v22.1.1

Deploy: Limit the submitted error_message of images that fail to build to 300K characters

.eslintignore

@@ -1,2 +0,0 @@
-/completion/*
-/bin/*

.eslintrc.js

@@ -1,21 +0,0 @@
-module.exports = {
-	extends: ['./node_modules/@balena/lint/config/.eslintrc.js'],
-	parserOptions: {
-		project: 'tsconfig.dev.json',
-	},
-	root: true,
-	rules: {
-		ignoreDefinitionFiles: 0,
-		// to avoid the `warning  Forbidden non-null assertion  @typescript-eslint/no-non-null-assertion`
-		'@typescript-eslint/no-non-null-assertion': 'off',
-		'@typescript-eslint/no-shadow': 'off',
-		'@typescript-eslint/no-var-requires': 'off',
-		'no-restricted-imports': [
-			'error',
-			{
-				paths: ['resin-cli-visuals', 'chalk', 'common-tags', 'resin-cli-form'],
-			},
-		],
-		'@typescript-eslint/no-unused-vars': ['error', { argsIgnorePattern: '^_' }],
-	},
-};

.github/ISSUE_TEMPLATE.md

@@ -67,7 +67,7 @@ fixed it.
 - **Cloud backend: openBalena or balenaCloud?** If unsure, it will be balenaCloud
 - **Operating system version:** e.g. Windows 10, Ubuntu 18.04, macOS 10.14.5
 - **32/64 bit OS and processor:** e.g. 32-bit Windows on 64-bit Intel processor
-- **Install method:** npm or zip package or executable installer
+- **Install method:** npm or standalone package or executable installer
 - **If npm install, Node.js and npm version:** e.g. Node v8.16.0 and npm v6.4.1
 
 # Additional References

.github/actions/publish/action.yml

@@ -18,7 +18,7 @@ inputs:
     default: 'accounts+apple@balena.io'
   NODE_VERSION:
     type: string
-    default: '20.x'
+    default: '22.x'
   VERBOSE:
     type: string
     default: 'true'
@@ -28,7 +28,7 @@ runs:
   using: 'composite'
   steps:
     - name: Download custom source artifact
-      uses: actions/download-artifact@f44cd7b40bfd40b6aa1cc1b9b5b7bf03d3c67110 # v4.1.0
+      uses: actions/download-artifact@cc203385981b70ca67e1cc392babf9cc229d5806 # v4.1.9
       with:
         name: custom-${{ github.event.pull_request.head.sha || github.event.head_commit.id }}-${{ runner.os }}-${{ runner.arch }}
         path: ${{ runner.temp }}
@@ -39,11 +39,17 @@ runs:
       run: tar -xf ${{ runner.temp }}/custom.tgz
 
     - name: Setup Node.js
-      uses: actions/setup-node@v3
+      uses: actions/setup-node@cdca7365b2dadb8aad0a33bc7601856ffabcc48e # v4
       with:
         node-version: ${{ inputs.NODE_VERSION }}
         cache: npm
 
+    - name: Set up Python 3.11
+      if: runner.os == 'macOS'
+      uses: actions/setup-python@65d7f2d534ac1bc67fcd62888c5f4f3d2cb2b236 # v4
+      with:
+        python-version: '3.11'
+
     - name: Install additional tools
       if: runner.os == 'Windows'
       shell: bash
@@ -60,7 +66,7 @@ runs:
     # https://github.com/Apple-Actions/import-codesign-certs
     - name: Import Apple code signing certificate
       if: runner.os == 'macOS'
-      uses: apple-actions/import-codesign-certs@v1
+      uses: apple-actions/import-codesign-certs@8f3fb608891dd2244cdab3d69cd68c0d37a7fe93 # v2
       with:
         p12-file-base64: ${{ fromJSON(inputs.secrets).APPLE_SIGNING }}
         p12-password: ${{ fromJSON(inputs.secrets).APPLE_SIGNING_PASSWORD }}
@@ -69,18 +75,11 @@ runs:
       if: runner.os == 'Windows'
       shell: powershell
       run: |
-        Set-Content -Path ${{ runner.temp }}/certificate.base64 -Value $env:WINDOWS_CERTIFICATE
-        certutil -decode ${{ runner.temp }}/certificate.base64 ${{ runner.temp }}/certificate.pfx
+        Set-Content -Path ${{ runner.temp }}/certificate.base64 -Value $env:SM_CLIENT_CERT_FILE_B64
+        certutil -decode ${{ runner.temp }}/certificate.base64 ${{ runner.temp }}/Certificate_pkcs12.p12
         Remove-Item -path ${{ runner.temp }} -include certificate.base64
-
-        Import-PfxCertificate `
-          -FilePath ${{ runner.temp }}/certificate.pfx `
-          -CertStoreLocation Cert:\CurrentUser\My `
-          -Password (ConvertTo-SecureString -String $env:WINDOWS_CERTIFICATE_PASSWORD -Force -AsPlainText)
-
       env:
-        WINDOWS_CERTIFICATE: ${{ fromJSON(inputs.secrets).WINDOWS_SIGNING }}
-        WINDOWS_CERTIFICATE_PASSWORD: ${{ fromJSON(inputs.secrets).WINDOWS_SIGNING_PASSWORD }}
+        SM_CLIENT_CERT_FILE_B64: ${{ fromJSON(inputs.secrets).SM_CLIENT_CERT_FILE_B64 }}
 
     # https://github.com/product-os/scripts/tree/master/shared
     # https://github.com/product-os/balena-concourse/blob/master/pipelines/github-events/template.yml
@@ -95,17 +94,26 @@ runs:
         runner_arch="$(echo "${RUNNER_ARCH}" | tr '[:upper:]' '[:lower:]')"
 
         if [[ $runner_os =~ darwin|macos|osx ]]; then
-            CSC_KEY_PASSWORD=${{ fromJSON(inputs.secrets).APPLE_SIGNING_PASSWORD }}
+            CSC_KEY_PASSWORD='${{ fromJSON(inputs.secrets).APPLE_SIGNING_PASSWORD }}'
             CSC_KEYCHAIN=signing_temp
             CSC_LINK=${{ fromJSON(inputs.secrets).APPLE_SIGNING }}
 
         elif [[ $runner_os =~ windows|win ]]; then
-            CSC_KEY_PASSWORD=${{ fromJSON(inputs.secrets).WINDOWS_SIGNING_PASSWORD }}
-            CSC_LINK='${{ runner.temp }}\certificate.pfx'
+            SM_HOST=${{ fromJSON(inputs.secrets).SM_HOST }}
+            SM_API_KEY=${{ fromJSON(inputs.secrets).SM_API_KEY }}
+            SM_CLIENT_CERT_FILE='${{ runner.temp }}\Certificate_pkcs12.p12'
+            SM_CLIENT_CERT_PASSWORD=${{ fromJSON(inputs.secrets).SM_CLIENT_CERT_PASSWORD }}
+            SM_CODE_SIGNING_CERT_SHA1_HASH=${{ fromJSON(inputs.secrets).SM_CODE_SIGNING_CERT_SHA1_HASH }}
 
-            # patches/all/oclif.patch
-            MSYSSHELLPATH="$(which bash)"
-            MSYSTEM=MSYS
+            curl --silent --retry 3 --fail https://one.digicert.com/signingmanager/api-ui/v1/releases/smtools-windows-x64.msi/download \
+              -H "x-api-key:$SM_API_KEY" \
+              -o smtools-windows-x64.msi
+            msiexec -i smtools-windows-x64.msi -qn
+            PATH="/c/Program Files/DigiCert/DigiCert One Signing Manager Tools:${PATH}"
+            smksp_registrar.exe list
+            smctl.exe keypair ls
+            smctl.exe windows certsync
+            /c/Windows/System32/certutil.exe -csp "DigiCert Signing Manager KSP" -key -user
 
             # (signtool.exe) https://github.com/actions/runner-images/blob/main/images/win/Windows2019-Readme.md#installed-windows-sdks
             PATH="/c/Program Files (x86)/Windows Kits/10/bin/${runner_arch}:${PATH}"
@@ -119,17 +127,19 @@ runs:
         # https://github.blog/2020-08-03-github-actions-improvements-for-fork-and-pull-request-workflows/#improvements-for-public-repository-forks
         # https://docs.github.com/en/actions/managing-workflow-runs/approving-workflow-runs-from-public-forks#about-workflow-runs-from-public-forks
         CSC_FOR_PULL_REQUEST: true
-        # https://sectigo.com/resource-library/time-stamping-server
-        TIMESTAMP_SERVER: http://timestamp.sectigo.com
+        # https://docs.digicert.com/es/software-trust-manager/ci-cd-integrations/plugins/github-custom-action-for-keypair-signing.html
+        TIMESTAMP_SERVER: http://timestamp.digicert.com
         # Apple notarization (automation/build-bin.ts)
         XCODE_APP_LOADER_EMAIL: ${{ inputs.XCODE_APP_LOADER_EMAIL }}
         XCODE_APP_LOADER_PASSWORD: ${{ fromJSON(inputs.secrets).XCODE_APP_LOADER_PASSWORD }}
         XCODE_APP_LOADER_TEAM_ID: ${{ inputs.XCODE_APP_LOADER_TEAM_ID }}
 
     - name: Upload artifacts
-      uses: actions/upload-artifact@c7d193f32edcb7bfad88892161225aeda64e9392 # v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
       with:
         name: gh-release-${{ github.event.pull_request.head.sha || github.event.head_commit.id }}-${{ strategy.job-index }}
-        path: dist
+        path: |
+          dist
+          !dist/balena
         retention-days: 1
         if-no-files-found: error

.github/actions/test/action.yml

@@ -15,7 +15,7 @@ inputs:
   # --- custom environment
   NODE_VERSION:
     type: string
-    default: '20.x'
+    default: '22.x'
   VERBOSE:
     type: string
     default: "true"
@@ -26,14 +26,14 @@ runs:
   steps:
     # https://github.com/actions/setup-node#caching-global-packages-data
     - name: Setup Node.js
-      uses: actions/setup-node@v3
+      uses: actions/setup-node@cdca7365b2dadb8aad0a33bc7601856ffabcc48e # v4
       with:
         node-version: ${{ inputs.NODE_VERSION }}
         cache: npm
 
     - name: Set up Python 3.11
       if: runner.os == 'macOS'
-      uses: actions/setup-python@d27e3f3d7c64b4bbf8e4abfb9b63b83e846e0435 # v4
+      uses: actions/setup-python@65d7f2d534ac1bc67fcd62888c5f4f3d2cb2b236 # v4
       with:
         python-version: "3.11"
 
@@ -58,7 +58,7 @@ runs:
       run: tar --exclude-vcs -acf ${{ runner.temp }}/custom.tgz .
 
     - name: Upload custom artifact
-      uses: actions/upload-artifact@c7d193f32edcb7bfad88892161225aeda64e9392 # v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
       with:
         name: custom-${{ github.event.pull_request.head.sha || github.event.head_commit.id }}-${{ runner.os }}-${{ runner.arch }}
         path: ${{ runner.temp }}/custom.tgz

.github/renovate.json

@@ -0,0 +1,4 @@
+{
+	"extends": ["github>balena-io/renovate-config"],
+	"postUpdateOptions": ["npmDedupe"]
+}

.github/workflows/flowzone.yml

@@ -21,6 +21,25 @@ jobs:
       )
     secrets: inherit
     with:
-      custom_runs_on: '[["self-hosted","Linux","distro:focal","X64"],["self-hosted","Linux","distro:focal","ARM64"],["macos-12"],["windows-2019"]]'
+      custom_test_matrix: >
+        {
+          "os": [
+            ["self-hosted", "X64"],
+            ["self-hosted", "ARM64"],
+            ["macos-13"],
+            ["windows-2019"],
+            ["macos-latest-xlarge"]
+          ]
+        }
+      custom_publish_matrix: >
+        {
+          "os": [
+            ["self-hosted", "X64"],
+            ["self-hosted", "ARM64"],
+            ["macos-13"],
+            ["windows-2019"],
+            ["macos-latest-xlarge"]
+          ]
+        }
       github_prerelease: false
       restrict_custom_actions: false

.husky/pre-commit

@@ -0,0 +1 @@
+node automation/check-npm-version.js && ts-node automation/check-doc.ts

.mocharc.js

@@ -2,7 +2,7 @@ module.exports = {
 	reporter: 'spec',
 	require: 'ts-node/register/transpile-only',
 	file: './tests/config-tests',
-	timeout: 12000,
+	timeout: 48000,
 	// To test only, say, 'push.spec.ts', do it as follows so that
 	// requests are authenticated:
 	// spec: ['tests/auth/*.spec.ts', 'tests/**/deploy.spec.ts'],

CONTRIBUTING.md

@@ -14,7 +14,7 @@ The balena CLI is an open source project and your contribution is welcome!
 In order to ease development:
 
 * `npm run build:fast` skips some of the build steps for interactive testing, or
-* `npm run test:source` skips testing the standalone zip packages (which is rather slow)
+* `npm run test:source` skips testing the standalone packages (which is rather slow)
 * `./bin/balena-dev` uses `ts-node/register` to transpile on the fly.
 
 Before opening a PR, test your changes with `npm test`. Keep compatibility in mind, as the CLI is
@@ -115,9 +115,9 @@ The content sources for the auto generation of `docs/balena-cli.md` are:
 * [Selected
   sections](https://github.com/balena-io/balena-cli/blob/v12.23.0/automation/capitanodoc/capitanodoc.ts#L199-L204)
   of the README file.
-* The CLI's command documentation in source code (`lib/commands/` folder), for example:
-  * `lib/commands/push.ts`
-  * `lib/commands/env/add.ts`
+* The CLI's command documentation in source code (`src/commands/` folder), for example:
+  * `src/commands/push.ts`
+  * `src/commands/env/add.ts`
 
 The README file is manually edited, but subsections are automatically extracted for inclusion in
 `docs/balena-cli.md` by the `getCapitanoDoc()` function in
@@ -133,7 +133,6 @@ To add a new command to be documented,
 1. Find the resource which it is part of or create a new one. 
 2. List the location of the build file 
 3. Make sure to add your files in alphabetical order
-4. Resources with plural names needs to have 2 sections if they have commands like: "fleet, fleets" or "device, devices" or "tag, tags"
 
 Once added, run the command `npm run build` to generate the documentation
 
@@ -224,7 +223,7 @@ command, or by manually editing or copying files to the `node_modules` folder.
 
 Unexpected behavior may then be observed because of the CLI's use of the
 [fast-boot2](https://www.npmjs.com/package/fast-boot2) package that caches module resolution.
-`fast-boot2` is configured in `lib/fast-boot.ts` to automatically invalidate the cache if
+`fast-boot2` is configured in `src/fast-boot.ts` to automatically invalidate the cache if
 changes are made to the `package.json` or `npm-shrinkwrap.json` files, but the cache won't
 be automatically invalidated if `npm link` is used or if manual modifications are made to the
 `node_modules` folder. In this situation:

INSTALL-ADVANCED.md

@@ -8,8 +8,8 @@ There are 3 options to choose from to install balena's CLI:
 
 * [Executable Installer](#executable-installer): the easiest method on Windows and macOS, using the
   traditional graphical desktop application installers.
-* [Standalone Zip Package](#standalone-zip-package): these are plain zip files with the balena CLI
-  executable in them: extract and run. Available for all platforms: Linux, Windows, macOS.
+* [Standalone tar.gz Package](#standalone-targz-package): these are plain tar.gz files with the balena CLI
+  bundled within. Available for all platforms: Linux, Windows, macOS.
   Recommended also for scripted installation in CI (continuous integration) environments.
 * [NPM Installation](#npm-installation): recommended for Node.js developers who may be interested
   in integrating the balena CLI in their existing projects or workflow.
@@ -30,9 +30,9 @@ instructions:
 > If you would like to use WSL, follow the [installations instructions for
 > Linux](./INSTALL-LINUX.md) rather than Windows, as WSL consists of a Linux environment.
 
-If you had previously installed the CLI using a standalone zip package, it may be a good idea to
+If you had previously installed the CLI using a standalone tar package, it may be a good idea to
 check your system's `PATH` environment variable for duplicate entries, as the terminal will use the
-entry that comes first. Check the [Standalone Zip Package](#standalone-zip-package) instructions
+entry that comes first. Check the [Standalone tar.gz Package](#standalone-targz-package) instructions
 for how to modify the PATH variable.
 
 By default, the CLI is installed to the following folders:
@@ -40,20 +40,19 @@ By default, the CLI is installed to the following folders:
 OS  | Folders
 --- | ---
 Windows: | `C:\Program Files\balena-cli\`
-macOS:   | `/usr/local/lib/balena-cli/` <br> `/usr/local/bin/balena`
+macOS:   | `/usr/local/src/balena-cli/` <br> `/usr/local/bin/balena`
 
-## Standalone Zip Package
+## Standalone tar.gz Package
 
-1. Download the latest zip file from the [releases page](https://github.com/balena-io/balena-cli/releases).
+1. Download the latest tar.gz file from the [releases page](https://github.com/balena-io/balena-cli/releases).
    Look for a file name that ends with the word "standalone", for example:  
-   `balena-cli-vX.Y.Z-linux-x64-standalone.zip`  ← _also for the Windows Subsystem for Linux_  
-   `balena-cli-vX.Y.Z-macOS-x64-standalone.zip`  
-   `balena-cli-vX.Y.Z-windows-x64-standalone.zip`
+   `balena-cli-vX.Y.Z-linux-x64-standalone.tar.gz`  ← _also for the Windows Subsystem for Linux_  
+   `balena-cli-vX.Y.Z-macOS-x64-standalone.tar.gz`
+   `balena-cli-vX.Y.Z-windows-x64-standalone.tar.gz`
 
-2. Extract the zip file contents to any folder you choose. The extracted contents will include a
-   `balena-cli` folder.
+2. Extract the tar.gz file contents to any folder you choose. The extracted contents will be a `balena` folder containing a `bin` subdirectory.
 
-3. Add the `balena-cli` folder to the system's `PATH` environment variable.  
+3. Add the `balena/bin` folder to the system's `PATH` environment variable.
    See instructions for:
    [Linux](https://stackoverflow.com/questions/14637979/how-to-permanently-set-path-on-linux-unix) |
    [macOS](https://www.architectryan.com/2012/10/02/add-to-the-path-on-mac-os-x-mountain-lion/#.Uydjga1dXDg) |
@@ -61,14 +60,14 @@ macOS:   | `/usr/local/lib/balena-cli/` <br> `/usr/local/bin/balena`
 
 > * If you are using macOS 10.15 or later (Catalina, Big Sur), [check this known issue and
 >   workaround](https://github.com/balena-io/balena-cli/issues/2244).
-> * **Linux Alpine** and **Busybox:** the standalone zip package is not currently compatible with
+> * **Linux Alpine** and **Busybox:** the standalone tar.gz package is not currently compatible with
 >   these "compact" Linux distributions, because of the alternative C libraries they ship with.
 >   For these, consider the [NPM Installation](#npm-installation) option.
-> * Note that moving the `balena` executable out of the extracted `balena-cli` folder on its own
+> * Note that moving the `balena/bin/balena` executable out of the extracted `balena` folder on its own
 >   (e.g. moving it to `/usr/local/bin/balena`) will **not** work, as it depends on the other
->   folders and files also present in the `balena-cli` folder.
+>   folders and files also present in the `balena` folder.
 
-To update the CLI to a new version, download a new release zip file and replace the previous
+To update the CLI to a new version, download a new release tar.gz file and replace the previous
 installation folder. To uninstall, simply delete the folder and edit the PATH environment variable
 as described above.
 
@@ -78,8 +77,8 @@ If you are a Node.js developer, you may wish to install the balena CLI via [npm]
 The npm installation involves building native (platform-specific) binary modules, which require
 some development tools to be installed first, as follows.
 
-> **The balena CLI currently requires Node.js version 20.**
-> **Versions 21 and later are not yet fully supported.**
+> **The balena CLI currently requires Node.js version >=20.6.0**
+> **Versions 23 and later are not yet fully supported.**
 
 ### Install development tools
 
@@ -89,7 +88,7 @@ some development tools to be installed first, as follows.
 $ sudo apt-get update && sudo apt-get -y install curl python3 git make g++
 $ curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.38.0/install.sh | bash
 $ . ~/.bashrc
-$ nvm install 20
+$ nvm install 22
 ```
 
 The `curl` command line above uses
@@ -106,7 +105,7 @@ recommended.
 ```sh
 $ curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.38.0/install.sh | bash
 $ . ~/.bashrc
-$ nvm install 20
+$ nvm install 22
 ```
 
 #### **Windows** (not WSL)
@@ -114,7 +113,7 @@ $ nvm install 20
 Install:
 
   * If you'd like the ability to switch between Node.js versions, install
-- Node.js v20 from the [Nodejs.org releases page](https://nodejs.org/en/download/releases/).
+- Node.js v22 from the [Nodejs.org releases page](https://nodejs.org/en/download/releases/).
     [nvm-windows](https://github.com/coreybutler/nvm-windows#node-version-manager-nvm-for-windows)
     instead.
 * The [MSYS2 shell](https://www.msys2.org/), which provides `git`, `make`, `g++` and more:
@@ -145,7 +144,7 @@ container) in order to allow npm scripts like `postinstall` to be executed.
 
 ## Additional Dependencies
 
-The `balena ssh`, `scan`, `build`, `deploy` and `preload` commands may require
+The `balena device ssh`, `device detect`, `build`, `deploy` and `preload` commands may require
 additional software to be installed. Check the Additional Dependencies sections for each operating
 system:
 

INSTALL-LINUX.md

@@ -8,15 +8,15 @@ method.
 
 Selected operating system: **Linux**
 
-1. Download the latest zip file from the [latest release
+1. Download the latest tar.gz file from the [latest release
    page](https://github.com/balena-io/balena-cli/releases/latest). Look for a file name that ends
-   with "-standalone.zip", for example:  
-   `balena-cli-vX.Y.Z-linux-x64-standalone.zip`
+   with "-standalone.tar.gz", for example:  
+   `balena-cli-vX.Y.Z-linux-x64-standalone.tar.gz`
 
-2. Extract the zip file contents to any folder you choose, for example `/home/james`.
-   The extracted contents will include a `balena-cli` folder.
+2. Extract the tar.gz file contents to any folder you choose, for example `/home/james`.
+   The extracted contents will include a `balena/bin` folder.
 
-3. Add that folder (e.g. `/home/james/balena-cli`) to the `PATH` environment variable.
+3. Add that folder (e.g. `/home/james/balena/bin`) to the `PATH` environment variable.
    Check this [StackOverflow
    post](https://stackoverflow.com/questions/14637979/how-to-permanently-set-path-on-linux-unix)
    for instructions. Close and reopen the terminal window so that the changes to `PATH`
@@ -27,13 +27,13 @@ Selected operating system: **Linux**
    * `balena version` - should print the CLI's version
    * `balena help` - should print a list of available commands
 
-To update the balena CLI to a new version, download a new release zip file and replace the previous
+To update the balena CLI to a new version, download a new release tar.gz file and replace the previous
 installation folder. To uninstall, simply delete the folder and edit the PATH environment variable
 as described above.
 
 ## sudo configuration
 
-A few CLI commands require execution through sudo, e.g. `sudo balena scan`.  
+A few CLI commands require execution through sudo, e.g. `sudo balena device detect`.  
 If your Linux distribution has an `/etc/sudoers` file that defines a `secure_path`
 setting, run `sudo visudo` to edit it and add the balena CLI's installation folder to
 the ***pre-existing*** `secure_path` setting, for example:
@@ -61,19 +61,19 @@ instructions](https://docs.docker.com/install/overview/) to install Docker on th
 workstation as the balena CLI. The [advanced installation
 options](./INSTALL-ADVANCED.md#additional-dependencies) document describes other possibilities.
 
-### balena ssh
+### balena device ssh
 
-The `balena ssh` command requires the `ssh` command-line tool to be available. Most Linux
+The `balena device ssh` command requires the `ssh` command-line tool to be available. Most Linux
 distributions will already have it installed. Otherwise, `sudo apt-get install openssh-client`
 should do the trick on Debian or Ubuntu.
 
-The `balena ssh` command also requires an SSH key to be added to your balena account: see [SSH
+The `balena device ssh` command also requires an SSH key to be added to your balena account: see [SSH
 Access documentation](https://www.balena.io/docs/learn/manage/ssh-access/). The `balena key*`
 command set can also be used to list and manage SSH keys: see `balena help -v`.
 
-### balena scan
+### balena device detect
 
-The `balena scan` command requires a multicast DNS (mDNS) service like
+The `balena device detect` command requires a multicast DNS (mDNS) service like
 [Avahi](https://en.wikipedia.org/wiki/Avahi_(software)), which is installed by default on most
 desktop Linux distributions. Otherwise, on Debian or Ubuntu, the installation command would be
 `sudo apt-get install avahi-daemon`.

INSTALL-MAC.md

@@ -7,8 +7,8 @@ Selected operating system: **macOS**
 
 1. Download the installer from the [latest release
    page](https://github.com/balena-io/balena-cli/releases/latest).
-   Look for a file name that ends with "-installer.pkg":  
-   `balena-cli-vX.Y.Z-macOS-x64-installer.pkg`  
+   Look for a file name that ends with "-installer.pkg":
+   `balena-cli-vX.Y.Z-macOS-x64-installer.pkg`
 
 2. Double click on the downloaded file to run the installer and follow the installer's
    instructions.
@@ -19,7 +19,7 @@ Selected operating system: **macOS**
    - On the terminal prompt, type `balena version` and hit Enter. It should display
      the version of the balena CLI that you have installed.
 
-No further steps are required to run most CLI commands. The `balena ssh`, `build`, `deploy`
+No further steps are required to run most CLI commands. The `balena device ssh`, `build`, `deploy`
 and `preload` commands may require additional software to be installed, as described
 in the next section.
 
@@ -27,7 +27,7 @@ To update the balena CLI, repeat the steps above for the new version.
 To uninstall it, run the following command on a terminal prompt:
 
