOutputBytes = 4 * 1024 * 1024;
+    const maxOutputBytes = FLEET_RUNNER_OUTPUT_MAX_BYTES;
     const timer = timeoutSeconds
       ? setTimeout(() => {
           timedOut = true;
@@ -3568,13 +4067,17 @@ async function runFleetSshCapture({
       }
     };
     const append = (current, chunk) => {
-      const next = current + String(chunk);
-      if (Buffer.byteLength(next, "utf8") > maxOutputBytes) {
+      if (outputExceeded) return current;
+      const chunkBytes = Buffer.isBuffer(chunk)
+        ? chunk.byteLength
+        : Buffer.byteLength(String(chunk), "utf8");
+      if (outputBytes + chunkBytes > maxOutputBytes) {
         outputExceeded = true;
         terminate();
         return current;
       }
-      return next;
+      outputBytes += chunkBytes;
+      return current + String(chunk);
     };
     child.stdout?.on("data", (chunk) => {
       stdout = append(stdout, chunk);
@@ -3591,9 +4094,9 @@ async function runFleetSshCapture({
       if (timer) clearTimeout(timer);
       if (killTimer) clearTimeout(killTimer);
       if (timedOut) stderr = `SSH command timed out after ${timeoutSeconds}s.`;
-      if (outputExceeded) stderr = "SSH command output exceeded 4 MiB.";
+      if (outputExceeded) stderr = "SSH command output exceeded the 64 MiB safety limit.";
       resolve({
-        exitCode: timedOut ? 124 : (signal || outputExceeded ? 1 : (code ?? 0)),
+        exitCode: timedOut ? 124 : signal || outputExceeded ? 1 : (code ?? 0),
         stderr,
         stdout,
       });
@@ -3636,34 +4139,50 @@ async function deriveFleetManagementPublicKey({ context, identityFile }) {
   });
 }
-function startFleetSshCanary({ context, identityFile, ip, port, timeoutSeconds, user }) {
+export function startFleetSshCanary({ context, identityFile, ip, port, timeoutSeconds, user }) {
   let failedChecks = 0;
   let successfulChecks = 0;
-  let inFlight = Promise.resolve();
+  let inFlight = null;
+  let stopped = false;
+  const setIntervalImpl = context.setInterval ?? setInterval;
+  const clearIntervalImpl = context.clearInterval ?? clearInterval;
+  const checkTimeoutSeconds = Math.max(1, Math.min(Number(timeoutSeconds) || 30, 30));
   const check = () => {
-    inFlight = inFlight.then(async () => {
-      const exitCode = await runFleetSsh({
-        context,
-        identityFile,
-        ip,
-        port,
-        remoteCommand: "sudo -n true",
-        timeoutSeconds,
-        user,
-      });
-      if (exitCode !== 0) {
+    if (stopped || inFlight) return;
+    const operation = runFleetSsh({
+      context,
+      identityFile,
+      ip,
+      port,
+      remoteCommand: "sudo -n true",
+      timeoutSeconds: checkTimeoutSeconds,
+      user,
+    })
+      .then((exitCode) => {
+        if (exitCode !== 0) {
+          failedChecks += 1;
+        } else {
+          successfulChecks += 1;
+        }
+      })
+      .catch(() => {
         failedChecks += 1;
-      } else {
-        successfulChecks += 1;
+      });
+    const tracked = operation.finally(() => {
+      if (inFlight === tracked) {
+        inFlight = null;
       }
     });
+    inFlight = tracked;
   };
   check();
-  const timer = setInterval(check, 2000);
+  const timer = setIntervalImpl(check, 2000);
   timer.unref?.();
   return async () => {
-    clearInterval(timer);
-    await inFlight;
+    stopped = true;
+    clearIntervalImpl(timer);
+    const activeCheck = inFlight;
+    if (activeCheck) await activeCheck;
     return { failedChecks, successfulChecks };
   };
 }
@@ -3766,21 +4285,7 @@ async function waitForFleetNodes({ context, ips, operatorId, timeoutSeconds }) {
       env: context.env,
       fetchImpl: context.fetchImpl,
     });
-    const matches = new Map();
-    for (const ip of ips) {
-      const candidates = (Array.isArray(rows) ? rows : []).filter((node) => {
-        const labels = node?.labels && typeof node.labels === "object" ? node.labels : {};
-        return [labels["ornn.ai/public-ip"], labels["ornn.ai/configured-ip"]]
-          .filter(Boolean)
-          .some((candidate) => String(candidate) === ip);
-      });
-      if (candidates.length > 1) {
-        throw new Error(`Multiple Fabric nodes matched IP ${ip}; refusing ambiguous enrollment.`);
-      }
-      if (candidates.length === 1) {
-        matches.set(ip, candidates[0]);
-      }
-    }
+    const matches = fleetNodesByIp(rows, ips);
     for (const [ip, node] of matches) {
       const prior = latestMatches.get(ip);
       if (prior && String(prior.id || "") !== String(node.id || "")) {
@@ -3805,14 +4310,30 @@ async function waitForFleetNodes({ context, ips, operatorId, timeoutSeconds }) {
   return latestMatches;
 }
-async function verifyFleetManagementSsh({
-  context,
-  identityFile,
-  ip,
-  port,
-  timeoutSeconds,
-  user,
-}) {
+function fleetNodesByIp(rows, ips) {
+  const matches = new Map();
+  for (const ip of ips) {
+    const candidates = (Array.isArray(rows) ? rows : []).filter((node) => {
+      const labels = node?.labels && typeof node.labels === "object" ? node.labels : {};
+      return [labels["ornn.ai/public-ip"], labels["ornn.ai/configured-ip"]]
+        .filter(Boolean)
+        .some((candidate) => String(candidate) === ip);
+    });
+    if (candidates.length > 1) {
+      throw new Error(`Multiple Fabric nodes matched IP ${ip}; refusing ambiguous enrollment.`);
+    }
+    if (candidates.length === 1) matches.set(ip, candidates[0]);
+  }
+  const nodeIds = [...matches.values()].map((node) => String(node.id || ""));
+  if (nodeIds.some((nodeId) => !nodeId) || new Set(nodeIds).size !== matches.size) {
+    throw new Error(
+      "Multiple fleet IPs resolved to the same Fabric node; refusing a duplicate enrollment mapping."
+    );
+  }
+  return matches;
+}
+async function verifyFleetManagementSsh({ context, identityFile, ip, port, timeoutSeconds, user }) {
   const exitCode = await runFleetSsh({
     context,
     identityFile,
@@ -3849,15 +4370,120 @@ function fleetManifestPath(fleetId, env) {
   return join(getFleetConfigDir(env), `${normalized}.json`);
 }
+function fleetEnrollmentLockPath(fleetId, env) {
+  return `${fleetManifestPath(fleetId, env)}.enroll.lock`;
+}
+function localProcessIsAlive(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error) {
+    return error?.code !== "ESRCH";
+  }
+}
+async function acquireFleetEnrollmentLock(fleetId, env) {
+  const path = fleetEnrollmentLockPath(fleetId, env);
+  const directory = dirname(path);
+  const ownerId = randomUUID();
+  await mkdir(directory, { recursive: true, mode: 0o700 });
+  await chmod(directory, 0o700);
+  for (let attempt = 0; attempt < 2; attempt += 1) {
+    let handle;
+    let created = false;
+    try {
+      handle = await open(path, "wx", 0o600);
+      created = true;
+      await handle.writeFile(
+        `${JSON.stringify({
+          host: hostname(),
+          owner_id: ownerId,
+          pid: process.pid,
+          started_at: new Date().toISOString(),
+        })}\n`,
+        "utf8"
+      );
+      await handle.sync();
+      return async () => {
+        await handle.close().catch(() => {});
+        try {
+          const current = JSON.parse(await readFile(path, "utf8"));
+          if (current?.owner_id === ownerId) await rm(path, { force: true });
+        } catch (error) {
+          if (error?.code !== "ENOENT") throw error;
+        }
+      };
+    } catch (error) {
+      await handle?.close().catch(() => {});
+      if (created) await rm(path, { force: true });
+      if (error?.code !== "EEXIST") throw error;
+      let existing;
+      try {
+        existing = JSON.parse(await readFile(path, "utf8"));
+      } catch (readError) {
+        if (readError?.code === "ENOENT") continue;
+        throw new Error("Another fleet enrollment owns the unreadable local lock file.");
+      }
+      const sameHost = existing?.host === hostname();
+      const pid = Number(existing?.pid);
+      if (sameHost && Number.isSafeInteger(pid) && pid > 0 && !localProcessIsAlive(pid)) {
+        await rm(path, { force: true });
+        if (attempt === 0) continue;
+      }
+      throw new Error(
+        `Another ornn fleet enroll process owns ${path}. Wait for it to finish before retrying.`
+      );
+    }
+  }
+  throw new Error("Could not acquire the fleet enrollment lock.");
+}
+async function withFleetEnrollmentLock(fleetId, env, operation) {
+  const release = await acquireFleetEnrollmentLock(fleetId, env);
+  try {
+    return await operation();
+  } finally {
+    await release();
+  }
+}
+async function loadFleetManifest(fleetId, env) {
+  const path = fleetManifestPath(fleetId, env);
+  try {
+    const value = JSON.parse(await readFile(path, "utf8"));
+    return value && typeof value === "object" && value.id === fleetId ? value : null;
+  } catch (error) {
+    if (error?.code === "ENOENT") return null;
+    throw new Error(`Could not read the private fleet manifest: ${fleetResultError(error)}`);
+  }
+}
+async function writePrivateJsonAtomic(path, value, { privateDirectory = false } = {}) {
+  const directory = dirname(path);
+  const temporaryPath = join(directory, `.${basename(path)}.${randomUUID()}.tmp`);
+  await mkdir(directory, { recursive: true, mode: 0o700 });
+  if (privateDirectory) await chmod(directory, 0o700);
+  let handle;
+  try {
+    handle = await open(temporaryPath, "wx", 0o600);
+    await handle.writeFile(`${JSON.stringify(value, null, 2)}\n`, "utf8");
+    await handle.sync();
+    await handle.close();
+    handle = null;
+    await rename(temporaryPath, path);
+    await chmod(path, 0o600);
+  } catch (error) {
+    await handle?.close().catch(() => {});
+    await rm(temporaryPath, { force: true });
+    throw error;
+  }
+}
 async function saveFleetManifest(manifest, env) {
-  const directory = getFleetConfigDir(env);
   const path = fleetManifestPath(manifest.id, env);
   manifest.updated_at = new Date().toISOString();
-  await mkdir(directory, { recursive: true, mode: 0o700 });
-  await writeFile(path, `${JSON.stringify(manifest, null, 2)}\n`, {
-    encoding: "utf8",
-    mode: 0o600,
-  });
+  await writePrivateJsonAtomic(path, manifest, { privateDirectory: true });
   return path;
 }
@@ -3881,14 +4507,15 @@ async function resolveFleetTenant(tenantInput, context, request = operatorReques
   });
   const normalized = input.toLowerCase();
   const matches = (Array.isArray(rows) ? rows : []).filter(
-    (row) => String(row?.contact_email || "").trim().toLowerCase() === normalized
+    (row) =>
+      String(row?.contact_email || "")
+        .trim()
+        .toLowerCase() === normalized
   );
   const tenantIds = [
     ...new Set(
-      matches
-        .map((row) => String(row.organization_id ?? row.tenant_id ?? ""))
-        .filter(Boolean)
-    )
+      matches.map((row) => String(row.organization_id ?? row.tenant_id ?? "")).filter(Boolean)
+    ),
   ];
   if (tenantIds.length !== 1) {
     throw new Error(
@@ -3918,7 +4545,9 @@ async function resolveFleetUser(tenantId, userInput, context, request = operator
   const matches = (Array.isArray(members) ? members : []).filter(
     (member) =>
       String(member?.auth_user_id || "") === input ||
-      String(member?.contact_email || "").trim().toLowerCase() === normalized
+      String(member?.contact_email || "")
+        .trim()
+        .toLowerCase() === normalized
   );
   if (matches.length !== 1) {
     throw new Error(
@@ -3957,7 +4586,7 @@ async function nodeDeenroll(id, rest, context) {
   const options = parseCommandOptions(
     rest,
     { boolean: ["json", "keep-record", "force"], value: ["reason"] },
-    nodeOpUsage("deenroll"),
+    nodeOpUsage("deenroll")
   );
   const reason = optionalStringOption(options.reason) || "cli-deenroll";
   // Dead/unreachable test nodes can't drain workloads, so default to force.
