From fed4ba05cdc3558b162f852d8604fd278f28ed55 Mon Sep 17 00:00:00 2001
From: Marta <martakaras1@gmail.com>
Date: Fri, 10 Jul 2026 16:01:21 +0200
Subject: [PATCH 1/2] feat: add template sub-resources, hosted resources, and
 project/server actions

Extend CLI coverage of the DeployHQ API (DHQ-639, phases 4-7):

- project/server actions: regenerate-key, undeployed-changes, ai-overview,
  servers from-global, servers metrics, config-files/ssh-commands link-global
- hosted resources & managed hosting: dhq hosted-resources, dhq managed-hosting
- template sub-resources: dhq templates {config-files,servers,build-*,...}
- long-tail: dhq ip-ranges, dhq plans, dhq invoices, dhq detect, dhq beta enroll

Adds an unauthenticated SDK client path (NewPublic) so the public ip-ranges and
plans endpoints work without credentials. Each resource ships an SDK client,
cobra command, agent metadata, assist allowlist entry, and unit tests. Verified
end-to-end against a live backend.
---
 internal/assist/prompt.go                   |   21 +
 internal/cli/context.go                     |   63 +-
 internal/commands/agent_metadata.go         |  136 +-
 internal/commands/beta.go                   |   76 +
 internal/commands/config_files.go           |   61 +
 internal/commands/detect.go                 |   88 ++
 internal/commands/hosted_resources.go       |  174 +++
 internal/commands/hosted_resources_test.go  |   48 +
 internal/commands/invoices.go               |  103 ++
 internal/commands/ip_ranges.go              |   58 +
 internal/commands/launch.go                 |   96 +-
 internal/commands/launch_test.go            |   30 +-
 internal/commands/managed_hosting.go        |  119 ++
 internal/commands/managed_hosting_test.go   |   29 +
 internal/commands/packages.go               |   49 +
 internal/commands/projects.go               |  161 +-
 internal/commands/root.go                   |    7 +
 internal/commands/servers.go                |   90 ++
 internal/commands/ssh_commands.go           |   61 +
 internal/commands/templates.go              |    4 +
 internal/commands/templates_subresources.go | 1540 +++++++++++++++++++
 pkg/sdk/client.go                           |   24 +-
 pkg/sdk/client_test.go                      |   59 +
 pkg/sdk/config_files.go                     |   33 +-
 pkg/sdk/config_files_test.go                |   56 +
 pkg/sdk/hosted_resources.go                 |  106 ++
 pkg/sdk/hosted_resources_test.go            |  198 +++
 pkg/sdk/invoices.go                         |   49 +
 pkg/sdk/invoices_test.go                    |   70 +
 pkg/sdk/ip_ranges.go                        |   52 +
 pkg/sdk/ip_ranges_test.go                   |   39 +
 pkg/sdk/managed_hosting.go                  |   66 +-
 pkg/sdk/managed_hosting_test.go             |  107 +-
 pkg/sdk/packages.go                         |   33 +
 pkg/sdk/packages_test.go                    |   53 +
 pkg/sdk/projects.go                         |   77 +
 pkg/sdk/projects_test.go                    |  109 ++
 pkg/sdk/servers.go                          |   50 +
 pkg/sdk/servers_test.go                     |   81 +
 pkg/sdk/ssh_commands.go                     |   41 +-
 pkg/sdk/ssh_commands_test.go                |   44 +
 pkg/sdk/template_subresources.go            |  421 +++++
 pkg/sdk/template_subresources_test.go       |  457 ++++++
 pkg/sdk/types.go                            |   48 +-
 44 files changed, 5142 insertions(+), 145 deletions(-)
 create mode 100644 internal/commands/beta.go
 create mode 100644 internal/commands/detect.go
 create mode 100644 internal/commands/hosted_resources.go
 create mode 100644 internal/commands/hosted_resources_test.go
 create mode 100644 internal/commands/invoices.go
 create mode 100644 internal/commands/ip_ranges.go
 create mode 100644 internal/commands/managed_hosting.go
 create mode 100644 internal/commands/managed_hosting_test.go
 create mode 100644 internal/commands/packages.go
 create mode 100644 internal/commands/templates_subresources.go
 create mode 100644 pkg/sdk/config_files_test.go
 create mode 100644 pkg/sdk/hosted_resources.go
 create mode 100644 pkg/sdk/hosted_resources_test.go
 create mode 100644 pkg/sdk/invoices.go
 create mode 100644 pkg/sdk/invoices_test.go
 create mode 100644 pkg/sdk/ip_ranges.go
 create mode 100644 pkg/sdk/ip_ranges_test.go
 create mode 100644 pkg/sdk/packages.go
 create mode 100644 pkg/sdk/packages_test.go
 create mode 100644 pkg/sdk/template_subresources.go
 create mode 100644 pkg/sdk/template_subresources_test.go

diff --git a/internal/assist/prompt.go b/internal/assist/prompt.go
index 3e07be3..9c9fcab 100644
--- a/internal/assist/prompt.go
+++ b/internal/assist/prompt.go
@@ -87,9 +87,14 @@ dhq signup                            — Create a new DeployHQ account
 Projects:
 dhq projects list|show|create|update|delete|star|insights
 dhq projects update <permalink> --name|--permalink|--zone|--email-notify-on|--notification-email|--notify-pusher|--check-undeployed-changes|--store-artifacts
+dhq projects regenerate-key <project> [--key-type ED25519|RSA]    (regenerates the SSH deploy key; prints the new public key)
+dhq projects undeployed-changes <project>                         (commits not yet deployed)
+dhq projects ai-overview <project> --end-ref <rev> [--start-ref <rev>]   (AI summary of changes)
 
 Servers & Groups:
 dhq servers list|show|create|update|delete|reset-host-key -p <project>
+dhq servers from-global <global-server-id> -p <project>          (add a global server template to a project)
+dhq servers metrics <server-id> -p <project>                     (point-in-time metrics snapshot; beta, SSH only, use --json)
 dhq server-groups list|show|create|update|delete -p <project>
 
 Deployments:
@@ -105,6 +110,7 @@ Configuration:
 dhq env-vars list|show|create|update|delete -p <project>
 dhq global-env-vars list|show|create|update|delete
 dhq config-files list|show|create|update|delete -p <project>
+dhq config-files link-global|unlink-global <config-file-id> -p <project>    (link/unlink an account-wide config file)
 dhq excluded-files list|show|create|update|delete -p <project>
 
 Build Pipeline:
@@ -114,6 +120,7 @@ dhq language-versions list -p <project>    (alias: dhq lv list)
 
 SSH & Deployment Commands:
 dhq ssh-commands list|show|create|update|delete -p <project>
+dhq ssh-commands link-global|unlink-global <command-id> -p <project>    (link/unlink an account-wide SSH command)
 dhq ssh-keys list|create|delete
 
 Integrations & Automation:
@@ -123,12 +130,26 @@ dhq scheduled-deploys list|show|create|update|delete -p <project>
 
 Templates:
 dhq templates list|show|public|public-show|create|update|delete
+dhq templates config-files|excluded-files|integrations|commands|build-commands|build-cache-files|build-known-hosts|servers|server-groups <action> -t <template>
+dhq templates build-languages set <package> --version <v> -t <template>
+dhq templates build-configuration -t <template>
+
+Managed Hosting:
+dhq hosted-resources list|show|sync|retry-provision
+dhq managed-hosting regions|sizes
+dhq beta enroll [--protocol managed_vps|static_hosting]    (enroll the account in the managed-resources beta)
 
 Account Resources:
 dhq agents list|create|update|delete|revoke
 dhq global-servers list|show|create|update|delete|copy-to-project
+dhq invoices list|download <number>       (billing history; billing-manager key required)
 dhq zones list
 
+Utilities & Info:
+dhq ip-ranges                             (DeployHQ IP ranges/ports for firewall allowlisting)
+dhq plans                                 (subscription plans and pricing; alias: pricing)
+dhq detect [path]                         (detect a project's framework and suggested deploy config)
+
 Dashboard & Activity:
 dhq status                             — Quick dashboard (deploy stats + recent activity)
 dhq activity list|stats                — Account-wide activity feed and deploy metrics
diff --git a/internal/cli/context.go b/internal/cli/context.go
index 1bccb4a..0743fab 100644
--- a/internal/cli/context.go
+++ b/internal/cli/context.go
@@ -18,8 +18,8 @@ type Context struct {
 	Config   *config.Config
 	Envelope *output.Envelope
 	Logger   *output.Logger
-	IsAgent bool // true when invoked by an AI agent
-	Version string
+	IsAgent  bool // true when invoked by an AI agent
+	Version  string
 
 	// Lazy-initialized API client (only when a command needs it)
 	client *sdk.Client
@@ -88,6 +88,56 @@ func (c *Context) Client() (*sdk.Client, error) {
 		return nil, err
 	}
 
+	client, err := sdk.New(account, email, apiKey, c.clientOpts(account)...)
+	if err != nil {
+		return nil, fmt.Errorf("create api client: %w", err)
+	}
+
+	c.client = client
+	return c.client, nil
+}
+
+// PublicClient returns an SDK client for the public, no-auth endpoints
+// (e.g. `dhq ip-ranges`, `dhq plans`). These endpoints return 200 without
+// credentials, so email/apiKey are not required — but an account is still
+// needed to know which subdomain to target.
+//
+// The account is resolved from config (flags/env/files) and, if absent
+// there, from the stored auth credentials. It is NOT cached on the Context
+// (that cache is reserved for the authenticated client).
+func (c *Context) PublicClient() (*sdk.Client, error) {
+	account, err := c.publicAccount()
+	if err != nil {
+		return nil, err
+	}
+
+	client, err := sdk.NewPublic(account, c.clientOpts(account)...)
+	if err != nil {
+		return nil, fmt.Errorf("create api client: %w", err)
+	}
+	return client, nil
+}
+
+// publicAccount resolves just the account subdomain for public endpoints,
+// without requiring email/apiKey. A public endpoint still needs to know
+// which account's subdomain to hit.
+func (c *Context) publicAccount() (string, error) {
+	if c.Config.Account != "" {
+		return c.Config.Account, nil
+	}
+	// Fall back to any stored auth account, if available.
+	if creds, err := auth.LoadByAccount(""); err == nil && creds.Account != "" {
+		return creds.Account, nil
+	}
+	return "", &output.UserError{
+		Message: "Account not configured",
+		Hint:    "This is a public endpoint, but it still needs an account subdomain to query.\nSet via --account flag, DEPLOYHQ_ACCOUNT env var, or 'dhq config set account <name>'",
+	}
+}
+
+// clientOpts builds the shared SDK options (user agent, base URL) used by
+// both the authenticated and public clients.
+func (c *Context) clientOpts(account string) []sdk.Option {
 	opts := []sdk.Option{}
 	agent := harness.AgentInfo{}
 	if c.IsAgent {
@@ -102,14 +152,7 @@ func (c *Context) Client() (*sdk.Client, error) {
 	if baseURL := c.Config.BaseURL(account); baseURL != "" {
 		opts = append(opts, sdk.WithBaseURL(baseURL))
 	}
-
-	client, err := sdk.New(account, email, apiKey, opts...)
-	if err != nil {
-		return nil, fmt.Errorf("create api client: %w", err)
-	}
-
-	c.client = client
-	return c.client, nil
+	return opts
 }
 
 // RequireProject returns the project identifier, or a UserError if not set.
diff --git a/internal/commands/agent_metadata.go b/internal/commands/agent_metadata.go
index 0002152..7a85996 100644
--- a/internal/commands/agent_metadata.go
+++ b/internal/commands/agent_metadata.go
@@ -28,7 +28,7 @@ var commandMetadataTable = map[string]AgentMetadata{
 		ResourceTypes: []string{"deployment"},
 	},
 	"dhq retry": {
-		Idempotent: false,
+		Idempotent:   false,
 		SupportsJSON: true, SafeForAutomation: true,
 		ResourceTypes: []string{"deployment"},
 	},
@@ -122,7 +122,7 @@ var commandMetadataTable = map[string]AgentMetadata{
 	},
 	"dhq env-vars create": {
 		Interactive: true, // prompts for value if --value omitted
-		Idempotent: false, SupportsJSON: true, SafeForAutomation: true,
+		Idempotent:  false, SupportsJSON: true, SafeForAutomation: true,
 		ResourceTypes: []string{"env_var"},
 	},
 	"dhq env-vars delete": {
@@ -165,23 +165,23 @@ var commandMetadataTable = map[string]AgentMetadata{
 		Idempotent: true, SupportsJSON: false, SafeForAutomation: true,
 	},
 	"dhq init": {
-		Interactive: true,
+		Interactive:  true,
 		SupportsJSON: false, SafeForAutomation: false,
 	},
 	"dhq hello": {
-		Interactive: true,
+		Interactive:  true,
 		SupportsJSON: false, SafeForAutomation: false,
 	},
 	"dhq configure": {
-		Interactive: true,
+		Interactive:  true,
 		SupportsJSON: false, SafeForAutomation: false,
 	},
 	"dhq signup": {
-		Interactive: true,
+		Interactive:  true,
 		SupportsJSON: true, SafeForAutomation: true,
 	},
 	"dhq mcp": {
-		Interactive: true,
+		Interactive:  true,
 		SupportsJSON: false, SafeForAutomation: false,
 	},
 
@@ -280,6 +280,128 @@ var commandMetadataTable = map[string]AgentMetadata{
 		Idempotent: true, SupportsJSON: true, SafeForAutomation: true,
 		ResourceTypes: []string{"template"},
 	},
+
+	// Hosted resources (Managed VPS + Static Hosting lifecycle)
+	"dhq hosted-resources list": {
+		Idempotent: true, SupportsJSON: true, SafeForAutomation: true,
+		ResourceTypes: []string{"hosted_resource"},
+	},
+	"dhq hosted-resources show": {
+		Idempotent: true, SupportsJSON: true, SafeForAutomation: true,
+		ResourceTypes: []string{"hosted_resource"},
+	},
+	"dhq hosted-resources sync": {
+		Idempotent: true, SupportsJSON: true, SafeForAutomation: true,
+		ResourceTypes: []string{"hosted_resource"},
+	},
+	"dhq hosted-resources retry-provision": {
+		// Only valid when the resource is in the error state; not blindly retry-safe.
+		Idempotent: false, SupportsJSON: true, SafeForAutomation: false,
+		ResourceTypes: []string{"hosted_resource"},
+	},
+
+	// Managed hosting catalog (read-only)
+	"dhq managed-hosting regions": {
+		Idempotent: true, SupportsJSON: true, SafeForAutomation: true,
+		ResourceTypes: []string{"managed_hosting_region"},
+	},
+	"dhq managed-hosting sizes": {
+		Idempotent: true, SupportsJSON: true, SafeForAutomation: true,
+		ResourceTypes: []string{"managed_hosting_size"},
+	},
+
+	// Template sub-resources (all take -t <template>)
+	"dhq templates config-files list":   {Idempotent: true, SupportsJSON: true, SafeForAutomation: true, ResourceTypes: []string{"template"}},
+	"dhq templates config-files show":   {Idempotent: true, SupportsJSON: true, SafeForAutomation: true, ResourceTypes: []string{"template"}},
+	"dhq templates config-files create": {SupportsJSON: true, SafeForAutomation: true, ResourceTypes: []string{"template"}},
+	"dhq templates config-files update": {Idempotent: true, SupportsJSON: true, SafeForAutomation: true, ResourceTypes: []string{"template"}},
+	"dhq templates config-files delete": {Destructive: true, RequiresConfirmation: true, SupportsJSON: true, SafeForAutomation: true, ResourceTypes: []string{"template"}},
+
+	"dhq templates excluded-files list":   {Idempotent: true, SupportsJSON: true, SafeForAutomation: true, ResourceTypes: []string{"template"}},
+	"dhq templates excluded-files create": {SupportsJSON: true, SafeForAutomation: true, ResourceTypes: []string{"template"}},
+	"dhq templates excluded-files update": {Idempotent: true, SupportsJSON: true, SafeForAutomation: true, ResourceTypes: []string{"template"}},
+	"dhq templates excluded-files delete": {Destructive: true, RequiresConfirmation: true, SupportsJSON: true, SafeForAutomation: true, ResourceTypes: []string{"template"}},
+
+	"dhq templates integrations list":   {Idempotent: true, SupportsJSON: true, SafeForAutomation: true, ResourceTypes: []string{"template"}},
+	"dhq templates integrations create": {SupportsJSON: true, SafeForAutomation: true, ResourceTypes: []string{"template"}},
+	"dhq templates integrations update": {Idempotent: true, SupportsJSON: true, SafeForAutomation: true, ResourceTypes: []string{"template"}},
+	"dhq templates integrations delete": {Destructive: true, RequiresConfirmation: true, SupportsJSON: true, SafeForAutomation: true, ResourceTypes: []string{"template"}},
+
+	"dhq templates commands list":   {Idempotent: true, SupportsJSON: true, SafeForAutomation: true, ResourceTypes: []string{"template"}},
+	"dhq templates commands create": {SupportsJSON: true, SafeForAutomation: true, ResourceTypes: []string{"template"}},
+	"dhq templates commands update": {Idempotent: true, SupportsJSON: true, SafeForAutomation: true, ResourceTypes: []string{"template"}},
+	"dhq templates commands delete": {Destructive: true, RequiresConfirmation: true, SupportsJSON: true, SafeForAutomation: true, ResourceTypes: []string{"template"}},
+
+	"dhq templates build-commands list":   {Idempotent: true, SupportsJSON: true, SafeForAutomation: true, ResourceTypes: []string{"template"}},
+	"dhq templates build-commands create": {SupportsJSON: true, SafeForAutomation: true, ResourceTypes: []string{"template"}},
+	"dhq templates build-commands update": {Idempotent: true, SupportsJSON: true, SafeForAutomation: true, ResourceTypes: []string{"template"}},
+	"dhq templates build-commands delete": {Destructive: true, RequiresConfirmation: true, SupportsJSON: true, SafeForAutomation: true, ResourceTypes: []string{"template"}},
+
+	"dhq templates build-cache-files list":   {Idempotent: true, SupportsJSON: true, SafeForAutomation: true, ResourceTypes: []string{"template"}},
+	"dhq templates build-cache-files create": {SupportsJSON: true, SafeForAutomation: true, ResourceTypes: []string{"template"}},
+	"dhq templates build-cache-files update": {Idempotent: true, SupportsJSON: true, SafeForAutomation: true, ResourceTypes: []string{"template"}},
+	"dhq templates build-cache-files delete": {Destructive: true, RequiresConfirmation: true, SupportsJSON: true, SafeForAutomation: true, ResourceTypes: []string{"template"}},
+
+	"dhq templates build-known-hosts list":   {Idempotent: true, SupportsJSON: true, SafeForAutomation: true, ResourceTypes: []string{"template"}},
+	"dhq templates build-known-hosts create": {SupportsJSON: true, SafeForAutomation: true, ResourceTypes: []string{"template"}},
+	"dhq templates build-known-hosts delete": {Destructive: true, RequiresConfirmation: true, SupportsJSON: true, SafeForAutomation: true, ResourceTypes: []string{"template"}},
+
+	"dhq templates build-languages set": {Idempotent: true, SupportsJSON: true, SafeForAutomation: true, ResourceTypes: []string{"template"}},
+
+	"dhq templates build-configuration": {Idempotent: true, SupportsJSON: true, SafeForAutomation: true, ResourceTypes: []string{"template"}},
+
+	"dhq templates servers list":   {Idempotent: true, SupportsJSON: true, SafeForAutomation: true, ResourceTypes: []string{"template", "server"}},
+	"dhq templates servers show":   {Idempotent: true, SupportsJSON: true, SafeForAutomation: true, ResourceTypes: []string{"template", "server"}},
+	"dhq templates servers create": {SupportsJSON: true, SafeForAutomation: true, ResourceTypes: []string{"template", "server"}},
+	"dhq templates servers update": {Idempotent: true, SupportsJSON: true, SafeForAutomation: true, ResourceTypes: []string{"template", "server"}},
+	"dhq templates servers delete": {Destructive: true, RequiresConfirmation: true, SupportsJSON: true, SafeForAutomation: true, ResourceTypes: []string{"template", "server"}},
+
+	"dhq templates server-groups list":   {Idempotent: true, SupportsJSON: true, SafeForAutomation: true, ResourceTypes: []string{"template"}},
+	"dhq templates server-groups create": {SupportsJSON: true, SafeForAutomation: true, ResourceTypes: []string{"template"}},
+	"dhq templates server-groups update": {Idempotent: true, SupportsJSON: true, SafeForAutomation: true, ResourceTypes: []string{"template"}},
+	"dhq templates server-groups delete": {Destructive: true, RequiresConfirmation: true, SupportsJSON: true, SafeForAutomation: true, ResourceTypes: []string{"template"}},
+
+	// Phase 4 — project & server actions
+	"dhq projects regenerate-key": {
+		// Invalidates the existing deploy key — servers must be updated with the new one.
+		Destructive: true, RequiresConfirmation: true,
+		SupportsJSON: true, SafeForAutomation: false,
+		ResourceTypes: []string{"project"},
+	},
+	"dhq projects undeployed-changes": {
+		Idempotent: true, SupportsJSON: true, SafeForAutomation: true,
+		ResourceTypes: []string{"project"},
+	},
+	"dhq projects ai-overview": {
+		Idempotent: true, SupportsJSON: true, SafeForAutomation: true,
+		ResourceTypes: []string{"project"},
+	},
+	"dhq servers from-global": {
+		SupportsJSON: true, SafeForAutomation: true,
+		ResourceTypes: []string{"server"},
+	},
+	"dhq servers metrics": {
+		Idempotent: true, SupportsJSON: true, SafeForAutomation: true,
+		ResourceTypes: []string{"server"},
+	},
+	"dhq config-files link-global":   {Idempotent: true, SupportsJSON: true, SafeForAutomation: true, ResourceTypes: []string{"config_file"}},
+	"dhq config-files unlink-global": {Destructive: true, Idempotent: true, SupportsJSON: true, SafeForAutomation: true, ResourceTypes: []string{"config_file"}},
+	"dhq ssh-commands link-global":   {Idempotent: true, SupportsJSON: true, SafeForAutomation: true, ResourceTypes: []string{"ssh_command"}},
+	"dhq ssh-commands unlink-global": {Destructive: true, Idempotent: true, SupportsJSON: true, SafeForAutomation: true, ResourceTypes: []string{"ssh_command"}},
+
+	// Phase 7 — long-tail resources
+	"dhq ip-ranges":         {Idempotent: true, SupportsJSON: true, SafeForAutomation: true, ResourceTypes: []string{"ip_range"}},
+	"dhq plans":             {Idempotent: true, SupportsJSON: true, SafeForAutomation: true, ResourceTypes: []string{"package"}},
+	"dhq invoices list":     {Idempotent: true, SupportsJSON: true, SafeForAutomation: true, ResourceTypes: []string{"invoice"}},
+	"dhq invoices download": {Idempotent: true, SupportsJSON: false, SafeForAutomation: true, ResourceTypes: []string{"invoice"}},
+	"dhq detect":            {Idempotent: true, SupportsJSON: true, SafeForAutomation: true},
+	"dhq beta enroll": {
+		// Admin-gated (403 for non-admins); re-enrolling is a no-op.
+		Idempotent: true, RequiresConfirmation: true,
+		SupportsJSON: true, SafeForAutomation: true,
+		ResourceTypes: []string{"beta_enrollment"},
+	},
+
 	"dhq zones list": {
 		Idempotent: true, SupportsJSON: true, SafeForAutomation: true,
 		ResourceTypes: []string{"zone"},
diff --git a/internal/commands/beta.go b/internal/commands/beta.go
new file mode 100644
index 0000000..53ce8af
--- /dev/null
+++ b/internal/commands/beta.go
@@ -0,0 +1,76 @@
+package commands
+
+import (
+	"errors"
+	"fmt"
+	"net/http"
+
+	"github.com/deployhq/deployhq-cli/internal/output"
+	"github.com/deployhq/deployhq-cli/pkg/sdk"
+	"github.com/spf13/cobra"
+)
+
+func newBetaCmd() *cobra.Command {
+	cmd := &cobra.Command{
+		Use:   "beta",
+		Short: "Manage DeployHQ beta enrollment",
+		Long: `Enroll your account in DeployHQ's managed-resources beta (Static Hosting and
+Managed VPS). Enrollment can only be flipped on by an account admin.`,
+	}
+	cmd.AddCommand(newBetaEnrollCmd())
+	return cmd
+}
+
+func newBetaEnrollCmd() *cobra.Command {
+	var protocol string
+	cmd := &cobra.Command{
+		Use:   "enroll",
+		Short: "Enroll the account in the managed-resources beta",
+		Long: `Enroll your account in the managed-resources beta.
+
+By default enrolls in the managed_vps protocol; pass --protocol static_hosting to
+enroll in Static Hosting instead. Requires an account admin — non-admins receive a
+403 with a link to enable the beta in the dashboard.`,
+		RunE: func(cmd *cobra.Command, args []string) error {
+			client, err := cliCtx.Client()
+			if err != nil {
+				return err
+			}
+			env := cliCtx.Envelope
+			resp, err := client.EnrollBeta(cliCtx.Background(), protocol)
+			if err != nil {
+				var apiErr *sdk.APIError
+				if errors.As(err, &apiErr) {
+					betaURL := fmt.Sprintf("https://app.deployhq.com/%s/beta_features", client.Account())
+					switch apiErr.StatusCode {
+					case http.StatusForbidden:
+						return &output.UserError{
+							Message: "Beta enrollment requires an account admin. Ask an admin to enable it at: " + betaURL,
+						}
+					case http.StatusUnprocessableEntity:
+						return &output.UserError{
+							Message: fmt.Sprintf("Unsupported protocol %q. Use managed_vps or static_hosting.", protocol),
+						}
+					}
+				}
+				return err
+			}
+			if env.WantsJSON() {
+				summary := "not enrolled"
+				if resp.Enrolled {
+					summary = "enrolled"
+				}
+				return env.WriteJSON(output.NewResponse(resp, summary))
+			}
+			if resp.Enrolled {
+				output.ColorGreen.Fprintf(env.Stderr, "Enrolled in the managed-resources beta.\n") //nolint:errcheck
+			} else {
+				env.Status("Enrollment request sent, but the account is not yet enrolled.")
+			}
+			env.Status("\nTip: dhq launch to provision Static Hosting or a Managed VPS")
+			return nil
+		},
+	}
+	cmd.Flags().StringVar(&protocol, "protocol", "managed_vps", "Protocol to enroll in: managed_vps or static_hosting")
+	return cmd
+}
diff --git a/internal/commands/config_files.go b/internal/commands/config_files.go
index b3538bf..afae9e2 100644
--- a/internal/commands/config_files.go
+++ b/internal/commands/config_files.go
@@ -22,10 +22,71 @@ Each config file is scoped to one project and pinned to a target path on the ser
 		newConfigFilesCreateCmd(),
 		newConfigFilesUpdateCmd(),
 		newConfigFilesDeleteCmd(),
+		newConfigFilesLinkGlobalCmd(),
+		newConfigFilesUnlinkGlobalCmd(),
 	)
 	return cmd
 }
 
