v16.7.5

Abstract the fleet/app/block create commands

.github/actions/publish/action.yml

@@ -0,0 +1,134 @@
+---
+name: package and draft GitHub release
+# https://github.com/product-os/flowzone/tree/master/.github/actions
+inputs:
+  json:
+    description: 'JSON stringified object containing all the inputs from the calling workflow'
+    required: true
+  secrets:
+    description: 'JSON stringified object containing all the secrets from the calling workflow'
+    required: true
+  variables:
+    description: 'JSON stringified object containing all the variables from the calling workflow'
+    required: true
+
+  # --- custom environment
+  XCODE_APP_LOADER_EMAIL:
+    type: string
+    default: 'accounts+apple@balena.io'
+  NODE_VERSION:
+    type: string
+    default: '16.x'
+  VERBOSE:
+    type: string
+    default: 'true'
+
+runs:
+  # https://docs.github.com/en/actions/creating-actions/creating-a-composite-action
+  using: 'composite'
+  steps:
+    - name: Download custom source artifact
+      uses: actions/download-artifact@v3
+      with:
+        name: custom-${{ github.event.pull_request.head.sha || github.event.head_commit.id }}-${{ runner.os }}-${{ runner.arch }}
+        path: ${{ runner.temp }}
+
+    - name: Extract custom source artifact
+      shell: pwsh
+      working-directory: .
+      run: tar -xf ${{ runner.temp }}/custom.tgz
+
+    - name: Setup Node.js
+      uses: actions/setup-node@v3
+      with:
+        node-version: ${{ inputs.NODE_VERSION }}
+        cache: npm
+
+    - name: Install additional tools
+      if: runner.os == 'Windows'
+      shell: bash
+      run: |
+        choco install yq
+
+    - name: Install additional tools
+      if: runner.os == 'macOS'
+      shell: bash
+      run: |
+        brew install coreutils
+
+    # https://www.electron.build/code-signing.html
+    # https://github.com/Apple-Actions/import-codesign-certs
+    - name: Import Apple code signing certificate
+      if: runner.os == 'macOS'
+      uses: apple-actions/import-codesign-certs@v1
+      with:
+        p12-file-base64: ${{ fromJSON(inputs.secrets).APPLE_SIGNING }}
+        p12-password: ${{ fromJSON(inputs.secrets).APPLE_SIGNING_PASSWORD }}
+
+    - name: Import Windows code signing certificate
+      if: runner.os == 'Windows'
+      shell: powershell
+      run: |
+        Set-Content -Path ${{ runner.temp }}/certificate.base64 -Value $env:WINDOWS_CERTIFICATE
+        certutil -decode ${{ runner.temp }}/certificate.base64 ${{ runner.temp }}/certificate.pfx
+        Remove-Item -path ${{ runner.temp }} -include certificate.base64
+
+        Import-PfxCertificate `
+          -FilePath ${{ runner.temp }}/certificate.pfx `
+          -CertStoreLocation Cert:\CurrentUser\My `
+          -Password (ConvertTo-SecureString -String $env:WINDOWS_CERTIFICATE_PASSWORD -Force -AsPlainText)
+
+      env:
+        WINDOWS_CERTIFICATE: ${{ fromJSON(inputs.secrets).WINDOWS_SIGNING }}
+        WINDOWS_CERTIFICATE_PASSWORD: ${{ fromJSON(inputs.secrets).WINDOWS_SIGNING_PASSWORD }}
+
+    # https://github.com/product-os/scripts/tree/master/shared
+    # https://github.com/product-os/balena-concourse/blob/master/pipelines/github-events/template.yml
+    - name: Package release
+      shell: bash
+      run: |
+        set -ea
+
+        [[ '${{ inputs.VERBOSE }}' =~ on|On|Yes|yes|true|True ]] && set -x
+
+        runner_os="$(echo "${RUNNER_OS}" | tr '[:upper:]' '[:lower:]')"