@@ -4015,7 +4644,7 @@ async function nodeDeenroll(id, rest, context) {
       writeOptionalStatusLine(
         context.stdout,
         "Record removed",
-        options.keepRecord ? "kept" : result.dereferenced ? "yes" : "already gone",
+        options.keepRecord ? "kept" : result.dereferenced ? "yes" : "already gone"
       );
     }
   }
@@ -4063,7 +4692,7 @@ async function nodes(args, context) {
     const options = parseCommandOptions(
       [id, nested, ...rest].filter(Boolean),
       { boolean: ["json"] },
-      "Usage: ornn nodes list [--json]",
+      "Usage: ornn nodes list [--json]"
     );
     const machines = await fetchTenantMachines(context);
     if (options.json) {
@@ -4078,7 +4707,7 @@ async function nodes(args, context) {
     const options = parseCommandOptions(
       [nested, ...rest].filter(Boolean),
       { boolean: ["json"] },
-      "Usage: ornn nodes show <node-id> [--json]",
+      "Usage: ornn nodes show <node-id> [--json]"
     );
     const machine = await fetchMachine(id, context);
     if (options.json) {
@@ -4114,7 +4743,7 @@ async function nodes(args, context) {
           "wait-timeout",
         ],
       },
-      "Usage: ornn nodes launch <reservation-id> --key <path|id|label> [--mode bare-metal|vm] [--username <name>] [--network public|private] [--storage-load-drive-id <id>] [--storage-save-drive-id <id>] [--wait] [--json]",
+      "Usage: ornn nodes launch <reservation-id> --key <path|id|label> [--mode bare-metal|vm] [--username <name>] [--network public|private] [--storage-load-drive-id <id>] [--storage-save-drive-id <id>] [--wait] [--json]"
     );
     const result = await launchReservationAccess(id, options, context, { openDefault: false });
     if (options.json) {
@@ -4126,7 +4755,9 @@ async function nodes(args, context) {
   }
   if (subcommand === "launch") {
-    throw new Error("Usage: ornn nodes launch <reservation-id> --key <path|id|label> [--mode bare-metal|vm] [--username <name>] [--network public|private] [--storage-load-drive-id <id>] [--storage-save-drive-id <id>] [--wait] [--json]");
+    throw new Error(
+      "Usage: ornn nodes launch <reservation-id> --key <path|id|label> [--mode bare-metal|vm] [--username <name>] [--network public|private] [--storage-load-drive-id <id>] [--storage-save-drive-id <id>] [--wait] [--json]"
+    );
   }
   if (subcommand === "switch" && id) {
@@ -4151,14 +4782,14 @@ async function nodes(args, context) {
           "wait-timeout",
         ],
       },
-      "Usage: ornn nodes switch <reservation-id> --network public|private --key <path|id|label> [--mode bare-metal|vm] [--username <name>] [--wait] [--json]",
+      "Usage: ornn nodes switch <reservation-id> --network public|private --key <path|id|label> [--mode bare-metal|vm] [--username <name>] [--wait] [--json]"
     );
     const result = await switchReservationAccess(id, options, context);
     if (options.json) {
       writeJson(context.stdout, result);
     } else {
       context.stdout.write(
-        `Switched to ${displayAccessMode(result.mode)} / ${result.network_mode} on reservation ${id}.\n`,
+        `Switched to ${displayAccessMode(result.mode)} / ${result.network_mode} on reservation ${id}.\n`
       );
       writeAccessLaunchSummary(context.stdout, { machines: result.machines });
       if (result.wait) {
@@ -4170,7 +4801,7 @@ async function nodes(args, context) {
   if (subcommand === "switch") {
     throw new Error(
-      "Usage: ornn nodes switch <reservation-id> --network public|private --key <path|id|label> [--mode bare-metal|vm] [--username <name>] [--wait] [--json]",
+      "Usage: ornn nodes switch <reservation-id> --network public|private --key <path|id|label> [--mode bare-metal|vm] [--username <name>] [--wait] [--json]"
     );
   }
@@ -4178,7 +4809,7 @@ async function nodes(args, context) {
     const options = parseCommandOptions(
       [nested, ...rest].filter(Boolean),
       { boolean: ["json"], value: ["timeout", "wait-interval", "wait-timeout"] },
-      "Usage: ornn nodes wait <node-or-reservation-id> [--timeout <seconds>] [--json]",
+      "Usage: ornn nodes wait <node-or-reservation-id> [--timeout <seconds>] [--json]"
     );
     const result = await waitForSshReady(id, waitOptions(options), context);
     if (options.json) {
@@ -4193,7 +4824,7 @@ async function nodes(args, context) {
     const options = parseCommandOptions(
       [nested, ...rest].filter(Boolean),
       { boolean: ["json"], value: ["request-id"] },
-      `Usage: ornn nodes ${subcommand} <node-id> [--json]`,
+      `Usage: ornn nodes ${subcommand} <node-id> [--json]`
     );
     const machine = await runNodeAction(id, subcommand, options, context);
     if (options.json) {
@@ -4209,7 +4840,7 @@ async function nodes(args, context) {
     const options = parseCommandOptions(
       [nested, ...rest].filter(Boolean),
       { boolean: ["json"], value: ["identity-file", "user"] },
-      "Usage: ornn nodes ssh-command <node-or-reservation-id> [--json]",
+      "Usage: ornn nodes ssh-command <node-or-reservation-id> [--json]"
     );
     const { machine } = await resolveSshTarget(id, context);
     const invocation = sshInvocationForMachine(machine, options);
@@ -4226,21 +4857,28 @@ async function nodes(args, context) {
   }
   if (subcommand === "keys") {
-    return await nodeKeys([id, nested, ...rest].filter((item) => item !== undefined), context);
+    return await nodeKeys(
+      [id, nested, ...rest].filter((item) => item !== undefined),
+      context
+    );
   }
-  throw new Error("Usage: ornn nodes list|show|launch|switch|wait|reboot|hard-reset|ssh-command|keys");
+  throw new Error(
+    "Usage: ornn nodes list|show|launch|switch|wait|reboot|hard-reset|ssh-command|keys"
+  );
 }
 async function ssh(args, context) {
   const [identifier, ...rest] = args;
   if (!identifier) {
-    throw new Error("Usage: ornn ssh <node-or-reservation-id> [--print] [--identity-file <path>] [--user <name>] [--json]");
+    throw new Error(
+      "Usage: ornn ssh <node-or-reservation-id> [--print] [--identity-file <path>] [--user <name>] [--json]"
+    );
   }
   const options = parseCommandOptions(
     rest,
     { boolean: ["json", "print"], value: ["identity-file", "user"] },
-    "Usage: ornn ssh <node-or-reservation-id> [--print] [--identity-file <path>] [--user <name>] [--json]",
+    "Usage: ornn ssh <node-or-reservation-id> [--print] [--identity-file <path>] [--user <name>] [--json]"
   );
   const { machine } = await resolveSshTarget(identifier, context);
   const invocation = sshInvocationForMachine(machine, options);
@@ -4266,7 +4904,7 @@ async function metrics(args, context) {
     const options = parseCommandOptions(
       [nodeId, ...rest].filter(Boolean),
       { boolean: ["json"] },
-      "Usage: ornn metrics nodes [--json]",
+      "Usage: ornn metrics nodes [--json]"
     );
     const snapshots = await fetchTenantMetricSnapshots(context);
     if (options.json) {
@@ -4281,7 +4919,7 @@ async function metrics(args, context) {
     const options = parseCommandOptions(
       rest,
       { boolean: ["json"] },
-      "Usage: ornn metrics node <node-id> [--json]",
+      "Usage: ornn metrics node <node-id> [--json]"
     );
     const snapshot = await fetchMetricSnapshotForNode(nodeId, context);
     if (options.json) {
@@ -4296,7 +4934,7 @@ async function metrics(args, context) {
     const options = parseCommandOptions(
       rest,
       { boolean: ["json"], value: ["end", "max-points", "start"] },
-      "Usage: ornn metrics history <node-id> [--start <iso>] [--end <iso>] [--max-points <n>] [--json]",
+      "Usage: ornn metrics history <node-id> [--start <iso>] [--end <iso>] [--max-points <n>] [--json]"
     );
     const result = await fetchMetricHistoryForNode(nodeId, options, context);
     if (options.json) {
@@ -4314,7 +4952,7 @@ async function metrics(args, context) {
         boolean: ["json"],
         value: ["count", "interval", "timeout", "watch-interval", "watch-timeout"],
       },
-      "Usage: ornn metrics watch <node-id> [--interval <seconds>] [--count <n>] [--timeout <seconds>] [--json]",
+      "Usage: ornn metrics watch <node-id> [--interval <seconds>] [--count <n>] [--timeout <seconds>] [--json]"
     );
     await watchNodeMetrics(nodeId, options, context);
     return 0;
@@ -4324,10 +4962,14 @@ async function metrics(args, context) {
     throw new Error("Usage: ornn metrics node <node-id> [--json]");
   }
   if (subcommand === "history") {
-    throw new Error("Usage: ornn metrics history <node-id> [--start <iso>] [--end <iso>] [--max-points <n>] [--json]");
+    throw new Error(
+      "Usage: ornn metrics history <node-id> [--start <iso>] [--end <iso>] [--max-points <n>] [--json]"
+    );
   }
   if (subcommand === "watch") {
-    throw new Error("Usage: ornn metrics watch <node-id> [--interval <seconds>] [--count <n>] [--timeout <seconds>] [--json]");
+    throw new Error(
+      "Usage: ornn metrics watch <node-id> [--interval <seconds>] [--count <n>] [--timeout <seconds>] [--json]"
+    );
   }
   throw new Error("Usage: ornn metrics nodes|node|history|watch");
@@ -4340,7 +4982,7 @@ async function clusters(args, context) {
     const options = parseCommandOptions(
       [reservationId, maybeNodeId, ...rest].filter(Boolean),
       { boolean: ["json"] },
-      "Usage: ornn clusters list [--json]",
+      "Usage: ornn clusters list [--json]"
     );
     const rows = await fetchTenantClusters(context);
     if (options.json) {
@@ -4355,7 +4997,7 @@ async function clusters(args, context) {
     const options = parseCommandOptions(
       [reservationId, maybeNodeId, ...rest].filter(Boolean),
       { boolean: ["json"] },
-      "Usage: ornn clusters reservations [--json]",
+      "Usage: ornn clusters reservations [--json]"
     );
     const rows = await cliRequest({
       endpoint: computeEndpoint("/clusters/reservations"),
@@ -4365,7 +5007,10 @@ async function clusters(args, context) {
     if (options.json) {
       writeJson(context.stdout, rows);
     } else {
-      writeClusterReservationList(context.stdout, requireArrayPayload(rows, "cluster reservations"));
+      writeClusterReservationList(
+        context.stdout,
+        requireArrayPayload(rows, "cluster reservations")
+      );
     }
     return 0;
   }
@@ -4374,7 +5019,7 @@ async function clusters(args, context) {
     const options = parseCommandOptions(
       [maybeNodeId, ...rest].filter(Boolean),
       { boolean: ["json"], value: ["network", "network-mode", "type", "mode"] },
-      "Usage: ornn clusters eligible-nodes <reservation-id> [--type kubernetes|slurm] [--network public|private] [--json]",
+      "Usage: ornn clusters eligible-nodes <reservation-id> [--type kubernetes|slurm] [--network public|private] [--json]"
     );
     const type = normalizeClusterType(options.type || options.mode || "kubernetes");
     const networkMode = normalizeClusterNetwork(options.network || options.networkMode || "public");
@@ -4407,7 +5052,7 @@ async function clusters(args, context) {
           "timeout",
         ],
       },
-      "Usage: ornn clusters create <reservation-id> --type kubernetes|slurm [--network public|private] [--node <node-id>] [--node-count <n>] [--wait] [--json]",
+      "Usage: ornn clusters create <reservation-id> --type kubernetes|slurm [--network public|private] [--node <node-id>] [--node-count <n>] [--wait] [--json]"
     );
     const type = normalizeClusterType(requiredOption(options.type || options.mode, "--type"));
     const launch = await launchCluster(reservationId, type, options, context);
@@ -4427,7 +5072,7 @@ async function clusters(args, context) {
     const options = parseCommandOptions(
       [maybeNodeId, ...rest].filter(Boolean),
       { boolean: ["json"], value: ["type", "mode"] },
-      "Usage: ornn clusters show <reservation-id> [--type kubernetes|slurm] [--json]",
+      "Usage: ornn clusters show <reservation-id> [--type kubernetes|slurm] [--json]"
     );
     const type = await resolveClusterTypeForReservation(reservationId, options, context);
     const cluster = await fetchCluster(reservationId, type, context);
@@ -4443,7 +5088,7 @@ async function clusters(args, context) {
     const options = parseCommandOptions(
       [maybeNodeId, ...rest].filter(Boolean),
       { boolean: ["json"], value: ["timeout", "type", "mode", "wait-interval", "wait-timeout"] },
-      "Usage: ornn clusters wait <reservation-id> [--type kubernetes|slurm] [--timeout <seconds>] [--json]",
+      "Usage: ornn clusters wait <reservation-id> [--type kubernetes|slurm] [--timeout <seconds>] [--json]"
     );
     const type = await resolveClusterTypeForReservation(reservationId, options, context);
     const result = await waitForClusterActive(reservationId, type, waitOptions(options), context);
@@ -4459,7 +5104,7 @@ async function clusters(args, context) {
     const options = parseCommandOptions(
       [maybeNodeId, ...rest].filter(Boolean),
       { boolean: ["json"], value: ["type", "mode"] },
-      "Usage: ornn clusters credentials <reservation-id> [--type kubernetes|slurm] [--json]",
+      "Usage: ornn clusters credentials <reservation-id> [--type kubernetes|slurm] [--json]"
     );
     const type = await resolveClusterTypeForReservation(reservationId, options, context);
     const credentials = await fetchClusterCredentials(reservationId, type, context);
@@ -4475,7 +5120,7 @@ async function clusters(args, context) {
     const options = parseCommandOptions(
       [maybeNodeId, ...rest].filter(Boolean),
       { boolean: ["json"], value: ["output"] },
-      "Usage: ornn clusters kubeconfig <reservation-id> [--output <path>] [--json]",
+      "Usage: ornn clusters kubeconfig <reservation-id> [--output <path>] [--json]"
     );
     const credentials = await fetchClusterCredentials(reservationId, "kubernetes", context);
     const kubeconfig = String(credentials?.kubeconfig || "");
@@ -4484,7 +5129,11 @@ async function clusters(args, context) {
     }
     const outputPath = options.output ? expandUserPath(String(options.output)) : null;
     if (outputPath) {
-      await writeFile(outputPath, kubeconfig.endsWith("\n") ? kubeconfig : `${kubeconfig}\n`, "utf8");
+      await writeFile(
+        outputPath,
+        kubeconfig.endsWith("\n") ? kubeconfig : `${kubeconfig}\n`,
+        "utf8"
+      );
     }
     if (options.json) {
       writeJson(context.stdout, { credentials, output: outputPath });
@@ -4500,7 +5149,7 @@ async function clusters(args, context) {
     const options = parseCommandOptions(
       [maybeNodeId, ...rest].filter(Boolean),
       { boolean: ["json"], value: ["identity-file", "user"] },
-      "Usage: ornn clusters ssh-command <reservation-id> [--identity-file <path>] [--user <name>] [--json]",
+      "Usage: ornn clusters ssh-command <reservation-id> [--identity-file <path>] [--user <name>] [--json]"
     );