 ```text
-sudo /usr/local/lib/balena-cli/bin/uninstall
+sudo /usr/local/src/balena-cli/bin/uninstall
 ```
 
 ## Additional Dependencies
@@ -41,9 +41,9 @@ instructions](https://docs.docker.com/install/overview/) to install Docker on th
 workstation as the balena CLI. The [advanced installation
 options](./INSTALL-ADVANCED.md#additional-dependencies) document describes other possibilities.
 
-### balena ssh
+### balena device ssh
 
-The `balena ssh` command requires the `ssh` command-line tool to be available. To check whether
+The `balena device ssh` command requires the `ssh` command-line tool to be available. To check whether
 it is already installed, run `ssh` on a Terminal window. If it is not yet installed, the options
 include:
 
@@ -52,7 +52,7 @@ include:
   Components → Command Line Tools → Install.
 * Or, install [Homebrew](https://brew.sh/), then `brew install openssh`
 
-The `balena ssh` command also requires an SSH key to be added to your balena account: see [SSH
+The `balena device ssh` command also requires an SSH key to be added to your balena account: see [SSH
 Access documentation](https://www.balena.io/docs/learn/manage/ssh-access/). The `balena key*`
 command set can also be used to list and manage SSH keys: see `balena help -v`.
 

INSTALL-WINDOWS.md

@@ -8,7 +8,7 @@ Selected operating system: **Windows**
 1. Download the installer from the [latest release
    page](https://github.com/balena-io/balena-cli/releases/latest).
    Look for a file name that ends with "-installer.exe":  
-   `balena-cli-vX.Y.Z-windows-x64-installer.exe`  
+   `balena-cli-vX.Y.Z-windows-x64-installer.exe`
 
 2. Double click on the downloaded file to run the installer and follow the installer's
    instructions.
@@ -19,7 +19,7 @@ Selected operating system: **Windows**
    - On the command prompt, type `balena version` and hit Enter. It should display
      the version of the balena CLI that you have installed.
 
-No further steps are required to run most CLI commands. The `balena ssh`, `scan`, `build`,
+No further steps are required to run most CLI commands. The `balena device ssh`, `device detect`, `build`,
 `deploy` and `preload` commands may require additional software to be installed, as
 described below.
 
@@ -34,9 +34,9 @@ instructions](https://docs.docker.com/install/overview/) to install Docker on th
 workstation as the balena CLI. The [advanced installation
 options](./INSTALL-ADVANCED.md#additional-dependencies) document describes other possibilities.
 
-### balena ssh
+### balena device ssh
 
-The `balena ssh` command requires the `ssh` command-line tool to be available. Microsoft started
+The `balena device ssh` command requires the `ssh` command-line tool to be available. Microsoft started
 distributing an SSH client with Windows 10, which is automatically installed through Windows
 Update. To check whether it is installed, run `ssh` on a Windows Command Prompt or PowerShell. It
 can also be [manually
@@ -44,13 +44,13 @@ installed](https://docs.microsoft.com/en-us/windows-server/administration/openss
 if needed. For older versions of Windows, there are several ssh/OpenSSH clients provided by 3rd
 parties.
 
-The `balena ssh` command also requires an SSH key to be added to your balena account: see [SSH
+The `balena device ssh` command also requires an SSH key to be added to your balena account: see [SSH
 Access documentation](https://www.balena.io/docs/learn/manage/ssh-access/). The `balena key*`
 command set can also be used to list and manage SSH keys: see `balena help -v`.
 
-### balena scan
+### balena device detect
 
-The `balena scan` command requires a multicast DNS (mDNS) service like Apple's Bonjour.
+The `balena device detect` command requires a multicast DNS (mDNS) service like Apple's Bonjour.
 Many Windows machines will already have this service installed, as it is bundled in popular
 applications such as Skype (Wikipedia lists [several others](https://en.wikipedia.org/wiki/Bonjour_(software))).
 Otherwise, Bonjour for Windows can be downloaded and installed from: https://support.apple.com/kb/DL999

MIGRATIONS.md

@@ -0,0 +1,45 @@
+## Migrating to balena CLI v22
+
+This guide outlines the changes introduced in balena CLI v22 and provides instructions for when and how to migrate.
+
+---
+
+### For Installer Users (Windows .exe, macOS .pkg)
+
+If you are using the Windows executable (.exe) or macOS package (.pkg) installers, **no changes** are required for this update. You can continue to use the installers as before.
+
+---
+
+### For npm Installation Users
+
+If you installed balena CLI via npm, **no changes** are required for this update. Your existing installation and update process remains the same.
+
+---
+
+### For Standalone Installation Users
+
+Users of the standalone balena CLI will need to make the following adjustments:
+
+1.  **Archive Format Change**: The distribution archive format has changed from `.zip` to `.tar.gz`. You will need to use the `tar` command instead of `unzip` to extract the CLI.
+
+    * **Previous command (v21.x.x and older):**
+        ```bash
+        unzip balena-cli-v21.1.12-linux-x64-standalone.zip
+        ```
+    * **New command (v22.0.0 and newer):**
+        ```bash
+        tar -xzf balena-cli-v22.0.0-linux-x64-standalone.tar.gz
+        ```
+
+2.  **Executable Path Change**: The path to the balena CLI executable within the extracted folder has been updated.
+
+    * **Previous path (v21.x.x and older):**
+        ```
+        balena-cli/balena
+        ```
+    * **New path (v22.0.0 and newer):**
+        ```
+        balena/bin/balena
+        ```
+
+Please update your scripts and any aliases to reflect these changes if you are using the standalone version.

README.md

@@ -20,6 +20,8 @@ GitHub](https://github.com/balena-io/balena-cli/), and your contribution is also
 Check the [balena CLI installation instructions on
 GitHub](https://github.com/balena-io/balena-cli/blob/master/INSTALL.md).
 
+Note for v22 Migration: If you are upgrading to balena CLI v22 from a previous standalone installation, please [see the v22 Migration Guide](https://github.com/balena-io/balena-cli/blob/master/MIGRATIONS.md) for installation changes.
+
 ## Choosing a shell (command prompt/terminal)
 
 On **Windows,** the standard Command Prompt (`cmd.exe`) and
@@ -88,9 +90,9 @@ HTTP(S) proxies can be configured through any of the following methods, in prece
 * The `HTTPS_PROXY` and/or `HTTP_PROXY` environment variables, in the same URL format as
   `BALENARC_PROXY`.
 
-### Proxy setup for balena ssh
+### Proxy setup for balena device ssh
 
-In order to work behind a proxy server, the `balena ssh` command requires the
+In order to work behind a proxy server, the `balena device ssh` command requires the
 [`proxytunnel`](http://proxytunnel.sourceforge.net/) package (command-line tool) to be installed.
 `proxytunnel` is available for Linux distributions like Ubuntu/Debian (`apt install proxytunnel`),
 and for macOS through [Homebrew](https://brew.sh/). Windows support is limited to the [Windows
@@ -110,7 +112,7 @@ The `BALENARC_NO_PROXY` variable may be used to exclude specified destinations f
 > * This feature requires CLI version 11.30.8 or later. In the case of the npm [installation
 >   option](https://github.com/balena-io/balena-cli/blob/master/INSTALL.md), it also requires
 >   Node.js version 10.16.0 or later.
-> * To exclude a `balena ssh` target from proxying (IP address or `.local` hostname), the
+> * To exclude a `balena device ssh` target from proxying (IP address or `.local` hostname), the
 >   `--noproxy` option should be specified in addition to the `BALENARC_NO_PROXY` variable.
 
 By default (if `BALENARC_NO_PROXY` is not defined), all [private IPv4

TROUBLESHOOTING.md

@@ -31,7 +31,7 @@ command again.
 
 Check whether the SD card is locked (a physical switch on the side of the card).
 
-## I get `connect ETIMEDOUT` with `balena tunnel`
+## I get `connect ETIMEDOUT` with `balena device tunnel`
 
 Please update the CLI to the latest version. This issue was fixed in v12.38.5.
 For more details, see: https://github.com/balena-io/balena-cli/issues/2172
@@ -79,10 +79,10 @@ Try resetting the ownership by running:
 $ sudo chown -R <user> $HOME/.balena
 ```
 
-## Broken line wrapping / cursor behavior with `balena ssh`
+## Broken line wrapping / cursor behavior with `balena device ssh`
 
 Users sometimes come across broken line wrapping or cursor behavior in text terminals, for example
-when long command lines are typed in a `balena ssh` session, or when using text editors like `vim`
+when long command lines are typed in a `balena device ssh` session, or when using text editors like `vim`
 or `nano`. This is not something specific to the balena CLI, being also a commonly reported issue
 with standard remote terminal tools like `ssh` or `telnet`.  It is often a remote shell
 configuration issue (files like `/etc/profile`, `~/.bash_profile`, `~/.bash_login`, `~/.profile`
@@ -115,7 +115,7 @@ If nothing seems to help, consider also using a different client-side terminal a
 ## "Docker seems to be unavailable" error when using Windows Subsystem for Linux (WSL)
 
 When running on WSL, the recommendation is to install a CLI release for Linux, like the standalone
-zip package for Linux. However, commands like "balena build" will, by default, attempt to reach the
+tar.gz package for Linux. However, commands like "balena build" will, by default, attempt to reach the
 Docker daemon at the Unix socket path `/var/run/docker.sock`, while Docker Desktop for Windows uses
 a Windows named pipe at `//./pipe/docker_engine` (which the Linux CLI on WSL cannot use). A
 solution is:

automation/build-bin.ts

@@ -15,32 +15,21 @@
  * limitations under the License.
  */
 
-import type { JsonVersions } from '../lib/commands/version/index';
-
 import { run as oclifRun } from '@oclif/core';
-import * as archiver from 'archiver';
-import * as Bluebird from 'bluebird';
-import { execFile } from 'child_process';
-import * as filehound from 'filehound';
-import { Stats } from 'fs';
+import { exec, execFile } from 'child_process';
+import type { Stats } from 'fs';
 import * as fs from 'fs-extra';
 import * as klaw from 'klaw';
 import * as path from 'path';
 import * as rimraf from 'rimraf';
-import * as semver from 'semver';
 import { promisify } from 'util';
 import { notarize } from '@electron/notarize';
 
-import { stripIndent } from '../build/utils/lazy';
-import {
-	diffLines,
-	loadPackageJson,
-	ROOT,
-	StdOutTap,
-	whichSpawn,
-} from './utils';
+import { loadPackageJson, ROOT, whichSpawn } from './utils';
 
 const execFileAsync = promisify(execFile);
+const execAsync = promisify(exec);
+const rimrafAsync = promisify(rimraf);
 
 export const packageJSON = loadPackageJson();
 export const version = 'v' + packageJSON.version;
@@ -54,15 +43,13 @@ interface PathByPlatform {
 	[platform: string]: string;
 }
 
-const standaloneZips: PathByPlatform = {
-	linux: dPath(`balena-cli-${version}-linux-${arch}-standalone.zip`),
-	darwin: dPath(`balena-cli-${version}-macOS-${arch}-standalone.zip`),
-	win32: dPath(`balena-cli-${version}-windows-${arch}-standalone.zip`),
-};
-
-const oclifInstallers: PathByPlatform = {
-	darwin: dPath('macos', `balena-${version}.pkg`),
-	win32: dPath('win32', `balena-${version}-${arch}.exe`),
+const getOclifInstallersOriginalNames = async (): Promise<PathByPlatform> => {
+	const { stdout } = await execAsync('git rev-parse --short HEAD');
+	const sha = stdout.trim();
+	return {
+		darwin: dPath('macos', `balena-${version}-${sha}-${arch}.pkg`),
+		win32: dPath('win32', `balena-${version}-${sha}-${arch}.exe`),
+	};
 };
 
 const renamedOclifInstallers: PathByPlatform = {
@@ -70,258 +57,30 @@ const renamedOclifInstallers: PathByPlatform = {
 	win32: dPath(`balena-cli-${version}-windows-${arch}-installer.exe`),
 };
 
-export const finalReleaseAssets: { [platform: string]: string[] } = {
-	win32: [standaloneZips['win32'], renamedOclifInstallers['win32']],
-	darwin: [standaloneZips['darwin'], renamedOclifInstallers['darwin']],
-	linux: [standaloneZips['linux']],
+const getOclifStandaloneOriginalNames = async (): Promise<PathByPlatform> => {
+	const { stdout } = await execAsync('git rev-parse --short HEAD');
+	const sha = stdout.trim();
+	return {
+		linux: dPath(`balena-${version}-${sha}-linux-${arch}.tar.gz`),
+		darwin: dPath(`balena-${version}-${sha}-darwin-${arch}.tar.gz`),
+		win32: dPath(`balena-${version}-${sha}-win32-${arch}.tar.gz`),
+	};
 };
 
-/**
- * Given the output of `pkg` as a string (containing warning messages),
- * diff it against previously saved output of known "safe" warnings.
- * Throw an error if the diff is not empty.
- */
-async function diffPkgOutput(pkgOut: string) {
-	const { monochrome } = await import('../tests/helpers');
-	const relSavedPath = path.join(
-		'tests',
-		'test-data',
-		'pkg',
-		`expected-warnings-${process.platform}-${arch}.txt`,
-	);
-	const absSavedPath = path.join(ROOT, relSavedPath);
-	const ignoreStartsWith = [
-		'> pkg@',
-		'> Fetching base Node.js binaries',
-		'  fetched-',
-		'prebuild-install WARN install No prebuilt binaries found',
-	];
-	const modulesRE =
-		process.platform === 'win32'
-			? /(?<=[ '])([A-Z]:)?\\.+?\\node_modules(?=\\)/
-			: /(?<=[ '])\/.+?\/node_modules(?=\/)/;
-	const buildRE =
-		process.platform === 'win32'
-			? /(?<=[ '])([A-Z]:)?\\.+\\build(?=\\)/
-			: /(?<=[ '])\/.+\/build(?=\/)/;
+const renamedOclifStandalone: PathByPlatform = {
+	linux: dPath(`balena-cli-${version}-linux-${arch}-standalone.tar.gz`),
+	darwin: dPath(`balena-cli-${version}-macOS-${arch}-standalone.tar.gz`),
+	win32: dPath(`balena-cli-${version}-windows-${arch}-standalone.tar.gz`),
+};
 
-	const cleanLines = (chunks: string | string[]) => {
-		const lines = typeof chunks === 'string' ? chunks.split('\n') : chunks;
-		return lines
-			.map((line: string) => monochrome(line)) // remove ASCII colors
-			.filter((line: string) => !/^\s*$/.test(line)) // blank lines
-			.filter((line: string) =>
-				ignoreStartsWith.every((i) => !line.startsWith(i)),
-			)
-			.map((line: string) => {
-				// replace absolute paths with relative paths
-				let replaced = line.replace(modulesRE, 'node_modules');
-				if (replaced === line) {
-					replaced = line.replace(buildRE, 'build');
-				}
-				return replaced;
-			});
-	};
-
-	pkgOut = cleanLines(pkgOut).join('\n');
-	const { readFile } = (await import('fs')).promises;
-	const expectedOut = cleanLines(await readFile(absSavedPath, 'utf8')).join(
-		'\n',
-	);
-	if (expectedOut !== pkgOut) {
-		const sep =
-			'================================================================================';
-		const diff = diffLines(expectedOut, pkgOut);
-		const msg = `pkg output does not match expected output from "${relSavedPath}"
-Diff:
-${sep}
-${diff}
-${sep}
-Check whether the new or changed pkg warnings are safe to ignore, then update
-"${relSavedPath}"
-and share the result of your investigation as comments on the pull request.
-Hint: the fix is often a matter of updating the 'pkg.scripts' or 'pkg.assets'
-sections in the CLI's 'package.json' file, or a matter of updating the
-'buildPkg' function in 'automation/build-bin.ts'.  Sometimes it requires
-patching dependencies: See for example 'patches/all/open+7.0.2.patch'.
-${sep}
-`;
-		throw new Error(msg);
+export async function signFilesForNotarization() {
+	console.log('Signing files for notarization');
+	// If signFilesForNotarization is called on the test CI environment (which will not set CSC_LINK)
+	// then we skip the signing process.
+	if (process.platform !== 'darwin' || !process.env.CSC_LINK) {
+		console.log('Skipping signing for notarization');
+		return;
 	}
-}
-
-/**
- * Call `pkg.exec` to generate the standalone zip file, capturing its warning
- * messages (stdout and stderr) in order to call diffPkgOutput().
- */
-async function execPkg(...args: any[]) {
-	const { exec: pkgExec } = await import('@yao-pkg/pkg');
-	const outTap = new StdOutTap(true);
-	try {
-		outTap.tap();
-		await (pkgExec as any)(...args);
-	} catch (err) {
-		outTap.untap();
-		console.log(outTap.stdoutBuf.join(''));
-		console.error(outTap.stderrBuf.join(''));
-		throw err;
-	}
-	outTap.untap();
-	await diffPkgOutput(outTap.allBuf.join(''));
-}
-
-/**
- * Use the 'pkg' module to create a single large executable file with
- * the contents of 'node_modules' and the CLI's javascript code.
- * Also copy a number of native modules (binary '.node' files) that are
- * compiled during 'npm install' to the 'build-bin' folder, alongside
- * the single large executable file created by pkg. (This is necessary
- * because of a pkg limitation that does not allow binary executables
- * to be directly executed from inside another binary executable.)
- */
-async function buildPkg() {
-	// https://github.com/vercel/pkg#targets
-	let targets = `linux-${arch}`;
-	// TBC: not possible to build for macOS or Windows arm64 on x64 nodes
-	if (process.platform === 'darwin') {
-		targets = `macos-x64`;
-	}
-	if (process.platform === 'win32') {
-		targets = `win-x64`;
-	}
-	const args = [
-		'--targets',
-		targets,
-		'--output',
-		'build-bin/balena',
-		'package.json',
-	];
-	console.log('=======================================================');
-	console.log(`execPkg ${args.join(' ')}`);
-	console.log(`cwd="${process.cwd()}" ROOT="${ROOT}"`);
-	console.log('=======================================================');
-
-	await execPkg(args);
-
-	const paths: Array<[string, string[], string[]]> = [
-		// [platform, [source path], [destination path]]
-		['*', ['open', 'xdg-open'], ['xdg-open']],
-		['darwin', ['denymount', 'bin', 'denymount'], ['denymount']],
-	];
-	await Promise.all(
-		paths.map(([platform, source, dest]) => {
-			if (platform === '*' || platform === process.platform) {
-				// eg copy from node_modules/open/xdg-open to build-bin/xdg-open
-				return fs.copy(
-					path.join(ROOT, 'node_modules', ...source),
-					path.join(ROOT, 'build-bin', ...dest),
-				);
-			}
-		}),
-	);
-	const nativeExtensionPaths: string[] = await filehound
-		.create()
-		.paths(path.join(ROOT, 'node_modules'))
-		.ext(['node', 'dll'])
-		.find();
-
-	console.log(`\nCopying to build-bin:\n${nativeExtensionPaths.join('\n')}`);
-
-	await Promise.all(
-		nativeExtensionPaths.map((extPath) =>
-			fs.copy(
-				extPath,
-				extPath.replace(
-					path.join(ROOT, 'node_modules'),
-					path.join(ROOT, 'build-bin'),
-				),
-			),
-		),
-	);
-}
-
-/**
- * Run some basic tests on the built pkg executable.
- * TODO: test more than just `balena version -j`; integrate with the
- * existing mocha/chai CLI command testing.
- */
-async function testPkg() {
-	const pkgBalenaPath = path.join(
-		ROOT,
-		'build-bin',
-		process.platform === 'win32' ? 'balena.exe' : 'balena',
-	);
-	console.log(`Testing standalone package "${pkgBalenaPath}"...`);
-	// Run `balena version -j`, parse its stdout as JSON, and check that the
-	// reported Node.js major version matches semver.major(process.version)
-	let { stdout, stderr } = await execFileAsync(pkgBalenaPath, [
-		'version',
-		'-j',
-	]);
-	const { filterCliOutputForTests } = await import('../tests/helpers');
-	const filtered = filterCliOutputForTests({
-		err: stderr.split(/\r?\n/),
-		out: stdout.split(/\r?\n/),
-	});
-	stdout = filtered.out.join('\n');
-	stderr = filtered.err.join('\n');
-	let pkgNodeVersion = '';
-	let pkgNodeMajorVersion = 0;
-	try {
-		const balenaVersions: JsonVersions = JSON.parse(stdout);
-		pkgNodeVersion = balenaVersions['Node.js'];
-		pkgNodeMajorVersion = semver.major(pkgNodeVersion);
-	} catch (err) {
-		throw new Error(stripIndent`
-			Error parsing JSON output of "balena version -j": ${err}
-			Original output: "${stdout}"`);
-	}
-	if (semver.major(process.version) !== pkgNodeMajorVersion) {
-		throw new Error(
-			`Mismatched major version: built-in pkg Node version="${pkgNodeVersion}" vs process.version="${process.version}"`,
-		);
-	}
-	if (filtered.err.length > 0) {
-		const err = filtered.err.join('\n');
-		throw new Error(`"${pkgBalenaPath}": non-empty stderr "${err}"`);
-	}
-	console.log('Success! (standalone package test successful)');
-}
-
-/**
- * Create the zip file for the standalone 'pkg' bundle previously created
- * by the buildPkg() function in 'build-bin.ts'.
- */
-async function zipPkg() {
-	const outputFile = standaloneZips[process.platform];
-	if (!outputFile) {
-		throw new Error(
-			`Standalone installer unavailable for platform "${process.platform}"`,
-		);
-	}
-	await fs.mkdirp(path.dirname(outputFile));
-	await new Promise((resolve, reject) => {
-		console.log(`Zipping standalone package to "${outputFile}"...`);
-
-		const archive = archiver('zip', {
-			zlib: { level: 7 },
-		});
-		archive.directory(path.join(ROOT, 'build-bin'), 'balena-cli');
-
-		const outputStream = fs.createWriteStream(outputFile);
-
-		outputStream.on('close', resolve);
-		outputStream.on('error', reject);
-
-		archive.on('error', reject);
-		archive.on('warning', console.warn);
-
-		archive.pipe(outputStream);
-		archive.finalize().catch(reject);
-	});
-}
-
-async function signFilesForNotarization() {
 	console.log('Deleting unneeded zip files...');
 	await new Promise((resolve, reject) => {
 		klaw('node_modules/')
@@ -407,20 +166,40 @@ async function signFilesForNotarization() {
 	]);
 }
 
-export async function buildStandaloneZip() {
-	console.log(`Building standalone zip package for CLI ${version}`);
+export async function buildStandalone() {
+	console.log(`Building standalone tarball for CLI ${version}`);
+	fs.rmSync('./tmp', { recursive: true, force: true });
+	fs.rmSync('./dist', { recursive: true, force: true });
+	fs.mkdirSync('./dist');
 	try {
-		await buildPkg();
-		await testPkg();
-		await zipPkg();
-		console.log(`Standalone zip package build completed`);
+		let packOpts = ['-r', ROOT, '--no-xz'];
+		if (process.platform === 'darwin') {
+			packOpts = packOpts.concat('--targets', `darwin-${arch}`);
+		} else if (process.platform === 'win32') {
+			packOpts = packOpts.concat('--targets', 'win32-x64');
+		} else if (process.platform === 'linux') {
+			packOpts = packOpts.concat('--targets', `linux-${arch}`);
+		}
+
+		console.log(`Building oclif installer for CLI ${version}`);
+		const packCmd = `pack:tarballs`;
+		console.log('=======================================================');
+		console.log(`oclif ${packCmd} ${packOpts.join(' ')}`);
+		console.log(`cwd="${process.cwd()}" ROOT="${ROOT}"`);
+		console.log('=======================================================');
+		const oclifPath = path.join(ROOT, 'node_modules', 'oclif');
+		await oclifRun([packCmd].concat(...packOpts), oclifPath);
+		await renameStandalone();
+
+		console.log(`Standalone tarball package build completed`);
 	} catch (error) {
-		console.error(`Error creating or testing standalone zip package`);
+		console.error(`Error creating or testing standalone tarball package`);
 		throw error;
 	}
 }
 
-async function renameInstallerFiles() {
+async function renameInstallers() {
+	const oclifInstallers = await getOclifInstallersOriginalNames();
 	if (await fs.pathExists(oclifInstallers[process.platform])) {
 		await fs.rename(
 			oclifInstallers[process.platform],
@@ -429,24 +208,36 @@ async function renameInstallerFiles() {
 	}
 }
 
+async function renameStandalone() {
+	const oclifStandalone = await getOclifStandaloneOriginalNames();
+	if (await fs.pathExists(oclifStandalone[process.platform])) {
+		await fs.rename(
+			oclifStandalone[process.platform],
+			renamedOclifStandalone[process.platform],
+		);
+	}
+}
+
 /**
  * If the CSC_LINK and CSC_KEY_PASSWORD env vars are set, digitally sign the
  * executable installer using Microsoft SignTool.exe (Sign Tool)
  * https://learn.microsoft.com/en-us/dotnet/framework/tools/signtool-exe
  */
 async function signWindowsInstaller() {
-	if (process.env.CSC_LINK && process.env.CSC_KEY_PASSWORD) {
-		const exeName = renamedOclifInstallers[process.platform];
+	if (process.env.SM_CODE_SIGNING_CERT_SHA1_HASH) {
+		const exeName = (await getOclifInstallersOriginalNames())[process.platform];
 		console.log(`Signing installer "${exeName}"`);
 		// trust ...
 		await execFileAsync('signtool.exe', [
 			'sign',
-			'-t',
+			'-sha1',
+			process.env.SM_CODE_SIGNING_CERT_SHA1_HASH,
+			'-tr',
 			process.env.TIMESTAMP_SERVER || 'http://timestamp.comodoca.com',
-			'-f',
-			process.env.CSC_LINK,
-			'-p',
-			process.env.CSC_KEY_PASSWORD,
+			'-td',
+			'SHA256',
+			'-fd',
+			'SHA256',
 			'-d',
 			`balena-cli ${version}`,
 			exeName,
@@ -468,12 +259,14 @@ async function notarizeMacInstaller(): Promise<void> {
 	const appleId =
 		process.env.XCODE_APP_LOADER_EMAIL || 'accounts+apple@balena.io';
 	const appleIdPassword = process.env.XCODE_APP_LOADER_PASSWORD;
+	const appPath = (await getOclifInstallersOriginalNames())[process.platform];
+	console.log(`Notarizing file "${appPath}"`);
 
 	if (appleIdPassword && teamId) {
 		await notarize({
 			tool: 'notarytool',
 			teamId,
-			appPath: renamedOclifInstallers.darwin,
+			appPath,
 			appleId,
 			appleIdPassword,
 		});
@@ -491,7 +284,7 @@ export async function buildOclifInstaller() {
 	let packOpts = ['-r', ROOT];
 	if (process.platform === 'darwin') {
 		packOS = 'macos';
-		packOpts = packOpts.concat('--targets', 'darwin-x64');
+		packOpts = packOpts.concat('--targets', `darwin-${arch}`);
 	} else if (process.platform === 'win32') {
 		packOS = 'win';
 		packOpts = packOpts.concat('--targets', 'win32-x64');
@@ -505,11 +298,7 @@ export async function buildOclifInstaller() {
 		}
 		for (const dir of dirs) {
 			console.log(`rimraf(${dir})`);
-			await Bluebird.fromCallback((cb) => rimraf(dir, cb));
-		}
-		if (process.platform === 'darwin') {
-			console.log('Signing files for notarization...');
-			await signFilesForNotarization();
+			await rimrafAsync(dir);
 		}
 		console.log('=======================================================');
 		console.log(`oclif ${packCmd} ${packOpts.join(' ')}`);
@@ -517,7 +306,6 @@ export async function buildOclifInstaller() {
 		console.log('=======================================================');
 		const oclifPath = path.join(ROOT, 'node_modules', 'oclif');
 		await oclifRun([packCmd].concat(...packOpts), oclifPath);
-		await renameInstallerFiles();
 		// The Windows installer is explicitly signed here (oclif doesn't do it).
 		// The macOS installer is automatically signed by oclif (which runs the
 		// `pkgbuild` tool), using the certificate name given in package.json
@@ -529,6 +317,7 @@ export async function buildOclifInstaller() {
 			await notarizeMacInstaller(); // Notarize
 			console.log('Package notarized.');
 		}
+		await renameInstallers();
 		console.log(`oclif installer build completed`);
 	}
 }
@@ -564,4 +353,5 @@ export async function testShrinkwrap(): Promise<void> {
 	if (process.platform !== 'win32') {
 		await whichSpawn(path.resolve(__dirname, 'test-lock-deduplicated.sh'));
 	}
+	await Promise.resolve();
 }

automation/capitanodoc/capitanodoc.ts

@@ -28,7 +28,7 @@ import { GlobSync } from 'glob';
  *
  * IMPORTANT
  *
- * All commands need to be stored under a folder in lib/commands to maintain uniformity
+ * All commands need to be stored under a folder in src/commands to maintain uniformity
  * Generating docs will error out if directive not followed
  * To add a custom heading for command docs, add the heading next to the folder name
  * in the `commandHeadings` dictionary.
@@ -36,9 +36,6 @@ import { GlobSync } from 'glob';
  * This dictionary is the source of truth that creates the docs config which is used
  * to generate the CLI documentation. By default, the folder name will be used.
  *
- * Resources with plural names needs to have 2 sections if they have commands like:
- * "fleet, fleets" or "device, devices" or "tag, tags"
- *
  */
 
 interface Category {
@@ -54,25 +51,25 @@ interface Documentation {
 
 // Mapping folders names to custom headings in the docs
 const commandHeadings: { [key: string]: string } = {
-	'api-key': 'API Key',
-	'api-keys': 'API Keys',
+	'api-key': 'API Keys',
 	login: 'Authentication',
 	whoami: 'Authentication',
 	logout: 'Authentication',
-	env: 'Environment Variable',
-	envs: 'Environment Variables',
+	env: 'Environment Variables',
 	help: 'Help and Version',
-	key: 'SSH Key',
-	keys: 'SSH Keys',
-	orgs: 'Organizations',
+	'ssh-key': 'SSH Keys',
+	organization: 'Organizations',
 	os: 'OS',
 	util: 'Utilities',
-	ssh: 'Network',
-	scan: 'Network',
-	tunnel: 'Network',
 	build: 'Deploy',
 	join: 'Platform',
 	leave: 'Platform',
+	app: 'Apps',
+	block: 'Blocks',
+	device: 'Devices',
+	fleet: 'Fleets',
+	release: 'Releases',
+	tag: 'Tags',
 };
 