+        runner_arch="$(echo "${RUNNER_ARCH}" | tr '[:upper:]' '[:lower:]')"
+
+        if [[ $runner_os =~ darwin|macos|osx ]]; then
+            CSC_KEY_PASSWORD=${{ fromJSON(inputs.secrets).APPLE_SIGNING_PASSWORD }}
+            CSC_KEYCHAIN=signing_temp
+            CSC_LINK=${{ fromJSON(inputs.secrets).APPLE_SIGNING }}
+
+        elif [[ $runner_os =~ windows|win ]]; then
+            CSC_KEY_PASSWORD=${{ fromJSON(inputs.secrets).WINDOWS_SIGNING_PASSWORD }}
+            CSC_LINK='${{ runner.temp }}\certificate.pfx'
+
+            # patches/all/oclif.patch
+            MSYSSHELLPATH="$(which bash)"
+            MSYSTEM=MSYS
+
+            # (signtool.exe) https://github.com/actions/runner-images/blob/main/images/win/Windows2019-Readme.md#installed-windows-sdks
+            PATH="/c/Program Files (x86)/Windows Kits/10/bin/${runner_arch}:${PATH}"
+        fi
+
+        npm run package
+
+        find dist -type f -maxdepth 1
+
+      env:
+        # https://github.blog/2020-08-03-github-actions-improvements-for-fork-and-pull-request-workflows/#improvements-for-public-repository-forks
+        # https://docs.github.com/en/actions/managing-workflow-runs/approving-workflow-runs-from-public-forks#about-workflow-runs-from-public-forks
+        CSC_FOR_PULL_REQUEST: true
+        # https://sectigo.com/resource-library/time-stamping-server
+        TIMESTAMP_SERVER: http://timestamp.sectigo.com
+        # Apple notarization (automation/build-bin.ts)
+        XCODE_APP_LOADER_EMAIL: ${{ inputs.XCODE_APP_LOADER_EMAIL }}
+        XCODE_APP_LOADER_PASSWORD: ${{ fromJSON(inputs.secrets).XCODE_APP_LOADER_PASSWORD }}
+        XCODE_APP_LOADER_TEAM_ID: ${{ inputs.XCODE_APP_LOADER_TEAM_ID }}
+
+    - name: Upload artifacts
+      uses: actions/upload-artifact@v3
+      with:
+        name: gh-release-${{ github.event.pull_request.head.sha || github.event.head_commit.id }}
+        path: dist
+        retention-days: 1

.github/actions/test/action.yml

@@ -0,0 +1,59 @@
+---
+name: test release
+# https://github.com/product-os/flowzone/tree/master/.github/actions
+inputs:
+  json:
+    description: "JSON stringified object containing all the inputs from the calling workflow"
+    required: true
+  secrets:
+    description: "JSON stringified object containing all the secrets from the calling workflow"
+    required: true
+  variables:
+    description: "JSON stringified object containing all the variables from the calling workflow"
+    required: true
+
+  # --- custom environment
+  NODE_VERSION:
+    type: string
+    default: '16.x'
+  VERBOSE:
+    type: string
+    default: "true"
+
+runs:
+  # https://docs.github.com/en/actions/creating-actions/creating-a-composite-action
+  using: "composite"
+  steps:
+    # https://github.com/actions/setup-node#caching-global-packages-data
+    - name: Setup Node.js
+      uses: actions/setup-node@v3
+      with:
+        node-version: ${{ inputs.NODE_VERSION }}
+        cache: npm
+
+    - name: Test release
+      shell: bash
+      run: |
+        set -ea
+
+        [[ '${{ inputs.VERBOSE }}' =~ on|On|Yes|yes|true|True ]] && set -x
+
+        if [[ -e package-lock.json ]] || [[ -e npm-shrinkwrap.json ]]; then
+            npm ci
+        else
+            npm i
+        fi
+
+        npm run build
+        npm run test
+
+    - name: Compress custom source
+      shell: pwsh
+      run: tar -acf ${{ runner.temp }}/custom.tgz .