     const credentials = await fetchClusterCredentials(reservationId, "slurm", context);
     const invocation = slurmSshInvocation(credentials, options);
@@ -4520,7 +5169,7 @@ async function clusters(args, context) {
     const options = parseCommandOptions(
       [maybeNodeId, ...rest].filter(Boolean),
       { boolean: ["json", "print"], value: ["identity-file", "user"] },
-      "Usage: ornn clusters ssh <reservation-id> [--print] [--identity-file <path>] [--user <name>] [--json]",
+      "Usage: ornn clusters ssh <reservation-id> [--print] [--identity-file <path>] [--user <name>] [--json]"
     );
     const credentials = await fetchClusterCredentials(reservationId, "slurm", context);
     const invocation = slurmSshInvocation(credentials, options);
@@ -4545,16 +5194,19 @@ async function clusters(args, context) {
     const options = parseCommandOptions(
       trailing,
       { boolean: ["json"], value: ["node", "node-id"] },
-      `Usage: ornn clusters ${subcommand} <reservation-id> --node <node-id> [--json]`,
+      `Usage: ornn clusters ${subcommand} <reservation-id> --node <node-id> [--json]`
     );
     const nodeId = requiredOption(options.node || options.nodeId || nodeIdArg, "--node");
-    const cluster = subcommand === "add-node"
-      ? await addClusterNode(reservationId, nodeId, context)
-      : await removeClusterNode(reservationId, nodeId, context);
+    const cluster =
+      subcommand === "add-node"
+        ? await addClusterNode(reservationId, nodeId, context)
+        : await removeClusterNode(reservationId, nodeId, context);
     if (options.json) {
       writeJson(context.stdout, cluster);
     } else {
-      context.stdout.write(`Cluster node ${subcommand === "add-node" ? "add" : "remove"} queued.\n`);
+      context.stdout.write(
+        `Cluster node ${subcommand === "add-node" ? "add" : "remove"} queued.\n`
+      );
       writeClusterDetail(context.stdout, cluster);
     }
     return 0;
@@ -4564,7 +5216,7 @@ async function clusters(args, context) {
     const options = parseCommandOptions(
       [maybeNodeId, ...rest].filter(Boolean),
       { boolean: ["json"], value: ["type", "mode"] },
-      "Usage: ornn clusters teardown <reservation-id> [--type kubernetes|slurm] [--json]",
+      "Usage: ornn clusters teardown <reservation-id> [--type kubernetes|slurm] [--json]"
     );
     const type = await resolveClusterTypeForReservation(reservationId, options, context);
     const cluster = await teardownCluster(reservationId, type, context);
@@ -4578,10 +5230,14 @@ async function clusters(args, context) {
   }
   if (subcommand === "create") {
-    throw new Error("Usage: ornn clusters create <reservation-id> --type kubernetes|slurm [--network public|private] [--node <node-id>] [--node-count <n>] [--wait] [--json]");
+    throw new Error(
+      "Usage: ornn clusters create <reservation-id> --type kubernetes|slurm [--network public|private] [--node <node-id>] [--node-count <n>] [--wait] [--json]"
+    );
   }
-  throw new Error("Usage: ornn clusters list|reservations|eligible-nodes|create|show|wait|credentials|kubeconfig|ssh-command|ssh|add-node|remove-node|teardown");
+  throw new Error(
+    "Usage: ornn clusters list|reservations|eligible-nodes|create|show|wait|credentials|kubeconfig|ssh-command|ssh|add-node|remove-node|teardown"
+  );
 }
 async function slurm(args, context) {
@@ -4594,7 +5250,7 @@ async function slurm(args, context) {
         boolean: ["json", "wait"],
         value: ["network", "node", "node-count", "wait-interval", "wait-timeout", "timeout"],
       },
-      "Usage: ornn slurm launch <reservation-id> [--network public|private] [--node <node-id>] [--node-count <n>] [--wait] [--wait-timeout <seconds>] [--json]",
+      "Usage: ornn slurm launch <reservation-id> [--network public|private] [--node <node-id>] [--node-count <n>] [--wait] [--wait-timeout <seconds>] [--json]"
     );
     const launch = await launchCluster(reservationId, "slurm", options, context);
     const wait = options.wait
@@ -4613,7 +5269,7 @@ async function slurm(args, context) {
     const options = parseCommandOptions(
       rest,
       { boolean: ["json"] },
-      "Usage: ornn slurm teardown <reservation-id> [--json]",
+      "Usage: ornn slurm teardown <reservation-id> [--json]"
     );
     const cluster = await teardownCluster(reservationId, "slurm", context);
     if (options.json) {
@@ -4629,7 +5285,7 @@ async function slurm(args, context) {
     const options = parseCommandOptions(
       rest,
       { boolean: ["json"] },
-      "Usage: ornn slurm status <reservation-id> [--json]",
+      "Usage: ornn slurm status <reservation-id> [--json]"
     );
     const cluster = await fetchCluster(reservationId, "slurm", context);
     if (options.json) {
@@ -4644,7 +5300,7 @@ async function slurm(args, context) {
     const options = parseCommandOptions(
       rest,
       { boolean: ["json"] },
-      "Usage: ornn slurm credentials <reservation-id> [--json]",
+      "Usage: ornn slurm credentials <reservation-id> [--json]"
     );
     const credentials = await fetchClusterCredentials(reservationId, "slurm", context);
     if (options.json) {
@@ -4659,7 +5315,7 @@ async function slurm(args, context) {
     const options = parseCommandOptions(
       rest,
       { boolean: ["json", "print"], value: ["identity-file", "user"] },
-      "Usage: ornn slurm ssh <reservation-id> [--print] [--identity-file <path>] [--user <name>] [--json]",
+      "Usage: ornn slurm ssh <reservation-id> [--print] [--identity-file <path>] [--user <name>] [--json]"
     );
     const credentials = await fetchClusterCredentials(reservationId, "slurm", context);
     const invocation = slurmSshInvocation(credentials, options);
@@ -4691,7 +5347,7 @@ async function kubernetes(args, context) {
         boolean: ["json", "wait"],
         value: ["network", "node", "node-count", "wait-interval", "wait-timeout", "timeout"],
       },
-      "Usage: ornn kubernetes launch <reservation-id> [--network public|private] [--node <node-id>] [--node-count <n>] [--wait] [--wait-timeout <seconds>] [--json]",
+      "Usage: ornn kubernetes launch <reservation-id> [--network public|private] [--node <node-id>] [--node-count <n>] [--wait] [--wait-timeout <seconds>] [--json]"
     );
     const launch = await launchCluster(reservationId, "kubernetes", options, context);
     const wait = options.wait
@@ -4710,7 +5366,7 @@ async function kubernetes(args, context) {
     const options = parseCommandOptions(
       rest,
       { boolean: ["json"] },
-      "Usage: ornn kubernetes teardown <reservation-id> [--json]",
+      "Usage: ornn kubernetes teardown <reservation-id> [--json]"
     );
     const cluster = await teardownCluster(reservationId, "kubernetes", context);
     if (options.json) {
@@ -4726,7 +5382,7 @@ async function kubernetes(args, context) {
     const options = parseCommandOptions(
       rest,
       { boolean: ["json"] },
-      "Usage: ornn kubernetes status <reservation-id> [--json]",
+      "Usage: ornn kubernetes status <reservation-id> [--json]"
     );
     const cluster = await fetchCluster(reservationId, "kubernetes", context);
     if (options.json) {
@@ -4741,7 +5397,7 @@ async function kubernetes(args, context) {
     const options = parseCommandOptions(
       rest,
       { boolean: ["json"] },
-      "Usage: ornn kubernetes credentials <reservation-id> [--json]",
+      "Usage: ornn kubernetes credentials <reservation-id> [--json]"
     );
     const credentials = await fetchClusterCredentials(reservationId, "kubernetes", context);
     if (options.json) {
@@ -4756,7 +5412,7 @@ async function kubernetes(args, context) {
     const options = parseCommandOptions(
       rest,
       { boolean: ["json"], value: ["output"] },
-      "Usage: ornn kubernetes kubeconfig <reservation-id> [--output <path>] [--json]",
+      "Usage: ornn kubernetes kubeconfig <reservation-id> [--output <path>] [--json]"
     );
     const credentials = await fetchClusterCredentials(reservationId, "kubernetes", context);
     const kubeconfig = String(credentials?.kubeconfig || "");
@@ -4765,7 +5421,11 @@ async function kubernetes(args, context) {
     }
     const outputPath = options.output ? expandUserPath(String(options.output)) : null;
     if (outputPath) {
-      await writeFile(outputPath, kubeconfig.endsWith("\n") ? kubeconfig : `${kubeconfig}\n`, "utf8");
+      await writeFile(
+        outputPath,
+        kubeconfig.endsWith("\n") ? kubeconfig : `${kubeconfig}\n`,
+        "utf8"
+      );
     }
     if (options.json) {
       writeJson(context.stdout, { credentials, output: outputPath });
@@ -4777,7 +5437,9 @@ async function kubernetes(args, context) {
     return 0;
   }
-  throw new Error("Usage: ornn kubernetes launch|teardown|status|credentials|kubeconfig <reservation-id>");
+  throw new Error(
+    "Usage: ornn kubernetes launch|teardown|status|credentials|kubeconfig <reservation-id>"
+  );
 }
 async function networks(args, context) {
@@ -4787,7 +5449,7 @@ async function networks(args, context) {
     const options = parseCommandOptions(
       [id, ...rest].filter(Boolean),
       { boolean: ["json"] },
-      "Usage: ornn networks list [--json]",
+      "Usage: ornn networks list [--json]"
     );
     const payload = await cliRequest({
       endpoint: computeEndpoint("/networks"),
@@ -4807,7 +5469,7 @@ async function networks(args, context) {
     const options = parseCommandOptions(
       rest,
       { boolean: ["json"] },
-      "Usage: ornn networks show <network-id> [--json]",
+      "Usage: ornn networks show <network-id> [--json]"
     );
     const network = await cliRequest({
       endpoint: computeEndpoint(`/networks/${encodeURIComponent(id)}`),
@@ -4826,7 +5488,7 @@ async function networks(args, context) {
     const options = parseCommandOptions(
       [id, ...rest].filter(Boolean),
       { boolean: ["json"], value: ["cidr", "description", "name"] },
-      "Usage: ornn networks create --name <name> [--cidr <cidr>] [--description <text>] [--json]",
+      "Usage: ornn networks create --name <name> [--cidr <cidr>] [--description <text>] [--json]"
     );
     const payload = {
       cidr: optionalStringOption(options.cidr),
@@ -4854,7 +5516,7 @@ async function networks(args, context) {
     const options = parseCommandOptions(
       rest,
       { boolean: ["clear-description", "json"], value: ["description", "name"] },
-      "Usage: ornn networks update <network-id> [--name <name>] [--description <text>] [--clear-description] [--json]",
+      "Usage: ornn networks update <network-id> [--name <name>] [--description <text>] [--clear-description] [--json]"
     );
     if (options.clearDescription && optionProvided(options.description)) {
       throw new Error("Use either --description or --clear-description, not both.");
@@ -4892,7 +5554,7 @@ async function networks(args, context) {
     const options = parseCommandOptions(
       rest,
       { boolean: ["json"] },
-      "Usage: ornn networks delete <network-id> [--json]",
+      "Usage: ornn networks delete <network-id> [--json]"
     );
     await cliRequest({
       endpoint: computeEndpoint(`/networks/${encodeURIComponent(id)}`),
@@ -4913,7 +5575,7 @@ async function networks(args, context) {
     const options = parseCommandOptions(
       rest,
       { boolean: ["json"] },
-      "Usage: ornn networks reservation <reservation-id> [--json]",
+      "Usage: ornn networks reservation <reservation-id> [--json]"
     );
     const payload = await cliRequest({
       endpoint: computeEndpoint(`/nodes/reservations/${encodeURIComponent(id)}/network`),
@@ -4932,7 +5594,7 @@ async function networks(args, context) {
     const options = parseCommandOptions(
       rest,
       { boolean: ["json"], value: ["network", "network-id"] },
-      "Usage: ornn networks attach <reservation-id> --network <network-id> [--json]",
+      "Usage: ornn networks attach <reservation-id> --network <network-id> [--json]"
     );
     const networkId = requiredOption(options.network || options.networkId, "--network");
     const payload = await cliRequest({
@@ -4955,7 +5617,7 @@ async function networks(args, context) {
     const options = parseCommandOptions(
       rest,
       { boolean: ["json"] },
-      "Usage: ornn networks detach <reservation-id> [--json]",
+      "Usage: ornn networks detach <reservation-id> [--json]"
     );
     const payload = await cliRequest({
       body: { tenant_network_id: null },
@@ -4987,12 +5649,21 @@ function normalizeStorageDestination(value) {
     normalized.endsWith("/") ||
     parts.some((part) => !part || part === "." || part === "..")
   ) {
-    throw new Error("Destination must be a relative path inside the volume and cannot contain . or .. segments.");
+    throw new Error(
+      "Destination must be a relative path inside the volume and cannot contain . or .. segments."
+    );
   }
   return normalized;
 }
-async function putSignedStorageUpload({ contentType, fetchImpl, headers, localFile, sizeBytes, uploadUrl }) {
+async function putSignedStorageUpload({
+  contentType,
+  fetchImpl,
+  headers,
+  localFile,
+  sizeBytes,
+  uploadUrl,
+}) {
   let url;
   try {
     url = new URL(uploadUrl);
@@ -5034,13 +5705,16 @@ async function putSignedStorageUpload({ contentType, fetchImpl, headers, localFi
     if (response.status === 403) {
       throw new CliApiError(
         "The upload link expired before the file finished uploading. Try again; the volume does not need to be remounted.",
-        { status: response.status },
+        { status: response.status }
       );
     }
     if (response.status === 409 || response.status === 412) {
-      throw new CliApiError("This file changed while your upload was in progress. Refresh the volume and try again.", {
-        status: response.status,
-      });
+      throw new CliApiError(
+        "This file changed while your upload was in progress. Refresh the volume and try again.",
+        {
+          status: response.status,
+        }
+      );
     }
     throw new CliApiError("Storage could not accept the file. Try the upload again.", {
       status: response.status,
@@ -5053,7 +5727,7 @@ async function cancelStorageUploadSession({ driveId, env, fetchImpl, uploadId })
   try {
     await cliRequest({
       endpoint: computeEndpoint(
-        `/nodes/storage-drives/${encodeURIComponent(driveId)}/file-uploads/${encodeURIComponent(uploadId)}`,
+        `/nodes/storage-drives/${encodeURIComponent(driveId)}/file-uploads/${encodeURIComponent(uploadId)}`
       ),
       env,
       fetchImpl,
@@ -5068,18 +5742,19 @@ async function cancelStorageUploadSession({ driveId, env, fetchImpl, uploadId })
 async function storage(args, context) {
   const [resource = "volumes", rawSubcommand, id, ...rest] = args;
   const subcommand =
-    rawSubcommand ?? (resource === "buckets" || ["drives", "volumes"].includes(resource) ? "list" : undefined);
+    rawSubcommand ??
