v17.1.0

Update oclif, improve help command

.gitattributes

@@ -4,6 +4,10 @@
 *.* -eol
 
 *.sh text eol=lf
+.dockerignore eol=lf
+Dockerfile eol=lf
+Dockerfile.* eol=lf
+* text=auto eol=lf
 
 # lf for the docs as it's auto-generated and will otherwise trigger an uncommited error on windows
 docs/balena-cli.md text eol=lf

.github/actions/publish/action.yml

@@ -3,32 +3,34 @@ name: package and draft GitHub release
 # https://github.com/product-os/flowzone/tree/master/.github/actions
 inputs:
   json:
-    description: "JSON stringified object containing all the inputs from the calling workflow"
+    description: 'JSON stringified object containing all the inputs from the calling workflow'
     required: true
   secrets:
-    description: "JSON stringified object containing all the secrets from the calling workflow"
+    description: 'JSON stringified object containing all the secrets from the calling workflow'
+    required: true
+  variables:
+    description: 'JSON stringified object containing all the variables from the calling workflow'
     required: true
 
   # --- custom environment
   XCODE_APP_LOADER_EMAIL:
     type: string
-    default: "accounts+apple@balena.io"
+    default: 'accounts+apple@balena.io'
   NODE_VERSION:
     type: string
-    # FIXME: (please) https://github.com/balena-io/balena-cli/issues/2165
-    default: "12.x"
+    default: '18.x'
   VERBOSE:
     type: string
-    default: "true"
+    default: 'true'
 
 runs:
   # https://docs.github.com/en/actions/creating-actions/creating-a-composite-action
-  using: "composite"
+  using: 'composite'
   steps:
     - name: Download custom source artifact
       uses: actions/download-artifact@v3
       with:
-        name: custom-${{ github.event.pull_request.head.sha || github.event.head_commit.id }}-${{ runner.os }}
+        name: custom-${{ github.event.pull_request.head.sha || github.event.head_commit.id }}-${{ runner.os }}-${{ runner.arch }}
         path: ${{ runner.temp }}
 
     - name: Extract custom source artifact
@@ -122,6 +124,7 @@ runs:
         # Apple notarization (automation/build-bin.ts)
         XCODE_APP_LOADER_EMAIL: ${{ inputs.XCODE_APP_LOADER_EMAIL }}
         XCODE_APP_LOADER_PASSWORD: ${{ fromJSON(inputs.secrets).XCODE_APP_LOADER_PASSWORD }}
+        XCODE_APP_LOADER_TEAM_ID: ${{ inputs.XCODE_APP_LOADER_TEAM_ID }}
 
     - name: Upload artifacts
       uses: actions/upload-artifact@v3

.github/actions/test/action.yml

@@ -8,12 +8,14 @@ inputs:
   secrets:
     description: "JSON stringified object containing all the secrets from the calling workflow"
     required: true
+  variables:
+    description: "JSON stringified object containing all the variables from the calling workflow"
+    required: true
 
   # --- custom environment
   NODE_VERSION:
     type: string
-    # FIXME: (please) https://github.com/balena-io/balena-cli/issues/2165
-    default: "12.x"
+    default: '18.x'
   VERBOSE:
     type: string
     default: "true"
@@ -36,7 +38,7 @@ runs:
 
         [[ '${{ inputs.VERBOSE }}' =~ on|On|Yes|yes|true|True ]] && set -x
 
-        if [[ -e package-lock.json ]]; then
+        if [[ -e package-lock.json ]] || [[ -e npm-shrinkwrap.json ]]; then
             npm ci
         else
             npm i
@@ -47,11 +49,11 @@ runs:
 
     - name: Compress custom source
       shell: pwsh
-      run: tar -acf ${{ runner.temp }}/custom.tgz .
+      run: tar --exclude-vcs -acf ${{ runner.temp }}/custom.tgz .
 
     - name: Upload custom artifact
       uses: actions/upload-artifact@v3
       with:
-        name: custom-${{ github.event.pull_request.head.sha || github.event.head_commit.id }}-${{ runner.os }}
+        name: custom-${{ github.event.pull_request.head.sha || github.event.head_commit.id }}-${{ runner.os }}-${{ runner.arch }}
         path: ${{ runner.temp }}/custom.tgz
         retention-days: 1

.github/workflows/flowzone.yml

@@ -3,14 +3,27 @@ name: Flowzone
 on:
   pull_request:
     types: [opened, synchronize, closed]
-    branches:
-      - "main"
-      - "master"
+    branches: [main, master]
+  pull_request_target:
+    types: [opened, synchronize, closed]
+    branches: [main, master]
 
 jobs:
   flowzone:
     name: Flowzone
     uses: product-os/flowzone/.github/workflows/flowzone.yml@master
+    # prevent duplicate workflow executions for pull_request and pull_request_target
+    if: |
+      (
+        github.event.pull_request.head.repo.full_name == github.repository &&
+        github.event_name == 'pull_request'
+      ) || (
+        github.event.pull_request.head.repo.full_name != github.repository &&
+        github.event_name == 'pull_request_target'
+      )
     secrets: inherit
     with:
-      tests_run_on: '["ubuntu-20.04","macos-11","windows-2019"]'
+      custom_runs_on: '[["self-hosted","Linux","distro:focal","X64"],["self-hosted","Linux","distro:focal","ARM64"],["macos-12"],["windows-2019"]]'
+      repo_config: true
+      repo_description: "The official balena CLI tool."
+      github_prerelease: false

.gitignore

@@ -10,6 +10,7 @@
 *.seed
 /.idea/
 /.lock-wscript
+/.nvmrc
 /.nyc_output/
 /.vscode/
 /coverage/

.nvmrc

@@ -1 +0,0 @@
-12

INSTALL-ADVANCED.md

@@ -78,8 +78,8 @@ If you are a Node.js developer, you may wish to install the balena CLI via [npm]
 The npm installation involves building native (platform-specific) binary modules, which require
 some development tools to be installed first, as follows.
 
-> **The balena CLI currently requires Node.js version 12 (min 12.8.0).**  
-> **Versions 13 and later are not yet fully supported.**
+> **The balena CLI currently requires Node.js version 18.**  
+> **Versions 19 and later are not yet fully supported.**
 