 // Fetch all available commands
@@ -148,7 +145,7 @@ export async function getCapitanoDoc(): Promise<typeof capitanoDoc> {
 				throw new Error(`Error parsing section title`);
 			}
 			// match[1] has the title, match[2] has the rest
-			return match && match[2];
+			return match?.[2];
 		}),
 		mdParser.getSectionOfTitle('Installation'),
 		mdParser.getSectionOfTitle('Choosing a shell (command prompt/terminal)'),

automation/capitanodoc/doc-types.d.ts

@@ -14,7 +14,7 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-import { Command as OclifCommandClass } from '@oclif/core';
+import type { Command as OclifCommandClass } from '@oclif/core';
 
 type OclifCommand = typeof OclifCommandClass;
 
@@ -26,7 +26,7 @@ export interface Document {
 
 export interface Category {
 	title: string;
-	commands: OclifCommand[];
+	commands: Array<OclifCommand & { name: string }>;
 }
 
 export { OclifCommand };

automation/capitanodoc/index.ts

@@ -16,9 +16,8 @@
  */
 import * as path from 'path';
 import { getCapitanoDoc } from './capitanodoc';
-import { Category, Document, OclifCommand } from './doc-types';
+import type { Category, Document, OclifCommand } from './doc-types';
 import * as markdown from './markdown';
-import { stripIndent } from '../../lib/utils/lazy';
 
 /**
  * Generates the markdown document (as a string) for the CLI documentation
@@ -39,7 +38,7 @@ export async function renderMarkdown(): Promise<string> {
 		};
 
 		for (const jsFilename of commandCategory.files) {
-			category.commands.push(...importOclifCommands(jsFilename));
+			category.commands.push(await importOclifCommands(jsFilename));
 		}
 		result.categories.push(category);
 	}
@@ -47,48 +46,23 @@ export async function renderMarkdown(): Promise<string> {
 	return markdown.render(result);
 }
 
-// Help is now managed via a plugin
-// This fake command allows capitanodoc to include help in docs
-class FakeHelpCommand {
-	description = stripIndent`
-		List balena commands, or get detailed help for a specific command.
+async function importOclifCommands(jsFilename: string) {
+	const command = (await import(path.join(process.cwd(), jsFilename)))
+		.default as OclifCommand;
 
-		List balena commands, or get detailed help for a specific command.
-	`;
-
-	examples = [
-		'$ balena help',
-		'$ balena help login',
-		'$ balena help os download',
-	];
-
-	args = {
-		command: {
-			description: 'command to show help for',
-		},
-	};
-
-	usage = 'help [command]';
-
-	flags = {
-		verbose: {
-			description: 'show additional commands',
-			char: '-v',
-		},
-	};
-}
-
-function importOclifCommands(jsFilename: string): OclifCommand[] {
-	// TODO: Currently oclif commands with no `usage` overridden will cause
-	//  an error when parsed.  This should be improved so that `usage` does not have
-	//  to be overridden if not necessary.
-
-	const command: OclifCommand =
-		jsFilename === 'help'
-			? (new FakeHelpCommand() as unknown as OclifCommand)
-			: (require(path.join(process.cwd(), jsFilename)).default as OclifCommand);
-
-	return [command];
+	return {
+		...command,
+		// build/commands/device/index.js -> device
+		// build/commands/device/list.js -> device list
+		name: jsFilename
+			.split('/')
+			.slice(2)
+			.join(' ')
+			.split('.')
+			.slice(0, 1)
+			.join(' ')
+			.split(' index')[0],
+	} as Category['commands'][0];
 }
 
 /**

automation/capitanodoc/markdown.ts

@@ -18,12 +18,27 @@ import { Parser } from '@oclif/core';
 import * as ent from 'ent';
 import * as _ from 'lodash';
 
-import { getManualSortCompareFunction } from '../../lib/utils/helpers';
-import { capitanoizeOclifUsage } from '../../lib/utils/oclif-utils';
-import { Category, Document, OclifCommand } from './doc-types';
+import { capitanoizeOclifUsage } from '../../src/utils/oclif-utils';
+import type { Category, Document } from './doc-types';
 
-function renderOclifCommand(command: OclifCommand): string[] {
-	const result = [`## ${ent.encode(command.usage || '')}`];
+function renderOclifCommand(command: Category['commands'][0]): string[] {
+	const result = [`## ${ent.encode(command.name || '')}`];
+	if (command.aliases?.length) {
+		result.push('### Aliases');
+		result.push(
+			command.aliases
+				.map(
+					(alias) =>
+						`- \`${alias}\`${command.deprecateAliases ? ' *(deprecated)*' : ''}`,
+				)
+				.join('\n'),
+		);
+		result.push(
+			`\nTo use one of the aliases, replace \`${command.name}\` with the alias.`,
+		);
+	}
+
+	result.push('### Description');
 	const description = (command.description || '')
 		.split('\n')
 		.slice(1) // remove the first line, which oclif uses as help header
@@ -80,7 +95,7 @@ function renderToc(categories: Category[]): string[] {
 		result.push(
 			category.commands
 				.map((command) => {
-					const signature = capitanoizeOclifUsage(command.usage);
+					const signature = capitanoizeOclifUsage(command.name);
 					return `\t- [${ent.encode(signature)}](${getAnchor(signature)})`;
 				})
 				.join('\n'),
@@ -89,33 +104,7 @@ function renderToc(categories: Category[]): string[] {
 	return result;
 }
 
-const manualCategorySorting: { [category: string]: string[] } = {
-	'Environment Variables': ['envs', 'env rm', 'env add', 'env rename'],
-	OS: [
-		'os versions',
-		'os download',
-		'os build config',
-		'os configure',
-		'os initialize',
-	],
-};
-
-function sortCommands(doc: Document): void {
-	for (const category of doc.categories) {
-		if (category.title in manualCategorySorting) {
-			category.commands = category.commands.sort(
-				getManualSortCompareFunction<OclifCommand, string>(
-					manualCategorySorting[category.title],
-					(cmd: OclifCommand, x: string) =>
-						(cmd.usage || '').toString().replace(/\W+/g, ' ').includes(x),
-				),
-			);
-		}
-	}
-}
-
 export function render(doc: Document) {
-	sortCommands(doc);
 	const result = [
 		`# ${doc.title}`,
 		doc.introduction,

automation/capitanodoc/utils.ts

@@ -15,41 +15,9 @@
  * limitations under the License.
  */
 
-import type { OptionDefinition } from 'capitano';
-import * as ent from 'ent';
 import * as fs from 'fs';
 import * as readline from 'readline';
 
-export function getOptionPrefix(signature: string) {
-	if (signature.length > 1) {
-		return '--';
-	} else {
-		return '-';
-	}
-}
-
-export function getOptionSignature(signature: string) {
-	return `${getOptionPrefix(signature)}${signature}`;
-}
-
-export function parseCapitanoOption(option: OptionDefinition): string {
-	let result = getOptionSignature(option.signature);
-
-	if (Array.isArray(option.alias)) {
-		for (const alias of option.alias) {
-			result += `, ${getOptionSignature(alias)}`;
-		}
-	} else if (typeof option.alias === 'string') {
-		result += `, ${getOptionSignature(option.alias)}`;
-	}
-
-	if (option.parameter) {
-		result += ` <${option.parameter}>`;
-	}
-
-	return ent.encode(result);
-}
-
 export class MarkdownFileParser {
 	constructor(public mdFilePath: string) {}
 

automation/check-doc.ts

@@ -43,8 +43,8 @@ async function checkBuildTimestamps() {
 		...gitStatus.staged,
 		...gitStatus.renamed.map((o) => o.to),
 	])
-		// select only staged files that start with lib/ or typings/
-		.filter((f) => f.match(/^(lib|typings)[/\\]/))
+		// select only staged files that start with src/ or typings/
+		.filter((f) => f.match(/^(src|typings)[/\\]/))
 		.map((f) => path.join(ROOT, f));
 
 	const fStats = await Promise.all(stagedFiles.map((f) => fs.stat(f)));

automation/deploy-bin.ts

@@ -1,257 +0,0 @@
-/**
- * @license
- * Copyright 2019 Balena Ltd.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-import * as Bluebird from 'bluebird';
-import * as _ from 'lodash';
-import * as semver from 'semver';
-
-import { finalReleaseAssets, version } from './build-bin';
-
-const { GITHUB_TOKEN } = process.env;
-
-/**
- * Create or update a release in GitHub's releases page, uploading the
- * installer files (standalone zip + native oclif installers).
- */
-export async function createGitHubRelease() {
-	console.log(`Publishing release ${version} to GitHub`);
-	const publishRelease = await import('publish-release');
-	const ghRelease = (await Bluebird.fromCallback(
-		publishRelease.bind(null, {
-			token: GITHUB_TOKEN || '',
-			owner: 'balena-io',
-			repo: 'balena-cli',
-			tag: version,
-			name: `balena-CLI ${version}`,
-			reuseRelease: true,
-			assets: finalReleaseAssets[process.platform],
-		}),
-	)) as { html_url: any };
-	console.log(`Release ${version} successful: ${ghRelease.html_url}`);
-}
-
-/**
- * Top-level function to create a CLI release in GitHub's releases page:
- * call zipStandaloneInstaller(), rename the files as we'd like them to
- * display on the releases page, and call createGitHubRelease() to upload
- * the files.
- */
-export async function release() {
-	try {
-		await createGitHubRelease();
-	} catch (err) {
-		throw new Error(`Error creating GitHub release:\n${err}`);
-	}
-}
-
-/** Return a cached Octokit instance, creating a new one as needed. */
-const getOctokit = _.once(function () {
-	const Octokit = (
-		require('@octokit/rest') as typeof import('@octokit/rest')
-	).Octokit.plugin(
-		(
-			require('@octokit/plugin-throttling') as typeof import('@octokit/plugin-throttling')
-		).throttling,
-	);
-	return new Octokit({
-		auth: GITHUB_TOKEN,
-		throttle: {
-			onRateLimit: (retryAfter: number, options: any) => {
-				console.warn(
-					`Request quota exhausted for request ${options.method} ${options.url}`,
-				);
-				// retries 3 times
-				if (options.request.retryCount < 3) {
-					console.log(`Retrying after ${retryAfter} seconds!`);
-					return true;
-				}
-			},
-			onAbuseLimit: (_retryAfter: number, options: any) => {
-				// does not retry, only logs a warning
-				console.warn(
-					`Abuse detected for request ${options.method} ${options.url}`,
-				);
-			},
-		},
-	});
-});
-
-/**
- * Extract pagination information (current page, total pages, ordinal number)
- * from the 'link' response header (example below), using the parse-link-header
- * npm package:
- * "link": "<https://api.github.com/repositories/187370853/releases?per_page=2&page=2>; rel=\"next\",
- *          <https://api.github.com/repositories/187370853/releases?per_page=2&page=3>; rel=\"last\""
- *
- * @param response Octokit response object (including response.headers.link)
- * @param perPageDefault Default per_page pagination value if missing in URL
- * @return Object where 'page' is the current page number (1-based),
- * 'pages' is the total number of pages, and 'ordinal' is the ordinal number
- * (3rd, 4th, 5th...) of the first item in the current page.
- */
-function getPageNumbers(
-	response: any,
-	perPageDefault: number,
-): { page: number; pages: number; ordinal: number } {
-	const res = { page: 1, pages: 1, ordinal: 1 };
-	if (!response.headers.link) {
-		return res;
-	}
-	const parse =
-		require('parse-link-header') as typeof import('parse-link-header');
-	const parsed = parse(response.headers.link);
-	if (parsed == null) {
-		throw new Error(`Failed to parse link header: '${response.headers.link}'`);
-	}
-	let perPage = perPageDefault;
-	if (parsed.next) {
-		if (parsed.next.per_page) {
-			perPage = parseInt(parsed.next.per_page, 10);
-		}
-		res.page = parseInt(parsed.next.page, 10) - 1;
-		res.pages = parseInt(parsed.last.page, 10);
-	} else {
-		if (parsed.prev.per_page) {
-			perPage = parseInt(parsed.prev.per_page, 10);
-		}
-		res.page = res.pages = parseInt(parsed.prev.page, 10) + 1;
-	}
-	res.ordinal = (res.page - 1) * perPage + 1;
-	return res;
-}
-
-/**
- * Iterate over every GitHub release in the given owner/repo, check whether
- * its tag_name matches against the affectedVersions semver spec, and if so
- * replace its release description (body) with the given newDescription value.
- * @param owner GitHub repo owner, e.g. 'balena-io' or 'pdcastro'
- * @param repo GitHub repo, e.g. 'balena-cli'
- * @param affectedVersions Semver spec, e.g. '2.6.1 - 7.10.9 || 8.0.0'
- * @param newDescription New release description (body)
- * @param editID Short string present in newDescription, e.g. '[AA101]', that
- * can be searched to determine whether that release has already been updated.
- */
-async function updateGitHubReleaseDescriptions(
-	owner: string,
-	repo: string,
-	affectedVersions: string,
-	newDescription: string,
-	editID: string,
-) {
-	const perPage = 30;
-	const octokit = getOctokit();
-	const options = octokit.repos.listReleases.endpoint.merge({
-		owner,
-		repo,
-		per_page: perPage,
-	});
-	let errCount = 0;
-	type Release =
-		import('@octokit/rest').RestEndpointMethodTypes['repos']['listReleases']['response']['data'][0];
-	for await (const response of octokit.paginate.iterator<Release>(options)) {
-		const {
-			page: thisPage,
-			pages: totalPages,
-			ordinal,
-		} = getPageNumbers(response, perPage);
-		let i = 0;
-		for (const cliRelease of response.data) {
-			const prefix = `[#${ordinal + i++} pg ${thisPage}/${totalPages}]`;
-			if (!cliRelease.id) {
-				console.error(
-					`${prefix} Error: missing release ID (errCount=${++errCount})`,
-				);
-				continue;
-			}
-			const skipMsg = `${prefix} skipping release "${cliRelease.tag_name}" (${cliRelease.id})`;
-			if (cliRelease.draft === true) {
-				console.info(`${skipMsg}: draft release`);
-				continue;
-			} else if (cliRelease.body && cliRelease.body.includes(editID)) {
-				console.info(`${skipMsg}: already updated`);
-				continue;
-			} else if (!semver.satisfies(cliRelease.tag_name, affectedVersions)) {
-				console.info(`${skipMsg}: outside version range`);
-				continue;
-			} else {
-				const updatedRelease = {
-					owner,
-					repo,
-					release_id: cliRelease.id,
-					body: newDescription,
-				};
-				let oldBodyPreview = cliRelease.body;
-				if (oldBodyPreview) {
-					oldBodyPreview = oldBodyPreview.replace(/\s+/g, ' ').trim();
-					if (oldBodyPreview.length > 12) {
-						oldBodyPreview = oldBodyPreview.substring(0, 9) + '...';
-					}
-				}
-				console.info(
-					`${prefix} updating release "${cliRelease.tag_name}" (${cliRelease.id}) old body="${oldBodyPreview}"`,
-				);
-				try {
-					await octokit.repos.updateRelease(updatedRelease);
-				} catch (err) {
-					console.error(
-						`${skipMsg}: Error: ${err.message} (count=${++errCount})`,
-					);
-					continue;
-				}
-			}
-		}
-	}
-}
-
-/**
- * Add a warning description to CLI releases affected by a mixpanel tracking
- * security issue (#1359). This function can be executed "manually" with the
- * following command line:
- *
- * npx ts-node --type-check -P automation/tsconfig.json automation/run.ts fix1359
- */
-export async function updateDescriptionOfReleasesAffectedByIssue1359() {
-	// Run only on Linux/Node10, instead of all platform/Node combinations.
-	// (It could have been any other platform, as long as it only runs once.)
-	if (process.platform !== 'linux' || semver.major(process.version) !== 10) {
-		return;
-	}
-	const owner = 'balena-io';
-	const repo = 'balena-cli';
-	const affectedVersions =
-		'2.6.1 - 7.10.9 || 8.0.0 - 8.1.0 || 9.0.0 - 9.15.6 || 10.0.0 - 10.17.5 || 11.0.0 - 11.7.2';
-	const editID = '[AA100]';
-	let newDescription = `
-		Please note: the "login" command in this release is affected by a
-		security issue fixed in versions
-		[7.10.10](https://github.com/balena-io/balena-cli/releases/tag/v7.10.10),
-		[8.1.1](https://github.com/balena-io/balena-cli/releases/tag/v8.1.1),
-		[9.15.7](https://github.com/balena-io/balena-cli/releases/tag/v9.15.7),
-		[10.17.6](https://github.com/balena-io/balena-cli/releases/tag/v10.17.6),
-		[11.7.3](https://github.com/balena-io/balena-cli/releases/tag/v11.7.3)
-		and later. If you need to use this version, avoid passing your password,
-		keys or tokens as command-line arguments. ${editID}`;
-	// remove line breaks and collapse white space
-	newDescription = newDescription.replace(/\s+/g, ' ').trim();
-	await updateGitHubReleaseDescriptions(
-		owner,
-		repo,
-		affectedVersions,
-		newDescription,
-		editID,
-	);
-}

automation/run.ts

@@ -19,14 +19,11 @@ import * as _ from 'lodash';
 
 import {
 	buildOclifInstaller,
-	buildStandaloneZip,
+	buildStandalone,
 	catchUncommitted,
+	signFilesForNotarization,
 	testShrinkwrap,
 } from './build-bin';
-import {
-	release,
-	updateDescriptionOfReleasesAffectedByIssue1359,
-} from './deploy-bin';
 
 // DEBUG set to falsy for negative values else is truthy
 process.env.DEBUG = ['0', 'no', 'false', '', undefined].includes(
@@ -39,8 +36,7 @@ process.env.DEBUG = ['0', 'no', 'false', '', undefined].includes(
  * Trivial command-line parser. Check whether the command-line argument is one
  * of the following strings, then call the appropriate functions:
  *     'build:installer'   (to build a native oclif installer)
- * 	   'build:standalone'  (to build a standalone pkg package)
- *     'release'           (to create/update a GitHub release)
+ * 	   'build:standalone'  (to build a standalone package)
  *
  * @param args Arguments to parse (default is process.argv.slice(2))
  */
@@ -53,11 +49,10 @@ async function parse(args?: string[]) {
 	}
 	const commands: { [cmd: string]: () => void | Promise<void> } = {
 		'build:installer': buildOclifInstaller,
-		'build:standalone': buildStandaloneZip,
+		'build:standalone': buildStandalone,
+		'sign:binaries': signFilesForNotarization,
 		'catch-uncommitted': catchUncommitted,
 		'test-shrinkwrap': testShrinkwrap,
-		fix1359: updateDescriptionOfReleasesAffectedByIssue1359,
-		release,
 	};
 	for (const arg of args) {
 		if (!Object.hasOwn(commands, arg)) {
@@ -65,21 +60,6 @@ async function parse(args?: string[]) {
 		}
 	}
 
-	// The BUILD_TMP env var is used as an alternative location for oclif
-	// (patched) to copy/extract the CLI files, run npm install and then
-	// create the NSIS executable installer for Windows. This was necessary
-	// to avoid issues with a 260-char limit on Windows paths (possibly a
-	// limitation of some library used by NSIS), as the "current working dir"
-	// provided by balena CI is a rather long path to start with.
-	if (process.platform === 'win32' && !process.env.BUILD_TMP) {
-		const randID = (await import('crypto'))
-			.randomBytes(6)
-			.toString('base64')
-			.replace(/\+/g, '-')
-			.replace(/\//g, '_'); // base64url (RFC 4648)
-		process.env.BUILD_TMP = `C:\\tmp\\${randID}`;
-	}
-
 	for (const arg of args) {
 		try {
 			const cmdFunc = commands[arg];

automation/update-module.ts

@@ -3,7 +3,7 @@ import * as semver from 'semver';
 
 const changeTypes = ['major', 'minor', 'patch'] as const;
 
-const validateChangeType = (maybeChangeType: string = 'minor') => {
+const validateChangeType = (maybeChangeType = 'minor') => {
 	maybeChangeType = maybeChangeType.toLowerCase();
 	switch (maybeChangeType) {
 		case 'patch':
@@ -107,11 +107,11 @@ async function $main() {
 
 	const changeType = process.argv[4]
 		? // if the caller specified a change type, use that one
-		  validateChangeType(process.argv[4])
+			validateChangeType(process.argv[4])
 		: // use the same change type as in the dependency, but avoid major bumps
-		semverChangeType && semverChangeType !== 'major'
-		? semverChangeType
-		: 'minor';
+			semverChangeType && semverChangeType !== 'major'
+			? semverChangeType
+			: 'minor';
 	console.log(`Using Change-type: ${changeType}`);
 
 	let { stdout: currentBranch } = await run('git rev-parse --abbrev-ref HEAD');
@@ -136,5 +136,4 @@ async function main() {
 	}
 }
 
-// eslint-disable-next-line @typescript-eslint/no-floating-promises
-main();
+void main();

automation/utils.ts

@@ -17,74 +17,16 @@
 
 import { spawn } from 'child_process';
 import * as path from 'path';
+import * as fs from 'fs';
+import * as whichMod from 'which';
 
 export const ROOT = path.join(__dirname, '..');
 
-/** Tap and buffer this process' stdout and stderr */
-export class StdOutTap {
-	public stdoutBuf: string[] = [];
-	public stderrBuf: string[] = [];
-	public allBuf: string[] = []; // both stdout and stderr
-
-	protected origStdoutWrite: typeof process.stdout.write;
-	protected origStderrWrite: typeof process.stdout.write;
-
-	constructor(protected printDots = false) {}
-
-	tap() {
-		this.origStdoutWrite = process.stdout.write;
-		this.origStderrWrite = process.stderr.write;
-
-		process.stdout.write = (chunk: string, ...args: any[]): boolean => {
-			this.stdoutBuf.push(chunk);
-			this.allBuf.push(chunk);
-			const str = this.printDots ? '.' : chunk;
-			return this.origStdoutWrite.call(process.stdout, str, ...args);
-		};
-
-		process.stderr.write = (chunk: string, ...args: any[]): boolean => {
-			this.stderrBuf.push(chunk);
-			this.allBuf.push(chunk);
-			const str = this.printDots ? '.' : chunk;
-			return this.origStderrWrite.call(process.stderr, str, ...args);
-		};
-	}
-
-	untap() {
-		process.stdout.write = this.origStdoutWrite;
-		process.stderr.write = this.origStderrWrite;
-		if (this.printDots) {
-			console.error('');
-		}
-	}
-}
-
-/**
- * Diff strings by line, using the 'diff' npm package:
- * https://www.npmjs.com/package/diff
- */
-export function diffLines(str1: string, str2: string): string {
-	const { diffTrimmedLines } = require('diff');
-	const diffObjs = diffTrimmedLines(str1, str2);
-	const prefix = (chunk: string, char: string) =>
-		chunk
-			.split('\n')
-			.map((line: string) => `${char} ${line}`)
-			.join('\n');
-	const diffStr = diffObjs
-		.map((part: any) => {
-			return part.added
-				? prefix(part.value, '+')
-				: part.removed
-				? prefix(part.value, '-')
-				: prefix(part.value, ' ');
-		})
-		.join('\n');
-	return diffStr;
-}
-
 export function loadPackageJson() {
-	return require(path.join(ROOT, 'package.json'));
+	const packageJsonPath = path.join(ROOT, 'package.json');
+
+	const packageJson = fs.readFileSync(packageJsonPath, 'utf8');
+	return JSON.parse(packageJson);
 }
 