+func newConfigFilesLinkGlobalCmd() *cobra.Command {
+	return &cobra.Command{
+		Use:   "link-global <config-file-id>",
+		Short: "Link a global config file into this project",
+		Args:  cobra.ExactArgs(1),
+		Example: `  # Link an account-wide config file into the current project
+  dhq config-files link-global cfg-abc123 -p my-app`,
+		RunE: func(cmd *cobra.Command, args []string) error {
+			projectID, err := cliCtx.RequireProject()
+			if err != nil {
+				return err
+			}
+			client, err := cliCtx.Client()
+			if err != nil {
+				return err
+			}
+			f, err := client.LinkGlobalConfigFile(cliCtx.Background(), projectID, args[0])
+			if err != nil {
+				return err
+			}
+			env := cliCtx.Envelope
+			if env.WantsJSON() {
+				return env.WriteJSON(output.NewResponse(f, fmt.Sprintf("Linked global config file: %s", f.Path)))
+			}
+			env.Status("Linked global config file: %s", f.Path)
+			return nil
+		},
+	}
+}
+
+func newConfigFilesUnlinkGlobalCmd() *cobra.Command {
+	return &cobra.Command{
+		Use:   "unlink-global <config-file-id>",
+		Short: "Unlink a global config file from this project",
+		Args:  cobra.ExactArgs(1),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			projectID, err := cliCtx.RequireProject()
+			if err != nil {
+				return err
+			}
+			client, err := cliCtx.Client()
+			if err != nil {
+				return err
+			}
+			if err := client.UnlinkGlobalConfigFile(cliCtx.Background(), projectID, args[0]); err != nil {
+				return err
+			}
+			env := cliCtx.Envelope
+			if env.WantsJSON() {
+				return env.WriteJSON(output.NewResponse(
+					map[string]string{"config_file_id": args[0], "status": "unlinked"},
+					fmt.Sprintf("Unlinked: %s", args[0])))
+			}
+			env.Status("Unlinked global config file: %s", args[0])
+			return nil
+		},
+	}
+}
+
 func newConfigFilesListCmd() *cobra.Command {
 	return &cobra.Command{
 		Use: "list", Short: "List config files",
diff --git a/internal/commands/detect.go b/internal/commands/detect.go
new file mode 100644
index 0000000..15617eb
--- /dev/null
+++ b/internal/commands/detect.go
@@ -0,0 +1,88 @@
+package commands
+
+import (
+	"strings"
+
+	"github.com/deployhq/deployhq-cli/internal/detect"
+	"github.com/deployhq/deployhq-cli/internal/output"
+	"github.com/deployhq/deployhq-cli/pkg/sdk"
+	"github.com/spf13/cobra"
+)
+
+func newDetectCmd() *cobra.Command {
+	cmd := &cobra.Command{
+		Use:   "detect [path]",
+		Short: "Detect a project's framework and suggested deploy configuration",
+		Long: `Scan a project directory and ask DeployHQ to detect its framework, the
+suggested deploy protocol, and a build pipeline — the same StackDetector the web
+onboarding wizard uses, so the CLI's recommendation matches the server.
+
+The scan uploads the directory's filename listing plus the contents of a bounded
+set of manifest files (package.json, Gemfile, requirements.txt, go.mod, and the
+like). .git and node_modules are skipped. Defaults to the current directory.`,
+		Args: cobra.MaximumNArgs(1),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			dir := "."
+			if len(args) == 1 {
+				dir = args[0]
+			}
+			client, err := cliCtx.Client()
+			if err != nil {
+				return err
+			}
+			filenames, files := detect.CollectManifest(dir)
+			resp, err := client.DetectFramework(cliCtx.Background(), sdk.DetectionPayload{
+				Filenames: filenames,
+				Files:     files,
+			})
+			if err != nil {
+				return err
+			}
+			env := cliCtx.Envelope
+			if env.WantsJSON() {
+				summary := resp.Stack
+				if summary == "" {
+					summary = "no framework detected"
+				}
+				return env.WriteJSON(output.NewResponse(resp, summary))
+			}
+
+			stack := resp.Stack
+			if stack == "" {
+				stack = "(none detected)"
+			}
+			rows := [][]string{{"Stack", stack}}
+			if resp.Version != "" {
+				rows = append(rows, []string{"Version", resp.Version})
+			}
+			if resp.SuggestedProtocol != "" {
+				rows = append(rows, []string{"Suggested protocol", resp.SuggestedProtocol})
+			}
+			if resp.StaticHosting.Eligibility != "" {
+				rows = append(rows, []string{"Static hosting", resp.StaticHosting.Eligibility})
+			}
+			if resp.Description != "" {
+				rows = append(rows, []string{"Description", resp.Description})
+			}
+			env.WriteTable([]string{"Field", "Value"}, rows)
+
+			if len(resp.BuildCommands) > 0 {
+				cmds := make([]string, 0, len(resp.BuildCommands))
+				for _, bc := range resp.BuildCommands {
+					if bc.Command != "" {
+						cmds = append(cmds, bc.Command)
+					}
+				}
+				if len(cmds) > 0 {
+					env.Status("\nBuild commands:\n  %s", strings.Join(cmds, "\n  "))
+				}
+			}
+			if resp.AIAssisted {
+				env.Status("\n(AI-assisted detection)")
+			}
+			env.Status("\nTip: dhq launch to deploy this project, or dhq detect --json for the full result")
+			return nil
+		},
+	}
+	return cmd
+}
diff --git a/internal/commands/hosted_resources.go b/internal/commands/hosted_resources.go
new file mode 100644
index 0000000..f4e4e28
--- /dev/null
+++ b/internal/commands/hosted_resources.go
@@ -0,0 +1,174 @@
+package commands
+
+import (
+	"fmt"
+
+	"github.com/deployhq/deployhq-cli/internal/output"
+	"github.com/deployhq/deployhq-cli/pkg/sdk"
+	"github.com/spf13/cobra"
+)
+
+func newHostedResourcesCmd() *cobra.Command {
+	cmd := &cobra.Command{
+		Use:     "hosted-resources",
+		Aliases: []string{"hosted-resource"},
+		Short:   "Manage hosted resources (Managed VPS + Static Hosting)",
+		Long: `Managed hosting resources for the account: Managed VPS droplets (kind "hosted_resource") and Static Hosting websites (kind "hosted_website").
+
+This is an admin + beta-features area; without both you will get a permission error. Inspect a resource with "dhq hosted-resources show <id>", re-sync provider state with "sync", and retry a failed provision with "retry-provision".`,
+	}
+
+	cmd.AddCommand(
+		newHostedResourcesListCmd(),
+		newHostedResourcesShowCmd(),
+		newHostedResourcesSyncCmd(),
+		newHostedResourcesRetryProvisionCmd(),
+	)
+
+	return cmd
+}
+
+// hostedResourceLocation returns the value for the "Region / Subdomain" column:
+// the region slug for a Managed VPS, or the subdomain for a Static Hosting site.
+func hostedResourceLocation(r sdk.HostedResource) string {
+	if r.Kind == "hosted_website" {
+		return r.Subdomain
+	}
+	if r.Region != nil {
+		return *r.Region
+	}
+	return ""
+}
+
+func newHostedResourcesListCmd() *cobra.Command {
+	return &cobra.Command{
+		Use:   "list",
+		Short: "List hosted resources",
+		RunE: func(cmd *cobra.Command, args []string) error {
+			client, err := cliCtx.Client()
+			if err != nil {
+				return err
+			}
+
+			resources, err := client.ListHostedResources(cliCtx.Background(), nil)
+			if err != nil {
+				return err
+			}
+
+			env := cliCtx.Envelope
+			if env.WantsJSON() {
+				return env.WriteJSON(output.NewResponse(resources,
+					fmt.Sprintf("%d hosted resources", len(resources)),
+					output.Breadcrumb{Action: "show", Cmd: "dhq hosted-resources show <id>"},
+				))
+			}
+
+			if env.QuietMode {
+				ids := make([]string, len(resources))
+				for i, r := range resources {
+					ids[i] = r.Identifier
+				}
+				env.WriteQuiet(ids)
+				return nil
+			}
+
+			columns := []string{"Name", "Identifier", "Kind", "Status", "Region / Subdomain", "Monthly Cost"}
+			rows := make([][]string, len(resources))
+			for i, r := range resources {
+				rows[i] = []string{
+					r.Name,
+					r.Identifier,
+					r.Kind,
+					r.Status,
+					hostedResourceLocation(r),
+					fmt.Sprintf("$%.2f", r.MonthlyCost),
+				}
+			}
+			env.WriteTable(columns, rows)
+			return nil
+		},
+	}
+}
+
+func newHostedResourcesShowCmd() *cobra.Command {
+	return &cobra.Command{
+		Use:   "show <id>",
+		Short: "Show hosted resource details",
+		Args:  cobra.ExactArgs(1),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			client, err := cliCtx.Client()
+			if err != nil {
+				return err
+			}
+
+			resource, err := client.GetHostedResource(cliCtx.Background(), args[0])
+			if err != nil {
+				return err
+			}
+
+			return cliCtx.Envelope.WriteJSON(output.NewResponse(resource,
+				fmt.Sprintf("Hosted resource: %s", resource.Name),
+				output.Breadcrumb{Action: "sync", Cmd: fmt.Sprintf("dhq hosted-resources sync %s", resource.Identifier)},
+				output.Breadcrumb{Action: "retry-provision", Cmd: fmt.Sprintf("dhq hosted-resources retry-provision %s", resource.Identifier)},
+			))
+		},
+	}
+}
+
+func newHostedResourcesSyncCmd() *cobra.Command {
+	return &cobra.Command{
+		Use:   "sync <id>",
+		Short: "Request a re-sync of a hosted resource's provisioning state",
+		Args:  cobra.ExactArgs(1),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			client, err := cliCtx.Client()
+			if err != nil {
+				return err
+			}
+
+			if err := client.SyncHostedResource(cliCtx.Background(), args[0]); err != nil {
+				return err
+			}
+
+			env := cliCtx.Envelope
+			if env.WantsJSON() {
+				return env.WriteJSON(output.NewResponse(
+					map[string]string{"identifier": args[0], "status": "sync_requested"},
+					fmt.Sprintf("Sync requested for %s", args[0]),
+					output.Breadcrumb{Action: "show", Cmd: fmt.Sprintf("dhq hosted-resources show %s", args[0])},
+				))
+			}
+			env.Status("Sync requested for %s", args[0])
+			return nil
+		},
+	}
+}
+
+func newHostedResourcesRetryProvisionCmd() *cobra.Command {
+	return &cobra.Command{
+		Use:   "retry-provision <id>",
+		Short: "Retry provisioning a hosted resource that is in the error state",
+		Args:  cobra.ExactArgs(1),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			client, err := cliCtx.Client()
+			if err != nil {
+				return err
+			}
+
+			if err := client.RetryProvisionHostedResource(cliCtx.Background(), args[0]); err != nil {
+				return err
+			}
+
+			env := cliCtx.Envelope
+			if env.WantsJSON() {
+				return env.WriteJSON(output.NewResponse(
+					map[string]string{"identifier": args[0], "status": "provisioning"},
+					fmt.Sprintf("Provisioning retry started for %s", args[0]),
+					output.Breadcrumb{Action: "show", Cmd: fmt.Sprintf("dhq hosted-resources show %s", args[0])},
+				))
+			}
+			env.Status("Provisioning retry started for %s", args[0])
+			return nil
+		},
+	}
+}
diff --git a/internal/commands/hosted_resources_test.go b/internal/commands/hosted_resources_test.go
new file mode 100644
index 0000000..892cc0b
--- /dev/null
+++ b/internal/commands/hosted_resources_test.go
@@ -0,0 +1,48 @@
+package commands
+
+import (
+	"testing"
+
+	"github.com/deployhq/deployhq-cli/pkg/sdk"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestHostedResourcesCmd_Structure(t *testing.T) {
+	cmd := newHostedResourcesCmd()
+	assert.Equal(t, "hosted-resources", cmd.Name())
+
+	want := map[string]bool{
+		"list":            false,
+		"show":            false,
+		"sync":            false,
+		"retry-provision": false,
+	}
+	for _, sub := range cmd.Commands() {
+		if _, ok := want[sub.Name()]; ok {
+			want[sub.Name()] = true
+		}
+	}
+	for name, found := range want {
+		assert.Truef(t, found, "missing subcommand %q", name)
+	}
+}
+
+func TestHostedResourcesCmd_Help(t *testing.T) {
+	cmd := newHostedResourcesCmd()
+	cmd.SetArgs([]string{"--help"})
+	require.NoError(t, cmd.Execute())
+}
+
+func TestHostedResourceLocation(t *testing.T) {
+	region := "lon1"
+	vps := sdk.HostedResource{Kind: "hosted_resource", Region: &region}
+	assert.Equal(t, "lon1", hostedResourceLocation(vps))
+
+	website := sdk.HostedResource{Kind: "hosted_website", Subdomain: "my-site"}
+	assert.Equal(t, "my-site", hostedResourceLocation(website))
+
+	// Managed VPS with no region yet → empty, no nil-deref.
+	pending := sdk.HostedResource{Kind: "hosted_resource"}
+	assert.Equal(t, "", hostedResourceLocation(pending))
+}
diff --git a/internal/commands/invoices.go b/internal/commands/invoices.go
new file mode 100644
index 0000000..f66ec9b
--- /dev/null
+++ b/internal/commands/invoices.go
@@ -0,0 +1,103 @@
+package commands
+
+import (
+	"fmt"
+	"os"
+	"strconv"
+
+	"github.com/deployhq/deployhq-cli/internal/output"
+	"github.com/spf13/cobra"
+)
+
+func newInvoicesCmd() *cobra.Command {
+	cmd := &cobra.Command{
+		Use:   "invoices",
+		Short: "List and download account invoices",
+		Long: `Billing invoices on your account.
+
+Requires a billing-manager API key; other keys receive a 403. Invoices are keyed
+by number. The single-invoice endpoint is PDF-only, so "download" writes the raw
+PDF (there is no JSON view of an individual invoice).`,
+	}
+	cmd.AddCommand(newInvoicesListCmd(), newInvoicesDownloadCmd())
+	return cmd
+}
+
+func newInvoicesListCmd() *cobra.Command {
+	return &cobra.Command{
+		Use:   "list",
+		Short: "List invoices",
+		RunE: func(cmd *cobra.Command, args []string) error {
+			client, err := cliCtx.Client()
+			if err != nil {
+				return err
+			}
+			invoices, err := client.ListInvoices(cliCtx.Background(), nil)
+			if err != nil {
+				return err
+			}
+			env := cliCtx.Envelope
+			if env.WantsJSON() {
+				return env.WriteJSON(output.NewResponse(invoices, fmt.Sprintf("%d invoices", len(invoices))))
+			}
+			rows := make([][]string, len(invoices))
+			for i, inv := range invoices {
+				paid := "no"
+				if inv.Paid {
+					paid = "yes"
+				}
+				rows[i] = []string{
+					strconv.Itoa(inv.Number),
+					inv.CreatedAt,
+					inv.Total,
+					inv.Currency,
+					paid,
+				}
+			}
+			env.WriteTable([]string{"Number", "Date", "Total", "Currency", "Paid"}, rows)
+			env.Status("\nTip: dhq invoices download <number> --output invoice.pdf")
+			return nil
+		},
+	}
+}
+
+func newInvoicesDownloadCmd() *cobra.Command {
+	var outputPath string
+	cmd := &cobra.Command{
+		Use:   "download <number>",
+		Short: "Download an invoice PDF",
+		Args:  cobra.ExactArgs(1),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			number, err := strconv.Atoi(args[0])
+			if err != nil {
+				return fmt.Errorf("invalid invoice number %q: must be an integer", args[0])
+			}
+			client, err := cliCtx.Client()
+			if err != nil {
+				return err
+			}
+			data, err := client.DownloadInvoice(cliCtx.Background(), number)
+			if err != nil {
+				return err
+			}
+			env := cliCtx.Envelope
+
+			// No --output and piped: stream the PDF to stdout so it can be
+			// redirected. Otherwise write to a file (default filename).
+			if outputPath == "" && !env.IsTTY {
+				_, werr := env.Stdout.Write(data)
+				return werr
+			}
+			if outputPath == "" {
+				outputPath = fmt.Sprintf("invoice-%d.pdf", number)
+			}
+			if err := os.WriteFile(outputPath, data, 0o644); err != nil {
+				return fmt.Errorf("write %s: %w", outputPath, err)
+			}
+			env.Status("Saved invoice %d to %s (%d bytes)", number, outputPath, len(data))
+			return nil
+		},
+	}
+	cmd.Flags().StringVarP(&outputPath, "output", "o", "", "Write the PDF to this file (default invoice-<number>.pdf)")
+	return cmd
+}
diff --git a/internal/commands/ip_ranges.go b/internal/commands/ip_ranges.go
new file mode 100644
index 0000000..ef66ec1
--- /dev/null
+++ b/internal/commands/ip_ranges.go
@@ -0,0 +1,58 @@
+package commands
+
+import (
+	"fmt"
+	"strings"
+
+	"github.com/deployhq/deployhq-cli/internal/output"
+	"github.com/spf13/cobra"
+)
+
+func newIPRangesCmd() *cobra.Command {
+	cmd := &cobra.Command{
+		Use:   "ip-ranges",
+		Short: "List DeployHQ IP ranges for firewall allowlisting",
+		Long: `The IP ranges and ports DeployHQ connects from when deploying to your servers.
+
+Add these to your server firewall's allowlist so DeployHQ can reach it over SSH/FTP,
+and so DeployHQ's build and network-agent traffic is admitted. This endpoint is public.
+
+Use --json for the full structure (shared, per-zone, and network-agent ranges); the
+default table shows the flattened all-IPv4/all-IPv6 union plus the ports used.`,
+		RunE: func(cmd *cobra.Command, args []string) error {
+			client, err := cliCtx.PublicClient()
+			if err != nil {
+				return err
+			}
+			ranges, err := client.GetIPRanges(cliCtx.Background())
+			if err != nil {
+				return err
+			}
+			env := cliCtx.Envelope
+			if env.WantsJSON() {
+				return env.WriteJSON(output.NewResponse(ranges,
+					fmt.Sprintf("%d IPv4 and %d IPv6 ranges", len(ranges.AllIPv4), len(ranges.AllIPv6))))
+			}
+
+			rows := make([][]string, 0, len(ranges.AllIPv4)+len(ranges.AllIPv6))
+			for _, ip := range ranges.AllIPv4 {
+				rows = append(rows, []string{"IPv4", ip})
+			}
+			for _, ip := range ranges.AllIPv6 {
+				rows = append(rows, []string{"IPv6", ip})
+			}
+			env.WriteTable([]string{"Family", "Range"}, rows)
+
+			if len(ranges.Ports) > 0 {
+				parts := make([]string, len(ranges.Ports))
+				for i, p := range ranges.Ports {
+					parts[i] = fmt.Sprintf("%s (%s)", p.Protocol, p.Description)
+				}
+				env.Status("\nPorts: %s", strings.Join(parts, ", "))
+			}
+			env.Status("\nTip: dhq ip-ranges --json for shared, per-zone, and network-agent ranges")
+			return nil
+		},
+	}
+	return cmd
+}
diff --git a/internal/commands/launch.go b/internal/commands/launch.go
index faad211..4d59456 100644
--- a/internal/commands/launch.go
+++ b/internal/commands/launch.go
@@ -84,13 +84,13 @@ type dryRunResult struct {
 }
 
 type dryRunWould struct {
-	Provision   string  `json:"provision,omitempty"`
-	Region      string  `json:"region,omitempty"`
-	Size        string  `json:"size,omitempty"`
-	MonthlyCost string  `json:"monthly_cost,omitempty"`
-	Subdomain   string  `json:"subdomain,omitempty"`
-	Project     string  `json:"project,omitempty"`
-	Branch      string  `json:"branch,omitempty"`
+	Provision   string `json:"provision,omitempty"`
+	Region      string `json:"region,omitempty"`
+	Size        string `json:"size,omitempty"`
+	MonthlyCost string `json:"monthly_cost,omitempty"`
+	Subdomain   string `json:"subdomain,omitempty"`
+	Project     string `json:"project,omitempty"`
+	Branch      string `json:"branch,omitempty"`
 }
 
 // launchErrorReason is the machine-readable error code taxonomy.
@@ -158,18 +158,18 @@ func rateLimitLaunchError(err error) *launchError {
 // newLaunchCmd builds the `dhq launch` Cobra command.
 func newLaunchCmd() *cobra.Command {
 	var (
-		flagStatic          bool
-		flagVPS             bool
-		flagAcceptCost      bool
-		flagSubdomain       string
-		flagRegion          string
-		flagSize            string
-		flagBranch          string
-		flagProject         string
-		flagCleanupOnFail   bool
-		flagNonInteract     bool // local --non-interactive (mirrors global but scoped)
-		flagInteractive     bool
-		flagDryRun          bool
+		flagStatic        bool
+		flagVPS           bool
+		flagAcceptCost    bool
+		flagSubdomain     string
+		flagRegion        string
+		flagSize          string
+		flagBranch        string
+		flagProject       string
+		flagCleanupOnFail bool
+		flagNonInteract   bool // local --non-interactive (mirrors global but scoped)
+		flagInteractive   bool
+		flagDryRun        bool
 	)
 
 	cmd := &cobra.Command{
@@ -892,7 +892,7 @@ func launchDryRun(ctx context.Context, env *output.Envelope, cfg launchConfig, c
 			sizes, sErr := client.ListManagedHostingSizes(ctx)
 			if sErr == nil && len(sizes) > 0 {
 				size = sizes[0].Slug
-				monthlyCost = fmt.Sprintf("$%.2f", sizes[0].PriceMonthly)
+				monthlyCost = fmt.Sprintf("$%.2f", sizes[0].MonthlyCost)
 			} else {
 				size = "s-1vcpu-1gb"
 			}
@@ -1414,8 +1414,8 @@ func managedSizeRanks(sizes []sdk.ManagedHostingSize) []int {
 			if j == i {
 				continue
 			}
-			if sizes[j].PriceMonthly < sizes[i].PriceMonthly ||
-				(sizes[j].PriceMonthly == sizes[i].PriceMonthly && j < i) {
+			if sizes[j].MonthlyCost < sizes[i].MonthlyCost ||
+				(sizes[j].MonthlyCost == sizes[i].MonthlyCost && j < i) {
 				rank++
 			}
 		}
@@ -1424,14 +1424,11 @@ func managedSizeRanks(sizes []sdk.ManagedHostingSize) []int {
 	return ranks
 }
 
-// managedSizeSpecs renders the hardware line for a size, e.g.
-// "1 vCPU · 1 GB RAM · 25 GB SSD". Falls back to the API's Description when the
-// structured fields are absent.
+// managedSizeSpecs renders the hardware line for a size. The managed_hosting
+// sizes endpoint returns a single human-readable label (e.g. "1 vCPU / 1 GB
+// RAM"); we surface it as-is.
 func managedSizeSpecs(s sdk.ManagedHostingSize) string {
-	if s.VCPUs > 0 {
-		return fmt.Sprintf("%d vCPU · %s RAM · %d GB SSD", s.VCPUs, humanMB(s.Memory), s.Disk)
-	}
-	return s.Description
+	return s.Label
 }
 
 // managedSizeLabel renders a human-friendly one-line label for a size in the
@@ -1448,7 +1445,7 @@ func managedSizeLabel(s sdk.ManagedHostingSize, rank int) string {
 	if specs := managedSizeSpecs(s); specs != "" {
 		parts = append(parts, specs)
 	}
-	parts = append(parts, fmt.Sprintf("$%.2f/mo", s.PriceMonthly))
+	parts = append(parts, fmt.Sprintf("$%.2f/mo", s.MonthlyCost))
 	return fmt.Sprintf("%s  (%s)", strings.Join(parts, " · "), s.Slug)
 }
 
@@ -1480,18 +1477,11 @@ func launchProvisionVPS(ctx context.Context, env *output.Envelope, cfg launchCon
 		// Pick region
 		if region == "" {
 			if len(regions) > 0 {
-				// Pick first available region as default
-				for _, r := range regions {
-					if r.Available {
-						selectedRegion = r
-						region = r.Slug
-						break
-					}
-				}
-				if region == "" {
-					region = regions[0].Slug
-					selectedRegion = regions[0]
-				}
+				// The managed_hosting regions endpoint only returns regions
+				// that can currently be provisioned, so the first one is a
+				// safe default.
+				region = regions[0].Slug
+				selectedRegion = regions[0]
 			} else {
 				region = "lon1"
 			}
@@ -1521,7 +1511,7 @@ func launchProvisionVPS(ctx context.Context, env *output.Envelope, cfg launchCon
 					selectedSize = sizes[0]
 				}
 			}
-			monthlyCostStr = fmt.Sprintf("$%.2f/month", selectedSize.PriceMonthly)
+			monthlyCostStr = fmt.Sprintf("$%.2f/month", selectedSize.MonthlyCost)
 		} else {
 			if size == "" {
 				size = "s-1vcpu-1gb"
@@ -1532,25 +1522,19 @@ func launchProvisionVPS(ctx context.Context, env *output.Envelope, cfg launchCon
 		// Interactive: allow region/size selection
 		if !env.NonInteractive {
 			if len(regions) > 1 {
-				// Keep a parallel slice of the available regions: the prompt only
-				// lists those, so the selected index must map back through this
-				// filtered slice — indexing the full `regions` slice would pick the
-				// wrong region whenever an unavailable one precedes an available one.
-				availableRegions := make([]sdk.ManagedHostingRegion, 0, len(regions))
+				// All returned regions are provisionable, so the picker index
+				// maps directly onto the regions slice.
 				regionItems := make([]string, 0, len(regions))
 				for _, r := range regions {
-					if r.Available {
-						availableRegions = append(availableRegions, r)
-						regionItems = append(regionItems, fmt.Sprintf("%s (%s)", r.Name, r.Slug))
-					}
+					regionItems = append(regionItems, fmt.Sprintf("%s (%s)", r.Name, r.Slug))
 				}
 				regionPrompt := promptui.Select{
 					Label: fmt.Sprintf("Region [%s]", region),
 					Items: regionItems,
 				}
-				if rIdx, _, rErr := regionPrompt.Run(); rErr == nil && rIdx < len(availableRegions) {
-					region = availableRegions[rIdx].Slug
-					selectedRegion = availableRegions[rIdx]
+				if rIdx, _, rErr := regionPrompt.Run(); rErr == nil && rIdx < len(regions) {
+					region = regions[rIdx].Slug
+					selectedRegion = regions[rIdx]
 				}
 			}
 
@@ -1568,7 +1552,7 @@ func launchProvisionVPS(ctx context.Context, env *output.Envelope, cfg launchCon
 				if sIdx, _, sErr2 := sizePrompt.Run(); sErr2 == nil {
 					selectedSize = sizes[sIdx]
 					size = selectedSize.Slug
-					monthlyCostStr = fmt.Sprintf("$%.2f/month", selectedSize.PriceMonthly)
+					monthlyCostStr = fmt.Sprintf("$%.2f/month", selectedSize.MonthlyCost)
 				}
 			}
 		}
diff --git a/internal/commands/launch_test.go b/internal/commands/launch_test.go
index bb0c9c1..4e14d53 100644
--- a/internal/commands/launch_test.go
+++ b/internal/commands/launch_test.go
@@ -422,9 +422,9 @@ func TestHumanMB(t *testing.T) {
 func TestManagedSizeRanksAndTiers(t *testing.T) {
 	// Deliberately out of price order to prove ranking is by price, not position.
 	sizes := []sdk.ManagedHostingSize{
-		{Slug: "mid", PriceMonthly: 12},
-		{Slug: "cheap", PriceMonthly: 6},
-		{Slug: "dear", PriceMonthly: 24},
+		{Slug: "mid", MonthlyCost: 12},
+		{Slug: "cheap", MonthlyCost: 6},
+		{Slug: "dear", MonthlyCost: 24},
 	}
 	ranks := managedSizeRanks(sizes)
 	assert.Equal(t, []int{1, 0, 2}, ranks)
@@ -437,18 +437,16 @@ func TestManagedSizeRanksAndTiers(t *testing.T) {
 }
 
 func TestManagedSizeLabel(t *testing.T) {
-	s := sdk.ManagedHostingSize{Slug: "s-1vcpu-1gb", VCPUs: 1, Memory: 1024, Disk: 25, PriceMonthly: 6}
+	s := sdk.ManagedHostingSize{Slug: "s-1vcpu-1gb", Label: "1 vCPU / 1 GB RAM", MonthlyCost: 6}
 	label := managedSizeLabel(s, 0)
 	assert.Contains(t, label, "Starter")
-	assert.Contains(t, label, "1 vCPU")
-	assert.Contains(t, label, "1 GB RAM")
-	assert.Contains(t, label, "25 GB SSD")
+	assert.Contains(t, label, "1 vCPU / 1 GB RAM")
 	assert.Contains(t, label, "$6.00/mo")
 	assert.Contains(t, label, "(s-1vcpu-1gb)", "slug stays visible for --size discoverability")
 
-	// Missing structured specs → fall back to the API Description, no tier crash.
-	bare := sdk.ManagedHostingSize{Slug: "x", Description: "custom", PriceMonthly: 9}
-	assert.Contains(t, managedSizeLabel(bare, 9), "custom")
+	// No label → tier + price only, no crash.
+	bare := sdk.ManagedHostingSize{Slug: "x", MonthlyCost: 9}
+	assert.Contains(t, managedSizeLabel(bare, 9), "$9.00/mo")
 }
 
 // ── rate_limited (429 provisioning rate limit) ───────────────────────────────
@@ -504,9 +502,9 @@ func TestLaunchVPS_AcceptCostRequired_NonInteractive(t *testing.T) {
 		case "/profile":
 			json.NewEncoder(w).Encode(map[string]interface{}{ //nolint:errcheck
 				"account": map[string]interface{}{
-					"beta_features":          true,
+					"beta_features":           true,
 					"static_hosting_eligible": true,
-					"managed_vps_eligible":   true,
+					"managed_vps_eligible":    true,
 				},
 			})
 		case "/managed_hosting/regions":
@@ -730,9 +728,9 @@ func TestLaunchDryRun_Static_JSON(t *testing.T) {
 		if r.Method == http.MethodGet && r.URL.Path == "/profile" {
 			json.NewEncoder(w).Encode(map[string]interface{}{ //nolint:errcheck
 				"account": map[string]interface{}{
-					"beta_features":          true,
+					"beta_features":           true,
 					"static_hosting_eligible": true,
-					"managed_vps_eligible":   true,
+					"managed_vps_eligible":    true,
 				},
 			})
 			return
@@ -1037,9 +1035,9 @@ func TestLaunchDryRun_NoBetaEnroll(t *testing.T) {
 		if r.Method == http.MethodGet && r.URL.Path == "/profile" {
 			json.NewEncoder(w).Encode(map[string]interface{}{ //nolint:errcheck
 				"account": map[string]interface{}{
-					"beta_features":          false, // not enrolled
+					"beta_features":           false, // not enrolled
 					"static_hosting_eligible": false,
-					"managed_vps_eligible":   false,
+					"managed_vps_eligible":    false,
 				},
 			})
 			return
diff --git a/internal/commands/managed_hosting.go b/internal/commands/managed_hosting.go
new file mode 100644
index 0000000..43a9f42
--- /dev/null
+++ b/internal/commands/managed_hosting.go
@@ -0,0 +1,119 @@
+package commands
+
+import (
+	"fmt"
+
+	"github.com/deployhq/deployhq-cli/internal/output"
+	"github.com/spf13/cobra"
+)
+
+func newManagedHostingCmd() *cobra.Command {
+	cmd := &cobra.Command{
+		Use:     "managed-hosting",
+		Aliases: []string{"managed-vps"},
+		Short:   "Browse Managed VPS regions and sizes",
+		Long: `Read-only catalogue of the regions and droplet sizes available for Managed VPS provisioning. Requires beta_features on the account.
+
+Use these slugs with "dhq launch" or "dhq servers create --region <slug> --size <slug>".`,
+	}
+
+	cmd.AddCommand(
+		newManagedHostingRegionsCmd(),
+		newManagedHostingSizesCmd(),
+	)
+
+	return cmd
+}
+
+func newManagedHostingRegionsCmd() *cobra.Command {
+	return &cobra.Command{
+		Use:   "regions",
+		Short: "List Managed VPS regions",
+		RunE: func(cmd *cobra.Command, args []string) error {
+			client, err := cliCtx.Client()
+			if err != nil {
+				return err
+			}
+
+			rows, err := client.ListManagedHostingRegionRows(cliCtx.Background())
+			if err != nil {
+				return err
+			}
+
+			env := cliCtx.Envelope
+			if env.WantsJSON() {
+				return env.WriteJSON(output.NewResponse(rows,
+					fmt.Sprintf("%d regions", len(rows)),
+				))
+			}
+
+			if env.QuietMode {
+				slugs := make([]string, len(rows))
+				for i, r := range rows {
+					slugs[i] = r.Slug
+				}
+				env.WriteQuiet(slugs)
+				return nil
+			}
+
+			columns := []string{"Group", "Slug", "Name", "Country", "Default?"}
+			tableRows := make([][]string, len(rows))
+			for i, r := range rows {
+				def := ""
+				if r.IsDefault {
+					def = "yes"
+				}
+				tableRows[i] = []string{r.Group, r.Slug, r.Name, r.Country, def}
+			}
+			env.WriteTable(columns, tableRows)
+			return nil
+		},
+	}
+}
+
+func newManagedHostingSizesCmd() *cobra.Command {
+	return &cobra.Command{
+		Use:   "sizes",
+		Short: "List Managed VPS sizes",
+		RunE: func(cmd *cobra.Command, args []string) error {
+			client, err := cliCtx.Client()
+			if err != nil {
+				return err
+			}
+
+			sizes, err := client.ListManagedHostingSizes(cliCtx.Background())
+			if err != nil {
+				return err
+			}
+
+			env := cliCtx.Envelope
+			if env.WantsJSON() {
+				return env.WriteJSON(output.NewResponse(sizes,
+					fmt.Sprintf("%d sizes", len(sizes)),
+				))
+			}
+
+			if env.QuietMode {
+				slugs := make([]string, len(sizes))
+				for i, s := range sizes {
+					slugs[i] = s.Slug
+				}
+				env.WriteQuiet(slugs)
+				return nil
+			}
+
+			columns := []string{"Slug", "Label", "Monthly Cost", "Currency"}
+			tableRows := make([][]string, len(sizes))
+			for i, s := range sizes {
+				tableRows[i] = []string{
+					s.Slug,
+					s.Label,
+					fmt.Sprintf("%.2f", s.MonthlyCost),
+					s.Currency,
+				}
+			}
+			env.WriteTable(columns, tableRows)
+			return nil
+		},
+	}
+}
diff --git a/internal/commands/managed_hosting_test.go b/internal/commands/managed_hosting_test.go
new file mode 100644
index 0000000..163b480
--- /dev/null
+++ b/internal/commands/managed_hosting_test.go
@@ -0,0 +1,29 @@
+package commands
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestManagedHostingCmd_Structure(t *testing.T) {
+	cmd := newManagedHostingCmd()
+	assert.Equal(t, "managed-hosting", cmd.Name())
+
+	want := map[string]bool{"regions": false, "sizes": false}
+	for _, sub := range cmd.Commands() {
+		if _, ok := want[sub.Name()]; ok {
+			want[sub.Name()] = true
+		}
+	}
+	for name, found := range want {
+		assert.Truef(t, found, "missing subcommand %q", name)
+	}
+}
+
+func TestManagedHostingCmd_Help(t *testing.T) {
+	cmd := newManagedHostingCmd()
+	cmd.SetArgs([]string{"--help"})
+	require.NoError(t, cmd.Execute())
+}
diff --git a/internal/commands/packages.go b/internal/commands/packages.go
new file mode 100644
index 0000000..e33653c
--- /dev/null
+++ b/internal/commands/packages.go
@@ -0,0 +1,49 @@
+package commands
+
+import (
+	"fmt"
+	"strconv"
+
+	"github.com/deployhq/deployhq-cli/internal/output"
+	"github.com/spf13/cobra"
+)
+
+func newPlansCmd() *cobra.Command {
+	cmd := &cobra.Command{
+		Use:     "plans",
+		Aliases: []string{"pricing"},
+		Short:   "List DeployHQ subscription plans and pricing",
+		Long: `DeployHQ's subscription plans with pricing localised to your location.
+
+Prices are quoted in the currency inferred from your IP, so they may differ by
+region. This endpoint is public. Use --json to include each plan's feature list.`,
+		RunE: func(cmd *cobra.Command, args []string) error {
+			client, err := cliCtx.PublicClient()
+			if err != nil {
+				return err
+			}
+			plans, err := client.ListPackages(cliCtx.Background())
+			if err != nil {
+				return err
+			}
+			env := cliCtx.Envelope
+			if env.WantsJSON() {
+				return env.WriteJSON(output.NewResponse(plans, fmt.Sprintf("%d plans", len(plans))))
+			}
+			rows := make([][]string, len(plans))
+			for i, p := range plans {
+				rows[i] = []string{
+					p.Permalink,
+					p.Name,
+					strconv.FormatFloat(p.Price, 'f', -1, 64),
+					strconv.FormatFloat(p.PriceBilledAnnually, 'f', -1, 64),
+					p.Currency,
+				}
+			}
+			env.WriteTable([]string{"Permalink", "Name", "Price", "Annual", "Currency"}, rows)
+			env.Status("\nTip: dhq plans --json for each plan's feature list")
+			return nil
+		},
+	}
+	return cmd
+}
diff --git a/internal/commands/projects.go b/internal/commands/projects.go
index d148908..0c04070 100644
--- a/internal/commands/projects.go
+++ b/internal/commands/projects.go
@@ -30,6 +30,9 @@ Use these commands to create, list, configure, and delete projects. Once a proje
 		newProjectsInsightsCmd(),
 		newProjectsUploadKeyCmd(),
 		newProjectsBadgeCmd(),
+		newProjectsRegenerateKeyCmd(),
+		newProjectsUndeployedChangesCmd(),
+		newProjectsAIOverviewCmd(),
 	)
 
 	return cmd
@@ -331,10 +334,10 @@ func newProjectsDeleteCmd() *cobra.Command {
 
 func newProjectsStarCmd() *cobra.Command {
 	return &cobra.Command{
-		Use:     "star [permalink]",
-		Aliases: []string{"fav", "unfav", "favourite", "unfavourite"},
-		Short:   "Toggle project starred/favourite status",
-		Args:    cobra.MaximumNArgs(1),
+		Use:               "star [permalink]",
+		Aliases:           []string{"fav", "unfav", "favourite", "unfavourite"},
+		Short:             "Toggle project starred/favourite status",
+		Args:              cobra.MaximumNArgs(1),
 		ValidArgsFunction: completeProjectNames,
 		RunE: func(cmd *cobra.Command, args []string) error {
 			projectID, err := resolveProjectArg(args)
@@ -466,6 +469,156 @@ func newProjectsBadgeCmd() *cobra.Command {
 	}
 }
 