+    (resource === "buckets" || ["drives", "volumes"].includes(resource) ? "list" : undefined);
   if (resource === "files" && subcommand === "upload" && id) {
     const [localFile, ...optionArgs] = rest;
     if (!localFile) {
       throw new Error(
-        "Usage: ornn storage files upload <drive-id> <local-file> [--destination <path>] [--content-type <type>] [--json]",
+        "Usage: ornn storage files upload <drive-id> <local-file> [--destination <path>] [--content-type <type>] [--json]"
       );
     }
     const options = parseCommandOptions(
       optionArgs,
       { boolean: ["json"], value: ["content-type", "destination"] },
-      "Usage: ornn storage files upload <drive-id> <local-file> [--destination <path>] [--content-type <type>] [--json]",
+      "Usage: ornn storage files upload <drive-id> <local-file> [--destination <path>] [--content-type <type>] [--json]"
     );
     let fileInfo;
     try {
@@ -5090,7 +5765,9 @@ async function storage(args, context) {
     if (!fileInfo.isFile()) {
       throw new Error("Upload expects a file, not a directory.");
     }
-    const destination = normalizeStorageDestination(optionalStringOption(options.destination) ?? basename(localFile));
+    const destination = normalizeStorageDestination(
+      optionalStringOption(options.destination) ?? basename(localFile)
+    );
     const contentType = optionalStringOption(options.contentType) ?? "application/octet-stream";
     const session = await cliRequest({
       body: { path: destination, content_type: contentType, size_bytes: fileInfo.size },
@@ -5110,7 +5787,7 @@ async function storage(args, context) {
         uploadUrl: session.upload_url,
       });
       const completionEndpoint = computeEndpoint(
-        `/nodes/storage-drives/${encodeURIComponent(id)}/file-uploads/${encodeURIComponent(session.upload_id)}/complete`,
+        `/nodes/storage-drives/${encodeURIComponent(id)}/file-uploads/${encodeURIComponent(session.upload_id)}/complete`
       );
       try {
         result = await cliRequest({
@@ -5144,7 +5821,9 @@ async function storage(args, context) {
     if (options.json) {
       writeJson(context.stdout, result);
     } else {
-      context.stdout.write(`Uploaded ${localFile} to ${destination}. Mounted nodes can use it without remounting.\n`);
+      context.stdout.write(
+        `Uploaded ${localFile} to ${destination}. Mounted nodes can use it without remounting.\n`
+      );
     }
     return 0;
   }
@@ -5155,11 +5834,16 @@ async function storage(args, context) {
         boolean: ["json"],
         value: ["reservation", "reservation-id"],
       },
-      "Usage: ornn storage undeploy --reservation <reservation-id> [--json]",
+      "Usage: ornn storage undeploy --reservation <reservation-id> [--json]"
+    );
+    const reservationId = requiredOption(
+      options.reservation || options.reservationId,
+      "--reservation"
     );
-    const reservationId = requiredOption(options.reservation || options.reservationId, "--reservation");
     const payload = await cliRequest({
-      endpoint: computeEndpoint(`/nodes/reservations/${encodeURIComponent(reservationId)}/storage-attachment`),
+      endpoint: computeEndpoint(
+        `/nodes/reservations/${encodeURIComponent(reservationId)}/storage-attachment`
+      ),
       env: context.env,
       fetchImpl: context.fetchImpl,
       method: "DELETE",
@@ -5168,7 +5852,7 @@ async function storage(args, context) {
       writeJson(context.stdout, payload);
     } else {
       context.stdout.write(
-        "Storage detach requested. Ornn will flush every mounted node before releasing the volume.\n",
+        "Storage detach requested. Ornn will flush every mounted node before releasing the volume.\n"
       );
       if (payload?.attachment) {
         writeReservationStorageAttachment(context.stdout, payload.attachment);
@@ -5184,15 +5868,24 @@ async function storage(args, context) {
           boolean: ["json"],
           value: ["capacity-gib", "performance-tier", "reservation", "reservation-id"],
         },
-        "Usage: ornn storage filesystem deploy --reservation <reservation-id> [--performance-tier <tier>] [--capacity-gib <gib>] [--json]",
+        "Usage: ornn storage filesystem deploy --reservation <reservation-id> [--performance-tier <tier>] [--capacity-gib <gib>] [--json]"
+      );
+      const reservationId = requiredOption(
+        options.reservation || options.reservationId,
+        "--reservation"
       );
-      const reservationId = requiredOption(options.reservation || options.reservationId, "--reservation");
       const payload = await cliRequest({
         body: {
-          ...(optionProvided(options.performanceTier) ? { performance_tier: requiredOption(options.performanceTier, "--performance-tier") } : {}),
-          ...(optionProvided(options.capacityGib) ? { capacity_gib: positiveIntegerOption(options.capacityGib, "--capacity-gib") } : {}),
+          ...(optionProvided(options.performanceTier)
+            ? { performance_tier: requiredOption(options.performanceTier, "--performance-tier") }
+            : {}),
+          ...(optionProvided(options.capacityGib)
+            ? { capacity_gib: positiveIntegerOption(options.capacityGib, "--capacity-gib") }
+            : {}),
         },
-        endpoint: computeEndpoint(`/nodes/reservations/${encodeURIComponent(reservationId)}/filesystem-deployment`),
+        endpoint: computeEndpoint(
+          `/nodes/reservations/${encodeURIComponent(reservationId)}/filesystem-deployment`
+        ),
         env: context.env,
         fetchImpl: context.fetchImpl,
         method: "POST",
@@ -5212,11 +5905,16 @@ async function storage(args, context) {
           boolean: ["json"],
           value: ["reservation", "reservation-id"],
         },
-        "Usage: ornn storage filesystem status --reservation <reservation-id> [--json]",
+        "Usage: ornn storage filesystem status --reservation <reservation-id> [--json]"
+      );
+      const reservationId = requiredOption(
+        options.reservation || options.reservationId,
+        "--reservation"
       );
-      const reservationId = requiredOption(options.reservation || options.reservationId, "--reservation");
       const payload = await cliRequest({
-        endpoint: computeEndpoint(`/nodes/reservations/${encodeURIComponent(reservationId)}/storage-attachment`),
+        endpoint: computeEndpoint(
+          `/nodes/reservations/${encodeURIComponent(reservationId)}/storage-attachment`
+        ),
         env: context.env,
         fetchImpl: context.fetchImpl,
       });
@@ -5235,11 +5933,16 @@ async function storage(args, context) {
           boolean: ["json"],
           value: ["reservation", "reservation-id"],
         },
-        "Usage: ornn storage filesystem delete --reservation <reservation-id> [--json]",
+        "Usage: ornn storage filesystem delete --reservation <reservation-id> [--json]"
+      );
+      const reservationId = requiredOption(
+        options.reservation || options.reservationId,
+        "--reservation"
       );
-      const reservationId = requiredOption(options.reservation || options.reservationId, "--reservation");
       const payload = await cliRequest({
-        endpoint: computeEndpoint(`/nodes/reservations/${encodeURIComponent(reservationId)}/filesystem-deployment`),
+        endpoint: computeEndpoint(
+          `/nodes/reservations/${encodeURIComponent(reservationId)}/filesystem-deployment`
+        ),
         env: context.env,
         fetchImpl: context.fetchImpl,
         method: "DELETE",
@@ -5252,7 +5955,9 @@ async function storage(args, context) {
       }
       return 0;
     }
-    throw new Error("Usage: ornn storage filesystem deploy|status|delete --reservation <reservation-id> [--json]");
+    throw new Error(
+      "Usage: ornn storage filesystem deploy|status|delete --reservation <reservation-id> [--json]"
+    );
   }
   if (resource === "deploy" && subcommand === "status") {
     const options = parseCommandOptions(
@@ -5261,11 +5966,16 @@ async function storage(args, context) {
         boolean: ["json"],
         value: ["reservation", "reservation-id"],
       },
-      "Usage: ornn storage deploy status --reservation <reservation-id> [--json]",
+      "Usage: ornn storage deploy status --reservation <reservation-id> [--json]"
+    );
+    const reservationId = requiredOption(
+      options.reservation || options.reservationId,
+      "--reservation"
     );
-    const reservationId = requiredOption(options.reservation || options.reservationId, "--reservation");
     const payload = await cliRequest({
-      endpoint: computeEndpoint(`/nodes/reservations/${encodeURIComponent(reservationId)}/storage-attachment`),
+      endpoint: computeEndpoint(
+        `/nodes/reservations/${encodeURIComponent(reservationId)}/storage-attachment`
+      ),
       env: context.env,
       fetchImpl: context.fetchImpl,
     });
@@ -5284,12 +5994,15 @@ async function storage(args, context) {
         boolean: ["all-nodes", "json", "read-only", "read-write"],
         value: ["mount-path", "reservation", "reservation-id"],
       },
-      "Usage: ornn storage deploy <drive-id> --reservation <reservation-id> [--all-nodes] [--mount-path <path>] [--read-only|--read-write] [--json]",
+      "Usage: ornn storage deploy <drive-id> --reservation <reservation-id> [--all-nodes] [--mount-path <path>] [--read-only|--read-write] [--json]"
     );
     if (options.readOnly && options.readWrite) {
       throw new Error("Choose only one of --read-only or --read-write.");
     }
-    const reservationId = requiredOption(options.reservation || options.reservationId, "--reservation");
+    const reservationId = requiredOption(
+      options.reservation || options.reservationId,
+      "--reservation"
+    );
     const drive = await findStorageBucket(subcommand, context);
     const deploymentBlockReason = storageDeploymentBlockReason(drive);
     if (deploymentBlockReason) {
@@ -5298,11 +6011,15 @@ async function storage(args, context) {
     const payload = await cliRequest({
       body: {
         drive_id: subcommand,
-        ...(optionProvided(options.mountPath) ? { mount_path: requiredOption(options.mountPath, "--mount-path") } : {}),
+        ...(optionProvided(options.mountPath)
+          ? { mount_path: requiredOption(options.mountPath, "--mount-path") }
+          : {}),
         access_mode: options.readOnly ? "read-only" : "read-write",
         ...(options.allNodes ? { all_nodes: true } : {}),
       },
-      endpoint: computeEndpoint(`/nodes/reservations/${encodeURIComponent(reservationId)}/storage-deployment`),
+      endpoint: computeEndpoint(
+        `/nodes/reservations/${encodeURIComponent(reservationId)}/storage-deployment`
+      ),
       env: context.env,
       fetchImpl: context.fetchImpl,
       method: "POST",
@@ -5313,21 +6030,23 @@ async function storage(args, context) {
       context.stdout.write(
         options.allNodes
           ? "Storage deployment started for every compatible node in the group.\n"
-          : "Storage deployment started.\n",
+          : "Storage deployment started.\n"
       );
       writeReservationStorageAttachment(context.stdout, payload.attachment);
     }
     return 0;
   }
   if (resource === "deploy") {
-    throw new Error("Usage: ornn storage deploy <drive-id> --reservation <reservation-id> [--all-nodes] [--mount-path <path>] [--read-only|--read-write] [--json]");
+    throw new Error(
+      "Usage: ornn storage deploy <drive-id> --reservation <reservation-id> [--all-nodes] [--mount-path <path>] [--read-only|--read-write] [--json]"
+    );
   }
   if (resource === "buckets") {
     if (subcommand === "list") {
       const options = parseCommandOptions(
         [id, ...rest].filter(Boolean),
         { boolean: ["json"] },
-        "Usage: ornn storage buckets list [--json]",
+        "Usage: ornn storage buckets list [--json]"
       );
       const payload = await fetchStorageDrives(context);
       const buckets = storageBucketsFromPayload(payload);
@@ -5342,7 +6061,7 @@ async function storage(args, context) {
       const options = parseCommandOptions(
         rest,
         { boolean: ["json"] },
-        "Usage: ornn storage buckets show <drive-id> [--json]",
+        "Usage: ornn storage buckets show <drive-id> [--json]"
       );
       const bucket = await findStorageBucket(id, context);
       if (options.json) {
@@ -5356,7 +6075,7 @@ async function storage(args, context) {
       const options = parseCommandOptions(
         rest,
         { boolean: ["json"] },
-        "Usage: ornn storage buckets verify <drive-id> [--json]",
+        "Usage: ornn storage buckets verify <drive-id> [--json]"
       );
       const drive = await cliRequest({
         endpoint: computeEndpoint(`/nodes/storage-drives/${encodeURIComponent(id)}/verify-source`),
@@ -5369,7 +6088,7 @@ async function storage(args, context) {
         writeJson(context.stdout, drive);
       } else {
         context.stdout.write(
-          verificationFailed ? "Bucket source verification failed.\n" : "Bucket source verified.\n",
+          verificationFailed ? "Bucket source verification failed.\n" : "Bucket source verified.\n"
         );
         writeStorageDriveDetail(context.stdout, drive);
       }
@@ -5382,7 +6101,7 @@ async function storage(args, context) {
           boolean: ["json"],
           value: ["access-key-id", "secret-access-key", "secret-access-key-file"],
         },
-        "Usage: ornn storage buckets update-credentials <drive-id> --access-key-id <id> --secret-access-key-file <path> [--json]",
+        "Usage: ornn storage buckets update-credentials <drive-id> --access-key-id <id> --secret-access-key-file <path> [--json]"
       );
       if (options.secretAccessKey && options.secretAccessKeyFile) {
         throw new Error("Use only one of --secret-access-key or --secret-access-key-file.");
@@ -5398,7 +6117,9 @@ async function storage(args, context) {
           external_access_key_id: requiredOption(options.accessKeyId, "--access-key-id"),
           external_secret_access_key: secretAccessKey,
         },
-        endpoint: computeEndpoint(`/nodes/storage-drives/${encodeURIComponent(id)}/source-credentials`),
+        endpoint: computeEndpoint(
+          `/nodes/storage-drives/${encodeURIComponent(id)}/source-credentials`
+        ),
         env: context.env,
         fetchImpl: context.fetchImpl,
         method: "PATCH",
@@ -5415,7 +6136,7 @@ async function storage(args, context) {
       const options = parseCommandOptions(
         rest,
         { boolean: ["json"] },
-        "Usage: ornn storage buckets disconnect <drive-id> [--json]",
+        "Usage: ornn storage buckets disconnect <drive-id> [--json]"
       );
       await cliRequest({
         endpoint: computeEndpoint(`/nodes/storage-drives/${encodeURIComponent(id)}`),
@@ -5433,16 +6154,27 @@ async function storage(args, context) {