 /**
@@ -97,7 +39,6 @@ export function loadPackageJson() {
  * @returns The program's full path, e.g. 'C:\WINDOWS\System32\OpenSSH\ssh.EXE'
  */
 export async function which(program: string): Promise<string> {
-	const whichMod = await import('which');
 	let programPath: string;
 	try {
 		programPath = await whichMod(program);
@@ -128,7 +69,7 @@ export async function whichSpawn(
 					.on('error', reject)
 					.on('close', resolve);
 			} catch (err) {
-				reject(err);
+				reject(err as Error);
 			}
 		});
 	} catch (err) {

bin/balena

@@ -1,21 +0,0 @@
-#!/usr/bin/env node
-
-// We boost the threadpool size as ext2fs can deadlock with some
-// operations otherwise, if the pool runs out.
-process.env.UV_THREADPOOL_SIZE = '64';
-
-// Disable oclif registering ts-node
-process.env.OCLIF_TS_NODE = 0;
-
-async function run() {
-	// Use fast-boot to cache require lookups, speeding up startup
-	await require('../build/fast-boot').start();
-
-	// Set the desired es version for downstream modules that support it
-	require('@balena/es-version').set('es2018');
-
-	// Run the CLI
-	await require('../build/app').run(undefined, { dir: __dirname });
-}
-
-run();

bin/balena

@@ -0,0 +1 @@
+run.js

bin/balena-dev

@@ -1,87 +0,0 @@
-#!/usr/bin/env node
-
-// ****************************************************************************
-// THIS IS FOR DEV PURPOSES ONLY AND WILL NOT BE PART OF THE PUBLISHED PACKAGE
-// Before opening a PR you should build and test your changes using bin/balena
-// ****************************************************************************
-
-// We boost the threadpool size as ext2fs can deadlock with some
-// operations otherwise, if the pool runs out.
-process.env.UV_THREADPOOL_SIZE = '64';
-
-// Note on `fast-boot2`: We do not use `fast-boot2` with `balena-dev` because:
-// * fast-boot2's cacheKiller option is configured to include the timestamps of
-//   the package.json and npm-shrinkwrap.json files, to avoid unexpected CLI
-//   behavior when changes are made to dependencies during development. This is
-//   generally a good thing, however, `balena-dev` (a few lines below) edits
-//   `package.json` to modify oclif paths, and this results in cache
-//   invalidation and a performance hit rather than speedup.
-// * Even if the timestamps are removed from cacheKiller, so that there is no
-//   cache invalidation, fast-boot's speedup is barely noticeable when ts-node
-//   is used, e.g. 1.43s vs 1.4s when running `balena version`.
-// * `fast-boot` causes unexpected behavior when used with `npm link` or
-//   when the `node_modules` folder is manually modified (affecting transitive
-//   dependencies) during development (e.g. bug investigations). A workaround
-//   is to use `balena-dev` without `fast-boot`. See also notes in
-//   `CONTRIBUTING.md`.
-
-const path = require('path');
-const rootDir = path.join(__dirname, '..');
-
-// Allow balena-dev to work with oclif by temporarily
-// pointing oclif config options to lib/ instead of build/
-modifyOclifPaths();
-// Undo changes on exit
-process.on('exit', function () {
-	modifyOclifPaths(true);
-});
-// Undo changes in case of ctrl-c
-process.on('SIGINT', function () {
-	modifyOclifPaths(true);
-	// Note process exit here will interfere with commands that do their own SIGINT handling,
-	// but without it commands can not be exited.
-	// So currently using balena-dev does not guarantee proper exit behaviour when using ctrl-c.
-	// Ideally a better solution is needed.
-	process.exit();
-});
-
-// Set the desired es version for downstream modules that support it
-require('@balena/es-version').set('es2018');
-
-// Note: before ts-node v6.0.0, 'transpile-only' (no type checking) was the
-// default option. We upgraded ts-node and found that adding 'transpile-only'
-// was necessary to avoid a mysterious 'null' error message. On the plus side,
-// it is supposed to run faster. We still benefit from type checking when
-// running 'npm run build'.
-require('ts-node').register({
-	project: path.join(rootDir, 'tsconfig.json'),
-	transpileOnly: true,
-});
-require('../lib/app').run(undefined, { dir: __dirname, development: true });
-
-// Modify package.json oclif paths from build/ -> lib/, or vice versa
-function modifyOclifPaths(revert) {
-	const fs = require('fs');
-	const packageJsonPath = path.join(rootDir, 'package.json');
-
-	const packageJson = fs.readFileSync(packageJsonPath, 'utf8');
-	const packageObj = JSON.parse(packageJson);
-
-	if (!packageObj.oclif) {
-		return;
-	}
-
-	let oclifSectionText = JSON.stringify(packageObj.oclif);
-	if (!revert) {
-		oclifSectionText = oclifSectionText.replace(/\/build\//g, '/lib/');
-	} else {
-		oclifSectionText = oclifSectionText.replace(/\/lib\//g, '/build/');
-	}
-
-	packageObj.oclif = JSON.parse(oclifSectionText);
-	fs.writeFileSync(
-		packageJsonPath,
-		`${JSON.stringify(packageObj, null, 2)}\n`,
-		'utf8',
-	);
-}

bin/balena-dev

@@ -0,0 +1 @@
+dev.js

bin/dev.cmd

@@ -0,0 +1,3 @@
+@echo off
+
+node "%~dp0\run" %*

bin/dev.js

@@ -0,0 +1,90 @@
+#!/usr/bin/env node
+
+// ****************************************************************************
+// THIS IS FOR DEV PURPOSES ONLY AND WILL NOT BE PART OF THE PUBLISHED PACKAGE
+// Before opening a PR you should build and test your changes using bin/balena
+// ****************************************************************************
+
+// We boost the threadpool size as ext2fs can deadlock with some
+// operations otherwise, if the pool runs out.
+process.env.UV_THREADPOOL_SIZE = '64';
+
+// Note on `fast-boot2`: We do not use `fast-boot2` with `balena-dev` because:
+// * fast-boot2's cacheKiller option is configured to include the timestamps of
+//   the package.json and npm-shrinkwrap.json files, to avoid unexpected CLI
+//   behavior when changes are made to dependencies during development. This is
+//   generally a good thing, however, `balena-dev` (a few lines below) edits
+//   `package.json` to modify oclif paths, and this results in cache
+//   invalidation and a performance hit rather than speedup.
+// * Even if the timestamps are removed from cacheKiller, so that there is no
+//   cache invalidation, fast-boot's speedup is barely noticeable when ts-node
+//   is used, e.g. 1.43s vs 1.4s when running `balena version`.
+// * `fast-boot` causes unexpected behavior when used with `npm link` or
+//   when the `node_modules` folder is manually modified (affecting transitive
+//   dependencies) during development (e.g. bug investigations). A workaround
+//   is to use `balena-dev` without `fast-boot`. See also notes in
+//   `CONTRIBUTING.md`.
+
+const path = require('path');
+const rootDir = path.join(__dirname, '..');
+
+// Allow balena-dev to work with oclif by temporarily
+// pointing oclif config options to src/ instead of build/
+modifyOclifPaths();
+// Undo changes on exit
+process.on('exit', function () {
+	modifyOclifPaths(true);
+});
+// Undo changes in case of ctrl-c
+process.on('SIGINT', function () {
+	modifyOclifPaths(true);
+	// Note process exit here will interfere with commands that do their own SIGINT handling,
+	// but without it commands can not be exited.
+	// So currently using balena-dev does not guarantee proper exit behaviour when using ctrl-c.
+	// Ideally a better solution is needed.
+	process.exit();
+});
+
+// Set the desired es version for downstream modules that support it
+require('@balena/es-version').set('es2018');
+
+// Note: before ts-node v6.0.0, 'transpile-only' (no type checking) was the
+// default option. We upgraded ts-node and found that adding 'transpile-only'
+// was necessary to avoid a mysterious 'null' error message. On the plus side,
+// it is supposed to run faster. We still benefit from type checking when
+// running 'npm run build'.
+require('ts-node').register({
+	project: path.join(rootDir, 'tsconfig.json'),
+	transpileOnly: true,
+});
+void require('../src/app').run(undefined, {
+	dir: __dirname,
+	development: true,
+});
+
+// Modify package.json oclif paths from build/ -> src/, or vice versa
+function modifyOclifPaths(revert) {
+	const fs = require('fs');
+	const packageJsonPath = path.join(rootDir, 'package.json');
+
+	const packageJson = fs.readFileSync(packageJsonPath, 'utf8');
+	const packageObj = JSON.parse(packageJson);
+
+	if (!packageObj.oclif) {
+		return;
+	}
+
+	let oclifSectionText = JSON.stringify(packageObj.oclif);
+	if (!revert) {
+		oclifSectionText = oclifSectionText.replace(/\/build\//g, '/src/');
+	} else {
+		oclifSectionText = oclifSectionText.replace(/\/src\//g, '/build/');
+	}
+
+	packageObj.oclif = JSON.parse(oclifSectionText);
+	fs.writeFileSync(
+		packageJsonPath,
+		`${JSON.stringify(packageObj, null, 2)}\n`,
+		'utf8',
+	);
+}

bin/run.cmd

@@ -0,0 +1,3 @@
+@echo off
+
+node "%~dp0\run" %*

bin/run.js

@@ -0,0 +1,21 @@
+#!/usr/bin/env node
+
+// We boost the threadpool size as ext2fs can deadlock with some
+// operations otherwise, if the pool runs out.
+process.env.UV_THREADPOOL_SIZE = '64';
+
+// Disable oclif registering ts-node
+process.env.OCLIF_TS_NODE = '0';
+
+async function run() {
+	// Use fast-boot to cache require lookups, speeding up startup
+	await require('../build/fast-boot').start();
+
+	// Set the desired es version for downstream modules that support it
+	require('@balena/es-version').set('es2018');
+
+	// Run the CLI
+	await require('../build/app').run(undefined, { dir: __dirname });
+}
+
+void run();

completion/_balena

@@ -8,27 +8,28 @@ _balena() {
   local context state line curcontext="$curcontext"
 
   # Valid top-level completions
-  main_commands=( api-key api-keys app block build config deploy device device devices env envs fleet fleet fleets internal join key key keys leave local login logout logs notes orgs os preload push release release releases scan settings ssh support tag tags tunnel util version whoami )
+  main_commands=( api-key app block build config deploy device device-type env fleet internal join leave local login logout organization os preload push release settings ssh-key support tag util version whoami )
   # Sub-completions
-  api_key_cmds=( generate revoke )
+  api_key_cmds=( generate list revoke )
   app_cmds=( create )
   block_cmds=( create )
   config_cmds=( generate inject read reconfigure write )
-  device_cmds=( deactivate identify init local-mode move os-update pin public-url purge reboot register rename restart rm shutdown start-service stop-service track-fleet )
-  devices_cmds=( supported )
-  env_cmds=( add rename rm )
-  fleet_cmds=( create pin purge rename restart rm track-latest )
+  device_type_cmds=( list )
+  device_cmds=( deactivate detect identify init list local-mode logs move note os-update pin public-url purge reboot register rename restart rm shutdown ssh start-service stop-service track-fleet tunnel )
+  env_cmds=( list rename rm set )
+  fleet_cmds=( create list pin purge rename restart rm track-latest )
   internal_cmds=( osinit )
-  key_cmds=( add rm )
   local_cmds=( configure flash )
+  organization_cmds=( list )
   os_cmds=( build-config configure download initialize versions )
-  release_cmds=( finalize invalidate validate )
-  tag_cmds=( rm set )
+  release_cmds=( finalize invalidate list validate )
+  ssh_key_cmds=( add list rm )
+  tag_cmds=( list rm set )
 
 
   _arguments -C \
     '(- 1 *)--version[show version and exit]' \
-    '(- 1 *)'{-h,--help}'[show help options and exit]' \
+    '(- 1 *)--help[show help options and exit]' \
     '1:first command:_balena_main_cmds' \
     '2:second command:_balena_sec_cmds' \
   && ret=0
@@ -54,12 +55,12 @@ _balena_sec_cmds() {
       "config")
         _describe -t config_cmds 'config_cmd' config_cmds "$@" && ret=0
       ;;
+      "device-type")
+        _describe -t device_type_cmds 'device-type_cmd' device_type_cmds "$@" && ret=0
+      ;;
       "device")
         _describe -t device_cmds 'device_cmd' device_cmds "$@" && ret=0
       ;;
-      "devices")
-        _describe -t devices_cmds 'devices_cmd' devices_cmds "$@" && ret=0
-      ;;
       "env")
         _describe -t env_cmds 'env_cmd' env_cmds "$@" && ret=0
       ;;
@@ -69,18 +70,21 @@ _balena_sec_cmds() {
       "internal")
         _describe -t internal_cmds 'internal_cmd' internal_cmds "$@" && ret=0
       ;;
-      "key")
-        _describe -t key_cmds 'key_cmd' key_cmds "$@" && ret=0
-      ;;
       "local")
         _describe -t local_cmds 'local_cmd' local_cmds "$@" && ret=0
       ;;
+      "organization")
+        _describe -t organization_cmds 'organization_cmd' organization_cmds "$@" && ret=0
+      ;;
       "os")
         _describe -t os_cmds 'os_cmd' os_cmds "$@" && ret=0
       ;;
       "release")
         _describe -t release_cmds 'release_cmd' release_cmds "$@" && ret=0
       ;;
+      "ssh-key")
+        _describe -t ssh_key_cmds 'ssh-key_cmd' ssh_key_cmds "$@" && ret=0
+      ;;
       "tag")
         _describe -t tag_cmds 'tag_cmd' tag_cmds "$@" && ret=0
       ;;

completion/balena-completion.bash

@@ -7,22 +7,23 @@ _balena_complete()
   local cur prev
 
   # Valid top-level completions
-  main_commands="api-key api-keys app block build config deploy device device devices env envs fleet fleet fleets internal join key key keys leave local login logout logs notes orgs os preload push release release releases scan settings ssh support tag tags tunnel util version whoami"
+  main_commands="api-key app block build config deploy device device-type env fleet internal join leave local login logout organization os preload push release settings ssh-key support tag util version whoami"
   # Sub-completions
-  api_key_cmds="generate revoke"
+  api_key_cmds="generate list revoke"
   app_cmds="create"
   block_cmds="create"
   config_cmds="generate inject read reconfigure write"
-  device_cmds="deactivate identify init local-mode move os-update pin public-url purge reboot register rename restart rm shutdown start-service stop-service track-fleet"
-  devices_cmds="supported"
-  env_cmds="add rename rm"
-  fleet_cmds="create pin purge rename restart rm track-latest"
+  device_type_cmds="list"
+  device_cmds="deactivate detect identify init list local-mode logs move note os-update pin public-url purge reboot register rename restart rm shutdown ssh start-service stop-service track-fleet tunnel"
+  env_cmds="list rename rm set"
+  fleet_cmds="create list pin purge rename restart rm track-latest"
   internal_cmds="osinit"
-  key_cmds="add rm"
   local_cmds="configure flash"
+  organization_cmds="list"
   os_cmds="build-config configure download initialize versions"
-  release_cmds="finalize invalidate validate"
-  tag_cmds="rm set"
+  release_cmds="finalize invalidate list validate"
+  ssh_key_cmds="add list rm"
+  tag_cmds="list rm set"
 
 
 
@@ -48,12 +49,12 @@ _balena_complete()
       config)
         COMPREPLY=( $(compgen -W "$config_cmds" -- $cur) )
         ;;
+      device-type)
+        COMPREPLY=( $(compgen -W "$device_type_cmds" -- $cur) )
+        ;;
       device)
         COMPREPLY=( $(compgen -W "$device_cmds" -- $cur) )
         ;;
-      devices)
-        COMPREPLY=( $(compgen -W "$devices_cmds" -- $cur) )
-        ;;
       env)
         COMPREPLY=( $(compgen -W "$env_cmds" -- $cur) )
         ;;
@@ -63,18 +64,21 @@ _balena_complete()
       internal)
         COMPREPLY=( $(compgen -W "$internal_cmds" -- $cur) )
         ;;
-      key)
-        COMPREPLY=( $(compgen -W "$key_cmds" -- $cur) )
-        ;;
       local)
         COMPREPLY=( $(compgen -W "$local_cmds" -- $cur) )
         ;;
+      organization)
+        COMPREPLY=( $(compgen -W "$organization_cmds" -- $cur) )
+        ;;
       os)
         COMPREPLY=( $(compgen -W "$os_cmds" -- $cur) )
         ;;
       release)
         COMPREPLY=( $(compgen -W "$release_cmds" -- $cur) )
         ;;
+      ssh-key)
+        COMPREPLY=( $(compgen -W "$ssh_key_cmds" -- $cur) )
+        ;;
       tag)
         COMPREPLY=( $(compgen -W "$tag_cmds" -- $cur) )
         ;;

completion/generate-completion.js

@@ -33,7 +33,7 @@ const commandsJson = JSON.parse(fs.readFileSync(commandsFilePath, 'utf8'));
 
 const mainCommands = [];
 const additionalCommands = [];
-for (const key of Object.keys(commandsJson.commands)) {
+for (const key of Object.keys(commandsJson.commands).sort()) {
 	const cmd = key.split(':');
 	if (cmd.length > 1) {
 		additionalCommands.push(cmd);

completion/templates/zsh.template

@@ -14,7 +14,7 @@ $sub_cmds$
 
   _arguments -C \
     '(- 1 *)--version[show version and exit]' \
-    '(- 1 *)'{-h,--help}'[show help options and exit]' \
+    '(- 1 *)--help[show help options and exit]' \
     '1:first command:_balena_main_cmds' \
     '2:second command:_balena_sec_cmds' \
   && ret=0

eslint.config.js

@@ -0,0 +1,32 @@
+const { FlatCompat } = require('@eslint/eslintrc');
+
+const compat = new FlatCompat({
+	baseDirectory: __dirname,
+});
+module.exports = [
+	...require('@balena/lint/config/eslint.config'),
+	...compat.config({
+		parserOptions: {
+			project: 'tsconfig.dev.json',
+		},
+		ignorePatterns: ['**/generate-completion.js', '**/bin/**/*'],
+		rules: {
+			ignoreDefinitionFiles: 0,
+			'@typescript-eslint/no-non-null-assertion': 'off',
+			'@typescript-eslint/no-shadow': 'off',
+			'@typescript-eslint/no-var-requires': 'off',
+			'@typescript-eslint/no-require-imports': 'off',
+			'@typescript-eslint/no-unnecessary-type-assertion': 'off',
+			'@typescript-eslint/prefer-nullish-coalescing': 'warn',
+
+			'no-restricted-imports': ['error', {
+				paths: ['resin-cli-visuals', 'chalk', 'common-tags', 'resin-cli-form'],
+			}],
+
+			'@typescript-eslint/no-unused-vars': ['error', {
+				argsIgnorePattern: '^_',
+				caughtErrorsIgnorePattern: '^_',
+			}],
+		},
+	}),
+];

lib/command.ts

@@ -1,174 +0,0 @@
-/**
- * @license
- * Copyright 2020 Balena Ltd.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-import { Command } from '@oclif/core';
-import {
-	InsufficientPrivilegesError,
-	NotAvailableInOfflineModeError,
-} from './errors';
-import { stripIndent } from './utils/lazy';
-import * as output from './framework/output';
-
-export default abstract class BalenaCommand extends Command {
-	/**
-	 * When set to true, command will be listed in `help`,
-	 * otherwise listed in `help --verbose` with secondary commands.
-	 */
-	public static primary = false;
-
-	/**
-	 * Require elevated privileges to run.
-	 * When set to true, command will exit with an error
-	 * if executed without root on Mac/Linux
-	 * or if executed by non-Administrator on Windows.
-	 */
-	public static root = false;
-
-	/**
-	 * Require authentication to run.
-	 * When set to true, command will exit with an error
-	 * if user is not already logged in.
-	 */
-	public static authenticated = false;
-
-	/**
-	 * Require an internet connection to run.
-	 * When set to true, command will exit with an error
-	 * if user is running in offline mode (BALENARC_OFFLINE_MODE).
-	 */
-	public static offlineCompatible = false;
-
-	/**
-	 * Accept piped input.
-	 * When set to true, command will read from stdin during init
-	 * and make contents available on member `stdin`.
-	 */
-	public static readStdin = false;
-
-	public stdin: string;
-
-	/**
-	 * Throw InsufficientPrivilegesError if not root on Mac/Linux
-	 * or non-Administrator on Windows.
-	 *
-	 * Called automatically if `root=true`.
-	 * Can be called explicitly by command implementation, if e.g.:
-	 *  - check should only be done conditionally
-	 *  - other code needs to execute before check
-	 */
-	protected static async checkElevatedPrivileges() {
-		const isElevated = await (await import('is-elevated'))();
-		if (!isElevated) {
-			throw new InsufficientPrivilegesError(
-				'You need root/admin privileges to run this command',
-			);
-		}
-	}
-
-	/**
-	 * Throw NotLoggedInError if not logged in.
-	 *
-	 * Called automatically if `authenticated=true`.
-	 * Can be called explicitly by command implementation, if e.g.:
-	 *  - check should only be done conditionally
-	 *  - other code needs to execute before check
-	 *
-	 *  Note, currently public to allow use outside of derived commands
-	 *  (as some command implementations require this. Can be made protected
-	 *  if this changes).
-	 *
-	 * @throws {NotLoggedInError}
-	 */
-	public static async checkLoggedIn() {
-		await (await import('./utils/patterns')).checkLoggedIn();
-	}
-
-	/**
-	 * Throw NotLoggedInError if not logged in when condition true.
-	 *
-	 * @param {boolean} doCheck - will check if true.
-	 * @throws {NotLoggedInError}
-	 */
-	public static async checkLoggedInIf(doCheck: boolean) {
-		if (doCheck) {
-			await this.checkLoggedIn();
-		}
-	}
-
-	/**
-	 * Throw NotAvailableInOfflineModeError if in offline mode.
-	 *
-	 * Called automatically if `onlineOnly=true`.
-	 * Can be called explicitly by command implementation, if e.g.:
-	 *  - check should only be done conditionally
-	 *  - other code needs to execute before check
-	 *
-	 *  Note, currently public to allow use outside of derived commands
-	 *  (as some command implementations require this. Can be made protected
-	 *  if this changes).
-	 *
-	 * @throws {NotAvailableInOfflineModeError}
-	 */
-	public static checkNotUsingOfflineMode() {
-		if (process.env.BALENARC_OFFLINE_MODE) {
-			throw new NotAvailableInOfflineModeError(stripIndent`
-		This command requires an internet connection, and cannot be used in offline mode.
-		To leave offline mode, unset the BALENARC_OFFLINE_MODE environment variable.
-		`);
-		}
-	}
-
-	/**
-	 * Read stdin contents and make available to command.
-	 *
-	 * This approach could be improved in the future to automatically set argument
-	 * values from stdin based in configuration, minimising command implementation.
-	 */
-	protected async getStdin() {
-		this.stdin = await (await import('get-stdin'))();
-	}
-
-	/**
-	 * Get a logger instance.
-	 */
-	protected static async getLogger() {
-		return (await import('./utils/logger')).getLogger();
-	}
-
-	protected async init() {
-		const ctr = this.constructor as typeof BalenaCommand;
-
-		if (ctr.root) {
-			await BalenaCommand.checkElevatedPrivileges();
-		}
-
-		if (ctr.authenticated) {
-			await BalenaCommand.checkLoggedIn();
-		}
-
-		if (!ctr.offlineCompatible) {
-			BalenaCommand.checkNotUsingOfflineMode();
-		}
-
-		if (ctr.readStdin) {
-			await this.getStdin();
-		}
-	}
-
-	protected outputMessage = output.outputMessage;
-	protected outputData = output.outputData;
-}

lib/commands/api-key/generate.ts

@@ -1,76 +0,0 @@
-/**
- * @license
- * Copyright 2016-2020 Balena Ltd.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-import { Args } from '@oclif/core';
-import Command from '../../command';
-import { ExpectedError } from '../../errors';
-import * as cf from '../../utils/common-flags';
-import { getBalenaSdk, stripIndent } from '../../utils/lazy';
-
-export default class GenerateCmd extends Command {
-	public static description = stripIndent`
-		Generate a new balenaCloud API key.
-
-		Generate a new balenaCloud API key for the current user, with the given
-		name. The key will be logged to the console.
-
-		This key can be used to log into the CLI using 'balena login --token <key>',
-		or to authenticate requests to the API with an 'Authorization: Bearer <key>' header.
-`;
-	public static examples = ['$ balena api-key generate "Jenkins Key"'];
-
-	public static args = {
-		name: Args.string({
-			description: 'the API key name',
-			required: true,
-		}),
-	};
-
-	public static usage = 'api-key generate <name>';
-
-	public static flags = {
-		help: cf.help,
-	};
-
-	public static authenticated = true;
-
-	public async run() {
-		const { args: params } = await this.parse(GenerateCmd);
-
-		let key;
-		try {
-			key = await getBalenaSdk().models.apiKey.create(params.name);
-		} catch (e) {
-			if (e.name === 'BalenaNotLoggedIn') {
-				throw new ExpectedError(stripIndent`
-					This command cannot be run when logged in with an API key.
-					Please login again with 'balena login' and select an alternative method.
-				`);
-			} else {
-				throw e;
-			}
-		}
-
-		console.log(stripIndent`
-			Registered api key '${params.name}':
-
-			${key}
-
-			This key will not be shown again, so please save it now.
-		`);
-	}
-}

lib/framework/index.ts

@@ -1,19 +0,0 @@
-/*
-Copyright 2020 Balena
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-   http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-import type { DataOutputOptions, DataSetOutputOptions } from './output';
-
-export { DataOutputOptions, DataSetOutputOptions };

lib/framework/output.ts

@@ -1,158 +0,0 @@
-/*
-Copyright 2020 Balena
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-   http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-import { getCliUx, getChalk } from '../utils/lazy';
-
-export interface DataOutputOptions {
-	fields?: string;
-	json?: boolean;
-}
-
-export interface DataSetOutputOptions extends DataOutputOptions {
-	filter?: string;
-	'no-header'?: boolean;
-	'no-truncate'?: boolean;
-	sort?: string;
-}
-
-/**
- * Output message to STDERR
- */
-export function outputMessage(msg: string) {
-	// Messages go to STDERR
-	console.error(msg);
-}
-
-/**
- * Output result data to STDOUT
- *  Supports:
- *   - arrays of items (displayed in a tabular way),
- *   - single items (displayed in a field per row format).
- *
- * @param data Array of data objects to output
- * @param fields Array of fieldnames, specifying the fields and display order
- * @param options Output options
- */
-export async function outputData(
-	data: any[] | object,
-	fields: string[],
-	options: DataOutputOptions | DataSetOutputOptions,
-) {
-	if (Array.isArray(data)) {
-		await outputDataSet(data, fields, options as DataSetOutputOptions);
-	} else {
-		await outputDataItem(data, fields, options as DataOutputOptions);
-	}
-}
-
-/**
- * Wraps the cli.ux table implementation, to output tabular data
- *
- * @param data Array of data objects to output
- * @param fields Array of fieldnames, specifying the fields and display order
- * @param options Output options
- */
-async function outputDataSet(
-	data: any[],
-	fields: string[],
-	options: DataSetOutputOptions,
-) {
-	// Oclif expects fields to be specified in the format used in table headers (though lowercase)
-	// By replacing underscores with spaces here, we can support both header format and actual field name
-	// (e.g. as seen in json output).
-	options.fields = options.fields?.replace(/_/g, ' ');
-	options.filter = options.filter?.replace(/_/g, ' ');
-	options.sort = options.sort?.replace(/_/g, ' ');
-
-	getCliUx().table(
-		data,
-		// Convert fields array to column object keys
-		// that cli.ux expects.  We can later add support
-		// for both formats if beneficial
-		fields.reduce((ac, a) => ({ ...ac, [a]: {} }), {}),
-		{
-			...options,
-			...(options.json
-				? {
-						output: 'json',
-				  }
-				: {}),
-			columns: options.fields,
-			printLine,
-		},
-	);
-}
-
-/**
- * Outputs a single data object (like `resin-cli-visuals table.vertical`),
- *  but supporting a subset of options from `cli-ux table` (--json and --fields)
- *
- * @param data Array of data objects to output
- * @param fields Array of fieldnames, specifying the fields and display order
- * @param options Output options
- */
-async function outputDataItem(
-	data: any,
-	fields: string[],
-	options: DataOutputOptions,
-) {
-	const outData: typeof data = {};
-
-	// Convert comma separated list of fields in `options.fields` to array of correct format.
-	// Note, user may have specified the true field name (e.g. `some_field`),
-	// or the format displayed in headers (e.g. `Some field`, case insensitive).
-	const userSelectedFields = options.fields?.split(',').map((f) => {
-		return f.toLowerCase().trim().replace(/ /g, '_');
-	});
-
-	// Order and filter the fields based on `fields` parameter and `options.fields`
-	(userSelectedFields || fields).forEach((fieldName) => {
-		if (fields.includes(fieldName)) {
-			outData[fieldName] = data[fieldName];
-		}
-	});
-
-	if (options.json) {
-		printLine(JSON.stringify(outData, undefined, 2));
-	} else {
-		const chalk = getChalk();
-		const { capitalize } = await import('lodash');
-
-		// Find longest key, so we can align results
-		const longestKeyLength = getLongestObjectKeyLength(outData);
-
-		// Output one field per line
-		for (const [k, v] of Object.entries(outData)) {
-			const shim = ' '.repeat(longestKeyLength - k.length);
-			const kDisplay = capitalize(k.replace(/_/g, ' '));
-			printLine(`${chalk.bold(kDisplay) + shim} : ${v}`);
-		}
-	}
-}
-
-function getLongestObjectKeyLength(o: any): number {
-	return Object.keys(o).length >= 1
-		? Object.keys(o).reduce((a, b) => {
-				return a.length > b.length ? a : b;
-		  }).length
-		: 0;
-}
-
-function printLine(s: any) {
-	// Duplicating oclif cli-ux's default implementation here,
-	// but using this one explicitly for ease of testing
-	process.stdout.write(s + '\n');
-}

lib/hooks/prerun/track.ts

@@ -1,46 +0,0 @@
-/**
- * @license
- * Copyright 2019-2020 Balena Ltd.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-import type { Hook } from '@oclif/core';
-
-let trackResolve: (result: Promise<any>) => void;
-
-// note: trackPromise is subject to a Bluebird.timeout, defined in events.ts
-export const trackPromise = new Promise((resolve) => {
-	trackResolve = resolve;
-});
-
-/**
- * This is an oclif 'prerun' hook. This hook runs after the command line is
- * parsed by oclif, but before the command's run() function is called.
- * See: https://oclif.io/docs/hooks
- *
- * This hook is used to track CLI command signatures (usage analytics).
- * A command signature is something like "env add NAME [VALUE]". That's
- * literally so: 'NAME' and 'VALUE' are NOT replaced with actual values.
- */
-const hook: Hook<'prerun'> = async function (options) {
-	const events = await import('../../events');
-	const usage: string | string[] | undefined = options.Command.usage;
-	const cmdSignature =
-		usage == null ? '*' : typeof usage === 'string' ? usage : usage.join(' ');
-
-	// Intentionally do not await for the track promise here, in order to
-	// run the command tracking and the command itself in parallel.
-	trackResolve(events.trackCommand(cmdSignature));
-};
-
-export default hook;

lib/utils/discover.ts

@@ -1,40 +0,0 @@
-import { enumerateServices, findServices } from 'resin-discoverable-services';
-
-interface LocalBalenaOsDevice {
-	address: string;
-	host: string;
-	osVariant?: string;
-	port: number;
-}
-
-// Although we only check for 'balena-ssh', we know, implicitly, that balenaOS
-// devices come with 'rsync' installed that can be used over SSH.
-const avahiBalenaSshTag = 'resin-ssh';
-
-export async function discoverLocalBalenaOsDevices(
-	timeout = 4000,
-): Promise<LocalBalenaOsDevice[]> {
-	const availableServices = await enumerateServices();
-	const serviceDefinitions = Array.from(availableServices)
-		.filter((s) => Array.from(s.tags).includes(avahiBalenaSshTag))
-		.map((s) => s.service);
-
-	if (serviceDefinitions.length === 0) {
-		throw new Error(
-			`Could not find any available '${avahiBalenaSshTag}' services`,
-		);
-	}
-
-	const services = await findServices(serviceDefinitions, timeout);
-	return services.map(function (service) {
-		// User referer address to get device IP. This will work fine assuming that
-		// a device only advertises own services.
-		const {
-			referer: { address },
-			host,
-			port,
-		} = service;
-
-		return { address, host, port };
-	});
-}