+func newProjectsRegenerateKeyCmd() *cobra.Command {
+	var keyType string
+
+	cmd := &cobra.Command{
+		Use:               "regenerate-key [permalink]",
+		Short:             "Regenerate the project's SSH deploy key",
+		Args:              cobra.MaximumNArgs(1),
+		ValidArgsFunction: completeProjectNames,
+		Example: `  # Regenerate with the account default key type
+  dhq projects regenerate-key my-app
+
+  # Regenerate as an ED25519 key
+  dhq projects regenerate-key my-app --key-type ED25519`,
+		RunE: func(cmd *cobra.Command, args []string) error {
+			projectID, err := resolveProjectArg(args)
+			if err != nil {
+				return err
+			}
+
+			client, err := cliCtx.Client()
+			if err != nil {
+				return err
+			}
+
+			publicKey, err := client.RegenerateProjectKey(cliCtx.Background(), projectID, keyType)
+			if err != nil {
+				return err
+			}
+
+			env := cliCtx.Envelope
+			if env.WantsJSON() {
+				return env.WriteJSON(output.NewResponse(
+					map[string]string{"public_key": publicKey},
+					fmt.Sprintf("Regenerated deploy key for project: %s", projectID),
+				))
+			}
+
+			env.Status("Regenerated deploy key for project: %s", projectID)
+			env.Status("\nNew public key (add this to your repository's deploy keys):\n")
+			_, err = fmt.Fprintln(cmd.OutOrStdout(), publicKey)
+			return err
+		},
+	}
+
+	cmd.Flags().StringVar(&keyType, "key-type", "", "Key type: ED25519 or RSA (default: account default)")
+	return cmd
+}
+
+func newProjectsUndeployedChangesCmd() *cobra.Command {
+	return &cobra.Command{
+		Use:               "undeployed-changes [permalink]",
+		Short:             "Show commits not yet deployed for a project",
+		Args:              cobra.MaximumNArgs(1),
+		ValidArgsFunction: completeProjectNames,
+		RunE: func(cmd *cobra.Command, args []string) error {
+			projectID, err := resolveProjectArg(args)
+			if err != nil {
+				return err
+			}
+
+			client, err := cliCtx.Client()
+			if err != nil {
+				return err
+			}
+
+			changes, err := client.GetUndeployedChanges(cliCtx.Background(), projectID)
+			if err != nil {
+				return err
+			}
+
+			env := cliCtx.Envelope
+			if env.WantsJSON() {
+				return env.WriteJSON(output.NewResponse(changes,
+					fmt.Sprintf("%d undeployed change(s)", changes.Count),
+					output.Breadcrumb{Action: "deploy", Cmd: fmt.Sprintf("dhq deploy -p %s", projectID)},
+				))
+			}
+
+			env.Status("%d undeployed change(s)", changes.Count)
+			if changes.Truncated {
+				env.Status("(list truncated)")
+			}
+			if len(changes.Commits) > 0 {
+				rows := make([][]string, len(changes.Commits))
+				for i, commit := range changes.Commits {
+					ref := commit.Ref
+					if len(ref) > 8 {
+						ref = ref[:8]
+					}
+					rows[i] = []string{ref, commit.Author, commit.ShortMessage}
+				}
+				env.WriteTable([]string{"Ref", "Author", "Message"}, rows)
+				env.Status("\nTip: dhq deploy -p %s", projectID)
+			}
+			return nil
+		},
+	}
+}
+
+func newProjectsAIOverviewCmd() *cobra.Command {
+	var startRef, endRef string
+
+	cmd := &cobra.Command{
+		Use:               "ai-overview [permalink]",
+		Short:             "Generate an AI summary of changes for a deployment",
+		Args:              cobra.MaximumNArgs(1),
+		ValidArgsFunction: completeProjectNames,
+		Example: `  # Summarize changes up to a revision
+  dhq projects ai-overview my-app --end-ref main
+
+  # Summarize a specific range
+  dhq projects ai-overview my-app --start-ref abc123 --end-ref def456`,
+		RunE: func(cmd *cobra.Command, args []string) error {
+			if endRef == "" {
+				return &output.UserError{Message: "--end-ref is required", Hint: "Use --end-ref <revision>"}
+			}
+
+			projectID, err := resolveProjectArg(args)
+			if err != nil {
+				return err
+			}
+
+			client, err := cliCtx.Client()
+			if err != nil {
+				return err
+			}
+
+			overview, err := client.GenerateAIDeploymentOverview(cliCtx.Background(), projectID, startRef, endRef)
+			if err != nil {
+				return err
+			}
+
+			env := cliCtx.Envelope
+			if env.WantsJSON() {
+				return env.WriteJSON(output.NewResponse(
+					map[string]string{"overview": overview},
+					fmt.Sprintf("AI deployment overview for project: %s", projectID),
+				))
+			}
+
+			_, err = fmt.Fprintln(cmd.OutOrStdout(), overview)
+			return err
+		},
+	}
+
+	cmd.Flags().StringVar(&startRef, "start-ref", "", "Start revision (default: last deployed revision)")
+	cmd.Flags().StringVar(&endRef, "end-ref", "", "End revision (required)")
+	return cmd
+}
+
 // resolveProjectArg gets the project ID from args or --project flag.
 func resolveProjectArg(args []string) (string, error) {
 	if len(args) > 0 {
diff --git a/internal/commands/root.go b/internal/commands/root.go
index 7f9b66b..7b009eb 100644
--- a/internal/commands/root.go
+++ b/internal/commands/root.go
@@ -195,10 +195,17 @@ Support: support@deployhq.com`,
 		newAutoDeploysCmd(),
 		newScheduledDeploysCmd(),
 		newTemplatesCmd(),
+		newHostedResourcesCmd(),
+		newManagedHostingCmd(),
+		newBetaCmd(),
+		newInvoicesCmd(),
+		newIPRangesCmd(),
+		newPlansCmd(),
 		newZonesCmd(),
 
 		// Operations
 		newTestAccessCmd(),
+		newDetectCmd(),
 
 		// Shortcuts
 		newLaunchCmd(),
diff --git a/internal/commands/servers.go b/internal/commands/servers.go
index 4f9aa83..2fb9e7c 100644
--- a/internal/commands/servers.go
+++ b/internal/commands/servers.go
@@ -30,6 +30,8 @@ Use these commands to create, configure, and list the servers attached to a proj
 		newServersUpdateCmd(),
 		newServersDeleteCmd(),
 		newServersResetHostKeyCmd(),
+		newServersFromGlobalCmd(),
+		newServersMetricsCmd(),
 	)
 
 	return cmd
@@ -534,3 +536,91 @@ func newServersResetHostKeyCmd() *cobra.Command {
 		},
 	}
 }
+
+func newServersFromGlobalCmd() *cobra.Command {
+	return &cobra.Command{
+		Use:   "from-global <global-server-id>",
+		Short: "Create a project server from a global server template",
+		Args:  cobra.ExactArgs(1),
+		Example: `  # Add a global server to the current project
+  dhq servers from-global glob-abc123 -p my-app`,
+		RunE: func(cmd *cobra.Command, args []string) error {
+			projectID, err := cliCtx.RequireProject()
+			if err != nil {
+				return err
+			}
+
+			client, err := cliCtx.Client()
+			if err != nil {
+				return err
+			}
+
+			server, err := client.CreateServerFromGlobal(cliCtx.Background(), projectID, args[0])
+			if err != nil {
+				return err
+			}
+
+			env := cliCtx.Envelope
+			if env.WantsJSON() {
+				return env.WriteJSON(output.NewResponse(server,
+					fmt.Sprintf("Created server: %s", server.Name),
+					output.Breadcrumb{Action: "show", Cmd: fmt.Sprintf("dhq servers show %s -p %s", server.Identifier, projectID)},
+					output.Breadcrumb{Action: "deploy", Cmd: fmt.Sprintf("dhq deploy -p %s", projectID)},
+				))
+			}
+			env.Status("Created server: %s (%s)", server.Name, server.Identifier)
+			return nil
+		},
+	}
+}
+
+func newServersMetricsCmd() *cobra.Command {
+	return &cobra.Command{
+		Use:               "metrics <identifier>",
+		Short:             "Show a point-in-time metrics snapshot for a server (beta, SSH only)",
+		Args:              cobra.ExactArgs(1),
+		ValidArgsFunction: completeServerNames,
+		RunE: func(cmd *cobra.Command, args []string) error {
+			projectID, err := cliCtx.RequireProject()
+			if err != nil {
+				return err
+			}
+
+			client, err := cliCtx.Client()
+			if err != nil {
+				return err
+			}
+
+			metrics, err := client.GetServerMetrics(cliCtx.Background(), projectID, args[0])
+			if err != nil {
+				return err
+			}
+
+			env := cliCtx.Envelope
+			if env.WantsJSON() {
+				return env.WriteJSON(output.NewResponse(metrics,
+					fmt.Sprintf("Metrics for server: %s", args[0]),
+				))
+			}
+
+			rows := [][]string{}
+			if metrics.Hostname != "" {
+				rows = append(rows, []string{"Hostname", metrics.Hostname})
+			}
+			if online, ok := metrics.Status["online"].(bool); ok {
+				reachable := "no"
+				if online {
+					reachable = "yes"
+				}
+				rows = append(rows, []string{"Reachable", reachable})
+			}
+			rows = append(rows,
+				[]string{"Uptime", metrics.Uptime.Formatted},
+				[]string{"Partitions", fmt.Sprintf("%d", len(metrics.Disk))},
+			)
+			env.WriteTable([]string{"Field", "Value"}, rows)
+			env.Status("\nMetrics are nested; run with --json for the full status/cpu/memory/disk/profile snapshot.")
+			return nil
+		},
+	}
+}
diff --git a/internal/commands/ssh_commands.go b/internal/commands/ssh_commands.go
index aec9e9e..0f5951d 100644
--- a/internal/commands/ssh_commands.go
+++ b/internal/commands/ssh_commands.go
@@ -64,6 +64,8 @@ Build commands run on the build server; SSH commands run on the deploy target.`,
 		},
 		newSSHCommandsCreateCmd(),
 		newSSHCommandsUpdateCmd(),
+		newSSHCommandsLinkGlobalCmd(),
+		newSSHCommandsUnlinkGlobalCmd(),
 		&cobra.Command{
 			Use: "delete <id>", Short: "Delete an SSH command", Args: cobra.ExactArgs(1),
 			RunE: func(cmd *cobra.Command, args []string) error {
@@ -136,6 +138,65 @@ func newSSHCommandsUpdateCmd() *cobra.Command {
 	return cmd
 }
 
+func newSSHCommandsLinkGlobalCmd() *cobra.Command {
+	return &cobra.Command{
+		Use:   "link-global <command-id>",
+		Short: "Link a global SSH command into this project",
+		Args:  cobra.ExactArgs(1),
+		Example: `  # Link an account-wide SSH command into the current project
+  dhq ssh-commands link-global cmd-abc123 -p my-app`,
+		RunE: func(cmd *cobra.Command, args []string) error {
+			projectID, err := cliCtx.RequireProject()
+			if err != nil {
+				return err
+			}
+			client, err := cliCtx.Client()
+			if err != nil {
+				return err
+			}
+			c, err := client.LinkGlobalCommand(cliCtx.Background(), projectID, args[0])
+			if err != nil {
+				return err
+			}
+			env := cliCtx.Envelope
+			if env.WantsJSON() {
+				return env.WriteJSON(output.NewResponse(c, fmt.Sprintf("Linked global SSH command: %s", c.Identifier)))
+			}
+			env.Status("Linked global SSH command: %s", c.Identifier)
+			return nil
+		},
+	}
+}
+
+func newSSHCommandsUnlinkGlobalCmd() *cobra.Command {
+	return &cobra.Command{
+		Use:   "unlink-global <command-id>",
+		Short: "Unlink a global SSH command from this project",
+		Args:  cobra.ExactArgs(1),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			projectID, err := cliCtx.RequireProject()
+			if err != nil {
+				return err
+			}
+			client, err := cliCtx.Client()
+			if err != nil {
+				return err
+			}
+			if err := client.UnlinkGlobalCommand(cliCtx.Background(), projectID, args[0]); err != nil {
+				return err
+			}
+			env := cliCtx.Envelope
+			if env.WantsJSON() {
+				return env.WriteJSON(output.NewResponse(
+					map[string]string{"command_id": args[0], "status": "unlinked"},
+					fmt.Sprintf("Unlinked: %s", args[0])))
+			}
+			env.Status("Unlinked global SSH command: %s", args[0])
+			return nil
+		},
+	}
+}
+
 func newSSHCommandsCreateCmd() *cobra.Command {
 	var command, description, timing string
 	cmd := &cobra.Command{
diff --git a/internal/commands/templates.go b/internal/commands/templates.go
index 230452b..7ae90d8 100644
--- a/internal/commands/templates.go
+++ b/internal/commands/templates.go
@@ -28,6 +28,10 @@ Apply a template at project creation: "dhq projects create --template <id>".`,
 		newTemplatesDeleteCmd(),
 	)
 
+	// Template sub-resource tree (config-files, servers, build-*, etc.) — each
+	// leaf command takes --template/-t <permalink> to identify the template.
+	cmd.AddCommand(newTemplatesSubresourceCmds()...)
+
 	return cmd
 }
 