     }
     if (subcommand !== "connect" || !["gcs", "s3", "r2"].includes(id)) {
       throw new Error(
-        "Usage: ornn storage buckets list|show|connect|verify|update-credentials|disconnect",
+        "Usage: ornn storage buckets list|show|connect|verify|update-credentials|disconnect"
       );
     }
     const options = parseCommandOptions(
       rest,
       {
         boolean: ["json", "read-only", "read-write", "verify"],
-        value: ["access-key-id", "account-id", "bucket", "endpoint-url", "name", "prefix", "region", "secret-access-key", "secret-access-key-file", "url"],
+        value: [
+          "access-key-id",
+          "account-id",
+          "bucket",
+          "endpoint-url",
+          "name",
+          "prefix",
+          "region",
+          "secret-access-key",
+          "secret-access-key-file",
+          "url",
+        ],
       },
-      "Usage: ornn storage buckets connect gcs|s3|r2 --bucket <bucket>|--url <url> [--name <name>] [--prefix <prefix>] [--region <region>] [--account-id <id>|--endpoint-url <url>] [--access-key-id <id> --secret-access-key-file <path>] [--read-only|--read-write] [--verify] [--json]",
+      "Usage: ornn storage buckets connect gcs|s3|r2 --bucket <bucket>|--url <url> [--name <name>] [--prefix <prefix>] [--region <region>] [--account-id <id>|--endpoint-url <url>] [--access-key-id <id> --secret-access-key-file <path>] [--read-only|--read-write] [--verify] [--json]"
     );
     if (options.readOnly && options.readWrite) {
       throw new Error("Choose only one of --read-only or --read-write.");
@@ -5456,7 +6188,10 @@ async function storage(args, context) {
     if (options.secretAccessKey && options.secretAccessKeyFile) {
       throw new Error("Use only one of --secret-access-key or --secret-access-key-file.");
     }
-    if (id === "gcs" && (options.accessKeyId || options.secretAccessKey || options.secretAccessKeyFile)) {
+    if (
+      id === "gcs" &&
+      (options.accessKeyId || options.secretAccessKey || options.secretAccessKeyFile)
+    ) {
       throw new Error("Access key credentials are only supported for S3-compatible buckets.");
     }
     const secretAccessKey = options.secretAccessKeyFile
@@ -5468,7 +6203,11 @@ async function storage(args, context) {
     const source = storageBucketSourceFromOptions(id, options);
     const prefix = optionalStringOption(options.prefix) ?? source.prefix;
     const endpointOptions = { ...options };
-    if (!optionProvided(endpointOptions.accountId) && source.accountId && !optionProvided(endpointOptions.endpointUrl)) {
+    if (
+      !optionProvided(endpointOptions.accountId) &&
+      source.accountId &&
+      !optionProvided(endpointOptions.endpointUrl)
+    ) {
       endpointOptions.accountId = source.accountId;
     }
     const endpointUrl = storageBucketEndpointUrl(id, endpointOptions);
@@ -5481,7 +6220,8 @@ async function storage(args, context) {
         source_provider: sourceProvider,
         external_bucket: bucketName,
         external_prefix: prefix,
-        external_region: optionalStringOption(options.region) ?? source.region ?? (id === "r2" ? "auto" : null),
+        external_region:
+          optionalStringOption(options.region) ?? source.region ?? (id === "r2" ? "auto" : null),
         external_read_only: options.readWrite ? false : true,
         ...(id === "r2" ? { external_s3_provider: "cloudflare_r2" } : {}),
         ...(id === "s3" ? { external_s3_provider: "aws_s3" } : {}),
@@ -5502,7 +6242,8 @@ async function storage(args, context) {
       endpointUrl,
       prefix,
       provider: id,
-      region: optionalStringOption(options.region) ?? source.region ?? (id === "r2" ? "auto" : null),
+      region:
+        optionalStringOption(options.region) ?? source.region ?? (id === "r2" ? "auto" : null),
       target: drive.import_target,
     });
     if (options.json) {
@@ -5513,7 +6254,7 @@ async function storage(args, context) {
         context.stdout.write(
           drive?.source?.connection_status === "verification_failed"
             ? "Bucket source verification failed.\n"
-            : "Bucket source verified.\n",
+            : "Bucket source verified.\n"
         );
       }
       writeStorageDriveDetail(context.stdout, drive);
@@ -5526,7 +6267,7 @@ async function storage(args, context) {
   }
   if (!["drives", "volumes"].includes(resource)) {
     throw new Error(
-      "Usage: ornn storage volumes list|show|create|refresh|clear|delete; ornn storage files upload <drive-id> <local-file>; ornn storage buckets connect gcs|s3|r2 --bucket <bucket>",
+      "Usage: ornn storage volumes list|show|create|refresh|clear|delete; ornn storage files upload <drive-id> <local-file>; ornn storage buckets connect gcs|s3|r2 --bucket <bucket>"
     );
   }
@@ -5534,7 +6275,7 @@ async function storage(args, context) {
     const options = parseCommandOptions(
       [id, ...rest].filter(Boolean),
       { boolean: ["json"] },
-      "Usage: ornn storage volumes list [--json]",
+      "Usage: ornn storage volumes list [--json]"
     );
     const payload = await fetchStorageDrives(context);
     if (options.json) {
@@ -5549,7 +6290,7 @@ async function storage(args, context) {
     const options = parseCommandOptions(
       rest,
       { boolean: ["json"] },
-      "Usage: ornn storage volumes show <drive-id> [--json]",
+      "Usage: ornn storage volumes show <drive-id> [--json]"
     );
     const drive = await findStorageDrive(id, context);
     if (options.json) {
@@ -5564,7 +6305,7 @@ async function storage(args, context) {
     const options = parseCommandOptions(
       [id, ...rest].filter(Boolean),
       { boolean: ["json"], value: ["name", "source", "source-drive-id"] },
-      "Usage: ornn storage volumes create --name <name> [--source <drive-id>] [--json]",
+      "Usage: ornn storage volumes create --name <name> [--source <drive-id>] [--json]"
     );
     const sourceDriveId = optionProvided(options.sourceDriveId)
       ? requiredOption(options.sourceDriveId, "--source-drive-id")
@@ -5592,7 +6333,7 @@ async function storage(args, context) {
     const options = parseCommandOptions(
       rest,
       { boolean: ["json"] },
-      "Usage: ornn storage volumes refresh <drive-id> [--json]",
+      "Usage: ornn storage volumes refresh <drive-id> [--json]"
     );
     const drive = await cliRequest({
       endpoint: computeEndpoint(`/nodes/storage-drives/${encodeURIComponent(id)}/refresh`),
@@ -5613,7 +6354,7 @@ async function storage(args, context) {
     const options = parseCommandOptions(
       rest,
       { boolean: ["json"] },
-      "Usage: ornn storage volumes clear <drive-id> [--json]",
+      "Usage: ornn storage volumes clear <drive-id> [--json]"
     );
     await cliRequest({
       endpoint: computeEndpoint(`/nodes/storage-drives/${encodeURIComponent(id)}/contents`),
@@ -5634,7 +6375,7 @@ async function storage(args, context) {
     const options = parseCommandOptions(
       rest,
       { boolean: ["json"] },
-      "Usage: ornn storage volumes delete <drive-id> [--json]",
+      "Usage: ornn storage volumes delete <drive-id> [--json]"
     );
     await cliRequest({
       endpoint: computeEndpoint(`/nodes/storage-drives/${encodeURIComponent(id)}`),
@@ -5660,7 +6401,7 @@ async function keys(args, context) {
     const options = parseCommandOptions(
       rest,
       { boolean: ["json"], value: ["label", "public-key", "public-key-file"] },
-      "Usage: ornn keys add [<public-key-file>] [--public-key <key>] [--label <label>] [--json]",
+      "Usage: ornn keys add [<public-key-file>] [--public-key <key>] [--label <label>] [--json]"
     );
     const publicKey = await publicKeyFromRef(maybePath);
     const key = await ensureAccountSshKey(publicKey, options.label, context);
@@ -5687,7 +6428,7 @@ async function nodeKeys(args, context) {
     const options = parseCommandOptions(
       rest,
       { boolean: ["json"] },
-      `Usage: ornn nodes keys ${action} <node-id> [--json]`,
+      `Usage: ornn nodes keys ${action} <node-id> [--json]`
     );
     const machine = await fetchMachine(nodeId, context);
     const status = nodeKeyStatus(machine);
@@ -5704,9 +6445,17 @@ async function nodeKeys(args, context) {
       rest,
       {
         boolean: ["json"],
-        value: ["key", "key-id", "label", "public-key", "public-key-file", "request-id", "ssh-key-id"],
+        value: [
+          "key",
+          "key-id",
+          "label",
+          "public-key",
+          "public-key-file",
+          "request-id",
+          "ssh-key-id",
+        ],
       },
-      `Usage: ornn nodes keys ${action} <node-id> --key <path|id|label> [--json]`,
+      `Usage: ornn nodes keys ${action} <node-id> --key <path|id|label> [--json]`
     );
     const sshKeyIds = await resolveAccountSshKeyIds(options, context);
     if (!sshKeyIds.length) {
@@ -5740,7 +6489,7 @@ async function access(args, context) {
     const options = parseCommandOptions(
       rest,
       { boolean: ["json"] },
-      "Usage: ornn access show <reservation-id> [--json]",
+      "Usage: ornn access show <reservation-id> [--json]"
     );
     const payload = await getReservationMachines(reservationId, context);
     if (options.json) {
@@ -5776,9 +6525,11 @@ async function access(args, context) {
           "wait-timeout",
         ],
       },
-      "Usage: ornn access activate <reservation-id> --key <path|id|label> [--mode bare-metal|vm] [--username <name>] [--network public|private] [--storage-load-drive-id <id>] [--storage-save-drive-id <id>] [--no-open] [--json]",
+      "Usage: ornn access activate <reservation-id> --key <path|id|label> [--mode bare-metal|vm] [--username <name>] [--network public|private] [--storage-load-drive-id <id>] [--storage-save-drive-id <id>] [--no-open] [--json]"
     );
-    const result = await launchReservationAccess(reservationId, options, context, { openDefault: true });
+    const result = await launchReservationAccess(reservationId, options, context, {
+      openDefault: true,
+    });
     if (options.json) {
       writeJson(context.stdout, accessActivateJsonResult(result));
     } else {
@@ -5816,14 +6567,14 @@ async function access(args, context) {
           "wait-timeout",
         ],
       },
-      "Usage: ornn access switch <reservation-id> --network public|private --key <path|id|label> [--mode bare-metal|vm] [--username <name>] [--wait] [--json]",
+      "Usage: ornn access switch <reservation-id> --network public|private --key <path|id|label> [--mode bare-metal|vm] [--username <name>] [--wait] [--json]"
     );
     const result = await switchReservationAccess(reservationId, options, context);
     if (options.json) {
       writeJson(context.stdout, result);
     } else {
       context.stdout.write(
-        `Switched to ${displayAccessMode(result.mode)} / ${result.network_mode} on reservation ${reservationId}.\n`,
+        `Switched to ${displayAccessMode(result.mode)} / ${result.network_mode} on reservation ${reservationId}.\n`
       );
       writeAccessLaunchSummary(context.stdout, { machines: result.machines });
       if (result.wait) {
@@ -5837,14 +6588,16 @@ async function access(args, context) {
     const options = parseCommandOptions(
       rest,
       { boolean: ["json"], value: ["request-id", "ssh-key-id"] },
-      "Usage: ornn access push-keys <reservation-id> --ssh-key-id <id> [--json]",
+      "Usage: ornn access push-keys <reservation-id> --ssh-key-id <id> [--json]"
     );
     const sshKeyIds = requiredArrayOption(options.sshKeyId, "--ssh-key-id");
     const pushed = await pushReservationKeys(reservationId, sshKeyIds, options.requestId, context);
     if (options.json) {
       writeJson(context.stdout, { machines: pushed });
     } else {
-      context.stdout.write(`SSH key update queued for ${pushed.length} machine${pushed.length === 1 ? "" : "s"}.\n`);
+      context.stdout.write(
+        `SSH key update queued for ${pushed.length} machine${pushed.length === 1 ? "" : "s"}.\n`
+      );
     }
     return 0;
   }
@@ -5862,7 +6615,7 @@ async function accessKeys(args, context) {
     const options = parseCommandOptions(
       rest,
       { boolean: ["json"] },
-      "Usage: ornn access keys list <reservation-id> [--json]",
+      "Usage: ornn access keys list <reservation-id> [--json]"
     );
     const payload = await fetchReservationSshKeys(reservationId, context);
     if (options.json) {
@@ -5877,7 +6630,7 @@ async function accessKeys(args, context) {
     const options = parseCommandOptions(
       rest,
       { boolean: ["json"], value: ["label", "public-key", "public-key-file"] },
-      "Usage: ornn access keys add <reservation-id> --public-key <key> [--label <label>] [--json]",
+      "Usage: ornn access keys add <reservation-id> --public-key <key> [--label <label>] [--json]"
     );
     const publicKey = options.publicKeyFile
       ? (await readFile(options.publicKeyFile, "utf8")).trim()
@@ -5908,14 +6661,16 @@ async function accessKeys(args, context) {
     const options = parseCommandOptions(
       rest,
       { boolean: ["json"], value: ["request-id", "ssh-key-id"] },
-      "Usage: ornn access keys push <reservation-id> --ssh-key-id <id> [--json]",
+      "Usage: ornn access keys push <reservation-id> --ssh-key-id <id> [--json]"
     );
     const sshKeyIds = requiredArrayOption(options.sshKeyId, "--ssh-key-id");
     const pushed = await pushReservationKeys(reservationId, sshKeyIds, options.requestId, context);
     if (options.json) {
       writeJson(context.stdout, { machines: pushed });
     } else {
-      context.stdout.write(`SSH key update queued for ${pushed.length} machine${pushed.length === 1 ? "" : "s"}.\n`);
+      context.stdout.write(
+        `SSH key update queued for ${pushed.length} machine${pushed.length === 1 ? "" : "s"}.\n`
+      );
     }
     return 0;
   }
@@ -5924,7 +6679,7 @@ async function accessKeys(args, context) {
     const options = parseCommandOptions(
       rest,
       { boolean: ["json"] },
-      "Usage: ornn access keys status <reservation-id> [--json]",
+      "Usage: ornn access keys status <reservation-id> [--json]"
     );
     const status = await buildReservationKeyStatus(reservationId, context);
     if (options.json) {
@@ -5944,7 +6699,7 @@ async function billing(args, context) {
     const options = parseCommandOptions(
       rest,
       { boolean: ["json"] },
-      "Usage: ornn billing summary [--json]",
+      "Usage: ornn billing summary [--json]"
     );
     const invoices = await fetchBillingInvoices(context);
     const summary = billingSummaryFromInvoices(invoices);
@@ -5960,7 +6715,7 @@ async function billing(args, context) {
     const options = parseCommandOptions(
       rest,
       { boolean: ["json"] },
-      "Usage: ornn billing invoices [--json]",
+      "Usage: ornn billing invoices [--json]"
     );
     const invoices = await fetchBillingInvoices(context);
     if (options.json) {