package.json

@@ -1,6 +1,6 @@
 {
   "name": "balena-cli",
-  "version": "18.0.0",
+  "version": "22.1.1",
   "description": "The official balena Command Line Interface",
   "main": "./build/app.js",
   "homepage": "https://github.com/balena-io/balena-cli",
@@ -14,7 +14,7 @@
     "bin/",
     "build/",
     "doc/",
-    "lib/",
+    "src/",
     "patches/",
     "!patches/**/**.dev.patch",
     "*.md",
@@ -22,44 +22,24 @@
     "oclif.manifest.json"
   ],
   "bin": {
-    "balena": "./bin/balena"
-  },
-  "pkg": {
-    "scripts": [
-      "build/**/*.js",
-      "node_modules/balena-sdk/es2018/index.js",
-      "node_modules/pinejs-client-request/node_modules/pinejs-client-core/es2018/index.js",
-      "node_modules/@balena/compose/dist/parse/schemas/*.json"
-    ],
-    "assets": [
-      "build/auth/pages/*.ejs",
-      "node_modules/resin-discoverable-services/services/**/*",
-      "node_modules/balena-sdk/node_modules/balena-pine/**/*",
-      "node_modules/balena-pine/**/*",
-      "node_modules/pinejs-client-core/**/*",
-      "node_modules/open/xdg-open",
-      "node_modules/windosu/*.bat",
-      "node_modules/windosu/*.cmd",
-      "node_modules/axios/**/*",
-      "npm-shrinkwrap.json",
-      "oclif.manifest.json"
-    ]
+    "balena": "./bin/run.js"
   },
   "scripts": {
     "postinstall": "node patches/apply-patches.js",
     "prebuild": "rimraf build/ build-bin/",
+    "pretarball": "ts-node --transpile-only ../../automation/run.ts sign:binaries",
     "build": "npm run build:src && npm run catch-uncommitted",
     "build:t": "npm run lint && npm run build:fast && npm run build:test",
     "build:src": "npm run lint && npm run build:fast && npm run build:test && npm run build:doc && npm run build:completion",
-    "build:pages": "mkdirp ./build/auth/pages/&& inline-source --compress ./lib/auth/pages/error.ejs ./build/auth/pages/error.ejs && inline-source --compress ./lib/auth/pages/success.ejs ./build/auth/pages/success.ejs",
+    "build:pages": "mkdirp ./build/auth/pages/&& inline-source --compress ./src/auth/pages/error.ejs ./build/auth/pages/error.ejs && inline-source --compress ./src/auth/pages/success.ejs ./build/auth/pages/success.ejs",
     "build:fast": "npm run build:pages && tsc && npx oclif manifest",
     "build:test": "tsc -P ./tsconfig.dev.json --noEmit",
     "build:doc": "ts-node --transpile-only automation/capitanodoc/index.ts > docs/balena-cli.md",
     "build:completion": "node completion/generate-completion.js",
     "build:standalone": "ts-node --transpile-only automation/run.ts build:standalone",
     "build:installer": "ts-node --transpile-only automation/run.ts build:installer",
+    "deduplicate-dependencies": "npm dd && git add npm-shrinkwrap.json && git commit --message \"Deduplicate dependencies\"",
     "package": "npm run build:fast && npm run build:standalone && npm run build:installer",
-    "release": "ts-node --transpile-only automation/run.ts release",
     "pretest": "npm run build",
     "test": "npm run test:shrinkwrap && npm run test:core",
     "test:core": "npm run test:source && npm run test:standalone",
@@ -68,15 +48,16 @@
     "test:standalone": "npm run build:standalone && npm run test:standalone:fast",
     "test:standalone:fast": "cross-env BALENA_CLI_TEST_TYPE=standalone mocha --config .mocharc-standalone.js",
     "test:fast": "npm run build:fast && npm run test:source",
+    "test:fast-profile": "npm run test:fast -- -- --inspect-brk=0.0.0.0",
     "test:debug": "cross-env BALENA_CLI_TEST_TYPE=source mocha --inspect-brk=0.0.0.0",
     "test:only": "npm run build:fast && cross-env BALENA_CLI_TEST_TYPE=source mocha \"tests/**/${npm_config_test}.spec.ts\"",
     "catch-uncommitted": "ts-node --transpile-only automation/run.ts catch-uncommitted",
     "ci": "npm run test && npm run catch-uncommitted",
     "lint": "npm run lint-tsconfig && npm run lint-other",
-    "lint-tsconfig": "balena-lint -e ts -e js -t tsconfig.dev.json --fix automation/ lib/ tests/ typings/",
-    "lint-other": "balena-lint -e ts -e js --fix bin/balena bin/balena-dev completion/ .mocharc.js .mocharc-standalone.js",
+    "lint-tsconfig": "balena-lint -e ts -e js -t tsconfig.dev.json --fix automation/ src/ tests/ typings/",
+    "lint-other": "balena-lint -e ts -e js --fix bin/run.js bin/dev.js completion/ .mocharc.js .mocharc-standalone.js",
     "update": "ts-node --transpile-only ./automation/update-module.ts",
-    "prepare": "echo {} > bin/.fast-boot.json",
+    "prepare": "echo {} > bin/.fast-boot.json && husky",
     "prepublishOnly": "npm run build"
   },
   "keywords": [
@@ -91,19 +72,15 @@
   "author": "Balena Inc. (https://balena.io/)",
   "license": "Apache-2.0",
   "engines": {
-    "node": ">=20 <21"
-  },
-  "husky": {
-    "hooks": {
-      "pre-commit": "node automation/check-npm-version.js && ts-node automation/check-doc.ts"
-    }
+    "node": ">=20.6.0 <23"
   },
   "oclif": {
     "bin": "balena",
     "commands": "./build/commands",
     "helpClass": "./build/help",
+    "topicSeparator": " ",
     "hooks": {
-      "prerun": "./build/hooks/prerun/track",
+      "prerun": "./build/hooks/prerun",
       "command_not_found": "./build/hooks/command-not-found/suggest"
     },
     "additionalHelpFlags": [
@@ -111,26 +88,23 @@
     ],
     "macos": {
       "identifier": "io.balena.cli",
-      "sign": "Developer ID Installer: Balena Ltd (66H43P8FRG)"
+      "sign": "\"Developer ID Installer: Balena Ltd (66H43P8FRG)\""
     }
   },
   "devDependencies": {
-    "@balena/lint": "^7.2.1",
+    "@balena/lint": "^9.1.3",
     "@electron/notarize": "^2.0.0",
-    "@octokit/plugin-throttling": "^3.5.1",
-    "@octokit/rest": "^18.6.7",
-    "@types/archiver": "^5.1.1",
     "@types/bluebird": "^3.5.36",
     "@types/body-parser": "^1.19.2",
     "@types/chai": "^4.3.0",
     "@types/chai-as-promised": "^7.1.4",
     "@types/cli-truncate": "^2.0.0",
     "@types/common-tags": "^1.8.1",
-    "@types/diff": "^5.0.3",
-    "@types/dockerode": "^3.3.9",
+    "@types/dockerode": "3.3.23",
     "@types/ejs": "^3.1.0",
     "@types/express": "^4.17.13",
-    "@types/fs-extra": "^9.0.13",
+    "@types/fast-levenshtein": "^0.0.4",
+    "@types/fs-extra": "^11.0.4",
     "@types/global-agent": "^2.1.1",
     "@types/global-tunnel-ng": "^2.1.1",
     "@types/http-proxy": "^1.17.8",
@@ -138,103 +112,90 @@
     "@types/intercept-stdout": "^0.1.0",
     "@types/is-root": "^2.1.2",
     "@types/js-yaml": "^4.0.5",
-    "@types/jsonwebtoken": "^8.5.6",
-    "@types/klaw": "^3.0.3",
+    "@types/jsonwebtoken": "^9.0.6",
+    "@types/klaw": "^3.0.6",
     "@types/lodash": "^4.14.178",
-    "@types/mixpanel": "^2.14.3",
-    "@types/mocha": "^8.2.3",
+    "@types/mime": "^3.0.4",
+    "@types/mocha": "^10.0.7",
+    "@types/mock-fs": "^4.13.4",
     "@types/mock-require": "^2.0.1",
-    "@types/moment-duration-format": "^2.2.3",
     "@types/ndjson": "^2.0.1",
-    "@types/net-keepalive": "^0.4.1",
-    "@types/nock": "^11.1.0",
     "@types/node": "^20.0.0",
     "@types/node-cleanup": "^2.1.2",
-    "@types/parse-link-header": "^1.0.1",
-    "@types/prettyjson": "^0.0.30",
+    "@types/prettyjson": "^0.0.33",
     "@types/progress-stream": "^2.0.2",
-    "@types/request": "^2.48.7",
-    "@types/rewire": "^2.5.28",
+    "@types/rewire": "^2.5.30",
     "@types/rimraf": "^3.0.2",
     "@types/semver": "^7.3.9",
     "@types/shell-escape": "^0.2.0",
-    "@types/sinon": "^10.0.6",
+    "@types/sinon": "^17.0.3",
     "@types/split": "^1.0.0",
     "@types/stream-to-promise": "^2.2.1",
     "@types/tar-stream": "^2.2.2",
     "@types/through2": "^2.0.36",
     "@types/tmp": "^0.2.3",
+    "@types/update-notifier": "^4.1.1",
     "@types/which": "^2.0.1",
     "@types/window-size": "^1.1.1",
-    "archiver": "^5.3.0",
     "catch-uncommitted": "^2.0.0",
     "chai": "^4.3.4",
     "chai-as-promised": "^7.1.1",
     "cross-env": "^7.0.3",
     "deep-object-diff": "^1.1.0",
-    "diff": "^5.0.0",
     "ent": "^2.2.0",
-    "filehound": "^1.17.5",
-    "fs-extra": "^9.1.0",
+    "fs-extra": "^11.2.0",
     "http-proxy": "^1.18.1",
-    "husky": "^4.3.8",
+    "husky": "^9.1.5",
     "inline-source-cli": "^2.0.0",
     "intercept-stdout": "^0.1.2",
-    "jsonwebtoken": "^8.5.1",
-    "mkdirp": "^1.0.4",
-    "mocha": "^8.4.0",
+    "jsonwebtoken": "^9.0.0",
+    "klaw": "^4.1.0",
+    "mocha": "^10.6.0",
+    "mock-fs": "^5.2.0",
     "mock-require": "^3.0.3",
-    "nock": "^13.2.1",
-    "oclif": "^3.17.1",
-    "parse-link-header": "^2.0.0",
-    "publish-release": "^1.6.1",
-    "rewire": "^5.0.0",
+    "nock": "^14.0.4",
+    "oclif": "^4.17.0",
+    "rewire": "^7.0.0",
     "simple-git": "^3.14.1",
-    "sinon": "^11.1.2",
+    "sinon": "^19.0.0",
+    "string-to-stream": "^3.0.1",
     "ts-node": "^10.4.0",
-    "typescript": "^5.3.2"
+    "typescript": "^5.8.2"
   },
   "dependencies": {
-    "@balena/compose": "^3.2.0",
+    "@balena/compose": "^7.0.9",
     "@balena/dockerignore": "^1.0.2",
     "@balena/env-parsing": "^1.1.8",
     "@balena/es-version": "^1.0.1",
-    "@oclif/core": "^3.14.1",
-    "@resin.io/valid-email": "^0.1.0",
-    "@sentry/node": "^6.16.1",
-    "@types/fast-levenshtein": "0.0.1",
-    "@types/update-notifier": "^4.1.1",
-    "@yao-pkg/pkg": "^5.11.1",
-    "balena-config-json": "^4.2.0",
-    "balena-device-init": "^6.0.0",
+    "@oclif/core": "^4.1.0",
+    "@sentry/node": "^9.0.0",
+    "balena-config-json": "^4.2.7",
+    "balena-device-init": "^8.1.11",
     "balena-errors": "^4.7.3",
-    "balena-image-fs": "^7.0.6",
-    "balena-image-manager": "^10.0.1",
-    "balena-preload": "^15.0.1",
-    "balena-sdk": "^19.4.0",
+    "balena-image-fs": "^7.5.2",
+    "balena-preload": "^18.0.4",
+    "balena-sdk": "^21.3.0",
     "balena-semver": "^2.3.0",
     "balena-settings-client": "^5.0.2",
     "balena-settings-storage": "^8.1.0",
-    "bluebird": "^3.7.2",
     "body-parser": "^1.19.1",
-    "chalk": "^3.0.0",
+    "bonjour-service": "^1.2.1",
+    "chalk": "^4.0.0",
     "chokidar": "^3.5.2",
     "cli-truncate": "^2.1.0",
     "color-hash": "^1.1.1",
-    "columnify": "^1.5.2",
     "common-tags": "^1.7.2",
+    "date-fns": "^4.1.0",
     "denymount": "^2.3.0",
-    "docker-modem": "3.0.0",
+    "docker-modem": "^5.0.6",
     "docker-progress": "^5.1.3",
-    "dockerode": "3.3.3",
+    "dockerode": "^4.0.5",
     "ejs": "^3.1.6",
-    "etcher-sdk": "9.0.6",
-    "event-stream": "3.3.4",
+    "etcher-sdk": "^10.0.0",
     "express": "^4.17.2",
     "fast-boot2": "^1.1.0",
     "fast-levenshtein": "^3.0.0",
     "filenamify": "^4.3.0",
-    "get-stdin": "^8.0.0",
     "glob": "^7.2.0",
     "global-agent": "^2.2.0",
     "global-tunnel-ng": "^2.1.1",
@@ -245,25 +206,21 @@
     "is-root": "^2.1.0",
     "js-yaml": "^4.1.0",
     "JSONStream": "^1.0.3",
-    "klaw": "^3.0.0",
+    "jwt-decode": "^3.1.2",
     "livepush": "^3.5.1",
     "lodash": "^4.17.21",
-    "minimatch": "^3.0.4",
-    "moment": "^2.29.1",
-    "moment-duration-format": "^2.3.2",
+    "mime": "^2.4.6",
+    "mkdirp": "^3.0.1",
     "ndjson": "^2.0.0",
-    "net-keepalive": "^3.0.0",
     "node-cleanup": "^2.1.2",
     "node-unzip-2": "^0.2.8",
     "open": "^7.1.0",
-    "patch-package": "^6.4.7",
+    "patch-package": "^8.0.0",
     "prettyjson": "^1.2.5",
     "progress-stream": "^2.0.0",
     "reconfix": "^1.0.0-v0-1-0-fork-46760acff4d165f5238bfac5e464256ef1944476",
-    "request": "^2.88.2",
-    "resin-cli-form": "^2.0.2",
-    "resin-cli-visuals": "^1.8.3",
-    "resin-discoverable-services": "^2.0.4",
+    "resin-cli-form": "^4.0.0",
+    "resin-cli-visuals": "^3.0.0",
     "resin-doodles": "^0.2.0",
     "resin-stream-logger": "^0.1.2",
     "rimraf": "^3.0.2",
@@ -285,7 +242,12 @@
   "optionalDependencies": {
     "windosu": "^0.3.0"
   },
+  "overrides": {
+    "inline-source-cli": {
+      "inline-source": "^8.0.3"
+    }
+  },
   "versionist": {
-    "publishedAt": "2024-02-06T12:19:36.007Z"
+    "publishedAt": "2025-06-19T09:32:53.877Z"
   }
 }

patches/all/@oclif+core+4.1.0.patch

@@ -1,51 +1,22 @@
-diff --git a/node_modules/@oclif/core/lib/cli-ux/list.js b/node_modules/@oclif/core/lib/cli-ux/list.js
-index 607d8dc..07ba1f2 100644
---- a/node_modules/@oclif/core/lib/cli-ux/list.js
-+++ b/node_modules/@oclif/core/lib/cli-ux/list.js
-@@ -22,7 +22,7 @@ function renderList(items) {
-         }
-         left = left.padEnd(maxLength);
-         right = linewrap(maxLength + 2, right);
--        return `${left}  ${right}`;
-+        return `${left} : ${right}`;
-     });
-     return lines.join('\n');
- }
 diff --git a/node_modules/@oclif/core/lib/help/command.js b/node_modules/@oclif/core/lib/help/command.js
-index 63c0545..7caad4a 100644
+index 33105a0..0436982 100644
 --- a/node_modules/@oclif/core/lib/help/command.js
 +++ b/node_modules/@oclif/core/lib/help/command.js
-@@ -58,7 +58,7 @@ class CommandHelp extends formatter_1.HelpFormatter {
-         if (args.filter((a) => a.description).length === 0)
+@@ -58,7 +58,8 @@ class CommandHelp extends formatter_1.HelpFormatter {
              return;
          return args.map((a) => {
--            const name = a.name.toUpperCase();
-+            const name = a.required ? `<${a.name}>` : `[${a.name}]`;
+             // Add ellipsis to indicate that the argument takes multiple values if strict is false
+-            const name = this.command.strict === false ? `${a.name.toUpperCase()}...` : a.name.toUpperCase();
++            let name = this.command.strict === false ? `${a.name.toUpperCase()}...` : a.name.toUpperCase();
++            name = a.required ? `<${name}>` : `[${name}]`;
              let description = a.description || '';
              if (a.default)
                  description = `${(0, theme_1.colorize)(this.config?.theme?.flagDefaultValue, `[default: ${a.default}]`)} ${description}`;
-@@ -153,14 +153,12 @@ class CommandHelp extends formatter_1.HelpFormatter {
-             label = labels.join(flag.char ? (0, theme_1.colorize)(this.config?.theme?.flagSeparator, ', ') : '  ');
-         }
-         if (flag.type === 'option') {
--            let value = flag.helpValue || (this.opts.showFlagNameInTitle ? flag.name : '<value>');
-+            let value = flag.helpValue || (this.opts.showFlagNameInTitle ? flag.name : `<${flag.name}>`);
-             if (!flag.helpValue && flag.options) {
-                 value = showOptions || this.opts.showFlagOptionsInTitle ? `${flag.options.join('|')}` : '<option>';
-             }
-             if (flag.multiple)
--                value += '...';
--            if (!value.includes('|'))
--                value = chalk_1.default.underline(value);
-+                value += ' ...';
-             label += `=${value}`;
-         }
-         return (0, theme_1.colorize)(this.config.theme?.flag, label);
 diff --git a/node_modules/@oclif/core/lib/help/index.js b/node_modules/@oclif/core/lib/help/index.js
-index 242538a..efde8ac 100644
+index 0b48c0e..ff4fed4 100644
 --- a/node_modules/@oclif/core/lib/help/index.js
 +++ b/node_modules/@oclif/core/lib/help/index.js
-@@ -168,11 +168,12 @@ class Help extends HelpBase {
+@@ -173,11 +173,12 @@ class Help extends HelpBase {
          }
          this.log(this.formatCommand(command));
          this.log('');
@@ -56,17 +27,17 @@ index 242538a..efde8ac 100644
              this.log('');
          }
 -        if (subCommands.length > 0) {
-+        if (subTopics.length > 0 && !SUPPRESS_SUBTOPICS) {
++        if (subCommands.length > 0 && !SUPPRESS_SUBTOPICS) {
              const aliases = [];
              const uniqueSubCommands = subCommands.filter((p) => {
                  aliases.push(...p.aliases);
 diff --git a/node_modules/@oclif/core/lib/parser/errors.js b/node_modules/@oclif/core/lib/parser/errors.js
-index 656ec6b..2bbf36b 100644
+index 168da99..538a880 100644
 --- a/node_modules/@oclif/core/lib/parser/errors.js
 +++ b/node_modules/@oclif/core/lib/parser/errors.js
-@@ -14,7 +14,8 @@ Object.defineProperty(exports, "CLIError", { enumerable: true, get: function ()
- class CLIParseError extends errors_1.CLIError {
+@@ -15,7 +15,8 @@ class CLIParseError extends errors_1.CLIError {
      parse;
+     showHelp = false;
      constructor(options) {
 -        options.message += '\nSee more help with --help';
 +        const help = options.command ? `\`${options.command} --help\`` : '--help';
@@ -74,7 +45,7 @@ index 656ec6b..2bbf36b 100644
          super(options.message, { exit: options.exit });
          this.parse = options.parse;
      }
-@@ -37,7 +38,8 @@ exports.InvalidArgsSpecError = InvalidArgsSpecError;
+@@ -38,7 +39,8 @@ exports.InvalidArgsSpecError = InvalidArgsSpecError;
  class RequiredArgsError extends CLIParseError {
      args;
      constructor({ args, exit, flagsWithMultiple, parse, }) {
@@ -83,13 +54,26 @@ index 656ec6b..2bbf36b 100644
 +        let message = `Missing ${args.length} required argument${args.length === 1 ? '' : 's'}`;
          const namedArgs = args.filter((a) => a.name);
          if (namedArgs.length > 0) {
-             const list = (0, list_1.renderList)(namedArgs.map((a) => [a.name, a.description]));
-@@ -48,7 +50,7 @@ class RequiredArgsError extends CLIParseError {
+             const list = (0, list_1.default)(namedArgs.map((a) => {
+@@ -52,7 +54,7 @@ class RequiredArgsError extends CLIParseError {
              message += `\n\nNote: ${flags} allow${flagsWithMultiple.length === 1 ? 's' : ''} multiple values. Because of this you need to provide all arguments before providing ${flagsWithMultiple.length === 1 ? 'that flag' : 'those flags'}.`;
              message += '\nAlternatively, you can use "--" to signify the end of the flags and the beginning of arguments.';
          }
 -        super({ exit: cache_1.default.getInstance().get('exitCodes')?.requiredArgs ?? exit, message, parse });
 +        super({ exit: cache_1.default.getInstance().get('exitCodes')?.requiredArgs ?? exit, message, parse, command });
          this.args = args;
+         this.showHelp = true;
      }
+diff --git a/node_modules/@oclif/core/lib/ux/list.js b/node_modules/@oclif/core/lib/ux/list.js
+index 954954c..0e507c7 100644
+--- a/node_modules/@oclif/core/lib/ux/list.js
++++ b/node_modules/@oclif/core/lib/ux/list.js
+@@ -22,7 +22,7 @@ function renderList(items) {
+         }
+         left = left.padEnd(maxLength);
+         right = linewrap(maxLength + 2, right);
+-        return `${left}  ${right}`;
++        return `${left} : ${right}`;
+     });
+     return lines.join('\n');
  }