diff --git a/internal/commands/templates_subresources.go b/internal/commands/templates_subresources.go
new file mode 100644
index 0000000..4cf0b85
--- /dev/null
+++ b/internal/commands/templates_subresources.go
@@ -0,0 +1,1540 @@
+package commands
+
+import (
+	"fmt"
+
+	"github.com/deployhq/deployhq-cli/internal/output"
+	"github.com/deployhq/deployhq-cli/pkg/sdk"
+	"github.com/spf13/cobra"
+)
+
+// Template sub-resource commands mirror the project-level resources but are
+// nested under a template identified by its permalink. Every command in this
+// tree takes a --template / -t flag (analogous to -p <project> on project-level
+// commands) that resolves to the template permalink used in the API path.
+//
+// These are exposed as standalone constructors so the orchestrator can attach
+// them onto the existing `templates` parent command in root.go without this
+// file editing that shared file.
+
+// addTemplateFlag registers the shared --template / -t flag and returns a
+// pointer to the bound value. Call requireTemplate(cmd, ptr) inside RunE to
+// enforce presence with a consistent error.
+func addTemplateFlag(cmd *cobra.Command, target *string) {
+	cmd.Flags().StringVarP(target, "template", "t", "", "Template permalink (required)")
+}
+
+// requireTemplate validates that a template permalink was supplied.
+func requireTemplate(permalink string) (string, error) {
+	if permalink == "" {
+		return "", &output.UserError{
+			Message: "No template specified",
+			Hint: "Identify the template with its permalink:\n" +
+				"  --template <permalink>   (or -t)\n" +
+				"Find permalinks with 'dhq templates list'.",
+		}
+	}
+	return permalink, nil
+}
+
+// newTemplatesSubresourceCmds returns every template sub-resource parent
+// command. The orchestrator attaches these onto the `templates` command.
+func newTemplatesSubresourceCmds() []*cobra.Command {
+	return []*cobra.Command{
+		newTemplateConfigFilesCmd(),
+		newTemplateExcludedFilesCmd(),
+		newTemplateIntegrationsCmd(),
+		newTemplateCommandsCmd(),
+		newTemplateBuildCommandsCmd(),
+		newTemplateBuildCacheFilesCmd(),
+		newTemplateBuildKnownHostsCmd(),
+		newTemplateBuildLanguagesCmd(),
+		newTemplateBuildConfigurationCmd(),
+		newTemplateServersCmd(),
+		newTemplateServerGroupsCmd(),
+	}
+}
+
+// --- 1. config_files (full CRUD) ---
+
+func newTemplateConfigFilesCmd() *cobra.Command {
+	cmd := &cobra.Command{
+		Use:   "config-files",
+		Short: "Manage config files on a template",
+		Long:  "Config file overrides baked into a template. Copied into new projects created from the template. Requires --template <permalink>.",
+	}
+	cmd.AddCommand(
+		tcfListCmd(), tcfShowCmd(), tcfCreateCmd(), tcfUpdateCmd(), tcfDeleteCmd(),
+	)
+	return cmd
+}
+
+func tcfListCmd() *cobra.Command {
+	var tmpl string
+	cmd := &cobra.Command{
+		Use: "list", Short: "List template config files",
+		RunE: func(cmd *cobra.Command, args []string) error {
+			permalink, err := requireTemplate(tmpl)
+			if err != nil {
+				return err
+			}
+			client, err := cliCtx.Client()
+			if err != nil {
+				return err
+			}
+			files, err := client.ListTemplateConfigFiles(cliCtx.Background(), permalink, nil)
+			if err != nil {
+				return err
+			}
+			env := cliCtx.Envelope
+			if env.WantsJSON() {
+				return env.WriteJSON(output.NewResponse(files, fmt.Sprintf("%d config files", len(files))))
+			}
+			if env.QuietMode {
+				identifiers := make([]string, len(files))
+				for i, f := range files {
+					identifiers[i] = f.Identifier
+				}
+				env.WriteQuiet(identifiers)
+				return nil
+			}
+			rows := make([][]string, len(files))
+			for i, f := range files {
+				rows[i] = []string{f.Identifier, f.Path, f.Description}
+			}
+			env.WriteTable([]string{"Identifier", "Path", "Description"}, rows)
+			return nil
+		},
+	}
+	addTemplateFlag(cmd, &tmpl)
+	return cmd
+}
+
+func tcfShowCmd() *cobra.Command {
+	var tmpl string
+	cmd := &cobra.Command{
+		Use: "show <id>", Short: "Show a template config file", Args: cobra.ExactArgs(1),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			permalink, err := requireTemplate(tmpl)
+			if err != nil {
+				return err
+			}
+			client, err := cliCtx.Client()
+			if err != nil {
+				return err
+			}
+			f, err := client.GetTemplateConfigFile(cliCtx.Background(), permalink, args[0])
+			if err != nil {
+				return err
+			}
+			env := cliCtx.Envelope
+			if env.WantsJSON() {
+				return env.WriteJSON(output.NewResponse(f, f.Path))
+			}
+			env.WriteTable([]string{"Field", "Value"}, [][]string{
+				{"Path", f.Path},
+				{"Description", f.Description},
+				{"Identifier", f.Identifier},
+			})
+			env.Status("\nContent:\n%s", f.Body)
+			return nil
+		},
+	}
+	addTemplateFlag(cmd, &tmpl)
+	return cmd
+}
+
+func tcfCreateCmd() *cobra.Command {
+	var tmpl, path, body, description string
+	cmd := &cobra.Command{
+		Use: "create", Short: "Create a template config file",
+		RunE: func(cmd *cobra.Command, args []string) error {
+			if path == "" || body == "" {
+				return &output.UserError{Message: "Both --path and --body are required"}
+			}
+			permalink, err := requireTemplate(tmpl)
+			if err != nil {
+				return err
+			}
+			client, err := cliCtx.Client()
+			if err != nil {
+				return err
+			}
+			f, err := client.CreateTemplateConfigFile(cliCtx.Background(), permalink, sdk.ConfigFileCreateRequest{
+				Path: path, Body: body, Description: description,
+			})
+			if err != nil {
+				return err
+			}
+			env := cliCtx.Envelope
+			if env.WantsJSON() {
+				return env.WriteJSON(output.NewResponse(f, fmt.Sprintf("Created: %s", f.Path)))
+			}
+			env.Status("Created config file: %s", f.Path)
+			return nil
+		},
+	}
+	addTemplateFlag(cmd, &tmpl)
+	cmd.Flags().StringVar(&path, "path", "", "File path (required)")
+	cmd.Flags().StringVar(&body, "body", "", "File content (required)")
+	cmd.Flags().StringVar(&description, "description", "", "Description")
+	return cmd
+}
+
+func tcfUpdateCmd() *cobra.Command {
+	var tmpl, path, body, description string
+	cmd := &cobra.Command{
+		Use: "update <id>", Short: "Update a template config file", Args: cobra.ExactArgs(1),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			permalink, err := requireTemplate(tmpl)
+			if err != nil {
+				return err
+			}
+			client, err := cliCtx.Client()
+			if err != nil {
+				return err
+			}
+			f, err := client.UpdateTemplateConfigFile(cliCtx.Background(), permalink, args[0], sdk.ConfigFileCreateRequest{
+				Path: path, Body: body, Description: description,
+			})
+			if err != nil {
+				return err
+			}
+			env := cliCtx.Envelope
+			if env.WantsJSON() {
+				return env.WriteJSON(output.NewResponse(f, fmt.Sprintf("Updated: %s", f.Path)))
+			}
+			env.Status("Updated config file: %s", f.Path)
+			return nil
+		},
+	}
+	addTemplateFlag(cmd, &tmpl)
+	cmd.Flags().StringVar(&path, "path", "", "File path")
+	cmd.Flags().StringVar(&body, "body", "", "File content")
+	cmd.Flags().StringVar(&description, "description", "", "Description")
+	return cmd
+}
+
+func tcfDeleteCmd() *cobra.Command {
+	var tmpl string
+	cmd := &cobra.Command{
+		Use: "delete <id>", Short: "Delete a template config file", Args: cobra.ExactArgs(1),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			permalink, err := requireTemplate(tmpl)
+			if err != nil {
+				return err
+			}
+			client, err := cliCtx.Client()
+			if err != nil {
+				return err
+			}
+			if err := client.DeleteTemplateConfigFile(cliCtx.Background(), permalink, args[0]); err != nil {
+				return err
+			}
+			env := cliCtx.Envelope
+			if env.WantsJSON() {
+				return env.WriteJSON(output.NewResponse(map[string]string{"identifier": args[0], "status": "deleted"}, fmt.Sprintf("Deleted: %s", args[0])))
+			}
+			env.Status("Deleted config file: %s", args[0])
+			return nil
+		},
+	}
+	addTemplateFlag(cmd, &tmpl)
+	return cmd
+}
+
+// --- 2. excluded_files (list/create/update/delete — NO show) ---
+
+func newTemplateExcludedFilesCmd() *cobra.Command {
+	cmd := &cobra.Command{
+		Use:   "excluded-files",
+		Short: "Manage excluded files on a template",
+		Long:  "File patterns excluded from deploys, baked into a template. Requires --template <permalink>.",
+	}
+	cmd.AddCommand(tefListCmd(), tefCreateCmd(), tefUpdateCmd(), tefDeleteCmd())
+	return cmd
+}
+
+func tefListCmd() *cobra.Command {
+	var tmpl string
+	cmd := &cobra.Command{
+		Use: "list", Short: "List template excluded files",
+		RunE: func(cmd *cobra.Command, args []string) error {
+			permalink, err := requireTemplate(tmpl)
+			if err != nil {
+				return err
+			}
+			client, err := cliCtx.Client()
+			if err != nil {
+				return err
+			}
+			files, err := client.ListTemplateExcludedFiles(cliCtx.Background(), permalink, nil)
+			if err != nil {
+				return err
+			}
+			env := cliCtx.Envelope
+			if env.WantsJSON() {
+				return env.WriteJSON(output.NewResponse(files, fmt.Sprintf("%d excluded files", len(files))))
+			}
+			if env.QuietMode {
+				identifiers := make([]string, len(files))
+				for i, f := range files {
+					identifiers[i] = f.Identifier
+				}
+				env.WriteQuiet(identifiers)
+				return nil
+			}
+			rows := make([][]string, len(files))
+			for i, f := range files {
+				rows[i] = []string{f.Identifier, f.Path}
+			}
+			env.WriteTable([]string{"Identifier", "Path"}, rows)
+			return nil
+		},
+	}
+	addTemplateFlag(cmd, &tmpl)
+	return cmd
+}
+
+func tefCreateCmd() *cobra.Command {
+	var tmpl, path string
+	cmd := &cobra.Command{
+		Use: "create", Short: "Create a template excluded file",
+		RunE: func(cmd *cobra.Command, args []string) error {
+			if path == "" {
+				return &output.UserError{Message: "--path is required"}
+			}
+			permalink, err := requireTemplate(tmpl)
+			if err != nil {
+				return err
+			}
+			client, err := cliCtx.Client()
+			if err != nil {
+				return err
+			}
+			f, err := client.CreateTemplateExcludedFile(cliCtx.Background(), permalink, sdk.ExcludedFileCreateRequest{Path: path})
+			if err != nil {
+				return err
+			}
+			env := cliCtx.Envelope
+			if env.WantsJSON() {
+				return env.WriteJSON(output.NewResponse(f, fmt.Sprintf("Created: %s", f.Path)))
+			}
+			env.Status("Created excluded file: %s", f.Path)
+			return nil
+		},
+	}
+	addTemplateFlag(cmd, &tmpl)
+	cmd.Flags().StringVar(&path, "path", "", "File pattern (required)")
+	return cmd
+}
+
+func tefUpdateCmd() *cobra.Command {
+	var tmpl, path string
+	cmd := &cobra.Command{
+		Use: "update <id>", Short: "Update a template excluded file", Args: cobra.ExactArgs(1),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			permalink, err := requireTemplate(tmpl)
+			if err != nil {
+				return err
+			}
+			client, err := cliCtx.Client()
+			if err != nil {
+				return err
+			}
+			f, err := client.UpdateTemplateExcludedFile(cliCtx.Background(), permalink, args[0], sdk.ExcludedFileCreateRequest{Path: path})
+			if err != nil {
+				return err
+			}
+			env := cliCtx.Envelope
+			if env.WantsJSON() {
+				return env.WriteJSON(output.NewResponse(f, fmt.Sprintf("Updated: %s", f.Path)))
+			}
+			env.Status("Updated excluded file: %s", f.Path)
+			return nil
+		},
+	}
+	addTemplateFlag(cmd, &tmpl)
+	cmd.Flags().StringVar(&path, "path", "", "File pattern")
+	return cmd
+}
+
+func tefDeleteCmd() *cobra.Command {
+	var tmpl string
+	cmd := &cobra.Command{
+		Use: "delete <id>", Short: "Delete a template excluded file", Args: cobra.ExactArgs(1),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			permalink, err := requireTemplate(tmpl)
+			if err != nil {
+				return err
+			}
+			client, err := cliCtx.Client()
+			if err != nil {
+				return err
+			}
+			if err := client.DeleteTemplateExcludedFile(cliCtx.Background(), permalink, args[0]); err != nil {
+				return err
+			}
+			env := cliCtx.Envelope
+			if env.WantsJSON() {
+				return env.WriteJSON(output.NewResponse(map[string]string{"identifier": args[0], "status": "deleted"}, fmt.Sprintf("Deleted: %s", args[0])))
+			}
+			env.Status("Deleted excluded file: %s", args[0])
+			return nil
+		},
+	}
+	addTemplateFlag(cmd, &tmpl)
+	return cmd
+}
+
+// --- 3. integrations (list/create/update/delete) ---
+
+func newTemplateIntegrationsCmd() *cobra.Command {
+	cmd := &cobra.Command{
+		Use:   "integrations",
+		Short: "Manage integrations on a template",
+		Long:  "Webhook/notification integrations baked into a template. Create is limited to API-creatable hook types; hook_type is immutable on update. Requires --template <permalink>.",
+	}
+	cmd.AddCommand(tintListCmd(), tintCreateCmd(), tintUpdateCmd(), tintDeleteCmd())
+	return cmd
+}
+
+func tintListCmd() *cobra.Command {
+	var tmpl string
+	cmd := &cobra.Command{
+		Use: "list", Short: "List template integrations",
+		RunE: func(cmd *cobra.Command, args []string) error {
+			permalink, err := requireTemplate(tmpl)
+			if err != nil {
+				return err
+			}
+			client, err := cliCtx.Client()
+			if err != nil {
+				return err
+			}
+			ints, err := client.ListTemplateIntegrations(cliCtx.Background(), permalink, nil)
+			if err != nil {
+				return err
+			}
+			env := cliCtx.Envelope
+			if env.WantsJSON() {
+				return env.WriteJSON(output.NewResponse(ints, fmt.Sprintf("%d integrations", len(ints))))
+			}
+			if env.QuietMode {
+				identifiers := make([]string, len(ints))
+				for i, in := range ints {
+					identifiers[i] = in.Identifier
+				}
+				env.WriteQuiet(identifiers)
+				return nil
+			}
+			rows := make([][]string, len(ints))
+			for i, in := range ints {
+				rows[i] = []string{in.Identifier, in.HookType, in.Name}
+			}
+			env.WriteTable([]string{"Identifier", "HookType", "Name"}, rows)
+			return nil
+		},
+	}
+	addTemplateFlag(cmd, &tmpl)
+	return cmd
+}
+
+func tintCreateCmd() *cobra.Command {
+	var tmpl, hookType, name string
+	cmd := &cobra.Command{
+		Use: "create", Short: "Create a template integration",
+		RunE: func(cmd *cobra.Command, args []string) error {
+			if hookType == "" {
+				return &output.UserError{Message: "--hook-type is required"}
+			}
+			permalink, err := requireTemplate(tmpl)
+			if err != nil {
+				return err
+			}
+			client, err := cliCtx.Client()
+			if err != nil {
+				return err
+			}
+			in, err := client.CreateTemplateIntegration(cliCtx.Background(), permalink, sdk.IntegrationCreateRequest{
+				HookType: hookType, Name: name,
+			})
+			if err != nil {
+				return err
+			}
+			env := cliCtx.Envelope
+			if env.WantsJSON() {
+				return env.WriteJSON(output.NewResponse(in, fmt.Sprintf("Created: %s", in.Identifier)))
+			}
+			env.Status("Created integration: %s (%s)", in.HookType, in.Identifier)
+			return nil
+		},
+	}
+	addTemplateFlag(cmd, &tmpl)
+	cmd.Flags().StringVar(&hookType, "hook-type", "", "Hook type (required)")
+	cmd.Flags().StringVar(&name, "name", "", "Integration name")
+	return cmd
+}
+
+func tintUpdateCmd() *cobra.Command {
+	var tmpl, name string
+	cmd := &cobra.Command{
+		Use: "update <id>", Short: "Update a template integration (hook_type is immutable)", Args: cobra.ExactArgs(1),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			permalink, err := requireTemplate(tmpl)
+			if err != nil {
+				return err
+			}
+			client, err := cliCtx.Client()
+			if err != nil {
+				return err
+			}
+			in, err := client.UpdateTemplateIntegration(cliCtx.Background(), permalink, args[0], sdk.IntegrationCreateRequest{Name: name})
+			if err != nil {
+				return err
+			}
+			env := cliCtx.Envelope
+			if env.WantsJSON() {
+				return env.WriteJSON(output.NewResponse(in, fmt.Sprintf("Updated: %s", in.Identifier)))
+			}
+			env.Status("Updated integration: %s", in.Identifier)
+			return nil
+		},
+	}
+	addTemplateFlag(cmd, &tmpl)
+	cmd.Flags().StringVar(&name, "name", "", "Integration name")
+	return cmd
+}
+
+func tintDeleteCmd() *cobra.Command {
+	var tmpl string
+	cmd := &cobra.Command{
+		Use: "delete <id>", Short: "Delete a template integration", Args: cobra.ExactArgs(1),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			permalink, err := requireTemplate(tmpl)
+			if err != nil {
+				return err
+			}
+			client, err := cliCtx.Client()
+			if err != nil {
+				return err
+			}
+			if err := client.DeleteTemplateIntegration(cliCtx.Background(), permalink, args[0]); err != nil {
+				return err
+			}
+			env := cliCtx.Envelope
+			if env.WantsJSON() {
+				return env.WriteJSON(output.NewResponse(map[string]string{"identifier": args[0], "status": "deleted"}, fmt.Sprintf("Deleted: %s", args[0])))
+			}
+			env.Status("Deleted integration: %s", args[0])
+			return nil
+		},
+	}
+	addTemplateFlag(cmd, &tmpl)
+	return cmd
+}
+
+// --- 4. commands (list/create/update/delete) ---
+
+func newTemplateCommandsCmd() *cobra.Command {
+	cmd := &cobra.Command{
+		Use:     "commands",
+		Aliases: []string{"ssh-commands"},
+		Short:   "Manage SSH commands on a template",
+		Long:    "SSH commands run on target servers during deploys, baked into a template. Requires --template <permalink>. (Aliased as 'ssh-commands', which hits the same backend route.)",
+	}
+	cmd.AddCommand(tcmdListCmd(), tcmdCreateCmd(), tcmdUpdateCmd(), tcmdDeleteCmd())
+	return cmd
+}
+
+func tcmdListCmd() *cobra.Command {
+	var tmpl string
+	cmd := &cobra.Command{
+		Use: "list", Short: "List template SSH commands",
+		RunE: func(cmd *cobra.Command, args []string) error {
+			permalink, err := requireTemplate(tmpl)
+			if err != nil {
+				return err
+			}
+			client, err := cliCtx.Client()
+			if err != nil {
+				return err
+			}
+			cmds, err := client.ListTemplateCommands(cliCtx.Background(), permalink, nil)
+			if err != nil {
+				return err
+			}
+			env := cliCtx.Envelope
+			if env.WantsJSON() {
+				return env.WriteJSON(output.NewResponse(cmds, fmt.Sprintf("%d commands", len(cmds))))
+			}
+			if env.QuietMode {
+				identifiers := make([]string, len(cmds))
+				for i, cm := range cmds {
+					identifiers[i] = cm.Identifier
+				}
+				env.WriteQuiet(identifiers)
+				return nil
+			}
+			rows := make([][]string, len(cmds))
+			for i, cm := range cmds {
+				rows[i] = []string{cm.Identifier, cm.Command, cm.Timing}
+			}
+			env.WriteTable([]string{"Identifier", "Command", "Timing"}, rows)
+			return nil
+		},
+	}
+	addTemplateFlag(cmd, &tmpl)
+	return cmd
+}
+
+func tcmdCreateCmd() *cobra.Command {
+	var tmpl, command, description, timing string
+	cmd := &cobra.Command{
+		Use: "create", Short: "Create a template SSH command",
+		RunE: func(cmd *cobra.Command, args []string) error {
+			if command == "" {
+				return &output.UserError{Message: "--command is required"}
+			}
+			permalink, err := requireTemplate(tmpl)
+			if err != nil {
+				return err
+			}
+			client, err := cliCtx.Client()
+			if err != nil {
+				return err
+			}
+			cm, err := client.CreateTemplateCommand(cliCtx.Background(), permalink, sdk.SSHCommandCreateRequest{
+				Command: command, Description: description, Timing: timing,
+			})
+			if err != nil {
+				return err
+			}
+			env := cliCtx.Envelope
+			if env.WantsJSON() {
+				return env.WriteJSON(output.NewResponse(cm, fmt.Sprintf("Created: %s", cm.Identifier)))
+			}
+			env.Status("Created SSH command: %s", cm.Identifier)
+			return nil
+		},
+	}
+	addTemplateFlag(cmd, &tmpl)
+	cmd.Flags().StringVar(&command, "command", "", "Command to run (required)")
+	cmd.Flags().StringVar(&description, "description", "", "Description")
+	cmd.Flags().StringVar(&timing, "timing", "", "Timing (before/after)")
+	return cmd
+}
+
+func tcmdUpdateCmd() *cobra.Command {
+	var tmpl, command, description, timing string
+	cmd := &cobra.Command{
+		Use: "update <id>", Short: "Update a template SSH command", Args: cobra.ExactArgs(1),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			permalink, err := requireTemplate(tmpl)
+			if err != nil {
+				return err
+			}
+			client, err := cliCtx.Client()
+			if err != nil {
+				return err
+			}
+			cm, err := client.UpdateTemplateCommand(cliCtx.Background(), permalink, args[0], sdk.SSHCommandCreateRequest{
+				Command: command, Description: description, Timing: timing,
+			})
+			if err != nil {
+				return err
+			}
+			env := cliCtx.Envelope
+			if env.WantsJSON() {
+				return env.WriteJSON(output.NewResponse(cm, fmt.Sprintf("Updated: %s", cm.Identifier)))
+			}
+			env.Status("Updated SSH command: %s", cm.Identifier)
+			return nil
+		},
+	}
+	addTemplateFlag(cmd, &tmpl)
+	cmd.Flags().StringVar(&command, "command", "", "Command to run")
+	cmd.Flags().StringVar(&description, "description", "", "Description")
+	cmd.Flags().StringVar(&timing, "timing", "", "Timing (before/after)")
+	return cmd
+}
+
+func tcmdDeleteCmd() *cobra.Command {
+	var tmpl string
+	cmd := &cobra.Command{
+		Use: "delete <id>", Short: "Delete a template SSH command", Args: cobra.ExactArgs(1),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			permalink, err := requireTemplate(tmpl)
+			if err != nil {
+				return err
+			}
+			client, err := cliCtx.Client()
+			if err != nil {
+				return err
+			}
+			if err := client.DeleteTemplateCommand(cliCtx.Background(), permalink, args[0]); err != nil {
+				return err
+			}
+			env := cliCtx.Envelope
+			if env.WantsJSON() {
+				return env.WriteJSON(output.NewResponse(map[string]string{"identifier": args[0], "status": "deleted"}, fmt.Sprintf("Deleted: %s", args[0])))
+			}
+			env.Status("Deleted SSH command: %s", args[0])
+			return nil
+		},
+	}
+	addTemplateFlag(cmd, &tmpl)
+	return cmd
+}
+
+// --- 5. build_commands (list/create/update/delete) ---
+
+func newTemplateBuildCommandsCmd() *cobra.Command {
+	cmd := &cobra.Command{
+		Use:   "build-commands",
+		Short: "Manage build commands on a template",
+		Long:  "Build commands run on the build server, baked into a template. Requires --template <permalink>.",
+	}
+	cmd.AddCommand(tbcListCmd(), tbcCreateCmd(), tbcUpdateCmd(), tbcDeleteCmd())
+	return cmd
+}
+
+func tbcListCmd() *cobra.Command {
+	var tmpl string
+	cmd := &cobra.Command{
+		Use: "list", Short: "List template build commands",
+		RunE: func(cmd *cobra.Command, args []string) error {
+			permalink, err := requireTemplate(tmpl)
+			if err != nil {
+				return err
+			}
+			client, err := cliCtx.Client()
+			if err != nil {
+				return err
+			}
+			cmds, err := client.ListTemplateBuildCommands(cliCtx.Background(), permalink, nil)
+			if err != nil {
+				return err
+			}
+			env := cliCtx.Envelope
+			if env.WantsJSON() {
+				return env.WriteJSON(output.NewResponse(cmds, fmt.Sprintf("%d build commands", len(cmds))))
+			}
+			if env.QuietMode {
+				identifiers := make([]string, len(cmds))
+				for i, cm := range cmds {
+					identifiers[i] = cm.Identifier
+				}
+				env.WriteQuiet(identifiers)
+				return nil
+			}
+			rows := make([][]string, len(cmds))
+			for i, cm := range cmds {
+				rows[i] = []string{cm.Identifier, cm.Command, cm.Description}
+			}
+			env.WriteTable([]string{"Identifier", "Command", "Description"}, rows)
+			return nil
+		},
+	}
+	addTemplateFlag(cmd, &tmpl)
+	return cmd
+}
+
+func tbcCreateCmd() *cobra.Command {
+	var tmpl, command, description string
+	cmd := &cobra.Command{
+		Use: "create", Short: "Create a template build command",
+		RunE: func(cmd *cobra.Command, args []string) error {
+			if command == "" {
+				return &output.UserError{Message: "--command is required"}
+			}
+			permalink, err := requireTemplate(tmpl)
+			if err != nil {
+				return err
+			}
+			client, err := cliCtx.Client()
+			if err != nil {
+				return err
+			}
+			cm, err := client.CreateTemplateBuildCommand(cliCtx.Background(), permalink, sdk.BuildCommandCreateRequest{
+				Command: command, Description: description,
+			})
+			if err != nil {
+				return err
+			}
+			env := cliCtx.Envelope
+			if env.WantsJSON() {
+				return env.WriteJSON(output.NewResponse(cm, fmt.Sprintf("Created: %s", cm.Identifier)))
+			}
+			env.Status("Created build command: %s", cm.Identifier)
+			return nil
+		},
+	}
+	addTemplateFlag(cmd, &tmpl)
+	cmd.Flags().StringVar(&command, "command", "", "Command to run (required)")
+	cmd.Flags().StringVar(&description, "description", "", "Description")
+	return cmd
+}
+
+func tbcUpdateCmd() *cobra.Command {
+	var tmpl, command, description string
+	cmd := &cobra.Command{
+		Use: "update <id>", Short: "Update a template build command", Args: cobra.ExactArgs(1),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			permalink, err := requireTemplate(tmpl)
+			if err != nil {
+				return err
+			}
+			client, err := cliCtx.Client()
+			if err != nil {
+				return err
+			}
+			cm, err := client.UpdateTemplateBuildCommand(cliCtx.Background(), permalink, args[0], sdk.BuildCommandCreateRequest{
+				Command: command, Description: description,
+			})
+			if err != nil {
+				return err
+			}
+			env := cliCtx.Envelope
+			if env.WantsJSON() {
+				return env.WriteJSON(output.NewResponse(cm, fmt.Sprintf("Updated: %s", cm.Identifier)))
+			}
+			env.Status("Updated build command: %s", cm.Identifier)
+			return nil
+		},
+	}
+	addTemplateFlag(cmd, &tmpl)
+	cmd.Flags().StringVar(&command, "command", "", "Command to run")
+	cmd.Flags().StringVar(&description, "description", "", "Description")
+	return cmd
+}
+
+func tbcDeleteCmd() *cobra.Command {
+	var tmpl string
+	cmd := &cobra.Command{
+		Use: "delete <id>", Short: "Delete a template build command", Args: cobra.ExactArgs(1),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			permalink, err := requireTemplate(tmpl)
+			if err != nil {
+				return err
+			}
+			client, err := cliCtx.Client()
+			if err != nil {
+				return err
+			}
+			if err := client.DeleteTemplateBuildCommand(cliCtx.Background(), permalink, args[0]); err != nil {
+				return err
+			}
+			env := cliCtx.Envelope
+			if env.WantsJSON() {
+				return env.WriteJSON(output.NewResponse(map[string]string{"identifier": args[0], "status": "deleted"}, fmt.Sprintf("Deleted: %s", args[0])))
+			}
+			env.Status("Deleted build command: %s", args[0])
+			return nil
+		},
+	}
+	addTemplateFlag(cmd, &tmpl)
+	return cmd
+}
+
+// --- 6. build_cache_files (list/create/update/delete) ---
+
+func newTemplateBuildCacheFilesCmd() *cobra.Command {
+	cmd := &cobra.Command{
+		Use:   "build-cache-files",
+		Short: "Manage build cache files on a template",
+		Long:  "Paths cached between builds, baked into a template. Requires --template <permalink>.",
+	}
+	cmd.AddCommand(tbcfListCmd(), tbcfCreateCmd(), tbcfUpdateCmd(), tbcfDeleteCmd())
+	return cmd
+}
+
+func tbcfListCmd() *cobra.Command {
+	var tmpl string
+	cmd := &cobra.Command{
+		Use: "list", Short: "List template build cache files",
+		RunE: func(cmd *cobra.Command, args []string) error {
+			permalink, err := requireTemplate(tmpl)
+			if err != nil {
+				return err
+			}
+			client, err := cliCtx.Client()
+			if err != nil {
+				return err
+			}
+			files, err := client.ListTemplateBuildCacheFiles(cliCtx.Background(), permalink)
+			if err != nil {
+				return err
+			}
+			env := cliCtx.Envelope
+			if env.WantsJSON() {
+				return env.WriteJSON(output.NewResponse(files, fmt.Sprintf("%d build cache files", len(files))))
+			}
+			if env.QuietMode {
+				identifiers := make([]string, len(files))
+				for i, f := range files {
+					identifiers[i] = f.Identifier
+				}
+				env.WriteQuiet(identifiers)
+				return nil
+			}
+			rows := make([][]string, len(files))
+			for i, f := range files {
+				rows[i] = []string{f.Identifier, f.Path}
+			}
+			env.WriteTable([]string{"Identifier", "Path"}, rows)
+			return nil
+		},
+	}
+	addTemplateFlag(cmd, &tmpl)
+	return cmd
+}
+
+func tbcfCreateCmd() *cobra.Command {
+	var tmpl, path string
+	cmd := &cobra.Command{
+		Use: "create", Short: "Create a template build cache file",
+		RunE: func(cmd *cobra.Command, args []string) error {
+			if path == "" {
+				return &output.UserError{Message: "--path is required"}
+			}
+			permalink, err := requireTemplate(tmpl)
+			if err != nil {
+				return err
+			}
+			client, err := cliCtx.Client()
+			if err != nil {
+				return err
+			}
+			f, err := client.CreateTemplateBuildCacheFile(cliCtx.Background(), permalink, sdk.BuildCacheFileCreateRequest{Path: path})
+			if err != nil {
+				return err
+			}
+			env := cliCtx.Envelope
+			if env.WantsJSON() {
+				return env.WriteJSON(output.NewResponse(f, fmt.Sprintf("Created: %s", f.Path)))
+			}
+			env.Status("Created build cache file: %s", f.Path)
+			return nil
+		},
+	}
+	addTemplateFlag(cmd, &tmpl)
+	cmd.Flags().StringVar(&path, "path", "", "Cache path (required)")
+	return cmd
+}
+
+func tbcfUpdateCmd() *cobra.Command {
+	var tmpl, path string
+	cmd := &cobra.Command{
+		Use: "update <id>", Short: "Update a template build cache file", Args: cobra.ExactArgs(1),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			permalink, err := requireTemplate(tmpl)
+			if err != nil {
+				return err
+			}
+			client, err := cliCtx.Client()
+			if err != nil {
+				return err
+			}
+			f, err := client.UpdateTemplateBuildCacheFile(cliCtx.Background(), permalink, args[0], sdk.BuildCacheFileCreateRequest{Path: path})
+			if err != nil {
+				return err
+			}
+			env := cliCtx.Envelope
+			if env.WantsJSON() {
+				return env.WriteJSON(output.NewResponse(f, fmt.Sprintf("Updated: %s", f.Path)))
+			}
+			env.Status("Updated build cache file: %s", f.Path)
+			return nil
+		},
+	}
+	addTemplateFlag(cmd, &tmpl)
+	cmd.Flags().StringVar(&path, "path", "", "Cache path")
+	return cmd
+}
+
+func tbcfDeleteCmd() *cobra.Command {
+	var tmpl string
+	cmd := &cobra.Command{
+		Use: "delete <id>", Short: "Delete a template build cache file", Args: cobra.ExactArgs(1),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			permalink, err := requireTemplate(tmpl)
+			if err != nil {
+				return err
+			}
+			client, err := cliCtx.Client()
+			if err != nil {
+				return err
+			}
+			if err := client.DeleteTemplateBuildCacheFile(cliCtx.Background(), permalink, args[0]); err != nil {
+				return err
+			}
+			env := cliCtx.Envelope
+			if env.WantsJSON() {
+				return env.WriteJSON(output.NewResponse(map[string]string{"identifier": args[0], "status": "deleted"}, fmt.Sprintf("Deleted: %s", args[0])))
+			}
+			env.Status("Deleted build cache file: %s", args[0])
+			return nil
+		},
+	}
+	addTemplateFlag(cmd, &tmpl)
+	return cmd
+}
+
+// --- 7. build_known_hosts (list/create/delete — NO update) ---
+
+func newTemplateBuildKnownHostsCmd() *cobra.Command {
+	cmd := &cobra.Command{
+		Use:   "build-known-hosts",
+		Short: "Manage build known hosts on a template",
+		Long:  "SSH known-host entries for the build server, baked into a template. No update — recreate to change. Requires --template <permalink>.",
+	}
+	cmd.AddCommand(tbkhListCmd(), tbkhCreateCmd(), tbkhDeleteCmd())
+	return cmd
+}
+
+func tbkhListCmd() *cobra.Command {
+	var tmpl string
+	cmd := &cobra.Command{
+		Use: "list", Short: "List template build known hosts",
+		RunE: func(cmd *cobra.Command, args []string) error {
+			permalink, err := requireTemplate(tmpl)
+			if err != nil {
+				return err
+			}
+			client, err := cliCtx.Client()
+			if err != nil {
+				return err
+			}
+			hosts, err := client.ListTemplateBuildKnownHosts(cliCtx.Background(), permalink)
+			if err != nil {
+				return err
+			}
+			env := cliCtx.Envelope
+			if env.WantsJSON() {
+				return env.WriteJSON(output.NewResponse(hosts, fmt.Sprintf("%d known hosts", len(hosts))))
+			}
+			if env.QuietMode {
+				identifiers := make([]string, len(hosts))
+				for i, h := range hosts {
+					identifiers[i] = h.Identifier
+				}
+				env.WriteQuiet(identifiers)
+				return nil
+			}
+			rows := make([][]string, len(hosts))
+			for i, h := range hosts {
+				rows[i] = []string{h.Identifier, h.Hostname}
+			}
+			env.WriteTable([]string{"Identifier", "Hostname"}, rows)
+			return nil
+		},
+	}
+	addTemplateFlag(cmd, &tmpl)
+	return cmd
+}
+
+func tbkhCreateCmd() *cobra.Command {
+	var tmpl, hostname, publicKey string
+	cmd := &cobra.Command{
+		Use: "create", Short: "Create a template build known host",
+		RunE: func(cmd *cobra.Command, args []string) error {
+			if hostname == "" || publicKey == "" {
+				return &output.UserError{Message: "Both --hostname and --public-key are required"}
+			}
+			permalink, err := requireTemplate(tmpl)
+			if err != nil {
+				return err
+			}
+			client, err := cliCtx.Client()
+			if err != nil {
+				return err
+			}
+			h, err := client.CreateTemplateBuildKnownHost(cliCtx.Background(), permalink, sdk.BuildKnownHostCreateRequest{
+				Hostname: hostname, PublicKey: publicKey,
+			})
+			if err != nil {
+				return err
+			}
+			env := cliCtx.Envelope
+			if env.WantsJSON() {
+				return env.WriteJSON(output.NewResponse(h, fmt.Sprintf("Created: %s", h.Hostname)))
+			}
+			env.Status("Created build known host: %s", h.Hostname)
+			return nil
+		},
+	}
+	addTemplateFlag(cmd, &tmpl)
+	cmd.Flags().StringVar(&hostname, "hostname", "", "Hostname (required)")
+	cmd.Flags().StringVar(&publicKey, "public-key", "", "SSH public key (required)")
+	return cmd
+}
+
+func tbkhDeleteCmd() *cobra.Command {
+	var tmpl string
+	cmd := &cobra.Command{
+		Use: "delete <id>", Short: "Delete a template build known host", Args: cobra.ExactArgs(1),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			permalink, err := requireTemplate(tmpl)
+			if err != nil {
+				return err
+			}
+			client, err := cliCtx.Client()
+			if err != nil {
+				return err
+			}
+			if err := client.DeleteTemplateBuildKnownHost(cliCtx.Background(), permalink, args[0]); err != nil {
+				return err
+			}
+			env := cliCtx.Envelope
+			if env.WantsJSON() {
+				return env.WriteJSON(output.NewResponse(map[string]string{"identifier": args[0], "status": "deleted"}, fmt.Sprintf("Deleted: %s", args[0])))
+			}
+			env.Status("Deleted build known host: %s", args[0])
+			return nil
+		},
+	}
+	addTemplateFlag(cmd, &tmpl)
+	return cmd
+}
+
+// --- 8. build_languages (UPDATE/set ONLY; :id = package name) ---
+
+func newTemplateBuildLanguagesCmd() *cobra.Command {
+	cmd := &cobra.Command{
+		Use:   "build-languages",
+		Short: "Manage build language versions on a template",
+		Long:  "Set language versions on a template's default build environment. The <package-name> is the package (e.g. ruby, nodejs). Requires --template <permalink>.",
+	}
+	cmd.AddCommand(tblSetCmd())
+	return cmd
+}
+
+func tblSetCmd() *cobra.Command {
+	var tmpl, version string
+	cmd := &cobra.Command{
+		Use: "set <package-name>", Short: "Set the version for a build language", Args: cobra.ExactArgs(1),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			if version == "" {
+				return &output.UserError{Message: "--version is required"}
+			}
+			permalink, err := requireTemplate(tmpl)
+			if err != nil {
+				return err
+			}
+			client, err := cliCtx.Client()
+			if err != nil {
+				return err
+			}
+			lang, err := client.UpdateTemplateBuildLanguage(cliCtx.Background(), permalink, args[0], sdk.BuildLanguageUpdateRequest{Version: version})
+			if err != nil {
+				return err
+			}
+			env := cliCtx.Envelope
+			if env.WantsJSON() {
+				return env.WriteJSON(output.NewResponse(lang, lang.Name+" "+lang.Version))
+			}
+			env.Status("Set %s to version %s", lang.Name, lang.Version)
+			return nil
+		},
+	}
+	addTemplateFlag(cmd, &tmpl)
+	cmd.Flags().StringVar(&version, "version", "", "Language version (required)")
+	return cmd
+}
+
+// --- 9. build_configuration (SHOW ONLY; singular) ---
+
+func newTemplateBuildConfigurationCmd() *cobra.Command {
+	var tmpl string
+	cmd := &cobra.Command{
+		Use:   "build-configuration",
+		Short: "Show a template's default build environment",
+		Long:  "Show the default build environment (packages) for a template. Requires --template <permalink>.",
+		RunE: func(cmd *cobra.Command, args []string) error {
+			permalink, err := requireTemplate(tmpl)
+			if err != nil {
+				return err
+			}
+			client, err := cliCtx.Client()
+			if err != nil {
+				return err
+			}
+			cfg, err := client.GetTemplateBuildConfiguration(cliCtx.Background(), permalink)
+			if err != nil {
+				return err
+			}
+			env := cliCtx.Envelope
+			if env.WantsJSON() {
+				return env.WriteJSON(output.NewResponse(cfg, "Build configuration"))
+			}
+			rows := make([][]string, 0, len(cfg.Packages))
+			for pkg, ver := range cfg.Packages {
+				rows = append(rows, []string{pkg, ver})
+			}
+			env.WriteTable([]string{"Package", "Version"}, rows)
+			return nil
+		},
+	}
+	addTemplateFlag(cmd, &tmpl)
+	return cmd
+}
+
+// --- 10. servers (full CRUD) ---
+
+func newTemplateServersCmd() *cobra.Command {
+	cmd := &cobra.Command{
+		Use:   "servers",
+		Short: "Manage servers on a template",
+		Long:  "Server definitions baked into a template. Project-only protocols are rejected. Requires --template <permalink>.",
+	}
+	cmd.AddCommand(tsrvListCmd(), tsrvShowCmd(), tsrvCreateCmd(), tsrvUpdateCmd(), tsrvDeleteCmd())
+	return cmd
+}
+
+func tsrvListCmd() *cobra.Command {
+	var tmpl string
+	cmd := &cobra.Command{
+		Use: "list", Short: "List template servers",
+		RunE: func(cmd *cobra.Command, args []string) error {
+			permalink, err := requireTemplate(tmpl)
+			if err != nil {
+				return err
+			}
+			client, err := cliCtx.Client()
+			if err != nil {
+				return err
+			}
+			servers, err := client.ListTemplateServers(cliCtx.Background(), permalink, nil)
+			if err != nil {
+				return err
+			}
+			env := cliCtx.Envelope
+			if env.WantsJSON() {
+				return env.WriteJSON(output.NewResponse(servers, fmt.Sprintf("%d servers", len(servers))))
+			}
+			if env.QuietMode {
+				identifiers := make([]string, len(servers))
+				for i, s := range servers {
+					identifiers[i] = s.Identifier
+				}
+				env.WriteQuiet(identifiers)
+				return nil
+			}
+			rows := make([][]string, len(servers))
+			for i, s := range servers {
+				rows[i] = []string{s.Identifier, s.Name, s.ProtocolType, s.Environment}
+			}
+			env.WriteTable([]string{"Identifier", "Name", "Protocol", "Environment"}, rows)
+			return nil
+		},
+	}
+	addTemplateFlag(cmd, &tmpl)
+	return cmd
+}
+
+func tsrvShowCmd() *cobra.Command {
+	var tmpl string
+	cmd := &cobra.Command{
+		Use: "show <id>", Short: "Show a template server", Args: cobra.ExactArgs(1),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			permalink, err := requireTemplate(tmpl)
+			if err != nil {
+				return err
+			}
+			client, err := cliCtx.Client()
+			if err != nil {
+				return err
+			}
+			s, err := client.GetTemplateServer(cliCtx.Background(), permalink, args[0])
+			if err != nil {
+				return err
+			}
+			env := cliCtx.Envelope
+			if env.WantsJSON() {
+				return env.WriteJSON(output.NewResponse(s, fmt.Sprintf("Server: %s", s.Name)))
+			}
+			env.WriteTable([]string{"Field", "Value"}, [][]string{
+				{"Name", s.Name},
+				{"Identifier", s.Identifier},
+				{"Protocol", s.ProtocolType},
+				{"Environment", s.Environment},
+				{"Server Path", s.ServerPath},
+			})
+			return nil
+		},
+	}
+	addTemplateFlag(cmd, &tmpl)
+	return cmd
+}
+
+func tsrvCreateCmd() *cobra.Command {
+	var tmpl, name, protocolType, serverPath, environment string
+	cmd := &cobra.Command{
+		Use: "create", Short: "Create a template server",
+		RunE: func(cmd *cobra.Command, args []string) error {
+			if name == "" || protocolType == "" {
+				return &output.UserError{Message: "Both --name and --protocol-type are required"}
+			}
+			permalink, err := requireTemplate(tmpl)
+			if err != nil {
+				return err
+			}
+			client, err := cliCtx.Client()
+			if err != nil {
+				return err
+			}
+			s, err := client.CreateTemplateServer(cliCtx.Background(), permalink, sdk.ServerCreateRequest{
+				Name: name, ProtocolType: protocolType, ServerPath: serverPath, Environment: environment,
+			})
+			if err != nil {
+				return err
+			}
+			env := cliCtx.Envelope
+			if env.WantsJSON() {
+				return env.WriteJSON(output.NewResponse(s, fmt.Sprintf("Created: %s", s.Name)))
+			}
+			env.Status("Created server: %s (%s)", s.Name, s.Identifier)
+			return nil
+		},
+	}
+	addTemplateFlag(cmd, &tmpl)
+	cmd.Flags().StringVar(&name, "name", "", "Server name (required)")
+	cmd.Flags().StringVar(&protocolType, "protocol-type", "", "Protocol type (required)")
+	cmd.Flags().StringVar(&serverPath, "server-path", "", "Server path")
+	cmd.Flags().StringVar(&environment, "environment", "", "Environment")
+	return cmd
+}
+
+func tsrvUpdateCmd() *cobra.Command {
+	var tmpl, name, serverPath, environment string
+	cmd := &cobra.Command{
+		Use: "update <id>", Short: "Update a template server", Args: cobra.ExactArgs(1),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			permalink, err := requireTemplate(tmpl)
+			if err != nil {
+				return err
+			}
+			client, err := cliCtx.Client()
+			if err != nil {
+				return err
+			}
+			s, err := client.UpdateTemplateServer(cliCtx.Background(), permalink, args[0], sdk.ServerUpdateRequest{
+				Name: name, ServerPath: serverPath, Environment: environment,
+			})
+			if err != nil {
+				return err
+			}
+			env := cliCtx.Envelope
+			if env.WantsJSON() {
+				return env.WriteJSON(output.NewResponse(s, fmt.Sprintf("Updated: %s", s.Name)))
+			}
+			env.Status("Updated server: %s", s.Name)
+			return nil
+		},
+	}
+	addTemplateFlag(cmd, &tmpl)
+	cmd.Flags().StringVar(&name, "name", "", "Server name")
+	cmd.Flags().StringVar(&serverPath, "server-path", "", "Server path")
+	cmd.Flags().StringVar(&environment, "environment", "", "Environment")
+	return cmd
+}
+
+func tsrvDeleteCmd() *cobra.Command {
+	var tmpl string
+	cmd := &cobra.Command{
+		Use: "delete <id>", Short: "Delete a template server", Args: cobra.ExactArgs(1),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			permalink, err := requireTemplate(tmpl)
+			if err != nil {
+				return err
+			}
+			client, err := cliCtx.Client()
+			if err != nil {
+				return err
+			}
+			if err := client.DeleteTemplateServer(cliCtx.Background(), permalink, args[0]); err != nil {
+				return err
+			}
+			env := cliCtx.Envelope
+			if env.WantsJSON() {
+				return env.WriteJSON(output.NewResponse(map[string]string{"identifier": args[0], "status": "deleted"}, fmt.Sprintf("Deleted: %s", args[0])))
+			}
+			env.Status("Deleted server: %s", args[0])
+			return nil
+		},
+	}
+	addTemplateFlag(cmd, &tmpl)
+	return cmd
+}
+
+// --- 11. server_groups (list/create/update/delete — NO show) ---
+
+func newTemplateServerGroupsCmd() *cobra.Command {
+	cmd := &cobra.Command{
+		Use:     "server-groups",
+		Aliases: []string{"sg"},
+		Short:   "Manage server groups on a template",
+		Long:    "Server groups baked into a template. Requires --template <permalink>.",
+	}
+	cmd.AddCommand(tsgListCmd(), tsgCreateCmd(), tsgUpdateCmd(), tsgDeleteCmd())
+	return cmd
+}
+
+func tsgListCmd() *cobra.Command {
+	var tmpl string
+	cmd := &cobra.Command{
+		Use: "list", Short: "List template server groups",
+		RunE: func(cmd *cobra.Command, args []string) error {
+			permalink, err := requireTemplate(tmpl)
+			if err != nil {
+				return err
+			}
+			client, err := cliCtx.Client()
+			if err != nil {
+				return err
+			}
+			groups, err := client.ListTemplateServerGroups(cliCtx.Background(), permalink, nil)
+			if err != nil {
+				return err
+			}
+			env := cliCtx.Envelope
+			if env.WantsJSON() {
+				return env.WriteJSON(output.NewResponse(groups, fmt.Sprintf("%d server groups", len(groups))))
+			}
+			if env.QuietMode {
+				identifiers := make([]string, len(groups))
+				for i, g := range groups {
+					identifiers[i] = g.Identifier
+				}
+				env.WriteQuiet(identifiers)
+				return nil
+			}
+			rows := make([][]string, len(groups))
+			for i, g := range groups {
+				rows[i] = []string{g.Identifier, g.Name, g.Environment}
+			}
+			env.WriteTable([]string{"Identifier", "Name", "Environment"}, rows)
+			return nil
+		},
+	}
+	addTemplateFlag(cmd, &tmpl)
+	return cmd
+}
+
+func tsgCreateCmd() *cobra.Command {
+	var tmpl, name, environment, transferOrder, emailNotifyOn, notificationEmail string
+	var autoDeploy bool
+	cmd := &cobra.Command{
+		Use: "create", Short: "Create a template server group",
+		RunE: func(cmd *cobra.Command, args []string) error {
+			if name == "" {
+				return &output.UserError{Message: "--name is required"}
+			}
+			permalink, err := requireTemplate(tmpl)
+			if err != nil {
+				return err
+			}
+			client, err := cliCtx.Client()
+			if err != nil {
+				return err
+			}
+			req := sdk.TemplateServerGroupCreateRequest{
+				Name: name, Environment: environment, TransferOrder: transferOrder,
+				EmailNotifyOn: emailNotifyOn, NotificationEmail: notificationEmail,
+			}
+			if cmd.Flags().Changed("auto-deploy") {
+				req.AutoDeploy = &autoDeploy
+			}
+			g, err := client.CreateTemplateServerGroup(cliCtx.Background(), permalink, req)
+			if err != nil {
+				return err
+			}
+			env := cliCtx.Envelope
+			if env.WantsJSON() {
+				return env.WriteJSON(output.NewResponse(g, fmt.Sprintf("Created: %s", g.Name)))
+			}
+			env.Status("Created server group: %s (%s)", g.Name, g.Identifier)
+			return nil
+		},
+	}
+	addTemplateFlag(cmd, &tmpl)
+	cmd.Flags().StringVar(&name, "name", "", "Server group name (required)")
+	cmd.Flags().StringVar(&environment, "environment", "", "Environment")
+	cmd.Flags().StringVar(&transferOrder, "transfer-order", "", "Transfer order")
+	cmd.Flags().StringVar(&emailNotifyOn, "email-notify-on", "", "Email notify on (event)")
+	cmd.Flags().StringVar(&notificationEmail, "notification-email", "", "Notification email")
+	cmd.Flags().BoolVar(&autoDeploy, "auto-deploy", false, "Enable auto-deploy")
+	return cmd
+}
+
+func tsgUpdateCmd() *cobra.Command {
+	var tmpl, name, environment, transferOrder, emailNotifyOn, notificationEmail string
+	var autoDeploy bool
+	cmd := &cobra.Command{
+		Use: "update <id>", Short: "Update a template server group", Args: cobra.ExactArgs(1),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			permalink, err := requireTemplate(tmpl)
+			if err != nil {
+				return err
+			}
+			client, err := cliCtx.Client()
+			if err != nil {
+				return err
+			}
+			req := sdk.TemplateServerGroupUpdateRequest{
+				Name: name, Environment: environment, TransferOrder: transferOrder,
+				EmailNotifyOn: emailNotifyOn, NotificationEmail: notificationEmail,
+			}
+			if cmd.Flags().Changed("auto-deploy") {
+				req.AutoDeploy = &autoDeploy
+			}
+			g, err := client.UpdateTemplateServerGroup(cliCtx.Background(), permalink, args[0], req)
+			if err != nil {
+				return err
+			}
+			env := cliCtx.Envelope
+			if env.WantsJSON() {
+				return env.WriteJSON(output.NewResponse(g, fmt.Sprintf("Updated: %s", g.Name)))
+			}
+			env.Status("Updated server group: %s", g.Name)
+			return nil
+		},
+	}
+	addTemplateFlag(cmd, &tmpl)
+	cmd.Flags().StringVar(&name, "name", "", "Server group name")
+	cmd.Flags().StringVar(&environment, "environment", "", "Environment")
+	cmd.Flags().StringVar(&transferOrder, "transfer-order", "", "Transfer order")
+	cmd.Flags().StringVar(&emailNotifyOn, "email-notify-on", "", "Email notify on (event)")
+	cmd.Flags().StringVar(&notificationEmail, "notification-email", "", "Notification email")
+	cmd.Flags().BoolVar(&autoDeploy, "auto-deploy", false, "Enable auto-deploy")
+	return cmd
+}
+
+func tsgDeleteCmd() *cobra.Command {
+	var tmpl string
+	cmd := &cobra.Command{
+		Use: "delete <id>", Short: "Delete a template server group", Args: cobra.ExactArgs(1),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			permalink, err := requireTemplate(tmpl)
+			if err != nil {
+				return err
+			}
+			client, err := cliCtx.Client()
+			if err != nil {
+				return err
+			}
+			if err := client.DeleteTemplateServerGroup(cliCtx.Background(), permalink, args[0]); err != nil {
+				return err
+			}
+			env := cliCtx.Envelope
+			if env.WantsJSON() {
+				return env.WriteJSON(output.NewResponse(map[string]string{"identifier": args[0], "status": "deleted"}, fmt.Sprintf("Deleted: %s", args[0])))
+			}
+			env.Status("Deleted server group: %s", args[0])
+			return nil
+		},
+	}
+	addTemplateFlag(cmd, &tmpl)
+	return cmd
+}
diff --git a/pkg/sdk/client.go b/pkg/sdk/client.go
index 1e00fb8..f45f413 100644
--- a/pkg/sdk/client.go
+++ b/pkg/sdk/client.go
@@ -66,15 +66,33 @@ func WithBaseURL(rawURL string) Option {
 // account is the subdomain (e.g. "mycompany" for mycompany.deployhq.com).
 // email and apiKey are used for HTTP Basic authentication.
 func New(account, email, apiKey string, opts ...Option) (*Client, error) {
-	if account == "" {
-		return nil, fmt.Errorf("deployhq: account is required")
-	}
 	if email == "" {
 		return nil, fmt.Errorf("deployhq: email is required")
 	}
 	if apiKey == "" {
 		return nil, fmt.Errorf("deployhq: api key is required")
 	}
+	return newClient(account, email, apiKey, opts...)
+}
+
+// NewPublic creates a DeployHQ API client for the public, no-auth endpoints
+// (e.g. GET /ip_ranges and GET /packages). These return 200 without HTTP
+// Basic authentication, so email and apiKey are left empty and no
+// Authorization header is meaningfully populated (an empty one is harmless
+// and ignored by the server).
+//
+// An account is still required because every request targets the account's
+// subdomain (https://<account>.deployhq.com/...).
+func NewPublic(account string, opts ...Option) (*Client, error) {
+	return newClient(account, "", "", opts...)
+}
+
+// newClient builds a Client. account is always required; email/apiKey may be
+// empty for public (no-auth) endpoints — callers enforce their own validation.
+func newClient(account, email, apiKey string, opts ...Option) (*Client, error) {
+	if account == "" {
+		return nil, fmt.Errorf("deployhq: account is required")
+	}
 