@@ -5975,14 +6730,16 @@ async function billing(args, context) {
     const options = parseCommandOptions(
       rest,
       { boolean: ["json"], value: ["end", "start"] },
-      "Usage: ornn billing showback --start <yyyy-mm-dd> --end <yyyy-mm-dd> [--json]",
+      "Usage: ornn billing showback --start <yyyy-mm-dd> --end <yyyy-mm-dd> [--json]"
     );
     const { endDate, startDate } = dateRangeOptions({
       endDate: options.end,
       startDate: options.start,
     });
     const report = await cliRequest({
-      endpoint: computeEndpoint(`/tenants/me/showback${buildQuery({ end: endDate, start: startDate })}`),
+      endpoint: computeEndpoint(
+        `/tenants/me/showback${buildQuery({ end: endDate, start: startDate })}`
+      ),
       env: context.env,
       fetchImpl: context.fetchImpl,
     });
@@ -5998,7 +6755,7 @@ async function billing(args, context) {
     const options = parseCommandOptions(
       rest,
       { boolean: ["json", "no-open"] },
-      "Usage: ornn billing open [--no-open] [--json]",
+      "Usage: ornn billing open [--no-open] [--json]"
     );
     const opened = await openFabricPage(context, "/account?tab=billing", {
       json: options.json,
@@ -6019,7 +6776,7 @@ async function sshKeys(args, context) {
     const options = parseCommandOptions(
       [id, ...rest].filter(Boolean),
       { boolean: ["json"] },
-      "Usage: ornn ssh-keys list [--json]",
+      "Usage: ornn ssh-keys list [--json]"
     );
     const keys = await cliRequest({
       endpoint: computeEndpoint("/nodes/tenants/me/ssh-keys"),
@@ -6038,7 +6795,7 @@ async function sshKeys(args, context) {
     const options = parseCommandOptions(
       [id, ...rest].filter(Boolean),
       { boolean: ["json"], value: ["label", "public-key", "public-key-file"] },
-      "Usage: ornn ssh-keys add --public-key <key> [--label <label>] [--json]",
+      "Usage: ornn ssh-keys add --public-key <key> [--label <label>] [--json]"
     );
     const publicKey = options.publicKeyFile
       ? (await readFile(options.publicKeyFile, "utf8")).trim()
@@ -6068,7 +6825,7 @@ async function sshKeys(args, context) {
     const options = parseCommandOptions(
       rest,
       { boolean: ["json"] },
-      "Usage: ornn ssh-keys delete <key-id> [--json]",
+      "Usage: ornn ssh-keys delete <key-id> [--json]"
     );
     const response = await cliRequest({
       endpoint: computeEndpoint(`/nodes/tenants/me/ssh-keys/${id}`),
@@ -6205,7 +6962,9 @@ function textMatches(value, filter) {
   if (!filter) {
     return true;
   }
-  return String(value ?? "").toLowerCase().includes(String(filter).toLowerCase());
+  return String(value ?? "")
+    .toLowerCase()
+    .includes(String(filter).toLowerCase());
 }
 async function resolveListing(listingId, context) {
@@ -6220,7 +6979,11 @@ function marketplacePathForListing(listing) {
   return listing.marketplace_url || `/marketplace/${encodeURIComponent(listing.id)}`;
 }
-async function openFabricPage(context, pathOrUrl, { json = false, label = "page", noOpen = false, payload = {} } = {}) {
+async function openFabricPage(
+  context,
+  pathOrUrl,
+  { json = false, label = "page", noOpen = false, payload = {} } = {}
+) {
   const url = await resolveFabricUrl(context, pathOrUrl);
   const opened = noOpen ? false : await context.openBrowserImpl(url);
   const result = { ...payload, label, opened, url };
@@ -6426,21 +7189,26 @@ export async function fetchAllTenantReservations(context) {
         env: context.env,
         fetchImpl: context.fetchImpl,
       }),
-      "reservations",
+      "reservations"
     );
     all.push(...batch);
     if (batch.length < limit) {
       return all;
     }
     const nextCursor = batch.at(-1)?.id;
-    if (typeof nextCursor !== "string" || !nextCursor.trim() || nextCursor === cursor || seenCursors.has(nextCursor)) {
+    if (
+      typeof nextCursor !== "string" ||
+      !nextCursor.trim() ||
+      nextCursor === cursor ||
+      seenCursors.has(nextCursor)
+    ) {
       throw new Error("Reservation cursor pagination did not advance.");
     }
     cursor = nextCursor;
     seenCursors.add(cursor);
   }
   context.stderr?.write(
-    `Warning: reservation scan reached its pagination safety limit; continuing with the first ${all.length} records.\n`,
+    `Warning: reservation scan reached its pagination safety limit; continuing with the first ${all.length} records.\n`
   );
   return all;
 }
@@ -6452,7 +7220,9 @@ function writeReservationList(stdout, reservations) {
   }
   stdout.write("GPU reservations:\n");
   for (const reservation of reservations) {
-    stdout.write(`- ${reservation.id} ${reservation.status || "unknown"} ${reservation.gpu_count ?? "?"} GPUs`);
+    stdout.write(
+      `- ${reservation.id} ${reservation.status || "unknown"} ${reservation.gpu_count ?? "?"} GPUs`
+    );
     stdout.write(` ${reservation.start_date || "TBD"} to ${reservation.end_date || "TBD"}`);
     if (reservation.price_per_gpu_hour !== undefined && reservation.price_per_gpu_hour !== null) {
       stdout.write(` at ${formatUsd(reservation.price_per_gpu_hour)}/GPU-hr`);
@@ -6470,7 +7240,7 @@ function writeDeployableCommerceReservations(stdout, payload) {
   stdout.write("Deployable Commerce reservations:\n");
   for (const reservation of reservations) {
     stdout.write(
-      `- ${reservation.reservation_id}  listing=${reservation.listing_id}  ${reservation.gpu_count} GPUs  ${formatDateRange(reservation.start_at, reservation.end_at)}\n`,
+      `- ${reservation.reservation_id}  listing=${reservation.listing_id}  ${reservation.gpu_count} GPUs  ${formatDateRange(reservation.start_at, reservation.end_at)}\n`
     );
   }
   if (payload?.scan_truncated) {
@@ -6481,7 +7251,7 @@ function writeDeployableCommerceReservations(stdout, payload) {
 function warnIfCommerceDeployStampMissed(payload, context) {
   if (payload?.commerce_first_deployed_recorded === false) {
     context.stderr.write(
-      "Warning: deployment succeeded, but Commerce did not record first_deployed_at. Review and repair the Commerce reservation.\n",
+      "Warning: deployment succeeded, but Commerce did not record first_deployed_at. Review and repair the Commerce reservation.\n"
     );
   }
 }
@@ -6499,7 +7269,7 @@ function writeCreatedCommerceReservation(stdout, payload, tenantLabel) {
   stdout.write(`Window: ${formatDateRange(reservation.startAt, reservation.endAt)}\n`);
   stdout.write(`Price: ${formatUsd(reservation.pricePerGpuHr)}/GPU-hr\n`);
   stdout.write(
-    `Deploy with: ornn fleet deploy ${payload?.fleet_id || "<fleet-id>"} --tenant ${shellQuote(tenantLabel)} --commerce-reservation ${reservation.reservationId}\n`,
+    `Deploy with: ornn fleet deploy ${payload?.fleet_id || "<fleet-id>"} --tenant ${shellQuote(tenantLabel)} --commerce-reservation ${reservation.reservationId}\n`
   );
 }
@@ -6554,7 +7324,9 @@ async function verifyStorageBucketSource(driveId, context) {
 async function findStorageDrive(driveId, context) {
   const payload = await fetchStorageDrives(context);
-  const drive = storageDrivesFromPayload(payload).find((item) => String(item.id) === String(driveId));
+  const drive = storageDrivesFromPayload(payload).find(
+    (item) => String(item.id) === String(driveId)
+  );
   if (!drive) {
     throw new Error(`Storage volume not found: ${driveId}`);
   }
@@ -6563,7 +7335,9 @@ async function findStorageDrive(driveId, context) {
 async function findStorageBucket(driveId, context) {
   const payload = await fetchStorageDrives(context);
-  const bucket = storageBucketsFromPayload(payload).find((item) => String(item.id) === String(driveId));
+  const bucket = storageBucketsFromPayload(payload).find(
+    (item) => String(item.id) === String(driveId)
+  );
   if (!bucket) {
     throw new Error(`Storage bucket not found: ${driveId}`);
   }
@@ -6582,7 +7356,12 @@ async function fetchReservationSshKeys(reservationId, context) {
   });
 }
-async function launchReservationAccess(reservationId, options, context, { openDefault = false } = {}) {
+async function launchReservationAccess(
+  reservationId,
+  options,
+  context,
+  { openDefault = false } = {}
+) {
   const mode = normalizeAccessMode(options.mode || "bare-metal");
   const networkOption = optionProvided(options.networkMode) ? options.networkMode : options.network;
   const sshKeyIds = await resolveAccountSshKeyIds(options, context);
@@ -6604,10 +7383,16 @@ async function launchReservationAccess(reservationId, options, context, { openDe
     launchPayload.network_mode = normalizeNodeNetwork(networkOption);
   }
   if (optionProvided(options.storageLoadDriveId)) {
-    launchPayload.storage_load_drive_id = requiredOption(options.storageLoadDriveId, "--storage-load-drive-id");
+    launchPayload.storage_load_drive_id = requiredOption(
+      options.storageLoadDriveId,
+      "--storage-load-drive-id"
+    );
   }
   if (optionProvided(options.storageSaveDriveId)) {
-    launchPayload.storage_save_drive_id = requiredOption(options.storageSaveDriveId, "--storage-save-drive-id");
+    launchPayload.storage_save_drive_id = requiredOption(
+      options.storageSaveDriveId,
+      "--storage-save-drive-id"
+    );
   }
   const access = await cliRequest({
     body: { access_mode: mode, image_id: null },
@@ -6623,13 +7408,16 @@ async function launchReservationAccess(reservationId, options, context, { openDe
     fetchImpl: context.fetchImpl,
     method: "POST",
   });
-  const opened = openDefault || options.open
-    ? await openFabricPage(context, `/portfolio/${encodeURIComponent(reservationId)}`, {
-        label: "reservation",
-        noOpen: Boolean(options.noOpen),
-      })
+  const opened =
+    openDefault || options.open
+      ? await openFabricPage(context, `/portfolio/${encodeURIComponent(reservationId)}`, {
+          label: "reservation",
+          noOpen: Boolean(options.noOpen),
+        })
+      : null;
+  const wait = options.wait
+    ? await waitForSshReady(reservationId, waitOptions(options), context)
     : null;
-  const wait = options.wait ? await waitForSshReady(reservationId, waitOptions(options), context) : null;
   return {
     access,
     launch,
@@ -6667,7 +7455,9 @@ async function switchReservationAccess(reservationId, options, context) {
     method: "POST",
   });
   const machines = Array.isArray(switched?.machines) ? switched.machines : [];
-  const wait = options.wait ? await waitForSshReady(reservationId, waitOptions(options), context) : null;
+  const wait = options.wait
+    ? await waitForSshReady(reservationId, waitOptions(options), context)
+    : null;
   return {
     machines,
     mode,
@@ -6700,7 +7490,7 @@ async function fetchTenantClusters(context) {
 async function fetchEligibleClusterNodes(reservationId, type, networkMode, context) {
   return await cliRequest({
     endpoint: computeEndpoint(
-      `/clusters/reservations/${encodeURIComponent(reservationId)}/eligible-nodes?access_mode=${encodeURIComponent(type)}&network_mode=${encodeURIComponent(networkMode)}`,
+      `/clusters/reservations/${encodeURIComponent(reservationId)}/eligible-nodes?access_mode=${encodeURIComponent(type)}&network_mode=${encodeURIComponent(networkMode)}`
     ),
     env: context.env,
     fetchImpl: context.fetchImpl,
@@ -6745,7 +7535,9 @@ async function teardownCluster(reservationId, type, context) {
 async function addClusterNode(reservationId, nodeId, context) {
   return await cliRequest({
     body: { node_id: nodeId },
-    endpoint: computeEndpoint(`/clusters/reservations/${encodeURIComponent(reservationId)}/cluster/nodes`),
+    endpoint: computeEndpoint(
+      `/clusters/reservations/${encodeURIComponent(reservationId)}/cluster/nodes`
+    ),
     env: context.env,
     fetchImpl: context.fetchImpl,
     method: "POST",
@@ -6755,7 +7547,7 @@ async function addClusterNode(reservationId, nodeId, context) {
 async function removeClusterNode(reservationId, nodeId, context) {
   return await cliRequest({
     endpoint: computeEndpoint(
-      `/clusters/reservations/${encodeURIComponent(reservationId)}/cluster/nodes/${encodeURIComponent(nodeId)}`,
+      `/clusters/reservations/${encodeURIComponent(reservationId)}/cluster/nodes/${encodeURIComponent(nodeId)}`
     ),
     env: context.env,
     fetchImpl: context.fetchImpl,
@@ -6768,7 +7560,9 @@ async function resolveClusterTypeForReservation(reservationId, options, context)
     return normalizeClusterType(options.type || options.mode);
   }
   const clusters = requireArrayPayload(await fetchTenantClusters(context), "clusters");
-  const cluster = clusters.find((candidate) => String(candidate.reservation_id || "") === String(reservationId));
+  const cluster = clusters.find(
+    (candidate) => String(candidate.reservation_id || "") === String(reservationId)
+  );
   if (cluster?.access_mode) {
     return normalizeClusterType(cluster.access_mode);
   }
@@ -6807,7 +7601,9 @@ async function waitForClusterActive(reservationId, type, options, context) {
     if (Date.now() >= deadline) {
       const detail = lastError instanceof Error ? ` Last error: ${lastError.message}` : "";
       const state = lastCluster?.state ? ` Last state: ${lastCluster.state}.` : "";
-      throw new Error(`Timed out waiting for ${displayClusterType(type)} cluster ${reservationId}.${state}${detail}`);
+      throw new Error(
+        `Timed out waiting for ${displayClusterType(type)} cluster ${reservationId}.${state}${detail}`
+      );
     }
     await sleep(options.intervalSeconds * 1000);
   }
@@ -6831,7 +7627,7 @@ function clusterLaunchPayload(options) {
   if (optionProvided(options.storageLoadSizeBytes)) {
     payload.storage_load_size_bytes = nonNegativeIntegerOption(
       options.storageLoadSizeBytes,
-      "--storage-load-size-bytes",
+      "--storage-load-size-bytes"
     );
   }
   return payload;
@@ -6862,7 +7658,7 @@ async function fetchTenantMachines(context) {
         reservation_id: machine.reservation_id || reservation.id,
         reservation_status: reservation.status || null,
       }));
-    }),
+    })
   );
   return settled.flatMap((result) => (result.status === "fulfilled" ? result.value : []));
 }
@@ -6878,7 +7674,7 @@ async function fetchMachine(nodeId, context) {
 async function fetchTenantMetricSnapshots(context) {
   const machines = await fetchTenantMachines(context);
   const settled = await Promise.allSettled(
-    machines.map((machine) => fetchMetricSnapshotForMachine(machine, context)),
+    machines.map((machine) => fetchMetricSnapshotForMachine(machine, context))
   );
   return settled.map((result, index) => {
     if (result.status === "fulfilled") {
@@ -6910,7 +7706,8 @@ async function resolveMetricMachine(nodeId, context) {
   if (!machine?.reservation_id) {
     const machines = await fetchTenantMachines(context);
-    machine = machines.find((candidate) => String(machineId(candidate)) === String(nodeId)) ?? machine;
+    machine =
+      machines.find((candidate) => String(machineId(candidate)) === String(nodeId)) ?? machine;