patches/all/oclif+3.17.2.dev.patch

@@ -1,285 +0,0 @@
-diff --git a/node_modules/oclif/lib/commands/pack/macos.js b/node_modules/oclif/lib/commands/pack/macos.js
-index d06d0b3..c571fe3 100644
---- a/node_modules/oclif/lib/commands/pack/macos.js
-+++ b/node_modules/oclif/lib/commands/pack/macos.js
-@@ -177,7 +177,8 @@ class PackMacos extends core_1.Command {
-             if (process.env.OSX_KEYCHAIN)
-                 args.push('--keychain', process.env.OSX_KEYCHAIN);
-             args.push(dist);
--            await exec(`pkgbuild  ${args.join(' ')}`);
-+            console.error(`[debug] oclif pkgbuild "${args.join('" "')}"`);
-+            await exec(`pkgbuild  "${args.join('" "')}"`);
-         };
-         const arches = _.uniq(buildConfig.targets
-             .filter(t => t.platform === 'darwin')
-diff --git a/node_modules/oclif/lib/commands/pack/win.js b/node_modules/oclif/lib/commands/pack/win.js
-index c0926bd..a37cd6e 100644
---- a/node_modules/oclif/lib/commands/pack/win.js
-+++ b/node_modules/oclif/lib/commands/pack/win.js
-@@ -59,6 +59,12 @@ InstallDir "\$PROGRAMFILES${arch === 'x64' ? '64' : ''}\\${config.dirname}"
- ${customization}
- 
- Section "${config.name} CLI \${VERSION}"
-+  ; First remove any old client files.
-+  ; (Remnants of old versions were causing CLI errors)
-+  ; Initially tried running the Uninstall.exe, but was
-+  ; unable to make script wait for completion (despite using _?)
-+  DetailPrint "Removing files from previous version."
-+  RMDir /r "$INSTDIR\\client"
-   SetOutPath $INSTDIR
-   File /r bin
-   File /r client
-@@ -226,7 +232,8 @@ class PackWin extends core_1.Command {
-                 fs.writeFile(path.join(installerBase, 'bin', `${flags['additional-cli']}`), scripts.sh({ bin: flags['additional-cli'] })),
-             ] : []));
-             await fs.move(buildConfig.workspace({ platform: 'win32', arch }), path.join(installerBase, 'client'));
--            await exec(`makensis ${installerBase}/${config.bin}.nsi | grep -v "\\[compress\\]" | grep -v "^File: Descending to"`);
-+            const { msysExec, toMsysPath } = require("../../util");
-+            await msysExec(`makensis ${toMsysPath(installerBase)}/${config.bin}.nsi | grep -v "\\[compress\\]" | grep -v "^File: Descending to"`);
-             const templateKey = (0, upload_util_1.templateShortKey)('win32', { bin: config.bin, version: config.version, sha: buildConfig.gitSha, arch });
-             const o = buildConfig.dist(`win32/${templateKey}`);
-             await fs.move(path.join(installerBase, 'installer.exe'), o);
-diff --git a/node_modules/oclif/lib/tarballs/build.js b/node_modules/oclif/lib/tarballs/build.js
-index 384ea4b..602daa4 100644
---- a/node_modules/oclif/lib/tarballs/build.js
-+++ b/node_modules/oclif/lib/tarballs/build.js
-@@ -21,7 +21,8 @@ const pack = async (from, to) => {
-         await exec(`tar cfJ ${to} ${(path.basename(from))}`, { cwd }));
- };
- async function build(c, options = {}) {
--    const { xz, config } = c;
-+    const { xz, config, tmp } = c;
-+    console.error(`[debug] oclif c.root="${c.root}" c.workspace()="${c.workspace()}"`);
-     const packCLI = async () => {
-         const { stdout } = await exec('npm pack --unsafe-perm', { cwd: c.root });
-         return path.join(c.root, stdout.trim().split('\n').pop());
-@@ -30,7 +31,8 @@ async function build(c, options = {}) {
-         await fs.emptyDir(c.workspace());
-         const tarballNewLocation = path.join(c.workspace(), path.basename(tarball));
-         await fs.move(tarball, tarballNewLocation);
--        await exec(`tar -xzf "${tarballNewLocation}"`, { cwd: c.workspace() });
-+        const { msysExec, toMsysPath } = require("../util");
-+        await msysExec(`tar -xzf ${toMsysPath(tarballNewLocation)}`, { cwd: c.workspace() });
-         await Promise.all((await fs.promises.readdir(path.join(c.workspace(), 'package'), { withFileTypes: true }))
-             .map(i => fs.move(path.join(c.workspace(), 'package', i.name), path.join(c.workspace(), i.name))));
-         await Promise.all([
-@@ -38,6 +40,13 @@ async function build(c, options = {}) {
-             fs.promises.rm(path.join(c.workspace(), path.basename(tarball)), { recursive: true }),
-             fs.remove(path.join(c.workspace(), 'bin', 'run.cmd')),
-         ]);
-+        // rename the original balena-cli ./bin/balena entry point for oclif compatibility
-+        await fs.move(path.join(c.workspace(), 'bin', 'balena'), path.join(c.workspace(), 'bin', 'run'));
-+        // The oclif installers are a production installation, while the source
-+        // `bin` folder may contain a `.fast-boot.json` file of a dev installation.
-+        // This has previously led to issues preventing the CLI from starting, so
-+        // delete `.fast-boot.json` (if any) from the destination folder.
-+        await fs.promises.rm(path.join(c.workspace(), 'bin', '.fast-boot.json'));
-     };
-     const updatePJSON = async () => {
-         const pjsonPath = path.join(c.workspace(), 'package.json');
-@@ -49,35 +58,20 @@ async function build(c, options = {}) {
-         await fs.writeJSON(pjsonPath, pjson, { spaces: 2 });
-     };
-     const addDependencies = async () => {
--        const yarnRoot = findYarnWorkspaceRoot(c.root) || c.root;
--        if (fs.existsSync(path.join(yarnRoot, 'yarn.lock'))) {
--            await fs.copy(path.join(yarnRoot, 'yarn.lock'), path.join(c.workspace(), 'yarn.lock'));
--            const yarnVersion = (await exec('yarn -v')).stdout.charAt(0);
--            if (yarnVersion === '1') {
--                await exec('yarn --no-progress --production --non-interactive', { cwd: c.workspace() });
--            }
--            else if (yarnVersion === '2') {
--                throw new Error('Yarn 2 is not supported yet. Try using Yarn 1, or Yarn 3');
--            }
--            else {
--                try {
--                    await exec('yarn workspaces focus --production', { cwd: c.workspace() });
--                }
--                catch (error) {
--                    if (error instanceof Error && error.message.includes('Command not found')) {
--                        throw new Error('Missing workspace tools. Run `yarn plugin import workspace-tools`.');
--                    }
--                    throw error;
--                }
--            }
--        }
--        else {
--            const lockpath = fs.existsSync(path.join(c.root, 'package-lock.json')) ?
--                path.join(c.root, 'package-lock.json') :
--                path.join(c.root, 'npm-shrinkwrap.json');
--            await fs.copy(lockpath, path.join(c.workspace(), path.basename(lockpath)));
--            await exec('npm install --production', { cwd: c.workspace() });
-+        const ws = c.workspace();
-+        exec(`cd ${ws}`);
-+        console.error(`[debug] oclif copying node_modules to "${ws}"`)
-+        const source = path.join(c.root, 'node_modules');
-+        if (process.platform === 'win32') {
-+            await exec(`xcopy "${source}" "${ws}\\node_modules" /S /E /B /I /K /Q /Y`);
-+        } else {
-+            // use the shell's `cp` on macOS in order to preserve extended
-+            // file attributes containing `codesign` digital signatures
-+            await exec(`cp -pR "${source}" "${ws}"`);
-         }
-+        console.error(`[debug] oclif running "npm prune --production" in "${ws}"`);
-+        await exec('npm prune --production', { cwd: c.workspace() });
-+        console.error(`[debug] oclif done`);
-     };
-     const pretarball = async () => {
-         const pjson = await fs.readJSON(path.join(c.workspace(), 'package.json'));
-@@ -115,7 +109,8 @@ async function build(c, options = {}) {
-             output: path.join(workspace, 'bin', 'node'),
-             platform: target.platform,
-             arch: target.arch,
--            tmp: path.join(config.root, 'tmp'),
-+            tmp,
-+            projectRootPath: c.root
-         });
-         if (options.pack === false)
-             return;
-@@ -158,6 +153,7 @@ async function build(c, options = {}) {
-         await fs.writeJSON(manifestFilepath, manifest, { spaces: 2 });
-     };
-     (0, log_1.log)(`gathering workspace for ${config.bin} to ${c.workspace()}`);
-+    console.error(`[debug] ${options.tarball}`);
-     await extractCLI(options.tarball ? options.tarball : await packCLI());
-     await updatePJSON();
-     await addDependencies();
-diff --git a/node_modules/oclif/lib/tarballs/config.js b/node_modules/oclif/lib/tarballs/config.js
-index 216759d..cab0e6e 100644
---- a/node_modules/oclif/lib/tarballs/config.js
-+++ b/node_modules/oclif/lib/tarballs/config.js
-@@ -25,7 +25,10 @@ async function gitSha(cwd, options = {}) {
- }
- exports.gitSha = gitSha;
- async function Tmp(config) {
--    const tmp = path.join(config.root, 'tmp');
-+     const tmp = process.env.BUILD_TMP
-+         ? path.join(process.env.BUILD_TMP, 'oclif')
-+         : path.join(config.root, 'tmp');
-+    console.error(`[debug] oclif tmp="${tmp}"`);
-     await fs.promises.mkdir(tmp, { recursive: true });
-     return tmp;
- }
-@@ -62,7 +65,7 @@ async function buildConfig(root, options = {}) {
-         s3Config: updateConfig.s3,
-         nodeVersion,
-         workspace(target) {
--            const base = path.join(config.root, 'tmp');
-+            const base = tmp;
-             if (target && target.platform)
-                 return path.join(base, [target.platform, target.arch].join('-'), (0, upload_util_1.templateShortKey)('baseDir', { bin: config.bin }));
-             return path.join(base, (0, upload_util_1.templateShortKey)('baseDir', { bin: config.bin }));
-diff --git a/node_modules/oclif/lib/tarballs/node.js b/node_modules/oclif/lib/tarballs/node.js
-index 35f1d0c..5349eaa 100644
---- a/node_modules/oclif/lib/tarballs/node.js
-+++ b/node_modules/oclif/lib/tarballs/node.js
-@@ -12,6 +12,7 @@ const retry = require("async-retry");
- const util_2 = require("../util");
- const pipeline = (0, util_1.promisify)(stream_1.pipeline);
- const exec = (0, util_1.promisify)(child_process_1.exec);
-+const { isMSYS2, msysExec, toMsysPath } = require("../util");
- const RETRY_TIMEOUT_MS = 1000;
- async function fetchNodeBinary({ nodeVersion, output, platform, arch, tmp }) {
-     if (arch === 'arm')
-@@ -42,8 +43,10 @@ async function fetchNodeBinary({ nodeVersion, output, platform, arch, tmp }) {
-         const basedir = path.dirname(tarball);
-         await fs.promises.mkdir(basedir, { recursive: true });
-         await pipeline(got_1.default.stream(url), fs.createWriteStream(tarball));
--        if (platform !== 'win32')
--            await exec(`grep "${path.basename(tarball)}" "${shasums}" | shasum -a 256 -c -`, { cwd: basedir });
-+        if (platform !== 'win32') {
-+            const shaCmd = isMSYS2 ? 'sha256sum -c -' : 'shasum -a 256 -c -';
-+            await msysExec(`grep ${path.basename(tarball)} ${toMsysPath(shasums)} | ${shaCmd}`, { cwd: basedir });
-+        }
-     };
-     const extract = async () => {
-         (0, log_1.log)(`extracting ${nodeBase}`);
-@@ -51,7 +54,7 @@ async function fetchNodeBinary({ nodeVersion, output, platform, arch, tmp }) {
-         await fs.promises.mkdir(nodeTmp, { recursive: true });
-         await fs.promises.mkdir(path.dirname(cache), { recursive: true });
-         if (platform === 'win32') {
--            await exec(`7z x -bd -y "${tarball}"`, { cwd: nodeTmp });
-+            await msysExec(`7z x -bd -y ${toMsysPath(tarball)} > /dev/null`, { cwd: nodeTmp });
-             await fs.move(path.join(nodeTmp, nodeBase, 'node.exe'), path.join(cache, 'node.exe'));
-         }
-         else {
-diff --git a/node_modules/oclif/lib/upload-util.js b/node_modules/oclif/lib/upload-util.js
-index 6963e4d..430472d 100644
---- a/node_modules/oclif/lib/upload-util.js
-+++ b/node_modules/oclif/lib/upload-util.js
-@@ -31,10 +31,10 @@ options = { root: '.' }) {
-     const templates = {
-         baseDir: '<%- bin %>',
-         unversioned: '<%- bin %>-<%- platform %>-<%- arch %><%- ext %>',
--        versioned: '<%- bin %>-v<%- version %>-<%- sha %>-<%- platform %>-<%- arch %><%- ext %>',
--        manifest: '<%- bin %>-v<%- version %>-<%- sha %>-<%- platform %>-<%- arch %>-buildmanifest',
--        macos: '<%- bin %>-v<%- version %>-<%- sha %>-<%- arch %>.pkg',
--        win32: '<%- bin %>-v<%- version %>-<%- sha %>-<%- arch %>.exe',
-+        versioned: '<%- bin %>-v<%- version %>-<%- platform %>-<%- arch %><%- ext %>',
-+        manifest: '<%- bin %>-v<%- version %>-<%- platform %>-<%- arch %>-buildmanifest',
-+        macos: '<%- bin %>-v<%- version %>.pkg',
-+        win32: '<%- bin %>-v<%- version %>-<%- arch %>.exe',
-         deb: '<%- bin %>_<%- versionShaRevision %>_<%- arch %>.deb',
-     };
-     return _.template(templates[type])(Object.assign({}, options));
-diff --git a/node_modules/oclif/lib/util.js b/node_modules/oclif/lib/util.js
-index 816c71b..1384aa6 100644
---- a/node_modules/oclif/lib/util.js
-+++ b/node_modules/oclif/lib/util.js
-@@ -95,9 +95,10 @@ const hash = async (algo, fp) => {
-     });
- };
- exports.hash = hash;
-+
- async function checkFor7Zip() {
-     try {
--        await exec('7z');
-+        await msysExec('7z', { stdio: [0, null, 2] });
-     }
-     catch (error) {
-         if (error.code === 127)
-@@ -107,3 +108,44 @@ async function checkFor7Zip() {
-     }
- }
- exports.checkFor7Zip = checkFor7Zip;
-+
-+// OSTYPE is 'msys' for MSYS 1.0 and for MSYS2, or 'cygwin' for Cygwin
-+// but note that OSTYPE is not "exported" by default, so run: export OSTYPE=$OSTYPE
-+// MSYSTEM is 'MINGW32' for MSYS 1.0, 'MSYS' for MSYS2, and undefined for Cygwin
-+const isCygwin = process.env.OSTYPE === 'cygwin';
-+const isMinGW = process.env.MSYSTEM && process.env.MSYSTEM.startsWith('MINGW');
-+const isMSYS2 = process.env.MSYSTEM && process.env.MSYSTEM.startsWith('MSYS');
-+const MSYSSHELLPATH = process.env.MSYSSHELLPATH ||
-+    (isMSYS2 ? 'C:\\msys64\\usr\\bin\\bash.exe' :
-+        (isMinGW ? 'C:\\MinGW\\msys\\1.0\\bin\\bash.exe' :
-+            (isCygwin ? 'C:\\cygwin64\\bin\\bash.exe' : '/bin/sh')));
-+
-+exports.isCygwin = isCygwin;
-+exports.isMinGW = isMinGW;
-+exports.isMSYS2 = isMSYS2;
-+console.error(`[debug] oclif MSYSSHELLPATH=${MSYSSHELLPATH} MSYSTEM=${process.env.MSYSTEM} OSTYPE=${process.env.OSTYPE} isMSYS2=${isMSYS2} isMingGW=${isMinGW} isCygwin=${isCygwin}`);
-+
-+/* Convert a Windows path like 'C:\tmp' to a MSYS path like '/c/tmp' */
-+function toMsysPath(windowsPath) {
-+    // 'c:\myfolder' -> '/c/myfolder' or '/cygdrive/c/myfolder'
-+    let msysPath = windowsPath.replace(/\\/g, '/');
-+    if (isMSYS2 || isMinGW) {
-+        msysPath = msysPath.replace(/^([a-zA-Z]):/, '/$1');
-+    } else if (isCygwin) {
-+        msysPath = msysPath.replace(/^([a-zA-Z]):/, '/cygdrive/$1');
-+    }
-+    console.error(`[debug] oclif toMsysPath before="${windowsPath}" after="${msysPath}"`);
-+    return msysPath;
-+}
-+exports.toMsysPath = toMsysPath;
-+
-+async function msysExec(cmd, options = {}) {
-+    if (process.platform !== 'win32') {
-+        return exec(cmd, options);
-+    }
-+    const sh = MSYSSHELLPATH;
-+    const args = ['-c', cmd];
-+    console.error(`[debug] oclif msysExec sh="${sh}" args=${JSON.stringify(args)} options=${JSON.stringify(options)}`);
-+    return exec(`"${sh}" "${args.join('" "')}"`, options);
-+}
-+exports.msysExec = msysExec;

patches/all/oclif+4.17.0.dev.patch

@@ -0,0 +1,33 @@
+diff --git a/node_modules/oclif/lib/commands/pack/win.js b/node_modules/oclif/lib/commands/pack/win.js
+index bfe9205..482519e 100644
+--- a/node_modules/oclif/lib/commands/pack/win.js
++++ b/node_modules/oclif/lib/commands/pack/win.js
+@@ -86,6 +86,12 @@ InstallDir "\$PROGRAMFILES${arch === 'x64' ? '64' : ''}\\${config.dirname}"
+ ${customization}
+ 
+ Section "${config.name} CLI \${VERSION}"
++  ; First remove any old client files.
++  ; (Remnants of old versions were causing CLI errors)
++  ; Initially tried running the Uninstall.exe, but was
++  ; unable to make script wait for completion (despite using _?)
++  DetailPrint "Removing files from previous version."
++  RMDir /r "$INSTDIR\\client"
+   SetOutPath $INSTDIR
+   File /r bin
+   File /r client
+diff --git a/node_modules/oclif/lib/tarballs/build.js b/node_modules/oclif/lib/tarballs/build.js
+index f0c8d95..a72400e 100644
+--- a/node_modules/oclif/lib/tarballs/build.js
++++ b/node_modules/oclif/lib/tarballs/build.js
+@@ -218,6 +218,11 @@ const extractCLI = async (tarball, c) => {
+         (0, promises_1.rm)(path.join(workspace, path.basename(tarball)), { recursive: true }),
+         (0, fs_extra_1.remove)(path.join(workspace, 'bin', 'run.cmd')),
+     ]);
++    // The oclif installers are a production installation, while the source
++    // `bin` folder may contain a `.fast-boot.json` file of a dev installation.
++    // This has previously led to issues preventing the CLI from starting, so
++    // delete `.fast-boot.json` (if any) from the destination folder.
++    await (0, fs_extra_1.remove)(path.join(workspace, 'bin', '.fast-boot.json'));
+ };
+ const buildTarget = async (target, c, options) => {
+     if (target.platform === 'win32' && target.arch === 'arm64' && (0, semver_1.lt)(c.nodeVersion, '20.0.0')) {

patches/all/open+7.4.2.patch

@@ -1,16 +0,0 @@
-diff --git a/node_modules/open/index.js b/node_modules/open/index.js
-index 13147d0..ff161dd 100644
---- a/node_modules/open/index.js
-+++ b/node_modules/open/index.js
-@@ -10,7 +10,10 @@ const pAccess = promisify(fs.access);
- const pReadFile = promisify(fs.readFile);
- 
- // Path to included `xdg-open`.
--const localXdgOpenPath = path.join(__dirname, 'xdg-open');
-+const localXdgOpenPath = process.pkg
-+	? path.join(path.dirname(process.execPath), 'xdg-open')
-+	: path.join(__dirname, 'xdg-open');
-+
- 
- /**
- Get the mount point for fixed drives in WSL.

patches/unix/node-gyp-build+4.6.0.patch

@@ -1,14 +0,0 @@
-diff --git a/node_modules/node-gyp-build/node-gyp-build.js b/node_modules/node-gyp-build/node-gyp-build.js
-index 61b398e..3cc3be8 100644
---- a/node_modules/node-gyp-build/node-gyp-build.js
-+++ b/node_modules/node-gyp-build/node-gyp-build.js
-@@ -30,6 +30,9 @@ load.resolve = load.path = function (dir) {
-     if (process.env[name + '_PREBUILD']) dir = process.env[name + '_PREBUILD']
-   } catch (err) {}
- 
-+  // pkg fix: native node modules are located externally to the pkg executable
-+  dir = dir.replace(/^\/snapshot\/.+?\/node_modules\//, path.dirname(process.execPath) + path.sep)
-+
-   if (!prebuildsOnly) {
-     var release = getFirst(path.join(dir, 'build/Release'), matchBuild)
-     if (release) return release

patches/win32/windosu+0.3.0.patch

@@ -1,38 +0,0 @@
-diff --git a/node_modules/windosu/lib/pipe.js b/node_modules/windosu/lib/pipe.js
-index dc81fa5..a381cc7 100644
---- a/node_modules/windosu/lib/pipe.js
-+++ b/node_modules/windosu/lib/pipe.js
-@@ -42,7 +42,8 @@ function pipe(path, options) {
-     return d.promise;
- }
- module.exports = pipe;
--if (module === require.main) {
-+
-+function main() {
-     if (!process.argv[4]) {
-         console.error('Incorrect arguments!');
-         process.exit(-1);
-@@ -52,3 +53,8 @@ if (module === require.main) {
-         serve: process.argv[3] == 'server'
-     });
- }
-+module.exports.main = main;
-+
-+if (module === require.main) {
-+    main();
-+}
-diff --git a/node_modules/windosu/lib/windosu.js b/node_modules/windosu/lib/windosu.js
-index 6502812..dd0391a 100644
---- a/node_modules/windosu/lib/windosu.js
-+++ b/node_modules/windosu/lib/windosu.js
-@@ -16,7 +16,9 @@ module.exports.exec = function (command, options, callback) {
-                         temp: temp,
-                         command: command,
-                         cliWidth: cliWidth(),
--                        pipe: '"' + process.execPath + '" "' + path.join(__dirname, 'pipe.js') + '"',
-+                        pipe: process.pkg
-+                            ? '"' + process.execPath + '" pkgExec "' + path.join(__dirname, 'pipe.js') + '::main"'
-+                            : '"' + process.execPath + '" "' + path.join(__dirname, 'pipe.js') + '"',
-                         input: inputName = id + '-in',
-                         output: outputName = id + '-out',
-                         stderr_redir: process.stdout.isTTY ? '2>&1' : '2> %ERROR%'

repo.yml

@@ -6,6 +6,10 @@ upstream:
     url: 'https://github.com/balena-io/balena-sdk'
   - repo: 'balena-config-json'
     url: 'https://github.com/balena-io-modules/balena-config-json'
+  - repo: 'balena-image-fs'
+    url: 'https://github.com/balena-io-modules/balena-image-fs'
+  - repo: 'balena-device-init'
+    url: 'https://github.com/balena-io-modules/balena-device-init'
   - repo: 'balena-image-manager'
     url: 'https://github.com/balena-io-modules/balena-image-manager'
   - repo: 'balena-preload'

src/app.ts

@@ -16,8 +16,8 @@
  */
 
 import * as packageJSON from '../package.json';
+import type { AppOptions } from './preparser';
 import {
-	AppOptions,
 	checkDeletedCommand,
 	preparseArgs,
 	unsupportedFlag,
@@ -34,18 +34,14 @@ export const setupSentry = onceAsync(async () => {
 	const config = await import('./config');
 	const Sentry = await import('@sentry/node');
 	Sentry.init({
-		autoSessionTracking: false,
 		dsn: config.sentryDsn,
 		release: packageJSON.version,
 	});
-	Sentry.configureScope((scope) => {
-		scope.setExtras({
-			is_pkg: !!(process as any).pkg,
-			node_version: process.version,
-			platform: process.platform,
-		});
+	Sentry.getCurrentScope().setExtras({
+		is_pkg: !!(process as any).pkg,
+		node_version: process.version,
+		platform: process.platform,
 	});
-	return Sentry.getCurrentHub();
 });
 
 async function checkNodeVersion() {
@@ -101,11 +97,9 @@ async function init() {
 
 /** Execute the oclif parser and the CLI command. */
 async function oclifRun(command: string[], options: AppOptions) {
-	let deprecationPromise: Promise<void>;
+	let deprecationPromise: Promise<void> | undefined;
 	// check and enforce the CLI's deprecation policy
-	if (unsupportedFlag || process.env.BALENARC_UNSUPPORTED) {
-		deprecationPromise = Promise.resolve();
-	} else {
+	if (!(unsupportedFlag || process.env.BALENARC_UNSUPPORTED)) {
 		const { DeprecationChecker } = await import('./deprecation');
 		const deprecationChecker = new DeprecationChecker(packageJSON.version);
 		// warnAndAbortIfDeprecated uses previously cached data only
@@ -137,7 +131,8 @@ async function oclifRun(command: string[], options: AppOptions) {
 			}
 		}
 		if (shouldFlush) {
-			await import('@oclif/core/flush');
+			const { flush } = await import('@oclif/core');
+			await flush();
 		}
 		// TODO: figure out why we need to call fast-boot stop() here, in
 		// addition to calling it in the main `run()` function in this file.
@@ -152,26 +147,20 @@ async function oclifRun(command: string[], options: AppOptions) {
 		}
 	})(!options.noFlush);
 
-	const { trackPromise } = await import('./hooks/prerun/track');
+	const { trackPromise } = await import('./hooks/prerun');
 
 	await Promise.all([trackPromise, deprecationPromise, runPromise]);
 }
 
-/** CLI entrypoint. Called by the `bin/balena` and `bin/balena-dev` scripts. */
+/** CLI entrypoint. Called by the `bin/run.js` and `bin/dev.js` scripts. */
 export async function run(cliArgs = process.argv, options: AppOptions) {
 	try {
-		const { setOfflineModeEnvVars, normalizeEnvVars, pkgExec } = await import(
+		const { setOfflineModeEnvVars, normalizeEnvVars } = await import(
 			'./utils/bootstrap'
 		);
 		setOfflineModeEnvVars();
 		normalizeEnvVars();
 
-		// The 'pkgExec' special/internal command provides a Node.js interpreter
-		// for use of the standalone zip package. See pkgExec function.
-		if (cliArgs.length > 3 && cliArgs[2] === 'pkgExec') {
-			return pkgExec(cliArgs[3], cliArgs.slice(4));
-		}
-
 		await init();
 
 		// Look for commands that have been removed and if so, exit with a notice

src/commands/api-key/generate.ts

@@ -0,0 +1,156 @@
+/**
+ * @license
+ * Copyright 2016-2020 Balena Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import { Args, Command } from '@oclif/core';
+import { ExpectedError } from '../../errors';
+import { getBalenaSdk, getCliForm, stripIndent } from '../../utils/lazy';
+import {
+	formatDuration,
+	intervalToDuration,
+	isValid,
+	parseISO,
+} from 'date-fns';
+
+// In days
+const durations = [1, 7, 30, 90];
+
+async function isLoggedInWithJwt() {
+	const balena = getBalenaSdk();
+	try {
+		const token = await balena.auth.getToken();
+		const { default: jwtDecode } = await import('jwt-decode');
+		jwtDecode(token);
+		return true;
+	} catch {
+		return false;
+	}
+}
+
+export default class GenerateCmd extends Command {
+	public static description = stripIndent`
+		Generate a new balenaCloud API key.
+
+		Generate a new balenaCloud API key for the current user, with the given
+		name. The key will be logged to the console.
+
+		This key can be used to log into the CLI using 'balena login --token <key>',
+		or to authenticate requests to the API with an 'Authorization: Bearer <key>' header.
+`;
+	public static examples = [
+		'$ balena api-key generate "Jenkins Key"',
+		'$ balena api-key generate "Jenkins Key" 2025-10-30',
+		'$ balena api-key generate "Jenkins Key" never',
+	];
+
+	public static args = {
+		name: Args.string({
+			description: 'the API key name',
+			required: true,
+		}),
+		expiryDate: Args.string({
+			description:
+				'the expiry date of the API key as an ISO date string, or "never" for no expiry',
+		}),
+	};
+
+	public static authenticated = true;
+
+	public async run() {
+		const { args: params } = await this.parse(GenerateCmd);
+
+		let expiryDateResponse: string | number | undefined = params.expiryDate;
+		let key;
+		try {
+			if (!expiryDateResponse) {
+				expiryDateResponse = await getCliForm().ask({
+					message: 'Please pick an expiry date for the API key',
+					type: 'list',
+					choices: [...durations, 'custom', 'never'].map((duration) => ({
+						name:
+							duration === 'never'
+								? 'No expiration'
+								: typeof duration === 'number'
+									? formatDuration(
+											intervalToDuration({
+												start: 0,
+												end: duration * 24 * 60 * 60 * 1000,
+											}),
+										)
+									: 'Custom expiration',
+						value: duration,
+					})),
+				});
+			}
+			let expiryDate: Date | null;
+			if (expiryDateResponse === 'never') {
+				expiryDate = null;
+			} else if (expiryDateResponse === 'custom') {
+				do {
+					expiryDate = parseISO(
+						await getCliForm().ask({
+							message:
+								'Please enter an expiry date for the API key as an ISO date string',
+							type: 'input',
+						}),
+					);
+					if (!isValid(expiryDate)) {
+						console.error('Invalid date format');
+					}
+				} while (!isValid(expiryDate));
+			} else if (typeof expiryDateResponse === 'string') {
+				expiryDate = parseISO(expiryDateResponse);
+				if (!isValid(expiryDate)) {
+					throw new Error(
+						'Invalid date format, please use a valid ISO date string',
+					);
+				}
+			} else {
+				expiryDate = new Date(
+					Date.now() + expiryDateResponse * 24 * 60 * 60 * 1000,
+				);
+			}
+			key = await getBalenaSdk().models.apiKey.create({
+				name: params.name,
+				expiryDate: expiryDate === null ? null : expiryDate.toISOString(),
+			});
+		} catch (e) {
+			if (e.name === 'BalenaNotLoggedIn') {
+				if (await isLoggedInWithJwt()) {
+					throw new ExpectedError(stripIndent`
+						This command requires you to have been recently authenticated.
+						Please login again with 'balena login'.
+						In case you are using the Web authorization method, you need to logout and re-login to the dashboard first.
+					`);
+				}
+				throw new ExpectedError(stripIndent`
+					This command cannot be run when logged in with an API key.
+					Please login again with 'balena login' and select an alternative method.
+				`);
+			} else {
+				throw e;
+			}
+		}
+
+		console.log(stripIndent`
+			Registered api key '${params.name}':
+
+			${key}
+
+			This key will not be shown again, so please save it now.
+		`);
+	}
+}

src/commands/api-key/list.ts

@@ -15,12 +15,14 @@
  * limitations under the License.
  */
 
-import { Flags } from '@oclif/core';
-import Command from '../../command';
+import { Flags, Command } from '@oclif/core';
 import * as cf from '../../utils/common-flags';
 import { getBalenaSdk, getVisuals, stripIndent } from '../../utils/lazy';
 
-export default class ApiKeysCmd extends Command {
+export default class APIKeyListCmd extends Command {
+	public static aliases = ['api-keys'];
+	public static deprecateAliases = true;
+
 	public static description = stripIndent`
 		Print a list of balenaCloud API keys.
 