 ### Install development tools
 
@@ -89,7 +89,7 @@ some development tools to be installed first, as follows.
 $ sudo apt-get update && sudo apt-get -y install curl python3 git make g++
 $ curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.38.0/install.sh | bash
 $ . ~/.bashrc
-$ nvm install 12
+$ nvm install 18
 ```
 
 The `curl` command line above uses
@@ -106,15 +106,15 @@ recommended.
 ```sh
 $ curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.38.0/install.sh | bash
 $ . ~/.bashrc
-$ nvm install 12
+$ nvm install 18
 ```
 
 #### **Windows** (not WSL)
 
 Install:
 
-* Node.js v12 from the [Nodejs.org releases page](https://nodejs.org/en/download/releases/).
   * If you'd like the ability to switch between Node.js versions, install
+- Node.js v18 from the [Nodejs.org releases page](https://nodejs.org/en/download/releases/).
     [nvm-windows](https://github.com/coreybutler/nvm-windows#node-version-manager-nvm-for-windows)
     instead.
 * The [MSYS2 shell](https://www.msys2.org/), which provides `git`, `make`, `g++` and more:

automation/build-bin.ts

@@ -17,7 +17,7 @@
 
 import type { JsonVersions } from '../lib/commands/version';
 
-import { run as oclifRun } from 'oclif';
+import { run as oclifRun } from '@oclif/core';
 import * as archiver from 'archiver';
 import * as Bluebird from 'bluebird';
 import { execFile } from 'child_process';
@@ -30,6 +30,7 @@ import * as path from 'path';
 import * as rimraf from 'rimraf';
 import * as semver from 'semver';
 import { promisify } from 'util';
+import { notarize } from '@electron/notarize';
 
 import { stripIndent } from '../build/utils/lazy';
 import {
@@ -87,7 +88,7 @@ async function diffPkgOutput(pkgOut: string) {
 		'tests',
 		'test-data',
 		'pkg',
-		`expected-warnings-${process.platform}.txt`,
+		`expected-warnings-${process.platform}-${arch}.txt`,
 	);
 	const absSavedPath = path.join(ROOT, relSavedPath);
 	const ignoreStartsWith = [
@@ -180,9 +181,18 @@ async function execPkg(...args: any[]) {
  * to be directly executed from inside another binary executable.)
  */
 async function buildPkg() {
+	// https://github.com/vercel/pkg#targets
+	let targets = `linux-${arch}`;
+	// TBC: not possible to build for macOS or Windows arm64 on x64 nodes
+	if (process.platform === 'darwin') {
+		targets = `macos-x64`;
+	}
+	if (process.platform === 'win32') {
+		targets = `win-x64`;
+	}
 	const args = [
-		'--target',
-		'host',
+		'--targets',
+		targets,
 		'--output',
 		'build-bin/balena',
 		'package.json',
@@ -197,7 +207,6 @@ async function buildPkg() {
 	const paths: Array<[string, string[], string[]]> = [
 		// [platform, [source path], [destination path]]
 		['*', ['open', 'xdg-open'], ['xdg-open']],
-		['*', ['opn', 'xdg-open'], ['xdg-open-402']],
 		['darwin', ['denymount', 'bin', 'denymount'], ['denymount']],
 	];
 	await Promise.all(
@@ -456,16 +465,15 @@ async function signWindowsInstaller() {
  * Wait for Apple Installer Notarization to continue
  */
 async function notarizeMacInstaller(): Promise<void> {
+	const teamId = process.env.XCODE_APP_LOADER_TEAM_ID || '66H43P8FRG';
 	const appleId =
 		process.env.XCODE_APP_LOADER_EMAIL || 'accounts+apple@balena.io';
-	const appBundleId = packageJSON.oclif.macos.identifier || 'io.balena.cli';
 	const appleIdPassword = process.env.XCODE_APP_LOADER_PASSWORD;
 
-	if (appleIdPassword) {
-		const { notarize } = await import('electron-notarize');
-		// https://github.com/electron/notarize/blob/main/README.md
+	if (appleIdPassword && teamId) {
 		await notarize({
-			appBundleId,
+			tool: 'notarytool',
+			teamId,
 			appPath: renamedOclifInstallers.darwin,
 			appleId,
 			appleIdPassword,
@@ -484,9 +492,10 @@ export async function buildOclifInstaller() {
 	let packOpts = ['-r', ROOT];
 	if (process.platform === 'darwin') {
 		packOS = 'macos';
+		packOpts = packOpts.concat('--targets', 'darwin-x64');
 	} else if (process.platform === 'win32') {
 		packOS = 'win';
-		packOpts = packOpts.concat('-t', 'win32-x64');
+		packOpts = packOpts.concat('--targets', 'win32-x64');
 	}
 	if (packOS) {
 		console.log(`Building oclif installer for CLI ${version}`);
@@ -504,10 +513,11 @@ export async function buildOclifInstaller() {
 			await signFilesForNotarization();
 		}
 		console.log('=======================================================');
-		console.log(`oclif "${packCmd}" "${packOpts.join('" "')}"`);
+		console.log(`oclif ${packCmd} ${packOpts.join(' ')}`);
 		console.log(`cwd="${process.cwd()}" ROOT="${ROOT}"`);
 		console.log('=======================================================');
-		await oclifRun([packCmd].concat(...packOpts));
+		const oclifPath = path.join(ROOT, 'node_modules', 'oclif');
+		await oclifRun([packCmd].concat(...packOpts), oclifPath);
 		await renameInstallerFiles();
 		// The Windows installer is explicitly signed here (oclif doesn't do it).
 		// The macOS installer is automatically signed by oclif (which runs the

completion/_balena

@@ -8,11 +8,13 @@ _balena() {
   local context state line curcontext="$curcontext"
 
   # Valid top-level completions
-  main_commands=( build deploy envs fleets join keys leave login logout logs note orgs preload push releases scan settings ssh support tags tunnel version whoami api-key config device device devices env fleet fleet internal key key local os release release tag util )
+  main_commands=( build deploy envs fleets join keys leave login logout logs note orgs preload push releases scan settings ssh support tags tunnel version whoami api-key api-keys app block config device device devices env fleet fleet internal key key local os release release tag util )
   # Sub-completions
-  api_key_cmds=( generate )
+  api_key_cmds=( generate revoke )
+  app_cmds=( create )
+  block_cmds=( create )
   config_cmds=( generate inject read reconfigure write )
-  device_cmds=( deactivate identify init local-mode move os-update pin public-url purge reboot register rename restart rm services shutdown track-fleet )
+  device_cmds=( deactivate identify init local-mode move os-update pin public-url purge reboot register rename restart rm shutdown track-fleet )
   devices_cmds=( supported )
   env_cmds=( add rename rm )
   fleet_cmds=( create pin purge rename restart rm track-latest )
@@ -43,6 +45,12 @@ _balena_sec_cmds() {
       "api-key")
         _describe -t api_key_cmds 'api-key_cmd' api_key_cmds "$@" && ret=0
       ;;
+      "app")
+        _describe -t app_cmds 'app_cmd' app_cmds "$@" && ret=0
+      ;;
+      "block")
+        _describe -t block_cmds 'block_cmd' block_cmds "$@" && ret=0
+      ;;
       "config")
         _describe -t config_cmds 'config_cmd' config_cmds "$@" && ret=0
       ;;

completion/balena-completion.bash

@@ -7,11 +7,13 @@ _balena_complete()
   local cur prev
 
   # Valid top-level completions
-  main_commands="build deploy envs fleets join keys leave login logout logs note orgs preload push releases scan settings ssh support tags tunnel version whoami api-key config device device devices env fleet fleet internal key key local os release release tag util"
+  main_commands="build deploy envs fleets join keys leave login logout logs note orgs preload push releases scan settings ssh support tags tunnel version whoami api-key api-keys app block config device device devices env fleet fleet internal key key local os release release tag util"
   # Sub-completions
-  api_key_cmds="generate"
+  api_key_cmds="generate revoke"
+  app_cmds="create"
+  block_cmds="create"
   config_cmds="generate inject read reconfigure write"
-  device_cmds="deactivate identify init local-mode move os-update pin public-url purge reboot register rename restart rm services shutdown track-fleet"
+  device_cmds="deactivate identify init local-mode move os-update pin public-url purge reboot register rename restart rm shutdown track-fleet"
   devices_cmds="supported"
   env_cmds="add rename rm"
   fleet_cmds="create pin purge rename restart rm track-latest"
@@ -37,6 +39,12 @@ _balena_complete()
       api-key)
         COMPREPLY=( $(compgen -W "$api_key_cmds" -- $cur) )
         ;;
+      app)
+        COMPREPLY=( $(compgen -W "$app_cmds" -- $cur) )
+        ;;
+      block)
+        COMPREPLY=( $(compgen -W "$block_cmds" -- $cur) )
+        ;;
       config)
         COMPREPLY=( $(compgen -W "$config_cmds" -- $cur) )
         ;;

docs/balena-cli.md

@@ -621,6 +621,10 @@ password
 
 TCP port number of local HTTP login server (--web auth only)
 
+#### -H, --hideExperimentalWarning
+
+Hides warning for experimental features
+
 ## logout
 
 Logout from your balena account.
@@ -1276,7 +1280,6 @@ Examples:
 	$ balena envs --fleet myorg/myfleet
 	$ balena envs --fleet MyFleet --json
 	$ balena envs --fleet MyFleet --service MyService
-	$ balena envs --fleet MyFleet --service MyService
 	$ balena envs --fleet MyFleet --config
 	$ balena envs --device 7cf02a6
 	$ balena envs --device 7cf02a6 --json
@@ -2160,6 +2163,9 @@ confuse the balenaOS "development mode" with a device's "local mode", the latter
 being a supervisor feature that allows the "balena push" command to push a user's
 application directly to a device in the local network.
 
+The '--secureBoot' option is used to configure a balenaOS installer image to opt-in
+secure boot and disk encryption.
+
 The --system-connection (-c) option is used to inject NetworkManager connection
 profiles for additional network interfaces, such as cellular/GSM or additional
 WiFi or ethernet connections. This option may be passed multiple times in case there
@@ -2230,6 +2236,10 @@ WiFi SSID (network name) (non-interactive configuration)
 
 Configure balenaOS to operate in development mode
 
+#### --secureBoot
+
+Configure balenaOS installer to opt-in secure boot and disk encryption
+
 #### -d, --device DEVICE
 
 device UUID
@@ -2314,6 +2324,9 @@ confuse the balenaOS "development mode" with a device's "local mode", the latter
 being a supervisor feature that allows the "balena push" command to push a user's
 application directly to a device in the local network.
 
+The '--secureBoot' option is used to configure a balenaOS installer image to opt-in
+secure boot and disk encryption.
+
 To configure an image for a fleet of mixed device types, use the --fleet option
 alongside the --deviceType option to specify the target device type.
 
@@ -2337,6 +2350,7 @@ Examples:
 	$ balena config generate --device 7cf02a6 --version 2.12.7 --deviceApiKey <existingDeviceKey>
 	$ balena config generate --device 7cf02a6 --version 2.12.7 --output config.json
 	$ balena config generate --fleet myorg/fleet --version 2.12.7 --dev
+	$ balena config generate --fleet myorg/fleet --version 2.12.7 --secureBoot
 	$ balena config generate --fleet myorg/fleet --version 2.12.7 --deviceType fincm3
 	$ balena config generate --fleet myorg/fleet --version 2.12.7 --output config.json
 	$ balena config generate --fleet myorg/fleet --version 2.12.7 --network wifi --wifiSsid mySsid --wifiKey abcdefgh --appUpdatePollInterval 15
@@ -2355,6 +2369,10 @@ fleet name or slug (preferred)
 
 Configure balenaOS to operate in development mode
 
+#### --secureBoot
+
+Configure balenaOS installer to opt-in secure boot and disk encryption
+
 #### -d, --device DEVICE
 
 device UUID
@@ -2788,7 +2806,7 @@ used (usually $HOME/.balena/secrets.yml|.json)
 
 Don't run a live session on this push. The filesystem will not be monitored,
 and changes will not be synchronized to any running containers. Note that both
-this flag and --detached and required to cause the process to end once the
+this flag and --detached are required to cause the process to end once the
 initial build has completed.
 
 #### -d, --detached

lib/commands/api-key/revoke.ts

@@ -0,0 +1,80 @@
+/**
+ * @license
+ * Copyright 2016-2020 Balena Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import { flags } from '@oclif/command';
+import Command from '../../command';
+import * as cf from '../../utils/common-flags';
+import { getBalenaSdk, stripIndent } from '../../utils/lazy';
+
+interface FlagsDef {
+	help: void;
+}
+
+interface ArgsDef {
+	ids: string;
+}
+
+export default class RevokeCmd extends Command {
+	public static description = stripIndent`
+		Revoke balenaCloud API keys.
+
+		Revoke balenaCloud API keys with the given
+		comma-separated list of ids.
+
+		The given balenaCloud API keys will no longer be usable.
+`;
+	public static examples = [
+		'$ balena api-key revoke 123',
+		'$ balena api-key revoke 123,124,456',
+	];
+
+	public static args = [
+		{
+			name: 'ids',
+			description: 'the API key ids',
+			required: true,
+		},
+	];
+
+	public static usage = 'api-key revoke <ids>';
+
+	public static flags: flags.Input<FlagsDef> = {
+		help: cf.help,
+	};
+
+	public static authenticated = true;
+
+	public async run() {
+		const { args: params } = this.parse<FlagsDef, ArgsDef>(RevokeCmd);
+
+		try {
+			const apiKeyIds = params.ids.split(',');
+			if (apiKeyIds.filter((apiKeyId) => !apiKeyId.match(/^\d+$/)).length > 0) {
+				console.log('API key ids must be positive integers');
+				return;
+			}
+			await Promise.all(
+				apiKeyIds.map(
+					async (id) => await getBalenaSdk().models.apiKey.revoke(Number(id)),
+				),
+			);
+			console.log('Successfully revoked the given API keys');
+		} catch (e) {
+			throw e;
+		}
+	}
+}

lib/commands/api-keys/index.ts

@@ -0,0 +1,95 @@
+/**
+ * @license
+ * Copyright 2016-2020 Balena Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import { flags } from '@oclif/command';
+import Command from '../../command';
+import * as cf from '../../utils/common-flags';
+import { getBalenaSdk, getVisuals, stripIndent } from '../../utils/lazy';
+
+interface FlagsDef {
+	help: void;
+	user?: void;
+	fleet?: string;
+}
+
+export default class ApiKeysCmd extends Command {
+	public static description = stripIndent`
+		Print a list of balenaCloud API keys.
+
+		Print a list of balenaCloud API keys.
+
+		Print a list of balenaCloud API keys for the current user or for a specific fleet with the \`--fleet\` option.
+`;
+	public static examples = ['$ balena api-keys'];
+
+	public static args = [];
+
+	public static usage = 'api-keys';
+
+	public static flags: flags.Input<FlagsDef> = {
+		help: cf.help,
+		user: flags.boolean({
+			char: 'u',
+			description: 'show API keys for your user',
+		}),
+		fleet: cf.fleet,
+	};
+
+	public static authenticated = true;
+
+	public async run() {
+		const { flags: options } = this.parse<FlagsDef, {}>(ApiKeysCmd);
+
+		try {
+			const { getApplication } = await import('../../utils/sdk');
+			const actorId = options.fleet
+				? (
+						await getApplication(getBalenaSdk(), options.fleet, {
+							$select: 'actor',
+						})
+				  ).actor
+				: await getBalenaSdk().auth.getActorId();
+			const keys = await getBalenaSdk().pine.get({
+				resource: 'api_key',
+				options: {
+					$select: ['id', 'created_at', 'name', 'description', 'expiry_date'],
+					$filter: {
+						is_of__actor: actorId,
+						...(options.user
+							? {
+									name: {
+										$ne: null,
+									},
+							  }
+							: {}),
+					},
+					$orderby: 'name asc',
+				},
+			});
+			const fields = ['id', 'name', 'created_at', 'description', 'expiry_date'];
+			const _ = await import('lodash');
+			console.log(
+				getVisuals().table.horizontal(
+					keys.map((key) => _.mapValues(key, (val) => val ?? 'N/a')),
+					fields,
+				),
+			);
+		} catch (e) {
+			throw e;
+		}
+	}
+}

lib/commands/app/create.ts

@@ -0,0 +1,87 @@
+/**
+ * @license
+ * Copyright 2016-2021 Balena Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import { flags } from '@oclif/command';
+
+import Command from '../../command';
+import * as cf from '../../utils/common-flags';
+import { stripIndent } from '../../utils/lazy';
+import { ArgsDef, FlagsDef } from '../../utils/application-create';
+
+export default class AppCreateCmd extends Command {
+	public static description = stripIndent`
+		Create an app.
+
+		Create a new balena app.
+
+		You can specify the organization the app should belong to using
+		the \`--organization\` option. The organization's handle, not its name,
+		should be provided. Organization handles can be listed with the
+		\`balena orgs\` command.
+
+		The app's default device type is specified with the \`--type\` option.
+		The \`balena devices supported\` command can be used to list the available
+		device types.
+
+		Interactive dropdowns will be shown for selection if no device type or
+		organization is specified and there are multiple options to choose from.
+		If there is a single option to choose from, it will be chosen automatically.
+		This interactive behavior can be disabled by explicitly specifying a device
+		type and organization.
+	`;
+
+	public static examples = [
+		'$ balena app create MyApp',
+		'$ balena app create MyApp --organization mmyorg',
+		'$ balena app create MyApp -o myorg --type raspberry-pi',
+	];
+
+	public static args = [
+		{
+			name: 'name',
+			description: 'app name',
+			required: true,
+		},
+	];
+
+	public static usage = 'app create <name>';
+
+	public static flags: flags.Input<FlagsDef> = {
+		organization: flags.string({
+			char: 'o',
+			description: 'handle of the organization the app should belong to',
+		}),
+		type: flags.string({
+			char: 't',
+			description:
+				'app device type (Check available types with `balena devices supported`)',
+		}),
+		help: cf.help,
+	};
+
+	public static authenticated = true;
+
+	public async run() {
+		const { args: params, flags: options } = this.parse<FlagsDef, ArgsDef>(
+			AppCreateCmd,
+		);
+
+		await (
+			await import('../../utils/application-create')
+		).applicationCreateBase('app', options, params);
+	}
+}

lib/commands/block/create.ts

@@ -0,0 +1,96 @@
+/**
+ * @license
+ * Copyright 2016-2021 Balena Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import { flags } from '@oclif/command';
+
+import Command from '../../command';
+import * as cf from '../../utils/common-flags';
+import { stripIndent } from '../../utils/lazy';
+
+interface FlagsDef {
+	organization?: string;
+	type?: string; // application device type
+	help: void;
+}
+
+interface ArgsDef {
+	name: string;
+}
+
+export default class BlockCreateCmd extends Command {
+	public static description = stripIndent`
+		Create an block.
+
+		Create a new balena block.
+
+		You can specify the organization the block should belong to using
+		the \`--organization\` option. The organization's handle, not its name,
+		should be provided. Organization handles can be listed with the
+		\`balena orgs\` command.
+
+		The block's default device type is specified with the \`--type\` option.
+		The \`balena devices supported\` command can be used to list the available
+		device types.
+
+		Interactive dropdowns will be shown for selection if no device type or
+		organization is specified and there are multiple options to choose from.
+		If there is a single option to choose from, it will be chosen automatically.
+		This interactive behavior can be disabled by explicitly specifying a device
+		type and organization.
+	`;
+
+	public static examples = [
+		'$ balena block create MyBlock',
+		'$ balena block create MyBlock --organization mmyorg',
+		'$ balena block create MyBlock -o myorg --type raspberry-pi',
+	];
+
+	public static args = [
+		{
+			name: 'name',
+			description: 'block name',
+			required: true,
+		},
+	];
+
+	public static usage = 'block create <name>';
+
+	public static flags: flags.Input<FlagsDef> = {
+		organization: flags.string({
+			char: 'o',
+			description: 'handle of the organization the block should belong to',
+		}),
+		type: flags.string({
+			char: 't',
+			description:
+				'block device type (Check available types with `balena devices supported`)',
+		}),
+		help: cf.help,
+	};
+
+	public static authenticated = true;
+
+	public async run() {
+		const { args: params, flags: options } = this.parse<FlagsDef, ArgsDef>(
+			BlockCreateCmd,
+		);
+
+		await (
+			await import('../../utils/application-create')
+		).applicationCreateBase('block', options, params);
+	}
+}

lib/commands/build.ts

@@ -20,7 +20,7 @@ import Command from '../command';
 import { getBalenaSdk } from '../utils/lazy';
 import * as cf from '../utils/common-flags';
 import * as compose from '../utils/compose';
-import type { Application, ApplicationType, BalenaSDK } from 'balena-sdk';
+import type { ApplicationType, BalenaSDK } from 'balena-sdk';
 import {
 	buildArgDeprecation,
 	dockerignoreHelp,
@@ -208,7 +208,7 @@ ${dockerignoreHelp}
 	 *   buildEmulated
 	 *   buildOpts: arguments to forward to docker build command
 	 *
-	 * @param {DockerToolbelt} docker
+	 * @param {Dockerode} docker
 	 * @param {Logger} logger
 	 * @param {ComposeOpts} composeOpts
 	 * @param opts
@@ -218,7 +218,9 @@ ${dockerignoreHelp}
 		logger: import('../utils/logger'),
 		composeOpts: ComposeOpts,
 		opts: {
-			app?: Application;
+			app?: {
+				application_type: [Pick<ApplicationType, 'supports_multicontainer'>];
+			};
 			arch: string;
 			deviceType: string;
 			buildEmulated: boolean;
@@ -234,7 +236,7 @@ ${dockerignoreHelp}
 			opts.buildOpts.t,
 		);
 
-		const appType = (opts.app?.application_type as ApplicationType[])?.[0];
+		const appType = opts.app?.application_type?.[0];
 		if (
 			appType != null &&
 			project.descriptors.length > 1 &&

lib/commands/config/generate.ts

@@ -19,13 +19,18 @@ import { flags } from '@oclif/command';
 import Command from '../../command';
 import * as cf from '../../utils/common-flags';
 import { getBalenaSdk, getCliForm, stripIndent } from '../../utils/lazy';
-import { applicationIdInfo, devModeInfo } from '../../utils/messages';
-import type { PineDeferred } from 'balena-sdk';
+import {
+	applicationIdInfo,
+	devModeInfo,
+	secureBootInfo,
+} from '../../utils/messages';
+import type { BalenaSDK, PineDeferred } from 'balena-sdk';
 
 interface FlagsDef {
 	version: string; // OS version
 	fleet?: string;
 	dev?: boolean; // balenaOS development variant
+	secureBoot?: boolean;
 	device?: string;
 	deviceApiKey?: string;
 	deviceType?: string;
@@ -51,6 +56,8 @@ export default class ConfigGenerateCmd extends Command {
 
 		${devModeInfo.split('\n').join('\n\t\t')}
 
+		${secureBootInfo.split('\n').join('\n\t\t')}
+
 		To configure an image for a fleet of mixed device types, use the --fleet option
 		alongside the --deviceType option to specify the target device type.
 
@@ -66,6 +73,7 @@ export default class ConfigGenerateCmd extends Command {
 		'$ balena config generate --device 7cf02a6 --version 2.12.7 --deviceApiKey <existingDeviceKey>',
 		'$ balena config generate --device 7cf02a6 --version 2.12.7 --output config.json',
 		'$ balena config generate --fleet myorg/fleet --version 2.12.7 --dev',
+		'$ balena config generate --fleet myorg/fleet --version 2.12.7 --secureBoot',
 		'$ balena config generate --fleet myorg/fleet --version 2.12.7 --deviceType fincm3',
 		'$ balena config generate --fleet myorg/fleet --version 2.12.7 --output config.json',
 		'$ balena config generate --fleet myorg/fleet --version 2.12.7 --network wifi --wifiSsid mySsid --wifiKey abcdefgh --appUpdatePollInterval 15',
@@ -80,6 +88,7 @@ export default class ConfigGenerateCmd extends Command {
 		}),
 		fleet: { ...cf.fleet, exclusive: ['device'] },
 		dev: cf.dev,
+		secureBoot: cf.secureBoot,
 		device: {
 			...cf.device,
 			exclusive: [
@@ -135,17 +144,25 @@ export default class ConfigGenerateCmd extends Command {
 
 	public static authenticated = true;
 
+	public async getApplication(balena: BalenaSDK, fleet: string) {
+		const { getApplication } = await import('../../utils/sdk');
+		return await getApplication(balena, fleet, {
+			$select: 'slug',
+			$expand: {
+				is_for__device_type: { $select: 'slug' },
+			},
+		});
+	}
+
 	public async run() {
 		const { flags: options } = this.parse<FlagsDef, {}>(ConfigGenerateCmd);
-
-		const { getApplication } = await import('../../utils/sdk');
-
 		const balena = getBalenaSdk();
 
 		await this.validateOptions(options);
 
 		let resourceDeviceType: string;
-		let application: ApplicationWithDeviceType | null = null;
+		let application: Awaited<ReturnType<typeof this.getApplication>> | null =
+			null;
 		let device:
 			| (DeviceWithDeviceType & { belongs_to__application: PineDeferred })
 			| null = null;
@@ -165,11 +182,7 @@ export default class ConfigGenerateCmd extends Command {
 			resourceDeviceType = device.is_of__device_type[0].slug;
 		} else {
 			// Disambiguate application (if is a number, it could either be an ID or a numerical name)
-			application = (await getApplication(balena, options.fleet!, {
-				$expand: {
-					is_for__device_type: { $select: 'slug' },
-				},
-			})) as ApplicationWithDeviceType;
+			application = await this.getApplication(balena, options.fleet!);
 			resourceDeviceType = application.is_for__device_type[0].slug;
 		}
 
@@ -191,8 +204,16 @@ export default class ConfigGenerateCmd extends Command {
 			}
 		}
 
-		const deviceManifest = await balena.models.device.getManifestBySlug(
+		const deviceManifest =
+			await balena.models.config.getDeviceTypeManifestBySlug(deviceType);
+
+		const { validateSecureBootOptionAndWarn } = await import(
+			'../../utils/config'
+		);
+		await validateSecureBootOptionAndWarn(
+			options.secureBoot,
 			deviceType,
+			options.version,
 		);
 
 		// Prompt for values
@@ -203,6 +224,7 @@ export default class ConfigGenerateCmd extends Command {
 		});
 		answers.version = options.version;
 		answers.developmentMode = options.dev;
+		answers.secureBoot = options.secureBoot;
 		answers.provisioningKeyName = options['provisioning-key-name'];
 		answers.provisioningKeyExpiryDate = options['provisioning-key-expiry-date'];
 

lib/commands/deploy.ts

@@ -43,15 +43,13 @@ import {
 	parseReleaseTagKeysAndValues,
 } from '../utils/compose_ts';
 import { dockerCliFlags } from '../utils/docker';
-import type {
-	Application,
-	ApplicationType,
-	DeviceType,
-	Release,
-} from 'balena-sdk';
+import type { ApplicationType, DeviceType, Release } from 'balena-sdk';
 
-interface ApplicationWithArch extends Application {
+interface ApplicationWithArch {
+	id: number;
 	arch: string;
+	is_for__device_type: [Pick<DeviceType, 'slug'>];
+	application_type: [Pick<ApplicationType, 'slug' | 'supports_multicontainer'>];
 }
 
 interface FlagsDef extends ComposeCliFlags, DockerCliFlags {
@@ -235,7 +233,7 @@ ${dockerignoreHelp}
 			releaseTagValues,
 		);
 		if (options.note) {
-			await sdk.models.release.note(release.id, options.note);
+			await sdk.models.release.setNote(release.id, options.note);
 		}
 	}
 
@@ -262,7 +260,7 @@ ${dockerignoreHelp}
 			'../utils/compose_ts'
 		);
 
-		const appType = (opts.app?.application_type as ApplicationType[])?.[0];
+		const appType = opts.app.application_type[0];
 
 		try {
 			const project = await loadProject(
@@ -319,7 +317,7 @@ ${dockerignoreHelp}
 					projectName: project.name,
 					composition: compositionToBuild,
 					arch: opts.app.arch,
-					deviceType: (opts.app?.is_for__device_type as DeviceType[])?.[0].slug,
+					deviceType: opts.app.is_for__device_type[0].slug,
 					emulated: opts.buildEmulated,
 					buildOpts: opts.buildOpts,
 					inlineLogs: composeOpts.inlineLogs,
@@ -340,7 +338,7 @@ ${dockerignoreHelp}
 			);
 
 			let release: Release | ComposeReleaseInfo['release'];
-			if (appType?.is_legacy) {
+			if (appType.slug === 'legacy-v1' || appType.slug === 'legacy-v2') {
 				const { deployLegacy } = require('../utils/deploy-legacy');
 
 				const msg = getChalk().yellow(
@@ -348,9 +346,9 @@ ${dockerignoreHelp}
 				);
 				logger.logWarn(msg);
 
-				const [token, username, url, options] = await Promise.all([
+				const [token, { username }, url, options] = await Promise.all([
 					sdk.auth.getToken(),
-					sdk.auth.whoami(),
+					sdk.auth.getUserInfo(),
 					sdk.settings.get('balenaUrl'),
 					{
 						// opts.appName may be prefixed by 'owner/', unlike opts.app.app_name
@@ -373,8 +371,8 @@ ${dockerignoreHelp}
 					$select: ['commit'],
 				});
 			} else {
-				const [userId, auth, apiEndpoint] = await Promise.all([
-					sdk.auth.getUserId(),
+				const [{ id: userId }, auth, apiEndpoint] = await Promise.all([
+					sdk.auth.getUserInfo(),
 					sdk.auth.getToken(),
 					sdk.settings.get('apiUrl'),
 				]);

lib/commands/device/init.ts

@@ -124,20 +124,16 @@ export default class DeviceInitCmd extends Command {
 		const balena = getBalenaSdk();
 
 		// Get application and
-		const application = (await getApplication(
-			balena,
-			options.fleet ||
-				(
-					await (await import('../../utils/patterns')).selectApplication()
-				).slug,
-			{
-				$expand: {
-					is_for__device_type: {
-						$select: 'slug',
+		const application = options.fleet
+			? await getApplication(balena, options.fleet, {
+					$select: ['id', 'slug'],
+					$expand: {
+						is_for__device_type: {
+							$select: 'slug',
+						},
 					},
-				},
-			},
-		)) as ApplicationWithDeviceType;
+			  })
+			: await (await import('../../utils/patterns')).selectApplication();
 
 		// Register new device