+
+    - name: Upload custom artifact
+      uses: actions/upload-artifact@v3
+      with:
+        name: custom-${{ github.event.pull_request.head.sha || github.event.head_commit.id }}-${{ runner.os }}-${{ runner.arch }}
+        path: ${{ runner.temp }}/custom.tgz
+        retention-days: 1

.github/workflows/flowzone.yml

@@ -0,0 +1,29 @@
+name: Flowzone
+
+on:
+  pull_request:
+    types: [opened, synchronize, closed]
+    branches: [main, master]
+  pull_request_target:
+    types: [opened, synchronize, closed]
+    branches: [main, master]
+
+jobs:
+  flowzone:
+    name: Flowzone
+    uses: product-os/flowzone/.github/workflows/flowzone.yml@v4.7.1
+    # prevent duplicate workflow executions for pull_request and pull_request_target
+    if: |
+      (
+        github.event.pull_request.head.repo.full_name == github.repository &&
+        github.event_name == 'pull_request'
+      ) || (
+        github.event.pull_request.head.repo.full_name != github.repository &&
+        github.event_name == 'pull_request_target'
+      )
+    secrets: inherit
+    with:
+      custom_runs_on: '[["self-hosted","Linux","distro:focal","X64"],["self-hosted","Linux","distro:focal","ARM64"],["macos-12"],["windows-2019"]]'
+      repo_config: true
+      repo_description: "The official balena CLI tool."
+      github_prerelease: false

.resinci.yml

@@ -1,20 +0,0 @@
----
-npm:
-  platforms:
-    - name: linux
-      os: ubuntu
-      architecture: x86_64
-      node_versions:
-        - "12"
-        - "14"
-    ##
-    ## Temporarily skip Alpine tests until the following issues are resolved:
-    ##   * https://github.com/concourse/concourse/issues/7905
-    ##   * https://github.com/product-os/balena-concourse/issues/631
-    ##
-    # - name: linux
-    #   os: alpine
-    #   architecture: x86_64
-    #   node_versions:
-    #     - "12"
-    #     - "14"

INSTALL-ADVANCED.md

@@ -78,8 +78,8 @@ If you are a Node.js developer, you may wish to install the balena CLI via [npm]
 The npm installation involves building native (platform-specific) binary modules, which require
 some development tools to be installed first, as follows.
 
-> **The balena CLI currently requires Node.js version 12 (min 12.8.0).**  
-> **Versions 13 and later are not yet fully supported.**
+> **The balena CLI currently requires Node.js version 16.**  
+> **Versions 17 and later are not yet fully supported.**
 
 ### Install development tools
 
@@ -89,7 +89,7 @@ some development tools to be installed first, as follows.
 $ sudo apt-get update && sudo apt-get -y install curl python3 git make g++
 $ curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.38.0/install.sh | bash
 $ . ~/.bashrc
-$ nvm install 12
+$ nvm install 16
 ```
 
 The `curl` command line above uses
@@ -106,15 +106,15 @@ recommended.
 ```sh
 $ curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.38.0/install.sh | bash
 $ . ~/.bashrc
-$ nvm install 12
+$ nvm install 16
 ```
 
 #### **Windows** (not WSL)
 
 Install:
 
-* Node.js v12 from the [Nodejs.org releases page](https://nodejs.org/en/download/releases/).
   * If you'd like the ability to switch between Node.js versions, install
+- Node.js v16 from the [Nodejs.org releases page](https://nodejs.org/en/download/releases/).
     [nvm-windows](https://github.com/coreybutler/nvm-windows#node-version-manager-nvm-for-windows)
     instead.
 * The [MSYS2 shell](https://www.msys2.org/), which provides `git`, `make`, `g++` and more:

automation/build-bin.ts

@@ -45,8 +45,6 @@ const execFileAsync = promisify(execFile);
 export const packageJSON = loadPackageJson();
 export const version = 'v' + packageJSON.version;
 const arch = process.arch;
-const MSYS2_BASH =
-	process.env.MSYSSHELLPATH || 'C:\\msys64\\usr\\bin\\bash.exe';
 
 function dPath(...paths: string[]) {
 	return path.join(ROOT, 'dist', ...paths);
@@ -89,7 +87,7 @@ async function diffPkgOutput(pkgOut: string) {
 		'tests',
 		'test-data',
 		'pkg',
-		`expected-warnings-${process.platform}.txt`,
+		`expected-warnings-${process.platform}-${arch}.txt`,
 	);
 	const absSavedPath = path.join(ROOT, relSavedPath);
 	const ignoreStartsWith = [
@@ -182,9 +180,18 @@ async function execPkg(...args: any[]) {
  * to be directly executed from inside another binary executable.)