   }
   if (!machine) {
@@ -6935,7 +7732,7 @@ async function fetchMetricHistoryForNode(nodeId, options, context) {
   });
   const series = await cliRequest({
     endpoint: computeEndpoint(
-      `/nodes/reservations/${encodeURIComponent(machine.reservation_id)}/telemetry-history${query}`,
+      `/nodes/reservations/${encodeURIComponent(machine.reservation_id)}/telemetry-history${query}`
     ),
     env: context.env,
     fetchImpl: context.fetchImpl,
@@ -6954,7 +7751,7 @@ async function fetchMetricSnapshotForMachine(machine, context) {
   }
   const payload = await cliRequest({
     endpoint: computeEndpoint(
-      `/nodes/reservations/${encodeURIComponent(reservationId)}/live-metrics?machine_id=${encodeURIComponent(machineId(machine))}`,
+      `/nodes/reservations/${encodeURIComponent(reservationId)}/live-metrics?machine_id=${encodeURIComponent(machineId(machine))}`
     ),
     env: context.env,
     fetchImpl: context.fetchImpl,
@@ -7015,11 +7812,13 @@ async function resolveSshTarget(identifier, context) {
   }
   if (ready.length > 1) {
     throw new Error(
-      `Reservation ${identifier} has ${ready.length} SSH-ready nodes. Use \`ornn nodes list\` and pass a node id.`,
+      `Reservation ${identifier} has ${ready.length} SSH-ready nodes. Use \`ornn nodes list\` and pass a node id.`
     );
   }
   if (machines.length) {
-    throw new Error(`No SSH-ready nodes found for reservation ${identifier}. Run \`ornn nodes wait ${identifier}\`.`);
+    throw new Error(
+      `No SSH-ready nodes found for reservation ${identifier}. Run \`ornn nodes wait ${identifier}\`.`
+    );
   }
   throw new Error(`Node or reservation not found: ${identifier}`);
 }
@@ -7085,13 +7884,18 @@ function waitOptions(options) {
       ? parsePositiveNumber(options.waitInterval, "--wait-interval")
       : 5,
     timeoutSeconds: optionProvided(timeoutValue)
-      ? parsePositiveNumber(timeoutValue, optionProvided(options.waitTimeout) ? "--wait-timeout" : "--timeout")
+      ? parsePositiveNumber(
+          timeoutValue,
+          optionProvided(options.waitTimeout) ? "--wait-timeout" : "--timeout"
+        )
       : 600,
   };
 }
 async function resolveAccountSshKeyIds(options, context) {
-  const rawSshKeyIds = arrayOptionPreserveEmpty(options.sshKeyId).map((value) => String(value).trim());
+  const rawSshKeyIds = arrayOptionPreserveEmpty(options.sshKeyId).map((value) =>
+    String(value).trim()
+  );
   const rawKeyIds = arrayOptionPreserveEmpty(options.keyId).map((value) => String(value).trim());
   if (rawSshKeyIds.some((value) => !value)) {
     throw new Error("--ssh-key-id is required.");
@@ -7104,7 +7908,9 @@ async function resolveAccountSshKeyIds(options, context) {
     ...arrayOption(options.key),
     ...arrayOption(options.publicKeyFile),
     ...arrayOption(options.publicKey),
-  ].map((value) => String(value).trim()).filter(Boolean);
+  ]
+    .map((value) => String(value).trim())
+    .filter(Boolean);
   const resolved = [...directIds];
   for (const ref of refs) {
@@ -7195,7 +8001,7 @@ async function publicKeyFromRef(ref) {
   }
   if (/PRIVATE KEY/.test(contents)) {
     throw new Error(
-      `Refusing to upload a private SSH key. Pass the matching public key file (${ref}.pub) or use a saved key id/label.`,
+      `Refusing to upload a private SSH key. Pass the matching public key file (${ref}.pub) or use a saved key id/label.`
     );
   }
   throw new Error("File does not contain a supported SSH public key.");
@@ -7260,7 +8066,8 @@ function reservationKeyMachineStatus(key, machine) {
     machine_id: machineId(machine),
     machine_state: machineState(machine),
     status: metadata?.status || (fallbackInstalled ? "installed" : "associated"),
-    linux_username: metadata?.linux_username || key.linux_username || machine.linux_username || null,
+    linux_username:
+      metadata?.linux_username || key.linux_username || machine.linux_username || null,
     queued_at: metadata?.queued_at || null,
     pushed_at: metadata?.pushed_at || (fallbackInstalled ? machine.keys_pushed_at : null),
     failed_at: metadata?.failed_at || null,
@@ -7275,9 +8082,12 @@ function reservationKeyMetadataForMachine(key, machine) {
   }
   return (
     machine.authorized_key_metadata.find((item) => {
-      const itemKeyId = item.ssh_key_id === undefined || item.ssh_key_id === null ? "" : String(item.ssh_key_id);
+      const itemKeyId =
+        item.ssh_key_id === undefined || item.ssh_key_id === null ? "" : String(item.ssh_key_id);
       const keyId = key.id === undefined || key.id === null ? "" : String(key.id);
-      return (keyId && itemKeyId === keyId) || (key.fingerprint && item.fingerprint === key.fingerprint);
+      return (
+        (keyId && itemKeyId === keyId) || (key.fingerprint && item.fingerprint === key.fingerprint)
+      );
     }) || null
   );
 }
@@ -7403,7 +8213,11 @@ function writeMetricSnapshotDetail(stdout, snapshot) {
 function writeMetricHistory(stdout, result) {
   const points = Array.isArray(result.series?.points) ? result.series.points : [];
   stdout.write(`Telemetry history for ${result.node_id}\n`);
-  writeOptionalStatusLine(stdout, "Reservation", result.series?.reservation_id || result.machine?.reservation_id);
+  writeOptionalStatusLine(
+    stdout,
+    "Reservation",
+    result.series?.reservation_id || result.machine?.reservation_id
+  );
   stdout.write(`Points: ${points.length}\n`);
   if (!points.length) {
     return;
@@ -7417,7 +8231,9 @@ function writeMetricHistory(stdout, result) {
     stdout.write(`- ${point.observed_at || "unknown"}`);
     stdout.write(` samples=${point.samples ?? 1}`);
     stdout.write(` gpu=${formatMetricValue(metricValue(metrics, "gpu_utilization"), "%")}`);
-    stdout.write(` gpu_mem=${formatMetricValue(metricValue(metrics, "gpu_memory_utilization"), "%")}`);
+    stdout.write(
+      ` gpu_mem=${formatMetricValue(metricValue(metrics, "gpu_memory_utilization"), "%")}`
+    );
     stdout.write(` power=${formatMetricValue(metricValue(metrics, "gpu_power_w"), "W")}`);
     stdout.write(` tflops=${formatMetricValue(metricValue(metrics, "gpu_tflops"), "TFLOP/s")}`);
     stdout.write("\n");
@@ -7506,14 +8322,14 @@ function writeReservationStorageAttachment(stdout, attachment = {}) {
         ? [attachment.drive.active_mount]
         : [];
     const mountedCount = mounts.filter(
-      (mount) => textValue(mount.state).toLowerCase() === "mounted",
+      (mount) => textValue(mount.state).toLowerCase() === "mounted"
     ).length;
     const expectedCount = Math.max(Number(attachment.scope?.node_count) || 0, mounts.length);
     if (expectedCount > 0) {
       writeOptionalStatusLine(
         stdout,
         "Mounted",
-        `${mountedCount} of ${expectedCount} ${expectedCount === 1 ? "node" : "nodes"}`,
+        `${mountedCount} of ${expectedCount} ${expectedCount === 1 ? "node" : "nodes"}`
       );
     }
   }
@@ -7522,7 +8338,11 @@ function writeReservationStorageAttachment(stdout, attachment = {}) {
     stdout.write("Placement:\n");
     writeOptionalStatusLine(stdout, "State", placement.state);
     writeOptionalStatusLine(stdout, "Transfer", placement.transfer_status);
-    writeOptionalStatusLine(stdout, "Progress", formatStorageTransferProgress(placement.transfer_progress));
+    writeOptionalStatusLine(
+      stdout,
+      "Progress",
+      formatStorageTransferProgress(placement.transfer_progress)
+    );
     if (
       typeof placement.transfer_object_count === "number" ||
       typeof placement.transfer_bytes === "number"
@@ -7537,7 +8357,7 @@ function writeReservationStorageAttachment(stdout, attachment = {}) {
       writeOptionalStatusLine(
         stdout,
         "Copied",
-        [objectLabel, bytesLabel].filter(Boolean).join(", "),
+        [objectLabel, bytesLabel].filter(Boolean).join(", ")
       );
     }
   }
@@ -7547,7 +8367,11 @@ function writeReservationStorageAttachment(stdout, attachment = {}) {
     writeOptionalStatusLine(stdout, "State", nfsBackend.state);
     writeOptionalStatusLine(stdout, "Region", nfsBackend.region);
     writeOptionalStatusLine(stdout, "Tier", nfsBackend.performance_tier);
-    writeOptionalStatusLine(stdout, "Capacity", nfsBackend.capacity_gib ? `${nfsBackend.capacity_gib} GiB` : null);
+    writeOptionalStatusLine(
+      stdout,
+      "Capacity",
+      nfsBackend.capacity_gib ? `${nfsBackend.capacity_gib} GiB` : null
+    );
     writeOptionalStatusLine(stdout, "Mount ready", nfsBackend.mount_ready ? "yes" : "no");
   }
 }
@@ -7555,8 +8379,12 @@ function writeReservationStorageAttachment(stdout, attachment = {}) {
 function formatStorageTransferProgress(progress) {
   if (!progress) return null;
   const parts = [];
-  if (typeof progress.completed_objects === "number" || typeof progress.total_objects === "number") {
-    const completed = typeof progress.completed_objects === "number" ? progress.completed_objects : 0;
+  if (
+    typeof progress.completed_objects === "number" ||
+    typeof progress.total_objects === "number"
+  ) {
+    const completed =
+      typeof progress.completed_objects === "number" ? progress.completed_objects : 0;
     const total = typeof progress.total_objects === "number" ? progress.total_objects : null;
     parts.push(total ? `${completed}/${total} objects` : `${completed} objects`);
   }
@@ -7653,7 +8481,7 @@ function writeStorageDriveDetail(stdout, drive = {}) {
     writeOptionalStatusLine(stdout, "Endpoint", drive.source.endpoint_url);
     if (drive.source.credentials_configured) {
       stdout.write(
-        `Credentials: configured${drive.source.access_key_id_hint ? ` (${drive.source.access_key_id_hint})` : ""}\n`,
+        `Credentials: configured${drive.source.access_key_id_hint ? ` (${drive.source.access_key_id_hint})` : ""}\n`
       );
     }
     writeOptionalStatusLine(stdout, "Connection", drive.source.connection_status);
@@ -7683,7 +8511,7 @@ function writeStorageDriveDetail(stdout, drive = {}) {
     stdout.write(`Active mounts (${activeMounts.length} nodes):\n`);
     for (const mount of activeMounts) {
       stdout.write(
-        `- ${storageMountNodeLabel(mount)} ${storageMountStateLabel(mount.state)} ${mount.access || "unknown"} ${mount.mount_path || ""}\n`,
+        `- ${storageMountNodeLabel(mount)} ${storageMountStateLabel(mount.state)} ${mount.access || "unknown"} ${mount.mount_path || ""}\n`
       );
       const issue = storageMountIssue(mount);
       if (issue) {
@@ -7741,8 +8569,12 @@ function writeBillingSummary(stdout, summary = {}) {
   stdout.write("Billing summary:\n");
   stdout.write(`Open balance: ${formatCents(summary.open_balance_cents)}\n`);
   stdout.write(`Earliest due date: ${summary.earliest_due_date || "none"}\n`);
-  stdout.write(`This month: ${formatCents(summary.this_month_total_cents)} (${summary.this_month_count || 0} invoices)\n`);
-  stdout.write(`Last month: ${formatCents(summary.last_month_total_cents)} (${summary.last_month_count || 0} invoices)\n`);
+  stdout.write(
+    `This month: ${formatCents(summary.this_month_total_cents)} (${summary.this_month_count || 0} invoices)\n`
+  );
+  stdout.write(
+    `Last month: ${formatCents(summary.last_month_total_cents)} (${summary.last_month_count || 0} invoices)\n`
+  );
 }
 function writeInvoiceList(stdout, invoices) {
@@ -7752,7 +8584,9 @@ function writeInvoiceList(stdout, invoices) {
   }
   stdout.write("Invoices:\n");
   for (const invoice of invoices) {
-    stdout.write(`- ${invoice.id} ${invoice.status || "unknown"} ${invoice.type || "invoice"} ${formatCents(invoice.amount_cents, invoice.currency)}`);
+    stdout.write(
+      `- ${invoice.id} ${invoice.status || "unknown"} ${invoice.type || "invoice"} ${formatCents(invoice.amount_cents, invoice.currency)}`
+    );
     if (invoice.due_date) {
       stdout.write(` due=${invoice.due_date}`);
     }
@@ -7767,7 +8601,9 @@ function writeInvoiceList(stdout, invoices) {
 function writeShowbackReport(stdout, report = {}) {
   const rows = Array.isArray(report.rows) ? report.rows : [];
-  stdout.write(`Showback ${report.window_start || "unknown"} to ${report.window_end || "unknown"}\n`);
+  stdout.write(
+    `Showback ${report.window_start || "unknown"} to ${report.window_end || "unknown"}\n`
+  );
   stdout.write(`Total GPU hours: ${report.total_gpu_hours ?? 0}\n`);
   stdout.write(`Total cost: ${formatCents(report.total_cost_cents)}\n`);
   if (!rows.length) {
@@ -7799,7 +8635,10 @@ function billingSummaryFromInvoices(invoices) {
     const amount = Number(invoice.amount_cents || 0);
     if (invoice.status === "open") {
       summary.open_balance_cents += amount;
-      if (invoice.due_date && (!summary.earliest_due_date || invoice.due_date < summary.earliest_due_date)) {
+      if (
+        invoice.due_date &&
+        (!summary.earliest_due_date || invoice.due_date < summary.earliest_due_date)
+      ) {
         summary.earliest_due_date = invoice.due_date;
       }
     }
@@ -7819,7 +8658,11 @@ function billingSummaryFromInvoices(invoices) {
 }
 function networksFromPayload(payload) {
-  return Array.isArray(payload) ? payload : Array.isArray(payload?.networks) ? payload.networks : [];
+  return Array.isArray(payload)
+    ? payload
+    : Array.isArray(payload?.networks)
+      ? payload.networks
+      : [];
 }
 function networkFromMutationPayload(payload) {
@@ -7888,12 +8731,15 @@ function storageBucketSourceFromConsoleUrl(provider, rawUrl) {
   const hostname = url.hostname.toLowerCase();
   const pathParts = url.pathname.split("/").filter(Boolean).map(decodeURIComponent);
   if (provider === "s3") {
-    const bucketIndex = pathParts.findIndex((part, index) => part === "buckets" && pathParts[index - 1] === "s3");
+    const bucketIndex = pathParts.findIndex(
+      (part, index) => part === "buckets" && pathParts[index - 1] === "s3"
+    );
     const bucket = bucketIndex >= 0 ? storageConsolePathValue(pathParts[bucketIndex + 1]) : null;
     const rawRegionFromHost = hostname.endsWith(".console.aws.amazon.com")
       ? hostname.slice(0, -".console.aws.amazon.com".length)
       : null;
-    const regionFromHost = rawRegionFromHost && rawRegionFromHost !== "s3" ? rawRegionFromHost : null;
+    const regionFromHost =
+      rawRegionFromHost && rawRegionFromHost !== "s3" ? rawRegionFromHost : null;
     const region = url.searchParams.get("region") || regionFromHost;
     const prefix = url.searchParams.get("prefix");
     if (!bucket) {
@@ -7906,7 +8752,9 @@ function storageBucketSourceFromConsoleUrl(provider, rawUrl) {
     const bucketIndex = pathParts.findIndex((part) => part === "buckets");
     const bucket = bucketIndex >= 0 ? storageConsolePathValue(pathParts[bucketIndex + 1]) : null;
     if (!accountId || !bucket) {
-      throw new Error("Cloudflare R2 console URL must include /<account-id>/r2/.../buckets/<bucket>.");
+      throw new Error(
+        "Cloudflare R2 console URL must include /<account-id>/r2/.../buckets/<bucket>."