 		const deviceUuid = balena.models.device.generateUniqueKey();

lib/commands/device/move.ts

@@ -20,7 +20,7 @@ import type { IArg } from '@oclif/parser/lib/args';
 import type {
 	BalenaSDK,
 	Device,
-	DeviceType,
+	PineOptions,
 	PineTypedResult,
 } from 'balena-sdk';
 import Command from '../../command';
@@ -29,13 +29,6 @@ import { ExpectedError } from '../../errors';
 import { getBalenaSdk, stripIndent } from '../../utils/lazy';
 import { applicationIdInfo } from '../../utils/messages';
 
-type ExtendedDevice = PineTypedResult<
-	Device,
-	typeof import('../../utils/helpers').expandForAppNameAndCpuArch
-> & {
-	application_name?: string;
-};
-
 interface FlagsDef {
 	fleet?: string;
 	help: void;
@@ -81,6 +74,33 @@ export default class DeviceMoveCmd extends Command {
 
 	public static authenticated = true;
 
+	private async getDevices(balena: BalenaSDK, deviceUuids: string[]) {
+		const deviceOptions = {
+			$select: 'belongs_to__application',
+			$expand: {
+				is_of__device_type: {
+					$select: 'is_of__cpu_architecture',
+					$expand: {
+						is_of__cpu_architecture: {
+							$select: 'slug',
+						},
+					},
+				},
+			},
+		} satisfies PineOptions<Device>;
+
+		// TODO: Refacor once `device.get()` accepts an array of uuids`
+		const devices = await Promise.all(
+			deviceUuids.map(
+				(uuid) =>
+					balena.models.device.get(uuid, deviceOptions) as Promise<
+						PineTypedResult<Device, typeof deviceOptions>
+					>,
+			),
+		);
+		return devices;
+	}
+
 	public async run() {
 		const { args: params, flags: options } = this.parse<FlagsDef, ArgsDef>(
 			DeviceMoveCmd,
@@ -88,36 +108,17 @@ export default class DeviceMoveCmd extends Command {
 
 		const balena = getBalenaSdk();
 
-		const { expandForAppNameAndCpuArch } = await import('../../utils/helpers');
-
 		// Split uuids string into array of uuids
 		const deviceUuids = params.uuid.split(',');
 
-		// Get devices
-		const devices = await Promise.all(
-			deviceUuids.map(
-				(uuid) =>
-					balena.models.device.get(
-						uuid,
-						expandForAppNameAndCpuArch,
-					) as Promise<ExtendedDevice>,
-			),
-		);
-
-		// Map application name for each device
-		for (const device of devices) {
-			const belongsToApplication = device.belongs_to__application;
-			device.application_name = belongsToApplication?.[0]
-				? belongsToApplication[0].app_name
-				: 'N/a';
-		}
+		const devices = await this.getDevices(balena, deviceUuids);
 
 		// Disambiguate application
 		const { getApplication } = await import('../../utils/sdk');
 
 		// Get destination application
 		const application = options.fleet
-			? await getApplication(balena, options.fleet)
+			? await getApplication(balena, options.fleet, { $select: ['id', 'slug'] })
 			: await this.interactivelySelectApplication(balena, devices);
 
 		// Move each device
@@ -134,9 +135,8 @@ export default class DeviceMoveCmd extends Command {
 
 	async interactivelySelectApplication(
 		balena: BalenaSDK,
-		devices: ExtendedDevice[],
+		devices: Awaited<ReturnType<typeof this.getDevices>>,
 	) {
-		const { getExpandedProp } = await import('../../utils/pine');
 		// deduplicate the slugs
 		const deviceCpuArchs = Array.from(
 			new Set(
@@ -146,46 +146,44 @@ export default class DeviceMoveCmd extends Command {
 			),
 		);
 
-		const deviceTypeOptions = {
-			$select: 'slug',
-			$expand: {
-				is_of__cpu_architecture: {
-					$select: 'slug',
-				},
+		const allCpuArches = await balena.pine.get({
+			resource: 'cpu_architecture',
+			options: {
+				$select: ['id', 'slug'],
 			},
-		} as const;
-		const deviceTypes = (await balena.models.deviceType.getAllSupported(
-			deviceTypeOptions,
-		)) as Array<PineTypedResult<DeviceType, typeof deviceTypeOptions>>;
+		});
 
-		const compatibleDeviceTypeSlugs = new Set(
-			deviceTypes
-				.filter((deviceType) => {
-					const deviceTypeArch = getExpandedProp(
-						deviceType.is_of__cpu_architecture,
-						'slug',
-					)!;
-					return deviceCpuArchs.every((deviceCpuArch) =>
-						balena.models.os.isArchitectureCompatibleWith(
-							deviceCpuArch,
-							deviceTypeArch,
-						),
-					);
-				})
-				.map((deviceType) => deviceType.slug),
-		);
+		const compatibleCpuArchIds = allCpuArches
+			.filter((cpuArch) => {
+				return deviceCpuArchs.every((deviceCpuArch) =>
+					balena.models.os.isArchitectureCompatibleWith(
+						deviceCpuArch,
+						cpuArch.slug,
+					),
+				);
+			})
+			.map((deviceType) => deviceType.id);
 
 		const patterns = await import('../../utils/patterns');
 		try {
 			const application = await patterns.selectApplication(
-				(app) =>
-					compatibleDeviceTypeSlugs.has(app.is_for__device_type[0].slug) &&
-					devices.some((device) => device.application_name !== app.app_name),
+				{
+					is_for__device_type: {
+						$any: {
+							$alias: 'dt',
+							$expr: {
+								dt: {
+									is_of__cpu_architecture: { $in: compatibleCpuArchIds },
+								},
+							},
+						},
+					},
+				},
 				true,
 			);
 			return application;
 		} catch (err) {
-			if (!compatibleDeviceTypeSlugs.size) {
+			if (!compatibleCpuArchIds.length) {
 				throw new ExpectedError(
 					`${err.message}\nDo all devices have a compatible architecture?`,
 				);

lib/commands/device/register.ts

@@ -78,7 +78,9 @@ export default class DeviceRegisterCmd extends Command {
 
 		const balena = getBalenaSdk();
 
-		const application = await getApplication(balena, params.fleet);
+		const application = await getApplication(balena, params.fleet, {
+			$select: ['id', 'slug'],
+		});
 		const uuid = options.uuid ?? balena.models.device.generateUniqueKey();
 
 		console.info(`Registering to ${application.slug}: ${uuid}`);

lib/commands/device/services.ts

@@ -1,93 +0,0 @@
-/**
- * @license
- * Copyright 2016-2020 Balena Ltd.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-import { flags } from '@oclif/command';
-import type { IArg } from '@oclif/parser/lib/args';
-import { ImageInstall } from 'balena-sdk';
-import Command from '../../command';
-import * as cf from '../../utils/common-flags';
-import { getBalenaSdk, getVisuals, stripIndent } from '../../utils/lazy';
-import { getExpandedProp } from '../../utils/pine';
-
-interface FlagsDef {
-	help: void;
-}
-
-interface ArgsDef {
-	uuid: string;
-}
-
-interface AugmentedImageInstall extends ImageInstall {
-	name?: string;
-	release?: string;
-}
-
-export default class DeviceServicesCmd extends Command {
-	public static description = stripIndent`
-         Show info about a device's services.
- 
-         Show info about a device's services.
-         `;
-	public static examples = ['$ balena device services 23c73a1'];
-
-	public static args: Array<IArg<any>> = [
-		{
-			name: 'uuid',
-			description: 'the uuid of the device whose services to show info about',
-			required: true,
-		},
-	];
-
-	public static usage = 'device services <uuid>';
-
-	public static flags: flags.Input<FlagsDef> = {
-		help: cf.help,
-	};
-
-	public static authenticated = true;
-
-	public async run() {
-		const { args: params } = this.parse<FlagsDef, ArgsDef>(DeviceServicesCmd);
-
-		const balena = getBalenaSdk();
-
-		try {
-			const device = await balena.models.device.getWithServiceDetails(
-				params.uuid,
-			);
-			console.log(
-				getVisuals().table.horizontal(
-					device.image_install?.map((imageInstall) => {
-						const newImageInstall: AugmentedImageInstall = { ...imageInstall };
-						newImageInstall.name = getExpandedProp(
-							getExpandedProp(imageInstall.image, 'is_a_build_of__service')!,
-							'service_name',
-						);
-						newImageInstall.release = getExpandedProp(
-							imageInstall.is_provided_by__release,
-							'commit',
-						);
-						return newImageInstall;
-					}),
-					['name', 'status', 'release', 'id'],
-				),
-			);
-		} catch (e) {
-			throw e;
-		}
-	}
-}

lib/commands/devices/index.ts

@@ -22,13 +22,7 @@ import { expandForAppName } from '../../utils/helpers';
 import { getBalenaSdk, getVisuals, stripIndent } from '../../utils/lazy';
 import { applicationIdInfo, jsonInfo } from '../../utils/messages';
 
-import type { Application } from 'balena-sdk';
-
-interface ExtendedDevice extends DeviceWithDeviceType {
-	dashboard_url?: string;
-	fleet?: string | null; // 'org/name' slug
-	device_type?: string | null;
-}
+import type { Device, PineOptions } from 'balena-sdk';
 
 interface FlagsDef {
 	fleet?: string;
@@ -36,6 +30,18 @@ interface FlagsDef {
 	json: boolean;
 }
 
+const devicesSelectFields = {
+	$select: [
+		'id',
+		'uuid',
+		'device_name',
+		'status',
+		'is_online',
+		'supervisor_version',
+		'os_version',
+	],
+} satisfies PineOptions<Device>;
+
 export default class DevicesCmd extends Command {
 	public static description = stripIndent`
 		List all devices.
@@ -70,36 +76,39 @@ export default class DevicesCmd extends Command {
 		const { flags: options } = this.parse<FlagsDef, {}>(DevicesCmd);
 
 		const balena = getBalenaSdk();
+		const devicesOptions = {
+			...devicesSelectFields,
+			...expandForAppName,
+			$orderby: { device_name: 'asc' },
+		} satisfies PineOptions<Device>;
 
-		let devices;
+		const devices = (
+			await (async () => {
+				if (options.fleet != null) {
+					const { getApplication } = await import('../../utils/sdk');
+					const application = await getApplication(balena, options.fleet, {
+						$select: 'slug',
+						$expand: {
+							owns__device: devicesOptions,
+						},
+					});
+					return application.owns__device;
+				}
 
-		if (options.fleet != null) {
-			const { getApplication } = await import('../../utils/sdk');
-			const application = await getApplication(balena, options.fleet);
-			devices = (await balena.models.device.getAllByApplication(
-				application.id,
-				expandForAppName,
-			)) as ExtendedDevice[];
-		} else {
-			devices = (await balena.models.device.getAll(
-				expandForAppName,
-			)) as ExtendedDevice[];
-		}
+				return await balena.pine.get({
+					resource: 'device',
+					options: devicesOptions,
+				});
+			})()
+		).map((device) => ({
+			...device,
+			dashboard_url: balena.models.device.getDashboardUrl(device.uuid),
+			fleet: device.belongs_to__application?.[0]?.slug || null,
+			uuid: options.json ? device.uuid : device.uuid.slice(0, 7),
+			device_type: device.is_of__device_type?.[0]?.slug || null,
+		}));
 
-		devices = devices.map(function (device) {
-			device.dashboard_url = balena.models.device.getDashboardUrl(device.uuid);
-
-			const belongsToApplication =
-				device.belongs_to__application as Application[];
-			device.fleet = belongsToApplication?.[0]?.slug || null;
-
-			device.uuid = options.json ? device.uuid : device.uuid.slice(0, 7);
-
-			device.device_type = device.is_of__device_type?.[0]?.slug || null;
-			return device;
-		});
-
-		const fields = [
+		const fields: Array<keyof (typeof devices)[number]> = [
 			'id',
 			'uuid',
 			'device_name',

lib/commands/devices/supported.ts

@@ -61,15 +61,15 @@ export default class DevicesSupportedCmd extends Command {
 	public async run() {
 		const { flags: options } = this.parse<FlagsDef, {}>(DevicesSupportedCmd);
 		const pineOptions = {
-			$select: (['slug', 'name'] as const).slice(),
+			$select: ['slug', 'name'],
 			$expand: {
 				is_of__cpu_architecture: { $select: 'slug' },
 				device_type_alias: {
 					$select: 'is_referenced_by__alias',
-					$orderby: 'is_referenced_by__alias asc',
+					$orderby: { is_referenced_by__alias: 'asc' },
 				},
 			},
-		} as const;
+		} satisfies BalenaSdk.PineOptions<BalenaSdk.DeviceType>;
 		const dts = (await getBalenaSdk().models.deviceType.getAllSupported(
 			pineOptions,
 		)) as Array<

lib/commands/env/add.ts

@@ -151,16 +151,15 @@ export default class EnvAddCmd extends Command {
 
 		const varType = isConfigVar ? 'configVar' : 'envVar';
 		if (options.fleet) {
-			const { getFleetSlug } = await import('../../utils/sdk');
-			for (const app of options.fleet.split(',')) {
+			for (const appSlug of await resolveFleetSlugs(balena, options.fleet)) {
 				try {
 					await balena.models.application[varType].set(
-						await getFleetSlug(balena, app),
+						appSlug,
 						params.name,
 						params.value,
 					);
 				} catch (err) {
-					console.error(`${err.message}, fleet: ${app}`);
+					console.error(`${err.message}, fleet: ${appSlug}`);
 					process.exitCode = 1;
 				}
 			}
@@ -181,6 +180,25 @@ export default class EnvAddCmd extends Command {
 	}
 }
 
+// TODO: Stop accepting application names in the next major
+// and just drop this in favor of doing the .split(',') directly.
+async function resolveFleetSlugs(
+	balena: BalenaSdk.BalenaSDK,
+	fleetOption: string,
+) {
+	const fleetSlugs: string[] = [];
+	const { getFleetSlug } = await import('../../utils/sdk');
+	for (const appNameOrSlug of fleetOption.split(',')) {
+		try {
+			fleetSlugs.push(await getFleetSlug(balena, appNameOrSlug));
+		} catch (err) {
+			console.error(`${err.message}, fleet: ${appNameOrSlug}`);
+			process.exitCode = 1;
+		}
+	}
+	return fleetSlugs;
+}
+
 /**
  * Add service variables for a device or fleet.
  */
@@ -190,17 +208,17 @@ async function setServiceVars(
 	options: FlagsDef,
 ) {
 	if (options.fleet) {
-		for (const app of options.fleet.split(',')) {
+		for (const appSlug of await resolveFleetSlugs(sdk, options.fleet)) {
 			for (const service of options.service!.split(',')) {
 				try {
-					const serviceId = await getServiceIdForApp(sdk, app, service);
+					const serviceId = await getServiceIdForApp(sdk, appSlug, service);
 					await sdk.models.service.var.set(
 						serviceId,
 						params.name,
 						params.value!,
 					);
 				} catch (err) {
-					console.error(`${err.message}, fleet: ${app}`);
+					console.error(`${err.message}, fleet: ${appSlug}`);
 					process.exitCode = 1;
 				}
 			}
@@ -245,11 +263,12 @@ async function setServiceVars(
  */
 async function getServiceIdForApp(
 	sdk: BalenaSdk.BalenaSDK,
-	appName: string,
+	appSlug: string,
 	serviceName: string,
 ): Promise<number> {
 	let serviceId: number | undefined;
-	const services = await sdk.models.service.getAllByApplication(appName, {
+	const services = await sdk.models.service.getAllByApplication(appSlug, {
+		$select: 'id',
 		$filter: { service_name: serviceName },
 	});
 	if (services.length > 0) {
@@ -257,7 +276,7 @@ async function getServiceIdForApp(
 	}
 	if (serviceId === undefined) {
 		throw new ExpectedError(
-			`Cannot find service ${serviceName} for fleet ${appName}`,
+			`Cannot find service ${serviceName} for fleet ${appSlug}`,
 		);
 	}
 	return serviceId;

lib/commands/envs.ts

@@ -93,7 +93,6 @@ export default class EnvsCmd extends Command {
 		'$ balena envs --fleet myorg/myfleet',
 		'$ balena envs --fleet MyFleet --json',
 		'$ balena envs --fleet MyFleet --service MyService',
-		'$ balena envs --fleet MyFleet --service MyService',
 		'$ balena envs --fleet MyFleet --config',
 		'$ balena envs --device 7cf02a6',
 		'$ balena envs --device 7cf02a6 --json',
@@ -209,6 +208,7 @@ async function validateServiceName(
 	fleetSlug: string,
 ) {
 	const services = await sdk.models.service.getAllByApplication(fleetSlug, {
+		$select: 'id',
 		$filter: { service_name: serviceName },
 	});
 	if (services.length === 0) {

lib/commands/fleet/create.ts

@@ -16,22 +16,11 @@
  */
 
 import { flags } from '@oclif/command';
-import type { Application } from 'balena-sdk';
 
 import Command from '../../command';
-import { ExpectedError } from '../../errors';
 import * as cf from '../../utils/common-flags';
-import { getBalenaSdk, stripIndent } from '../../utils/lazy';
-
-interface FlagsDef {
-	organization?: string;
-	type?: string; // application device type
-	help: void;
-}
-
-interface ArgsDef {
-	name: string;
-}
+import { stripIndent } from '../../utils/lazy';
+import { ArgsDef, FlagsDef } from '../../utils/application-create';
 
 export default class FleetCreateCmd extends Command {
 	public static description = stripIndent`
@@ -91,59 +80,8 @@ export default class FleetCreateCmd extends Command {
 			FleetCreateCmd,
 		);
 
-		// Ascertain device type
-		const deviceType =
-			options.type ||
-			(await (await import('../../utils/patterns')).selectDeviceType());
-
-		// Ascertain organization
-		const organization =
-			options.organization?.toLowerCase() || (await this.getOrganization());
-
-		// Create application
-		let application: Application;
-		try {
-			application = await getBalenaSdk().models.application.create({
-				name: params.name,
-				deviceType,
-				organization,
-			});
-		} catch (err) {
-			if ((err.message || '').toLowerCase().includes('unique')) {
-				// BalenaRequestError: Request error: "organization" and "app_name" must be unique.
-				throw new ExpectedError(
-					`Error: fleet "${params.name}" already exists in organization "${organization}".`,
-				);
-			} else if ((err.message || '').toLowerCase().includes('unauthorized')) {
-				// BalenaRequestError: Request error: Unauthorized
-				throw new ExpectedError(
-					`Error: You are not authorized to create fleets in organization "${organization}".`,
-				);
-			}
-
-			throw err;
-		}
-
-		// Output
-		console.log(
-			`Fleet created: slug "${application.slug}", device type "${deviceType}"`,
-		);
-	}
-
-	async getOrganization() {
-		const { getOwnOrganizations } = await import('../../utils/sdk');
-		const organizations = await getOwnOrganizations(getBalenaSdk());
-
-		if (organizations.length === 0) {
-			// User is not a member of any organizations (should not happen).
-			throw new Error('This account is not a member of any organizations');
-		} else if (organizations.length === 1) {
-			// User is a member of only one organization - use this.
-			return organizations[0].handle;
-		} else {
-			// User is a member of multiple organizations -
-			const { selectOrganization } = await import('../../utils/patterns');
-			return selectOrganization(organizations);
-		}
+		await (
+			await import('../../utils/application-create')
+		).applicationCreateBase('fleet', options, params);
 	}
 }

lib/commands/fleet/index.ts

@@ -17,7 +17,6 @@
 
 import type { flags as flagsType } from '@oclif/command';
 import { flags } from '@oclif/command';
-import type { Release } from 'balena-sdk';
 
 import Command from '../../command';
 import * as cf from '../../utils/common-flags';
@@ -74,17 +73,12 @@ export default class FleetCmd extends Command {
 
 		const balena = getBalenaSdk();
 
-		const application = (await getApplication(balena, params.fleet, {
+		const application = await getApplication(balena, params.fleet, {
 			$expand: {
 				is_for__device_type: { $select: 'slug' },
 				should_be_running__release: { $select: 'commit' },
 			},
-		})) as ApplicationWithDeviceType & {
-			should_be_running__release: [Release?];
-			// For display purposes:
-			device_type: string;
-			commit?: string;
-		};
+		});
 
 		if (options.view) {
 			const open = await import('open');
@@ -95,11 +89,14 @@ export default class FleetCmd extends Command {
 			return;
 		}
 
-		application.device_type = application.is_for__device_type[0].slug;
-		application.commit = application.should_be_running__release[0]?.commit;
+		const outputApplication = {
+			...application,
+			device_type: application.is_for__device_type[0].slug,
+			commit: application.should_be_running__release[0]?.commit,
+		};
 
 		await this.outputData(
-			application,
+			outputApplication,
 			['app_name', 'id', 'device_type', 'slug', 'commit'],
 			options,
 		);

lib/commands/fleet/purge.ts

@@ -65,7 +65,9 @@ export default class FleetPurgeCmd extends Command {
 
 		// balena.models.application.purge only accepts a numeric id
 		// so we must first fetch the app to get it's id,
-		const application = await getApplication(balena, params.fleet);
+		const application = await getApplication(balena, params.fleet, {
+			$select: 'id',
+		});
 
 		try {
 			await balena.models.application.purge(application.id);

lib/commands/fleet/rename.ts

@@ -16,7 +16,6 @@
  */
 
 import type { flags } from '@oclif/command';
-import type { ApplicationType } from 'balena-sdk';
 
 import Command from '../../command';
 import * as cf from '../../utils/common-flags';
@@ -78,9 +77,10 @@ export default class FleetRenameCmd extends Command {
 		// Disambiguate target application (if params.params is a number, it could either be an ID or a numerical name)
 		const { getApplication } = await import('../../utils/sdk');
 		const application = await getApplication(balena, params.fleet, {
+			$select: ['id', 'app_name', 'slug'],
 			$expand: {
 				application_type: {
-					$select: ['is_legacy'],
+					$select: 'slug',
 				},
 			},
 		});
@@ -91,8 +91,8 @@ export default class FleetRenameCmd extends Command {
 		}
 
 		// Check app supports renaming
-		const appType = (application.application_type as ApplicationType[])?.[0];
-		if (appType.is_legacy) {
+		const appType = application.application_type[0];
+		if (appType.slug === 'legacy-v1' || appType.slug === 'legacy-v2') {
 			throw new ExpectedError(
 				`Fleet ${params.fleet} is of 'legacy' type, and cannot be renamed.`,
 			);
@@ -133,9 +133,9 @@ export default class FleetRenameCmd extends Command {
 		}
 
 		// Get application again, to be sure of results
-		const renamedApplication = await balena.models.application.get(
-			application.id,
-		);
+		const renamedApplication = await getApplication(balena, application.id, {
+			$select: ['app_name', 'slug'],
+		});
 
 		// Output result
 		console.log(`Fleet renamed`);

lib/commands/fleet/restart.ts

@@ -63,7 +63,9 @@ export default class FleetRestartCmd extends Command {
 		const balena = getBalenaSdk();
 
 		// Disambiguate application
-		const application = await getApplication(balena, params.fleet);
+		const application = await getApplication(balena, params.fleet, {
+			$select: 'slug',
+		});
 
 		await balena.models.application.restart(application.slug);
 	}

lib/commands/fleet/rm.ts

@@ -76,7 +76,9 @@ export default class FleetRmCmd extends Command {
 		);
 
 		// Disambiguate application (if is a number, it could either be an ID or a numerical name)
-		const application = await getApplication(balena, params.fleet);
+		const application = await getApplication(balena, params.fleet, {
+			$select: 'slug',
+		});
 
 		// Remove
 		await balena.models.application.remove(application.slug);

lib/commands/fleets.ts

@@ -15,6 +15,7 @@
  * limitations under the License.
  */
 
+import type * as BalenaSdk from 'balena-sdk';
 import { flags } from '@oclif/command';
 
 import Command from '../command';
@@ -22,7 +23,7 @@ import * as cf from '../utils/common-flags';
 import { getBalenaSdk, stripIndent } from '../utils/lazy';
 import type { DataSetOutputOptions } from '../framework';
 
-interface ExtendedApplication extends ApplicationWithDeviceType {
+interface ExtendedApplication extends ApplicationWithDeviceTypeSlug {
 	device_count: number;
 	online_devices: number;
 	device_type?: string;
@@ -60,15 +61,20 @@ export default class FleetsCmd extends Command {
 
 		const balena = getBalenaSdk();
 
+		const pineOptions = {
+			$select: ['id', 'app_name', 'slug'],
+			$expand: {
+				is_for__device_type: { $select: 'slug' },
+				owns__device: { $select: 'is_online' },
+			},
+		} satisfies BalenaSdk.PineOptions<BalenaSdk.Application>;
 		// Get applications
 		const applications =
-			(await balena.models.application.getAllDirectlyAccessible({
-				$select: ['id', 'app_name', 'slug'],
-				$expand: {
-					is_for__device_type: { $select: 'slug' },
-					owns__device: { $select: 'is_online' },
-				},
-			})) as ExtendedApplication[];
+			(await balena.models.application.getAllDirectlyAccessible(
+				pineOptions,
+			)) as Array<
+				BalenaSdk.PineTypedResult<BalenaSdk.Application, typeof pineOptions>
+			> as ExtendedApplication[];
 
 		// Add extended properties
 		applications.forEach((application) => {

lib/commands/login.ts

@@ -20,6 +20,7 @@ import Command from '../command';
 import * as cf from '../utils/common-flags';
 import { getBalenaSdk, stripIndent, getCliForm } from '../utils/lazy';
 import { ExpectedError } from '../errors';
+import type { WhoamiResult } from 'balena-sdk';
 
 interface FlagsDef {
 	token: boolean;
@@ -30,6 +31,7 @@ interface FlagsDef {
 	password?: string;
 	port?: number;
 	help: void;
+	hideExperimentalWarning: boolean;
 }
 
 interface ArgsDef {
@@ -114,6 +116,11 @@ export default class LoginCmd extends Command {
 				'TCP port number of local HTTP login server (--web auth only)',
 			dependsOn: ['web'],
 		}),
+		hideExperimentalWarning: flags.boolean({
+			char: 'H',
+			default: false,
+			description: 'Hides warning for experimental features',
+		}),
 		help: cf.help,
 	};
 
@@ -137,9 +144,24 @@ export default class LoginCmd extends Command {
 		console.log(`\nLogging in to ${balenaUrl}`);
 		await this.doLogin(options, balenaUrl, params.token);
 
-		const username = await balena.auth.whoami();
+		// We can safely assume this won't be undefined as doLogin will throw if this call fails
+		// We also don't need to worry too much about the amount of calls to whoami
+		// as these are cached by the SDK
+		const whoamiResult = (await balena.auth.whoami()) as WhoamiResult;
 
-		console.info(`Successfully logged in as: ${username}`);
+		if (whoamiResult.actorType !== 'user' && !options.hideExperimentalWarning) {
+			console.info(stripIndent`
+			----------------------------------------------------------------------------------------
+			You are logging in with a ${whoamiResult.actorType} key.
+			This is an experimental feature and many features of the CLI might not work as expected.
+			We sure hope you know what you are doing.
+			----------------------------------------------------------------------------------------
+			`);
+		}
+
+		console.info(
+			`Successfully logged in as: ${this.getLoggedInMessage(whoamiResult)}`,
+		);
 		console.info(`\
 
 Find out about the available commands by running:
@@ -149,6 +171,16 @@ Find out about the available commands by running:
 ${messages.reachingOut}`);
 	}
 
+	private getLoggedInMessage(whoami: WhoamiResult): string {
+		if (whoami.actorType === 'user') {
+			return whoami.username;
+		}
+
+		const identifier =
+			whoami.actorType === 'device' ? whoami.uuid : whoami.slug;
+		return `${whoami.actorType} ${identifier}`;
+	}
+
 	async doLogin(
 		loginOptions: FlagsDef,
 		balenaUrl: string = 'balena-cloud.com',
@@ -165,7 +197,14 @@ ${messages.reachingOut}`);
 			}
 			const balena = getBalenaSdk();
 			await balena.auth.loginWithToken(token!);
-			if (!(await balena.auth.whoami())) {
+			try {
+				if (!(await balena.auth.whoami())) {
+					throw new ExpectedError('Token authentication failed');
+				}
+			} catch (err) {
+				if (process.env.DEBUG) {
+					console.error(`Get user info failed with: ${err.message}`);
+				}
 				throw new ExpectedError('Token authentication failed');
 			}
 			return;

lib/commands/note.ts

@@ -88,6 +88,6 @@ export default class NoteCmd extends Command {
 
 		const balena = getBalenaSdk();
 
-		return balena.models.device.note(options.device!, params.note);
+		return balena.models.device.setNote(options.device, params.note);
 	}
 }

lib/commands/orgs.ts

@@ -46,7 +46,9 @@ export default class OrgsCmd extends Command {
 		const { getOwnOrganizations } = await import('../utils/sdk');
 
 		// Get organizations
-		const organizations = await getOwnOrganizations(getBalenaSdk());
+		const organizations = await getOwnOrganizations(getBalenaSdk(), {
+			$select: ['name', 'handle'],
+		});
 
 		// Display
 		console.log(

lib/commands/os/configure.ts

@@ -23,7 +23,11 @@ import Command from '../../command';
 import { ExpectedError } from '../../errors';
 import * as cf from '../../utils/common-flags';
 import { getBalenaSdk, stripIndent, getCliForm } from '../../utils/lazy';
-import { applicationIdInfo, devModeInfo } from '../../utils/messages';
+import {
+	applicationIdInfo,
+	devModeInfo,
+	secureBootInfo,
+} from '../../utils/messages';
 
 const CONNECTIONS_FOLDER = '/system-connections';
 
@@ -36,6 +40,7 @@ interface FlagsDef {
 	'config-wifi-key'?: string;
 	'config-wifi-ssid'?: string;
 	dev?: boolean; // balenaOS development variant
+	secureBoot?: boolean;
 	device?: string; // device UUID
 	'device-type'?: string;
 	help?: void;
@@ -53,6 +58,7 @@ interface ArgsDef {
 interface Answers {
 	appUpdatePollInterval: number; // in minutes
 	developmentMode?: boolean; // balenaOS development variant
+	secureBoot?: boolean;
 	deviceType: string; // e.g. "raspberrypi3"
 	network: 'ethernet' | 'wifi';
 	version: string; // e.g. "2.32.0+rev1"
@@ -80,6 +86,8 @@ export default class OsConfigureCmd extends Command {
 
 		${devModeInfo.split('\n').join('\n\t\t')}
 
+		${secureBootInfo.split('\n').join('\n\t\t')}
+
 		The --system-connection (-c) option is used to inject NetworkManager connection
 		profiles for additional network interfaces, such as cellular/GSM or additional
 		WiFi or ethernet connections. This option may be passed multiple times in case there
@@ -140,6 +148,7 @@ export default class OsConfigureCmd extends Command {