  */
 async function buildPkg() {
+	// https://github.com/vercel/pkg#targets
+	let targets = `linux-${arch}`;
+	// TBC: not possible to build for macOS or Windows arm64 on x64 nodes
+	if (process.platform === 'darwin') {
+		targets = `macos-x64`;
+	}
+	if (process.platform === 'win32') {
+		targets = `win-x64`;
+	}
 	const args = [
-		'--target',
-		'host',
+		'--targets',
+		targets,
 		'--output',
 		'build-bin/balena',
 		'package.json',
@@ -425,20 +432,28 @@ async function renameInstallerFiles() {
 
 /**
  * If the CSC_LINK and CSC_KEY_PASSWORD env vars are set, digitally sign the
- * executable installer by running the balena-io/scripts/shared/sign-exe.sh
- * script (which must be in the PATH) using a MSYS2 bash shell.
+ * executable installer using Microsoft SignTool.exe (Sign Tool)
+ * https://learn.microsoft.com/en-us/dotnet/framework/tools/signtool-exe
  */
 async function signWindowsInstaller() {
 	if (process.env.CSC_LINK && process.env.CSC_KEY_PASSWORD) {
 		const exeName = renamedOclifInstallers[process.platform];
 		console.log(`Signing installer "${exeName}"`);
-		await execFileAsync(MSYS2_BASH, [
-			'sign-exe.sh',
+		// trust ...
+		await execFileAsync('signtool.exe', [
+			'sign',
+			'-t',
+			process.env.TIMESTAMP_SERVER || 'http://timestamp.comodoca.com',
 			'-f',
-			exeName,
+			process.env.CSC_LINK,
+			'-p',
+			process.env.CSC_KEY_PASSWORD,
 			'-d',
 			`balena-cli ${version}`,
+			exeName,
 		]);
+		// ... but verify
+		await execFileAsync('signtool.exe', ['verify', '-pa', '-v', exeName]);
 	} else {
 		console.log(
 			'Skipping installer signing step because CSC_* env vars are not set',
@@ -450,14 +465,22 @@ async function signWindowsInstaller() {
  * Wait for Apple Installer Notarization to continue
  */
 async function notarizeMacInstaller(): Promise<void> {
-	const appleId = 'accounts+apple@balena.io';
-	const { notarize } = await import('electron-notarize');
-	await notarize({
-		appBundleId: 'io.balena.etcher',
-		appPath: renamedOclifInstallers.darwin,
-		appleId,
-		appleIdPassword: '@keychain:CLI_PASSWORD',
-	});
+	const teamId = process.env.XCODE_APP_LOADER_TEAM_ID || '66H43P8FRG';
+	const appleId =
+		process.env.XCODE_APP_LOADER_EMAIL || 'accounts+apple@balena.io';
+	const appleIdPassword = process.env.XCODE_APP_LOADER_PASSWORD;
+
+	if (appleIdPassword && teamId) {
+		const { notarize } = await import('@electron/notarize');
+		// https://github.com/electron/notarize#readme
+		await notarize({
+			tool: 'notarytool',
+			teamId,
+			appPath: renamedOclifInstallers.darwin,
+			appleId,
+			appleIdPassword,
+		});
+	}
 }
 
 /**

automation/check-doc.ts

@@ -15,11 +15,12 @@
  * limitations under the License.
  */
 
-const stripIndent = require('common-tags/lib/stripIndent');
-const _ = require('lodash');
-const { promises: fs } = require('fs');
-const path = require('path');
-const simplegit = require('simple-git/promise');
+// tslint:disable-next-line:import-blacklist
+import { stripIndent } from 'common-tags';
+import * as _ from 'lodash';
+import { promises as fs } from 'fs';
+import * as path from 'path';
+import { simpleGit } from 'simple-git';
 
 const ROOT = path.normalize(path.join(__dirname, '..'));
 
@@ -31,7 +32,7 @@ const ROOT = path.normalize(path.join(__dirname, '..'));
  * using `touch`.