 	// Tolerate users passing a full hostname (e.g. "mycompany.deployhq.com")
 	// instead of just the subdomain — otherwise we'd build .deployhq.com.deployhq.com.
diff --git a/pkg/sdk/client_test.go b/pkg/sdk/client_test.go
index ef2617e..c00cc4d 100644
--- a/pkg/sdk/client_test.go
+++ b/pkg/sdk/client_test.go
@@ -56,6 +56,65 @@ func TestNew(t *testing.T) {
 	})
 }
 
+func TestNewPublic(t *testing.T) {
+	t.Run("valid without credentials", func(t *testing.T) {
+		c, err := NewPublic("myco")
+		require.NoError(t, err)
+		assert.Equal(t, "https://myco.deployhq.com", c.baseURL.String())
+		assert.Empty(t, c.email)
+		assert.Empty(t, c.apiKey)
+	})
+
+	t.Run("missing account", func(t *testing.T) {
+		_, err := NewPublic("")
+		assert.Error(t, err)
+		assert.Contains(t, err.Error(), "account is required")
+	})
+}
+
+// newPublicTestClient creates a public (no-auth) Client pointed at the test server.
+func newPublicTestClient(t *testing.T, server *httptest.Server) *Client {
+	t.Helper()
+	c, err := NewPublic("test")
+	require.NoError(t, err)
+	c.baseURL = mustParseURL(t, server.URL)
+	c.httpClient = server.Client()
+	return c
+}
+
+// TestPublicClient_NoAuth verifies the public client works against a server
+// that requires no Authorization header (the empty header it sends is ignored).
+func TestPublicClient_NoAuth(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		// An empty basic-auth header (or none) must be acceptable — the
+		// server does not require credentials for these public endpoints.
+		user, pass, _ := r.BasicAuth()
+		assert.Empty(t, user)
+		assert.Empty(t, pass)
+
+		switch r.URL.Path {
+		case "/ip_ranges":
+			_ = json.NewEncoder(w).Encode(IPRanges{AllIPv4: []string{"1.2.3.0/24"}})
+		case "/packages":
+			_ = json.NewEncoder(w).Encode([]Package{{Permalink: "pro", Name: "Pro"}})
+		default:
+			w.WriteHeader(http.StatusNotFound)
+		}
+	}))
+	defer server.Close()
+
+	c := newPublicTestClient(t, server)
+
+	ranges, err := c.GetIPRanges(context.Background())
+	require.NoError(t, err)
+	assert.Equal(t, []string{"1.2.3.0/24"}, ranges.AllIPv4)
+
+	pkgs, err := c.ListPackages(context.Background())
+	require.NoError(t, err)
+	require.Len(t, pkgs, 1)
+	assert.Equal(t, "pro", pkgs[0].Permalink)
+}
+
 func TestClient_BasicAuth(t *testing.T) {
 	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		user, pass, ok := r.BasicAuth()
diff --git a/pkg/sdk/config_files.go b/pkg/sdk/config_files.go
index c3938b0..aa2f2ca 100644
--- a/pkg/sdk/config_files.go
+++ b/pkg/sdk/config_files.go
@@ -3,15 +3,16 @@ package sdk
 import (
 	"context"
 	"fmt"
+	"net/http"
 )
 
 // ConfigFile represents a project config file.
 type ConfigFile struct {
-	Identifier  string   `json:"identifier"`
-	Description string   `json:"description"`
-	Path        string   `json:"path"`
-	Body        string   `json:"body"`
-	Build       bool     `json:"build"`
+	Identifier  string        `json:"identifier"`
+	Description string        `json:"description"`
+	Path        string        `json:"path"`
+	Body        string        `json:"body"`
+	Build       bool          `json:"build"`
 	Servers     []interface{} `json:"servers,omitempty"`
 }
 
@@ -65,3 +66,25 @@ func (c *Client) UpdateConfigFile(ctx context.Context, projectID, fileID string,
 func (c *Client) DeleteConfigFile(ctx context.Context, projectID, fileID string) error {
 	return c.delete(ctx, fmt.Sprintf("/projects/%s/config_files/%s", projectID, fileID))
 }
+
+// LinkGlobalConfigFile links an account-wide global config file into a project.
+// The request body is FLAT (top-level config_file_id), not wrapped.
+func (c *Client) LinkGlobalConfigFile(ctx context.Context, projectID, configFileID string) (*ConfigFile, error) {
+	body := struct {
+		ConfigFileID string `json:"config_file_id"`
+	}{ConfigFileID: configFileID}
+	var file ConfigFile
+	if err := c.post(ctx, fmt.Sprintf("/projects/%s/config_files/link_global", projectID), body, &file); err != nil {
+		return nil, err
+	}
+	return &file, nil
+}
+
+// UnlinkGlobalConfigFile removes the link between a project and a global config
+// file. This is a DELETE request that carries a FLAT body.
+func (c *Client) UnlinkGlobalConfigFile(ctx context.Context, projectID, configFileID string) error {
+	body := struct {
+		ConfigFileID string `json:"config_file_id"`
+	}{ConfigFileID: configFileID}
+	return c.do(ctx, http.MethodDelete, fmt.Sprintf("/projects/%s/config_files/unlink_global", projectID), body, nil)
+}
diff --git a/pkg/sdk/config_files_test.go b/pkg/sdk/config_files_test.go
new file mode 100644
index 0000000..183edce
--- /dev/null
+++ b/pkg/sdk/config_files_test.go
@@ -0,0 +1,56 @@
+package sdk
+
+import (
+	"context"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestLinkGlobalConfigFile(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		assert.Equal(t, http.MethodPost, r.Method)
+		assert.Equal(t, "/projects/my-app/config_files/link_global", r.URL.Path)
+
+		// Body must be FLAT (top-level config_file_id).
+		var body map[string]string
+		require.NoError(t, json.NewDecoder(r.Body).Decode(&body))
+		assert.Equal(t, "cfg-1", body["config_file_id"])
+		_, hasWrapper := body["config_file"]
+		assert.False(t, hasWrapper, "body should be flat, not wrapped in config_file")
+
+		w.WriteHeader(http.StatusCreated)
+		_ = json.NewEncoder(w).Encode(ConfigFile{Identifier: "cfg-1", Path: "/etc/app.conf", Description: "Linked"})
+	}))
+	defer server.Close()
+
+	c := newTestClient(t, server)
+	f, err := c.LinkGlobalConfigFile(context.Background(), "my-app", "cfg-1")
+	require.NoError(t, err)
+	assert.Equal(t, "cfg-1", f.Identifier)
+	assert.Equal(t, "/etc/app.conf", f.Path)
+}
+
+func TestUnlinkGlobalConfigFile(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		assert.Equal(t, http.MethodDelete, r.Method)
+		assert.Equal(t, "/projects/my-app/config_files/unlink_global", r.URL.Path)
+
+		// DELETE carries a FLAT body.
+		var body map[string]string
+		require.NoError(t, json.NewDecoder(r.Body).Decode(&body))
+		assert.Equal(t, "cfg-1", body["config_file_id"])
+
+		w.WriteHeader(http.StatusOK)
+		_ = json.NewEncoder(w).Encode(map[string]string{"status": "deleted"})
+	}))
+	defer server.Close()
+
+	c := newTestClient(t, server)
+	err := c.UnlinkGlobalConfigFile(context.Background(), "my-app", "cfg-1")
+	require.NoError(t, err)
+}
diff --git a/pkg/sdk/hosted_resources.go b/pkg/sdk/hosted_resources.go
new file mode 100644
index 0000000..1daf6ae
--- /dev/null
+++ b/pkg/sdk/hosted_resources.go
@@ -0,0 +1,106 @@
+package sdk
+
+import (
+	"context"
+	"fmt"
+)
+
+// HostedResourceSSHKey is the SSH key pair attached to a Managed VPS hosted
+// resource. It mirrors the account-level SSHKey shape.
+type HostedResourceSSHKey struct {
+	Identifier  string `json:"identifier"`
+	Title       string `json:"title"`
+	PublicKey   string `json:"public_key"`
+	KeyType     string `json:"key_type"`
+	Fingerprint string `json:"fingerprint"`
+	Account     string `json:"account"`
+}
+
+// HostedResource is a managed hosting resource. The API returns two kinds of
+// object in a single collection, discriminated by the Kind field:
+//
+//   - kind == "hosted_resource": a Managed VPS droplet (Region, Size, IPAddress,
+//     SSHKey are populated).
+//   - kind == "hosted_website":  a Static Hosting website (Subdomain, SPAMode,
+//     StorageBytesTotal, ActiveDeploymentUUID, DeploymentCount are populated).
+//
+// Both shapes are modelled by this single struct; fields absent for a given
+// kind are omitted from the JSON and decode to their zero values.
+type HostedResource struct {
+	// Kind discriminates the resource: "hosted_resource" or "hosted_website".
+	Kind string `json:"kind"`
+	// Identifier is the opaque string identifier used in the show/action routes.
+	Identifier string `json:"identifier"`
+	// Name is the human-readable resource name.
+	Name string `json:"name"`
+	// Status is the provisioning lifecycle status:
+	// provisioning|active|suspended|error|destroying|disabled.
+	Status string `json:"status"`
+	// MonthlyCost is the monthly cost in the account's billing currency.
+	MonthlyCost float64 `json:"monthly_cost"`
+
+	// --- hosted_resource (Managed VPS) fields ---
+
+	// Region is the DigitalOcean region slug (nullable → pointer).
+	Region *string `json:"region,omitempty"`
+	// Size is the droplet size slug (nullable → pointer).
+	Size *string `json:"size,omitempty"`
+	// IPAddress is the public IP once provisioned (nullable → pointer).
+	IPAddress *string `json:"ip_address,omitempty"`
+	// SSHKey is the attached SSH key pair (nil when none).
+	SSHKey *HostedResourceSSHKey `json:"ssh_key,omitempty"`
+
+	// --- hosted_website (Static Hosting) fields ---
+
+	// Subdomain is the deployhq-sites subdomain for a hosted_website.
+	Subdomain string `json:"subdomain,omitempty"`
+	// SPAMode indicates single-page-app fallback routing for a hosted_website.
+	SPAMode bool `json:"spa_mode,omitempty"`
+	// StorageBytesTotal is the total stored bytes for a hosted_website.
+	StorageBytesTotal int `json:"storage_bytes_total,omitempty"`
+	// ActiveDeploymentUUID is the UUID of the live deployment (nullable → pointer).
+	ActiveDeploymentUUID *string `json:"active_deployment_uuid,omitempty"`
+	// DeploymentCount is the number of deployments for a hosted_website.
+	DeploymentCount int `json:"deployment_count,omitempty"`
+
+	// --- common timestamps ---
+
+	CreatedAt string `json:"created_at,omitempty"`
+	UpdatedAt string `json:"updated_at,omitempty"`
+}
+
+// ListHostedResources returns all managed hosting resources for the account —
+// both Managed VPS resources (kind "hosted_resource") and Static Hosting
+// websites (kind "hosted_website"). The endpoint is gated by admin +
+// beta_features; callers without both receive a 403.
+func (c *Client) ListHostedResources(ctx context.Context, opts *ListOptions) ([]HostedResource, error) {
+	var resources []HostedResource
+	path := appendListParams("/hosted_resources", opts)
+	if err := c.get(ctx, path, &resources); err != nil {
+		return nil, err
+	}
+	return resources, nil
+}
+
+// GetHostedResource returns a single hosted resource by its string identifier.
+func (c *Client) GetHostedResource(ctx context.Context, id string) (*HostedResource, error) {
+	var resource HostedResource
+	if err := c.get(ctx, fmt.Sprintf("/hosted_resources/%s", id), &resource); err != nil {
+		return nil, err
+	}
+	return &resource, nil
+}
+
+// SyncHostedResource requests a re-sync of the hosted resource's provisioning
+// state from the upstream provider. POSTs with no request body; the 200 response
+// carries {"status":"sync_requested"} which is not surfaced.
+func (c *Client) SyncHostedResource(ctx context.Context, id string) error {
+	return c.post(ctx, fmt.Sprintf("/hosted_resources/%s/sync", id), nil, nil)
+}
+
+// RetryProvisionHostedResource retries provisioning of a resource that is in
+// the "error" state. POSTs with no request body; the 200 response carries
+// {"status":"provisioning"}. A resource not in the error state returns a 422.
+func (c *Client) RetryProvisionHostedResource(ctx context.Context, id string) error {
+	return c.post(ctx, fmt.Sprintf("/hosted_resources/%s/retry_provision", id), nil, nil)
+}
diff --git a/pkg/sdk/hosted_resources_test.go b/pkg/sdk/hosted_resources_test.go
new file mode 100644
index 0000000..9cc5860
--- /dev/null
+++ b/pkg/sdk/hosted_resources_test.go
@@ -0,0 +1,198 @@
+package sdk
+
+import (
+	"context"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestListHostedResources(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		assert.Equal(t, "/hosted_resources", r.URL.Path)
+		assert.Equal(t, http.MethodGet, r.Method)
+		// Top-level JSON array unioning both kinds.
+		_, _ = w.Write([]byte(`[
+			{
+				"kind": "hosted_resource",
+				"identifier": "hr-1",
+				"name": "my-vps",
+				"region": "lon1",
+				"size": "s-1vcpu-1gb",
+				"status": "active",
+				"ip_address": "203.0.113.10",
+				"monthly_cost": 6.0,
+				"ssh_key": {
+					"identifier": "key-1",
+					"title": "vps key",
+					"public_key": "ssh-ed25519 AAAA",
+					"key_type": "ed25519",
+					"fingerprint": "aa:bb:cc",
+					"account": "acme"
+				},
+				"created_at": "2026-01-01T00:00:00Z",
+				"updated_at": "2026-01-02T00:00:00Z"
+			},
+			{
+				"kind": "hosted_website",
+				"identifier": "hw-1",
+				"name": "my-site",
+				"subdomain": "my-site",
+				"status": "provisioning",
+				"monthly_cost": 0.0,
+				"spa_mode": true,
+				"storage_bytes_total": 1048576,
+				"active_deployment_uuid": null,
+				"deployment_count": 3,
+				"created_at": "2026-01-03T00:00:00Z",
+				"updated_at": "2026-01-04T00:00:00Z"
+			},
+			{
+				"kind": "hosted_resource",
+				"identifier": "hr-2",
+				"name": "pending-vps",
+				"region": null,
+				"size": null,
+				"status": "provisioning",
+				"ip_address": null,
+				"monthly_cost": 12.0,
+				"ssh_key": null,
+				"created_at": "2026-01-05T00:00:00Z",
+				"updated_at": "2026-01-05T00:00:00Z"
+			}
+		]`))
+	}))
+	defer server.Close()
+
+	c := newTestClient(t, server)
+	resources, err := c.ListHostedResources(context.Background(), nil)
+	require.NoError(t, err)
+	require.Len(t, resources, 3)
+
+	// hosted_resource with populated nullable fields + ssh_key.
+	vps := resources[0]
+	assert.Equal(t, "hosted_resource", vps.Kind)
+	assert.Equal(t, "hr-1", vps.Identifier)
+	assert.Equal(t, "active", vps.Status)
+	assert.Equal(t, 6.0, vps.MonthlyCost)
+	require.NotNil(t, vps.Region)
+	assert.Equal(t, "lon1", *vps.Region)
+	require.NotNil(t, vps.IPAddress)
+	assert.Equal(t, "203.0.113.10", *vps.IPAddress)
+	require.NotNil(t, vps.SSHKey)
+	assert.Equal(t, "key-1", vps.SSHKey.Identifier)
+	assert.Equal(t, "ed25519", vps.SSHKey.KeyType)
+
+	// hosted_website discriminated by kind.
+	site := resources[1]
+	assert.Equal(t, "hosted_website", site.Kind)
+	assert.Equal(t, "my-site", site.Subdomain)
+	assert.True(t, site.SPAMode)
+	assert.Equal(t, 1048576, site.StorageBytesTotal)
+	assert.Equal(t, 3, site.DeploymentCount)
+	assert.Nil(t, site.ActiveDeploymentUUID)
+	assert.Empty(t, site.Region) // region pointer is nil for websites
+
+	// hosted_resource with null nullable fields.
+	pending := resources[2]
+	assert.Nil(t, pending.Region)
+	assert.Nil(t, pending.Size)
+	assert.Nil(t, pending.IPAddress)
+	assert.Nil(t, pending.SSHKey)
+}
+
+func TestGetHostedResource(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		assert.Equal(t, "/hosted_resources/hr-1", r.URL.Path)
+		assert.Equal(t, http.MethodGet, r.Method)
+		_ = json.NewEncoder(w).Encode(HostedResource{
+			Kind:       "hosted_resource",
+			Identifier: "hr-1",
+			Name:       "my-vps",
+			Status:     "active",
+		})
+	}))
+	defer server.Close()
+
+	c := newTestClient(t, server)
+	res, err := c.GetHostedResource(context.Background(), "hr-1")
+	require.NoError(t, err)
+	assert.Equal(t, "hr-1", res.Identifier)
+	assert.Equal(t, "hosted_resource", res.Kind)
+}
+
+func TestSyncHostedResource(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		assert.Equal(t, "/hosted_resources/hr-1/sync", r.URL.Path)
+		assert.Equal(t, http.MethodPost, r.Method)
+		w.WriteHeader(http.StatusOK)
+		_ = json.NewEncoder(w).Encode(map[string]string{"status": "sync_requested"})
+	}))
+	defer server.Close()
+
+	c := newTestClient(t, server)
+	err := c.SyncHostedResource(context.Background(), "hr-1")
+	require.NoError(t, err)
+}
+
+func TestRetryProvisionHostedResource(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		assert.Equal(t, "/hosted_resources/hr-1/retry_provision", r.URL.Path)
+		assert.Equal(t, http.MethodPost, r.Method)
+		w.WriteHeader(http.StatusOK)
+		_ = json.NewEncoder(w).Encode(map[string]string{"status": "provisioning"})
+	}))
+	defer server.Close()
+
+	c := newTestClient(t, server)
+	err := c.RetryProvisionHostedResource(context.Background(), "hr-1")
+	require.NoError(t, err)
+}
+
+func TestRetryProvisionHostedResource_NotInErrorState(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusUnprocessableEntity)
+		_ = json.NewEncoder(w).Encode(map[string]string{
+			"error": "Only resources in error state can be retried.",
+		})
+	}))
+	defer server.Close()
+
+	c := newTestClient(t, server)
+	err := c.RetryProvisionHostedResource(context.Background(), "hr-1")
+	require.Error(t, err)
+	apiErr, ok := err.(*APIError)
+	require.True(t, ok)
+	assert.Equal(t, http.StatusUnprocessableEntity, apiErr.StatusCode)
+	assert.Equal(t, "Only resources in error state can be retried.", apiErr.Message)
+}
+
+func TestListHostedResources_Forbidden(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusForbidden)
+		_ = json.NewEncoder(w).Encode(map[string]string{"error": "access_denied"})
+	}))
+	defer server.Close()
+
+	c := newTestClient(t, server)
+	_, err := c.ListHostedResources(context.Background(), nil)
+	require.Error(t, err)
+	assert.True(t, IsForbidden(err))
+}
+
+func TestGetHostedResource_NotFound(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusNotFound)
+		_ = json.NewEncoder(w).Encode(map[string]string{"error": "not_found"})
+	}))
+	defer server.Close()
+
+	c := newTestClient(t, server)
+	_, err := c.GetHostedResource(context.Background(), "missing")
+	require.Error(t, err)
+	assert.True(t, IsNotFound(err))
+}
diff --git a/pkg/sdk/invoices.go b/pkg/sdk/invoices.go
new file mode 100644
index 0000000..c5701ed
--- /dev/null
+++ b/pkg/sdk/invoices.go
@@ -0,0 +1,49 @@
+package sdk
+
+import (
+	"context"
+	"fmt"
+	"net/http"
+)
+
+// Invoice is a billing invoice on the account, as served by
+// GET /account/invoices. Invoices are keyed by Number (an integer), not a
+// string identifier. The endpoint is gated: it requires a billing-manager API
+// key and returns 403 otherwise.
+type Invoice struct {
+	// Number is the invoice number — the key used to download the PDF.
+	Number int `json:"number"`
+	// Kind is the invoice kind (e.g. "subscription").
+	Kind string `json:"kind"`
+	// Currency is the ISO currency code.
+	Currency string `json:"currency"`
+	// Total is the invoice total (a decimal string).
+	Total string `json:"total"`
+	// VAT is the VAT component (a decimal string).
+	VAT string `json:"vat"`
+	// Paid reports whether the invoice has been paid.
+	Paid bool `json:"paid"`
+	// PaidAt is the payment timestamp, nil when unpaid.
+	PaidAt *string `json:"paid_at"`
+	// CreatedAt is the invoice creation timestamp.
+	CreatedAt string `json:"created_at"`
+	// DownloadURL is the direct PDF download URL.
+	DownloadURL string `json:"download_url"`
+}
+
+// ListInvoices returns the account's invoices. Requires a billing-manager API
+// key; a non-billing key yields a 403 *APIError.
+func (c *Client) ListInvoices(ctx context.Context, opts *ListOptions) ([]Invoice, error) {
+	var resp []Invoice
+	if err := c.get(ctx, appendListParams("/account/invoices", opts), &resp); err != nil {
+		return nil, err
+	}
+	return resp, nil
+}
+
+// DownloadInvoice fetches the raw PDF bytes for a single invoice, keyed by its
+// number. The show endpoint is PDF-only (there is no JSON single-invoice form).
+// Requires a billing-manager API key.
+func (c *Client) DownloadInvoice(ctx context.Context, number int) ([]byte, error) {
+	return c.doRaw(ctx, http.MethodGet, fmt.Sprintf("/account/invoices/%d.pdf", number))
+}
diff --git a/pkg/sdk/invoices_test.go b/pkg/sdk/invoices_test.go
new file mode 100644
index 0000000..7d5796d
--- /dev/null
+++ b/pkg/sdk/invoices_test.go
@@ -0,0 +1,70 @@
+package sdk
+
+import (
+	"context"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestListInvoices(t *testing.T) {
+	paidAt := "2026-06-01T00:00:00Z"
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		assert.Equal(t, "/account/invoices", r.URL.Path)
+		assert.Equal(t, http.MethodGet, r.Method)
+		_ = json.NewEncoder(w).Encode([]Invoice{
+			{
+				Number: 1001, Kind: "subscription", Currency: "USD",
+				Total: "25.00", VAT: "0.00", Paid: true, PaidAt: &paidAt,
+				CreatedAt: "2026-06-01T00:00:00Z", DownloadURL: "https://example.com/1001.pdf",
+			},
+			{Number: 1002, Kind: "subscription", Currency: "USD", Total: "25.00", Paid: false},
+		})
+	}))
+	defer server.Close()
+
+	c := newTestClient(t, server)
+	invoices, err := c.ListInvoices(context.Background(), nil)
+	require.NoError(t, err)
+	assert.Len(t, invoices, 2)
+	assert.Equal(t, 1001, invoices[0].Number)
+	assert.True(t, invoices[0].Paid)
+	require.NotNil(t, invoices[0].PaidAt)
+	assert.Equal(t, paidAt, *invoices[0].PaidAt)
+	assert.Nil(t, invoices[1].PaidAt)
+}
+
+func TestListInvoicesForbidden(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusForbidden)
+		_ = json.NewEncoder(w).Encode(map[string]string{"error": "billing manager required"})
+	}))
+	defer server.Close()
+
+	c := newTestClient(t, server)
+	_, err := c.ListInvoices(context.Background(), nil)
+	require.Error(t, err)
+	apiErr, ok := err.(*APIError)
+	require.True(t, ok)
+	assert.Equal(t, http.StatusForbidden, apiErr.StatusCode)
+}
+
+func TestDownloadInvoice(t *testing.T) {
+	pdf := []byte("%PDF-1.4 fake invoice bytes")
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		assert.Equal(t, "/account/invoices/1001.pdf", r.URL.Path)
+		assert.Equal(t, http.MethodGet, r.Method)
+		w.Header().Set("Content-Type", "application/pdf")
+		_, _ = w.Write(pdf)
+	}))
+	defer server.Close()
+
+	c := newTestClient(t, server)
+	data, err := c.DownloadInvoice(context.Background(), 1001)
+	require.NoError(t, err)
+	assert.Equal(t, pdf, data)
+}
diff --git a/pkg/sdk/ip_ranges.go b/pkg/sdk/ip_ranges.go
new file mode 100644
index 0000000..3760f75
--- /dev/null
+++ b/pkg/sdk/ip_ranges.go
@@ -0,0 +1,52 @@
+package sdk
+
+import "context"
+
+// IPRanges is the set of DeployHQ IP ranges and ports customers need to
+// allowlist so DeployHQ can reach their servers (SSH/FTP) and so their firewall
+// admits DeployHQ's build and network-agent traffic. Served by GET /ip_ranges,
+// which is public (no authentication required).
+type IPRanges struct {
+	// Shared holds the IPs shared across all zones.
+	Shared IPRangeSet `json:"shared"`
+	// Zones maps a zone identifier to its zone-specific ranges.
+	Zones map[string]IPRangeZone `json:"zones"`
+	// NetworkAgent holds the IPs used by the DeployHQ network agent.
+	NetworkAgent IPRangeSet `json:"network_agent"`
+	// AllIPv4 is the flattened union of every IPv4 range (shared + zones + agent).
+	AllIPv4 []string `json:"all_ipv4"`
+	// AllIPv6 is the flattened union of every IPv6 range.
+	AllIPv6 []string `json:"all_ipv6"`
+	// Ports lists the protocol/port descriptions DeployHQ connects on.
+	Ports []IPRangePort `json:"ports"`
+}
+
+// IPRangeSet is a pair of IPv4 and IPv6 CIDR ranges.
+type IPRangeSet struct {
+	IPv4 []string `json:"ipv4"`
+	IPv6 []string `json:"ipv6"`
+}
+
+// IPRangeZone is a named zone's IP ranges.
+type IPRangeZone struct {
+	Name string   `json:"name"`
+	IPv4 []string `json:"ipv4"`
+	IPv6 []string `json:"ipv6"`
+}
+
+// IPRangePort describes a protocol/port DeployHQ uses when connecting to a
+// customer's servers.
+type IPRangePort struct {
+	Protocol    string `json:"protocol"`
+	Description string `json:"description"`
+}
+
+// GetIPRanges returns DeployHQ's published IP ranges and ports for firewall
+// allowlisting. The endpoint is public and requires no authentication.
+func (c *Client) GetIPRanges(ctx context.Context) (*IPRanges, error) {
+	var resp IPRanges
+	if err := c.get(ctx, "/ip_ranges", &resp); err != nil {
+		return nil, err
+	}
+	return &resp, nil
+}
diff --git a/pkg/sdk/ip_ranges_test.go b/pkg/sdk/ip_ranges_test.go
new file mode 100644
index 0000000..54c2734
--- /dev/null
+++ b/pkg/sdk/ip_ranges_test.go
@@ -0,0 +1,39 @@
+package sdk
+
+import (
+	"context"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestGetIPRanges(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		assert.Equal(t, "/ip_ranges", r.URL.Path)
+		assert.Equal(t, http.MethodGet, r.Method)
+		_ = json.NewEncoder(w).Encode(IPRanges{
+			Shared: IPRangeSet{IPv4: []string{"1.2.3.0/24"}, IPv6: []string{"2001:db8::/32"}},
+			Zones: map[string]IPRangeZone{
+				"eu": {Name: "Europe", IPv4: []string{"10.0.0.0/24"}, IPv6: []string{"2001:db9::/32"}},
+			},
+			NetworkAgent: IPRangeSet{IPv4: []string{"5.6.7.0/24"}},
+			AllIPv4:      []string{"1.2.3.0/24", "10.0.0.0/24", "5.6.7.0/24"},
+			AllIPv6:      []string{"2001:db8::/32", "2001:db9::/32"},
+			Ports:        []IPRangePort{{Protocol: "ssh", Description: "SSH deployments"}},
+		})
+	}))
+	defer server.Close()
+
+	c := newTestClient(t, server)
+	ranges, err := c.GetIPRanges(context.Background())
+	require.NoError(t, err)
+	assert.Len(t, ranges.AllIPv4, 3)
+	assert.Len(t, ranges.AllIPv6, 2)
+	assert.Equal(t, "Europe", ranges.Zones["eu"].Name)
+	assert.Equal(t, "ssh", ranges.Ports[0].Protocol)
+	assert.Equal(t, []string{"5.6.7.0/24"}, ranges.NetworkAgent.IPv4)
+}
diff --git a/pkg/sdk/managed_hosting.go b/pkg/sdk/managed_hosting.go
index c61168f..73641d4 100644
--- a/pkg/sdk/managed_hosting.go
+++ b/pkg/sdk/managed_hosting.go
@@ -48,16 +48,68 @@ func (c *Client) EnrollBeta(ctx context.Context, protocol string) (*BetaEnrollme
 	return &resp, nil
 }
 
+// ManagedHostingRegionRow is a flattened region carrying its group name and
+// whether it is that group's default. Used to render the regions table without
+// losing the grouping the API imposes.
+type ManagedHostingRegionRow struct {
+	Group     string `json:"group"`
+	Slug      string `json:"slug"`
+	Name      string `json:"name"`
+	Flag      string `json:"flag"`
+	Country   string `json:"country"`
+	IsDefault bool   `json:"is_default"`
+}
+
+// GetManagedHostingRegions returns the raw grouped regions payload from
+// GET /managed_hosting/regions. This endpoint requires beta_features to be
+// enabled on the account (require_beta_features gate on the backend).
+func (c *Client) GetManagedHostingRegions(ctx context.Context) (*ManagedHostingRegionsResponse, error) {
+	var resp ManagedHostingRegionsResponse
+	if err := c.get(ctx, "/managed_hosting/regions", &resp); err != nil {
+		return nil, err
+	}
+	return &resp, nil
+}
+
+// ListManagedHostingRegionRows returns the grouped regions flattened into rows
+// (one per region, carrying the group name and default flag), suitable for a
+// table. Group order is not guaranteed (map iteration).
+func (c *Client) ListManagedHostingRegionRows(ctx context.Context) ([]ManagedHostingRegionRow, error) {
+	resp, err := c.GetManagedHostingRegions(ctx)
+	if err != nil {
+		return nil, err
+	}
+	var rows []ManagedHostingRegionRow
+	for group, g := range resp.GroupedRegions {
+		for _, r := range g.Regions {
+			rows = append(rows, ManagedHostingRegionRow{
+				Group:     group,
+				Slug:      r.Slug,
+				Name:      r.Name,
+				Flag:      r.Flag,
+				Country:   r.Country,
+				IsDefault: r.Slug == g.Default,
+			})
+		}
+	}
+	return rows, nil
+}
+
 // ListManagedHostingRegions returns the DigitalOcean regions available for
-// Managed VPS provisioning. This endpoint requires beta_features to be enabled
-// on the account (require_beta_features gate on the backend).
+// Managed VPS provisioning as a flat slice (all groups merged). This endpoint
+// requires beta_features to be enabled on the account (require_beta_features
+// gate on the backend).
 //
 // Use the returned Region.Slug as ServerCreateRequest.Region.
 func (c *Client) ListManagedHostingRegions(ctx context.Context) ([]ManagedHostingRegion, error) {
-	var regions []ManagedHostingRegion
-	if err := c.get(ctx, "/managed_hosting/regions", &regions); err != nil {
+	resp, err := c.GetManagedHostingRegions(ctx)
+	if err != nil {
 		return nil, err
 	}
+	var regions []ManagedHostingRegion
+	for _, g := range resp.GroupedRegions {
+		regions = append(regions, g.Regions...)
+	}
 	return regions, nil
 }
 
@@ -67,11 +119,11 @@ func (c *Client) ListManagedHostingRegions(ctx context.Context) ([]ManagedHostin
 //
 // Use the returned Size.Slug as ServerCreateRequest.Size.
 func (c *Client) ListManagedHostingSizes(ctx context.Context) ([]ManagedHostingSize, error) {
-	var sizes []ManagedHostingSize
-	if err := c.get(ctx, "/managed_hosting/sizes", &sizes); err != nil {
+	var resp ManagedHostingSizesResponse
+	if err := c.get(ctx, "/managed_hosting/sizes", &resp); err != nil {
 		return nil, err
 	}
-	return sizes, nil
+	return resp.Sizes, nil
 }
 
 // GetServerProvisioningState returns the current server record from the
diff --git a/pkg/sdk/managed_hosting_test.go b/pkg/sdk/managed_hosting_test.go
index c305a78..cd5cb90 100644
--- a/pkg/sdk/managed_hosting_test.go
+++ b/pkg/sdk/managed_hosting_test.go
@@ -156,15 +156,74 @@ func TestEnrollBeta_AllProtocols(t *testing.T) {
 	assert.True(t, resp.Enrolled)
 }
 