 			description: 'WiFi SSID (network name) (non-interactive configuration)',
 		}),
 		dev: cf.dev,
+		secureBoot: cf.secureBoot,
 		device: {
 			...cf.device,
 			exclusive: [
@@ -195,7 +204,7 @@ export default class OsConfigureCmd extends Command {
 		const helpers = await import('../../utils/helpers');
 		const { getApplication } = await import('../../utils/sdk');
 
-		let app: ApplicationWithDeviceType | undefined;
+		let app: ApplicationWithDeviceTypeSlug | undefined;
 		let device;
 		let deviceTypeSlug: string;
 
@@ -214,7 +223,7 @@ export default class OsConfigureCmd extends Command {
 				$expand: {
 					is_for__device_type: { $select: 'slug' },
 				},
-			})) as ApplicationWithDeviceType;
+			})) as ApplicationWithDeviceTypeSlug;
 			await checkDeviceTypeCompatibility(options, app);
 			deviceTypeSlug =
 				options['device-type'] || app.is_for__device_type[0].slug;
@@ -238,6 +247,15 @@ export default class OsConfigureCmd extends Command {
 		const { validateDevOptionAndWarn } = await import('../../utils/config');
 		await validateDevOptionAndWarn(options.dev, osVersion);
 
+		const { validateSecureBootOptionAndWarn } = await import(
+			'../../utils/config'
+		);
+		await validateSecureBootOptionAndWarn(
+			options.secureBoot,
+			deviceTypeSlug,
+			osVersion,
+		);
+
 		const answers: Answers = await askQuestionsForDeviceType(
 			deviceTypeManifest,
 			options,
@@ -248,6 +266,7 @@ export default class OsConfigureCmd extends Command {
 		}
 		answers.version = osVersion;
 		answers.developmentMode = options.dev;
+		answers.secureBoot = options.secureBoot;
 		answers.provisioningKeyName = options['provisioning-key-name'];
 		answers.provisioningKeyExpiryDate = options['provisioning-key-expiry-date'];
 
@@ -362,7 +381,9 @@ async function getOsVersionFromImage(
  */
 async function checkDeviceTypeCompatibility(
 	options: FlagsDef,
-	app: ApplicationWithDeviceType,
+	app: {
+		is_for__device_type: [Pick<BalenaSdk.DeviceType, 'slug'>];
+	},
 ) {
 	if (options['device-type']) {
 		const helpers = await import('../../utils/helpers');

lib/commands/preload.ts

@@ -31,7 +31,14 @@ import { parseAsInteger } from '../utils/validation';
 
 import { flags } from '@oclif/command';
 import * as _ from 'lodash';
-import type { Application, BalenaSDK, PineExpand, Release } from 'balena-sdk';
+import type {
+	Application,
+	BalenaSDK,
+	PineExpand,
+	PineOptions,
+	PineTypedResult,
+	Release,
+} from 'balena-sdk';
 import type { Preloader } from 'balena-preload';
 
 interface FlagsDef extends DockerConnectionCliFlags {
@@ -39,7 +46,7 @@ interface FlagsDef extends DockerConnectionCliFlags {
 	commit?: string;
 	'splash-image'?: string;
 	'dont-check-arch': boolean;
-	'pin-device-to-release': boolean;
+	'pin-device-to-release'?: boolean;
 	'additional-space'?: number;
 	'add-certificate'?: string[];
 	help: void;
@@ -115,7 +122,7 @@ https://github.com/balena-io-examples/staged-releases\
 				'disable architecture compatibility check between image and fleet',
 		}),
 		'pin-device-to-release': flags.boolean({
-			default: false,
+			allowNo: true,
 			description:
 				'pin the preloaded device to the preloaded release on provision',
 			char: 'p',
@@ -187,7 +194,7 @@ Can be repeated to add multiple certificates.\
 			: undefined;
 
 		const progressBars: {
-			[key: string]: ReturnType<typeof getVisuals>['Progress'];
+			[key: string]: InstanceType<ReturnType<typeof getVisuals>['Progress']>;
 		} = {};
 
 		const progressHandler = function (event: {
@@ -201,7 +208,7 @@ Can be repeated to add multiple certificates.\
 		};
 
 		const spinners: {
-			[key: string]: ReturnType<typeof getVisuals>['Spinner'];
+			[key: string]: InstanceType<ReturnType<typeof getVisuals>['Spinner']>;
 		} = {};
 
 		const spinnerHandler = function (event: { name: string; action: string }) {
@@ -223,7 +230,7 @@ Can be repeated to add multiple certificates.\
 		const splashImage = options['splash-image'];
 		const additionalSpace = options['additional-space'];
 		const dontCheckArch = options['dont-check-arch'] || false;
-		const pinDevice = options['pin-device-to-release'] || false;
+		const pinDevice = options['pin-device-to-release'];
 
 		if (dontCheckArch && !fleetSlug) {
 			throw new ExpectedError(
@@ -242,7 +249,7 @@ Can be repeated to add multiple certificates.\
 		const dockerUtils = await import('../utils/docker');
 		const docker = await dockerUtils.getDocker(options);
 		const preloader = new balenaPreload.Preloader(
-			null,
+			undefined,
 			docker,
 			fleetSlug,
 			commit,
@@ -250,7 +257,7 @@ Can be repeated to add multiple certificates.\
 			splashImage,
 			undefined, // TODO: Currently always undefined, investigate approach in ssh command.
 			dontCheckArch,
-			pinDevice,
+			pinDevice ?? false,
 			certificates,
 			additionalSpace,
 		);
@@ -308,7 +315,7 @@ Can be repeated to add multiple certificates.\
 		}
 	}
 
-	readonly applicationExpandOptions: PineExpand<Application> = {
+	readonly applicationExpandOptions = {
 		owns__release: {
 			$select: ['id', 'commit', 'end_timestamp', 'composition'],
 			$expand: {
@@ -329,7 +336,7 @@ Can be repeated to add multiple certificates.\
 		should_be_running__release: {
 			$select: 'commit',
 		},
-	};
+	} satisfies PineExpand<Application>;
 
 	isCurrentCommit(commit: string) {
 		return commit === 'latest' || commit === 'current';
@@ -343,7 +350,7 @@ Can be repeated to add multiple certificates.\
 		} catch {
 			throw new Error(`Device type "${deviceTypeSlug}" not found in API query`);
 		}
-		return (await balena.models.application.getAllDirectlyAccessible({
+		const options = {
 			$select: ['id', 'slug', 'should_track_latest_release'],
 			$expand: this.applicationExpandOptions,
 			$filter: {
@@ -388,11 +395,10 @@ Can be repeated to add multiple certificates.\
 				},
 			},
 			$orderby: 'slug asc',
-		})) as Array<
-			ApplicationWithDeviceType & {
-				should_be_running__release: [Release?];
-			}
-		>;
+		} satisfies PineOptions<Application>;
+		return (await balena.models.application.getAllDirectlyAccessible(
+			options,
+		)) as Array<PineTypedResult<Application, typeof options>>;
 	}
 
 	async selectApplication(deviceTypeSlug: string) {
@@ -442,16 +448,16 @@ Can be repeated to add multiple certificates.\
 	}
 
 	async offerToDisableAutomaticUpdates(
-		application: Application,
+		application: Pick<Application, 'id' | 'should_track_latest_release'>,
 		commit: string,
-		pinDevice: boolean,
+		pinDevice: boolean | undefined,
 	) {
 		const balena = getBalenaSdk();
 
 		if (
 			this.isCurrentCommit(commit) ||
 			!application.should_track_latest_release ||
-			pinDevice
+			pinDevice != null
 		) {
 			return;
 		}
@@ -470,8 +476,9 @@ through the web dashboard or programatically through the balena API / SDK.
 Documentation about release policies and pinning can be found at:
 https://www.balena.io/docs/learn/deploy/release-strategy/release-policy/
 
-Alternatively, the --pin-device-to-release flag may be used to pin only the
-preloaded device to the selected release.
+Alternatively, the --pin-device-to-release or --no-pin-device-to-release flags may be used
+to avoid this interactive confirmation and pin only the preloaded device to the selected release
+or keep it unpinned respectively.
 
 Would you like to disable automatic updates for this fleet now?\
 `;
@@ -494,9 +501,9 @@ Would you like to disable automatic updates for this fleet now?\
 	async getAppWithReleases(balenaSdk: BalenaSDK, slug: string) {
 		const { getApplication } = await import('../utils/sdk');
 
-		return (await getApplication(balenaSdk, slug, {
+		return await getApplication(balenaSdk, slug, {
 			$expand: this.applicationExpandOptions,
-		})) as Application & { should_be_running__release: [Release?] };
+		});
 	}
 
 	async prepareAndPreload(
@@ -505,14 +512,14 @@ Would you like to disable automatic updates for this fleet now?\
 		options: {
 			slug?: string;
 			commit?: string;
-			pinDevice: boolean;
+			pinDevice?: boolean;
 		},
 	) {
 		await preloader.prepare();
 
 		const application = options.slug
 			? await this.getAppWithReleases(balenaSdk, options.slug)
-			: await this.selectApplication(preloader.config.deviceType);
+			: await this.selectApplication(preloader.config!.deviceType);
 
 		let commit: string; // commit hash or the strings 'latest' or 'current'
 

lib/commands/push.ts

@@ -178,7 +178,7 @@ export default class PushCmd extends Command {
 			description: stripIndent`
 				Don't run a live session on this push. The filesystem will not be monitored,
 				and changes will not be synchronized to any running containers. Note that both
-				this flag and --detached and required to cause the process to end once the
+				this flag and --detached are required to cause the process to end once the
 				initial build has completed.`,
 			default: false,
 		}),
@@ -328,7 +328,7 @@ export default class PushCmd extends Command {
 		]);
 
 		const application = await getApplication(sdk, appNameOrSlug, {
-			$select: ['app_name', 'slug'],
+			$select: 'slug',
 		});
 
 		const opts = {
@@ -358,7 +358,7 @@ export default class PushCmd extends Command {
 				releaseTagValues,
 			);
 			if (options.note) {
-				await sdk.models.release.note(releaseId, options.note);
+				await sdk.models.release.setNote(releaseId, options.note);
 			}
 		} else if (releaseTagKeys.length > 0) {
 			throw new Error(stripIndent`

lib/commands/scan.ts

@@ -16,7 +16,6 @@
  */
 
 import { flags } from '@oclif/command';
-import type { LocalBalenaOsDevice } from 'balena-sync';
 import Command from '../command';
 import * as cf from '../utils/common-flags';
 import { getCliUx, stripIndent } from '../utils/lazy';
@@ -72,7 +71,7 @@ export default class ScanCmd extends Command {
 
 	public async run() {
 		const _ = await import('lodash');
-		const { discover } = await import('balena-sync');
+		const { discoverLocalBalenaOsDevices } = await import('../utils/discover');
 		const prettyjson = await import('prettyjson');
 		const dockerUtils = await import('../utils/docker');
 
@@ -88,8 +87,7 @@ export default class ScanCmd extends Command {
 		const ux = getCliUx();
 		ux.action.start('Scanning for local balenaOS devices');
 
-		const localDevices: LocalBalenaOsDevice[] =
-			await discover.discoverLocalBalenaOsDevices(discoverTimeout);
+		const localDevices = await discoverLocalBalenaOsDevices(discoverTimeout);
 		const engineReachableDevices: boolean[] = await Promise.all(
 			localDevices.map(async ({ address }: { address: string }) => {
 				const docker = await dockerUtils.createClient({
@@ -106,7 +104,7 @@ export default class ScanCmd extends Command {
 			}),
 		);
 
-		const developmentDevices: LocalBalenaOsDevice[] = localDevices.filter(
+		const developmentDevices = localDevices.filter(
 			(_localDevice, index) => engineReachableDevices[index],
 		);
 
@@ -116,18 +114,15 @@ export default class ScanCmd extends Command {
 			_.isEqual,
 		);
 
-		const productionDevicesInfo = _.map(
-			productionDevices,
-			(device: LocalBalenaOsDevice) => {
-				return {
-					host: device.host,
-					address: device.address,
-					osVariant: 'production',
-					dockerInfo: undefined,
-					dockerVersion: undefined,
-				};
-			},
-		);
+		const productionDevicesInfo = productionDevices.map((device) => {
+			return {
+				host: device.host,
+				address: device.address,
+				osVariant: 'production',
+				dockerInfo: undefined,
+				dockerVersion: undefined,
+			};
+		});
 
 		// Query devices for info
 		const devicesInfo = await Promise.all(

lib/commands/ssh.ts

@@ -152,9 +152,9 @@ export default class SshCmd extends Command {
 
 		const { which } = await import('../utils/which');
 
-		const [whichProxytunnel, username, proxyUrl] = await Promise.all([
+		const [whichProxytunnel, { username }, proxyUrl] = await Promise.all([
 			useProxy ? which('proxytunnel', false) : undefined,
-			sdk.auth.whoami(),
+			sdk.auth.getUserInfo(),
 			// note that `proxyUrl` refers to the balenaCloud "resin-proxy"
 			// service, currently "balena-devices.com", rather than some
 			// local proxy server URL
@@ -208,7 +208,7 @@ export default class SshCmd extends Command {
 				port: options.port || 'cloud',
 				proxyCommand,
 				service: params.service,
-				username: username!,
+				username,
 			});
 		}
 

lib/commands/support.ts

@@ -149,7 +149,7 @@ export default class SupportCmd extends Command {
 			console.log(
 				`Access has been granted for ${duration}, expiring ${new Date(
 					expiryTs,
-				).toLocaleString()}`,
+				).toISOString()}`,
 			);
 		}
 	}

lib/commands/tunnel.ts

@@ -153,19 +153,19 @@ export default class TunnelCmd extends Command {
 						try {
 							await handler(client);
 							logConnection(
-								client.remoteAddress || '',
-								client.remotePort || 0,
-								client.localAddress,
-								client.localPort,
+								client.remoteAddress ?? '',
+								client.remotePort ?? 0,
+								client.localAddress ?? '',
+								client.localPort ?? 0,
 								uuid,
 								remotePort,
 							);
 						} catch (err) {
 							logConnection(
-								client.remoteAddress || '',
-								client.remotePort || 0,
-								client.localAddress,
-								client.localPort,
+								client.remoteAddress ?? '',
+								client.remotePort ?? 0,
+								client.localAddress ?? '',
+								client.localPort ?? 0,
 								uuid,
 								remotePort,
 								err,

lib/commands/whoami.ts

@@ -36,18 +36,37 @@ export default class WhoamiCmd extends Command {
 
 		const balena = getBalenaSdk();
 
-		const [username, email, url] = await Promise.all([
+		const [whoamiResult, url] = await Promise.all([
 			balena.auth.whoami(),
-			balena.auth.getEmail(),
 			balena.settings.get('balenaUrl'),
 		]);
-		console.log(
-			getVisuals().table.vertical({ username, email, url }, [
-				'$account information$',
-				'username',
-				'email',
-				'url',
-			]),
-		);
+
+		if (whoamiResult?.actorType === 'user') {
+			const { username, email } = whoamiResult;
+			console.log(
+				getVisuals().table.vertical({ username, email, url }, [
+					'$account information$',
+					'username',
+					'email',
+					'url',
+				]),
+			);
+		} else if (whoamiResult?.actorType === 'device') {
+			console.log(
+				getVisuals().table.vertical({ device: whoamiResult.uuid, url }, [
+					'$account information$',
+					'device',
+					'url',
+				]),
+			);
+		} else if (whoamiResult?.actorType === 'application') {
+			console.log(
+				getVisuals().table.vertical({ application: whoamiResult.slug, url }, [
+					'$account information$',
+					'application',
+					'url',
+				]),
+			);
+		}
 	}
 }

lib/deprecation.ts

@@ -15,6 +15,8 @@
  * limitations under the License.
  */
 
+import type { BalenaSettingsStorage } from 'balena-settings-storage';
+
 export interface ReleaseTimestampsByVersion {
 	[version: string]: string; // e.g. { '12.0.0': '2021-06-16T12:54:52.000Z' }
 	lastFetched: string; // ISO 8601 timestamp, e.g. '2021-06-27T16:46:10.000Z'
@@ -46,7 +48,7 @@ export class DeprecationChecker {
 	readonly cacheFile = 'cachedReleaseTimestamps';
 	readonly now = new Date().getTime();
 	private initialized = false;
-	storage: ReturnType<typeof import('balena-settings-storage')>;
+	storage: BalenaSettingsStorage;
 	cachedTimestamps: ReleaseTimestampsByVersion;
 	nextMajorVersion: string; // semver without the 'v' prefix
 
@@ -63,7 +65,7 @@ export class DeprecationChecker {
 		this.initialized = true;
 
 		const settings = await import('balena-settings-client');
-		const getStorage = await import('balena-settings-storage');
+		const { getStorage } = await import('balena-settings-storage');
 		const dataDirectory = settings.get<string>('dataDirectory');
 		this.storage = getStorage({ dataDirectory });
 		let stored: ReleaseTimestampsByVersion | undefined;
@@ -86,7 +88,7 @@ export class DeprecationChecker {
 	 * @param version Semver without 'v' prefix, e.g. '12.0.0.'
 	 */
 	protected getNpmUrl(version: string) {
-		return `http://registry.npmjs.org/balena-cli/${version}`;
+		return `https://registry.npmjs.org/balena-cli/${version}`;
 	}
 
 	/**

lib/help.ts

@@ -14,11 +14,10 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-import Help from '@oclif/plugin-help';
+import { Help } from '@oclif/core';
+import { HelpFormatter } from '@oclif/core/lib/help/formatter';
 import * as indent from 'indent-string';
 import { getChalk } from './utils/lazy';
-import { renderList } from '@oclif/plugin-help/lib/list';
-import { ExpectedError } from './errors';
 
 // Partially overrides standard implementation of help plugin
 // https://github.com/oclif/plugin-help/blob/master/src/index.ts
@@ -39,9 +38,11 @@ function getHelpSubject(args: string[]): string | undefined {
 }
 
 export default class BalenaHelp extends Help {
+	public helpFormatter = new HelpFormatter(this.config);
+
 	public static usage: 'help [command]';
 
-	public showHelp(argv: string[]) {
+	public async showHelp(argv: string[]) {
 		const chalk = getChalk();
 		const subject = getHelpSubject(argv);
 		if (!subject) {
@@ -52,7 +53,7 @@ export default class BalenaHelp extends Help {
 
 		const command = this.config.findCommand(subject);
 		if (command) {
-			this.showCommandHelp(command);
+			await this.showCommandHelp(command);
 			return;
 		}
 
@@ -77,7 +78,7 @@ export default class BalenaHelp extends Help {
 			return;
 		}
 
-		throw new ExpectedError(`command ${chalk.cyan.bold(subject)} not found`);
+		console.log(`command ${chalk.cyan.bold(subject)} not found`);
 	}
 
 	getCustomRootHelp(showAllCommands: boolean): string {
@@ -91,7 +92,7 @@ export default class BalenaHelp extends Help {
 			.map((pc) => {
 				return commands.find((c) => c.id === pc.replace(' ', ':'));
 			})
-			.filter((c): c is typeof commands[0] => !!c);
+			.filter((c): c is (typeof commands)[0] => !!c);
 
 		let usageLength = 0;
 		for (const cmd of primaryCommands) {
@@ -187,14 +188,15 @@ See: https://git.io/JRHUW#deprecation-policy`,
 			return '';
 		}
 
-		const body = renderList(
+		const body = this.helpFormatter.renderList(
 			commands
 				.filter((c) => c.usage != null && c.usage !== '')
 				.map((c) => [c.usage, this.formatDescription(c.description)]),
 			{
 				spacer: '\n',
 				stripAnsi: this.opts.stripAnsi,
-				maxWidth: this.opts.maxWidth - 2,
+				indentation: 2,
+				multiline: false,
 			},
 		);
 

lib/hooks/command-not-found/suggest.ts

@@ -17,6 +17,7 @@
 
 import { Hook } from '@oclif/config';
 import type { IConfig } from '@oclif/config';
+import { getChalk } from '../../utils/lazy';
 
 /*
  A modified version of the command-not-found plugin logic,
@@ -31,7 +32,7 @@ const hook: Hook<'command-not-found'> = async function (
 ) {
 	const Levenshtein = await import('fast-levenshtein');
 	const _ = await import('lodash');
-	const { color } = await import('@oclif/color');
+	const chalk = getChalk();
 
 	const commandId = opts.id || '';
 	const command = opts.id?.replace(':', ' ') || '';
@@ -60,17 +61,19 @@ const hook: Hook<'command-not-found'> = async function (
 
 	// Output suggestions
 	console.error(
-		`${color.yellow(command)} is not a recognized balena command.\n`,
+		`${chalk.yellow(command)} is not a recognized balena command.\n`,
 	);
 	console.error(`Did you mean: ? `);
 	suggestions.forEach((s) => {
-		console.error(`  ${color.cmd(s)}`);
+		console.error(`  ${chalk.cyan.bold(s)}`);
 	});
 	console.error(
-		`\nRun ${color.cmd('balena help -v')} for a list of available commands,`,
+		`\nRun ${chalk.cyan.bold(
+			'balena help -v',
+		)} for a list of available commands,`,
 	);
 	console.error(
-		` or ${color.cmd(
+		` or ${chalk.cyan.bold(
 			'balena help <command>',
 		)} for detailed help on a specific command.`,
 	);

lib/preparser.ts

@@ -133,7 +133,6 @@ Please use "balena ${alternative}" instead.`);
 		'local stop': [removed, stopAlternative, 'v11.0.0'],
 		app: [replaced, 'fleet', 'v13.0.0'],
 		apps: [replaced, 'fleets', 'v13.0.0'],
-		'app create': [replaced, 'fleet create', 'v13.0.0'],
 		'app purge': [replaced, 'fleet purge', 'v13.0.0'],
 		'app rename': [replaced, 'fleet rename', 'v13.0.0'],
 		'app restart': [replaced, 'fleet restart', 'v13.0.0'],

lib/utils/application-create.ts

@@ -0,0 +1,58 @@
+import { ExpectedError } from '../errors';
+import { getBalenaSdk } from './lazy';
+
+export interface FlagsDef {
+	organization?: string;
+	type?: string; // application device type
+	help: void;
+}
+
+export interface ArgsDef {
+	name: string;
+}
+
+export async function applicationCreateBase(
+	resource: 'fleet' | 'app' | 'block',
+	options: FlagsDef,
+	params: ArgsDef,
+) {
+	// Ascertain device type
+	const deviceType =
+		options.type || (await (await import('./patterns')).selectDeviceType());
+
+	// Ascertain organization
+	const organization =
+		options.organization?.toLowerCase() ||
+		(await (await import('./patterns')).getAndSelectOrganization());
+
+	// Create application
+	try {
+		const application = await getBalenaSdk().models.application.create({
+			name: params.name,
+			deviceType,
+			organization,
+		});
+
+		// Output
+		const { capitalize } = await import('lodash');
+		console.log(
+			`${capitalize(resource)} created: slug "${
+				application.slug
+			}", device type "${deviceType}"`,
+		);
+	} catch (err) {
+		if ((err.message || '').toLowerCase().includes('unique')) {
+			// BalenaRequestError: Request error: "organization" and "app_name" must be unique.
+			throw new ExpectedError(
+				`Error: An app or block or fleet with the name "${params.name}" already exists in organization "${organization}".`,
+			);
+		} else if ((err.message || '').toLowerCase().includes('unauthorized')) {
+			// BalenaRequestError: Request error: Unauthorized
+			throw new ExpectedError(
+				`Error: You are not authorized to create ${resource}s in organization "${organization}".`,
+			);
+		}
+
+		throw err;
+	}
+}

lib/utils/bootstrap.ts

@@ -138,7 +138,7 @@ export async function getCachedUsername(): Promise<CachedUsername | undefined> {
 	if (cachedUsername) {
 		return cachedUsername;
 	}
-	const [{ getBalenaSdk }, getStorage, settings] = await Promise.all([
+	const [{ getBalenaSdk }, { getStorage }, settings] = await Promise.all([
 		import('./lazy'),
 		import('balena-settings-storage'),
 		import('balena-settings-client'),
@@ -167,7 +167,7 @@ export async function getCachedUsername(): Promise<CachedUsername | undefined> {
 		// ignore
 	}
 	try {
-		const username = await getBalenaSdk().auth.whoami();
+		const { username } = await getBalenaSdk().auth.getUserInfo();
 		if (username) {
 			cachedUsername = { token, username };
 			await storage.set('cachedUsername', cachedUsername);

lib/utils/common-flags.ts

@@ -74,6 +74,12 @@ export const dev: IBooleanFlag<boolean> = flags.boolean({
 	default: false,
 });
 
+export const secureBoot: IBooleanFlag<boolean> = flags.boolean({
+	description:
+		'Configure balenaOS installer to opt-in secure boot and disk encryption',
+	default: false,
+});
+
 export const drive = flags.string({
 	char: 'd',
 	description: stripIndent`

lib/utils/config.ts

@@ -52,10 +52,14 @@ export interface ImgConfig {
 	os?: {
 		sshKeys?: string[];
 	};
+
+	installer?: {
+		secureboot?: boolean;
+	};
 }
 
 export async function generateApplicationConfig(
-	application: BalenaSdk.Application,
+	application: Pick<BalenaSdk.Application, 'slug'>,
 	options: {
 		version: string;
 		appUpdatePollInterval?: number;
@@ -63,6 +67,7 @@ export async function generateApplicationConfig(
 		os?: {
 			sshKeys?: string[];
 		};
+		secureBoot?: boolean;
 	},
 ): Promise<ImgConfig> {
 	options = {
@@ -84,6 +89,12 @@ export async function generateApplicationConfig(
 			: options.os.sshKeys;
 	}
 
+	// configure installer secure boot opt-in if specified
+	if (options.secureBoot) {
+		config.installer ??= {};
+		config.installer.secureboot = options.secureBoot;
+	}
+
 	return config;
 }
 
@@ -165,3 +176,54 @@ export async function validateDevOptionAndWarn(
 		and exposes network ports such as 2375 that allows unencrypted access to balenaEngine.
 		Therefore, development mode should only be used in private, trusted local networks.`);
 }
+
+/**
+ * Chech whether the `--secureBoot` option of commands related to OS configuration
+ * such as `os configure` and `config generate` is compatible with a given
+ * OS release, and print a warning regarding the consequences of using that
+ * option.
+ */
+export async function validateSecureBootOptionAndWarn(
+	secureBoot?: boolean,
+	slug?: string,
+	version?: string,
+	logger?: import('./logger'),
+) {
+	if (!secureBoot) {
+		return;
+	}
+	const { ExpectedError } = await import('../errors');
+	if (!version) {
+		throw new ExpectedError(`Error: No version provided`);
+	}
+	if (!slug) {
+		throw new ExpectedError(`Error: No device type provided`);
+	}
+	const sdk = getBalenaSdk();
+	const [osRelease] = await sdk.models.os.getAllOsVersions(slug, {
+		$select: 'contract',
+		$filter: { raw_version: `${version.replace(/^v/, '')}` },
+	});
+	if (!osRelease) {
+		throw new ExpectedError(`Error: No ${version} release for ${slug}`);
+	}
+
+	const contract = osRelease.contract ? JSON.parse(osRelease.contract) : null;
+	if (
+		contract?.provides.some((entry: Dictionary<string>) => {
+			return entry.type === 'sw.feature' && entry.slug === 'secureboot';
+		})
+	) {
+		if (!logger) {
+			const Logger = await import('./logger');
+			logger = Logger.getLogger();
+		}
+		logger.logInfo(stripIndent`
+			The '--secureBoot' option is being used to configure a balenaOS installer image
+			into secure boot and full disk encryption.`);
+	} else {
+		throw new ExpectedError(
+			`Error: The '--secureBoot' option is not supported for ${slug} in ${version}`,
+		);
+	}
+}

lib/utils/device/deploy.ts

@@ -44,7 +44,7 @@ import { displayBuildLog } from './logs';
 import { stripIndent } from '../lazy';
 
 const LOCAL_APPNAME = 'localapp';
-const LOCAL_RELEASEHASH = 'localrelease';
+const LOCAL_RELEASEHASH = '10ca12e1ea5e';
 const LOCAL_PROJECT_NAME = 'local_image';
 
 // Define the logger here so the debug output
@@ -209,9 +209,9 @@ export async function deployToDevice(opts: DeviceDeployOptions): Promise<void> {
 	globalLogger.logDebug('Fetching device information...');
 	const deviceInfo = await api.getDeviceInformation();
 
-	let buildLogs: Dictionary<string> | undefined;
+	let imageIds: Dictionary<string[]> | undefined;
 	if (!opts.nolive) {
-		buildLogs = {};
+		imageIds = {};
 	}
 
 	const { awaitInterruptibleTask } = await import('../helpers');
@@ -223,7 +223,7 @@ export async function deployToDevice(opts: DeviceDeployOptions): Promise<void> {
 		deviceInfo,
 		globalLogger,
 		opts,
-		buildLogs,
+		imageIds,
 	);
 
 	globalLogger.outputDeferredMessages();
@@ -265,7 +265,7 @@ export async function deployToDevice(opts: DeviceDeployOptions): Promise<void> {
 			docker,
 			logger: globalLogger,
 			composition: project.composition,
-			buildLogs: buildLogs!,
+			imageIds: imageIds!,
 			deployOpts: opts,
 		});
 		promises.push(livepush.init());
@@ -312,6 +312,14 @@ function connectToDocker(host: string, port: number): Docker {
 	});
 }
 
+function extractDockerArrowMessage(outputLine: string): string | undefined {
+	const arrowTest = /^.*\s*-+>\s*(.+)/i;
+	const match = arrowTest.exec(outputLine);
+	if (match != null) {
+		return match[1];
+	}
+}
+
 async function performBuilds(
 	composition: Composition,
 	tarStream: Readable,
@@ -319,7 +327,7 @@ async function performBuilds(
 	deviceInfo: DeviceInfo,
 	logger: Logger,
 	opts: DeviceDeployOptions,
-	buildLogs?: Dictionary<string>,
+	imageIds?: Dictionary<string[]>,
 ): Promise<BuildTask[]> {
 	const multibuild = await import('@balena/compose/dist/multibuild');
 
@@ -345,14 +353,29 @@ async function performBuilds(
 	// If we're passed a build logs object make sure to set it
 	// up properly
 	let logHandlers: ((serviceName: string, line: string) => void) | undefined;
-	if (buildLogs != null) {
+
+	const lastArrowMessage: Dictionary<string> = {};
+
+	if (imageIds != null) {
 		for (const task of buildTasks) {
 			if (!task.external) {
-				buildLogs[task.serviceName] = '';
+				imageIds[task.serviceName] = [];
 			}
 		}
 		logHandlers = (serviceName: string, line: string) => {
-			buildLogs[serviceName] += `${line}\n`;
+			// If this was a from line, take the last found
+			// image id and save it
+			if (
+				/step \d+(?:\/\d+)?\s*:\s*FROM/i.test(line) &&
+				lastArrowMessage[serviceName] != null
+			) {
+				imageIds[serviceName].push(lastArrowMessage[serviceName]);
+			} else {
+				const msg = extractDockerArrowMessage(line);
+				if (msg != null) {
+					lastArrowMessage[serviceName] = msg;
+				}
+			}
 		};
 	}
 
@@ -413,12 +436,26 @@ export async function rebuildSingleTask(
 	// the logs, so any calller who wants to keep track of
 	// this should provide the following callback
 	containerIdCb?: (id: string) => void,
-): Promise<string> {
+): Promise<string[]> {
 	const multibuild = await import('@balena/compose/dist/multibuild');
 	// First we run the build task, to get the new image id