  */
 async function checkBuildTimestamps() {
-	const git = simplegit(ROOT);
+	const git = simpleGit(ROOT);
 	const docFile = path.join(ROOT, 'docs', 'balena-cli.md');
 	const [docStat, gitStatus] = await Promise.all([
 		fs.stat(docFile),
@@ -81,4 +82,5 @@ async function run() {
 	}
 }
 
+// tslint:disable-next-line:no-floating-promises
 run();

completion/_balena

@@ -8,19 +8,21 @@ _balena() {
   local context state line curcontext="$curcontext"
 
   # Valid top-level completions
-  main_commands=( build deploy envs fleets join keys leave login logout logs note orgs preload push releases scan settings ssh support tags tunnel version whoami api-key config device device devices env fleet fleet internal key key local os release release tag util )
+  main_commands=( build deploy envs fleets join keys leave login logout logs note orgs preload push releases scan settings ssh support tags tunnel version whoami api-key api-keys app block config device device devices env fleet fleet internal key key local os release release tag util )
   # Sub-completions
-  api_key_cmds=( generate )
+  api_key_cmds=( generate revoke )
+  app_cmds=( create )
+  block_cmds=( create )
   config_cmds=( generate inject read reconfigure write )
-  device_cmds=( deactivate identify init local-mode move os-update public-url purge reboot register rename restart rm shutdown )
+  device_cmds=( deactivate identify init local-mode move os-update pin public-url purge reboot register rename restart rm shutdown track-fleet )
   devices_cmds=( supported )
   env_cmds=( add rename rm )
-  fleet_cmds=( create purge rename restart rm )
+  fleet_cmds=( create pin purge rename restart rm track-latest )
   internal_cmds=( osinit )
   key_cmds=( add rm )
   local_cmds=( configure flash )
   os_cmds=( build-config configure download initialize versions )
-  release_cmds=( finalize )
+  release_cmds=( finalize invalidate validate )
   tag_cmds=( rm set )
 
 
@@ -43,6 +45,12 @@ _balena_sec_cmds() {
       "api-key")
         _describe -t api_key_cmds 'api-key_cmd' api_key_cmds "$@" && ret=0
       ;;
+      "app")
+        _describe -t app_cmds 'app_cmd' app_cmds "$@" && ret=0
+      ;;
+      "block")
+        _describe -t block_cmds 'block_cmd' block_cmds "$@" && ret=0
+      ;;
       "config")
         _describe -t config_cmds 'config_cmd' config_cmds "$@" && ret=0
       ;;

completion/balena-completion.bash

@@ -7,19 +7,21 @@ _balena_complete()
   local cur prev
 
   # Valid top-level completions
-  main_commands="build deploy envs fleets join keys leave login logout logs note orgs preload push releases scan settings ssh support tags tunnel version whoami api-key config device device devices env fleet fleet internal key key local os release release tag util"
+  main_commands="build deploy envs fleets join keys leave login logout logs note orgs preload push releases scan settings ssh support tags tunnel version whoami api-key api-keys app block config device device devices env fleet fleet internal key key local os release release tag util"
   # Sub-completions
-  api_key_cmds="generate"
+  api_key_cmds="generate revoke"
+  app_cmds="create"
+  block_cmds="create"
   config_cmds="generate inject read reconfigure write"
-  device_cmds="deactivate identify init local-mode move os-update public-url purge reboot register rename restart rm shutdown"
+  device_cmds="deactivate identify init local-mode move os-update pin public-url purge reboot register rename restart rm shutdown track-fleet"
   devices_cmds="supported"
   env_cmds="add rename rm"
-  fleet_cmds="create purge rename restart rm"
+  fleet_cmds="create pin purge rename restart rm track-latest"
   internal_cmds="osinit"
   key_cmds="add rm"
   local_cmds="configure flash"
   os_cmds="build-config configure download initialize versions"
-  release_cmds="finalize"
+  release_cmds="finalize invalidate validate"
   tag_cmds="rm set"
 
 
@@ -37,6 +39,12 @@ _balena_complete()
       api-key)
         COMPREPLY=( $(compgen -W "$api_key_cmds" -- $cur) )
         ;;
+      app)
+        COMPREPLY=( $(compgen -W "$app_cmds" -- $cur) )
+        ;;
+      block)
+        COMPREPLY=( $(compgen -W "$block_cmds" -- $cur) )
+        ;;
       config)
         COMPREPLY=( $(compgen -W "$config_cmds" -- $cur) )
         ;;

docs/balena-cli.md

@@ -333,11 +333,35 @@ Examples:
 
 ### Options
 
+#### --fields FIELDS
+
+only show provided fields (comma-separated)
+
+#### -j, --json
+
+output in json format
+
+#### --filter FILTER
+
+filter results by substring matching of a given field, eg: --filter field=foo
+
+#### --no-header
+
+hide table header from output
+
+#### --no-truncate
+
+do not truncate output to fit screen
+
+#### --sort SORT
+
+field to sort by (prepend '-' for descending order)
+
 ## fleet <fleet>
 
 Display detailed information about a single fleet.