@@ -28,12 +30,9 @@ export default class ApiKeysCmd extends Command {
 
 		Print a list of balenaCloud API keys for the current user or for a specific fleet with the \`--fleet\` option.
 `;
-	public static examples = ['$ balena api-keys'];
-
-	public static usage = 'api-keys';
+	public static examples = ['$ balena api-key list'];
 
 	public static flags = {
-		help: cf.help,
 		user: Flags.boolean({
 			char: 'u',
 			description: 'show API keys for your user',
@@ -44,7 +43,7 @@ export default class ApiKeysCmd extends Command {
 	public static authenticated = true;
 
 	public async run() {
-		const { flags: options } = await this.parse(ApiKeysCmd);
+		const { flags: options } = await this.parse(APIKeyListCmd);
 
 		const { getApplication } = await import('../../utils/sdk');
 		const actorId = options.fleet
@@ -52,7 +51,7 @@ export default class ApiKeysCmd extends Command {
 					await getApplication(getBalenaSdk(), options.fleet, {
 						$select: 'actor',
 					})
-			  ).actor
+				).actor.__id
 			: await getBalenaSdk().auth.getActorId();
 		const keys = await getBalenaSdk().pine.get({
 			resource: 'api_key',
@@ -65,7 +64,7 @@ export default class ApiKeysCmd extends Command {
 								name: {
 									$ne: null,
 								},
-						  }
+							}
 						: {}),
 				},
 				$orderby: 'name asc',

src/commands/api-key/revoke.ts

@@ -15,9 +15,7 @@
  * limitations under the License.
  */
 
-import { Args } from '@oclif/core';
-import Command from '../../command';
-import * as cf from '../../utils/common-flags';
+import { Args, Command } from '@oclif/core';
 import { getBalenaSdk, stripIndent } from '../../utils/lazy';
 
 export default class RevokeCmd extends Command {
@@ -41,12 +39,6 @@ export default class RevokeCmd extends Command {
 		}),
 	};
 
-	public static usage = 'api-key revoke <ids>';
-
-	public static flags = {
-		help: cf.help,
-	};
-
 	public static authenticated = true;
 
 	public async run() {
@@ -58,9 +50,9 @@ export default class RevokeCmd extends Command {
 			return;
 		}
 		await Promise.all(
-			apiKeyIds.map(
-				async (id) => await getBalenaSdk().models.apiKey.revoke(Number(id)),
-			),
+			apiKeyIds.map(async (id) => {
+				await getBalenaSdk().models.apiKey.revoke(Number(id));
+			}),
 		);
 		console.log('Successfully revoked the given API keys');
 	}

src/commands/app/create.ts

@@ -15,10 +15,7 @@
  * limitations under the License.
  */
 
-import { Flags, Args } from '@oclif/core';
-
-import Command from '../../command';
-import * as cf from '../../utils/common-flags';
+import { Flags, Args, Command } from '@oclif/core';
 import { stripIndent } from '../../utils/lazy';
 
 export default class AppCreateCmd extends Command {
@@ -30,10 +27,10 @@ export default class AppCreateCmd extends Command {
 		You can specify the organization the app should belong to using
 		the \`--organization\` option. The organization's handle, not its name,
 		should be provided. Organization handles can be listed with the
-		\`balena orgs\` command.
+		\`balena organization list\` command.
 
 		The app's default device type is specified with the \`--type\` option.
-		The \`balena devices supported\` command can be used to list the available
+		The \`balena device-type list\` command can be used to list the available
 		device types.
 
 		Interactive dropdowns will be shown for selection if no device type or
@@ -56,8 +53,6 @@ export default class AppCreateCmd extends Command {
 		}),
 	};
 
-	public static usage = 'app create <name>';
-
 	public static flags = {
 		organization: Flags.string({
 			char: 'o',
@@ -66,9 +61,8 @@ export default class AppCreateCmd extends Command {
 		type: Flags.string({
 			char: 't',
 			description:
-				'app device type (Check available types with `balena devices supported`)',
+				'app device type (Check available types with `balena device-type list`)',
 		}),
-		help: cf.help,
 	};
 
 	public static authenticated = true;

src/commands/block/create.ts

@@ -15,10 +15,7 @@
  * limitations under the License.
  */
 
-import { Flags, Args } from '@oclif/core';
-
-import Command from '../../command';
-import * as cf from '../../utils/common-flags';
+import { Flags, Args, Command } from '@oclif/core';
 import { stripIndent } from '../../utils/lazy';
 
 export default class BlockCreateCmd extends Command {
@@ -30,10 +27,10 @@ export default class BlockCreateCmd extends Command {
 		You can specify the organization the block should belong to using
 		the \`--organization\` option. The organization's handle, not its name,
 		should be provided. Organization handles can be listed with the
-		\`balena orgs\` command.
+		\`balena organization list\` command.
 
 		The block's default device type is specified with the \`--type\` option.
-		The \`balena devices supported\` command can be used to list the available
+		The \`balena device-type list\` command can be used to list the available
 		device types.
 
 		Interactive dropdowns will be shown for selection if no device type or
@@ -56,8 +53,6 @@ export default class BlockCreateCmd extends Command {
 		}),
 	};
 
-	public static usage = 'block create <name>';
-
 	public static flags = {
 		organization: Flags.string({
 			char: 'o',
@@ -66,9 +61,8 @@ export default class BlockCreateCmd extends Command {
 		type: Flags.string({
 			char: 't',
 			description:
-				'block device type (Check available types with `balena devices supported`)',
+				'block device type (Check available types with `balena device-type list`)',
 		}),
-		help: cf.help,
 	};
 
 	public static authenticated = true;

src/commands/build/index.ts

@@ -15,12 +15,17 @@
  * limitations under the License.
  */
 
-import { Args, Flags } from '@oclif/core';
-import Command from '../../command';
+import { Args, Flags, Command } from '@oclif/core';
 import { getBalenaSdk } from '../../utils/lazy';
 import * as cf from '../../utils/common-flags';
 import * as compose from '../../utils/compose';
-import type { ApplicationType, BalenaSDK } from 'balena-sdk';
+import type {
+	ApplicationType,
+	BalenaSDK,
+	DeviceType,
+	PineOptions,
+	PineTypedResult,
+} from 'balena-sdk';
 import {
 	buildArgDeprecation,
 	dockerignoreHelp,
@@ -31,15 +36,16 @@ import { buildProject, composeCliFlags } from '../../utils/compose_ts';
 import type { BuildOpts, DockerCliFlags } from '../../utils/docker';
 import { dockerCliFlags } from '../../utils/docker';
 
-// TODO: For this special one we can't use Interfaces.InferredFlags/InferredArgs
-// because of the 'registry-secrets' type which is defined in the actual code
-// as a path (string | undefined) but then the cli turns it into an object
-interface FlagsDef extends ComposeCliFlags, DockerCliFlags {
+type ComposeGenerateOptsParam = Parameters<typeof compose.generateOpts>[0];
+
+interface PrepareBuildOpts
+	extends ComposeCliFlags,
+		DockerCliFlags,
+		ComposeGenerateOptsParam {
 	arch?: string;
 	deviceType?: string;
 	fleet?: string;
-	source?: string; // Not part of command profile - source param copied here.
-	help: void;
+	source?: string;
 }
 
 export default class BuildCmd extends Command {
@@ -67,6 +73,7 @@ ${dockerignoreHelp}
 	public static examples = [
 		'$ balena build --fleet myFleet',
 		'$ balena build ./source/ --fleet myorg/myfleet',
+		'$ balena build --deviceType raspberrypi3 --emulated',
 		'$ balena build --deviceType raspberrypi3 --arch armv7hf --emulated',
 		'$ balena build --docker /var/run/docker.sock --fleet myFleet   # Linux, Mac',
 		'$ balena build --docker //./pipe/docker_engine --fleet myFleet # Windows',
@@ -77,8 +84,6 @@ ${dockerignoreHelp}
 		source: Args.string({ description: 'path of project source directory' }),
 	};
 
-	public static usage = 'build [source]';
-
 	public static flags = {
 		arch: Flags.string({
 			description: 'the architecture to build for',
@@ -91,9 +96,6 @@ ${dockerignoreHelp}
 		fleet: cf.fleet,
 		...composeCliFlags,
 		...dockerCliFlags,
-		// NOTE: Not supporting -h for help, because of clash with -h in DockerCliFlags
-		// Revisit this in future release.
-		help: Flags.help({}),
 	};
 
 	public static primary = true;
@@ -101,36 +103,43 @@ ${dockerignoreHelp}
 	public async run() {
 		const { args: params, flags: options } = await this.parse(BuildCmd);
 
-		await Command.checkLoggedInIf(!!options.fleet);
+		const Logger = await import('../../utils/logger');
+		const { checkLoggedInIf } = await import('../../utils/patterns');
+
+		await checkLoggedInIf(!!options.fleet);
 
 		(await import('events')).defaultMaxListeners = 1000;
 
 		const sdk = getBalenaSdk();
 
-		const logger = await Command.getLogger();
+		const logger = Logger.getLogger();
 		logger.logDebug('Parsing input...');
 
-		// `build` accepts `source` as a parameter, but compose expects it as an option
-		options.source = params.source;
-		delete params.source;
+		const prepareBuildOpts = {
+			...options,
+			source: params.source,
+		};
 
-		await this.validateOptions(options, sdk);
+		await this.resolveArchFromDeviceType(sdk, prepareBuildOpts);
+
+		await this.validateOptions(prepareBuildOpts, sdk);
 
 		// Build args are under consideration for removal - warn user
-		if (options.buildArg) {
+		if (prepareBuildOpts.buildArg) {
 			console.log(buildArgDeprecation);
 		}
 
-		const app = await this.getAppAndResolveArch(options);
+		const app = await this.getAppAndResolveArch(prepareBuildOpts);
 
-		const { docker, buildOpts, composeOpts } = await this.prepareBuild(options);
+		const { docker, buildOpts, composeOpts } =
+			await this.prepareBuild(prepareBuildOpts);
 
 		try {
 			await this.buildProject(docker, logger, composeOpts, {
-				app,
-				arch: options.arch!,
-				deviceType: options.deviceType!,
-				buildEmulated: options.emulated,
+				appType: app?.application_type?.[0],
+				arch: prepareBuildOpts.arch!,
+				deviceType: prepareBuildOpts.deviceType!,
+				buildEmulated: prepareBuildOpts.emulated,
 				buildOpts,
 			});
 		} catch (err) {
@@ -142,7 +151,7 @@ ${dockerignoreHelp}
 		logger.logSuccess('Build succeeded!');
 	}
 
-	protected async validateOptions(opts: FlagsDef, sdk: BalenaSDK) {
+	protected async validateOptions(opts: PrepareBuildOpts, sdk: BalenaSDK) {
 		// Validate option combinations
 		if (
 			(opts.fleet == null && (opts.arch == null || opts.deviceType == null)) ||
@@ -150,7 +159,7 @@ ${dockerignoreHelp}
 		) {
 			const { ExpectedError } = await import('../../errors');
 			throw new ExpectedError(
-				'You must specify either a fleet (-f), or the device type (-d) and architecture (-A)',
+				'You must specify either a fleet (-f), or the device type (-d) and optionally the architecture (-A)',
 			);
 		}
 
@@ -170,7 +179,43 @@ ${dockerignoreHelp}
 		opts['registry-secrets'] = registrySecrets;
 	}
 
-	protected async getAppAndResolveArch(opts: FlagsDef) {
+	protected async resolveArchFromDeviceType(
+		sdk: BalenaSDK,
+		opts: PrepareBuildOpts,
+	) {
+		if (opts.deviceType != null && opts.arch == null) {
+			try {
+				const deviceTypeOpts = {
+					$select: 'is_of__cpu_architecture',
+					$expand: {
+						is_of__cpu_architecture: {
+							$select: 'slug',
+						},
+					},
+				} satisfies PineOptions<DeviceType>;
+				opts.arch = (
+					(await sdk.models.deviceType.get(
+						opts.deviceType,
+						deviceTypeOpts,
+					)) as PineTypedResult<DeviceType, typeof deviceTypeOpts>
+				).is_of__cpu_architecture[0].slug;
+			} catch (err) {
+				const { ExpectedError } = await import('../../errors');
+				if (err instanceof sdk.errors.BalenaInvalidDeviceType) {
+					let message = err.message;
+					if (!(await sdk.auth.isLoggedIn())) {
+						message = `${message}. In case you are trying to use a private device type, please try to log in first.`;
+					}
+					throw new ExpectedError(message);
+				}
+				throw new ExpectedError(
+					'Failed to resolve the architecture of the provided device type. If you are in an air-gapped environment please also define the architecture (-A) parameter.',
+				);
+			}
+		}
+	}
+
+	protected async getAppAndResolveArch(opts: PrepareBuildOpts) {
 		if (opts.fleet) {
 			const { getAppWithArch } = await import('../../utils/helpers');
 			const app = await getAppWithArch(opts.fleet);
@@ -180,7 +225,7 @@ ${dockerignoreHelp}
 		}
 	}
 
-	protected async prepareBuild(options: FlagsDef) {
+	protected async prepareBuild(options: PrepareBuildOpts) {
 		const { getDocker, generateBuildOpts } = await import('../../utils/docker');
 		const [docker, buildOpts, composeOpts] = await Promise.all([
 			getDocker(options),
@@ -212,9 +257,7 @@ ${dockerignoreHelp}
 		logger: import('../../utils/logger'),
 		composeOpts: ComposeOpts,
 		opts: {
-			app?: {
-				application_type: [Pick<ApplicationType, 'supports_multicontainer'>];
-			};
+			appType?: Pick<ApplicationType, 'supports_multicontainer'>;
 			arch: string;
 			deviceType: string;
 			buildEmulated: boolean;
@@ -230,11 +273,10 @@ ${dockerignoreHelp}
 			opts.buildOpts.t,
 		);
 
-		const appType = opts.app?.application_type?.[0];
 		if (
-			appType != null &&
+			opts.appType != null &&
 			project.descriptors.length > 1 &&
-			!appType.supports_multicontainer
+			!opts.appType.supports_multicontainer
 		) {
 			logger.logWarn(
 				'Target fleet does not support multiple containers.\n' +

src/commands/config/generate.ts

@@ -15,9 +15,8 @@
  * limitations under the License.
  */
 
-import { Flags } from '@oclif/core';
+import { Flags, Command } from '@oclif/core';
 import type { Interfaces } from '@oclif/core';
-import Command from '../../command';
 import * as cf from '../../utils/common-flags';
 import { getBalenaSdk, getCliForm, stripIndent } from '../../utils/lazy';
 import {
@@ -60,8 +59,6 @@ export default class ConfigGenerateCmd extends Command {
 		'$ balena config generate --fleet myorg/fleet --version 2.12.7 --network wifi --wifiSsid mySsid --wifiKey abcdefgh --appUpdatePollInterval 15',
 	];
 
-	public static usage = 'config generate';
-
 	public static flags = {
 		version: Flags.string({
 			description: 'a balenaOS version',
@@ -85,7 +82,7 @@ export default class ConfigGenerateCmd extends Command {
 		}),
 		deviceType: Flags.string({
 			description:
-				"device type slug (run 'balena devices supported' for possible values)",
+				"device type slug (run 'balena device-type list' for possible values)",
 		}),
 		'generate-device-api-key': Flags.boolean({
 			description: 'generate a fresh device key for the device',
@@ -120,7 +117,6 @@ export default class ConfigGenerateCmd extends Command {
 				'expiry date assigned to generated provisioning api key (format: YYYY-MM-DD)',
 			exclusive: ['device'],
 		}),
-		help: cf.help,
 	};
 
 	public static authenticated = true;

src/commands/config/inject.ts

@@ -15,8 +15,7 @@
  * limitations under the License.
  */
 
-import { Args } from '@oclif/core';
-import Command from '../../command';
+import { Args, Command } from '@oclif/core';
 import * as cf from '../../utils/common-flags';
 import { getVisuals, stripIndent } from '../../utils/lazy';
 
@@ -43,11 +42,8 @@ export default class ConfigInjectCmd extends Command {
 		}),
 	};
 
-	public static usage = 'config inject <file>';
-
 	public static flags = {
 		drive: cf.driveOrImg,
-		help: cf.help,
 	};
 
 	public static root = true;
@@ -68,7 +64,12 @@ export default class ConfigInjectCmd extends Command {
 		);
 
 		const config = await import('balena-config-json');
-		await config.write(drive, '', configJSON);
+		await config.write(
+			drive,
+			// Will be removed in the next major of balena-config-json
+			undefined,
+			configJSON,
+		);
 
 		console.info('Done');
 	}

src/commands/config/read.ts

@@ -15,7 +15,7 @@
  * limitations under the License.
  */
 
-import Command from '../../command';
+import { Command } from '@oclif/core';
 import * as cf from '../../utils/common-flags';
 import { getVisuals, stripIndent } from '../../utils/lazy';
 
@@ -36,11 +36,8 @@ export default class ConfigReadCmd extends Command {
 		'$ balena config read --drive balena.img',
 	];
 
-	public static usage = 'config read';
-
 	public static flags = {
 		drive: cf.driveOrImg,
-		help: cf.help,
 		json: cf.json,
 	};
 
@@ -57,7 +54,7 @@ export default class ConfigReadCmd extends Command {
 		await safeUmount(drive);
 
 		const config = await import('balena-config-json');
-		const configJSON = await config.read(drive, '');
+		const configJSON = await config.read(drive);
 
 		if (options.json) {
 			console.log(JSON.stringify(configJSON, null, 4));

src/commands/config/reconfigure.ts

@@ -15,8 +15,7 @@
  * limitations under the License.
  */
 
-import { Flags } from '@oclif/core';
-import Command from '../../command';
+import { Flags, Command } from '@oclif/core';
 import * as cf from '../../utils/common-flags';
 import { getVisuals, stripIndent } from '../../utils/lazy';
 
@@ -39,15 +38,12 @@ export default class ConfigReconfigureCmd extends Command {
 		'$ balena config reconfigure --drive balena.img --advanced',
 	];
 
-	public static usage = 'config reconfigure';
-
 	public static flags = {
 		drive: cf.driveOrImg,
 		advanced: Flags.boolean({
 			description: 'show advanced commands',
 			char: 'v',
 		}),
-		help: cf.help,
 		version: Flags.string({
 			description: 'balenaOS version, for example "2.32.0" or "2.44.0+rev1"',
 		}),
@@ -66,7 +62,7 @@ export default class ConfigReconfigureCmd extends Command {
 		await safeUmount(drive);
 
 		const config = await import('balena-config-json');
-		const { uuid } = await config.read(drive, '');
+		const { uuid } = await config.read(drive);
 		await safeUmount(drive);
 
 		if (!uuid) {

src/commands/config/write.ts

@@ -15,8 +15,7 @@
  * limitations under the License.
  */
 
-import { Args } from '@oclif/core';
-import Command from '../../command';
+import { Args, Command } from '@oclif/core';
 import * as cf from '../../utils/common-flags';
 import { getVisuals, stripIndent } from '../../utils/lazy';
 
@@ -48,11 +47,8 @@ export default class ConfigWriteCmd extends Command {
 		}),
 	};
 
-	public static usage = 'config write <key> <value>';
-
 	public static flags = {
 		drive: cf.driveOrImg,
-		help: cf.help,
 	};
 
 	public static root = true;
@@ -68,14 +64,19 @@ export default class ConfigWriteCmd extends Command {
 		await safeUmount(drive);
 
 		const config = await import('balena-config-json');
-		const configJSON = await config.read(drive, '');
+		const configJSON = await config.read(drive);
 
 		console.info(`Setting ${params.key} to ${params.value}`);
 		ConfigWriteCmd.updateConfigJson(configJSON, params.key, params.value);
 
 		await denyMount(drive, async () => {
 			await safeUmount(drive);
-			await config.write(drive, '', configJSON);
+			await config.write(
+				drive,
+				// Will be removed in the next major of balena-config-json
+				undefined,
+				configJSON,
+			);
 		});
 
 		console.info('Done');

src/commands/deploy/index.ts

@@ -15,10 +15,8 @@
  * limitations under the License.
  */
 
-import { Args, Flags } from '@oclif/core';
+import { Args, Flags, Command } from '@oclif/core';
 import type { ImageDescriptor } from '@balena/compose/dist/parse';
-
-import Command from '../../command';
 import { ExpectedError } from '../../errors';
 import { getBalenaSdk, getChalk, stripIndent } from '../../utils/lazy';
 import {
@@ -62,7 +60,6 @@ interface FlagsDef extends ComposeCliFlags, DockerCliFlags {
 	'release-tag'?: string[];
 	draft: boolean;
 	note?: string;
-	help: void;
 }
 
 export default class DeployCmd extends Command {
@@ -108,8 +105,6 @@ ${dockerignoreHelp}
 		image: Args.string({ description: 'the image to deploy' }),
 	};
 
-	public static usage = 'deploy <fleet> [image]';
-
 	public static flags = {
 		source: Flags.string({
 			description:
@@ -143,9 +138,6 @@ ${dockerignoreHelp}
 		note: Flags.string({ description: 'The notes for this release' }),
 		...composeCliFlags,
 		...dockerCliFlags,
-		// NOTE: Not supporting -h for help, because of clash with -h in DockerCliFlags
-		// Revisit this in future release.
-		help: Flags.help({}),
 	};
 
 	public static authenticated = true;
@@ -157,7 +149,9 @@ ${dockerignoreHelp}
 
 		(await import('events')).defaultMaxListeners = 1000;
 
-		const logger = await Command.getLogger();
+		const Logger = await import('../../utils/logger');
+
+		const logger = Logger.getLogger();
 		logger.logDebug('Parsing input...');
 
 		const { fleet, image } = params;
@@ -364,23 +358,17 @@ ${dockerignoreHelp}
 					$select: ['commit'],
 				});
 			} else {
-				const [{ id: userId }, auth, apiEndpoint] = await Promise.all([
-					sdk.auth.getUserInfo(),
-					sdk.auth.getToken(),
-					sdk.settings.get('apiUrl'),
-				]);
 				release = await $deployProject(
 					docker,
+					sdk,
 					logger,
 					project.composition,
 					images,
 					opts.app.id,
-					userId,
-					`Bearer ${auth}`,
-					apiEndpoint,
 					!opts.shouldUploadLogs,
 					composeOpts.projectPath,
 					opts.createAsDraft,
+					project.descriptors,
 				);
 			}
 

src/commands/device-type/list.ts

@@ -14,20 +14,23 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-import { Flags } from '@oclif/core';
+import { Flags, Command } from '@oclif/core';
 import type * as BalenaSdk from 'balena-sdk';
 import * as _ from 'lodash';
-import Command from '../../command';
-
-import * as cf from '../../utils/common-flags';
 import { getBalenaSdk, getVisuals, stripIndent } from '../../utils/lazy';
-import { CommandHelp } from '../../utils/oclif-utils';
 
-export default class DevicesSupportedCmd extends Command {
+export default class DeviceTypeListCmd extends Command {
+	public static aliases = ['devices supported'];
+	public static deprecateAliases = true;
+
 	public static description = stripIndent`
-		List the supported device types (like 'raspberrypi3' or 'intel-nuc').
+		List the device types supported by balena (like 'raspberrypi3' or 'intel-nuc').
 
-		List the supported device types (like 'raspberrypi3' or 'intel-nuc').
+		List the device types supported by balena (like 'raspberrypi3' or 'intel-nuc').
+
+		By default, only actively supported device types are listed.
+		The --all option can be used to list all device types, including those that are
+		no longer supported by balena.
 
 		The --json option is recommended when scripting the output of this command,
 		because the JSON format is less likely to change and it better represents data
@@ -36,25 +39,24 @@ export default class DevicesSupportedCmd extends Command {
 		(https://stedolan.github.io/jq/manual/).
 `;
 	public static examples = [
-		'$ balena devices supported',
-		'$ balena devices supported --json',
+		'$ balena device-type list',
+		'$ balena device-type list --all',
+		'$ balena device-type list --json',
 	];
 
-	public static usage = (
-		'devices supported ' +
-		new CommandHelp({ args: DevicesSupportedCmd.args }).defaultUsage()
-	).trim();
-
 	public static flags = {
-		help: cf.help,
 		json: Flags.boolean({
 			char: 'j',
 			description: 'produce JSON output instead of tabular output',
 		}),
+		all: Flags.boolean({
+			description: 'include device types no longer supported by balena',
+			default: false,
+		}),
 	};
 
 	public async run() {
-		const { flags: options } = await this.parse(DevicesSupportedCmd);
+		const { flags: options } = await this.parse(DeviceTypeListCmd);
 		const pineOptions = {
 			$select: ['slug', 'name'],
 			$expand: {
@@ -65,9 +67,11 @@ export default class DevicesSupportedCmd extends Command {
 				},
 			},
 		} satisfies BalenaSdk.PineOptions<BalenaSdk.DeviceType>;
-		const dts = (await getBalenaSdk().models.deviceType.getAllSupported(
-			pineOptions,
-		)) as Array<
+		const dts = (
+			options.all
+				? await getBalenaSdk().models.deviceType.getAll(pineOptions)
+				: await getBalenaSdk().models.deviceType.getAllSupported(pineOptions)
+		) as Array<
 			BalenaSdk.PineTypedResult<BalenaSdk.DeviceType, typeof pineOptions>
 		>;
 		interface DT {

src/commands/device/deactivate.ts

@@ -15,8 +15,7 @@
  * limitations under the License.
  */
 
-import { Args } from '@oclif/core';
-import Command from '../../command';
+import { Args, Command } from '@oclif/core';
 import * as cf from '../../utils/common-flags';
 import { getBalenaSdk, stripIndent } from '../../utils/lazy';
 
@@ -41,11 +40,8 @@ export default class DeviceDeactivateCmd extends Command {
 		}),
 	};
 
-	public static usage = 'device deactivate <uuid>';
-
 	public static flags = {
 		yes: cf.yes,
-		help: cf.help,
 	};
 
 	public static authenticated = true;

src/commands/device/detect.ts

@@ -15,12 +15,13 @@
  * limitations under the License.
  */
 
-import { Flags } from '@oclif/core';
-import Command from '../../command';
-import * as cf from '../../utils/common-flags';
+import { Flags, Command } from '@oclif/core';
 import { getCliUx, stripIndent } from '../../utils/lazy';
 
-export default class ScanCmd extends Command {
+export default class DeviceDetectCmd extends Command {
+	public static aliases = ['scan'];
+	public static deprecateAliases = true;
+
 	public static description = stripIndent`
 		Scan for balenaOS devices on your local network.
 