-	let buildLogs = '';
+	const stageIds = [] as string[];
+	let lastArrowMessage: string | undefined;
+
 	const logHandler = (_s: string, line: string) => {
-		buildLogs += `${line}\n`;
+		// If this was a FROM line, take the last found
+		// image id and save it as a stage id
+		if (
+			/step \d+(?:\/\d+)?\s*:\s*FROM/i.test(line) &&
+			lastArrowMessage != null
+		) {
+			stageIds.push(lastArrowMessage);
+		} else {
+			const msg = extractDockerArrowMessage(line);
+			if (msg != null) {
+				lastArrowMessage = msg;
+			}
+		}
 
 		if (containerIdCb != null) {
 			const match = line.match(/^\s*--->\s*Running\s*in\s*([a-f0-9]*)\s*$/i);
@@ -477,7 +514,7 @@ export async function rebuildSingleTask(
 		]);
 	}
 
-	return buildLogs;
+	return stageIds;
 }
 
 function assignOutputHandlers(
@@ -551,7 +588,7 @@ async function assignDockerBuildOpts(
 				pull: opts.pull,
 			};
 			if (task.external) {
-				task.dockerOpts.authconfig = await getAuthConfigObj(
+				task.dockerOpts.authconfig = getAuthConfigObj(
 					task.imageName!,
 					opts.registrySecrets,
 				);

lib/utils/device/live.ts

@@ -52,7 +52,6 @@ interface MonitoredContainer {
 	containerId: string;
 }
 
-type BuildLogs = Dictionary<string>;
 type StageImageIDs = Dictionary<string[]>;
 
 export interface LivepushOpts {
@@ -62,7 +61,7 @@ export interface LivepushOpts {
 	docker: Dockerode;
 	api: DeviceAPI;
 	logger: Logger;
-	buildLogs: BuildLogs;
+	imageIds: StageImageIDs;
 	deployOpts: DeviceDeployOptions;
 }
 
@@ -97,7 +96,7 @@ export class LivepushManager {
 		this.api = opts.api;
 		this.logger = opts.logger;
 		this.deployOpts = opts.deployOpts;
-		this.imageIds = LivepushManager.getMultistageImageIDs(opts.buildLogs);
+		this.imageIds = opts.imageIds;
 	}
 
 	public async init(): Promise<void> {
@@ -250,7 +249,7 @@ export class LivepushManager {
 			cwd: serviceContext,
 			followSymlinks: true,
 			ignoreInitial: true,
-			ignored: (filePath: string, stats: fs.Stats | undefined) => {
+			ignored: (filePath: string, stats?: fs.Stats) => {
 				if (!stats) {
 					try {
 						// sync because chokidar defines a sync interface
@@ -297,33 +296,6 @@ export class LivepushManager {
 		return new Dockerfile(content).generateLiveDockerfile();
 	}
 
-	private static getMultistageImageIDs(buildLogs: BuildLogs): StageImageIDs {
-		const stageIds: StageImageIDs = {};
-		_.each(buildLogs, (log, serviceName) => {
-			stageIds[serviceName] = [];
-
-			const lines = log.split(/\r?\n/);
-			let lastArrowMessage: string | undefined;
-			for (const line of lines) {
-				// If this was a from line, take the last found
-				// image id and save it
-				if (
-					/step \d+(?:\/\d+)?\s*:\s*FROM/i.test(line) &&
-					lastArrowMessage != null
-				) {
-					stageIds[serviceName].push(lastArrowMessage);
-				} else {
-					const msg = LivepushManager.extractDockerArrowMessage(line);
-					if (msg != null) {
-						lastArrowMessage = msg;
-					}
-				}
-			}
-		});
-
-		return stageIds;
-	}
-
 	private async awaitDeviceStateSettle(): Promise<void> {
 		// Cache the state to avoid unnecessary calls
 		this.lastDeviceStatus = await this.api.getStatus();
@@ -405,9 +377,9 @@ export class LivepushManager {
 				);
 			}
 
-			let buildLog: string;
+			let stageImages: string[];
 			try {
-				buildLog = await rebuildSingleTask(
+				stageImages = await rebuildSingleTask(
 					serviceName,
 					this.docker,
 					this.logger,
@@ -466,17 +438,13 @@ export class LivepushManager {
 				);
 			}
 
-			const buildLogs: Dictionary<string> = {};
-			buildLogs[serviceName] = buildLog;
-			const stageImages = LivepushManager.getMultistageImageIDs(buildLogs);
-
 			const dockerfile = new Dockerfile(buildTask.dockerfile!);
 
 			instance.livepush = await Livepush.init({
 				dockerfile,
 				context: buildTask.context!,
 				containerId: container.containerId,
-				stageImages: stageImages[serviceName],
+				stageImages,
 				docker: this.docker,
 			});
 			this.assignLivepushOutputHandlers(serviceName, instance.livepush);
@@ -536,16 +504,6 @@ export class LivepushManager {
 		});
 	}
 
-	private static extractDockerArrowMessage(
-		outputLine: string,
-	): string | undefined {
-		const arrowTest = /^.*\s*-+>\s*(.+)/i;
-		const match = arrowTest.exec(outputLine);
-		if (match != null) {
-			return match[1];
-		}
-	}
-
 	private getDockerfilePathFromTask(task: BuildTask): string[] {
 		switch (task.projectType) {
 			case 'Standard Dockerfile':

lib/utils/device/logs.ts

@@ -155,12 +155,8 @@ export function displayLogObject<T extends Log>(
 	system: boolean,
 	filterServices?: string[],
 ): void {
-	let toPrint: string;
-	if (obj.timestamp != null) {
-		toPrint = `[${new Date(obj.timestamp).toLocaleString()}]`;
-	} else {
-		toPrint = `[${new Date().toLocaleString()}]`;
-	}
+	const d = obj.timestamp != null ? new Date(obj.timestamp) : new Date();
+	let toPrint = `[${d.toISOString()}]`;
 
 	if (obj.serviceName != null) {
 		if (filterServices) {

lib/utils/discover.ts

@@ -0,0 +1,40 @@
+import { enumerateServices, findServices } from 'resin-discoverable-services';
+
+interface LocalBalenaOsDevice {
+	address: string;
+	host: string;
+	osVariant?: string;
+	port: number;
+}
+
+// Although we only check for 'balena-ssh', we know, implicitly, that balenaOS
+// devices come with 'rsync' installed that can be used over SSH.
+const avahiBalenaSshTag = 'resin-ssh';
+
+export async function discoverLocalBalenaOsDevices(
+	timeout = 4000,
+): Promise<LocalBalenaOsDevice[]> {
+	const availableServices = await enumerateServices();
+	const serviceDefinitions = Array.from(availableServices)
+		.filter((s) => Array.from(s.tags).includes(avahiBalenaSshTag))
+		.map((s) => s.service);
+
+	if (serviceDefinitions.length === 0) {
+		throw new Error(
+			`Could not find any available '${avahiBalenaSshTag}' services`,
+		);
+	}
+
+	const services = await findServices(serviceDefinitions, timeout);
+	return services.map(function (service) {
+		// User referer address to get device IP. This will work fine assuming that
+		// a device only advertises own services.
+		const {
+			referer: { address },
+			host,
+			port,
+		} = service;
+
+		return { address, host, port };
+	});
+}

lib/utils/helpers.ts

@@ -119,7 +119,10 @@ export async function getManifest(
 			`The device type of the provided OS image ${manifest.slug}, does not match the expected device type ${deviceType}`,
 		);
 	}
-	return manifest ?? (await sdk.models.device.getManifestBySlug(deviceType));
+	return (
+		manifest ??
+		(await sdk.models.config.getDeviceTypeManifestBySlug(deviceType))
+	);
 }
 
 export const areDeviceTypesCompatible = async (
@@ -137,7 +140,7 @@ export const areDeviceTypesCompatible = async (
 				$select: 'slug',
 			},
 		},
-	} as const;
+	} satisfies BalenaSdk.PineOptions<BalenaSdk.DeviceType>;
 	const [appDeviceType, osDeviceType] = await Promise.all(
 		[appDeviceTypeSlug, osDeviceTypeSlug].map(
 			(dtSlug) =>
@@ -177,14 +180,13 @@ export async function osProgressHandler(step: InitializeEmitter) {
 	});
 }
 
-export async function getAppWithArch(
-	applicationName: string,
-): Promise<ApplicationWithDeviceType & { arch: string }> {
+export async function getAppWithArch(applicationName: string) {
 	const { getApplication } = await import('./sdk');
-	const options: BalenaSdk.PineOptions<BalenaSdk.Application> = {
+	const balena = getBalenaSdk();
+	const app = await getApplication(balena, applicationName, {
 		$expand: {
 			application_type: {
-				$select: ['name', 'slug', 'supports_multicontainer', 'is_legacy'],
+				$select: ['name', 'slug', 'supports_multicontainer'],
 			},
 			is_for__device_type: {
 				$select: 'slug',
@@ -195,20 +197,10 @@ export async function getAppWithArch(
 				},
 			},
 		},
-	};
-	const balena = getBalenaSdk();
-	const app = (await getApplication(
-		balena,
-		applicationName,
-		options,
-	)) as ApplicationWithDeviceType;
-	const { getExpanded } = await import('./pine');
-
+	});
 	return {
 		...app,
-		arch: getExpanded(
-			getExpanded(app.is_for__device_type)!.is_of__cpu_architecture,
-		)!.slug,
+		arch: app.is_for__device_type[0].is_of__cpu_architecture[0].slug,
 	};
 }
 
@@ -439,25 +431,11 @@ export function getProxyConfig(): ProxyConfig | undefined {
 
 export const expandForAppName = {
 	$expand: {
-		belongs_to__application: { $select: ['app_name', 'slug'] as any },
+		belongs_to__application: { $select: ['app_name', 'slug'] },
 		is_of__device_type: { $select: 'slug' },
 		is_running__release: { $select: 'commit' },
 	},
-} as const;
-
-export const expandForAppNameAndCpuArch = {
-	$expand: {
-		...expandForAppName.$expand,
-		is_of__device_type: {
-			$select: 'slug',
-			$expand: {
-				is_of__cpu_architecture: {
-					$select: 'slug',
-				},
-			},
-		},
-	},
-} as const;
+} satisfies BalenaSdk.PineOptions<BalenaSdk.Device>;
 
 /**
  * Use the `readline` library on Windows to install SIGINT handlers.

lib/utils/lazy.ts

@@ -20,7 +20,7 @@ import type * as BalenaSdk from 'balena-sdk';
 import type { Chalk } from 'chalk';
 import type * as visuals from 'resin-cli-visuals';
 import type * as CliForm from 'resin-cli-form';
-import type { ux } from 'cli-ux';
+import type { ux } from '@oclif/core';
 
 // Equivalent of _.once but avoiding the need to import lodash for lazy deps
 const once = <T>(fn: () => T) => {
@@ -57,7 +57,9 @@ export const getCliForm = once(
 	() => require('resin-cli-form') as typeof CliForm,
 );
 
-export const getCliUx = once(() => require('cli-ux').ux as typeof ux);
+export const getCliUx = once(
+	() => require('@oclif/core/lib/cli-ux') as typeof ux,
+);
 
 // Directly export stripIndent as we always use it immediately, but importing just `stripIndent` reduces startup time
 export const stripIndent =

lib/utils/messages.ts

@@ -169,6 +169,10 @@ confuse the balenaOS "development mode" with a device's "local mode", the latter
 being a supervisor feature that allows the "balena push" command to push a user's
 application directly to a device in the local network.`;
 
+export const secureBootInfo = `\
+The '--secureBoot' option is used to configure a balenaOS installer image to opt-in
+secure boot and disk encryption.`;
+
 export const jsonInfo = `\
 The --json option is recommended when scripting the output of this command,
 because field names are less likely to change in JSON format and because it

lib/utils/patterns.ts

@@ -14,8 +14,15 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-import type { Application, BalenaSDK, Device, Organization } from 'balena-sdk';
-import _ = require('lodash');
+import type {
+	Application,
+	BalenaSDK,
+	Device,
+	Organization,
+	PineFilter,
+	PineOptions,
+	PineTypedResult,
+} from 'balena-sdk';
 
 import { instanceOf, NotLoggedInError, ExpectedError } from '../errors';
 import { getBalenaSdk, getVisuals, stripIndent, getCliForm } from './lazy';
@@ -108,22 +115,22 @@ export function askLoginType() {
 	});
 }
 
-export function selectDeviceType() {
-	return getBalenaSdk()
-		.models.config.getDeviceTypes()
-		.then((deviceTypes) => {
-			deviceTypes = _.sortBy(deviceTypes, 'name').filter(
-				(dt) => dt.state !== 'DISCONTINUED',
-			);
-			return getCliForm().ask({
-				message: 'Device Type',
-				type: 'list',
-				choices: _.map(deviceTypes, ({ slug: value, name }) => ({
-					name,
-					value,
-				})),
-			});
-		});
+export async function selectDeviceType() {
+	const sdk = getBalenaSdk();
+	let deviceTypes = await sdk.models.deviceType.getAllSupported();
+	if (deviceTypes.length === 0) {
+		// Without this open-balena users would get an empty list
+		// until we add a hostApps import in open-balena.
+		deviceTypes = await sdk.models.deviceType.getAll();
+	}
+	return getCliForm().ask({
+		message: 'Device Type',
+		type: 'list',
+		choices: deviceTypes.map(({ slug: value, name }) => ({
+			name,
+			value,
+		})),
+	});
 }
 
 /**
@@ -157,46 +164,60 @@ export async function confirm(
 	}
 }
 
-export function selectApplication(
-	filter?: (app: ApplicationWithDeviceType) => boolean,
+const selectApplicationPineOptions = {
+	$select: ['id', 'slug', 'app_name'],
+	$expand: {
+		is_for__device_type: {
+			$select: 'slug',
+		},
+	},
+} satisfies PineOptions<Application>;
+
+type SelectApplicationResult = PineTypedResult<
+	Application,
+	typeof selectApplicationPineOptions
+>;
+
+export async function selectApplication(
+	filter?:
+		| PineFilter<Application>
+		| ((app: SelectApplicationResult) => boolean),
 	errorOnEmptySelection = false,
 ) {
 	const balena = getBalenaSdk();
-	return balena.models.application
-		.hasAny()
-		.then(async (hasAnyApplications) => {
-			if (!hasAnyApplications) {
-				throw new ExpectedError('No fleets found');
-			}
+	let apps = (await balena.models.application.getAllDirectlyAccessible({
+		...selectApplicationPineOptions,
+		...(filter != null && typeof filter === 'object' && { $filter: filter }),
+	})) as SelectApplicationResult[];
 
-			const apps = (await balena.models.application.getAllDirectlyAccessible({
-				$expand: {
-					is_for__device_type: {
-						$select: 'slug',
-					},
-				},
-			})) as ApplicationWithDeviceType[];
-			return apps.filter(filter || _.constant(true));
-		})
-		.then((applications) => {
-			if (errorOnEmptySelection && applications.length === 0) {
-				throw new ExpectedError('No suitable fleets found for selection');
-			}
-			return getCliForm().ask({
-				message: 'Select an application',
-				type: 'list',
-				choices: _.map(applications, (application) => ({
-					name: `${application.app_name} (${application.slug}) [${application.is_for__device_type[0].slug}]`,
-					value: application,
-				})),
-			});
-		});
+	if (!apps.length) {
+		throw new ExpectedError('No fleets found');
+	}
+
+	if (filter != null && typeof filter === 'function') {
+		apps = apps.filter(filter);
+	}
+
+	if (errorOnEmptySelection && apps.length === 0) {
+		throw new ExpectedError('No suitable fleets found for selection');
+	}
+	return getCliForm().ask({
+		message: 'Select an application',
+		type: 'list',
+		choices: apps.map((application) => ({
+			name: `${application.app_name} (${application.slug}) [${application.is_for__device_type[0].slug}]`,
+			value: application,
+		})),
+	});
 }
 
-export async function selectOrganization(organizations?: Organization[]) {
+export async function selectOrganization(
+	organizations?: Array<Pick<Organization, 'handle' | 'name'>>,
+) {
 	// Use either provided orgs (if e.g. already loaded) or load from cloud
-	organizations =
-		organizations || (await getBalenaSdk().models.organization.getAll());
+	organizations ??= await getBalenaSdk().models.organization.getAll({
+		$select: ['name', 'handle'],
+	});
 	return getCliForm().ask({
 		message: 'Select an organization',
 		type: 'list',
@@ -207,6 +228,24 @@ export async function selectOrganization(organizations?: Organization[]) {
 	});
 }
 
+export async function getAndSelectOrganization() {
+	const { getOwnOrganizations } = await import('./sdk');
+	const organizations = await getOwnOrganizations(getBalenaSdk(), {
+		$select: ['name', 'handle'],
+	});
+
+	if (organizations.length === 0) {
+		// User is not a member of any organizations (should not happen).
+		throw new Error('This account is not a member of any organizations');
+	} else if (organizations.length === 1) {
+		// User is a member of only one organization - use this.
+		return organizations[0].handle;
+	} else {
+		// User is a member of multiple organizations -
+		return selectOrganization(organizations);
+	}
+}
+
 export async function awaitDeviceOsUpdate(
 	uuid: string,
 	targetOsVersion: string,
@@ -252,33 +291,6 @@ export async function awaitDeviceOsUpdate(
 	return uuid;
 }
 
-export function inferOrSelectDevice(preferredUuid: string) {
-	const balena = getBalenaSdk();
-	return balena.models.device.getAll().then((devices) => {
-		const onlineDevices = devices.filter((device) => device.is_online);
-		if (_.isEmpty(onlineDevices)) {
-			throw new ExpectedError("You don't have any devices online");
-		}
-
-		const defaultUuid = _(onlineDevices).map('uuid').includes(preferredUuid)
-			? preferredUuid
-			: onlineDevices[0].uuid;
-
-		return getCliForm().ask({
-			message: 'Select a device',
-			type: 'list',
-			default: defaultUuid,
-			choices: _.map(onlineDevices, (device) => ({
-				name: `${device.device_name || 'Untitled'} (${device.uuid.slice(
-					0,
-					7,
-				)})`,
-				value: device.uuid,
-			})),
-		});
-	});
-}
-
 /*
  * Given fleetOrDevice, which may be
  *  - a fleet name
@@ -322,28 +334,34 @@ export async function getOnlineTargetDeviceUuid(
 	}
 
 	// Not a device UUID, try application
-	let application: Application;
-	try {
-		logger.logDebug(`Fetching fleet ${fleetOrDevice}`);
-		const { getApplication } = await import('./sdk');
-		application = await getApplication(sdk, fleetOrDevice);
-	} catch (err) {
-		const { BalenaApplicationNotFound } = await import('balena-errors');
-		if (instanceOf(err, BalenaApplicationNotFound)) {
-			throw new ExpectedError(`Fleet or Device not found: ${fleetOrDevice}`);
-		} else {
-			throw err;
+	const application = await (async () => {
+		try {
+			logger.logDebug(`Fetching fleet ${fleetOrDevice}`);
+			const { getApplication } = await import('./sdk');
+			return await getApplication(sdk, fleetOrDevice, {
+				$select: ['id', 'slug'],
+				$expand: {
+					owns__device: {
+						$select: ['device_name', 'uuid'],
+						$filter: { is_online: true },
+					},
+				},
+			});
+		} catch (err) {
+			const { BalenaApplicationNotFound } = await import('balena-errors');
+			if (instanceOf(err, BalenaApplicationNotFound)) {
+				throw new ExpectedError(`Fleet or Device not found: ${fleetOrDevice}`);
+			} else {
+				throw err;
+			}
 		}
-	}
+	})();
 
 	// App found, load its devices
-	const devices = await sdk.models.device.getAllByApplication(application.id, {
-		$select: ['device_name', 'uuid'],
-		$filter: { is_online: true },
-	});
+	const devices = application.owns__device;
 
 	// Throw if no devices online
-	if (_.isEmpty(devices)) {
+	if (!devices.length) {
 		throw new ExpectedError(
 			`Fleet ${application.slug} found, but has no devices online.`,
 		);
@@ -354,7 +372,7 @@ export async function getOnlineTargetDeviceUuid(
 		message: `Select a device on fleet ${application.slug}`,
 		type: 'list',
 		default: devices[0].uuid,
-		choices: _.map(devices, (device) => ({
+		choices: devices.map((device) => ({
 			name: `${device.device_name || 'Untitled'} (${device.uuid.slice(0, 7)})`,
 			value: device.uuid,
 		})),
@@ -368,7 +386,7 @@ export function selectFromList<T>(
 	return getCliForm().ask<T>({
 		message,
 		type: 'list',
-		choices: _.map(choices, (s) => ({
+		choices: choices.map((s) => ({
 			name: s.name,
 			value: s,
 		})),

lib/utils/pine.ts

@@ -16,10 +16,10 @@ limitations under the License.
 
 import type { OptionalNavigationResource } from 'balena-sdk';
 
-export const getExpanded = <T>(obj: OptionalNavigationResource<T>) =>
+export const getExpanded = <T extends {}>(obj: OptionalNavigationResource<T>) =>
 	(Array.isArray(obj) && obj[0]) || undefined;
 
-export const getExpandedProp = <T, K extends keyof T>(
+export const getExpandedProp = <T extends {}, K extends keyof T>(
 	obj: OptionalNavigationResource<T>,
 	key: K,
 ) => (Array.isArray(obj) && obj[0] && obj[0][key]) || undefined;

lib/utils/promote.ts

@@ -163,12 +163,61 @@ async function getOsVersion(deviceIp: string): Promise<string> {
 	return match[1];
 }
 
+const dockerPort = 2375;
+const dockerTimeout = 2000;
+
+async function selectLocalBalenaOsDevice(timeout = 4000): Promise<string> {
+	const { discoverLocalBalenaOsDevices } = await import('../utils/discover');
+	const { SpinnerPromise } = getVisuals();
+	const devices = await new SpinnerPromise({
+		promise: discoverLocalBalenaOsDevices(timeout),
+		startMessage: 'Discovering local balenaOS devices..',
+		stopMessage: 'Reporting discovered devices',
+	});
+
+	const responsiveDevices: typeof devices = [];
+	const Docker = await import('dockerode');
+	await Promise.all(
+		devices.map(async function (device) {
+			const address = device?.address;
+			if (!address) {
+				return;
+			}
+
+			try {
+				const docker = new Docker({
+					host: address,
+					port: dockerPort,
+					timeout: dockerTimeout,
+				});
+				await docker.ping();
+				responsiveDevices.push(device);
+			} catch {
+				return;
+			}
+		}),
+	);
+
+	if (!responsiveDevices.length) {
+		throw new Error('Could not find any local balenaOS devices');
+	}
+
+	return getCliForm().ask({
+		message: 'select a device',
+		type: 'list',
+		default: devices[0].address,
+		choices: responsiveDevices.map((device) => ({
+			name: `${device.host || 'untitled'} (${device.address})`,
+			value: device.address,
+		})),
+	});
+}
+
 async function selectLocalDevice(): Promise<string> {
-	const { forms } = await import('balena-sync');
-	let hostnameOrIp;
 	try {
-		hostnameOrIp = await forms.selectLocalBalenaOsDevice();
+		const hostnameOrIp = await selectLocalBalenaOsDevice();
 		console.error(`==> Selected device: ${hostnameOrIp}`);
+		return hostnameOrIp;
 	} catch (e) {
 		if (e.message.toLowerCase().includes('could not find any')) {
 			throw new ExpectedError(e);
@@ -176,13 +225,11 @@ async function selectLocalDevice(): Promise<string> {
 			throw e;
 		}
 	}
-
-	return hostnameOrIp;
 }
 
 async function selectAppFromList(
-	applications: ApplicationWithDeviceType[],
-): Promise<ApplicationWithDeviceType> {
+	applications: ApplicationWithDeviceTypeSlug[],
+): Promise<ApplicationWithDeviceTypeSlug> {
 	const _ = await import('lodash');
 	const { selectFromList } = await import('../utils/patterns');
 
@@ -200,7 +247,7 @@ async function getOrSelectApplication(
 	sdk: BalenaSdk.BalenaSDK,
 	deviceTypeSlug: string,
 	appName?: string,
-): Promise<ApplicationWithDeviceType> {
+): Promise<ApplicationWithDeviceTypeSlug> {
 	const pineOptions = {
 		$select: 'slug',
 		$expand: {
@@ -208,52 +255,73 @@ async function getOrSelectApplication(
 				$select: 'slug',
 			},
 		},
-	} as const;
-	const [deviceType, allDeviceTypes] = await Promise.all([
-		sdk.models.deviceType.get(deviceTypeSlug, pineOptions) as Promise<
-			BalenaSdk.PineTypedResult<BalenaSdk.DeviceType, typeof pineOptions>
-		>,
-		sdk.models.deviceType.getAllSupported(pineOptions) as Promise<
-			Array<BalenaSdk.PineTypedResult<BalenaSdk.DeviceType, typeof pineOptions>>
-		>,
-	]);
+	} satisfies BalenaSdk.PineOptions<BalenaSdk.DeviceType>;
+	const deviceType = (await sdk.models.deviceType.get(
+		deviceTypeSlug,
+		pineOptions,
+	)) as BalenaSdk.PineTypedResult<BalenaSdk.DeviceType, typeof pineOptions>;
+	const allCpuArches = await sdk.pine.get({
+		resource: 'cpu_architecture',
+		options: {
+			$select: ['id', 'slug'],
+		},
+	});
 
-	const compatibleDeviceTypes = allDeviceTypes
-		.filter((dt) =>
+	const compatibleCpuArchIds = allCpuArches
+		.filter((cpuArch) =>
 			sdk.models.os.isArchitectureCompatibleWith(
 				deviceType.is_of__cpu_architecture[0].slug,
-				dt.is_of__cpu_architecture[0].slug,
+				cpuArch.slug,
 			),
 		)
-		.map((type) => type.slug);
+		.map((cpu) => cpu.id);
 
 	if (!appName) {
-		return createOrSelectApp(sdk, compatibleDeviceTypes, deviceTypeSlug);
+		return createOrSelectApp(
+			sdk,
+			{
+				is_for__device_type: {
+					$any: {
+						$alias: 'dt',
+						$expr: {
+							dt: {
+								is_of__cpu_architecture: { $in: compatibleCpuArchIds },
+							},
+						},
+					},
+				},
+			},
+			deviceTypeSlug,
+		);
 	}
 
-	const options: BalenaSdk.PineOptions<BalenaSdk.Application> = {
+	const options = {
 		$expand: {
-			is_for__device_type: { $select: 'slug' },
+			is_for__device_type: { $select: ['slug', 'is_of__cpu_architecture'] },
 		},
-	};
+	} satisfies BalenaSdk.PineOptions<BalenaSdk.Application>;
 
 	// Check for a fleet slug of the form `user/fleet` and update the API query.
 	let name: string;
 	const match = appName.split('/');
 	if (match.length > 1) {
 		// These will match at most one fleet
-		options.$filter = { slug: appName.toLowerCase() };
+		(options as BalenaSdk.PineOptions<BalenaSdk.Application>).$filter = {
+			slug: appName.toLowerCase(),
+		};
 		name = match[1];
 	} else {
 		// We're given an application; resolve it if it's ambiguous and also validate
 		// it's of appropriate device type.
-		options.$filter = { app_name: appName };
+		(options as BalenaSdk.PineOptions<BalenaSdk.Application>).$filter = {
+			app_name: appName,
+		};
 		name = appName;
 	}
 
 	const applications = (await sdk.models.application.getAllDirectlyAccessible(
 		options,
-	)) as ApplicationWithDeviceType[];
+	)) as Array<BalenaSdk.PineTypedResult<BalenaSdk.Application, typeof options>>;
 
 	if (applications.length === 0) {
 		await confirm(
@@ -268,8 +336,11 @@ async function getOrSelectApplication(
 
 	// We've found at least one fleet with the given name.
 	// Filter out fleets for non-matching device types and see what we're left with.
+	const compatibleCpuArchIdsSet = new Set(compatibleCpuArchIds);
 	const validApplications = applications.filter((app) =>
-		compatibleDeviceTypes.includes(app.is_for__device_type[0].slug),
+		compatibleCpuArchIdsSet.has(
+			app.is_for__device_type[0].is_of__cpu_architecture.__id,
+		),
 	);
 
 	if (validApplications.length === 0) {
@@ -285,21 +356,14 @@ async function getOrSelectApplication(
 
 async function createOrSelectApp(
 	sdk: BalenaSdk.BalenaSDK,
-	compatibleDeviceTypes: string[],
+	compatibleDeviceTypesFilter: BalenaSdk.PineFilter<BalenaSdk.Application>,
 	deviceType: string,
-): Promise<ApplicationWithDeviceType> {
+): Promise<ApplicationWithDeviceTypeSlug> {
 	// No fleet specified, show a list to select one.
 	const applications = (await sdk.models.application.getAllDirectlyAccessible({
 		$expand: { is_for__device_type: { $select: 'slug' } },
-		$filter: {
-			is_for__device_type: {
-				$any: {
-					$alias: 'dt',
-					$expr: { dt: { slug: { $in: compatibleDeviceTypes } } },
-				},
-			},
-		},
-	})) as ApplicationWithDeviceType[];
+		$filter: compatibleDeviceTypesFilter,
+	})) as ApplicationWithDeviceTypeSlug[];
 
 	if (applications.length === 0) {
 		await confirm(
@@ -319,11 +383,14 @@ async function createApplication(
 	sdk: BalenaSdk.BalenaSDK,
 	deviceType: string,
 	name?: string,
-): Promise<ApplicationWithDeviceType> {
+): Promise<ApplicationWithDeviceTypeSlug> {
 	const validation = await import('./validation');
 
-	const username = await sdk.auth.whoami();
-	if (!username) {
+	let username: string;
+	try {
+		const userInfo = await sdk.auth.getUserInfo();
+		username = userInfo.username;
+	} catch (err) {
 		throw new sdk.errors.BalenaNotLoggedIn();
 	}
 
@@ -340,7 +407,7 @@ async function createApplication(
 				try {
 					await sdk.models.application.getDirectlyAccessible(appName, {
 						$filter: {
-							slug: { $startswith: `${username!.toLowerCase()}/` },
+							slug: { $startswith: `${username.toLowerCase()}/` },
 						},
 					});
 					// TODO: This is the only example in the codebase where `printErrorMessage()`
@@ -367,12 +434,12 @@ async function createApplication(
 		$expand: {
 			is_for__device_type: { $select: 'slug' },
 		},
-	})) as ApplicationWithDeviceType;
+	})) as ApplicationWithDeviceTypeSlug;
 }
 
 async function generateApplicationConfig(
 	sdk: BalenaSdk.BalenaSDK,
-	app: ApplicationWithDeviceType,
+	app: ApplicationWithDeviceTypeSlug,
 	options: {
 		version: string;
 		appUpdatePollInterval?: number;
@@ -380,7 +447,7 @@ async function generateApplicationConfig(
 ) {
 	const { generateApplicationConfig: configGen } = await import('./config');
 
-	const manifest = await sdk.models.device.getManifestBySlug(
+	const manifest = await sdk.models.config.getDeviceTypeManifestBySlug(
 		app.is_for__device_type[0].slug,
 	);
 	const opts =

lib/utils/remote-build.ts

@@ -167,7 +167,7 @@ async function handleHeadlessBuildStream(
 	// been started
 	let message: HeadlessBuilderMessage;
 	try {
-		const response = await streamToPromise(stream as NodeJS.ReadWriteStream);
+		const response = await streamToPromise(stream as NodeJS.ReadStream);
 		message = JSON.parse(response.toString());
 	} catch (e) {
 		if (e.code === 'SIGINT') {
@@ -419,7 +419,7 @@ async function getRemoteBuildStream(
 	if (build.opts.headless) {
 		stream = buildRequest;
 	} else {
-		stream = buildRequest.pipe(JSONStream.parse('*'));
+		stream = buildRequest.pipe(JSONStream.parse('*')) as NodeJS.ReadStream;
 	}
 	stream = stream
 		.once('error', () => uploadSpinner.stop())

lib/utils/sdk.ts

@@ -20,8 +20,18 @@ import type {
 	BalenaSDK,
 	Organization,
 	PineOptions,
+	PineTypedResult,
 } from 'balena-sdk';
 
+export async function getApplication(
+	sdk: BalenaSDK,
+	nameOrSlugOrId: string | number,
+): Promise<Application>;
+export async function getApplication<TP extends PineOptions<Application>>(
+	sdk: BalenaSDK,
+	nameOrSlugOrId: string | number,
+	options?: TP,
+): Promise<PineTypedResult<Application, TP>>;
 /**
  * Get a fleet object, disambiguating the fleet identifier which may be a
  * a fleet slug or name.
@@ -29,23 +39,51 @@ import type {