+// The real GET /managed_hosting/regions payload is grouped by continent.
+const managedRegionsPayload = `{
+	"grouped_regions": {
+		"Europe": {
+			"default": "lon1",
+			"regions": [
+				{"slug": "lon1", "name": "London, United Kingdom", "flag": "🇬🇧", "country": "United Kingdom"},
+				{"slug": "ams3", "name": "Amsterdam, Netherlands", "flag": "🇳🇱", "country": "Netherlands"}
+			]
+		},
+		"North America": {
+			"default": "nyc3",
+			"regions": [
+				{"slug": "nyc3", "name": "New York City, United States", "flag": "🇺🇸", "country": "United States"}
+			]
+		}
+	}
+}`
+
+func TestGetManagedHostingRegions(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		assert.Equal(t, "/managed_hosting/regions", r.URL.Path)
+		assert.Equal(t, http.MethodGet, r.Method)
+		_, _ = w.Write([]byte(managedRegionsPayload))
+	}))
+	defer server.Close()
+
+	c := newTestClient(t, server)
+	resp, err := c.GetManagedHostingRegions(context.Background())
+	require.NoError(t, err)
+	require.Contains(t, resp.GroupedRegions, "Europe")
+	eu := resp.GroupedRegions["Europe"]
+	assert.Equal(t, "lon1", eu.Default)
+	require.Len(t, eu.Regions, 2)
+	assert.Equal(t, "lon1", eu.Regions[0].Slug)
+	assert.Equal(t, "United Kingdom", eu.Regions[0].Country)
+	assert.Equal(t, "🇬🇧", eu.Regions[0].Flag)
+}
+
+func TestListManagedHostingRegionRows(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		_, _ = w.Write([]byte(managedRegionsPayload))
+	}))
+	defer server.Close()
+
+	c := newTestClient(t, server)
+	rows, err := c.ListManagedHostingRegionRows(context.Background())
+	require.NoError(t, err)
+	assert.Len(t, rows, 3)
+
+	// Find the lon1 row and assert it is flagged default within its group.
+	var lon1 *ManagedHostingRegionRow
+	for i := range rows {
+		if rows[i].Slug == "lon1" {
+			lon1 = &rows[i]
+		}
+	}
+	require.NotNil(t, lon1)
+	assert.Equal(t, "Europe", lon1.Group)
+	assert.True(t, lon1.IsDefault)
+	assert.Equal(t, "United Kingdom", lon1.Country)
+}
+
 func TestListManagedHostingRegions(t *testing.T) {
 	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		assert.Equal(t, "/managed_hosting/regions", r.URL.Path)
 		assert.Equal(t, http.MethodGet, r.Method)
-		_ = json.NewEncoder(w).Encode([]ManagedHostingRegion{
-			{Slug: "lon1", Name: "London, United Kingdom", Available: true},
-			{Slug: "nyc3", Name: "New York City, United States", Available: true},
-			{Slug: "ams3", Name: "Amsterdam, Netherlands", Available: false},
-		})
+		_, _ = w.Write([]byte(managedRegionsPayload))
 	}))
 	defer server.Close()
 
@@ -172,18 +231,24 @@ func TestListManagedHostingRegions(t *testing.T) {
 	regions, err := c.ListManagedHostingRegions(context.Background())
 	require.NoError(t, err)
 	assert.Len(t, regions, 3)
-	assert.Equal(t, "lon1", regions[0].Slug)
-	assert.True(t, regions[0].Available)
-	assert.False(t, regions[2].Available)
+	slugs := make(map[string]bool)
+	for _, r := range regions {
+		slugs[r.Slug] = true
+	}
+	assert.True(t, slugs["lon1"])
+	assert.True(t, slugs["nyc3"])
+	assert.True(t, slugs["ams3"])
 }
 
 func TestListManagedHostingSizes(t *testing.T) {
 	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		assert.Equal(t, "/managed_hosting/sizes", r.URL.Path)
 		assert.Equal(t, http.MethodGet, r.Method)
-		_ = json.NewEncoder(w).Encode([]ManagedHostingSize{
-			{Slug: "s-1vcpu-1gb", Description: "1 vCPU / 1 GB RAM", PriceMonthly: 6.0, PriceHourly: 0.009, Memory: 1024, VCPUs: 1, Disk: 25},
-			{Slug: "s-2vcpu-2gb", Description: "2 vCPU / 2 GB RAM", PriceMonthly: 12.0, PriceHourly: 0.018, Memory: 2048, VCPUs: 2, Disk: 60},
+		_ = json.NewEncoder(w).Encode(ManagedHostingSizesResponse{
+			Sizes: []ManagedHostingSize{
+				{Slug: "s-1vcpu-1gb", Label: "1 vCPU / 1 GB RAM", MonthlyCost: 6.0, Currency: "USD"},
+				{Slug: "s-2vcpu-2gb", Label: "2 vCPU / 2 GB RAM", MonthlyCost: 12.0, Currency: "USD"},
+			},
 		})
 	}))
 	defer server.Close()
@@ -193,8 +258,24 @@ func TestListManagedHostingSizes(t *testing.T) {
 	require.NoError(t, err)
 	assert.Len(t, sizes, 2)
 	assert.Equal(t, "s-1vcpu-1gb", sizes[0].Slug)
-	assert.Equal(t, 6.0, sizes[0].PriceMonthly)
-	assert.Equal(t, 1024, sizes[0].Memory)
+	assert.Equal(t, 6.0, sizes[0].MonthlyCost)
+	assert.Equal(t, "USD", sizes[0].Currency)
+	assert.Equal(t, "1 vCPU / 1 GB RAM", sizes[0].Label)
+}
+
+func TestListManagedHostingSizes_PricingUnavailable(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusServiceUnavailable)
+		_ = json.NewEncoder(w).Encode(map[string]string{"error": "Pricing temporarily unavailable."})
+	}))
+	defer server.Close()
+
+	c := newTestClient(t, server)
+	_, err := c.ListManagedHostingSizes(context.Background())
+	require.Error(t, err)
+	apiErr, ok := err.(*APIError)
+	require.True(t, ok)
+	assert.Equal(t, http.StatusServiceUnavailable, apiErr.StatusCode)
 }
 
 func TestGetServerProvisioningState_ManagedVPS(t *testing.T) {
diff --git a/pkg/sdk/packages.go b/pkg/sdk/packages.go
new file mode 100644
index 0000000..1797c86
--- /dev/null
+++ b/pkg/sdk/packages.go
@@ -0,0 +1,33 @@
+package sdk
+
+import "context"
+
+// Package is a DeployHQ subscription plan (pricing tier) as served by the public
+// GET /packages endpoint. Pricing is localised to the caller's currency based on
+// the request's originating IP, so Currency and the prices vary by location.
+type Package struct {
+	// Permalink is the stable plan identifier (e.g. "small", "medium").
+	Permalink string `json:"permalink"`
+	// Name is the human-readable plan name.
+	Name string `json:"name"`
+	// Currency is the ISO currency code the prices are quoted in.
+	Currency string `json:"currency"`
+	// Price is the monthly price.
+	Price float64 `json:"price"`
+	// PriceBilledAnnually is the effective monthly price when billed annually.
+	PriceBilledAnnually float64 `json:"price_billed_annually"`
+	// Features lists the plan's headline features.
+	Features []string `json:"features"`
+}
+
+// ListPackages returns DeployHQ's available subscription plans with pricing
+// localised to the caller's IP. The endpoint is public (no authentication).
+// A 503 with an {"error": ...} body indicates pricing is temporarily
+// unavailable; it is surfaced as an *APIError.
+func (c *Client) ListPackages(ctx context.Context) ([]Package, error) {
+	var resp []Package
+	if err := c.get(ctx, "/packages", &resp); err != nil {
+		return nil, err
+	}
+	return resp, nil
+}
diff --git a/pkg/sdk/packages_test.go b/pkg/sdk/packages_test.go
new file mode 100644
index 0000000..9bd4289
--- /dev/null
+++ b/pkg/sdk/packages_test.go
@@ -0,0 +1,53 @@
+package sdk
+
+import (
+	"context"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestListPackages(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		assert.Equal(t, "/packages", r.URL.Path)
+		assert.Equal(t, http.MethodGet, r.Method)
+		_ = json.NewEncoder(w).Encode([]Package{
+			{
+				Permalink: "small", Name: "Small", Currency: "USD",
+				Price: 25, PriceBilledAnnually: 20,
+				Features: []string{"10 projects", "Unlimited deployments"},
+			},
+			{Permalink: "medium", Name: "Medium", Currency: "USD", Price: 50, PriceBilledAnnually: 42},
+		})
+	}))
+	defer server.Close()
+
+	c := newTestClient(t, server)
+	pkgs, err := c.ListPackages(context.Background())
+	require.NoError(t, err)
+	assert.Len(t, pkgs, 2)
+	assert.Equal(t, "Small", pkgs[0].Name)
+	assert.Equal(t, 25.0, pkgs[0].Price)
+	assert.Equal(t, 20.0, pkgs[0].PriceBilledAnnually)
+	assert.Equal(t, "USD", pkgs[0].Currency)
+	assert.Len(t, pkgs[0].Features, 2)
+}
+
+func TestListPackagesUnavailable(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusServiceUnavailable)
+		_ = json.NewEncoder(w).Encode(map[string]string{"error": "pricing unavailable"})
+	}))
+	defer server.Close()
+
+	c := newTestClient(t, server)
+	_, err := c.ListPackages(context.Background())
+	require.Error(t, err)
+	apiErr, ok := err.(*APIError)
+	require.True(t, ok)
+	assert.Equal(t, http.StatusServiceUnavailable, apiErr.StatusCode)
+}
diff --git a/pkg/sdk/projects.go b/pkg/sdk/projects.go
index 8e539f3..0c87ba0 100644
--- a/pkg/sdk/projects.go
+++ b/pkg/sdk/projects.go
@@ -91,3 +91,80 @@ func (c *Client) UploadProjectKey(ctx context.Context, id, publicKey string) (*P
 func (c *Client) GetStatusBadge(ctx context.Context, id string) ([]byte, error) {
 	return c.doRaw(ctx, "GET", fmt.Sprintf("/%s/status_badge.svg", id))
 }
+
+// RegenerateProjectKey regenerates the project's SSH deploy key pair and
+// returns the new public key. keyType is optional ("ED25519" or "RSA"); pass
+// an empty string to let the server choose its default.
+func (c *Client) RegenerateProjectKey(ctx context.Context, projectID, keyType string) (string, error) {
+	inner := struct {
+		KeyType string `json:"key_type,omitempty"`
+	}{KeyType: keyType}
+	body := struct {
+		Project interface{} `json:"project"`
+	}{Project: inner}
+	var resp struct {
+		PublicKey string `json:"public_key"`
+	}
+	if err := c.patch(ctx, fmt.Sprintf("/projects/%s/regenerate_key", projectID), body, &resp); err != nil {
+		return "", err
+	}
+	return resp.PublicKey, nil
+}
+
+// UndeployedCommit is a single commit reported by GetUndeployedChanges.
+type UndeployedCommit struct {
+	Ref          string `json:"ref"`
+	Author       string `json:"author"`
+	Email        string `json:"email"`
+	Timestamp    string `json:"timestamp"`
+	Message      string `json:"message"`
+	ShortMessage string `json:"short_message"`
+	URL          string `json:"url"`
+}
+
+// UndeployedChanges describes commits that have not yet been deployed for a
+// project. Nullable fields are modeled as pointers.
+type UndeployedChanges struct {
+	Count                  int                `json:"count"`
+	Truncated              bool               `json:"truncated"`
+	LatestDeployedRevision *string            `json:"latest_deployed_revision"`
+	CurrentRevision        *string            `json:"current_revision"`
+	LastCheckedAt          *string            `json:"last_checked_at"`
+	CheckInProgress        bool               `json:"check_in_progress"`
+	CheckFailMessage       *string            `json:"check_fail_message"`
+	Commits                []UndeployedCommit `json:"commits"`
+}
+
+// GetUndeployedChanges returns the commits that have not yet been deployed for
+// the project.
+func (c *Client) GetUndeployedChanges(ctx context.Context, projectID string) (*UndeployedChanges, error) {
+	var changes UndeployedChanges
+	if err := c.get(ctx, fmt.Sprintf("/projects/%s/undeployed_changes", projectID), &changes); err != nil {
+		return nil, err
+	}
+	return &changes, nil
+}
+
+// GenerateAIDeploymentOverview asks DeployHQ to generate an AI-written summary
+// of the changes between startRef and endRef, returning the overview text.
+// endRef is required; startRef is optional (empty means "from the last
+// deployed revision").
+func (c *Client) GenerateAIDeploymentOverview(ctx context.Context, projectID, startRef, endRef string) (string, error) {
+	if endRef == "" {
+		return "", fmt.Errorf("deployhq: end_ref is required")
+	}
+	// Body is FLAT (top-level), not wrapped in a "project" key.
+	body := struct {
+		StartRef string `json:"start_ref,omitempty"`
+		EndRef   string `json:"end_ref"`
+	}{StartRef: startRef, EndRef: endRef}
+	var resp struct {
+		Success         bool   `json:"success"`
+		Overview        string `json:"overview"`
+		AIPromptVersion string `json:"ai_prompt_version"`
+	}
+	if err := c.post(ctx, fmt.Sprintf("/projects/%s/ai_deployment_overview", projectID), body, &resp); err != nil {
+		return "", err
+	}
+	return resp.Overview, nil
+}
diff --git a/pkg/sdk/projects_test.go b/pkg/sdk/projects_test.go
index 6048383..0e39546 100644
--- a/pkg/sdk/projects_test.go
+++ b/pkg/sdk/projects_test.go
@@ -3,6 +3,7 @@ package sdk
 import (
 	"context"
 	"encoding/json"
+	"io"
 	"net/http"
 	"net/http/httptest"
 	"testing"
@@ -108,3 +109,111 @@ func TestStarProject(t *testing.T) {
 	err := c.StarProject(context.Background(), "my-app")
 	require.NoError(t, err)
 }
+
+func TestRegenerateProjectKey(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		assert.Equal(t, http.MethodPatch, r.Method)
+		assert.Equal(t, "/projects/my-app/regenerate_key", r.URL.Path)
+
+		var body struct {
+			Project struct {
+				KeyType string `json:"key_type"`
+			} `json:"project"`
+		}
+		require.NoError(t, json.NewDecoder(r.Body).Decode(&body))
+		assert.Equal(t, "ED25519", body.Project.KeyType)
+
+		w.WriteHeader(http.StatusOK)
+		_ = json.NewEncoder(w).Encode(map[string]string{"public_key": "ssh-ed25519 AAAA..."})
+	}))
+	defer server.Close()
+
+	c := newTestClient(t, server)
+	key, err := c.RegenerateProjectKey(context.Background(), "my-app", "ED25519")
+	require.NoError(t, err)
+	assert.Equal(t, "ssh-ed25519 AAAA...", key)
+}
+
+func TestRegenerateProjectKey_NoKeyType(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		body, _ := io.ReadAll(r.Body)
+		// key_type is omitempty, so an empty value must not appear in the body.
+		assert.NotContains(t, string(body), "key_type")
+		_ = json.NewEncoder(w).Encode(map[string]string{"public_key": "ssh-rsa AAAA..."})
+	}))
+	defer server.Close()
+
+	c := newTestClient(t, server)
+	key, err := c.RegenerateProjectKey(context.Background(), "my-app", "")
+	require.NoError(t, err)
+	assert.Equal(t, "ssh-rsa AAAA...", key)
+}
+
+func TestGetUndeployedChanges(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		assert.Equal(t, http.MethodGet, r.Method)
+		assert.Equal(t, "/projects/my-app/undeployed_changes", r.URL.Path)
+		_, _ = w.Write([]byte(`{
+			"count": 2,
+			"truncated": false,
+			"latest_deployed_revision": "abc123",
+			"current_revision": "def456",
+			"last_checked_at": "2026-01-01T00:00:00Z",
+			"check_in_progress": false,
+			"check_fail_message": null,
+			"commits": [
+				{"ref":"def456","author":"Alice","email":"a@x.com","timestamp":"t","message":"Fix bug","short_message":"Fix bug","url":"http://x"},
+				{"ref":"aaa111","author":"Bob","email":"b@x.com","timestamp":"t","message":"Add feature","short_message":"Add feature","url":"http://y"}
+			]
+		}`))
+	}))
+	defer server.Close()
+
+	c := newTestClient(t, server)
+	changes, err := c.GetUndeployedChanges(context.Background(), "my-app")
+	require.NoError(t, err)
+	assert.Equal(t, 2, changes.Count)
+	assert.False(t, changes.Truncated)
+	require.NotNil(t, changes.LatestDeployedRevision)
+	assert.Equal(t, "abc123", *changes.LatestDeployedRevision)
+	assert.Nil(t, changes.CheckFailMessage)
+	require.Len(t, changes.Commits, 2)
+	assert.Equal(t, "Alice", changes.Commits[0].Author)
+	assert.Equal(t, "Fix bug", changes.Commits[0].Message)
+}
+
+func TestGenerateAIDeploymentOverview(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		assert.Equal(t, http.MethodPost, r.Method)
+		assert.Equal(t, "/projects/my-app/ai_deployment_overview", r.URL.Path)
+
+		// Body must be FLAT (not wrapped in "project").
+		var body map[string]string
+		require.NoError(t, json.NewDecoder(r.Body).Decode(&body))
+		assert.Equal(t, "abc123", body["start_ref"])
+		assert.Equal(t, "def456", body["end_ref"])
+		_, hasProject := body["project"]
+		assert.False(t, hasProject, "body should be flat, not wrapped in project")
+
+		_ = json.NewEncoder(w).Encode(map[string]interface{}{
+			"success":           true,
+			"overview":          "This deployment fixes bugs.",
+			"ai_prompt_version": "v2",
+		})
+	}))
+	defer server.Close()
+
+	c := newTestClient(t, server)
+	overview, err := c.GenerateAIDeploymentOverview(context.Background(), "my-app", "abc123", "def456")
+	require.NoError(t, err)
+	assert.Equal(t, "This deployment fixes bugs.", overview)
+}
+
+func TestGenerateAIDeploymentOverview_RequiresEndRef(t *testing.T) {
+	c := newTestClient(t, httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		t.Fatal("no HTTP request should be made when end_ref is empty")
+	})))
+	_, err := c.GenerateAIDeploymentOverview(context.Background(), "my-app", "abc123", "")
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "end_ref is required")
+}
diff --git a/pkg/sdk/servers.go b/pkg/sdk/servers.go
index 6e137af..d9e68b8 100644
--- a/pkg/sdk/servers.go
+++ b/pkg/sdk/servers.go
@@ -72,3 +72,53 @@ func (c *Client) DeleteServer(ctx context.Context, projectID, serverID string) e
 func (c *Client) ResetServerHostKey(ctx context.Context, projectID, serverID string) error {
 	return c.post(ctx, fmt.Sprintf("/projects/%s/servers/%s/reset_host_key", projectID, serverID), nil, nil)
 }
+
+// CreateServerFromGlobal creates a project server from a global server template.
+// The request body is FLAT (top-level global_server_id), not wrapped.
+func (c *Client) CreateServerFromGlobal(ctx context.Context, projectID, globalServerID string) (*Server, error) {
+	body := struct {
+		GlobalServerID string `json:"global_server_id"`
+	}{GlobalServerID: globalServerID}
+	var server Server
+	if err := c.post(ctx, fmt.Sprintf("/projects/%s/servers/from_global", projectID), body, &server); err != nil {
+		return nil, err
+	}
+	return &server, nil
+}
+
+// ServerMetrics is a point-in-time snapshot of a server's resource usage.
+// The cpu/memory/disk/profile blocks vary in shape, so they are modeled as
+// free-form maps.
+// ServerMetrics is a point-in-time snapshot. The backend deep-camelizes every
+// key, and the shapes vary by field, so the nested values are kept as generic
+// JSON: status/cpu/memory/profile/lastDeploy are objects, disk is an array of
+// per-partition objects, and uptime is an object ({formatted, seconds}), NOT a
+// string. Mirrors the nine keys the server_metrics endpoint returns.
+type ServerMetrics struct {
+	Status        map[string]interface{}   `json:"status"`
+	Uptime        ServerUptime             `json:"uptime"`
+	CPU           map[string]interface{}   `json:"cpu"`
+	Memory        map[string]interface{}   `json:"memory"`
+	Disk          []map[string]interface{} `json:"disk"`
+	LastDeploy    map[string]interface{}   `json:"lastDeploy"`
+	Profile       map[string]interface{}   `json:"profile"`
+	SharedHosting bool                     `json:"sharedHosting"`
+	Hostname      string                   `json:"hostname"`
+}
+
+// ServerUptime is the nested uptime object returned by server_metrics.
+type ServerUptime struct {
+	Formatted string `json:"formatted"`
+	Seconds   int64  `json:"seconds"`
+}
+
+// GetServerMetrics returns a point-in-time metrics snapshot for a server.
+// Only available for beta accounts on SSH servers; otherwise the API returns
+// 403 Not available.
+func (c *Client) GetServerMetrics(ctx context.Context, projectID, serverID string) (*ServerMetrics, error) {
+	var metrics ServerMetrics
+	if err := c.get(ctx, fmt.Sprintf("/projects/%s/servers/%s/server_metrics", projectID, serverID), &metrics); err != nil {
+		return nil, err
+	}
+	return &metrics, nil
+}
diff --git a/pkg/sdk/servers_test.go b/pkg/sdk/servers_test.go
index 4e2bc78..43261a5 100644
--- a/pkg/sdk/servers_test.go
+++ b/pkg/sdk/servers_test.go
@@ -96,3 +96,84 @@ func TestResetServerHostKey(t *testing.T) {
 	err := c.ResetServerHostKey(context.Background(), "my-app", "srv1")
 	require.NoError(t, err)
 }
+
+func TestCreateServerFromGlobal(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		assert.Equal(t, http.MethodPost, r.Method)
+		assert.Equal(t, "/projects/my-app/servers/from_global", r.URL.Path)
+
+		// Body must be FLAT (top-level global_server_id).
+		var body map[string]string
+		require.NoError(t, json.NewDecoder(r.Body).Decode(&body))
+		assert.Equal(t, "glob-1", body["global_server_id"])
+		_, hasServer := body["server"]
+		assert.False(t, hasServer, "body should be flat, not wrapped in server")
+
+		w.WriteHeader(http.StatusCreated)
+		_ = json.NewEncoder(w).Encode(Server{Identifier: "srv-new", Name: "From Global", ProtocolType: "ssh"})
+	}))
+	defer server.Close()
+
+	c := newTestClient(t, server)
+	s, err := c.CreateServerFromGlobal(context.Background(), "my-app", "glob-1")
+	require.NoError(t, err)
+	assert.Equal(t, "srv-new", s.Identifier)
+	assert.Equal(t, "From Global", s.Name)
+}
+
+func TestGetServerMetrics(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		assert.Equal(t, http.MethodGet, r.Method)
+		assert.Equal(t, "/projects/my-app/servers/srv1/server_metrics", r.URL.Path)
+		// Mirrors the real (deep-camelized) server_metrics payload: uptime is a
+		// nested {formatted, seconds} object, disk is an array of partition
+		// objects — NOT a string / map.
+		// Mirrors the full deep-camelized server_metrics payload: all nine keys,
+		// with uptime an object, disk an array, and last_deploy/status objects.
+		_, _ = w.Write([]byte(`{
+			"status": {"online": true, "message": "reachable"},
+			"cpu": {"usage": 12.5, "loadAverages": [0.1, 0.2, 0.3]},
+			"memory": {"used": 1024, "total": 4096},
+			"disk": [
+				{"mount": "/", "used": 50, "total": 100, "percentage": 50, "formattedUsed": "50 GB"},
+				{"mount": "/data", "used": 10, "total": 200, "percentage": 5}
+			],
+			"uptime": {"formatted": "5 days", "seconds": 432000},
+			"lastDeploy": {"uuid": "dep-1", "status": "completed"},
+			"profile": {"cores": 2},
+			"sharedHosting": false,
+			"hostname": "web-1.example.com"
+		}`))
+	}))
+	defer server.Close()
+
+	c := newTestClient(t, server)
+	m, err := c.GetServerMetrics(context.Background(), "my-app", "srv1")
+	require.NoError(t, err)
+	assert.Equal(t, "5 days", m.Uptime.Formatted)
+	assert.Equal(t, int64(432000), m.Uptime.Seconds)
+	assert.Len(t, m.Disk, 2)
+	assert.Equal(t, "/", m.Disk[0]["mount"])
+	assert.Equal(t, 12.5, m.CPU["usage"])
+	assert.Equal(t, float64(2), m.Profile["cores"])
+	// The four previously-dropped fields must now round-trip.
+	assert.Equal(t, true, m.Status["online"])
+	assert.Equal(t, "dep-1", m.LastDeploy["uuid"])
+	assert.False(t, m.SharedHosting)
+	assert.Equal(t, "web-1.example.com", m.Hostname)
+}
+
+func TestGetServerMetrics_NotAvailable(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusForbidden)
+		_ = json.NewEncoder(w).Encode(map[string]string{"error": "Not available"})
+	}))
+	defer server.Close()
+
+	c := newTestClient(t, server)
+	_, err := c.GetServerMetrics(context.Background(), "my-app", "srv1")
+	require.Error(t, err)
+	apiErr, ok := err.(*APIError)
+	require.True(t, ok)
+	assert.Equal(t, http.StatusForbidden, apiErr.StatusCode)
+}
diff --git a/pkg/sdk/ssh_commands.go b/pkg/sdk/ssh_commands.go
index 4a355ee..be16eed 100644
--- a/pkg/sdk/ssh_commands.go
+++ b/pkg/sdk/ssh_commands.go
@@ -3,20 +3,21 @@ package sdk
 import (
 	"context"
 	"fmt"
+	"net/http"
 )
 
 // SSHCommand represents an SSH command configured on a project.
 type SSHCommand struct {
-	Identifier  string   `json:"identifier"`
-	CBack       string   `json:"cback,omitempty"`
-	Position    int      `json:"position"`
-	Description string   `json:"description"`
-	Command     string   `json:"command"`
-	HaltOnError bool     `json:"halt_on_error"`
+	Identifier  string        `json:"identifier"`
+	CBack       string        `json:"cback,omitempty"`
+	Position    int           `json:"position"`
+	Description string        `json:"description"`
+	Command     string        `json:"command"`
+	HaltOnError bool          `json:"halt_on_error"`
 	Servers     []interface{} `json:"servers,omitempty"`
-	Timing      string   `json:"timing"`
-	Timeout     int      `json:"timeout"`
-	Enabled     bool     `json:"enabled"`
+	Timing      string        `json:"timing"`
+	Timeout     int           `json:"timeout"`
+	Enabled     bool          `json:"enabled"`
 }
 