@@ -33,13 +34,11 @@ export default class ScanCmd extends Command {
 `;
 
 	public static examples = [
-		'$ balena scan',
-		'$ balena scan --timeout 120',
-		'$ balena scan --verbose',
+		'$ balena device detect',
+		'$ balena device detect --timeout 120',
+		'$ balena device detect --verbose',
 	];
 
-	public static usage = 'scan';
-
 	public static flags = {
 		verbose: Flags.boolean({
 			default: false,
@@ -50,7 +49,6 @@ export default class ScanCmd extends Command {
 			char: 't',
 			description: 'scan timeout in seconds',
 		}),
-		help: cf.help,
 		json: Flags.boolean({
 			default: false,
 			char: 'j',
@@ -73,7 +71,7 @@ export default class ScanCmd extends Command {
 		const dockerPort = 2375;
 		const dockerTimeout = 2000;
 
-		const { flags: options } = await this.parse(ScanCmd);
+		const { flags: options } = await this.parse(DeviceDetectCmd);
 
 		const discoverTimeout =
 			options.timeout != null ? options.timeout * 1000 : undefined;
@@ -93,7 +91,7 @@ export default class ScanCmd extends Command {
 				try {
 					await docker.ping();
 					return true;
-				} catch (err) {
+				} catch {
 					return false;
 				}
 			}),
@@ -147,10 +145,10 @@ export default class ScanCmd extends Command {
 		if (!options.verbose) {
 			devicesInfo.forEach((d: any) => {
 				d.dockerInfo = _.isObject(d.dockerInfo)
-					? _.pick(d.dockerInfo, ScanCmd.dockerInfoProperties)
+					? _.pick(d.dockerInfo, DeviceDetectCmd.dockerInfoProperties)
 					: d.dockerInfo;
 				d.dockerVersion = _.isObject(d.dockerVersion)
-					? _.pick(d.dockerVersion, ScanCmd.dockerVersionProperties)
+					? _.pick(d.dockerVersion, DeviceDetectCmd.dockerVersionProperties)
 					: d.dockerVersion;
 			});
 		}
@@ -167,8 +165,9 @@ export default class ScanCmd extends Command {
 		if (!options.json && cmdOutput.length === 0) {
 			console.error(
 				process.platform === 'win32'
-					? ScanCmd.noDevicesFoundMessage + ScanCmd.windowsTipMessage
-					: ScanCmd.noDevicesFoundMessage,
+					? DeviceDetectCmd.noDevicesFoundMessage +
+							DeviceDetectCmd.windowsTipMessage
+					: DeviceDetectCmd.noDevicesFoundMessage,
 			);
 			return;
 		}
@@ -200,11 +199,11 @@ export default class ScanCmd extends Command {
 	protected static windowsTipMessage = `
 
 Note for Windows users:
-  The 'scan' command relies on the Bonjour service. Check whether Bonjour is
+  The 'device detect' command relies on the Bonjour service. Check whether Bonjour is
   installed (Control Panel > Programs and Features). If not, you can download
   Bonjour for Windows (included with Bonjour Print Services) from here:
   https://support.apple.com/kb/DL999
 
-  After installing Bonjour, restart your PC and run the 'balena scan' command
+  After installing Bonjour, restart your PC and run the 'balena device detect' command
   again.`;
 }

src/commands/device/identify.ts

@@ -15,9 +15,7 @@
  * limitations under the License.
  */
 
-import { Args } from '@oclif/core';
-import Command from '../../command';
-import * as cf from '../../utils/common-flags';
+import { Args, Command } from '@oclif/core';
 import { getBalenaSdk, stripIndent } from '../../utils/lazy';
 import { ExpectedError } from '../../errors';
 
@@ -36,12 +34,6 @@ export default class DeviceIdentifyCmd extends Command {
 		}),
 	};
 
-	public static usage = 'device identify <uuid>';
-
-	public static flags = {
-		help: cf.help,
-	};
-
 	public static authenticated = true;
 
 	public async run() {

src/commands/device/index.ts

@@ -15,8 +15,7 @@
  * limitations under the License.
  */
 
-import { Flags, Args } from '@oclif/core';
-import Command from '../../command';
+import { Flags, Args, Command } from '@oclif/core';
 import * as cf from '../../utils/common-flags';
 import { expandForAppName } from '../../utils/helpers';
 import { getBalenaSdk, getVisuals, stripIndent } from '../../utils/lazy';
@@ -62,11 +61,8 @@ export default class DeviceCmd extends Command {
 		}),
 	};
 
-	public static usage = 'device <uuid>';
-
 	public static flags = {
 		json: cf.json,
-		help: cf.help,
 		view: Flags.boolean({
 			default: false,
 			description: 'open device dashboard page',
@@ -81,45 +77,59 @@ export default class DeviceCmd extends Command {
 
 		const balena = getBalenaSdk();
 
-		const device = (await balena.models.device.get(
-			params.uuid,
-			options.json
-				? {
-						$expand: {
-							device_tag: {
-								$select: ['tag_key', 'value'],
-							},
-							...expandForAppName.$expand,
+		let device: ExtendedDevice;
+		if (options.json) {
+			const [deviceBase, deviceComputed] = await Promise.all([
+				balena.models.device.get(params.uuid, {
+					$expand: {
+						device_tag: {
+							$select: ['tag_key', 'value'],
 						},
-				  }
-				: {
-						$select: [
-							'device_name',
-							'id',
-							'overall_status',
-							'is_online',
-							'ip_address',
-							'mac_address',
-							'last_connectivity_event',
-							'uuid',
-							'supervisor_version',
-							'is_web_accessible',
-							'note',
-							'os_version',
-							'memory_usage',
-							'memory_total',
-							'public_address',
-							'storage_block_device',
-							'storage_usage',
-							'storage_total',
-							'cpu_usage',
-							'cpu_temp',
-							'cpu_id',
-							'is_undervolted',
-						],
-						...expandForAppName,
-				  },
-		)) as ExtendedDevice;
+						...expandForAppName.$expand,
+					},
+				}),
+				balena.models.device.get(params.uuid, {
+					$select: [
+						'overall_status',
+						'overall_progress',
+						'should_be_running__release',
+					],
+				}),
+			]);
+
+			device = {
+				...deviceBase,
+				...deviceComputed,
+			} as ExtendedDevice;
+		} else {
+			device = (await balena.models.device.get(params.uuid, {
+				$select: [
+					'device_name',
+					'id',
+					'overall_status',
+					'is_online',
+					'ip_address',
+					'mac_address',
+					'last_connectivity_event',
+					'uuid',
+					'supervisor_version',
+					'is_web_accessible',
+					'note',
+					'os_version',
+					'memory_usage',
+					'memory_total',
+					'public_address',
+					'storage_block_device',
+					'storage_usage',
+					'storage_total',
+					'cpu_usage',
+					'cpu_temp',
+					'cpu_id',
+					'is_undervolted',
+				],
+				...expandForAppName,
+			})) as ExtendedDevice;
+		}
 
 		if (options.view) {
 			const open = await import('open');

src/commands/device/init.ts

@@ -15,8 +15,7 @@
  * limitations under the License.
  */
 
-import { Flags } from '@oclif/core';
-import Command from '../../command';
+import { Flags, Command } from '@oclif/core';
 import * as cf from '../../utils/common-flags';
 import { getBalenaSdk, stripIndent } from '../../utils/lazy';
 import { applicationIdInfo } from '../../utils/messages';
@@ -29,7 +28,6 @@ interface FlagsDef {
 	'os-version'?: string;
 	drive?: string;
 	config?: string;
-	help: void;
 	'provisioning-key-name'?: string;
 	'provisioning-key-expiry-date'?: string;
 }
@@ -43,17 +41,17 @@ export default class DeviceInitCmd extends Command {
 		This command effectively combines several other balena CLI commands in one,
 		namely:
 
-		'balena device register'  
-		'balena os download'  
-		'balena os build-config' or 'balena config generate'  
-		'balena os configure'  
+		'balena device register'
+		'balena os download'
+		'balena os build-config' or 'balena config generate'
+		'balena os configure'
 		'balena os local flash'
 
 		Possible arguments for the '--fleet', '--os-version' and '--drive' options can
 		be listed respectively with the commands:
 
-		'balena fleets'  
-		'balena os versions'  
+		'balena fleet list'
+		'balena os versions'
 		'balena util available-drives'
 
 		If the '--fleet' or '--drive' options are omitted, interactive menus will be
@@ -74,8 +72,6 @@ export default class DeviceInitCmd extends Command {
 		'$ balena device init --fleet myFleet --os-version 2.83.21+rev1.prod --drive /dev/disk5 --config config.json --yes',
 	];
 
-	public static usage = 'device init';
-
 	public static flags = {
 		fleet: cf.fleet,
 		yes: cf.yes,
@@ -103,7 +99,6 @@ export default class DeviceInitCmd extends Command {
 			description:
 				'expiry date assigned to generated provisioning api key (format: YYYY-MM-DD)',
 		}),
-		help: cf.help,
 	};
 
 	public static authenticated = true;
@@ -119,8 +114,9 @@ export default class DeviceInitCmd extends Command {
 		tmp.setGracefulCleanup();
 		const { downloadOSImage } = await import('../../utils/cloud');
 		const { getApplication } = await import('../../utils/sdk');
+		const Logger = await import('../../utils/logger');
 
-		const logger = await Command.getLogger();
+		const logger = Logger.getLogger();
 		const balena = getBalenaSdk();
 
 		// Get application and
@@ -132,7 +128,7 @@ export default class DeviceInitCmd extends Command {
 							$select: 'slug',
 						},
 					},
-			  })
+				})
 			: await (await import('../../utils/patterns')).selectApplication();
 
 		// Register new device
@@ -159,7 +155,7 @@ export default class DeviceInitCmd extends Command {
 			try {
 				logger.logDebug(`Process failed, removing device ${device.uuid}`);
 				await balena.models.device.remove(device.uuid);
-			} catch (e) {
+			} catch {
 				// Ignore removal failures, and throw original error
 			}
 			throw e;

src/commands/device/list.ts

@@ -15,7 +15,7 @@
  * limitations under the License.
  */
 
-import Command from '../../command';
+import { Command } from '@oclif/core';
 import * as cf from '../../utils/common-flags';
 import { expandForAppName } from '../../utils/helpers';
 import { getBalenaSdk, getVisuals, stripIndent } from '../../utils/lazy';
@@ -35,7 +35,10 @@ const devicesSelectFields = {
 	],
 } satisfies PineOptions<Device>;
 
-export default class DevicesCmd extends Command {
+export default class DeviceListCmd extends Command {
+	public static aliases = ['devices'];
+	public static deprecateAliases = true;
+
 	public static description = stripIndent`
 		List all devices.
 
@@ -48,17 +51,14 @@ export default class DevicesCmd extends Command {
 		${jsonInfo.split('\n').join('\n\t\t')}
 	`;
 	public static examples = [
-		'$ balena devices',
-		'$ balena devices --fleet MyFleet',
-		'$ balena devices -f myorg/myfleet',
+		'$ balena device list',
+		'$ balena device list --fleet MyFleet',
+		'$ balena device list -f myorg/myfleet',
 	];
 
-	public static usage = 'devices';
-
 	public static flags = {
 		fleet: cf.fleet,
 		json: cf.json,
-		help: cf.help,
 	};
 
 	public static primary = true;
@@ -66,7 +66,7 @@ export default class DevicesCmd extends Command {
 	public static authenticated = true;
 
 	public async run() {
-		const { flags: options } = await this.parse(DevicesCmd);
+		const { flags: options } = await this.parse(DeviceListCmd);
 
 		const balena = getBalenaSdk();
 		const devicesOptions = {

src/commands/device/local-mode.ts

@@ -15,9 +15,7 @@
  * limitations under the License.
  */
 
-import { Flags, Args } from '@oclif/core';
-import Command from '../../command';
-import * as cf from '../../utils/common-flags';
+import { Flags, Args, Command } from '@oclif/core';
 import { getBalenaSdk, stripIndent } from '../../utils/lazy';
 
 export default class DeviceLocalModeCmd extends Command {
@@ -42,8 +40,6 @@ export default class DeviceLocalModeCmd extends Command {
 		}),
 	};
 
-	public static usage = 'device local-mode <uuid>';
-
 	public static flags = {
 		enable: Flags.boolean({
 			description: 'enable local mode',
@@ -57,7 +53,6 @@ export default class DeviceLocalModeCmd extends Command {
 			description: 'output boolean indicating local mode status',
 			exclusive: ['enable', 'disable'],
 		}),
-		help: cf.help,
 	};
 
 	public static authenticated = true;

src/commands/device/logs.ts

@@ -15,15 +15,16 @@
  * limitations under the License.
  */
 
-import { Flags, Args } from '@oclif/core';
-import Command from '../../command';
-import * as cf from '../../utils/common-flags';
+import { Flags, Args, Command } from '@oclif/core';
 import { getBalenaSdk, stripIndent } from '../../utils/lazy';
-import { LogMessage } from 'balena-sdk';
+import type { LogMessage } from 'balena-sdk';
 
 const MAX_RETRY = 1000;
 
-export default class LogsCmd extends Command {
+export default class DeviceLogsCmd extends Command {
+	public static aliases = ['logs'];
+	public static deprecateAliases = true;
+
 	public static description = stripIndent`
 		Show device logs.
 
@@ -43,15 +44,15 @@ export default class LogsCmd extends Command {
 		Note: --service and --system flags must come after the device parameter, as per examples.
 `;
 	public static examples = [
-		'$ balena logs 23c73a1',
-		'$ balena logs 23c73a1 --tail',
+		'$ balena device logs 23c73a1',
+		'$ balena device logs 23c73a1 --tail',
 		'',
-		'$ balena logs 192.168.0.31',
-		'$ balena logs 192.168.0.31 --service my-service',
-		'$ balena logs 192.168.0.31 --service my-service-1 --service my-service-2',
+		'$ balena device logs 192.168.0.31',
+		'$ balena device logs 192.168.0.31 --service my-service',
+		'$ balena device logs 192.168.0.31 --service my-service-1 --service my-service-2',
 		'',
-		'$ balena logs 23c73a1.local --system',
-		'$ balena logs 23c73a1.local --system --service my-service',
+		'$ balena device logs 23c73a1.local --system',
+		'$ balena device logs 23c73a1.local --system --service my-service',
 	];
 
 	public static args = {
@@ -61,8 +62,6 @@ export default class LogsCmd extends Command {
 		}),
 	};
 
-	public static usage = 'logs <device>';
-
 	public static flags = {
 		'max-retry': Flags.integer({
 			description: stripIndent`
@@ -87,13 +86,12 @@ export default class LogsCmd extends Command {
 				'Only show system logs. This can be used in combination with --service.',
 			char: 'S',
 		}),
-		help: cf.help,
 	};
 
 	public static primary = true;
 
 	public async run() {
-		const { args: params, flags: options } = await this.parse(LogsCmd);
+		const { args: params, flags: options } = await this.parse(DeviceLogsCmd);
 
 		const balena = getBalenaSdk();
 		const { serviceIdToName } = await import('../../utils/cloud');
@@ -137,7 +135,7 @@ export default class LogsCmd extends Command {
 			logger.logDebug('Checking we can access device');
 			try {
 				await deviceApi.ping();
-			} catch (e) {
+			} catch {
 				const { ExpectedError } = await import('../../errors');
 				throw new ExpectedError(
 					`Cannot access device at address ${params.device}.  Device may not be in local mode.`,
@@ -153,8 +151,9 @@ export default class LogsCmd extends Command {
 				maxAttempts: 1 + (options['max-retry'] ?? MAX_RETRY),
 			});
 		} else {
+			const { checkLoggedIn } = await import('../../utils/patterns');
 			// Logs from cloud
-			await Command.checkLoggedIn();
+			await checkLoggedIn();
 			if (options.tail) {
 				const logStream = await balena.logs.subscribe(params.device, {
 					count: 100,

src/commands/device/move.ts

@@ -15,14 +15,13 @@
  * limitations under the License.
  */
 
-import { Args } from '@oclif/core';
+import { Args, Command } from '@oclif/core';
 import type {
 	BalenaSDK,
 	Device,
 	PineOptions,
 	PineTypedResult,
 } from 'balena-sdk';
-import Command from '../../command';
 import * as cf from '../../utils/common-flags';
 import { ExpectedError } from '../../errors';
 import { getBalenaSdk, stripIndent } from '../../utils/lazy';
@@ -54,11 +53,8 @@ export default class DeviceMoveCmd extends Command {
 		}),
 	};
 
-	public static usage = 'device move <uuid(s)>';
-
 	public static flags = {
 		fleet: cf.fleet,
-		help: cf.help,
 	};
 
 	public static authenticated = true;

src/commands/device/note.ts

@@ -15,13 +15,15 @@
  * limitations under the License.
  */
 
-import { Flags, Args } from '@oclif/core';
-import Command from '../../command';
+import { Flags, Args, Command } from '@oclif/core';
 import { ExpectedError } from '../../errors';
 import * as cf from '../../utils/common-flags';
 import { getBalenaSdk, stripIndent } from '../../utils/lazy';
 
-export default class NoteCmd extends Command {
+export default class DeviceNoteCmd extends Command {
+	public static aliases = ['notes'];
+	public static deprecateAliases = true;
+
 	public static description = stripIndent`
 		Set a device note.
 
@@ -32,8 +34,8 @@ export default class NoteCmd extends Command {
 	`;
 
 	public static examples = [
-		'$ balena note "My useful note" --device 7cf02a6',
-		'$ cat note.txt | balena note --device 7cf02a6',
+		'$ balena device note "My useful note" --device 7cf02a6',
+		'$ cat note.txt | balena device note --device 7cf02a6',
 	];
 
 	public static args = {
@@ -42,27 +44,20 @@ export default class NoteCmd extends Command {
 		}),
 	};
 
-	public static usage = 'note <|note>';
-
 	public static flags = {
 		device: { exclusive: ['dev'], ...cf.device },
 		dev: Flags.string({
 			exclusive: ['device'],
 			hidden: true,
 		}),
-		help: cf.help,
 	};
 
 	public static authenticated = true;
 
-	public static readStdin = true;
-
 	public async run() {
-		const { args: params, flags: options } = await this.parse(NoteCmd);
+		const { args: params, flags: options } = await this.parse(DeviceNoteCmd);
 
-		params.note = params.note || this.stdin;
-
-		if (params.note.length === 0) {
+		if (params.note?.length === 0) {
 			throw new ExpectedError('Missing note content');
 		}
 
@@ -75,6 +70,6 @@ export default class NoteCmd extends Command {
 
 		const balena = getBalenaSdk();
 
-		return balena.models.device.setNote(options.device, params.note);
+		return balena.models.device.setNote(options.device, params.note ?? '');
 	}
 }

src/commands/device/os-update.ts

@@ -15,12 +15,12 @@
  * limitations under the License.
  */
 
-import { Flags, Args } from '@oclif/core';
-import Command from '../../command';
+import { Flags, Args, Command } from '@oclif/core';
 import * as cf from '../../utils/common-flags';
 import { getBalenaSdk, stripIndent, getCliForm } from '../../utils/lazy';
 import type { Device } from 'balena-sdk';
 import { ExpectedError } from '../../errors';
+import { getExpandedProp } from '../../utils/pine';
 
 export default class DeviceOsUpdateCmd extends Command {
 	public static description = stripIndent`
@@ -47,8 +47,6 @@ export default class DeviceOsUpdateCmd extends Command {
 		}),
 	};
 
-	public static usage = 'device os-update <uuid>';
-
 	public static flags = {
 		version: Flags.string({
 			description: 'a balenaOS version',
@@ -60,7 +58,6 @@ export default class DeviceOsUpdateCmd extends Command {
 			exclusive: ['version'],
 		}),
 		yes: cf.yes,
-		help: cf.help,
 	};
 
 	public static authenticated = true;
@@ -130,27 +127,64 @@ export default class DeviceOsUpdateCmd extends Command {
 				);
 			}
 		} else {
+			const choices = await Promise.all(
+				hupVersionInfo.versions.map(async (version) => {
+					const takeoverRequired =
+						(await sdk.models.os.getOsUpdateType(
+							getExpandedProp(is_of__device_type, 'slug')!,
+							currentOsVersion,
+							version,
+						)) === 'takeover';
+
+					return {
+						name: `${version}${hupVersionInfo.recommended === version ? ' (recommended)' : ''}${takeoverRequired ? ' ADVANCED UPDATE: Requires disk re-partitioning with no rollback option' : ''}`,
+						value: version,
+					};
+				}),
+			);
 			targetOsVersion = await getCliForm().ask({
 				message: 'Target OS version',
 				type: 'list',
-				choices: hupVersionInfo.versions.map((version) => ({
-					name:
-						hupVersionInfo.recommended === version
-							? `${version} (recommended)`
-							: version,
-					value: version,
-				})),
+				choices,
 			});
 		}
 
+		const takeoverRequired =
+			(await sdk.models.os.getOsUpdateType(
+				getExpandedProp(is_of__device_type, 'slug')!,
+				currentOsVersion,
+				targetOsVersion,
+			)) === 'takeover';
 		const patterns = await import('../../utils/patterns');
+		// Warn the user if the update requires a takeover
+		if (takeoverRequired) {
+			await patterns.confirm(
+				options.yes || false,
+				stripIndent`Before you proceed, note that this update process is different from a regular HostOS Update:
+DATA LOSS: This update requires disk re-partitioning, which will erase all data stored on the device.
+NO ROLLBACK: Unlike our HostOS update mechanism, this process does not allow reverting to a previous version in case of failure.
+Make sure to back up all important data before continuing. For more details, check our documentation: https://docs.balena.io/reference/OS/updates/update-process/
+`,
+			);
+		}
 		// Confirm and start update
 		await patterns.confirm(
 			options.yes || false,
 			'Host OS updates require a device restart when they complete. Are you sure you want to proceed?',
 		);
 
-		await sdk.models.device.startOsUpdate(uuid, targetOsVersion);
-		await patterns.awaitDeviceOsUpdate(uuid, targetOsVersion);
+		await sdk.models.device
+			.startOsUpdate(uuid, targetOsVersion, {
+				runDetached: true,
+			})
+			.then(() => {
+				console.log(
+					`The balena OS update has started. You can keep track of the progress via the dashboard.\n` +
+						`To open the dashboard page related to a device via the CLI, you can use \`balena device UUID --view\``,
+				);
+			})
+			.catch((error) => {
+				console.error(`Failed to start OS update for device ${uuid}:`, error);
+			});
 	}
 }

src/commands/device/pin.ts

@@ -15,9 +15,7 @@
  * limitations under the License.
  */
 
-import { Args } from '@oclif/core';
-import Command from '../../command';
-import * as cf from '../../utils/common-flags';
+import { Args, Command } from '@oclif/core';
 import { getBalenaSdk, stripIndent } from '../../utils/lazy';
 import { getExpandedProp } from '../../utils/pine';
 
@@ -44,12 +42,6 @@ export default class DevicePinCmd extends Command {
 		}),
 	};
 
-	public static usage = 'device pin <uuid> [releaseToPinTo]';
-
-	public static flags = {
-		help: cf.help,
-	};
-
 	public static authenticated = true;
 
 	public async run() {
@@ -59,7 +51,7 @@ export default class DevicePinCmd extends Command {
 
 		const device = await balena.models.device.get(params.uuid, {
 			$expand: {
-				should_be_running__release: {
+				is_pinned_on__release: {
 					$select: 'commit',
 				},
 				belongs_to__application: {
@@ -69,7 +61,7 @@ export default class DevicePinCmd extends Command {
 		});
 
 		const pinnedRelease = getExpandedProp(
-			device.should_be_running__release,
+			device.is_pinned_on__release,
 			'commit',
 		);
 		const appSlug = getExpandedProp(device.belongs_to__application, 'slug');
@@ -82,7 +74,7 @@ export default class DevicePinCmd extends Command {
 					pinnedRelease
 						? `This device is currently pinned to ${pinnedRelease}.`
 						: 'This device is not currently pinned to any release.'
-				} \n\nTo see a list of all releases this device can be pinned to, run \`balena releases ${appSlug}\`.`,
+				} \n\nTo see a list of all releases this device can be pinned to, run \`balena release list ${appSlug}\`.`,
 			);
 		} else {
 			await balena.models.device.pinToRelease(params.uuid, releaseToPinTo);

src/commands/device/public-url.ts

@@ -15,10 +15,8 @@
  * limitations under the License.
  */
 
-import { Flags, Args } from '@oclif/core';
-import Command from '../../command';
+import { Flags, Args, Command } from '@oclif/core';
 import { ExpectedError } from '../../errors';
-import * as cf from '../../utils/common-flags';
 import { getBalenaSdk, stripIndent } from '../../utils/lazy';
 
 export default class DevicePublicUrlCmd extends Command {
@@ -44,8 +42,6 @@ export default class DevicePublicUrlCmd extends Command {
 		}),
 	};
 
-	public static usage = 'device public-url <uuid>';
-
 	public static flags = {
 		enable: Flags.boolean({
 			description: 'enable the public URL',
@@ -59,7 +55,6 @@ export default class DevicePublicUrlCmd extends Command {
 			description: 'determine if public URL is enabled',
 			exclusive: ['enable', 'disable'],
 		}),
-		help: cf.help,
 	};
 
 	public static authenticated = true;

src/commands/device/purge.ts

@@ -15,9 +15,7 @@
  * limitations under the License.
  */
 
-import { Args } from '@oclif/core';
-import Command from '../../command';
-import * as cf from '../../utils/common-flags';
+import { Args, Command } from '@oclif/core';
 import { getBalenaSdk, getCliUx, stripIndent } from '../../utils/lazy';
 
 export default class DevicePurgeCmd extends Command {
@@ -35,8 +33,6 @@ export default class DevicePurgeCmd extends Command {
 		'$ balena device purge 55d43b3,23c73a1',
 	];
 
-	public static usage = 'device purge <uuid>';
-
 	public static args = {
 		uuid: Args.string({
 			description: 'comma-separated list (no blank spaces) of device UUIDs',
@@ -44,10 +40,6 @@ export default class DevicePurgeCmd extends Command {
 		}),
 	};
 
-	public static flags = {
-		help: cf.help,
-	};
-
 	public static authenticated = true;
 
 	public async run() {

src/commands/device/reboot.ts

@@ -15,8 +15,7 @@
  * limitations under the License.
  */
 
-import { Args } from '@oclif/core';
-import Command from '../../command';
+import { Args, Command } from '@oclif/core';
 import * as cf from '../../utils/common-flags';
 import { getBalenaSdk, stripIndent } from '../../utils/lazy';
 
@@ -35,11 +34,8 @@ export default class DeviceRebootCmd extends Command {
 		}),
 	};
 
-	public static usage = 'device reboot <uuid>';
-
 	public static flags = {
 		force: cf.force,
-		help: cf.help,
 	};
 
 	public static authenticated = true;

src/commands/device/register.ts

@@ -15,9 +15,7 @@
  * limitations under the License.
  */
 
-import { Flags } from '@oclif/core';
-import Command from '../../command';
-import * as cf from '../../utils/common-flags';
+import { Flags, Command } from '@oclif/core';
 import * as ca from '../../utils/common-args';
 import { getBalenaSdk, stripIndent } from '../../utils/lazy';
 import { applicationIdInfo } from '../../utils/messages';
@@ -44,8 +42,6 @@ export default class DeviceRegisterCmd extends Command {
 		fleet: ca.fleetRequired,
 	};
 
-	public static usage = 'device register <fleet>';
-
 	public static flags = {
 		uuid: Flags.string({
 			description: 'custom uuid',
@@ -53,9 +49,8 @@ export default class DeviceRegisterCmd extends Command {
 		}),
 		deviceType: Flags.string({
 			description:
-				"device type slug (run 'balena devices supported' for possible values)",
+				"device type slug (run 'balena device-type list' for possible values)",
 		}),
-		help: cf.help,
 	};
 
 	public static authenticated = true;
@@ -81,6 +76,6 @@ export default class DeviceRegisterCmd extends Command {
 			options.deviceType,
 		);
 
-		return result && result.uuid;
+		return result.uuid;
 	}
 }

src/commands/device/rename.ts

@@ -15,9 +15,7 @@
  * limitations under the License.
  */
 
-import { Args } from '@oclif/core';
-import Command from '../../command';
-import * as cf from '../../utils/common-flags';
+import { Args, Command } from '@oclif/core';
 import { getBalenaSdk, stripIndent, getCliForm } from '../../utils/lazy';
 
 export default class DeviceRenameCmd extends Command {
@@ -43,12 +41,6 @@ export default class DeviceRenameCmd extends Command {
 		}),
 	};
 
-	public static usage = 'device rename <uuid> [newName]';
-
-	public static flags = {
-		help: cf.help,
-	};
-
 	public static authenticated = true;
 
 	public async run() {

src/commands/device/restart.ts

@@ -15,9 +15,7 @@
  * limitations under the License.
  */
 
-import { Flags, Args } from '@oclif/core';
-import Command from '../../command';
-import * as cf from '../../utils/common-flags';
+import { Flags, Args, Command } from '@oclif/core';
 import { getBalenaSdk, getCliUx, stripIndent } from '../../utils/lazy';
 import type {
 	BalenaSDK,
@@ -53,15 +51,12 @@ export default class DeviceRestartCmd extends Command {
 		}),
 	};
 
-	public static usage = 'device restart <uuid>';
-
 	public static flags = {
 		service: Flags.string({
 			description:
 				'comma-separated list (no blank spaces) of service names to restart',
 			char: 's',
 		}),
-		help: cf.help,
 	};
 
 	public static authenticated = true;
@@ -159,7 +154,7 @@ export default class DeviceRestartCmd extends Command {
 
 	async restartAllServices(balena: BalenaSDK, deviceUuid: string) {
 		// Note: device.restartApplication throws `BalenaDeviceNotFound: Device not found` if device not online.
-		// Need to use device.get first to distinguish between non-existant and offline devices.
+		// Need to use device.get first to distinguish between non-existant and disconnected devices.
 		// Remove this workaround when SDK issue resolved: https://github.com/balena-io/balena-sdk/issues/649
 		const { instanceOf, ExpectedError } = await import('../../errors');
 		try {

src/commands/device/rm.ts

@@ -15,8 +15,7 @@
  * limitations under the License.
  */
 
-import { Args } from '@oclif/core';
-import Command from '../../command';
+import { Args, Command } from '@oclif/core';
 import * as cf from '../../utils/common-flags';
 import { getBalenaSdk, stripIndent } from '../../utils/lazy';
 
@@ -43,11 +42,8 @@ export default class DeviceRmCmd extends Command {
 		}),
 	};
 
-	public static usage = 'device rm <uuid(s)>';
-
 	public static flags = {
 		yes: cf.yes,
-		help: cf.help,
 	};
 
 	public static authenticated = true;