  */
 export async function getApplication(
 	sdk: BalenaSDK,
-	nameOrSlug: string,
+	nameOrSlugOrId: string | number,
 	options?: PineOptions<Application>,
 ): Promise<Application> {
 	const { looksLikeFleetSlug } = await import('./validation');
-	if (!looksLikeFleetSlug(nameOrSlug)) {
+	const whoamiResult = await sdk.auth.whoami();
+	const isDeviceActor = whoamiResult?.actorType === 'device';
+
+	if (isDeviceActor) {
+		const $filterByActor = {
+			$filter: {
+				owns__device: {
+					$any: {
+						$alias: 'd',
+						$expr: {
+							d: {
+								actor: whoamiResult.id,
+							},
+						},
+					},
+				},
+			},
+		};
+		options = options
+			? sdk.utils.mergePineOptions(options, $filterByActor)
+			: $filterByActor;
+	}
+
+	if (
+		typeof nameOrSlugOrId === 'string' &&
+		!looksLikeFleetSlug(nameOrSlugOrId)
+	) {
 		// Not a slug: must be an app name.
 		// TODO: revisit this logic when we add support for fleet UUIDs.
 		return await sdk.models.application.getAppByName(
-			nameOrSlug,
+			nameOrSlugOrId,
 			options,
-			'directly_accessible',
+			isDeviceActor ? undefined : 'directly_accessible',
 		);
 	}
-	return await sdk.models.application.getDirectlyAccessible(
-		nameOrSlug,
-		options,
-	);
+
+	const getFunction = isDeviceActor
+		? sdk.models.application.get
+		: sdk.models.application.getDirectlyAccessible;
+
+	return getFunction(nameOrSlugOrId, options);
 }
 
 /**
@@ -63,31 +101,44 @@ export async function getFleetSlug(
 	if (!looksLikeFleetSlug(nameOrSlug)) {
 		// Not a slug: must be an app name.
 		// TODO: revisit this logic when we add support for fleet UUIDs.
-		return (await getApplication(sdk, nameOrSlug)).slug;
+		return (await getApplication(sdk, nameOrSlug, { $select: 'slug' })).slug;
 	}
 	return nameOrSlug.toLowerCase();
 }
 
+export async function getOwnOrganizations(
+	sdk: BalenaSDK,
+): Promise<Organization[]>;
+export async function getOwnOrganizations<TP extends PineOptions<Organization>>(
+	sdk: BalenaSDK,
+	options: TP,
+): Promise<Array<PineTypedResult<Organization, TP>>>;
 /**
  * Wraps the sdk organization.getAll method,
  * restricting to those orgs user is a member of
  */
 export async function getOwnOrganizations(
 	sdk: BalenaSDK,
+	options?: PineOptions<Organization>,
 ): Promise<Organization[]> {
-	return await sdk.models.organization.getAll({
-		$filter: {
-			organization_membership: {
-				$any: {
-					$alias: 'orm',
-					$expr: {
-						orm: {
-							user: await sdk.auth.getUserId(),
+	return await sdk.models.organization.getAll(
+		sdk.utils.mergePineOptions(
+			{
+				$filter: {
+					organization_membership: {
+						$any: {
+							$alias: 'orm',
+							$expr: {
+								orm: {
+									user: (await sdk.auth.getUserInfo()).id,
+								},
+							},
 						},
 					},
 				},
+				$orderby: 'name asc',
 			},
-		},
-		$orderby: 'name asc',
-	});
+			options,
+		),
+	);
 }

lib/utils/ssh.ts

@@ -151,23 +151,23 @@ export async function runRemoteCommand({
 	let exitCode: number | undefined;
 	let exitSignal: NodeJS.Signals | undefined;
 	try {
-		[exitCode, exitSignal] = await new Promise<[number, NodeJS.Signals]>(
-			(resolve, reject) => {
-				const ps = spawn(program, args, { stdio })
-					.on('error', reject)
-					.on('close', (code, signal) => resolve([code, signal]));
+		[exitCode, exitSignal] = await new Promise((resolve, reject) => {
+			const ps = spawn(program, args, { stdio })
+				.on('error', reject)
+				.on('close', (code, signal) =>
+					resolve([code ?? undefined, signal ?? undefined]),
+				);
 
-				if (ps.stdin && stdin && typeof stdin !== 'string') {
-					stdin.pipe(ps.stdin);
-				}
-				if (ps.stdout && stdout && typeof stdout !== 'string') {
-					ps.stdout.pipe(stdout);
-				}
-				if (ps.stderr && stderr && typeof stderr !== 'string') {
-					ps.stderr.pipe(stderr);
-				}
-			},
-		);
+			if (ps.stdin && stdin && typeof stdin !== 'string') {
+				stdin.pipe(ps.stdin);
+			}
+			if (ps.stdout && stdout && typeof stdout !== 'string') {
+				ps.stdout.pipe(stdout);
+			}
+			if (ps.stderr && stderr && typeof stderr !== 'string') {
+				ps.stderr.pipe(stderr);
+			}
+		});
 	} catch (error) {
 		const msg = [
 			`ssh failed with exit code=${exitCode} signal=${exitSignal}:`,

lib/utils/tunnel.ts

@@ -51,7 +51,7 @@ export const tunnelConnectionToDevice = (
 		sdk.auth.getToken(),
 	]).then(([tunnelUrl, whoami, token]) => {
 		const auth = {
-			user: whoami || 'root',
+			user: whoami?.actorType === 'user' ? whoami.username : 'root',
 			password: token,
 		};
 

lib/utils/update.ts

@@ -19,8 +19,10 @@ import * as UpdateNotifier from 'update-notifier';
 
 import packageJSON = require('../../package.json');
 
-// Check for an update once a day. 1 day granularity should be
-// enough, rather than every run.
+// Check for an update at most once a day. 1 day granularity should be
+// enough, rather than every run. Note because we show the information
+// from the *last* time we ran, if the cli has not been run for a while
+// the update info can be out of date.
 const balenaUpdateInterval = 1000 * 60 * 60 * 24 * 1;
 
 let notifier: UpdateNotifier.UpdateNotifier;

package.json

@@ -1,6 +1,6 @@
 {
   "name": "balena-cli",
-  "version": "14.5.15",
+  "version": "17.1.0",
   "description": "The official balena Command Line Interface",
   "main": "./build/app.js",
   "homepage": "https://github.com/balena-io/balena-cli",
@@ -27,7 +27,6 @@
     "scripts": [
       "build/**/*.js",
       "node_modules/balena-sdk/es2018/index.js",
-      "node_modules/balena-sync/build/**/*.js",
       "node_modules/pinejs-client-request/node_modules/pinejs-client-core/es2018/index.js",
       "node_modules/@balena/compose/dist/parse/schemas/*.json"
     ],
@@ -37,7 +36,6 @@
       "node_modules/balena-sdk/node_modules/balena-pine/**/*",
       "node_modules/balena-pine/**/*",
       "node_modules/pinejs-client-core/**/*",
-      "node_modules/opn/xdg-open",
       "node_modules/open/xdg-open",
       "node_modules/windosu/*.bat",
       "node_modules/windosu/*.cmd",
@@ -90,7 +88,7 @@
   "author": "Balena Inc. (https://balena.io/)",
   "license": "Apache-2.0",
   "engines": {
-    "node": ">=12 <16"
+    "node": ">=18 <20"
   },
   "husky": {
     "hooks": {
@@ -108,13 +106,11 @@
     "macos": {
       "identifier": "io.balena.cli",
       "sign": "Developer ID Installer: Balena Ltd (66H43P8FRG)"
-    },
-    "plugins": [
-      "@oclif/plugin-help"
-    ]
+    }
   },
   "devDependencies": {
-    "@balena/lint": "^6.2.0",
+    "@balena/lint": "^6.2.2",
+    "@electron/notarize": "^2.0.0",
     "@oclif/config": "^1.18.2",
     "@oclif/parser": "^3.8.6",
     "@octokit/plugin-throttling": "^3.5.1",
@@ -133,6 +129,7 @@
     "@types/global-agent": "^2.1.1",
     "@types/global-tunnel-ng": "^2.1.1",
     "@types/http-proxy": "^1.17.8",
+    "@types/inquirer": "^7.3.3",
     "@types/intercept-stdout": "^0.1.0",
     "@types/is-root": "^2.1.2",
     "@types/js-yaml": "^4.0.5",
@@ -146,7 +143,7 @@
     "@types/ndjson": "^2.0.1",
     "@types/net-keepalive": "^0.4.1",
     "@types/nock": "^11.1.0",
-    "@types/node": "^12.20.42",
+    "@types/node": "^18.17.6",
     "@types/node-cleanup": "^2.1.2",
     "@types/parse-link-header": "^1.0.1",
     "@types/prettyjson": "^0.0.30",
@@ -170,7 +167,6 @@
     "cross-env": "^7.0.3",
     "deep-object-diff": "^1.1.0",
     "diff": "^5.0.0",
-    "electron-notarize": "^1.0.0",
     "ent": "^2.2.0",
     "filehound": "^1.17.5",
     "fs-extra": "^9.1.0",
@@ -184,50 +180,49 @@
     "mock-require": "^3.0.3",
     "nock": "^13.2.1",
     "parse-link-header": "^2.0.0",
-    "pkg": "^5.5.1",
+    "pkg": "^5.8.1",
     "publish-release": "^1.6.1",
     "rewire": "^5.0.0",
     "simple-git": "^3.14.1",
     "sinon": "^11.1.2",
     "ts-node": "^10.4.0",
-    "typescript": "^4.6.4"
+    "oclif": "^3.9.1",
+    "typescript": "^5.1.3"
   },
   "dependencies": {
-    "@balena/compose": "^2.1.1",
+    "@balena/compose": "^3.0.2",
     "@balena/dockerignore": "^1.0.2",
     "@balena/es-version": "^1.0.1",
     "@oclif/command": "^1.8.16",
+    "@oclif/core": "^2.15.0",
     "@resin.io/valid-email": "^0.1.0",
     "@sentry/node": "^6.16.1",
     "@types/fast-levenshtein": "0.0.1",
     "@types/update-notifier": "^4.1.1",
-    "JSONStream": "^1.0.3",
     "balena-config-json": "^4.2.0",
     "balena-device-init": "^6.0.0",
-    "balena-errors": "^4.7.1",
+    "balena-errors": "^4.7.3",
     "balena-image-fs": "^7.0.6",
-    "balena-image-manager": "^8.0.0",
-    "balena-preload": "^12.2.0",
-    "balena-sdk": "^16.28.0",
+    "balena-image-manager": "^9.0.2",
+    "balena-preload": "^14.0.2",
+    "balena-sdk": "^18.0.0",
     "balena-semver": "^2.3.0",
-    "balena-settings-client": "^4.0.7",
-    "balena-settings-storage": "^7.0.0",
-    "balena-sync": "^11.0.2",
+    "balena-settings-client": "^5.0.2",
+    "balena-settings-storage": "^8.1.0",
     "bluebird": "^3.7.2",
     "body-parser": "^1.19.1",
     "chalk": "^3.0.0",
     "chokidar": "^3.5.2",
     "cli-truncate": "^2.1.0",
-    "cli-ux": "^5.5.1",
     "color-hash": "^1.1.1",
     "columnify": "^1.5.2",
     "common-tags": "^1.7.2",
     "denymount": "^2.3.0",
     "docker-modem": "3.0.0",
     "docker-progress": "^5.1.3",
-    "dockerode": "^3.3.1",
+    "dockerode": "3.3.3",
     "ejs": "^3.1.6",
-    "etcher-sdk": "^6.2.1",
+    "etcher-sdk": "^8.5.3",
     "event-stream": "3.3.4",
     "express": "^4.17.2",
     "fast-boot2": "^1.1.0",
@@ -243,6 +238,7 @@
     "is-elevated": "^3.0.0",
     "is-root": "^2.1.0",
     "js-yaml": "^4.1.0",
+    "JSONStream": "^1.0.3",
     "klaw": "^3.0.0",
     "livepush": "^3.5.1",
     "lodash": "^4.17.21",
@@ -253,7 +249,6 @@
     "net-keepalive": "^3.0.0",
     "node-cleanup": "^2.1.2",
     "node-unzip-2": "^0.2.8",
-    "oclif": "^1.18.4",
     "open": "^7.1.0",
     "patch-package": "^6.4.7",
     "prettyjson": "^1.2.5",
@@ -261,7 +256,8 @@
     "reconfix": "^1.0.0-v0-1-0-fork-46760acff4d165f5238bfac5e464256ef1944476",
     "request": "^2.88.2",
     "resin-cli-form": "^2.0.2",
-    "resin-cli-visuals": "^1.8.0",
+    "resin-cli-visuals": "^1.8.3",
+    "resin-discoverable-services": "^2.0.4",
     "resin-doodles": "^0.2.0",
     "resin-stream-logger": "^0.1.2",
     "rimraf": "^3.0.2",
@@ -284,6 +280,6 @@
     "windosu": "^0.3.0"
   },
   "versionist": {
-    "publishedAt": "2022-12-12T13:41:12.779Z"
+    "publishedAt": "2023-09-05T13:00:58.291Z"
   }
 }

patches/all/@oclif+core+2.15.0.patch

@@ -0,0 +1,49 @@
+diff --git a/node_modules/@oclif/core/lib/help/command.js b/node_modules/@oclif/core/lib/help/command.js
+index 6de139b..3a13197 100644
+--- a/node_modules/@oclif/core/lib/help/command.js
++++ b/node_modules/@oclif/core/lib/help/command.js
+@@ -206,7 +206,7 @@ class CommandHelp extends formatter_1.HelpFormatter {
+         if (args.filter(a => a.description).length === 0)
+             return;
+         return args.map(a => {
+-            const name = a.name.toUpperCase();
++            const name = a.required ? `<${a.name}>` : `[${a.name}]`;
+             let description = a.description || '';
+             if (a.default)
+                 description = `[default: ${a.default}] ${description}`;
+@@ -238,14 +238,12 @@ class CommandHelp extends formatter_1.HelpFormatter {
+             label = labels.join(', ');
+         }
+         if (flag.type === 'option') {
+-            let value = flag.helpValue || (this.opts.showFlagNameInTitle ? flag.name : '<value>');
++            let value = flag.helpValue || (this.opts.showFlagNameInTitle ? flag.name : `<${flag.name}>`);
+             if (!flag.helpValue && flag.options) {
+                 value = showOptions || this.opts.showFlagOptionsInTitle ? `${flag.options.join('|')}` : '<option>';
+             }
+             if (flag.multiple)
+-                value += '...';
+-            if (!value.includes('|'))
+-                value = underline(value);
++                value += ' ...';
+             label += `=${value}`;
+         }
+         return label;
+diff --git a/node_modules/@oclif/core/lib/help/index.js b/node_modules/@oclif/core/lib/help/index.js
+index f9ef7cc..a14c67c 100644
+--- a/node_modules/@oclif/core/lib/help/index.js
++++ b/node_modules/@oclif/core/lib/help/index.js
+@@ -136,11 +136,12 @@ class Help extends HelpBase {
+         }
+         this.log(this.formatCommand(command));
+         this.log('');
+-        if (subTopics.length > 0) {
++        const SUPPRESS_SUBTOPICS = true;
++        if (subTopics.length > 0 && !SUPPRESS_SUBTOPICS) {
+             this.log(this.formatTopics(subTopics));
+             this.log('');
+         }
+-        if (subCommands.length > 0) {
++        if (subCommands.length > 0 && !SUPPRESS_SUBTOPICS) {
+             const aliases = [];
+             const uniqueSubCommands = subCommands.filter(p => {
+                 aliases.push(...p.aliases);

patches/all/@oclif+parser+3.8.17.patch

@@ -1,24 +1,24 @@
 diff --git a/node_modules/@oclif/parser/lib/errors.js b/node_modules/@oclif/parser/lib/errors.js
-index 0c93a81..95d06be 100644
+index 39936e3..23e3925 100644
 --- a/node_modules/@oclif/parser/lib/errors.js
 +++ b/node_modules/@oclif/parser/lib/errors.js
-@@ -13,7 +13,8 @@ const m = deps_1.default()
+@@ -14,7 +14,8 @@ const m = deps_1.default()
      .add('list', () => require('./list'));
  class CLIParseError extends errors_1.CLIError {
      constructor(options) {
 -        options.message += '\nSee more help with --help';
-+        const help = options.command ? `\`${options.command} --help\`` : '--help';
-+        options.message += `\nSee more help with ${help}`;
++    		const help = options.command ? `\`${options.command} --help\`` : '--help';
++    		options.message += `\nSee more help with ${help}`;
          super(options.message);
          this.parse = options.parse;
      }
-@@ -34,22 +35,24 @@ class InvalidArgsSpecError extends CLIParseError {
+@@ -35,22 +36,24 @@ class InvalidArgsSpecError extends CLIParseError {
  exports.InvalidArgsSpecError = InvalidArgsSpecError;
  class RequiredArgsError extends CLIParseError {
      constructor({ args, parse }) {
 -        let message = `Missing ${args.length} required arg${args.length === 1 ? '' : 's'}`;
-+        const command = 'balena ' + parse.input.context.id.replace(/:/g, ' ');
-+        let message = `Missing ${args.length} required argument${args.length === 1 ? '' : 's'}`;
++    		const command = 'balena ' + parse.input.context.id.replace(/:/g, ' ');
++    		let message = `Missing ${args.length} required argument${args.length === 1 ? '' : 's'}`;
          const namedArgs = args.filter(a => a.name);
          if (namedArgs.length > 0) {
              const list = m.list.renderList(namedArgs.map(a => [a.name, a.description]));
@@ -32,7 +32,7 @@ index 0c93a81..95d06be 100644
  exports.RequiredArgsError = RequiredArgsError;
  class RequiredFlagError extends CLIParseError {
      constructor({ flag, parse }) {
-+        const command = 'balena ' + parse.input.context.id.replace(/:/g, ' ');
++    		const command = 'balena ' + parse.input.context.id.replace(/:/g, ' ');
          const usage = m.list.renderList(m.help.flagUsages([flag], { displayRequired: false }));
          const message = `Missing required flag:\n${usage}`;
 -        super({ parse, message });
@@ -41,15 +41,15 @@ index 0c93a81..95d06be 100644
      }
  }
 diff --git a/node_modules/@oclif/parser/lib/list.js b/node_modules/@oclif/parser/lib/list.js
-index 3907cc0..b689ca1 100644
+index 9d020b7..6ea9eb9 100644
 --- a/node_modules/@oclif/parser/lib/list.js
 +++ b/node_modules/@oclif/parser/lib/list.js
-@@ -21,7 +21,7 @@ function renderList(items) {
+@@ -22,7 +22,7 @@ function renderList(items) {
          }
          left = left.padEnd(maxLength);
          right = linewrap(maxLength + 2, right);
 -        return `${left}  ${right}`;
-+        return `${left} : ${right}`;
++  			return `${left} : ${right}`;
      });
      return lines.join('\n');
  }

patches/all/@oclif+plugin-help+3.2.15.patch

@@ -1,43 +0,0 @@
-diff --git a/node_modules/@oclif/plugin-help/lib/command.js b/node_modules/@oclif/plugin-help/lib/command.js
-index b3b9010..788e5c6 100644
---- a/node_modules/@oclif/plugin-help/lib/command.js
-+++ b/node_modules/@oclif/plugin-help/lib/command.js
-@@ -88,7 +88,7 @@ class CommandHelp {
-             return;
-         const body = list_1.renderList(args.map(a => {
-             var _a;
--            const name = a.name.toUpperCase();
-+            const name = a.required ? `<${a.name}>` : `[${a.name}]`;
-             let description = a.description || '';
-             // `a.default` is actually not always a string (typing bug), hence `toString()`
-             if (a.default || ((_a = a.default) === null || _a === void 0 ? void 0 : _a.toString()) === '0')
-@@ -133,9 +133,7 @@ class CommandHelp {
-                 if (!flag.helpValue && flag.options) {
-                     value = flag.options.join('|');
-                 }
--                if (!value.includes('|'))
--                    value = underline(value);
--                left += `=${value}`;
-+                left += ` <${value}>`;
-             }
-             let right = flag.description || '';
-             // `flag.default` is not always a string (typing bug), hence `toString()`
-diff --git a/node_modules/@oclif/plugin-help/lib/index.js b/node_modules/@oclif/plugin-help/lib/index.js
-index 04d7861..c2fb591 100644
---- a/node_modules/@oclif/plugin-help/lib/index.js
-+++ b/node_modules/@oclif/plugin-help/lib/index.js
-@@ -98,11 +98,12 @@ class Help extends HelpBase {
-             console.log(title + '\n');
-         console.log(this.formatCommand(command));
-         console.log('');
--        if (subTopics.length > 0) {
-+        const SUPPRESS_SUBTOPICS = true;
-+        if (subTopics.length > 0 && !SUPPRESS_SUBTOPICS) {
-             console.log(this.formatTopics(subTopics));
-             console.log('');
-         }
--        if (subCommands.length > 0) {
-+        if (subCommands.length > 0 && !SUPPRESS_SUBTOPICS) {
-             console.log(this.formatCommands(subCommands));
-             console.log('');
-         }

patches/all/oclif+1.18.4.patch

@@ -1,278 +0,0 @@
-diff --git a/node_modules/oclif/lib/commands/pack/macos.js b/node_modules/oclif/lib/commands/pack/macos.js
-index 924f092..a69e60b 100644
---- a/node_modules/oclif/lib/commands/pack/macos.js
-+++ b/node_modules/oclif/lib/commands/pack/macos.js
-@@ -133,6 +133,7 @@ class PackMacos extends command_1.Command {
-         if (process.env.OSX_KEYCHAIN)
-             args.push('--keychain', process.env.OSX_KEYCHAIN);
-         args.push(dist);
-+        console.error(`[debug] oclif pkgbuild "${args.join('" "')}"`);
-         await qq.x('pkgbuild', args);
-     }
- }
-diff --git a/node_modules/oclif/lib/commands/pack/win.js b/node_modules/oclif/lib/commands/pack/win.js
-index bf4657e..fd58c7d 100644
---- a/node_modules/oclif/lib/commands/pack/win.js
-+++ b/node_modules/oclif/lib/commands/pack/win.js
-@@ -52,6 +52,13 @@ VIAddVersionKey /LANG=\${LANG_ENGLISH} "ProductVersion" "\${VERSION}.0"
- InstallDir "\$PROGRAMFILES${arch === 'x64' ? '64' : ''}\\${config.dirname}"
- 
- Section "${config.name} CLI \${VERSION}"
-+  ; First remove any old client files.
-+  ; (Remnants of old versions were causing CLI errors)
-+  ; Initially tried running the Uninstall.exe, but was
-+  ; unable to make script wait for completion (despite using _?)
-+  DetailPrint "Removing files from previous version."
-+  RMDir /r "$INSTDIR\\client"
-+
-   SetOutPath $INSTDIR
-   File /r bin
-   File /r client
-@@ -61,6 +68,8 @@ Section "${config.name} CLI \${VERSION}"
-   WriteUninstaller "$INSTDIR\\Uninstall.exe"
-   WriteRegStr HKLM "Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\${config.dirname}" \\
-                    "DisplayName" "${config.name}"
-+  WriteRegStr HKLM "Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\${config.dirname}" \\
-+                   "DisplayVersion" "\${VERSION}"
-   WriteRegStr HKLM "Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\${config.dirname}" \\
-                    "UninstallString" "$\\"$INSTDIR\\uninstall.exe$\\""
-   WriteRegStr HKLM "Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\${config.dirname}" \\
-@@ -193,7 +202,8 @@ class PackWin extends command_1.Command {
-     async run() {
-         await this.checkForNSIS();
-         const { flags } = this.parse(PackWin);
--        const buildConfig = await Tarballs.buildConfig(flags.root);
-+        const $targets = flags.targets ? flags.targets.split(',') : undefined;
-+        const buildConfig = await Tarballs.buildConfig(flags.root, { targets: $targets });
-         const { config, version, gitSha, targets, tmp } = buildConfig;
-         await Tarballs.build(buildConfig, { platform: 'win32', pack: false });
-         const arches = targets.filter(t => t.platform === 'win32').map(t => t.arch);
-@@ -208,7 +218,8 @@ class PackWin extends command_1.Command {
-             // eslint-disable-next-line no-await-in-loop
-             await qq.mv(buildConfig.workspace({ platform: 'win32', arch }), [installerBase, 'client']);
-             // eslint-disable-next-line no-await-in-loop
--            await qq.x(`makensis ${installerBase}/${config.bin}.nsi | grep -v "\\[compress\\]" | grep -v "^File: Descending to"`);
-+            const { msysExec, toMsysPath } = require("../../util");
-+            await msysExec(`makensis ${toMsysPath(installerBase)}/${config.bin}.nsi | grep -v "\\[compress\\]" | grep -v "^File: Descending to"`);
-             const templateKey = upload_util_1.templateShortKey('win32', { bin: config.bin, version: version, sha: gitSha, arch });
-             const o = buildConfig.dist(`win32/${templateKey}`);
-             // eslint-disable-next-line no-await-in-loop
-@@ -255,4 +266,5 @@ PackWin.hidden = true;
- PackWin.description = 'create windows installer from oclif CLI';
- PackWin.flags = {
-     root: command_1.flags.string({ char: 'r', description: 'path to oclif CLI root', default: '.', required: true }),
-+    targets: command_1.flags.string({char: 't', description: 'comma-separated targets to pack (e.g.: win32-x86,win32-x64)'}),
- };
-diff --git a/node_modules/oclif/lib/tarballs/build.js b/node_modules/oclif/lib/tarballs/build.js
-index d3e8e89..a5d29e2 100644
---- a/node_modules/oclif/lib/tarballs/build.js
-+++ b/node_modules/oclif/lib/tarballs/build.js
-@@ -18,8 +18,9 @@ const pack = async (from, to) => {
-     qq.cd(prevCwd);
- };
- async function build(c, options = {}) {
--    const { xz, config, version, s3Config, gitSha, nodeVersion, targets, updateConfig } = c;
-+    const { xz, config, version, s3Config, gitSha, nodeVersion, targets, updateConfig, tmp } = c;
-     const prevCwd = qq.cwd();
-+    console.error(`[debug] oclif cwd="${prevCwd}"\n c.root="${c.root}" c.workspace()="${c.workspace()}"`);
-     const packCLI = async () => {
-         const stdout = await qq.x.stdout('npm', ['pack', '--unsafe-perm'], { cwd: c.root });
-         return path.join(c.root, stdout.split('\n').pop());
-@@ -30,11 +31,19 @@ async function build(c, options = {}) {
-         tarball = path.basename(tarball);
-         tarball = qq.join([c.workspace(), tarball]);
-         qq.cd(c.workspace());
--        await qq.x(`tar -xzf ${tarball}`);
-+        const { msysExec, toMsysPath } = require("../util");
-+        await msysExec(`tar -xzf ${toMsysPath(tarball)}`);
-         // eslint-disable-next-line no-await-in-loop
-         for (const f of await qq.ls('package', { fullpath: true }))
-             await qq.mv(f, '.');
-         await qq.rm('package', tarball, 'bin/run.cmd');
-+        // rename the original balena-cli ./bin/balena entry point for oclif compatibility
-+        await qq.mv('bin/balena', 'bin/run');
-+        // The oclif installers are a production installation, while the source
-+        // `bin` folder may contain a `.fast-boot.json` file of a dev installation.
-+        // This has previously led to issues preventing the CLI from starting, so
-+        // delete `.fast-boot.json` (if any) from the destination folder.
-+        await qq.rm('bin/.fast-boot.json');
-     };
-     const updatePJSON = async () => {
-         qq.cd(c.workspace());
-@@ -46,21 +55,21 @@ async function build(c, options = {}) {
-         await qq.writeJSON('package.json', pjson);
-     };
-     const addDependencies = async () => {
--        qq.cd(c.workspace());
--        const yarnRoot = findYarnWorkspaceRoot(c.root) || c.root;
--        const yarn = await qq.exists([yarnRoot, 'yarn.lock']);
--        if (yarn) {
--            await qq.cp([yarnRoot, 'yarn.lock'], '.');
--            await qq.x('yarn --no-progress --production --non-interactive');
--        }
--        else {
--            let lockpath = qq.join(c.root, 'package-lock.json');
--            if (!await qq.exists(lockpath)) {
--                lockpath = qq.join(c.root, 'npm-shrinkwrap.json');
--            }
--            await qq.cp(lockpath, '.');
--            await qq.x('npm install --production');
-+        const ws = c.workspace();
-+        qq.cd(ws);
-+        console.error(`[debug] oclif copying node_modules to "${ws}"`)
-+        const source = path.join(c.root, 'node_modules');
-+        if (process.platform === 'win32') {
-+            // xcopy is much faster than `qq.cp(source, ws)`
-+            await qq.x(`xcopy "${source}" "${ws}\\node_modules" /S /E /B /I /K /Q /Y`);
-+        } else {
-+            // use the shell's `cp` on macOS in order to preserve extended
-+            // file attributes containing `codesign` digital signatures
-+            await qq.x(`cp -pR "${source}" "${ws}"`);
-         }
-+        console.error(`[debug] oclif running "npm prune --production" in "${ws}"`);
-+        await qq.x('npm prune --production');
-+        console.error(`[debug] oclif done`);
-     };
-     const pretarball = async () => {
-         qq.cd(c.workspace());
-@@ -99,7 +108,8 @@ async function build(c, options = {}) {
-             output: path.join(workspace, 'bin', 'node'),
-             platform: target.platform,
-             arch: target.arch,
--            tmp: qq.join(config.root, 'tmp'),
-+            tmp,
-+            projectRootPath: c.root,
-         });
-         if (options.pack === false)
-             return;
-diff --git a/node_modules/oclif/lib/tarballs/config.js b/node_modules/oclif/lib/tarballs/config.js
-index 0dc3cd7..1336219 100644
---- a/node_modules/oclif/lib/tarballs/config.js
-+++ b/node_modules/oclif/lib/tarballs/config.js
-@@ -18,7 +18,10 @@ function gitSha(cwd, options = {}) {
- }
- exports.gitSha = gitSha;
- async function Tmp(config) {
--    const tmp = path.join(config.root, 'tmp');
-+    const tmp = process.env.BUILD_TMP
-+        ? path.join(process.env.BUILD_TMP, 'oclif')
-+        : path.join(config.root, 'tmp');
-+    console.error(`[debug] oclif tmp="${tmp}"`);
-     await qq.mkdirp(tmp);
-     return tmp;
- }
-@@ -43,7 +46,7 @@ async function buildConfig(root, options = {}) {
-         s3Config: updateConfig.s3,
-         nodeVersion: updateConfig.node.version || process.versions.node,
-         workspace(target) {
--            const base = qq.join(config.root, 'tmp');
-+            const base = tmp;
-             if (target && target.platform)
-                 return qq.join(base, [target.platform, target.arch].join('-'), upload_util_1.templateShortKey('baseDir', { bin: config.bin }));
-             return qq.join(base, upload_util_1.templateShortKey('baseDir', { bin: config.bin }));
-diff --git a/node_modules/oclif/lib/tarballs/node.js b/node_modules/oclif/lib/tarballs/node.js
-index fabe5c4..e32dd76 100644
---- a/node_modules/oclif/lib/tarballs/node.js
-+++ b/node_modules/oclif/lib/tarballs/node.js
-@@ -4,9 +4,10 @@ const errors_1 = require("@oclif/errors");
- const path = require("path");
- const qq = require("qqjs");
- const log_1 = require("../log");
-+const { isMSYS2, msysExec, toMsysPath } = require("../util");
- async function checkFor7Zip() {
-     try {
--        await qq.x('7z', { stdio: [0, null, 2] });
-+        await msysExec('7z', { stdio: [0, null, 2] });
-     }
-     catch (error) {
-         if (error.code === 127)
-@@ -41,7 +42,8 @@ async function fetchNodeBinary({ nodeVersion, output, platform, arch, tmp }) {
-         const basedir = path.dirname(tarball);
-         await qq.mkdirp(basedir);
-         await qq.download(url, tarball);
--        await qq.x(`grep ${path.basename(tarball)} ${shasums} | shasum -a 256 -c -`, { cwd: basedir });
-+        const shaCmd = isMSYS2 ? 'sha256sum -c -' : 'shasum -a 256 -c -';
-+        await msysExec(`grep ${path.basename(tarball)} ${toMsysPath(shasums)} | ${shaCmd}`, { cwd: basedir });
-     };
-     const extract = async () => {
-         log_1.log(`extracting ${nodeBase}`);
-@@ -51,7 +53,7 @@ async function fetchNodeBinary({ nodeVersion, output, platform, arch, tmp }) {
-         await qq.mkdirp(path.dirname(cache));
-         if (platform === 'win32') {
-             qq.pushd(nodeTmp);