 
-Fleets may be specified by fleet name, slug, or numeric ID. Fleet slugs are
+Fleets may be specified by fleet name or slug. Fleet slugs are
 the recommended option, as they are unique and unambiguous. Slugs can be
 listed with the `balena fleets` command. Note that slugs may change if the
 fleet is renamed. Fleet names are not unique and may result in  "Fleet is
@@ -345,23 +369,34 @@ ambiguous" errors at any time (even if it "used to work in the past"), for
 example if the name clashes with a newly created public fleet, or with fleets
 from other balena accounts that you may be invited to join under any role.
 For this reason, fleet names are especially discouraged in scripts (e.g. CI
-environments). Numeric fleet IDs are deprecated because they consist of an
-implementation detail of the balena backend. We intend to remove support for
-numeric IDs at some point in the future.
+environments).
 
 Examples:
 
 	$ balena fleet MyFleet
 	$ balena fleet myorg/myfleet
+	$ balena fleet myorg/myfleet --view
 
 ### Arguments
 
 #### FLEET
 
-fleet name, slug (preferred), or numeric ID (deprecated)
+fleet name or slug (preferred)
 
 ### Options
 
+#### --view
+
+open fleet dashboard page
+
+#### --fields FIELDS
+
+only show provided fields (comma-separated)
+
+#### -j, --json
+
+output in json format
+
 ## fleet create <name>
 
 Create a new balena fleet.
@@ -408,7 +443,7 @@ fleet device type (Check available types with `balena devices supported`)
 Purge data from all devices belonging to a fleet.
 This will clear the fleet's '/data' directory.
 
-Fleets may be specified by fleet name, slug, or numeric ID. Fleet slugs are
+Fleets may be specified by fleet name or slug. Fleet slugs are
 the recommended option, as they are unique and unambiguous. Slugs can be
 listed with the `balena fleets` command. Note that slugs may change if the
 fleet is renamed. Fleet names are not unique and may result in  "Fleet is
@@ -416,9 +451,7 @@ ambiguous" errors at any time (even if it "used to work in the past"), for
 example if the name clashes with a newly created public fleet, or with fleets
 from other balena accounts that you may be invited to join under any role.
 For this reason, fleet names are especially discouraged in scripts (e.g. CI
-environments). Numeric fleet IDs are deprecated because they consist of an
-implementation detail of the balena backend. We intend to remove support for
-numeric IDs at some point in the future.
+environments).
 
 Examples:
 
@@ -429,7 +462,7 @@ Examples:
 
 #### FLEET
 
-fleet name, slug (preferred), or numeric ID (deprecated)
+fleet name or slug (preferred)
 
 ### Options
 
@@ -440,7 +473,7 @@ Rename a fleet.
 Note, if the `newName` parameter is omitted, it will be
 prompted for interactively.