 // SSHCommandCreateRequest is the payload for creating/updating an SSH command.
@@ -71,3 +72,25 @@ func (c *Client) UpdateSSHCommand(ctx context.Context, projectID, cmdID string,
 func (c *Client) DeleteSSHCommand(ctx context.Context, projectID, cmdID string) error {
 	return c.delete(ctx, fmt.Sprintf("/projects/%s/commands/%s", projectID, cmdID))
 }
+
+// LinkGlobalCommand links an account-wide global SSH command into a project.
+// The request body is FLAT (top-level command_id), not wrapped.
+func (c *Client) LinkGlobalCommand(ctx context.Context, projectID, commandID string) (*SSHCommand, error) {
+	body := struct {
+		CommandID string `json:"command_id"`
+	}{CommandID: commandID}
+	var cmd SSHCommand
+	if err := c.post(ctx, fmt.Sprintf("/projects/%s/commands/link_global", projectID), body, &cmd); err != nil {
+		return nil, err
+	}
+	return &cmd, nil
+}
+
+// UnlinkGlobalCommand removes the link between a project and a global SSH
+// command. This is a DELETE request that carries a FLAT body.
+func (c *Client) UnlinkGlobalCommand(ctx context.Context, projectID, commandID string) error {
+	body := struct {
+		CommandID string `json:"command_id"`
+	}{CommandID: commandID}
+	return c.do(ctx, http.MethodDelete, fmt.Sprintf("/projects/%s/commands/unlink_global", projectID), body, nil)
+}
diff --git a/pkg/sdk/ssh_commands_test.go b/pkg/sdk/ssh_commands_test.go
index 5a7756a..867e076 100644
--- a/pkg/sdk/ssh_commands_test.go
+++ b/pkg/sdk/ssh_commands_test.go
@@ -61,3 +61,47 @@ func readAllJSON(r *http.Request) (map[string]interface{}, error) {
 	}
 	return out, nil
 }
+
+func TestLinkGlobalCommand(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		assert.Equal(t, http.MethodPost, r.Method)
+		assert.Equal(t, "/projects/my-app/commands/link_global", r.URL.Path)
+
+		// Body must be FLAT (top-level command_id).
+		var body map[string]string
+		require.NoError(t, json.NewDecoder(r.Body).Decode(&body))
+		assert.Equal(t, "cmd-1", body["command_id"])
+		_, hasWrapper := body["command"]
+		assert.False(t, hasWrapper, "body should be flat, not wrapped in command")
+
+		w.WriteHeader(http.StatusCreated)
+		_ = json.NewEncoder(w).Encode(SSHCommand{Identifier: "cmd-1", Command: "echo hi", Timing: "all"})
+	}))
+	defer server.Close()
+
+	c := newTestClient(t, server)
+	cmd, err := c.LinkGlobalCommand(context.Background(), "my-app", "cmd-1")
+	require.NoError(t, err)
+	assert.Equal(t, "cmd-1", cmd.Identifier)
+	assert.Equal(t, "echo hi", cmd.Command)
+}
+
+func TestUnlinkGlobalCommand(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		assert.Equal(t, http.MethodDelete, r.Method)
+		assert.Equal(t, "/projects/my-app/commands/unlink_global", r.URL.Path)
+
+		// DELETE carries a FLAT body.
+		var body map[string]string
+		require.NoError(t, json.NewDecoder(r.Body).Decode(&body))
+		assert.Equal(t, "cmd-1", body["command_id"])
+
+		w.WriteHeader(http.StatusOK)
+		_ = json.NewEncoder(w).Encode(map[string]string{"status": "deleted"})
+	}))
+	defer server.Close()
+
+	c := newTestClient(t, server)
+	err := c.UnlinkGlobalCommand(context.Background(), "my-app", "cmd-1")
+	require.NoError(t, err)
+}
diff --git a/pkg/sdk/template_subresources.go b/pkg/sdk/template_subresources.go
new file mode 100644
index 0000000..3eaa599
--- /dev/null
+++ b/pkg/sdk/template_subresources.go
@@ -0,0 +1,421 @@
+package sdk
+
+import (
+	"context"
+	"fmt"
+)
+
+// Template sub-resources mirror the project-level resources, but are nested
+// under /templates/:template_id/... where :template_id is the template's
+// string permalink. Sub-resource items are keyed by their string identifier
+// (or, for build_languages, by the package name).
+//
+// Types are reused from the project-level equivalents wherever the shape is
+// identical (ConfigFile, ExcludedFile, SSHCommand, BuildCommand,
+// BuildCacheFile, BuildKnownHost, Integration, Server, BuildConfig,
+// BuildLanguage). New request types are defined only where the template
+// variant genuinely differs (server groups gain extra fields).
+
+// --- 1. config_files (full CRUD) ---
+
+func (c *Client) ListTemplateConfigFiles(ctx context.Context, templatePermalink string, opts *ListOptions) ([]ConfigFile, error) {
+	var files []ConfigFile
+	path := appendListParams(fmt.Sprintf("/templates/%s/config_files", templatePermalink), opts)
+	if err := c.get(ctx, path, &files); err != nil {
+		return nil, err
+	}
+	return files, nil
+}
+
+func (c *Client) GetTemplateConfigFile(ctx context.Context, templatePermalink, fileID string) (*ConfigFile, error) {
+	var file ConfigFile
+	if err := c.get(ctx, fmt.Sprintf("/templates/%s/config_files/%s", templatePermalink, fileID), &file); err != nil {
+		return nil, err
+	}
+	return &file, nil
+}
+
+func (c *Client) CreateTemplateConfigFile(ctx context.Context, templatePermalink string, req ConfigFileCreateRequest) (*ConfigFile, error) {
+	body := struct {
+		ConfigFile ConfigFileCreateRequest `json:"config_file"`
+	}{ConfigFile: req}
+	var file ConfigFile
+	if err := c.post(ctx, fmt.Sprintf("/templates/%s/config_files", templatePermalink), body, &file); err != nil {
+		return nil, err
+	}
+	return &file, nil
+}
+
+func (c *Client) UpdateTemplateConfigFile(ctx context.Context, templatePermalink, fileID string, req ConfigFileCreateRequest) (*ConfigFile, error) {
+	body := struct {
+		ConfigFile ConfigFileCreateRequest `json:"config_file"`
+	}{ConfigFile: req}
+	var file ConfigFile
+	if err := c.put(ctx, fmt.Sprintf("/templates/%s/config_files/%s", templatePermalink, fileID), body, &file); err != nil {
+		return nil, err
+	}
+	return &file, nil
+}
+
+func (c *Client) DeleteTemplateConfigFile(ctx context.Context, templatePermalink, fileID string) error {
+	return c.delete(ctx, fmt.Sprintf("/templates/%s/config_files/%s", templatePermalink, fileID))
+}
+
+// --- 2. excluded_files (index/create/update/destroy — NO show) ---
+
+func (c *Client) ListTemplateExcludedFiles(ctx context.Context, templatePermalink string, opts *ListOptions) ([]ExcludedFile, error) {
+	var files []ExcludedFile
+	path := appendListParams(fmt.Sprintf("/templates/%s/excluded_files", templatePermalink), opts)
+	if err := c.get(ctx, path, &files); err != nil {
+		return nil, err
+	}
+	return files, nil
+}
+
+func (c *Client) CreateTemplateExcludedFile(ctx context.Context, templatePermalink string, req ExcludedFileCreateRequest) (*ExcludedFile, error) {
+	body := struct {
+		ExcludedFile ExcludedFileCreateRequest `json:"excluded_file"`
+	}{ExcludedFile: req}
+	var file ExcludedFile
+	if err := c.post(ctx, fmt.Sprintf("/templates/%s/excluded_files", templatePermalink), body, &file); err != nil {
+		return nil, err
+	}
+	return &file, nil
+}
+
+func (c *Client) UpdateTemplateExcludedFile(ctx context.Context, templatePermalink, fileID string, req ExcludedFileCreateRequest) (*ExcludedFile, error) {
+	body := struct {
+		ExcludedFile ExcludedFileCreateRequest `json:"excluded_file"`
+	}{ExcludedFile: req}
+	var file ExcludedFile
+	if err := c.put(ctx, fmt.Sprintf("/templates/%s/excluded_files/%s", templatePermalink, fileID), body, &file); err != nil {
+		return nil, err
+	}
+	return &file, nil
+}
+
+func (c *Client) DeleteTemplateExcludedFile(ctx context.Context, templatePermalink, fileID string) error {
+	return c.delete(ctx, fmt.Sprintf("/templates/%s/excluded_files/%s", templatePermalink, fileID))
+}
+
+// --- 3. integrations (index/create/update/destroy) ---
+// Delta from project-level: create is limited to ALLOWED_API_TYPES server-side
+// (422 otherwise); hook_type is immutable on update; external-auth hook types
+// may return {auth_required, auth_url} instead of an integration — surfaced
+// via the raw create/update response when present.
+
+func (c *Client) ListTemplateIntegrations(ctx context.Context, templatePermalink string, opts *ListOptions) ([]Integration, error) {
+	var integrations []Integration
+	path := appendListParams(fmt.Sprintf("/templates/%s/integrations", templatePermalink), opts)
+	if err := c.get(ctx, path, &integrations); err != nil {
+		return nil, err
+	}
+	return integrations, nil
+}
+
+func (c *Client) CreateTemplateIntegration(ctx context.Context, templatePermalink string, req IntegrationCreateRequest) (*Integration, error) {
+	body := struct {
+		Integration IntegrationCreateRequest `json:"integration"`
+	}{Integration: req}
+	var integration Integration
+	if err := c.post(ctx, fmt.Sprintf("/templates/%s/integrations", templatePermalink), body, &integration); err != nil {
+		return nil, err
+	}
+	return &integration, nil
+}
+
+func (c *Client) UpdateTemplateIntegration(ctx context.Context, templatePermalink, integrationID string, req IntegrationCreateRequest) (*Integration, error) {
+	body := struct {
+		Integration IntegrationCreateRequest `json:"integration"`
+	}{Integration: req}
+	var integration Integration
+	if err := c.put(ctx, fmt.Sprintf("/templates/%s/integrations/%s", templatePermalink, integrationID), body, &integration); err != nil {
+		return nil, err
+	}
+	return &integration, nil
+}
+
+func (c *Client) DeleteTemplateIntegration(ctx context.Context, templatePermalink, integrationID string) error {
+	return c.delete(ctx, fmt.Sprintf("/templates/%s/integrations/%s", templatePermalink, integrationID))
+}
+
+// --- 4. commands (index/create/update/destroy) ---
+// Wrapper key "command"; reuses SSHCommand/SSHCommandCreateRequest.
+// NOTE: /templates/:id/ssh_commands is a DUPLICATE route to the same
+// controller; the CLI exposes `dhq templates commands` (with an
+// `ssh-commands` alias). These methods drive both routes identically.
+
+func (c *Client) ListTemplateCommands(ctx context.Context, templatePermalink string, opts *ListOptions) ([]SSHCommand, error) {
+	var cmds []SSHCommand
+	path := appendListParams(fmt.Sprintf("/templates/%s/commands", templatePermalink), opts)
+	if err := c.get(ctx, path, &cmds); err != nil {
+		return nil, err
+	}
+	return cmds, nil
+}
+
+func (c *Client) CreateTemplateCommand(ctx context.Context, templatePermalink string, req SSHCommandCreateRequest) (*SSHCommand, error) {
+	body := struct {
+		Command SSHCommandCreateRequest `json:"command"`
+	}{Command: req}
+	var cmd SSHCommand
+	if err := c.post(ctx, fmt.Sprintf("/templates/%s/commands", templatePermalink), body, &cmd); err != nil {
+		return nil, err
+	}
+	return &cmd, nil
+}
+
+func (c *Client) UpdateTemplateCommand(ctx context.Context, templatePermalink, cmdID string, req SSHCommandCreateRequest) (*SSHCommand, error) {
+	body := struct {
+		Command SSHCommandCreateRequest `json:"command"`
+	}{Command: req}
+	var cmd SSHCommand
+	if err := c.put(ctx, fmt.Sprintf("/templates/%s/commands/%s", templatePermalink, cmdID), body, &cmd); err != nil {
+		return nil, err
+	}
+	return &cmd, nil
+}
+
+func (c *Client) DeleteTemplateCommand(ctx context.Context, templatePermalink, cmdID string) error {
+	return c.delete(ctx, fmt.Sprintf("/templates/%s/commands/%s", templatePermalink, cmdID))
+}
+
+// --- 5. build_commands (index/create/update/destroy) ---
+// Delta: server-side failures surface as 500 (not 422). Just surface the error.
+
+func (c *Client) ListTemplateBuildCommands(ctx context.Context, templatePermalink string, opts *ListOptions) ([]BuildCommand, error) {
+	var cmds []BuildCommand
+	path := appendListParams(fmt.Sprintf("/templates/%s/build_commands", templatePermalink), opts)
+	if err := c.get(ctx, path, &cmds); err != nil {
+		return nil, err
+	}
+	return cmds, nil
+}
+
+func (c *Client) CreateTemplateBuildCommand(ctx context.Context, templatePermalink string, req BuildCommandCreateRequest) (*BuildCommand, error) {
+	body := struct {
+		BuildCommand BuildCommandCreateRequest `json:"build_command"`
+	}{BuildCommand: req}
+	var cmd BuildCommand
+	if err := c.post(ctx, fmt.Sprintf("/templates/%s/build_commands", templatePermalink), body, &cmd); err != nil {
+		return nil, err
+	}
+	return &cmd, nil
+}
+
+func (c *Client) UpdateTemplateBuildCommand(ctx context.Context, templatePermalink, cmdID string, req BuildCommandCreateRequest) (*BuildCommand, error) {
+	body := struct {
+		BuildCommand BuildCommandCreateRequest `json:"build_command"`
+	}{BuildCommand: req}
+	var cmd BuildCommand
+	if err := c.put(ctx, fmt.Sprintf("/templates/%s/build_commands/%s", templatePermalink, cmdID), body, &cmd); err != nil {
+		return nil, err
+	}
+	return &cmd, nil
+}
+
+func (c *Client) DeleteTemplateBuildCommand(ctx context.Context, templatePermalink, cmdID string) error {
+	return c.delete(ctx, fmt.Sprintf("/templates/%s/build_commands/%s", templatePermalink, cmdID))
+}
+
+// --- 6. build_cache_files (index/create/update/destroy) ---
+// Delta: 500 on server-side failure.
+
+func (c *Client) ListTemplateBuildCacheFiles(ctx context.Context, templatePermalink string) ([]BuildCacheFile, error) {
+	var files []BuildCacheFile
+	if err := c.get(ctx, fmt.Sprintf("/templates/%s/build_cache_files", templatePermalink), &files); err != nil {
+		return nil, err
+	}
+	return files, nil
+}
+
+func (c *Client) CreateTemplateBuildCacheFile(ctx context.Context, templatePermalink string, req BuildCacheFileCreateRequest) (*BuildCacheFile, error) {
+	body := struct {
+		BuildCacheFile BuildCacheFileCreateRequest `json:"build_cache_file"`
+	}{BuildCacheFile: req}
+	var file BuildCacheFile
+	if err := c.post(ctx, fmt.Sprintf("/templates/%s/build_cache_files", templatePermalink), body, &file); err != nil {
+		return nil, err
+	}
+	return &file, nil
+}
+
+func (c *Client) UpdateTemplateBuildCacheFile(ctx context.Context, templatePermalink, fileID string, req BuildCacheFileCreateRequest) (*BuildCacheFile, error) {
+	body := struct {
+		BuildCacheFile BuildCacheFileCreateRequest `json:"build_cache_file"`
+	}{BuildCacheFile: req}
+	var file BuildCacheFile
+	if err := c.put(ctx, fmt.Sprintf("/templates/%s/build_cache_files/%s", templatePermalink, fileID), body, &file); err != nil {
+		return nil, err
+	}
+	return &file, nil
+}
+
+func (c *Client) DeleteTemplateBuildCacheFile(ctx context.Context, templatePermalink, fileID string) error {
+	return c.delete(ctx, fmt.Sprintf("/templates/%s/build_cache_files/%s", templatePermalink, fileID))
+}
+
+// --- 7. build_known_hosts (index/create/destroy — NO update) ---
+// Delta: 500 on create failure.
+
+func (c *Client) ListTemplateBuildKnownHosts(ctx context.Context, templatePermalink string) ([]BuildKnownHost, error) {
+	var hosts []BuildKnownHost
+	if err := c.get(ctx, fmt.Sprintf("/templates/%s/build_known_hosts", templatePermalink), &hosts); err != nil {
+		return nil, err
+	}
+	return hosts, nil
+}
+
+func (c *Client) CreateTemplateBuildKnownHost(ctx context.Context, templatePermalink string, req BuildKnownHostCreateRequest) (*BuildKnownHost, error) {
+	body := struct {
+		BuildKnownHost BuildKnownHostCreateRequest `json:"build_known_host"`
+	}{BuildKnownHost: req}
+	var host BuildKnownHost
+	if err := c.post(ctx, fmt.Sprintf("/templates/%s/build_known_hosts", templatePermalink), body, &host); err != nil {
+		return nil, err
+	}
+	return &host, nil
+}
+
+func (c *Client) DeleteTemplateBuildKnownHost(ctx context.Context, templatePermalink, hostID string) error {
+	return c.delete(ctx, fmt.Sprintf("/templates/%s/build_known_hosts/%s", templatePermalink, hostID))
+}
+
+// --- 8. build_languages (UPDATE ONLY) ---
+// PATCH /templates/:id/build_languages/:package_name — targets the template's
+// default build environment. Wrapper key "build_environment" with just
+// `version`. The :id path segment is the package NAME (e.g. "ruby", "nodejs").
+
+func (c *Client) UpdateTemplateBuildLanguage(ctx context.Context, templatePermalink, packageName string, req BuildLanguageUpdateRequest) (*BuildLanguage, error) {
+	body := struct {
+		BuildEnvironment BuildLanguageUpdateRequest `json:"build_environment"`
+	}{BuildEnvironment: req}
+	var lang BuildLanguage
+	path := fmt.Sprintf("/templates/%s/build_languages/%s", templatePermalink, packageName)
+	if err := c.patch(ctx, path, body, &lang); err != nil {
+		return nil, err
+	}
+	return &lang, nil
+}
+
+// --- 9. build_configuration (SHOW ONLY, singular route) ---
+// GET /templates/:id/build_configuration (no :id) — returns the template's
+// default build environment api hash.
+
+func (c *Client) GetTemplateBuildConfiguration(ctx context.Context, templatePermalink string) (*BuildConfig, error) {
+	var config BuildConfig
+	if err := c.get(ctx, fmt.Sprintf("/templates/%s/build_configuration", templatePermalink), &config); err != nil {
+		return nil, err
+	}
+	return &config, nil
+}
+
+// --- 10. servers (full CRUD) ---
+// Reuses the project-level Server type and request shapes.
+// Delta: PROJECT_ONLY_PROTOCOLS are rejected 422 server-side; the API also
+// accepts a `protocol_type` alias (already the field name we send).
+
+func (c *Client) ListTemplateServers(ctx context.Context, templatePermalink string, opts *ListOptions) ([]Server, error) {
+	var servers []Server
+	path := appendListParams(fmt.Sprintf("/templates/%s/servers", templatePermalink), opts)
+	if err := c.get(ctx, path, &servers); err != nil {
+		return nil, err
+	}
+	return servers, nil
+}
+
+func (c *Client) GetTemplateServer(ctx context.Context, templatePermalink, serverID string) (*Server, error) {
+	var server Server
+	if err := c.get(ctx, fmt.Sprintf("/templates/%s/servers/%s", templatePermalink, serverID), &server); err != nil {
+		return nil, err
+	}
+	return &server, nil
+}
+
+func (c *Client) CreateTemplateServer(ctx context.Context, templatePermalink string, req ServerCreateRequest) (*Server, error) {
+	body := struct {
+		Server ServerCreateRequest `json:"server"`
+	}{Server: req}
+	var server Server
+	if err := c.post(ctx, fmt.Sprintf("/templates/%s/servers", templatePermalink), body, &server); err != nil {
+		return nil, err
+	}
+	return &server, nil
+}
+
+func (c *Client) UpdateTemplateServer(ctx context.Context, templatePermalink, serverID string, req ServerUpdateRequest) (*Server, error) {
+	body := struct {
+		Server ServerUpdateRequest `json:"server"`
+	}{Server: req}
+	var server Server
+	if err := c.put(ctx, fmt.Sprintf("/templates/%s/servers/%s", templatePermalink, serverID), body, &server); err != nil {
+		return nil, err
+	}
+	return &server, nil
+}
+
+func (c *Client) DeleteTemplateServer(ctx context.Context, templatePermalink, serverID string) error {
+	return c.delete(ctx, fmt.Sprintf("/templates/%s/servers/%s", templatePermalink, serverID))
+}
+
+// --- 11. server_groups (index/create/update/destroy — NO show) ---
+// The template variant accepts more fields than the project-level create
+// (name, auto_deploy, transfer_order, email_notify_on, notification_email,
+// environment), so it uses dedicated request types.
+
+// TemplateServerGroupCreateRequest is the payload for creating a template
+// server group. Wrapper key "server_group".
+type TemplateServerGroupCreateRequest struct {
+	Name              string `json:"name"`
+	AutoDeploy        *bool  `json:"auto_deploy,omitempty"`
+	TransferOrder     string `json:"transfer_order,omitempty"`
+	EmailNotifyOn     string `json:"email_notify_on,omitempty"`
+	NotificationEmail string `json:"notification_email,omitempty"`
+	Environment       string `json:"environment,omitempty"`
+}
+
+// TemplateServerGroupUpdateRequest is the payload for updating a template
+// server group. All fields are optional.
+type TemplateServerGroupUpdateRequest struct {
+	Name              string `json:"name,omitempty"`
+	AutoDeploy        *bool  `json:"auto_deploy,omitempty"`
+	TransferOrder     string `json:"transfer_order,omitempty"`
+	EmailNotifyOn     string `json:"email_notify_on,omitempty"`
+	NotificationEmail string `json:"notification_email,omitempty"`
+	Environment       string `json:"environment,omitempty"`
+}
+
+func (c *Client) ListTemplateServerGroups(ctx context.Context, templatePermalink string, opts *ListOptions) ([]ServerGroup, error) {
+	var groups []ServerGroup
+	path := appendListParams(fmt.Sprintf("/templates/%s/server_groups", templatePermalink), opts)
+	if err := c.get(ctx, path, &groups); err != nil {
+		return nil, err
+	}
+	return groups, nil
+}
+
+func (c *Client) CreateTemplateServerGroup(ctx context.Context, templatePermalink string, req TemplateServerGroupCreateRequest) (*ServerGroup, error) {
+	body := struct {
+		ServerGroup TemplateServerGroupCreateRequest `json:"server_group"`
+	}{ServerGroup: req}
+	var group ServerGroup
+	if err := c.post(ctx, fmt.Sprintf("/templates/%s/server_groups", templatePermalink), body, &group); err != nil {
+		return nil, err
+	}
+	return &group, nil
+}
+
+func (c *Client) UpdateTemplateServerGroup(ctx context.Context, templatePermalink, groupID string, req TemplateServerGroupUpdateRequest) (*ServerGroup, error) {
+	body := struct {
+		ServerGroup TemplateServerGroupUpdateRequest `json:"server_group"`
+	}{ServerGroup: req}
+	var group ServerGroup
+	if err := c.put(ctx, fmt.Sprintf("/templates/%s/server_groups/%s", templatePermalink, groupID), body, &group); err != nil {
+		return nil, err
+	}
+	return &group, nil
+}
+
+func (c *Client) DeleteTemplateServerGroup(ctx context.Context, templatePermalink, groupID string) error {
+	return c.delete(ctx, fmt.Sprintf("/templates/%s/server_groups/%s", templatePermalink, groupID))
+}
diff --git a/pkg/sdk/template_subresources_test.go b/pkg/sdk/template_subresources_test.go
new file mode 100644
index 0000000..a4ac3b8
--- /dev/null
+++ b/pkg/sdk/template_subresources_test.go
@@ -0,0 +1,457 @@
+package sdk
+
+import (
+	"context"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// These tests focus on path correctness, the request wrapper key, and the
+// per-sub-resource deltas (update-only build_languages with a package-name id,
+// show-only build_configuration, no-update build_known_hosts). Field-level
+// coverage is delegated to the project-level tests since the types are reused.
+
+// --- 1. config_files ---
+
+func TestListTemplateConfigFiles(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		assert.Equal(t, "/templates/my-tmpl/config_files", r.URL.Path)
+		_ = json.NewEncoder(w).Encode([]ConfigFile{{Identifier: "cf1", Path: "/etc/app.conf"}})
+	}))
+	defer srv.Close()
+
+	c := newTestClient(t, srv)
+	files, err := c.ListTemplateConfigFiles(context.Background(), "my-tmpl", nil)
+	require.NoError(t, err)
+	assert.Len(t, files, 1)
+	assert.Equal(t, "/etc/app.conf", files[0].Path)
+}
+
+func TestCreateTemplateConfigFile(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		assert.Equal(t, http.MethodPost, r.Method)
+		assert.Equal(t, "/templates/my-tmpl/config_files", r.URL.Path)
+		var body struct {
+			ConfigFile ConfigFileCreateRequest `json:"config_file"`
+		}
+		require.NoError(t, json.NewDecoder(r.Body).Decode(&body))
+		assert.Equal(t, "/etc/app.conf", body.ConfigFile.Path)
+		w.WriteHeader(http.StatusCreated)
+		_ = json.NewEncoder(w).Encode(ConfigFile{Identifier: "cf1", Path: body.ConfigFile.Path})
+	}))
+	defer srv.Close()
+
+	c := newTestClient(t, srv)
+	f, err := c.CreateTemplateConfigFile(context.Background(), "my-tmpl", ConfigFileCreateRequest{Path: "/etc/app.conf", Body: "x"})
+	require.NoError(t, err)
+	assert.Equal(t, "/etc/app.conf", f.Path)
+}
+
+func TestGetTemplateConfigFile(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		assert.Equal(t, "/templates/my-tmpl/config_files/cf1", r.URL.Path)
+		_ = json.NewEncoder(w).Encode(ConfigFile{Identifier: "cf1", Path: "/etc/app.conf"})
+	}))
+	defer srv.Close()
+
+	c := newTestClient(t, srv)
+	f, err := c.GetTemplateConfigFile(context.Background(), "my-tmpl", "cf1")
+	require.NoError(t, err)
+	assert.Equal(t, "cf1", f.Identifier)
+}
+
+func TestDeleteTemplateConfigFile(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		assert.Equal(t, http.MethodDelete, r.Method)
+		assert.Equal(t, "/templates/my-tmpl/config_files/cf1", r.URL.Path)
+		w.WriteHeader(http.StatusNoContent)
+	}))
+	defer srv.Close()
+
+	c := newTestClient(t, srv)
+	require.NoError(t, c.DeleteTemplateConfigFile(context.Background(), "my-tmpl", "cf1"))
+}
+
+// --- 2. excluded_files ---
+
+func TestListTemplateExcludedFiles(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		assert.Equal(t, "/templates/my-tmpl/excluded_files", r.URL.Path)
+		_ = json.NewEncoder(w).Encode([]ExcludedFile{{Identifier: "ef1", Path: "*.log"}})
+	}))
+	defer srv.Close()
+
+	c := newTestClient(t, srv)
+	files, err := c.ListTemplateExcludedFiles(context.Background(), "my-tmpl", nil)
+	require.NoError(t, err)
+	assert.Equal(t, "*.log", files[0].Path)
+}
+
+func TestCreateTemplateExcludedFile(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		assert.Equal(t, "/templates/my-tmpl/excluded_files", r.URL.Path)
+		var body struct {
+			ExcludedFile ExcludedFileCreateRequest `json:"excluded_file"`
+		}
+		require.NoError(t, json.NewDecoder(r.Body).Decode(&body))
+		assert.Equal(t, "*.log", body.ExcludedFile.Path)
+		w.WriteHeader(http.StatusCreated)
+		_ = json.NewEncoder(w).Encode(ExcludedFile{Identifier: "ef1", Path: body.ExcludedFile.Path})
+	}))
+	defer srv.Close()
+
+	c := newTestClient(t, srv)
+	f, err := c.CreateTemplateExcludedFile(context.Background(), "my-tmpl", ExcludedFileCreateRequest{Path: "*.log"})
+	require.NoError(t, err)
+	assert.Equal(t, "*.log", f.Path)
+}
+
+func TestDeleteTemplateExcludedFile(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		assert.Equal(t, http.MethodDelete, r.Method)
+		assert.Equal(t, "/templates/my-tmpl/excluded_files/ef1", r.URL.Path)
+		w.WriteHeader(http.StatusNoContent)
+	}))
+	defer srv.Close()
+
+	c := newTestClient(t, srv)
+	require.NoError(t, c.DeleteTemplateExcludedFile(context.Background(), "my-tmpl", "ef1"))
+}
+
+// --- 3. integrations ---
+
+func TestListTemplateIntegrations(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		assert.Equal(t, "/templates/my-tmpl/integrations", r.URL.Path)
+		_ = json.NewEncoder(w).Encode([]Integration{{Identifier: "in1", HookType: "slack"}})
+	}))
+	defer srv.Close()
+
+	c := newTestClient(t, srv)
+	ints, err := c.ListTemplateIntegrations(context.Background(), "my-tmpl", nil)
+	require.NoError(t, err)
+	assert.Equal(t, "slack", ints[0].HookType)
+}
+
+func TestCreateTemplateIntegration(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		assert.Equal(t, "/templates/my-tmpl/integrations", r.URL.Path)
+		var body struct {
+			Integration IntegrationCreateRequest `json:"integration"`
+		}
+		require.NoError(t, json.NewDecoder(r.Body).Decode(&body))
+		assert.Equal(t, "slack", body.Integration.HookType)
+		w.WriteHeader(http.StatusCreated)
+		_ = json.NewEncoder(w).Encode(Integration{Identifier: "in1", HookType: body.Integration.HookType})
+	}))
+	defer srv.Close()
+
+	c := newTestClient(t, srv)
+	in, err := c.CreateTemplateIntegration(context.Background(), "my-tmpl", IntegrationCreateRequest{HookType: "slack"})
+	require.NoError(t, err)
+	assert.Equal(t, "slack", in.HookType)
+}
+
+// --- 4. commands ---
+
+func TestListTemplateCommands(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		assert.Equal(t, "/templates/my-tmpl/commands", r.URL.Path)
+		_ = json.NewEncoder(w).Encode([]SSHCommand{{Identifier: "cmd1", Command: "ls"}})
+	}))
+	defer srv.Close()
+
+	c := newTestClient(t, srv)
+	cmds, err := c.ListTemplateCommands(context.Background(), "my-tmpl", nil)
+	require.NoError(t, err)
+	assert.Equal(t, "ls", cmds[0].Command)
+}
+
+func TestCreateTemplateCommand(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		assert.Equal(t, "/templates/my-tmpl/commands", r.URL.Path)
+		var body struct {
+			Command SSHCommandCreateRequest `json:"command"`
+		}
+		require.NoError(t, json.NewDecoder(r.Body).Decode(&body))
+		assert.Equal(t, "ls -la", body.Command.Command)
+		w.WriteHeader(http.StatusCreated)
+		_ = json.NewEncoder(w).Encode(SSHCommand{Identifier: "cmd1", Command: body.Command.Command})
+	}))
+	defer srv.Close()
+
+	c := newTestClient(t, srv)
+	cmd, err := c.CreateTemplateCommand(context.Background(), "my-tmpl", SSHCommandCreateRequest{Command: "ls -la"})
+	require.NoError(t, err)
+	assert.Equal(t, "ls -la", cmd.Command)
+}
+
+// --- 5. build_commands ---
+
+func TestListTemplateBuildCommands(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		assert.Equal(t, "/templates/my-tmpl/build_commands", r.URL.Path)
+		_ = json.NewEncoder(w).Encode([]BuildCommand{{Identifier: "bc1", Command: "npm ci"}})
+	}))
+	defer srv.Close()
+
+	c := newTestClient(t, srv)
+	cmds, err := c.ListTemplateBuildCommands(context.Background(), "my-tmpl", nil)
+	require.NoError(t, err)
+	assert.Equal(t, "npm ci", cmds[0].Command)
+}
+
+func TestCreateTemplateBuildCommand(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		assert.Equal(t, "/templates/my-tmpl/build_commands", r.URL.Path)
+		var body struct {
+			BuildCommand BuildCommandCreateRequest `json:"build_command"`
+		}
+		require.NoError(t, json.NewDecoder(r.Body).Decode(&body))
+		assert.Equal(t, "npm run build", body.BuildCommand.Command)
+		w.WriteHeader(http.StatusCreated)
+		_ = json.NewEncoder(w).Encode(BuildCommand{Identifier: "bc1", Command: body.BuildCommand.Command})
+	}))
+	defer srv.Close()
+
+	c := newTestClient(t, srv)
+	cmd, err := c.CreateTemplateBuildCommand(context.Background(), "my-tmpl", BuildCommandCreateRequest{Command: "npm run build"})
+	require.NoError(t, err)
+	assert.Equal(t, "npm run build", cmd.Command)
+}
+
+// --- 6. build_cache_files ---
+
+func TestListTemplateBuildCacheFiles(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		assert.Equal(t, "/templates/my-tmpl/build_cache_files", r.URL.Path)
+		_ = json.NewEncoder(w).Encode([]BuildCacheFile{{Identifier: "bcf1", Path: "node_modules"}})
+	}))
+	defer srv.Close()
+
+	c := newTestClient(t, srv)
+	files, err := c.ListTemplateBuildCacheFiles(context.Background(), "my-tmpl")
+	require.NoError(t, err)
+	assert.Equal(t, "node_modules", files[0].Path)
+}
+
+func TestCreateTemplateBuildCacheFile(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		assert.Equal(t, "/templates/my-tmpl/build_cache_files", r.URL.Path)
+		var body struct {
+			BuildCacheFile BuildCacheFileCreateRequest `json:"build_cache_file"`
+		}
+		require.NoError(t, json.NewDecoder(r.Body).Decode(&body))
+		assert.Equal(t, "vendor", body.BuildCacheFile.Path)
+		w.WriteHeader(http.StatusCreated)
+		_ = json.NewEncoder(w).Encode(BuildCacheFile{Identifier: "bcf1", Path: body.BuildCacheFile.Path})
+	}))
+	defer srv.Close()
+
+	c := newTestClient(t, srv)
+	f, err := c.CreateTemplateBuildCacheFile(context.Background(), "my-tmpl", BuildCacheFileCreateRequest{Path: "vendor"})
+	require.NoError(t, err)
+	assert.Equal(t, "vendor", f.Path)
+}
+
+// --- 7. build_known_hosts (no update) ---
+
+func TestListTemplateBuildKnownHosts(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		assert.Equal(t, "/templates/my-tmpl/build_known_hosts", r.URL.Path)
+		_ = json.NewEncoder(w).Encode([]BuildKnownHost{{Identifier: "kh1", Hostname: "github.com"}})
+	}))
+	defer srv.Close()
+
+	c := newTestClient(t, srv)
+	hosts, err := c.ListTemplateBuildKnownHosts(context.Background(), "my-tmpl")
+	require.NoError(t, err)
+	assert.Equal(t, "github.com", hosts[0].Hostname)
+}
+
+func TestCreateTemplateBuildKnownHost(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		assert.Equal(t, "/templates/my-tmpl/build_known_hosts", r.URL.Path)
+		var body struct {
+			BuildKnownHost BuildKnownHostCreateRequest `json:"build_known_host"`
+		}
+		require.NoError(t, json.NewDecoder(r.Body).Decode(&body))
+		assert.Equal(t, "github.com", body.BuildKnownHost.Hostname)
+		w.WriteHeader(http.StatusCreated)
+		_ = json.NewEncoder(w).Encode(BuildKnownHost{Identifier: "kh1", Hostname: body.BuildKnownHost.Hostname})
+	}))
+	defer srv.Close()
+
+	c := newTestClient(t, srv)
+	h, err := c.CreateTemplateBuildKnownHost(context.Background(), "my-tmpl", BuildKnownHostCreateRequest{Hostname: "github.com", PublicKey: "ssh-rsa AAAA"})
+	require.NoError(t, err)
+	assert.Equal(t, "github.com", h.Hostname)
+}
+
+// --- 8. build_languages (UPDATE ONLY; PATCH; :id = package name) ---
+
+func TestUpdateTemplateBuildLanguage(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		assert.Equal(t, http.MethodPatch, r.Method)
+		assert.Equal(t, "/templates/my-tmpl/build_languages/ruby", r.URL.Path)
+		var body struct {
+			BuildEnvironment BuildLanguageUpdateRequest `json:"build_environment"`
+		}
+		require.NoError(t, json.NewDecoder(r.Body).Decode(&body))
+		assert.Equal(t, "3.3.0", body.BuildEnvironment.Version)
+		_ = json.NewEncoder(w).Encode(BuildLanguage{Name: "ruby", Version: body.BuildEnvironment.Version})
+	}))
+	defer srv.Close()
+
+	c := newTestClient(t, srv)
+	lang, err := c.UpdateTemplateBuildLanguage(context.Background(), "my-tmpl", "ruby", BuildLanguageUpdateRequest{Version: "3.3.0"})
+	require.NoError(t, err)
+	assert.Equal(t, "3.3.0", lang.Version)
+}
+
+// --- 9. build_configuration (SHOW ONLY; singular route, no :id) ---
+
+func TestGetTemplateBuildConfiguration(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		assert.Equal(t, http.MethodGet, r.Method)
+		assert.Equal(t, "/templates/my-tmpl/build_configuration", r.URL.Path)
+		_ = json.NewEncoder(w).Encode(BuildConfig{Identifier: "be1", Default: true, Packages: map[string]string{"ruby": "3.3.0"}})
+	}))
+	defer srv.Close()
+
+	c := newTestClient(t, srv)
+	cfg, err := c.GetTemplateBuildConfiguration(context.Background(), "my-tmpl")
+	require.NoError(t, err)
+	assert.True(t, cfg.Default)
+	assert.Equal(t, "3.3.0", cfg.Packages["ruby"])
+}
+
+// --- 10. servers ---
+
+func TestListTemplateServers(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		assert.Equal(t, "/templates/my-tmpl/servers", r.URL.Path)
+		_ = json.NewEncoder(w).Encode([]Server{{Identifier: "s1", Name: "web", ProtocolType: "ssh"}})
+	}))
+	defer srv.Close()
+
+	c := newTestClient(t, srv)
+	servers, err := c.ListTemplateServers(context.Background(), "my-tmpl", nil)
+	require.NoError(t, err)
+	assert.Equal(t, "web", servers[0].Name)
+}
+
+func TestCreateTemplateServer(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		assert.Equal(t, "/templates/my-tmpl/servers", r.URL.Path)
+		var body struct {
+			Server ServerCreateRequest `json:"server"`
+		}
+		require.NoError(t, json.NewDecoder(r.Body).Decode(&body))
+		assert.Equal(t, "ssh", body.Server.ProtocolType)
+		w.WriteHeader(http.StatusCreated)
+		_ = json.NewEncoder(w).Encode(Server{Identifier: "s1", Name: body.Server.Name, ProtocolType: body.Server.ProtocolType})
+	}))
+	defer srv.Close()
+
+	c := newTestClient(t, srv)
+	s, err := c.CreateTemplateServer(context.Background(), "my-tmpl", ServerCreateRequest{Name: "web", ProtocolType: "ssh"})
+	require.NoError(t, err)
+	assert.Equal(t, "ssh", s.ProtocolType)
+}
+
+func TestGetTemplateServer(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		assert.Equal(t, "/templates/my-tmpl/servers/s1", r.URL.Path)
+		_ = json.NewEncoder(w).Encode(Server{Identifier: "s1", Name: "web"})
+	}))
+	defer srv.Close()
+
+	c := newTestClient(t, srv)
+	s, err := c.GetTemplateServer(context.Background(), "my-tmpl", "s1")
+	require.NoError(t, err)
+	assert.Equal(t, "s1", s.Identifier)
+}
+
+func TestDeleteTemplateServer(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		assert.Equal(t, http.MethodDelete, r.Method)
+		assert.Equal(t, "/templates/my-tmpl/servers/s1", r.URL.Path)
+		w.WriteHeader(http.StatusNoContent)
+	}))
+	defer srv.Close()
+
+	c := newTestClient(t, srv)
+	require.NoError(t, c.DeleteTemplateServer(context.Background(), "my-tmpl", "s1"))
+}
+
+// --- 11. server_groups (no show; extra fields on create) ---
+
+func TestListTemplateServerGroups(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		assert.Equal(t, "/templates/my-tmpl/server_groups", r.URL.Path)
+		_ = json.NewEncoder(w).Encode([]ServerGroup{{Identifier: "sg1", Name: "Production"}})
+	}))
+	defer srv.Close()
+
+	c := newTestClient(t, srv)
+	groups, err := c.ListTemplateServerGroups(context.Background(), "my-tmpl", nil)
+	require.NoError(t, err)
+	assert.Equal(t, "Production", groups[0].Name)
+}
+
+func TestCreateTemplateServerGroup(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		assert.Equal(t, "/templates/my-tmpl/server_groups", r.URL.Path)
+		var body struct {
+			ServerGroup TemplateServerGroupCreateRequest `json:"server_group"`
+		}
+		require.NoError(t, json.NewDecoder(r.Body).Decode(&body))
+		assert.Equal(t, "Staging", body.ServerGroup.Name)
+		assert.Equal(t, "production", body.ServerGroup.Environment)
+		w.WriteHeader(http.StatusCreated)
+		_ = json.NewEncoder(w).Encode(ServerGroup{Identifier: "sg-new", Name: body.ServerGroup.Name})
+	}))
+	defer srv.Close()
+
+	c := newTestClient(t, srv)
+	g, err := c.CreateTemplateServerGroup(context.Background(), "my-tmpl", TemplateServerGroupCreateRequest{Name: "Staging", Environment: "production"})
+	require.NoError(t, err)
+	assert.Equal(t, "Staging", g.Name)
+}
+
+func TestUpdateTemplateServerGroup(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		assert.Equal(t, http.MethodPut, r.Method)
+		assert.Equal(t, "/templates/my-tmpl/server_groups/sg1", r.URL.Path)
+		var body struct {
+			ServerGroup TemplateServerGroupUpdateRequest `json:"server_group"`
+		}
+		require.NoError(t, json.NewDecoder(r.Body).Decode(&body))
+		assert.Equal(t, "Renamed", body.ServerGroup.Name)
+		_ = json.NewEncoder(w).Encode(ServerGroup{Identifier: "sg1", Name: body.ServerGroup.Name})
+	}))
+	defer srv.Close()
+
+	c := newTestClient(t, srv)
+	g, err := c.UpdateTemplateServerGroup(context.Background(), "my-tmpl", "sg1", TemplateServerGroupUpdateRequest{Name: "Renamed"})
+	require.NoError(t, err)
+	assert.Equal(t, "Renamed", g.Name)
+}
+
+func TestDeleteTemplateServerGroup(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		assert.Equal(t, http.MethodDelete, r.Method)
+		assert.Equal(t, "/templates/my-tmpl/server_groups/sg1", r.URL.Path)
+		w.WriteHeader(http.StatusNoContent)
+	}))
+	defer srv.Close()
+
+	c := newTestClient(t, srv)
+	require.NoError(t, c.DeleteTemplateServerGroup(context.Background(), "my-tmpl", "sg1"))
+}
diff --git a/pkg/sdk/types.go b/pkg/sdk/types.go
index e3a0beb..612b622 100644
--- a/pkg/sdk/types.go
+++ b/pkg/sdk/types.go
@@ -431,32 +431,50 @@ type BetaEnrollmentResponse struct {
 	BetaFeatures bool `json:"beta_features"`
 }
 