--            await qq.x(`7z x -bd -y ${tarball} > /dev/null`);
-+            await msysExec(`7z x -bd -y ${toMsysPath(tarball)} > /dev/null`);
-             await qq.mv([nodeBase, 'node.exe'], cache);
-             qq.popd();
-         }
-diff --git a/node_modules/oclif/lib/upload-util.js b/node_modules/oclif/lib/upload-util.js
-index 45392cb..3c806c7 100644
---- a/node_modules/oclif/lib/upload-util.js
-+++ b/node_modules/oclif/lib/upload-util.js
-@@ -28,10 +28,10 @@ function templateShortKey(type, ext, options = { root: '.' }) {
-     const templates = {
-         baseDir: '<%- bin %>',
-         unversioned: '<%- bin %>-<%- platform %>-<%- arch %><%- ext %>',
--        versioned: '<%- bin %>-v<%- version %>-<%- sha %>-<%- platform %>-<%- arch %><%- ext %>',
--        manifest: '<%- bin %>-v<%- version %>-<%- sha %>-<%- platform %>-<%- arch %>-buildmanifest',
--        macos: '<%- bin %>-v<%- version %>-<%- sha %>.pkg',
--        win32: '<%- bin %>-v<%- version %>-<%- sha %>-<%- arch %>.exe',
-+        versioned: '<%- bin %>-v<%- version %>-<%- platform %>-<%- arch %><%- ext %>',
-+        manifest: '<%- bin %>-v<%- version %>-<%- platform %>-<%- arch %>-buildmanifest',
-+        macos: '<%- bin %>-v<%- version %>.pkg',
-+        win32: '<%- bin %>-v<%- version %>-<%- arch %>.exe',
-         deb: '<%- bin %>_<%- versionShaRevision %>_<%- arch %>.deb',
-     };
-     return _.template(templates[type])(Object.assign({}, options));
-diff --git a/node_modules/oclif/lib/util.js b/node_modules/oclif/lib/util.js
-index 17748ad..4928fc9 100644
---- a/node_modules/oclif/lib/util.js
-+++ b/node_modules/oclif/lib/util.js
-@@ -67,3 +67,47 @@ exports.sortVersionsObjectByKeysDesc = (input) => {
-     }
-     return result;
- };
-+
-+// OSTYPE is 'msys' for MSYS 1.0 and for MSYS2, or 'cygwin' for Cygwin
-+// but note that OSTYPE is not "exported" by default, so run: export OSTYPE=$OSTYPE
-+// MSYSTEM is 'MINGW32' for MSYS 1.0, 'MSYS' for MSYS2, and undefined for Cygwin
-+const isCygwin = process.env.OSTYPE === 'cygwin';
-+const isMinGW = process.env.MSYSTEM && process.env.MSYSTEM.startsWith('MINGW');
-+const isMSYS2 = process.env.MSYSTEM && process.env.MSYSTEM.startsWith('MSYS');
-+const MSYSSHELLPATH = process.env.MSYSSHELLPATH ||
-+    (isMSYS2 ? 'C:\\msys64\\usr\\bin\\bash.exe' :
-+        (isMinGW ? 'C:\\MinGW\\msys\\1.0\\bin\\bash.exe' :
-+            (isCygwin ? 'C:\\cygwin64\\bin\\bash.exe' : '/bin/sh')));
-+
-+exports.isCygwin = isCygwin;
-+exports.isMinGW = isMinGW;
-+exports.isMSYS2 = isMSYS2;
-+console.error(`[debug] oclif MSYSSHELLPATH=${MSYSSHELLPATH} MSYSTEM=${process.env.MSYSTEM} OSTYPE=${process.env.OSTYPE} isMSYS2=${isMSYS2} isMingGW=${isMinGW} isCygwin=${isCygwin}`);
-+
-+const qq = require("qqjs");
-+
-+/* Convert a Windows path like 'C:\tmp' to a MSYS path like '/c/tmp' */
-+function toMsysPath(windowsPath) {
-+    // 'c:\myfolder' -> '/c/myfolder' or '/cygdrive/c/myfolder'
-+    let msysPath = windowsPath.replace(/\\/g, '/');
-+    if (isMSYS2 || isMinGW) {
-+        msysPath = msysPath.replace(/^([a-zA-Z]):/, '/$1');
-+    } else if (isCygwin) {
-+        msysPath = msysPath.replace(/^([a-zA-Z]):/, '/cygdrive/$1');
-+    }
-+    console.error(`[debug] oclif toMsysPath before="${windowsPath}" after="${msysPath}"`);
-+    return msysPath;
-+}
-+exports.toMsysPath = toMsysPath;
-+
-+/* Like qqjs qq.x(), but using MSYS bash on Windows instead of cmd.exe */
-+async function msysExec(cmd, options = {}) {
-+    if (process.platform !== 'win32') {
-+        return qq.x(cmd, options);
-+    }
-+    const sh = MSYSSHELLPATH;
-+    const args = ['-c', cmd];
-+    console.error(`[debug] oclif msysExec sh="${sh}" args=${JSON.stringify(args)} options=${JSON.stringify(options)}`);
-+    return qq.x(sh, args, options);
-+}
-+exports.msysExec = msysExec;

patches/all/oclif+3.11.3.patch

@@ -0,0 +1,307 @@
+diff --git a/node_modules/oclif/lib/commands/pack/macos.js b/node_modules/oclif/lib/commands/pack/macos.js
+index d06d0b3..c571fe3 100644
+--- a/node_modules/oclif/lib/commands/pack/macos.js
++++ b/node_modules/oclif/lib/commands/pack/macos.js
+@@ -177,7 +177,8 @@ class PackMacos extends core_1.Command {
+             if (process.env.OSX_KEYCHAIN)
+                 args.push('--keychain', process.env.OSX_KEYCHAIN);
+             args.push(dist);
+-            await exec(`pkgbuild  ${args.join(' ')}`);
++            console.error(`[debug] oclif pkgbuild "${args.join('" "')}"`);
++            await exec(`pkgbuild  "${args.join('" "')}"`);
+         };
+         const arches = _.uniq(buildConfig.targets
+             .filter(t => t.platform === 'darwin')
+diff --git a/node_modules/oclif/lib/commands/pack/win.js b/node_modules/oclif/lib/commands/pack/win.js
+index 360c34b..ae14bf5 100644
+--- a/node_modules/oclif/lib/commands/pack/win.js
++++ b/node_modules/oclif/lib/commands/pack/win.js
+@@ -59,6 +59,13 @@ InstallDir "\$PROGRAMFILES${arch === 'x64' ? '64' : ''}\\${config.dirname}"
+ ${customization}
+ 
+ Section "${config.name} CLI \${VERSION}"
++  ; First remove any old client files.
++  ; (Remnants of old versions were causing CLI errors)
++  ; Initially tried running the Uninstall.exe, but was
++  ; unable to make script wait for completion (despite using _?)
++  DetailPrint "Removing files from previous version."
++  RMDir /r "$INSTDIR\\client"
++
+   SetOutPath $INSTDIR
+   File /r bin
+   File /r client
+@@ -203,7 +210,8 @@ class PackWin extends core_1.Command {
+     async run() {
+         await this.checkForNSIS();
+         const { flags } = await this.parse(PackWin);
+-        const buildConfig = await Tarballs.buildConfig(flags.root);
++        const $targets = flags.targets ? flags.targets.split(',') : undefined;
++        const buildConfig = await Tarballs.buildConfig(flags.root, { targets: $targets });
+         const { config } = buildConfig;
+         await Tarballs.build(buildConfig, { platform: 'win32', pack: false, tarball: flags.tarball, parallel: true });
+         const arches = buildConfig.targets.filter(t => t.platform === 'win32').map(t => t.arch);
+@@ -225,7 +233,8 @@ class PackWin extends core_1.Command {
+                 fs.writeFile(path.join(installerBase, 'bin', `${flags['additional-cli']}`), scripts.sh({ bin: flags['additional-cli'] })),
+             ] : []));
+             await fs.move(buildConfig.workspace({ platform: 'win32', arch }), path.join(installerBase, 'client'));
+-            await exec(`makensis ${installerBase}/${config.bin}.nsi | grep -v "\\[compress\\]" | grep -v "^File: Descending to"`);
++            const { msysExec, toMsysPath } = require("../../util");
++            await msysExec(`makensis ${toMsysPath(installerBase)}/${config.bin}.nsi | grep -v "\\[compress\\]" | grep -v "^File: Descending to"`);
+             const templateKey = (0, upload_util_1.templateShortKey)('win32', { bin: config.bin, version: config.version, sha: buildConfig.gitSha, arch });
+             const o = buildConfig.dist(`win32/${templateKey}`);
+             await fs.move(path.join(installerBase, 'installer.exe'), o);
+@@ -263,6 +272,9 @@ PackWin.flags = {
+         default: '.',
+         required: true,
+     }),
++    targets: core_1.Flags.string({
++        description: 'comma-separated targets to pack (e.g.: win32-x86,win32-x64)'
++    }),
+     'additional-cli': core_1.Flags.string({
+         description: `an Oclif CLI other than the one listed in config.bin that should be made available to the user
+ the CLI should already exist in a directory named after the CLI that is the root of the tarball produced by "oclif pack:tarballs"`,
+diff --git a/node_modules/oclif/lib/tarballs/build.js b/node_modules/oclif/lib/tarballs/build.js
+index 384ea4b..41963eb 100644
+--- a/node_modules/oclif/lib/tarballs/build.js
++++ b/node_modules/oclif/lib/tarballs/build.js
+@@ -21,8 +21,10 @@ const pack = async (from, to) => {
+         await exec(`tar cfJ ${to} ${(path.basename(from))}`, { cwd }));
+ };
+ async function build(c, options = {}) {
+-    const { xz, config } = c;
++    const { xz, config, tmp } = c;
++    console.error(`[debug] oclif c.root="${c.root}" c.workspace()="${c.workspace()}"`);
+     const packCLI = async () => {
++        console.error('[debug] packing cli');
+         const { stdout } = await exec('npm pack --unsafe-perm', { cwd: c.root });
+         return path.join(c.root, stdout.trim().split('\n').pop());
+     };
+@@ -30,7 +32,8 @@ async function build(c, options = {}) {
+         await fs.emptyDir(c.workspace());
+         const tarballNewLocation = path.join(c.workspace(), path.basename(tarball));
+         await fs.move(tarball, tarballNewLocation);
+-        await exec(`tar -xzf "${tarballNewLocation}"`, { cwd: c.workspace() });
++        const { msysExec, toMsysPath } = require("../util");
++        await msysExec(`tar -xzf ${toMsysPath(tarballNewLocation)}`, { cwd: c.workspace() });
+         await Promise.all((await fs.promises.readdir(path.join(c.workspace(), 'package'), { withFileTypes: true }))
+             .map(i => fs.move(path.join(c.workspace(), 'package', i.name), path.join(c.workspace(), i.name))));
+         await Promise.all([
+@@ -38,6 +41,13 @@ async function build(c, options = {}) {
+             fs.promises.rm(path.join(c.workspace(), path.basename(tarball)), { recursive: true }),
+             fs.remove(path.join(c.workspace(), 'bin', 'run.cmd')),
+         ]);
++        // rename the original balena-cli ./bin/balena entry point for oclif compatibility
++        await fs.move(path.join(c.workspace(), 'bin', 'balena'), path.join(c.workspace(), 'bin', 'run'));
++        // The oclif installers are a production installation, while the source
++        // `bin` folder may contain a `.fast-boot.json` file of a dev installation.
++        // This has previously led to issues preventing the CLI from starting, so
++        // delete `.fast-boot.json` (if any) from the destination folder.
++        await fs.promises.rm(path.join(c.workspace(), 'bin', '.fast-boot.json'));
+     };
+     const updatePJSON = async () => {
+         const pjsonPath = path.join(c.workspace(), 'package.json');
+@@ -49,35 +59,20 @@ async function build(c, options = {}) {
+         await fs.writeJSON(pjsonPath, pjson, { spaces: 2 });
+     };
+     const addDependencies = async () => {
+-        const yarnRoot = findYarnWorkspaceRoot(c.root) || c.root;
+-        if (fs.existsSync(path.join(yarnRoot, 'yarn.lock'))) {
+-            await fs.copy(path.join(yarnRoot, 'yarn.lock'), path.join(c.workspace(), 'yarn.lock'));
+-            const yarnVersion = (await exec('yarn -v')).stdout.charAt(0);
+-            if (yarnVersion === '1') {
+-                await exec('yarn --no-progress --production --non-interactive', { cwd: c.workspace() });
+-            }
+-            else if (yarnVersion === '2') {
+-                throw new Error('Yarn 2 is not supported yet. Try using Yarn 1, or Yarn 3');
+-            }
+-            else {
+-                try {
+-                    await exec('yarn workspaces focus --production', { cwd: c.workspace() });
+-                }
+-                catch (error) {
+-                    if (error instanceof Error && error.message.includes('Command not found')) {
+-                        throw new Error('Missing workspace tools. Run `yarn plugin import workspace-tools`.');
+-                    }
+-                    throw error;
+-                }
+-            }
+-        }
+-        else {
+-            const lockpath = fs.existsSync(path.join(c.root, 'package-lock.json')) ?
+-                path.join(c.root, 'package-lock.json') :
+-                path.join(c.root, 'npm-shrinkwrap.json');
+-            await fs.copy(lockpath, path.join(c.workspace(), path.basename(lockpath)));
+-            await exec('npm install --production', { cwd: c.workspace() });
++        const ws = c.workspace();
++        exec(`cd ${ws}`);
++        console.error(`[debug] oclif copying node_modules to "${ws}"`)
++        const source = path.join(c.root, 'node_modules');
++        if (process.platform === 'win32') {
++            await exec(`xcopy "${source}" "${ws}\\node_modules" /S /E /B /I /K /Q /Y`);
++        } else {
++            // use the shell's `cp` on macOS in order to preserve extended
++            // file attributes containing `codesign` digital signatures
++            await exec(`cp -pR "${source}" "${ws}"`);
+         }
++        console.error(`[debug] oclif running "npm prune --production" in "${ws}"`);
++        await exec('npm prune --production', { cwd: c.workspace() });
++        console.error(`[debug] oclif done`);
+     };
+     const pretarball = async () => {
+         const pjson = await fs.readJSON(path.join(c.workspace(), 'package.json'));
+@@ -115,7 +110,8 @@ async function build(c, options = {}) {
+             output: path.join(workspace, 'bin', 'node'),
+             platform: target.platform,
+             arch: target.arch,
+-            tmp: path.join(config.root, 'tmp'),
++            tmp,
++            projectRootPath: c.root
+         });
+         if (options.pack === false)
+             return;
+@@ -158,6 +154,7 @@ async function build(c, options = {}) {
+         await fs.writeJSON(manifestFilepath, manifest, { spaces: 2 });
+     };
+     (0, log_1.log)(`gathering workspace for ${config.bin} to ${c.workspace()}`);
++    console.error(`[debug] ${options.tarball}`);
+     await extractCLI(options.tarball ? options.tarball : await packCLI());
+     await updatePJSON();
+     await addDependencies();
+diff --git a/node_modules/oclif/lib/tarballs/config.js b/node_modules/oclif/lib/tarballs/config.js
+index 216759d..f7bfbfe 100644
+--- a/node_modules/oclif/lib/tarballs/config.js
++++ b/node_modules/oclif/lib/tarballs/config.js
+@@ -25,7 +25,10 @@ async function gitSha(cwd, options = {}) {
+ }
+ exports.gitSha = gitSha;
+ async function Tmp(config) {
+-    const tmp = path.join(config.root, 'tmp');
++    const tmp = process.env.BUILD_TMP
++        ? path.join(process.env.BUILD_TMP, 'oclif')
++        : path.join(config.root, 'tmp');
++    console.error(`[debug] oclif tmp="${tmp}"`);
+     await fs.promises.mkdir(tmp, { recursive: true });
+     return tmp;
+ }
+@@ -62,7 +65,7 @@ async function buildConfig(root, options = {}) {
+         s3Config: updateConfig.s3,
+         nodeVersion,
+         workspace(target) {
+-            const base = path.join(config.root, 'tmp');
++            const base = tmp;
+             if (target && target.platform)
+                 return path.join(base, [target.platform, target.arch].join('-'), (0, upload_util_1.templateShortKey)('baseDir', { bin: config.bin }));
+             return path.join(base, (0, upload_util_1.templateShortKey)('baseDir', { bin: config.bin }));
+diff --git a/node_modules/oclif/lib/tarballs/node.js b/node_modules/oclif/lib/tarballs/node.js
+index 1a4e09b..2d0566f 100644
+--- a/node_modules/oclif/lib/tarballs/node.js
++++ b/node_modules/oclif/lib/tarballs/node.js
+@@ -11,9 +11,10 @@ const node_util_1 = require("node:util");
+ const got_1 = require("got");
+ const pipeline = (0, node_util_1.promisify)(node_stream_1.pipeline);
+ const exec = (0, node_util_1.promisify)(node_child_process_1.exec);
++const { isMSYS2, msysExec, toMsysPath } = require("../util");
+ async function checkFor7Zip() {
+     try {
+-        await exec('7z');
++        await msysExec('7z', { stdio: [0, null, 2] });
+     }
+     catch (error) {
+         if (error.code === 127)
+@@ -51,8 +52,10 @@ async function fetchNodeBinary({ nodeVersion, output, platform, arch, tmp }) {
+         const basedir = path.dirname(tarball);
+         await fs.promises.mkdir(basedir, { recursive: true });
+         await pipeline(got_1.default.stream(url), fs.createWriteStream(tarball));
+-        if (platform !== 'win32')
+-            await exec(`grep "${path.basename(tarball)}" "${shasums}" | shasum -a 256 -c -`, { cwd: basedir });
++        if (platform !== 'win32') {
++            const shaCmd = isMSYS2 ? 'sha256sum -c -' : 'shasum -a 256 -c -';
++            await msysExec(`grep ${path.basename(tarball)} ${toMsysPath(shasums)} | ${shaCmd}`, { cwd: basedir });
++        }
+     };
+     const extract = async () => {
+         (0, log_1.log)(`extracting ${nodeBase}`);
+@@ -60,7 +63,7 @@ async function fetchNodeBinary({ nodeVersion, output, platform, arch, tmp }) {
+         await fs.promises.mkdir(nodeTmp, { recursive: true });
+         await fs.promises.mkdir(path.dirname(cache), { recursive: true });
+         if (platform === 'win32') {
+-            await exec(`7z x -bd -y "${tarball}"`, { cwd: nodeTmp });
++            await msysExec(`7z x -bd -y ${toMsysPath(tarball)} > /dev/null`, { cwd: nodeTmp });
+             await fs.move(path.join(nodeTmp, nodeBase, 'node.exe'), path.join(cache, 'node.exe'));
+         }
+         else {
+diff --git a/node_modules/oclif/lib/upload-util.js b/node_modules/oclif/lib/upload-util.js
+index 6963e4d..430472d 100644
+--- a/node_modules/oclif/lib/upload-util.js
++++ b/node_modules/oclif/lib/upload-util.js
+@@ -31,10 +31,10 @@ options = { root: '.' }) {
+     const templates = {
+         baseDir: '<%- bin %>',
+         unversioned: '<%- bin %>-<%- platform %>-<%- arch %><%- ext %>',
+-        versioned: '<%- bin %>-v<%- version %>-<%- sha %>-<%- platform %>-<%- arch %><%- ext %>',
+-        manifest: '<%- bin %>-v<%- version %>-<%- sha %>-<%- platform %>-<%- arch %>-buildmanifest',
+-        macos: '<%- bin %>-v<%- version %>-<%- sha %>-<%- arch %>.pkg',
+-        win32: '<%- bin %>-v<%- version %>-<%- sha %>-<%- arch %>.exe',
++        versioned: '<%- bin %>-v<%- version %>-<%- platform %>-<%- arch %><%- ext %>',
++        manifest: '<%- bin %>-v<%- version %>-<%- platform %>-<%- arch %>-buildmanifest',
++        macos: '<%- bin %>-v<%- version %>.pkg',
++        win32: '<%- bin %>-v<%- version %>-<%- arch %>.exe',
+         deb: '<%- bin %>_<%- versionShaRevision %>_<%- arch %>.deb',
+     };
+     return _.template(templates[type])(Object.assign({}, options));
+diff --git a/node_modules/oclif/lib/util.js b/node_modules/oclif/lib/util.js
+index 75bf3c6..c6a9c49 100644
+--- a/node_modules/oclif/lib/util.js
++++ b/node_modules/oclif/lib/util.js
+@@ -74,6 +74,51 @@ const sortVersionsObjectByKeysDesc = (input) => {
+     }
+     return result;
+ };
++
++// OSTYPE is 'msys' for MSYS 1.0 and for MSYS2, or 'cygwin' for Cygwin
++// but note that OSTYPE is not "exported" by default, so run: export OSTYPE=$OSTYPE
++// MSYSTEM is 'MINGW32' for MSYS 1.0, 'MSYS' for MSYS2, and undefined for Cygwin
++const isCygwin = process.env.OSTYPE === 'cygwin';
++const isMinGW = process.env.MSYSTEM && process.env.MSYSTEM.startsWith('MINGW');
++const isMSYS2 = process.env.MSYSTEM && process.env.MSYSTEM.startsWith('MSYS');
++const MSYSSHELLPATH = process.env.MSYSSHELLPATH ||
++    (isMSYS2 ? 'C:\\msys64\\usr\\bin\\bash.exe' :
++        (isMinGW ? 'C:\\MinGW\\msys\\1.0\\bin\\bash.exe' :
++            (isCygwin ? 'C:\\cygwin64\\bin\\bash.exe' : '/bin/sh')));
++
++exports.isCygwin = isCygwin;
++exports.isMinGW = isMinGW;
++exports.isMSYS2 = isMSYS2;
++console.error(`[debug] oclif MSYSSHELLPATH=${MSYSSHELLPATH} MSYSTEM=${process.env.MSYSTEM} OSTYPE=${process.env.OSTYPE} isMSYS2=${isMSYS2} isMingGW=${isMinGW} isCygwin=${isCygwin}`);
++
++const child_process_1 = require("child_process");
++const node_util_1 = require("node:util");
++const exec = (0, node_util_1.promisify)(child_process_1.exec);
++
++/* Convert a Windows path like 'C:\tmp' to a MSYS path like '/c/tmp' */
++function toMsysPath(windowsPath) {
++    // 'c:\myfolder' -> '/c/myfolder' or '/cygdrive/c/myfolder'
++    let msysPath = windowsPath.replace(/\\/g, '/');
++    if (isMSYS2 || isMinGW) {
++        msysPath = msysPath.replace(/^([a-zA-Z]):/, '/$1');
++    } else if (isCygwin) {
++        msysPath = msysPath.replace(/^([a-zA-Z]):/, '/cygdrive/$1');
++    }
++    console.error(`[debug] oclif toMsysPath before="${windowsPath}" after="${msysPath}"`);
++    return msysPath;
++}
++exports.toMsysPath = toMsysPath;
++
++async function msysExec(cmd, options = {}) {
++    if (process.platform !== 'win32') {
++        return exec(cmd, options);
++    }
++    const sh = MSYSSHELLPATH;
++    const args = ['-c', cmd];
++    console.error(`[debug] oclif msysExec sh="${sh}" args=${JSON.stringify(args)} options=${JSON.stringify(options)}`);
++    return exec(`"${sh}" "${args.join('" "')}"`, options);
++}
++exports.msysExec = msysExec;
+ exports.sortVersionsObjectByKeysDesc = sortVersionsObjectByKeysDesc;
+ const homeRegexp = new RegExp(`\\B${os.homedir().replace('/', '\\/')}`, 'g');
+ const curRegexp = new RegExp(`\\B${process.cwd()}`, 'g');

patches/all/open+7.4.2.patch

@@ -1,15 +1,16 @@
 diff --git a/node_modules/open/index.js b/node_modules/open/index.js
-index 3bf5373..e042b64 100644
+index 13147d0..ff161dd 100644
 --- a/node_modules/open/index.js
 +++ b/node_modules/open/index.js
-@@ -11,7 +11,9 @@ const pAccess = promisify(fs.access);
- const pExecFile = promisify(childProcess.execFile);
+@@ -10,7 +10,10 @@ const pAccess = promisify(fs.access);
+ const pReadFile = promisify(fs.readFile);
  
  // Path to included `xdg-open`.
 -const localXdgOpenPath = path.join(__dirname, 'xdg-open');
 +const localXdgOpenPath = process.pkg
 +	? path.join(path.dirname(process.execPath), 'xdg-open')
 +	: path.join(__dirname, 'xdg-open');
++
  
- // Convert a path from WSL format to Windows format:
- // `/mnt/c/Program Files/Example/MyApp.exe` → `C:\Program Files\Example\MyApp.exe`
+ /**
+ Get the mount point for fixed drives in WSL.

patches/all/opn+4.0.2.patch

@@ -1,15 +0,0 @@
-diff --git a/node_modules/opn/index.js b/node_modules/opn/index.js
-index 13dcb66..0f0c1df 100644
---- a/node_modules/opn/index.js
-+++ b/node_modules/opn/index.js
-@@ -51,7 +51,9 @@ module.exports = function (target, opts) {
- 		if (opts.app) {
- 			cmd = opts.app;
- 		} else {
--			cmd = path.join(__dirname, 'xdg-open');
-+			cmd = process.pkg
-+				? path.join(path.dirname(process.execPath), 'xdg-open-402')
-+				: path.join(__dirname, 'xdg-open');
- 		}
- 
- 		if (appArgs.length > 0) {

patches/unix/node-gyp-build+4.6.0.patch

@@ -1,8 +1,8 @@
-diff --git a/node_modules/node-gyp-build/index.js b/node_modules/node-gyp-build/index.js
-index b5096ed..7cd451a 100644
---- a/node_modules/node-gyp-build/index.js
-+++ b/node_modules/node-gyp-build/index.js
-@@ -29,6 +29,9 @@ load.path = function (dir) {
+diff --git a/node_modules/node-gyp-build/node-gyp-build.js b/node_modules/node-gyp-build/node-gyp-build.js
+index 61b398e..3cc3be8 100644
+--- a/node_modules/node-gyp-build/node-gyp-build.js
++++ b/node_modules/node-gyp-build/node-gyp-build.js
+@@ -30,6 +30,9 @@ load.resolve = load.path = function (dir) {
      if (process.env[name + '_PREBUILD']) dir = process.env[name + '_PREBUILD']
    } catch (err) {}
  

repo.yml

@@ -10,8 +10,6 @@ upstream:
     url: 'https://github.com/balena-io-modules/balena-image-manager'
   - repo: 'balena-preload'
     url: 'https://github.com/balena-io-modules/balena-preload'
-  - repo: 'balena-sync'
-    url: 'https://github.com/balena-io-modules/balena-sync'
   - repo: 'etcher-sdk'
     url: 'https://github.com/balena-io-modules/etcher-sdk/'
   - repo: 'balena-compose'

tests/commands/device/devices.spec.ts

@@ -38,7 +38,7 @@ describe('balena devices', function () {
 	it('should list devices from own and collaborator apps', async () => {
 		api.scope
 			.get(
-				'/v6/device?$orderby=device_name%20asc&$expand=belongs_to__application($select=app_name,slug),is_of__device_type($select=slug),is_running__release($select=commit)',
+				'/v6/device?$orderby=device_name%20asc&$select=id,uuid,device_name,status,is_online,supervisor_version,os_version&$expand=belongs_to__application($select=app_name,slug),is_of__device_type($select=slug),is_running__release($select=commit)',
 			)
 			.replyWithFile(200, path.join(apiResponsePath, 'devices.json'), {
 				'Content-Type': 'application/json',

tests/commands/env/envs.spec.ts

@@ -95,7 +95,7 @@ describe('balena envs', function () {
 
 	it('should successfully list service variables for a test fleet (-s flag)', async () => {
 		const serviceName = 'service2';
-		api.expectGetService({ serviceName });
+		api.expectGetServiceFromApp({ serviceName });
 		api.expectGetApplication();
 		api.expectGetAppEnvVars();
 		api.expectGetAppServiceVars();
@@ -117,7 +117,7 @@ describe('balena envs', function () {
 
 	it('should successfully list env and service vars for a test fleet (-s flags)', async () => {
 		const serviceName = 'service1';
-		api.expectGetService({ serviceName });
+		api.expectGetServiceFromApp({ serviceName });
 		api.expectGetApplication();
 		api.expectGetAppEnvVars();
 		api.expectGetAppServiceVars();
@@ -138,6 +138,7 @@ describe('balena envs', function () {
 	});
 
 	it('should successfully list env variables for a test device', async () => {
+		api.expectGetDevice({ shortUUID, fullUUID });
 		api.expectGetDevice({ fullUUID });
 		api.expectGetDeviceEnvVars();
 		api.expectGetApplication();
@@ -145,20 +146,19 @@ describe('balena envs', function () {
 		api.expectGetAppServiceVars();
 		api.expectGetDeviceServiceVars();
 
-		const uuid = shortUUID;
-		const result = await runCommand(`envs -d ${uuid}`);
+		const result = await runCommand(`envs -d ${shortUUID}`);
 		let { out } = result;
 		let expected =
 			stripIndent`
 			ID     NAME  VALUE       FLEET    DEVICE  SERVICE
 			120110 svar1 svar1-value org/test *       service1
 			120111 svar2 svar2-value org/test *       service2
-			120120 svar3 svar3-value org/test ${uuid} service1
-			120121 svar4 svar4-value org/test ${uuid} service2
+			120120 svar3 svar3-value org/test ${shortUUID} service1
+			120121 svar4 svar4-value org/test ${shortUUID} service2
 			120101 var1  var1-val    org/test *       *
 			120102 var2  22          org/test *       *
-			120203 var3  var3-val    org/test ${uuid} *
-			120204 var4  44          org/test ${uuid} *
+			120203 var3  var3-val    org/test ${shortUUID} *
+			120204 var4  44          org/test ${shortUUID} *
 			` + '\n';
 
 		out = out.map((l) => l.replace(/ +/g, ' '));
@@ -168,6 +168,7 @@ describe('balena envs', function () {
 	});
 
 	it('should successfully list env variables for a test device (JSON output)', async () => {
+		api.expectGetDevice({ shortUUID, fullUUID });
 		api.expectGetDevice({ fullUUID });
 		api.expectGetDeviceEnvVars();
 		api.expectGetApplication();
@@ -192,6 +193,7 @@ describe('balena envs', function () {
 	});
 
 	it('should successfully list config variables for a test device', async () => {
+		api.expectGetDevice({ shortUUID, fullUUID });
 		api.expectGetDevice({ fullUUID });
 		api.expectGetDeviceConfigVars();
 		api.expectGetApplication();
@@ -214,26 +216,26 @@ describe('balena envs', function () {
 
 	it('should successfully list service variables for a test device (-s flag)', async () => {
 		const serviceName = 'service2';
-		api.expectGetService({ serviceName });
+		api.expectGetServiceFromApp({ serviceName });
 		api.expectGetApplication();
+		api.expectGetDevice({ shortUUID, fullUUID });
 		api.expectGetDevice({ fullUUID });
 		api.expectGetDeviceServiceVars();
 		api.expectGetAppEnvVars();
 		api.expectGetAppServiceVars();
 		api.expectGetDeviceEnvVars();
 
-		const uuid = shortUUID;
-		const result = await runCommand(`envs -d ${uuid} -s ${serviceName}`);
+		const result = await runCommand(`envs -d ${shortUUID} -s ${serviceName}`);
 		let { out } = result;
 		let expected =
 			stripIndent`
 			ID     NAME  VALUE       FLEET    DEVICE  SERVICE
 			120111 svar2 svar2-value org/test *       service2
-			120121 svar4 svar4-value org/test ${uuid} service2
+			120121 svar4 svar4-value org/test ${shortUUID} service2
 			120101 var1  var1-val    org/test *       *
 			120102 var2  22          org/test *       *
-			120203 var3  var3-val    org/test ${uuid} *
-			120204 var4  44          org/test ${uuid} *
+			120203 var3  var3-val    org/test ${shortUUID} *
+			120204 var4  44          org/test ${shortUUID} *
 		` + '\n';
 
 		out = out.map((l) => l.replace(/ +/g, ' '));
@@ -243,20 +245,20 @@ describe('balena envs', function () {
 	});
 
 	it('should successfully list env and service variables for a test device (unknown fleet)', async () => {
+		api.expectGetDevice({ shortUUID, fullUUID, inaccessibleApp: true });
 		api.expectGetDevice({ fullUUID, inaccessibleApp: true });
 		api.expectGetDeviceEnvVars();
 		api.expectGetDeviceServiceVars();
 
-		const uuid = shortUUID;
-		const result = await runCommand(`envs -d ${uuid}`);
+		const result = await runCommand(`envs -d ${shortUUID}`);
 		let { out } = result;
 		let expected =
 			stripIndent`
 			ID     NAME  VALUE       FLEET DEVICE  SERVICE
-			120120 svar3 svar3-value N/A   ${uuid} service1
-			120121 svar4 svar4-value N/A   ${uuid} service2
-			120203 var3  var3-val    N/A   ${uuid} *
-			120204 var4  44          N/A   ${uuid} *
+			120120 svar3 svar3-value N/A   ${shortUUID} service1
+			120121 svar4 svar4-value N/A   ${shortUUID} service2
+			120203 var3  var3-val    N/A   ${shortUUID} *