 
-Fleets may be specified by fleet name, slug, or numeric ID. Fleet slugs are
+Fleets may be specified by fleet name or slug. Fleet slugs are
 the recommended option, as they are unique and unambiguous. Slugs can be
 listed with the `balena fleets` command. Note that slugs may change if the
 fleet is renamed. Fleet names are not unique and may result in  "Fleet is
@@ -448,9 +481,7 @@ ambiguous" errors at any time (even if it "used to work in the past"), for
 example if the name clashes with a newly created public fleet, or with fleets
 from other balena accounts that you may be invited to join under any role.
 For this reason, fleet names are especially discouraged in scripts (e.g. CI
-environments). Numeric fleet IDs are deprecated because they consist of an
-implementation detail of the balena backend. We intend to remove support for
-numeric IDs at some point in the future.
+environments).
 
 Examples:
 
@@ -462,7 +493,7 @@ Examples:
 
 #### FLEET
 
-fleet name, slug (preferred), or numeric ID (deprecated)
+fleet name or slug (preferred)
 
 #### NEWNAME
 
@@ -474,7 +505,7 @@ the new name for the fleet
 
 Restart all devices belonging to a fleet.
 
-Fleets may be specified by fleet name, slug, or numeric ID. Fleet slugs are
+Fleets may be specified by fleet name or slug. Fleet slugs are
 the recommended option, as they are unique and unambiguous. Slugs can be
 listed with the `balena fleets` command. Note that slugs may change if the
 fleet is renamed. Fleet names are not unique and may result in  "Fleet is
@@ -482,9 +513,7 @@ ambiguous" errors at any time (even if it "used to work in the past"), for
 example if the name clashes with a newly created public fleet, or with fleets
 from other balena accounts that you may be invited to join under any role.
 For this reason, fleet names are especially discouraged in scripts (e.g. CI
-environments). Numeric fleet IDs are deprecated because they consist of an
-implementation detail of the balena backend. We intend to remove support for
-numeric IDs at some point in the future.
+environments).
 
 Examples:
 
@@ -495,7 +524,7 @@ Examples:
 
 #### FLEET
 
-fleet name, slug (preferred), or numeric ID (deprecated)
+fleet name or slug (preferred)
 
 ### Options
 
@@ -505,7 +534,7 @@ Permanently remove a fleet.
 
 The --yes option may be used to avoid interactive confirmation.
 
-Fleets may be specified by fleet name, slug, or numeric ID. Fleet slugs are
+Fleets may be specified by fleet name or slug. Fleet slugs are
 the recommended option, as they are unique and unambiguous. Slugs can be
 listed with the `balena fleets` command. Note that slugs may change if the
 fleet is renamed. Fleet names are not unique and may result in  "Fleet is
@@ -513,9 +542,7 @@ ambiguous" errors at any time (even if it "used to work in the past"), for
 example if the name clashes with a newly created public fleet, or with fleets
 from other balena accounts that you may be invited to join under any role.
 For this reason, fleet names are especially discouraged in scripts (e.g. CI
-environments). Numeric fleet IDs are deprecated because they consist of an
-implementation detail of the balena backend. We intend to remove support for
-numeric IDs at some point in the future.
+environments).
 
 Examples:
 
@@ -527,7 +554,7 @@ Examples:
 
 #### FLEET
 
-fleet name, slug (preferred), or numeric ID (deprecated)
+fleet name or slug (preferred)
 
 ### Options
 
@@ -618,7 +645,7 @@ List all of your devices.
 
 Devices can be filtered by fleet with the `--fleet` option.
 
-Fleets may be specified by fleet name, slug, or numeric ID. Fleet slugs are
+Fleets may be specified by fleet name or slug. Fleet slugs are
 the recommended option, as they are unique and unambiguous. Slugs can be
 listed with the `balena fleets` command. Note that slugs may change if the
 fleet is renamed. Fleet names are not unique and may result in  "Fleet is
@@ -626,9 +653,7 @@ ambiguous" errors at any time (even if it "used to work in the past"), for
 example if the name clashes with a newly created public fleet, or with fleets
 from other balena accounts that you may be invited to join under any role.
 For this reason, fleet names are especially discouraged in scripts (e.g. CI
-environments). Numeric fleet IDs are deprecated because they consist of an
-implementation detail of the balena backend. We intend to remove support for
-numeric IDs at some point in the future.