+      );
     }
     return { accountId, bucket, prefix: null, region: "auto" };
   }
@@ -7927,7 +8775,9 @@ function storageConsolePathValue(value) {
 }
 function normalizeStoragePrefix(value) {
-  const normalized = String(value || "").trim().replace(/^\/+|\/+$/g, "");
+  const normalized = String(value || "")
+    .trim()
+    .replace(/^\/+|\/+$/g, "");
   return normalized || null;
 }
@@ -7953,7 +8803,9 @@ function storageBucketEndpointUrl(provider, options = {}) {
 }
 function storageObjectUri(scheme, bucket, prefix) {
-  const normalizedPrefix = String(prefix || "").trim().replace(/^\/+|\/+$/g, "");
+  const normalizedPrefix = String(prefix || "")
+    .trim()
+    .replace(/^\/+|\/+$/g, "");
   return normalizedPrefix ? `${scheme}://${bucket}/${normalizedPrefix}` : `${scheme}://${bucket}`;
 }
@@ -8028,19 +8880,28 @@ function metricSnapshotFromMachine(machine, extras = {}) {
     machine.lastHeartbeatAt ||
     null;
   return {
-    connection_status: resourceMetrics.connection_status || resourceMetrics.connectionStatus || "pending",
+    connection_status:
+      resourceMetrics.connection_status || resourceMetrics.connectionStatus || "pending",
     error: extras.error || null,
     last_heartbeat_at: lastHeartbeatAt,
     metrics: {
-      cpu_utilization: numericMetric(resourceMetrics.cpu_utilization ?? resourceMetrics.cpuUtilization),
+      cpu_utilization: numericMetric(
+        resourceMetrics.cpu_utilization ?? resourceMetrics.cpuUtilization
+      ),
       gpu_memory_utilization: numericMetric(
-        resourceMetrics.gpu_memory_utilization ?? resourceMetrics.gpuMemoryUtilization,
+        resourceMetrics.gpu_memory_utilization ?? resourceMetrics.gpuMemoryUtilization
       ),
       gpu_power_w: numericMetric(resourceMetrics.gpu_power_w ?? resourceMetrics.gpuPowerW),
       gpu_tflops: numericMetric(resourceMetrics.gpu_tflops ?? resourceMetrics.gpuTflops),
-      gpu_utilization: numericMetric(resourceMetrics.gpu_utilization ?? resourceMetrics.gpuUtilization),
-      memory_utilization: numericMetric(resourceMetrics.memory_utilization ?? resourceMetrics.memoryUtilization),
-      storage_utilization: numericMetric(resourceMetrics.storage_utilization ?? resourceMetrics.storageUtilization),
+      gpu_utilization: numericMetric(
+        resourceMetrics.gpu_utilization ?? resourceMetrics.gpuUtilization
+      ),
+      memory_utilization: numericMetric(
+        resourceMetrics.memory_utilization ?? resourceMetrics.memoryUtilization
+      ),
+      storage_utilization: numericMetric(
+        resourceMetrics.storage_utilization ?? resourceMetrics.storageUtilization
+      ),
     },
     node_id: machineId(machine),
     reported_at: resourceMetrics.reported_at || resourceMetrics.reportedAt || null,
@@ -8103,7 +8964,9 @@ function writeClusterList(stdout, clusters) {
   }
   stdout.write("Clusters:\n");
   for (const cluster of clusters) {
-    stdout.write(`- ${cluster.reservation_id || cluster.id || "cluster"} ${displayClusterType(cluster.access_mode)} ${cluster.state || "unknown"}`);
+    stdout.write(
+      `- ${cluster.reservation_id || cluster.id || "cluster"} ${displayClusterType(cluster.access_mode)} ${cluster.state || "unknown"}`
+    );
     stdout.write(` ${cluster.node_count ?? "?"} nodes/${cluster.gpu_count ?? "?"} GPUs`);
     stdout.write(` network=${cluster.network_mode || "public"}`);
     stdout.write(` credentials=${cluster.credential_state || "unknown"}`);
@@ -8139,11 +9002,15 @@ function writeEligibleClusterNodes(stdout, payload) {
     stdout.write("No eligible cluster nodes found.\n");
     return;
   }
-  stdout.write(`Eligible nodes for ${payload.reservation_id || "reservation"} (${displayClusterType(payload.access_mode)} / ${payload.network_mode || "public"}):\n`);
+  stdout.write(
+    `Eligible nodes for ${payload.reservation_id || "reservation"} (${displayClusterType(payload.access_mode)} / ${payload.network_mode || "public"}):\n`
+  );
   for (const node of nodes) {
     const status = node.eligible ? "eligible" : "blocked";
     stdout.write(`- ${node.node_id} ${status}`);
-    stdout.write(` ${node.gpu_count ?? "?"}x ${node.gpu_type || payload.reservation_gpu_type || "GPU"}`);
+    stdout.write(
+      ` ${node.gpu_count ?? "?"}x ${node.gpu_type || payload.reservation_gpu_type || "GPU"}`
+    );
     if (node.site_label) {
       stdout.write(` site=${node.site_label}`);
     }
@@ -8176,7 +9043,8 @@ function writeClusterDetail(stdout, cluster = {}) {
   writeOptionalStatusLine(stdout, "Endpoint", cluster.endpoint);
   writeOptionalStatusLine(stdout, "Namespace", cluster.namespace);
   writeOptionalStatusLine(stdout, "Credentials", cluster.credential_state);
-  const progress = cluster.progress && typeof cluster.progress === "object" ? cluster.progress : null;
+  const progress =
+    cluster.progress && typeof cluster.progress === "object" ? cluster.progress : null;
   if (progress) {
     stdout.write("Progress:\n");
     for (const [key, value] of Object.entries(progress)) {
@@ -8209,7 +9077,9 @@ function writeClusterCredentials(stdout, credentials = {}, type, reservationId)
     writeOptionalStatusLine(stdout, "Expires", credentials.expires_at);
     stdout.write(`Kubeconfig: ${credentials.kubeconfig ? "available" : "not returned"}\n`);
     if (credentials.kubeconfig) {
-      stdout.write(`Export it with: ornn clusters kubeconfig ${reservationId} --output kubeconfig.yaml\n`);
+      stdout.write(
+        `Export it with: ornn clusters kubeconfig ${reservationId} --output kubeconfig.yaml\n`
+      );
     }
     return;
   }
@@ -8236,7 +9106,9 @@ function writeClusterCredentials(stdout, credentials = {}, type, reservationId)
 }
 function nodeKeyStatus(machine) {
-  const metadata = Array.isArray(machine.authorized_key_metadata) ? machine.authorized_key_metadata : [];
+  const metadata = Array.isArray(machine.authorized_key_metadata)
+    ? machine.authorized_key_metadata
+    : [];
   return {
     machine_id: machineId(machine),
     machine_state: machineState(machine),
@@ -8355,7 +9227,7 @@ function commandText(invocation) {
 async function spawnCommand(invocation, context) {
   if (invocation.raw) {
     throw new Error(
-      "This node exposes a non-standard SSH command. Run `ornn ssh <node-id> --print` and execute the printed command.",
+      "This node exposes a non-standard SSH command. Run `ornn ssh <node-id> --print` and execute the printed command."
     );
   }
   return await new Promise((resolve, reject) => {
@@ -8380,11 +9252,15 @@ function shellQuote(value) {
 }
 function machineId(machine) {
-  return machine.id || machine.machine_id || machine.instance_id || machine.instance_name || "machine";
+  return (
+    machine.id || machine.machine_id || machine.instance_id || machine.instance_name || "machine"
+  );
 }
 function machineState(machine, fallback = "unknown") {
-  return machine.status || machine.state || machine.actual_state || machine.desired_state || fallback;
+  return (
+    machine.status || machine.state || machine.actual_state || machine.desired_state || fallback
+  );
 }
 function machineUsername(machine) {
@@ -8483,7 +9359,7 @@ function writeReservationKeyStatus(stdout, status) {
   if (!keys.length) {
     stdout.write("No reservation SSH keys found.\n");
     stdout.write(
-      `Add one with: ornn access keys add ${status.reservation_id} --public-key-file ~/.ssh/id_ed25519.pub\n`,
+      `Add one with: ornn access keys add ${status.reservation_id} --public-key-file ~/.ssh/id_ed25519.pub\n`
     );
     return;
   }
@@ -8520,11 +9396,15 @@ function writeOptionalStatusLine(stdout, label, value) {
 }
 function activeSshKeys(keys) {
-  return keys.filter((key) => String(key.status || "active").toLowerCase() === "active" && !key.revoked_at);
+  return keys.filter(
+    (key) => String(key.status || "active").toLowerCase() === "active" && !key.revoked_at
+  );
 }
 function normalizeAccessMode(value) {
-  const normalized = String(value || "").trim().toLowerCase();
+  const normalized = String(value || "")
+    .trim()
+    .toLowerCase();
   if (normalized === "bare-metal" || normalized === "baremetal" || normalized === "bare_metal") {
     return "bare-metal";
   }
@@ -8539,7 +9419,9 @@ function displayAccessMode(value) {
 }
 function normalizeClusterType(value) {
-  const normalized = String(value || "").trim().toLowerCase();
+  const normalized = String(value || "")
+    .trim()
+    .toLowerCase();
   if (["k8s", "kube", "kubernetes"].includes(normalized)) {
     return "kubernetes";
   }
@@ -8550,7 +9432,9 @@ function normalizeClusterType(value) {
 }
 function displayClusterType(value) {
-  const normalized = String(value || "").trim().toLowerCase();
+  const normalized = String(value || "")
+    .trim()
+    .toLowerCase();
   if (normalized === "slurm") {
     return "Slurm";
   }
@@ -8561,7 +9445,9 @@ function displayClusterType(value) {
 }
 function normalizeClusterNetwork(value) {
-  const normalized = String(value || "").trim().toLowerCase();
+  const normalized = String(value || "")
+    .trim()
+    .toLowerCase();
   if (normalized === "public") {
     return "public";
   }
@@ -8576,12 +9462,16 @@ function normalizeNodeNetwork(value) {
 }
 function looksLikePublicKey(value) {
-  return /^(ssh-ed25519|ssh-rsa|ecdsa-sha2-|sk-ssh-|sk-ecdsa-)\S*\s+\S+/.test(String(value || "").trim());
+  return /^(ssh-ed25519|ssh-rsa|ecdsa-sha2-|sk-ssh-|sk-ecdsa-)\S*\s+\S+/.test(
+    String(value || "").trim()
+  );
 }
 function looksLikePath(value) {
   const text = String(value || "").trim();
-  return text.startsWith("~") || text.startsWith(".") || text.includes("/") || text.endsWith(".pub");
+  return (
+    text.startsWith("~") || text.startsWith(".") || text.includes("/") || text.endsWith(".pub")
+  );
 }
 function expandUserPath(value) {
@@ -8766,7 +9656,10 @@ function optionProvided(value) {
 }
 function bidPriceOption(options) {
-  return positiveNumberOption(optionProvided(options.price) ? options.price : options.bidPricePerGpuHour, "--price");
+  return positiveNumberOption(
+    optionProvided(options.price) ? options.price : options.bidPricePerGpuHour,
+    "--price"
+  );
 }
 function positiveNumberOption(value, name) {
@@ -8794,8 +9687,12 @@ function nonNegativeIntegerOption(value, name) {
 }
 function listPaginationOptions(options) {
-  const limit = optionProvided(options.limit) ? positiveIntegerOption(options.limit, "--limit") : 500;
-  const cursor = optionProvided(options.cursor) ? requiredOption(options.cursor, "--cursor") : undefined;
+  const limit = optionProvided(options.limit)
+    ? positiveIntegerOption(options.limit, "--limit")
+    : 500;
+  const cursor = optionProvided(options.cursor)
+    ? requiredOption(options.cursor, "--cursor")
+    : undefined;
   if (limit > 500) {
     throw new Error("--limit must be at most 500.");
   }
@@ -9001,7 +9898,9 @@ function formatStructuredProvisioningError(detail) {
     const label = nextSteps.length === 1 ? "Next step" : "Next steps";
     lines.push(`${label}: ${nextSteps.join(" ")}`);
   } else if (detail.retryable === true) {
-    lines.push("Next step: Retry this command. If the problem continues, contact Ornn support with this error code.");
+    lines.push(
+      "Next step: Retry this command. If the problem continues, contact Ornn support with this error code."
+    );
   } else {
     lines.push(`Next step: ${defaultNextStepForErrorCode(code)}`);
   }
@@ -9089,9 +9988,7 @@ function listValues(value) {
   if (!Array.isArray(value)) {
     return [];
   }
-  return value
-    .filter((item) => typeof item === "string" && item.trim())
-    .map((item) => item.trim());
+  return value.filter((item) => typeof item === "string" && item.trim()).map((item) => item.trim());
 }
 function humanizeErrorToken(value) {