+			120204 var4  44          N/A   ${shortUUID} *
 		` + '\n';
 
 		out = out.map((l) => l.replace(/ +/g, ' '));
@@ -267,26 +269,26 @@ describe('balena envs', function () {
 
 	it('should successfully list env and service vars for a test device (-s flags)', async () => {
 		const serviceName = 'service1';
-		api.expectGetService({ serviceName });
+		api.expectGetServiceFromApp({ serviceName });
 		api.expectGetApplication();
 		api.expectGetAppEnvVars();
 		api.expectGetAppServiceVars();
+		api.expectGetDevice({ shortUUID, fullUUID });
 		api.expectGetDevice({ fullUUID });
 		api.expectGetDeviceEnvVars();
 		api.expectGetDeviceServiceVars();
 
-		const uuid = shortUUID;
-		const result = await runCommand(`envs -d ${uuid} -s ${serviceName}`);
+		const result = await runCommand(`envs -d ${shortUUID} -s ${serviceName}`);
 		let { out } = result;
 		let expected =
 			stripIndent`
 			ID     NAME  VALUE       FLEET    DEVICE  SERVICE
 			120110 svar1 svar1-value org/test *       ${serviceName}
-			120120 svar3 svar3-value org/test ${uuid} ${serviceName}
+			120120 svar3 svar3-value org/test ${shortUUID} ${serviceName}
 			120101 var1  var1-val    org/test *       *
 			120102 var2  22          org/test *       *
-			120203 var3  var3-val    org/test ${uuid} *
-			120204 var4  44          org/test ${uuid} *
+			120203 var3  var3-val    org/test ${shortUUID} *
+			120204 var4  44          org/test ${shortUUID} *
 		` + '\n';
 
 		out = out.map((l) => l.replace(/ +/g, ' '));
@@ -297,10 +299,11 @@ describe('balena envs', function () {
 
 	it('should successfully list env and service vars for a test device (-js flags)', async () => {
 		const serviceName = 'service1';
-		api.expectGetService({ serviceName });
+		api.expectGetServiceFromApp({ serviceName });
 		api.expectGetApplication();
 		api.expectGetAppEnvVars();
 		api.expectGetAppServiceVars();
+		api.expectGetDevice({ shortUUID, fullUUID });
 		api.expectGetDevice({ fullUUID });
 		api.expectGetDeviceEnvVars();
 		api.expectGetDeviceServiceVars();

tests/commands/ssh.spec.ts

@@ -178,7 +178,7 @@ async function startMockSshServer(): Promise<[Server, number]> {
 	});
 
 	return await new Promise<[Server, number]>((resolve, reject) => {
-		// TODO: remove 'as any' below. According to @types/node v12.20.42, the
+		// TODO: remove 'as any' below. According to @types/node v16.18.25, the
 		// callback type is `() => void`, but our code assumes `(err: Error) => void`
 		const listener = (server.listen as any)(0, '127.0.0.1', (err: Error) => {
 			// this callback is called for the 'listening' event

tests/commands/whoami.spec.ts

@@ -0,0 +1,75 @@
+/**
+ * @license
+ * Copyright 2019-2023 Balena Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import { expect } from 'chai';
+
+import { BalenaAPIMock } from '../nock/balena-api-mock';
+import { cleanOutput, runCommand } from '../helpers';
+
+describe('balena whoami', function () {
+	let api: BalenaAPIMock;
+
+	this.beforeEach(() => {
+		api = new BalenaAPIMock();
+		api.expectGetMixpanel({ optional: true });
+	});
+
+	this.afterEach(async () => {
+		// Check all expected api calls have been made and clean up.
+		api.done();
+	});
+
+	it(`should output login required message if haven't logged in`, async () => {
+		api.expectWhoAmIFail();
+		const { err, out } = await runCommand('whoami');
+		expect(out).to.be.empty;
+		expect(err[0]).to.include('Login required');
+	});
+
+	it('should display device with device response', async () => {
+		api.expectDeviceWhoAmI();
+		const { err, out } = await runCommand('whoami');
+
+		const lines = cleanOutput(out);
+		expect(lines[0]).to.contain('== ACCOUNT INFORMATION');
+		expect(lines[1]).to.contain('DEVICE: a11dc1acd31b623a0e4e084a6cf13aaa');
+		expect(lines[2]).to.contain('URL:    balena-cloud.com');
+		expect(err).to.be.empty;
+	});
+
+	it('should display application with application response', async () => {
+		api.expectApplicationWhoAmI();
+		const { err, out } = await runCommand('whoami');
+
+		const lines = cleanOutput(out);
+		expect(lines[0]).to.contain('== ACCOUNT INFORMATION');
+		expect(lines[1]).to.contain('APPLICATION: mytestorf/mytestfleet');
+		expect(lines[2]).to.contain('URL:         balena-cloud.com');
+		expect(err).to.be.empty;
+	});
+
+	it('should display user with user response', async () => {
+		api.expectGetWhoAmI();
+		const { err, out } = await runCommand('whoami');
+
+		const lines = cleanOutput(out);
+		expect(lines[0]).to.contain('== ACCOUNT INFORMATION');
+		expect(lines[1]).to.contain('USERNAME: gh_user');
+		expect(lines[2]).to.contain('EMAIL:    testuser@test.com');
+		expect(lines[3]).to.contain('URL:      balena-cloud.com');
+		expect(err).to.be.empty;
+	});
+});

tests/deprecation.spec.ts

@@ -16,7 +16,7 @@
  */
 
 import * as settings from 'balena-settings-client';
-import * as getStorage from 'balena-settings-storage';
+import { getStorage } from 'balena-settings-storage';
 import { expect } from 'chai';
 import mock = require('mock-require');
 import * as semver from 'semver';
@@ -78,7 +78,7 @@ describe('DeprecationChecker', function () {
 			.stub(mockStorage, 'set')
 			.withArgs(checker.cacheFile, sinon.match.any);
 
-		mock(storageModPath, () => mockStorage);
+		mock(storageModPath, { getStorage: () => mockStorage });
 	});
 
 	this.afterEach(() => {

tests/nock/balena-api-mock.ts

@@ -212,13 +212,20 @@ export class BalenaAPIMock extends NockMock {
 
 	public expectGetDevice(opts: {
 		fullUUID: string;
+		shortUUID?: string;
 		inaccessibleApp?: boolean;
 		isOnline?: boolean;
 		optional?: boolean;
 		persist?: boolean;
 	}) {
 		const id = 7654321;
-		this.optGet(/^\/v\d+\/device($|\?)/, opts).reply(200, {
+		const providedUuid = opts.shortUUID ?? opts.fullUUID;
+		this.optGet(
+			providedUuid.length !== 32
+				? /^\/v\d+\/device($|\?)/
+				: /^\/v\d+\/device\(uuid=%27[0-9a-f]{32}%27\)/,
+			opts,
+		).reply(200, {
 			d: [
 				{
 					id,
@@ -379,6 +386,21 @@ export class BalenaAPIMock extends NockMock {
 		});
 	}
 
+	public expectGetServiceFromApp(opts: {
+		optional?: boolean;
+		persist?: boolean;
+		serviceId?: number;
+		serviceName: string;
+	}) {
+		const serviceId = opts.serviceId || 243768;
+		this.optGet(/^\/v6\/application($|\?).*\$expand=service.*/, opts).reply(
+			200,
+			{
+				d: [{ service: [{ id: serviceId, service_name: opts.serviceName }] }],
+			},
+		);
+	}
+
 	public expectPostService409(opts: ScopeOpts = {}) {
 		this.optPost(/^\/v\d+\/service$/, opts).reply(
 			409,
@@ -408,13 +430,37 @@ export class BalenaAPIMock extends NockMock {
 	// User details are cached in the SDK
 	// so often we don't know if we can expect the whoami request
 	public expectGetWhoAmI(opts: ScopeOpts = { optional: true }) {
-		this.optGet('/user/v1/whoami', opts).reply(200, {
-			id: 99999,
+		this.optGet('/actor/v1/whoami', opts).reply(200, {
+			id: 1234,
+			actorType: 'user',
+			actorTypeId: 99999,
 			username: 'gh_user',
 			email: 'testuser@test.com',
 		});
 	}
 
+	public expectDeviceWhoAmI(opts: ScopeOpts = { optional: true }) {
+		this.optGet('/actor/v1/whoami', opts).reply(200, {
+			id: 1235,
+			actorType: 'device',
+			actorTypeId: 88888,
+			uuid: 'a11dc1acd31b623a0e4e084a6cf13aaa',
+		});
+	}
+
+	public expectApplicationWhoAmI(opts: ScopeOpts = { optional: true }) {
+		this.optGet('/actor/v1/whoami', opts).reply(200, {
+			id: 1236,
+			actorType: 'application',
+			actorTypeId: 77777,
+			slug: 'mytestorf/mytestfleet',
+		});
+	}
+
+	public expectWhoAmIFail(opts: ScopeOpts = { optional: true }) {
+		this.optGet('/actor/v1/whoami', opts).reply(401);
+	}
+
 	public expectGetMixpanel(opts: ScopeOpts = {}) {
 		this.optGet(/^\/mixpanel\/track/, opts).reply(200, {});
 	}

tests/nock/proxy-server.ts

@@ -113,7 +113,7 @@ async function createProxyServer(): Promise<[number, number]> {
 	let proxyPort = 0; // TCP port number, 0 means automatic allocation
 
 	await new Promise<void>((resolve, reject) => {
-		// TODO: remove 'as any' below. According to @types/node v12.20.42, the
+		// TODO: remove 'as any' below. According to @types/node v16.18.25, the
 		// callback type is `() => void`, but our code assumes `(err: Error) => void`
 		const listener = (server.listen as any)(0, '127.0.0.1', (err: Error) => {
 			if (err) {
@@ -197,7 +197,7 @@ async function createInterceptorServer(): Promise<number> {
 	let interceptorPort = 0;
 
 	await new Promise<void>((resolve, reject) => {
-		// TODO: remove 'as any' below. According to @types/node v12.20.42, the
+		// TODO: remove 'as any' below. According to @types/node v16.18.25, the
 		// callback type is `() => void`, but our code assumes `(err: Error) => void`
 		const listener = (server.listen as any)(0, '127.0.0.1', (err: Error) => {
 			if (err) {

tests/test-data/api-response/application-GET-v6-expanded-app-type-cpu-arch.json

@@ -6,7 +6,7 @@
 					"name": "Starter",
 					"slug": "microservices-starter",
 					"supports_multicontainer": true,
-					"is_legacy": false,
+					"is_legacy": true,
 					"__metadata": {}
 				}
 			],

tests/test-data/api-response/application-GET-v6-expanded-app-type.json

@@ -6,7 +6,7 @@
 					"name": "Starter",
 					"slug": "microservices-starter",
 					"supports_multicontainer": true,
-					"is_legacy": false,
+					"is_legacy": true,
 					"__metadata": {}
 				}
 			],

tests/test-data/api-response/devices.json

@@ -3,20 +3,11 @@
 		{
 			"belongs_to__application": [
 				{
-					"app_name": "test app",
 					"slug": "org/test app",
 					"__metadata": {}
 				}
 			],
 			"id": 1747415,
-			"belongs_to__user": {
-				"__deferred": {
-					"uri": "/resin/user(46272)"
-				},
-				"__id": 46272
-			},
-			"is_managed_by__device": null,
-			"actor": 4180757,
 			"device_name": "sparkling-wood",
 			"is_of__device_type": [{ "slug": "raspberrypi4-64" }],
 			"uuid": "fda508c8583011b8466c26abdd5159f2",
@@ -25,50 +16,10 @@
 					"commit": "18756d3386c25a044db66b89e0409804"
 				}
 			],
-			"note": null,
-			"local_id": null,
 			"status": "Idle",
 			"is_online": false,
-			"last_connectivity_event": "2019-11-23T00:26:35.074Z",
-			"is_connected_to_vpn": false,
-			"last_vpn_event": "2019-11-23T00:26:35.074Z",
-			"ip_address": "192.168.0.112",
-			"vpn_address": null,
-			"public_address": "89.186.29.129",
 			"os_version": "balenaOS 2.44.0+rev3",
-			"os_variant": "dev",
 			"supervisor_version": "10.3.7",
-			"should_be_managed_by__supervisor_release": null,
-			"is_managed_by__service_instance": {
-				"__deferred": {
-					"uri": "/resin/service_instance(124111)"
-				},
-				"__id": 124111
-			},
-			"provisioning_progress": null,
-			"provisioning_state": "",
-			"download_progress": null,
-			"is_web_accessible": false,
-			"longitude": "22.5853",
-			"latitude": "51.2712",
-			"location": "Lublin, Lublin, Poland",
-			"custom_longitude": "",
-			"custom_latitude": "",
-			"logs_channel": null,
-			"is_locked_until__date": null,
-			"is_accessible_by_support_until__date": null,
-			"created_at": "2019-11-18T12:27:37.423Z",
-			"is_active": true,
-			"api_heartbeat_state": "offline",
-			"cpu_usage" : 34,
-			"cpu_temp" : 56.2,
-			"cpu_id" :  "some cpu id",
-			"memory_usage" : 1000,
-			"memory_total" : 4000,
-			"storage_block_device" : "/dev/mmcblk0",
-			"storage_usage" :  1000,
-			"storage_total" : 64000,
-			"is_undervolted" : true,
 			"__metadata": {
 				"uri": "/resin/device(@id)?@id=1747415"
 			}
@@ -76,14 +27,6 @@
 		{
 			"belongs_to__application": [],
 			"id": 1747416,
-			"belongs_to__user": {
-				"__deferred": {
-					"uri": "/resin/user(46272)"
-				},
-				"__id": 46272
-			},
-			"is_managed_by__device": null,
-			"actor": 4180757,
 			"device_name": "dashing-spruce",
 			"is_of__device_type": [{ "slug": "raspberrypi4-64" }],
 			"uuid": "fda508c8583011b8466c26abdd5159f3",
@@ -92,50 +35,10 @@
 					"commit": "18756d3386c25a044db66b89e0409804"
 				}
 			],
-			"note": null,
-			"local_id": null,
 			"status": "Idle",
 			"is_online": false,
-			"last_connectivity_event": "2019-11-23T00:26:35.074Z",
-			"is_connected_to_vpn": false,
-			"last_vpn_event": "2019-11-23T00:26:35.074Z",
-			"ip_address": "192.168.0.112",
-			"vpn_address": null,
-			"public_address": "89.186.29.129",
 			"os_version": "balenaOS 2.44.0+rev3",
-			"os_variant": "dev",
 			"supervisor_version": "10.3.7",
-			"should_be_managed_by__supervisor_release": null,
-			"is_managed_by__service_instance": {
-				"__deferred": {
-					"uri": "/resin/service_instance(124111)"
-				},
-				"__id": 124111
-			},
-			"provisioning_progress": null,
-			"provisioning_state": "",
-			"download_progress": null,
-			"is_web_accessible": false,
-			"longitude": "22.5853",
-			"latitude": "51.2712",
-			"location": "Lublin, Lublin, Poland",
-			"custom_longitude": "",
-			"custom_latitude": "",
-			"logs_channel": null,
-			"is_locked_until__date": null,
-			"is_accessible_by_support_until__date": null,
-			"created_at": "2019-11-18T12:27:37.423Z",
-			"is_active": true,
-			"api_heartbeat_state": "offline",
-			"cpu_usage" : 34,
-			"cpu_temp" : 56.2,
-			"cpu_id" :  "some cpu id",
-			"memory_usage" : 1000,
-			"memory_total" : 4000,
-			"storage_block_device" : "/dev/mmcblk0",
-			"storage_usage" :  1000,
-			"storage_total" : 64000,
-			"is_undervolted" : true,
 			"__metadata": {
 				"uri": "/resin/device(@id)?@id=1747415"
 			}

tests/test-data/pkg/expected-warnings-darwin-x64.txt

@@ -1,21 +1,3 @@
-> Warning Cannot resolve 'module'
-  node_modules/balena-sync/build/index.js
-  Dynamic require may fail at run time, because the requested file
-  is unknown at compilation time and not included into executable.
-  Use a string literal as an argument for 'require', or leave it
-  as is and specify the resolved file name in 'scripts' option.
-> Warning Cannot resolve ''./' + command'
-  node_modules/balena-sync/build/capitano/index.js
-  Dynamic require may fail at run time, because the requested file
-  is unknown at compilation time and not included into executable.
-  Use a string literal as an argument for 'require', or leave it
-  as is and specify the resolved file name in 'scripts' option.
-> Warning Cannot resolve ''./' + target'
-  node_modules/balena-sync/build/sync/index.js
-  Dynamic require may fail at run time, because the requested file
-  is unknown at compilation time and not included into executable.
-  Use a string literal as an argument for 'require', or leave it
-  as is and specify the resolved file name in 'scripts' option.
 > Warning Cannot include file %1 into executable.
   The file must be distributed with executable as %2.
   %1: node_modules/open/xdg-open
@@ -56,14 +38,6 @@
   The file must be distributed with executable as %2.
   %1: node_modules/etcher-sdk/node_modules/drivelist/scripts/win32.bat
   %2: path-to-executable/drivelist/win32.bat
-> Warning Cannot include file %1 into executable.
-  The file must be distributed with executable as %2.
-  %1: node_modules/patch-package/node_modules/open/xdg-open
-  %2: path-to-executable/xdg-open
-> Warning Cannot include file %1 into executable.
-  The file must be distributed with executable as %2.
-  %1: node_modules/patch-package/node_modules/open/xdg-open
-  %2: path-to-executable/xdg-open
 > Warning Cannot resolve 'path'
   node_modules/@balena/compose/dist/parse/schemas/index.js
   Dynamic require may fail at run time, because the requested file
@@ -102,11 +76,9 @@
   The file must be distributed with executable as %2.
   %1: node_modules/drivelist/scripts/win32.bat
   %2: path-to-executable/drivelist/win32.bat
-> Warning Cannot include file %1 into executable.
-  The file must be distributed with executable as %2.
-  %1: node_modules/opn/xdg-open
-  %2: path-to-executable/xdg-open
-> Warning Cannot include file %1 into executable.
-  The file must be distributed with executable as %2.
-  %1: node_modules/opn/xdg-open
-  %2: path-to-executable/xdg-open
+prebuild-install warn install No prebuilt binaries found (target=v18.5.0 runtime=node arch=x64 libc= platform=darwin)
+prebuild-install warn install No prebuilt binaries found (target=v18.5.0 runtime=node arch=x64 libc= platform=darwin)
+prebuild-install warn install No prebuilt binaries found (target=v18.5.0 runtime=node arch=x64 libc= platform=darwin)
+prebuild-install warn install No prebuilt binaries found (target=v18.5.0 runtime=node arch=x64 libc= platform=darwin)
+prebuild-install warn install No prebuilt binaries found (target=v18.5.0 runtime=node arch=x64 libc= platform=darwin)
+

tests/test-data/pkg/expected-warnings-linux-arm64.txt

@@ -1,21 +1,3 @@
-> Warning Cannot resolve 'module'
-  node_modules/balena-sync/build/index.js
-  Dynamic require may fail at run time, because the requested file
-  is unknown at compilation time and not included into executable.
-  Use a string literal as an argument for 'require', or leave it
-  as is and specify the resolved file name in 'scripts' option.
-> Warning Cannot resolve ''./' + command'
-  node_modules/balena-sync/build/capitano/index.js
-  Dynamic require may fail at run time, because the requested file
-  is unknown at compilation time and not included into executable.
-  Use a string literal as an argument for 'require', or leave it
-  as is and specify the resolved file name in 'scripts' option.
-> Warning Cannot resolve ''./' + target'
-  node_modules/balena-sync/build/sync/index.js
-  Dynamic require may fail at run time, because the requested file
-  is unknown at compilation time and not included into executable.
-  Use a string literal as an argument for 'require', or leave it
-  as is and specify the resolved file name in 'scripts' option.
 > Warning Cannot include file %1 into executable.
   The file must be distributed with executable as %2.
   %1: node_modules/open/xdg-open
@@ -56,14 +38,6 @@
   The file must be distributed with executable as %2.
   %1: node_modules/etcher-sdk/node_modules/drivelist/scripts/win32.bat
   %2: path-to-executable/drivelist/win32.bat
-> Warning Cannot include file %1 into executable.
-  The file must be distributed with executable as %2.
-  %1: node_modules/patch-package/node_modules/open/xdg-open
-  %2: path-to-executable/xdg-open
-> Warning Cannot include file %1 into executable.
-  The file must be distributed with executable as %2.
-  %1: node_modules/patch-package/node_modules/open/xdg-open
-  %2: path-to-executable/xdg-open
 > Warning Cannot resolve 'path'
   node_modules/@balena/compose/dist/parse/schemas/index.js
   Dynamic require may fail at run time, because the requested file
@@ -102,11 +76,8 @@
   The file must be distributed with executable as %2.
   %1: node_modules/drivelist/scripts/win32.bat
   %2: path-to-executable/drivelist/win32.bat
-> Warning Cannot include file %1 into executable.
-  The file must be distributed with executable as %2.
-  %1: node_modules/opn/xdg-open
-  %2: path-to-executable/xdg-open
-> Warning Cannot include file %1 into executable.
-  The file must be distributed with executable as %2.
-  %1: node_modules/opn/xdg-open
-  %2: path-to-executable/xdg-open
+prebuild-install warn install No prebuilt binaries found (target=v18.5.0 runtime=node arch=arm64 libc= platform=linux)
+prebuild-install warn install No prebuilt binaries found (target=v18.5.0 runtime=node arch=arm64 libc= platform=linux)
+prebuild-install warn install No prebuilt binaries found (target=v18.5.0 runtime=node arch=arm64 libc= platform=linux)
+prebuild-install warn install No prebuilt binaries found (target=v18.5.0 runtime=node arch=arm64 libc= platform=linux)
+

tests/test-data/pkg/expected-warnings-linux-x64.txt

@@ -0,0 +1,83 @@
+> Warning Cannot include file %1 into executable.
+  The file must be distributed with executable as %2.
+  %1: node_modules/open/xdg-open
+  %2: path-to-executable/xdg-open
+> Warning Cannot include file %1 into executable.
+  The file must be distributed with executable as %2.
+  %1: node_modules/open/xdg-open
+  %2: path-to-executable/xdg-open
+> Warning Cannot include file %1 into executable.
+  The file must be distributed with executable as %2.
+  %1: node_modules/etcher-sdk/node_modules/drivelist/build/Release/drivelist.node
+  %2: path-to-executable/drivelist.node
+> Warning Cannot include file %1 into executable.
+  The file must be distributed with executable as %2.
+  %1: node_modules/etcher-sdk/node_modules/drivelist/scripts/darwin.sh
+  %2: path-to-executable/drivelist/darwin.sh
+> Warning Cannot include file %1 into executable.
+  The file must be distributed with executable as %2.
+  %1: node_modules/etcher-sdk/node_modules/drivelist/scripts/linux.sh
+  %2: path-to-executable/drivelist/linux.sh
+> Warning Cannot include file %1 into executable.
+  The file must be distributed with executable as %2.
+  %1: node_modules/etcher-sdk/node_modules/drivelist/scripts/win32.bat
+  %2: path-to-executable/drivelist/win32.bat
+> Warning Cannot include file %1 into executable.
+  The file must be distributed with executable as %2.
+  %1: node_modules/etcher-sdk/node_modules/drivelist/build/Release/drivelist.node
+  %2: path-to-executable/drivelist.node
+> Warning Cannot include file %1 into executable.
+  The file must be distributed with executable as %2.
+  %1: node_modules/etcher-sdk/node_modules/drivelist/scripts/darwin.sh
+  %2: path-to-executable/drivelist/darwin.sh
+> Warning Cannot include file %1 into executable.
+  The file must be distributed with executable as %2.
+  %1: node_modules/etcher-sdk/node_modules/drivelist/scripts/linux.sh
+  %2: path-to-executable/drivelist/linux.sh
+> Warning Cannot include file %1 into executable.
+  The file must be distributed with executable as %2.
+  %1: node_modules/etcher-sdk/node_modules/drivelist/scripts/win32.bat
+  %2: path-to-executable/drivelist/win32.bat
+> Warning Cannot resolve 'path'
+  node_modules/@balena/compose/dist/parse/schemas/index.js
+  Dynamic require may fail at run time, because the requested file
+  is unknown at compilation time and not included into executable.
+  Use a string literal as an argument for 'require', or leave it
+  as is and specify the resolved file name in 'scripts' option.
+> Warning Cannot include file %1 into executable.
+  The file must be distributed with executable as %2.
+  %1: node_modules/drivelist/build/Release/drivelist.node
+  %2: path-to-executable/drivelist.node
+> Warning Cannot include file %1 into executable.
+  The file must be distributed with executable as %2.
+  %1: node_modules/drivelist/scripts/darwin.sh
+  %2: path-to-executable/drivelist/darwin.sh
+> Warning Cannot include file %1 into executable.
+  The file must be distributed with executable as %2.
+  %1: node_modules/drivelist/scripts/linux.sh
+  %2: path-to-executable/drivelist/linux.sh
+> Warning Cannot include file %1 into executable.
+  The file must be distributed with executable as %2.
+  %1: node_modules/drivelist/scripts/win32.bat
+  %2: path-to-executable/drivelist/win32.bat
+> Warning Cannot include file %1 into executable.
+  The file must be distributed with executable as %2.
+  %1: node_modules/drivelist/build/Release/drivelist.node
+  %2: path-to-executable/drivelist.node
+> Warning Cannot include file %1 into executable.
+  The file must be distributed with executable as %2.
+  %1: node_modules/drivelist/scripts/darwin.sh
+  %2: path-to-executable/drivelist/darwin.sh
+> Warning Cannot include file %1 into executable.
+  The file must be distributed with executable as %2.
+  %1: node_modules/drivelist/scripts/linux.sh
+  %2: path-to-executable/drivelist/linux.sh
+> Warning Cannot include file %1 into executable.
+  The file must be distributed with executable as %2.
+  %1: node_modules/drivelist/scripts/win32.bat
+  %2: path-to-executable/drivelist/win32.bat
+prebuild-install warn install No prebuilt binaries found (target=v18.5.0 runtime=node arch=x64 libc= platform=linux)
+prebuild-install warn install No prebuilt binaries found (target=v18.5.0 runtime=node arch=x64 libc= platform=linux)
+prebuild-install warn install No prebuilt binaries found (target=v18.5.0 runtime=node arch=x64 libc= platform=linux)
+prebuild-install warn install No prebuilt binaries found (target=v18.5.0 runtime=node arch=x64 libc= platform=linux)
+

tests/test-data/pkg/expected-warnings-win32-x64.txt

@@ -1,21 +1,3 @@
-> Warning Cannot resolve 'module'
-  node_modules\balena-sync\build\index.js
-  Dynamic require may fail at run time, because the requested file
-  is unknown at compilation time and not included into executable.
-  Use a string literal as an argument for 'require', or leave it
-  as is and specify the resolved file name in 'scripts' option.
-> Warning Cannot resolve ''./' + command'
-  node_modules\balena-sync\build\capitano\index.js
-  Dynamic require may fail at run time, because the requested file
-  is unknown at compilation time and not included into executable.
-  Use a string literal as an argument for 'require', or leave it
-  as is and specify the resolved file name in 'scripts' option.
-> Warning Cannot resolve ''./' + target'
-  node_modules\balena-sync\build\sync\index.js
-  Dynamic require may fail at run time, because the requested file
-  is unknown at compilation time and not included into executable.
-  Use a string literal as an argument for 'require', or leave it
-  as is and specify the resolved file name in 'scripts' option.
 > Warning Cannot include file %1 into executable.
   The file must be distributed with executable as %2.
   %1: node_modules\open\xdg-open
@@ -56,14 +38,6 @@
   The file must be distributed with executable as %2.
   %1: node_modules\etcher-sdk\node_modules\drivelist\scripts\win32.bat
   %2: path-to-executable/drivelist/win32.bat
-> Warning Cannot include file %1 into executable.
-  The file must be distributed with executable as %2.
-  %1: node_modules\patch-package\node_modules\open\xdg-open
-  %2: path-to-executable/xdg-open
-> Warning Cannot include file %1 into executable.
-  The file must be distributed with executable as %2.
-  %1: node_modules\patch-package\node_modules\open\xdg-open
-  %2: path-to-executable/xdg-open
 > Warning Cannot resolve 'path'
   node_modules\@balena\compose\dist\parse\schemas\index.js
   Dynamic require may fail at run time, because the requested file
@@ -102,11 +76,3 @@
   The file must be distributed with executable as %2.
   %1: node_modules\drivelist\scripts\win32.bat
   %2: path-to-executable/drivelist/win32.bat
-> Warning Cannot include file %1 into executable.
-  The file must be distributed with executable as %2.
-  %1: node_modules\opn\xdg-open
-  %2: path-to-executable/xdg-open
-> Warning Cannot include file %1 into executable.
-  The file must be distributed with executable as %2.
-  %1: node_modules\opn\xdg-open
-  %2: path-to-executable/xdg-open

tests/utils/device/live.spec.ts

@@ -45,7 +45,7 @@ class MockLivepushManager extends LivepushManager {
 			docker: {} as import('dockerode'),
 			api: {} as import('../../../lib/utils/device/api').DeviceAPI,
 			logger: {} as import('../../../lib/utils/logger'),
-			buildLogs: {},
+			imageIds: {},
 			deployOpts:
 				{} as import('../../../lib/utils/device/deploy').DeviceDeployOptions,
 		});

tests/utils/eol-conversion.spec.ts

@@ -63,8 +63,6 @@ describe('detectEncoding() function', function () {
 	it('should correctly detect the encoding of a few selected files', async () => {
 		const sampleBinary = [
 			'drivelist/build/Release/drivelist.node',
-			'@balena.io/usb/build/Release/usb_bindings.node',
-			'xxhash/build/Release/hash.node',
 			'mountutils/build/Release/MountUtils.node',
 		];
 		const sampleText = [

typings/balena-image-manager/index.d.ts

@@ -1,27 +0,0 @@
-/**
- * @license
- * Copyright 2020 Balena Ltd.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-declare module 'balena-image-manager' {
-	export function cleanCache(): Promise<void>;
-
-	export function get(
-		deviceType: string,
-		versionOrRange: string,
-	): Promise<NodeJS.ReadableStream & { mime: string }>;
-
-	export function isESR(version: string): boolean;
-}

typings/balena-preload/index.d.ts

@@ -1,19 +0,0 @@
-declare module 'balena-preload' {
-	export class Preloader {
-		constructor(...args: any[]);
-
-		cleanup(): Promise<void>;
-
-		on(...args: any[]): void;
-
-		preload(): Promise<void>;
-
-		prepare(): Promise<void>;
-
-		setAppIdAndCommit(appId: string | number, commit: string): Promise<void>;
-
-		config: any;
-
-		stderr: any;
-	}
-}

typings/balena-sync/index.d.ts

@@ -1,41 +0,0 @@
-/**
- * @license
- * Copyright 2019 Balena Ltd.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-declare module 'balena-sync' {
-	import { CommandDefinition } from 'capitano';
-
-	export function capitano(tool: 'balena-cli'): CommandDefinition;
-
-	export interface LocalBalenaOsDevice {
-		address: string;
-		host: string;
-		osVariant: string;
-		port: number;
-	}
-
-	declare namespace forms {
-		export function selectLocalBalenaOsDevice(
-			timeout?: number,
-		): Promise<string>;
-	}
-
-	declare namespace discover {
-		export function discoverLocalBalenaOsDevices(
-			timeout?: number,
-		): Promise<LocalBalenaOsDevice[]>;
-	}
-}