-// ManagedHostingRegion is a DigitalOcean region available for Managed VPS provisioning.
+// ManagedHostingRegion is a DigitalOcean region available for Managed VPS
+// provisioning. Regions are served grouped by continent (see RegionGroup); this
+// is a single region row within a group.
 type ManagedHostingRegion struct {
 	// Slug is the region identifier used in ServerCreateRequest.Region (e.g. "lon1").
 	Slug string `json:"slug"`
 	// Name is the human-readable region name (e.g. "London, United Kingdom").
 	Name string `json:"name"`
-	// Available indicates whether new droplets can currently be created in this region.
-	Available bool `json:"available"`
+	// Flag is the emoji/flag glyph for the region's country.
+	Flag string `json:"flag"`
+	// Country is the human-readable country name.
+	Country string `json:"country"`
+}
+
+// RegionGroup is a named group of regions (e.g. "Europe") with the group's
+// default region slug.
+type RegionGroup struct {
+	// Default is the slug of the group's default region.
+	Default string `json:"default"`
+	// Regions are the regions within this group.
+	Regions []ManagedHostingRegion `json:"regions"`
+}
+
+// ManagedHostingRegionsResponse is the raw GET /managed_hosting/regions payload:
+// a map from group name to that group's regions and default.
+type ManagedHostingRegionsResponse struct {
+	GroupedRegions map[string]RegionGroup `json:"grouped_regions"`
 }
 
 // ManagedHostingSize is a DigitalOcean droplet size available for Managed VPS provisioning.
 type ManagedHostingSize struct {
 	// Slug is the size identifier used in ServerCreateRequest.Size (e.g. "s-1vcpu-1gb").
 	Slug string `json:"slug"`
-	// Description is the human-readable size label (e.g. "1 vCPU / 1 GB RAM").
-	Description string `json:"description"`
-	// PriceMonthly is the monthly cost in the account's billing currency.
-	PriceMonthly float64 `json:"price_monthly"`
-	// PriceHourly is the hourly cost in the account's billing currency.
-	PriceHourly float64 `json:"price_hourly"`
-	// Memory is the RAM in megabytes.
-	Memory int `json:"memory"`
-	// VCPUs is the number of virtual CPUs.
-	VCPUs int `json:"vcpus"`
-	// Disk is the root disk size in gigabytes.
-	Disk int `json:"disk"`
+	// Label is the human-readable size label (e.g. "1 vCPU / 1 GB RAM").
+	Label string `json:"label"`
+	// MonthlyCost is the monthly cost in the account's billing currency.
+	MonthlyCost float64 `json:"monthly_cost"`
+	// Currency is the ISO currency code for MonthlyCost (e.g. "USD").
+	Currency string `json:"currency"`
+}
+
+// ManagedHostingSizesResponse is the raw GET /managed_hosting/sizes payload.
+type ManagedHostingSizesResponse struct {
+	Sizes []ManagedHostingSize `json:"sizes"`
 }
 
 // ManagedVPSInfo is the nested `managed_vps` object within a server response for

From 55d3ea0d40a8a07b69ce11da4626c5e4f20ad64b Mon Sep 17 00:00:00 2001
From: Marta <martakaras1@gmail.com>
Date: Fri, 10 Jul 2026 16:36:20 +0200
Subject: [PATCH 2/2] fix: address code review feedback on managed hosting and
 long-tail commands

- launch: resolve monthly cost for explicit --size; format prices with the
  account currency instead of hardcoded $; select the API default region
  rather than an arbitrary one
- managed-hosting SDK: sort flattened regions deterministically
- invoices download: write PDF with 0600 permissions
- hosted-resources: drop the false $ prefix (API returns no currency)
- plans: honor --quiet
- templates: reject update commands with no changed flags
- refresh managed-hosting test fixtures to the current API shape
---
 internal/assist/prompt.go                   |  9 ++-
 internal/commands/hosted_resources.go       |  7 +-
 internal/commands/invoices.go               |  3 +-
 internal/commands/launch.go                 | 85 +++++++++++++++++----
 internal/commands/launch_test.go            | 70 +++++++++++++----
 internal/commands/packages.go               |  8 ++
 internal/commands/templates_subresources.go | 36 +++++++++
 pkg/sdk/managed_hosting.go                  | 29 ++++++-
 pkg/sdk/managed_hosting_test.go             |  5 ++
 pkg/sdk/projects_test.go                    |  7 +-
 10 files changed, 217 insertions(+), 42 deletions(-)

diff --git a/internal/assist/prompt.go b/internal/assist/prompt.go
index 9c9fcab..1647dc7 100644
--- a/internal/assist/prompt.go
+++ b/internal/assist/prompt.go
@@ -130,9 +130,11 @@ dhq scheduled-deploys list|show|create|update|delete -p <project>
 
 Templates:
 dhq templates list|show|public|public-show|create|update|delete
-dhq templates config-files|excluded-files|integrations|commands|build-commands|build-cache-files|build-known-hosts|servers|server-groups <action> -t <template>
+dhq templates config-files|servers list|show|create|update|delete -t <template>    (full CRUD)
+dhq templates excluded-files|integrations|commands|build-commands|build-cache-files|server-groups list|create|update|delete -t <template>    (no show)
+dhq templates build-known-hosts list|create|delete -t <template>    (no update)
 dhq templates build-languages set <package> --version <v> -t <template>
-dhq templates build-configuration -t <template>
+dhq templates build-configuration -t <template>    (show only)
 
 Managed Hosting:
 dhq hosted-resources list|show|sync|retry-provision
@@ -142,7 +144,8 @@ dhq beta enroll [--protocol managed_vps|static_hosting]    (enroll the account i
 Account Resources:
 dhq agents list|create|update|delete|revoke
 dhq global-servers list|show|create|update|delete|copy-to-project
-dhq invoices list|download <number>       (billing history; billing-manager key required)
+dhq invoices list                         (billing history; billing-manager key required)
+dhq invoices download <number>            (download an invoice PDF; billing-manager key required)
 dhq zones list
 
 Utilities & Info:
diff --git a/internal/commands/hosted_resources.go b/internal/commands/hosted_resources.go
index f4e4e28..ca06755 100644
--- a/internal/commands/hosted_resources.go
+++ b/internal/commands/hosted_resources.go
@@ -72,7 +72,10 @@ func newHostedResourcesListCmd() *cobra.Command {
 				return nil
 			}
 
-			columns := []string{"Name", "Identifier", "Kind", "Status", "Region / Subdomain", "Monthly Cost"}
+			// The hosted_resources endpoint reports monthly_cost in the account's
+			// billing currency but does not return the currency code, so we render
+			// a bare amount rather than falsely prefixing a currency symbol.
+			columns := []string{"Name", "Identifier", "Kind", "Status", "Region / Subdomain", "Monthly Cost (account currency)"}
 			rows := make([][]string, len(resources))
 			for i, r := range resources {
 				rows[i] = []string{
@@ -81,7 +84,7 @@ func newHostedResourcesListCmd() *cobra.Command {
 					r.Kind,
 					r.Status,
 					hostedResourceLocation(r),
-					fmt.Sprintf("$%.2f", r.MonthlyCost),
+					fmt.Sprintf("%.2f", r.MonthlyCost),
 				}
 			}
 			env.WriteTable(columns, rows)
diff --git a/internal/commands/invoices.go b/internal/commands/invoices.go
index f66ec9b..713b1e2 100644
--- a/internal/commands/invoices.go
+++ b/internal/commands/invoices.go
@@ -91,7 +91,8 @@ func newInvoicesDownloadCmd() *cobra.Command {
 			if outputPath == "" {
 				outputPath = fmt.Sprintf("invoice-%d.pdf", number)
 			}
-			if err := os.WriteFile(outputPath, data, 0o644); err != nil {
+			// Billing documents are sensitive; write them owner-only.
+			if err := os.WriteFile(outputPath, data, 0o600); err != nil {
 				return fmt.Errorf("write %s: %w", outputPath, err)
 			}
 			env.Status("Saved invoice %d to %s (%d bytes)", number, outputPath, len(data))
diff --git a/internal/commands/launch.go b/internal/commands/launch.go
index 4d59456..083497f 100644
--- a/internal/commands/launch.go
+++ b/internal/commands/launch.go
@@ -887,15 +887,23 @@ func launchDryRun(ctx context.Context, env *output.Envelope, cfg launchConfig, c
 		}
 		size := cfg.size
 		monthlyCost := ""
-		if size == "" {
-			// Try to fetch first available size for cost estimate
-			sizes, sErr := client.ListManagedHostingSizes(ctx)
-			if sErr == nil && len(sizes) > 0 {
+		// Resolve the cost for both the default-size and explicit --size paths by
+		// looking up the matching size in the sizes list.
+		sizes, sErr := client.ListManagedHostingSizes(ctx)
+		if sErr == nil && len(sizes) > 0 {
+			if size == "" {
 				size = sizes[0].Slug
-				monthlyCost = fmt.Sprintf("$%.2f", sizes[0].MonthlyCost)
+				monthlyCost = formatManagedPrice(sizes[0].MonthlyCost, sizes[0].Currency)
 			} else {
-				size = "s-1vcpu-1gb"
+				for _, s := range sizes {
+					if s.Slug == size {
+						monthlyCost = formatManagedPrice(s.MonthlyCost, s.Currency)
+						break
+					}
+				}
 			}
+		} else if size == "" {
+			size = "s-1vcpu-1gb"
 		}
 		dr.Would.Region = region
 		dr.Would.Size = size
@@ -1424,6 +1432,29 @@ func managedSizeRanks(sizes []sdk.ManagedHostingSize) []int {
 	return ranks
 }
 
+// currencySymbols maps common ISO currency codes to their symbol. Unlisted
+// currencies fall back to the ISO code suffix form (e.g. "12.00 SEK").
+var currencySymbols = map[string]string{
+	"USD": "$",
+	"GBP": "£",
+	"EUR": "€",
+}
+
+// formatManagedPrice renders a monetary amount in the given ISO currency.
+// Known currencies use their symbol prefix (e.g. "$12.00"); unknown or empty
+// currencies use the ISO-code suffix form (e.g. "12.00 SEK"). An empty
+// currency defaults to a bare amount with no symbol.
+func formatManagedPrice(amount float64, currency string) string {
+	currency = strings.ToUpper(strings.TrimSpace(currency))
+	if sym, ok := currencySymbols[currency]; ok {
+		return fmt.Sprintf("%s%.2f", sym, amount)
+	}
+	if currency == "" {
+		return fmt.Sprintf("%.2f", amount)
+	}
+	return fmt.Sprintf("%.2f %s", amount, currency)
+}
+
 // managedSizeSpecs renders the hardware line for a size. The managed_hosting
 // sizes endpoint returns a single human-readable label (e.g. "1 vCPU / 1 GB
 // RAM"); we surface it as-is.
@@ -1445,7 +1476,7 @@ func managedSizeLabel(s sdk.ManagedHostingSize, rank int) string {
 	if specs := managedSizeSpecs(s); specs != "" {
 		parts = append(parts, specs)
 	}
-	parts = append(parts, fmt.Sprintf("$%.2f/mo", s.MonthlyCost))
+	parts = append(parts, fmt.Sprintf("%s/mo", formatManagedPrice(s.MonthlyCost, s.Currency)))
 	return fmt.Sprintf("%s  (%s)", strings.Join(parts, " · "), s.Slug)
 }
 
@@ -1462,8 +1493,10 @@ func launchProvisionVPS(ctx context.Context, env *output.Envelope, cfg launchCon
 	var selectedSize sdk.ManagedHostingSize
 	var monthlyCostStr string
 
-	// Fetch available regions and sizes
-	regions, err := client.ListManagedHostingRegions(ctx)
+	// Fetch available regions and sizes. We fetch the flattened rows (which carry
+	// the group's default flag) so the fallback picks the API-designated default
+	// region rather than an arbitrary one.
+	regionRows, err := client.ListManagedHostingRegionRows(ctx)
 	if err != nil {
 		// Fall back to hardcoded defaults if endpoint not available
 		if region == "" {
@@ -1474,14 +1507,34 @@ func launchProvisionVPS(ctx context.Context, env *output.Envelope, cfg launchCon
 		}
 		monthlyCostStr = "contact support for pricing"
 	} else {
+		// Flatten rows back into region records for the picker.
+		regions := make([]sdk.ManagedHostingRegion, 0, len(regionRows))
+		for _, r := range regionRows {
+			regions = append(regions, sdk.ManagedHostingRegion{
+				Slug:    r.Slug,
+				Name:    r.Name,
+				Flag:    r.Flag,
+				Country: r.Country,
+			})
+		}
+
 		// Pick region
 		if region == "" {
 			if len(regions) > 0 {
-				// The managed_hosting regions endpoint only returns regions
-				// that can currently be provisioned, so the first one is a
-				// safe default.
-				region = regions[0].Slug
-				selectedRegion = regions[0]
+				// Prefer the region its group marks as default; fall back to the
+				// first provisionable region only when no default is flagged.
+				defaultIdx := -1
+				for i, r := range regionRows {
+					if r.IsDefault {
+						defaultIdx = i
+						break
+					}
+				}
+				if defaultIdx < 0 {
+					defaultIdx = 0
+				}
+				region = regions[defaultIdx].Slug
+				selectedRegion = regions[defaultIdx]
 			} else {
 				region = "lon1"
 			}
@@ -1511,7 +1564,7 @@ func launchProvisionVPS(ctx context.Context, env *output.Envelope, cfg launchCon
 					selectedSize = sizes[0]
 				}
 			}
-			monthlyCostStr = fmt.Sprintf("$%.2f/month", selectedSize.MonthlyCost)
+			monthlyCostStr = fmt.Sprintf("%s/month", formatManagedPrice(selectedSize.MonthlyCost, selectedSize.Currency))
 		} else {
 			if size == "" {
 				size = "s-1vcpu-1gb"
@@ -1552,7 +1605,7 @@ func launchProvisionVPS(ctx context.Context, env *output.Envelope, cfg launchCon
 				if sIdx, _, sErr2 := sizePrompt.Run(); sErr2 == nil {
 					selectedSize = sizes[sIdx]
 					size = selectedSize.Slug
-					monthlyCostStr = fmt.Sprintf("$%.2f/month", selectedSize.MonthlyCost)
+					monthlyCostStr = fmt.Sprintf("%s/month", formatManagedPrice(selectedSize.MonthlyCost, selectedSize.Currency))
 				}
 			}
 		}
diff --git a/internal/commands/launch_test.go b/internal/commands/launch_test.go
index 4e14d53..ae41755 100644
--- a/internal/commands/launch_test.go
+++ b/internal/commands/launch_test.go
@@ -437,7 +437,7 @@ func TestManagedSizeRanksAndTiers(t *testing.T) {
 }
 
 func TestManagedSizeLabel(t *testing.T) {
-	s := sdk.ManagedHostingSize{Slug: "s-1vcpu-1gb", Label: "1 vCPU / 1 GB RAM", MonthlyCost: 6}
+	s := sdk.ManagedHostingSize{Slug: "s-1vcpu-1gb", Label: "1 vCPU / 1 GB RAM", MonthlyCost: 6, Currency: "USD"}
 	label := managedSizeLabel(s, 0)
 	assert.Contains(t, label, "Starter")
 	assert.Contains(t, label, "1 vCPU / 1 GB RAM")
@@ -445,8 +445,28 @@ func TestManagedSizeLabel(t *testing.T) {
 	assert.Contains(t, label, "(s-1vcpu-1gb)", "slug stays visible for --size discoverability")
 
 	// No label → tier + price only, no crash.
-	bare := sdk.ManagedHostingSize{Slug: "x", MonthlyCost: 9}
+	bare := sdk.ManagedHostingSize{Slug: "x", MonthlyCost: 9, Currency: "USD"}
 	assert.Contains(t, managedSizeLabel(bare, 9), "$9.00/mo")
+
+	// Non-USD currency renders with the right symbol/code, never a bare "$".
+	gbp := sdk.ManagedHostingSize{Slug: "g", Label: "spec", MonthlyCost: 5, Currency: "GBP"}
+	gbpLabel := managedSizeLabel(gbp, 0)
+	assert.Contains(t, gbpLabel, "£5.00/mo")
+	assert.NotContains(t, gbpLabel, "$")
+}
+
+func TestFormatManagedPrice(t *testing.T) {
+	assert.Equal(t, "$12.00", formatManagedPrice(12, "USD"))
+	assert.Equal(t, "£12.00", formatManagedPrice(12, "GBP"))
+	assert.Equal(t, "€12.00", formatManagedPrice(12, "EUR"))
+	// Unknown currency → ISO-code suffix, no false "$".
+	sek := formatManagedPrice(12, "SEK")
+	assert.Equal(t, "12.00 SEK", sek)
+	assert.NotContains(t, sek, "$")
+	// Case/whitespace normalisation.
+	assert.Equal(t, "$12.00", formatManagedPrice(12, " usd "))
+	// Empty currency → bare amount, no symbol.
+	assert.Equal(t, "12.00", formatManagedPrice(12, ""))
 }
 
 // ── rate_limited (429 provisioning rate limit) ───────────────────────────────
@@ -508,12 +528,21 @@ func TestLaunchVPS_AcceptCostRequired_NonInteractive(t *testing.T) {
 				},
 			})
 		case "/managed_hosting/regions":
-			json.NewEncoder(w).Encode([]map[string]interface{}{ //nolint:errcheck
-				{"slug": "lon1", "name": "London", "available": true},
+			json.NewEncoder(w).Encode(map[string]interface{}{ //nolint:errcheck
+				"grouped_regions": map[string]interface{}{
+					"UK": map[string]interface{}{
+						"default": "lon1",
+						"regions": []map[string]interface{}{
+							{"slug": "lon1", "name": "London 1", "flag": "🇬🇧", "country": "UK"},
+						},
+					},
+				},
 			})
 		case "/managed_hosting/sizes":
-			json.NewEncoder(w).Encode([]map[string]interface{}{ //nolint:errcheck
-				{"slug": "s-1vcpu-1gb", "description": "1 vCPU / 1 GB", "price_monthly": 6.0},
+			json.NewEncoder(w).Encode(map[string]interface{}{ //nolint:errcheck
+				"sizes": []map[string]interface{}{
+					{"slug": "s-1vcpu-1gb", "label": "1 vCPU / 1 GB", "monthly_cost": 6.0, "currency": "USD"},
+				},
 			})
 		default:
 			t.Errorf("unexpected request: %s %s", r.Method, r.URL.Path)
@@ -552,12 +581,21 @@ func TestLaunchVPS_AcceptCostPresent_ProvisionsCalled(t *testing.T) {
 	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		switch {
 		case r.Method == http.MethodGet && r.URL.Path == "/managed_hosting/regions":
-			json.NewEncoder(w).Encode([]map[string]interface{}{ //nolint:errcheck
-				{"slug": "lon1", "name": "London", "available": true},
+			json.NewEncoder(w).Encode(map[string]interface{}{ //nolint:errcheck
+				"grouped_regions": map[string]interface{}{
+					"UK": map[string]interface{}{
+						"default": "lon1",
+						"regions": []map[string]interface{}{
+							{"slug": "lon1", "name": "London 1", "flag": "🇬🇧", "country": "UK"},
+						},
+					},
+				},
 			})
 		case r.Method == http.MethodGet && r.URL.Path == "/managed_hosting/sizes":
-			json.NewEncoder(w).Encode([]map[string]interface{}{ //nolint:errcheck
-				{"slug": "s-1vcpu-1gb", "description": "1 vCPU", "price_monthly": 6.0},
+			json.NewEncoder(w).Encode(map[string]interface{}{ //nolint:errcheck
+				"sizes": []map[string]interface{}{
+					{"slug": "s-1vcpu-1gb", "label": "1 vCPU", "monthly_cost": 6.0, "currency": "USD"},
+				},
 			})
 		case r.Method == http.MethodPost && strings.HasSuffix(r.URL.Path, "/servers"):
 			provisionCalled = true
@@ -774,8 +812,10 @@ func TestLaunchDryRun_VPS_JSON_RequiresAcceptCost(t *testing.T) {
 	// VPS dry-run without --accept-cost must list it in "requires".
 	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		if r.URL.Path == "/managed_hosting/sizes" {
-			json.NewEncoder(w).Encode([]map[string]interface{}{ //nolint:errcheck
-				{"slug": "s-1vcpu-1gb", "description": "1 vCPU", "price_monthly": 6.0},
+			json.NewEncoder(w).Encode(map[string]interface{}{ //nolint:errcheck
+				"sizes": []map[string]interface{}{
+					{"slug": "s-1vcpu-1gb", "label": "1 vCPU", "monthly_cost": 6.0, "currency": "USD"},
+				},
 			})
 			return
 		}
@@ -1044,8 +1084,10 @@ func TestLaunchDryRun_NoBetaEnroll(t *testing.T) {
 		}
 		// Sizes endpoint for cost estimate
 		if r.Method == http.MethodGet && r.URL.Path == "/managed_hosting/sizes" {
-			json.NewEncoder(w).Encode([]map[string]interface{}{ //nolint:errcheck
-				{"slug": "s-1vcpu-1gb", "description": "1 vCPU", "price_monthly": 6.0},
+			json.NewEncoder(w).Encode(map[string]interface{}{ //nolint:errcheck
+				"sizes": []map[string]interface{}{
+					{"slug": "s-1vcpu-1gb", "label": "1 vCPU", "monthly_cost": 6.0, "currency": "USD"},
+				},
 			})
 			return
 		}
diff --git a/internal/commands/packages.go b/internal/commands/packages.go
index e33653c..effee67 100644
--- a/internal/commands/packages.go
+++ b/internal/commands/packages.go
@@ -30,6 +30,14 @@ region. This endpoint is public. Use --json to include each plan's feature list.
 			if env.WantsJSON() {
 				return env.WriteJSON(output.NewResponse(plans, fmt.Sprintf("%d plans", len(plans))))
 			}
+			if env.QuietMode {
+				permalinks := make([]string, len(plans))
+				for i, p := range plans {
+					permalinks[i] = p.Permalink
+				}
+				env.WriteQuiet(permalinks)
+				return nil
+			}
 			rows := make([][]string, len(plans))
 			for i, p := range plans {
 				rows[i] = []string{
diff --git a/internal/commands/templates_subresources.go b/internal/commands/templates_subresources.go
index 4cf0b85..8d2fc88 100644
--- a/internal/commands/templates_subresources.go
+++ b/internal/commands/templates_subresources.go
@@ -24,6 +24,18 @@ func addTemplateFlag(cmd *cobra.Command, target *string) {
 	cmd.Flags().StringVarP(target, "template", "t", "", "Template permalink (required)")
 }
 
+// requireUpdateFlags guards update handlers against sending a zero-value PATCH.
+// If none of the named field flags were set, it returns a UserError instead of
+// silently overwriting the resource with empty values.
+func requireUpdateFlags(cmd *cobra.Command, flags ...string) error {
+	for _, f := range flags {
+		if cmd.Flags().Changed(f) {
+			return nil
+		}
+	}
+	return &output.UserError{Message: "no fields to update; pass at least one flag"}
+}
+
 // requireTemplate validates that a template permalink was supplied.
 func requireTemplate(permalink string) (string, error) {
 	if permalink == "" {
@@ -194,6 +206,9 @@ func tcfUpdateCmd() *cobra.Command {
 			if err != nil {
 				return err
 			}
+			if err := requireUpdateFlags(cmd, "path", "body", "description"); err != nil {
+				return err
+			}
 			f, err := client.UpdateTemplateConfigFile(cliCtx.Background(), permalink, args[0], sdk.ConfigFileCreateRequest{
 				Path: path, Body: body, Description: description,
 			})
@@ -342,6 +357,9 @@ func tefUpdateCmd() *cobra.Command {
 			if err != nil {
 				return err
 			}
+			if err := requireUpdateFlags(cmd, "path"); err != nil {
+				return err
+			}
 			f, err := client.UpdateTemplateExcludedFile(cliCtx.Background(), permalink, args[0], sdk.ExcludedFileCreateRequest{Path: path})
 			if err != nil {
 				return err
@@ -489,6 +507,9 @@ func tintUpdateCmd() *cobra.Command {
 			if err != nil {
 				return err
 			}
+			if err := requireUpdateFlags(cmd, "name"); err != nil {
+				return err
+			}
 			in, err := client.UpdateTemplateIntegration(cliCtx.Background(), permalink, args[0], sdk.IntegrationCreateRequest{Name: name})
 			if err != nil {
 				return err
@@ -638,6 +659,9 @@ func tcmdUpdateCmd() *cobra.Command {
 			if err != nil {
 				return err
 			}
+			if err := requireUpdateFlags(cmd, "command", "description", "timing"); err != nil {
+				return err
+			}
 			cm, err := client.UpdateTemplateCommand(cliCtx.Background(), permalink, args[0], sdk.SSHCommandCreateRequest{
 				Command: command, Description: description, Timing: timing,
 			})
@@ -789,6 +813,9 @@ func tbcUpdateCmd() *cobra.Command {
 			if err != nil {
 				return err
 			}
+			if err := requireUpdateFlags(cmd, "command", "description"); err != nil {
+				return err
+			}
 			cm, err := client.UpdateTemplateBuildCommand(cliCtx.Background(), permalink, args[0], sdk.BuildCommandCreateRequest{
 				Command: command, Description: description,
 			})
@@ -936,6 +963,9 @@ func tbcfUpdateCmd() *cobra.Command {
 			if err != nil {
 				return err
 			}
+			if err := requireUpdateFlags(cmd, "path"); err != nil {
+				return err
+			}
 			f, err := client.UpdateTemplateBuildCacheFile(cliCtx.Background(), permalink, args[0], sdk.BuildCacheFileCreateRequest{Path: path})
 			if err != nil {
 				return err
@@ -1319,6 +1349,9 @@ func tsrvUpdateCmd() *cobra.Command {
 			if err != nil {
 				return err
 			}
+			if err := requireUpdateFlags(cmd, "name", "server-path", "environment"); err != nil {
+				return err
+			}
 			s, err := client.UpdateTemplateServer(cliCtx.Background(), permalink, args[0], sdk.ServerUpdateRequest{
 				Name: name, ServerPath: serverPath, Environment: environment,
 			})
@@ -1482,6 +1515,9 @@ func tsgUpdateCmd() *cobra.Command {
 			if err != nil {
 				return err
 			}
+			if err := requireUpdateFlags(cmd, "name", "environment", "transfer-order", "email-notify-on", "notification-email", "auto-deploy"); err != nil {
+				return err
+			}
 			req := sdk.TemplateServerGroupUpdateRequest{
 				Name: name, Environment: environment, TransferOrder: transferOrder,
 				EmailNotifyOn: emailNotifyOn, NotificationEmail: notificationEmail,
diff --git a/pkg/sdk/managed_hosting.go b/pkg/sdk/managed_hosting.go
index 73641d4..abdd9fe 100644
--- a/pkg/sdk/managed_hosting.go
+++ b/pkg/sdk/managed_hosting.go
@@ -3,6 +3,7 @@ package sdk
 import (
 	"context"
 	"fmt"
+	"sort"
 	"strings"
 )
 
@@ -79,9 +80,19 @@ func (c *Client) ListManagedHostingRegionRows(ctx context.Context) ([]ManagedHos
 	if err != nil {
 		return nil, err
 	}
+	// Iterate groups in a stable order (map iteration is nondeterministic).
+	groups := make([]string, 0, len(resp.GroupedRegions))
+	for group := range resp.GroupedRegions {
+		groups = append(groups, group)
+	}
+	sort.Strings(groups)
+
 	var rows []ManagedHostingRegionRow
-	for group, g := range resp.GroupedRegions {
-		for _, r := range g.Regions {
+	for _, group := range groups {
+		g := resp.GroupedRegions[group]
+		regions := append([]ManagedHostingRegion(nil), g.Regions...)
+		sort.Slice(regions, func(i, j int) bool { return regions[i].Slug < regions[j].Slug })
+		for _, r := range regions {
 			rows = append(rows, ManagedHostingRegionRow{
 				Group:     group,
 				Slug:      r.Slug,
@@ -106,9 +117,19 @@ func (c *Client) ListManagedHostingRegions(ctx context.Context) ([]ManagedHostin
 	if err != nil {
 		return nil, err
 	}
+	// Iterate groups in a stable order (map iteration is nondeterministic).
+	groups := make([]string, 0, len(resp.GroupedRegions))
+	for group := range resp.GroupedRegions {
+		groups = append(groups, group)
+	}
+	sort.Strings(groups)
+
 	var regions []ManagedHostingRegion
-	for _, g := range resp.GroupedRegions {
-		regions = append(regions, g.Regions...)
+	for _, group := range groups {
+		g := resp.GroupedRegions[group]
+		grouped := append([]ManagedHostingRegion(nil), g.Regions...)
+		sort.Slice(grouped, func(i, j int) bool { return grouped[i].Slug < grouped[j].Slug })
+		regions = append(regions, grouped...)
 	}
 	return regions, nil
 }
diff --git a/pkg/sdk/managed_hosting_test.go b/pkg/sdk/managed_hosting_test.go
index cd5cb90..19c9af5 100644
--- a/pkg/sdk/managed_hosting_test.go
+++ b/pkg/sdk/managed_hosting_test.go
@@ -206,6 +206,11 @@ func TestListManagedHostingRegionRows(t *testing.T) {
 	require.NoError(t, err)
 	assert.Len(t, rows, 3)
 
+	// Ordering must be deterministic: groups sorted by name, regions by slug.
+	// Europe(ams3, lon1) then North America(nyc3).
+	gotOrder := []string{rows[0].Slug, rows[1].Slug, rows[2].Slug}
+	assert.Equal(t, []string{"ams3", "lon1", "nyc3"}, gotOrder)
+
 	// Find the lon1 row and assert it is flagged default within its group.
 	var lon1 *ManagedHostingRegionRow
 	for i := range rows {
diff --git a/pkg/sdk/projects_test.go b/pkg/sdk/projects_test.go
index 0e39546..915c6c8 100644
--- a/pkg/sdk/projects_test.go
+++ b/pkg/sdk/projects_test.go
@@ -210,9 +210,12 @@ func TestGenerateAIDeploymentOverview(t *testing.T) {
 }
 
 func TestGenerateAIDeploymentOverview_RequiresEndRef(t *testing.T) {
-	c := newTestClient(t, httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		t.Fatal("no HTTP request should be made when end_ref is empty")
-	})))
+	}))
+	defer server.Close()
+
+	c := newTestClient(t, server)
 	_, err := c.GenerateAIDeploymentOverview(context.Background(), "my-app", "abc123", "")
 	require.Error(t, err)
 	assert.Contains(t, err.Error(), "end_ref is required")