+environments).
 
 The --json option is recommended when scripting the output of this command,
 because field names are less likely to change in JSON format and because it
@@ -646,7 +671,7 @@ Examples:
 
 #### -f, --fleet FLEET
 
-fleet name, slug (preferred), or numeric ID (deprecated)
+fleet name or slug (preferred)
 
 #### -j, --json
 
@@ -680,6 +705,7 @@ Show information about a single device.
 Examples:
 
 	$ balena device 7cf02a6
+	$ balena device 7cf02a6 --view
 
 ### Arguments
 
@@ -689,6 +715,10 @@ the device uuid
 
 ### Options
 
+#### --view
+
+open device dashboard page
+
 ## device deactivate <uuid>
 
 Deactivate a device.
@@ -753,7 +783,7 @@ If the '--fleet' or '--drive' options are omitted, interactive menus will be
 presented with values to choose from. If the '--os-version' option is omitted,
 the latest released OS version for the fleet's default device type will be used.
 
-Fleets may be specified by fleet name, slug, or numeric ID. Fleet slugs are
+Fleets may be specified by fleet name or slug. Fleet slugs are
 the recommended option, as they are unique and unambiguous. Slugs can be
 listed with the `balena fleets` command. Note that slugs may change if the
 fleet is renamed. Fleet names are not unique and may result in  "Fleet is
@@ -761,9 +791,7 @@ ambiguous" errors at any time (even if it "used to work in the past"), for
 example if the name clashes with a newly created public fleet, or with fleets
 from other balena accounts that you may be invited to join under any role.
 For this reason, fleet names are especially discouraged in scripts (e.g. CI
-environments). Numeric fleet IDs are deprecated because they consist of an
-implementation detail of the balena backend. We intend to remove support for
-numeric IDs at some point in the future.
+environments).
 
 Image configuration questions will be asked interactively unless a pre-configured
 'config.json' file is provided with the '--config' option.  The file can be
@@ -773,13 +801,14 @@ Examples:
 
 	$ balena device init
 	$ balena device init -f myorg/myfleet
+	$ balena device init --fleet myFleet --os-version 2.101.7 --drive /dev/disk5 --config config.json --yes
 	$ balena device init --fleet myFleet --os-version 2.83.21+rev1.prod --drive /dev/disk5 --config config.json --yes
 
 ### Options
 
 #### -f, --fleet FLEET
 
-fleet name, slug (preferred), or numeric ID (deprecated)
+fleet name or slug (preferred)
 
 #### -y, --yes
 
@@ -811,6 +840,10 @@ path to the config JSON file, see `balena os build-config`
 
 custom key name assigned to generated provisioning api key
 
+#### --provisioning-key-expiry-date PROVISIONING-KEY-EXPIRY-DATE
+
+expiry date assigned to generated provisioning api key (format: YYYY-MM-DD)
+
 ## device local-mode <uuid>
 
 Output current local mode status, or enable/disable local mode
@@ -849,7 +882,7 @@ Move one or more devices to another fleet.
 
 If --fleet is omitted, the fleet will be prompted for interactively.
 
-Fleets may be specified by fleet name, slug, or numeric ID. Fleet slugs are
+Fleets may be specified by fleet name or slug. Fleet slugs are
 the recommended option, as they are unique and unambiguous. Slugs can be
 listed with the `balena fleets` command. Note that slugs may change if the
 fleet is renamed. Fleet names are not unique and may result in  "Fleet is
@@ -857,9 +890,7 @@ ambiguous" errors at any time (even if it "used to work in the past"), for
 example if the name clashes with a newly created public fleet, or with fleets
 from other balena accounts that you may be invited to join under any role.
 For this reason, fleet names are especially discouraged in scripts (e.g. CI
-environments). Numeric fleet IDs are deprecated because they consist of an
-implementation detail of the balena backend. We intend to remove support for
-numeric IDs at some point in the future.
+environments).
 
 Examples:
 
@@ -878,7 +909,7 @@ comma-separated list (no blank spaces) of device UUIDs to be moved
 
 #### -f, --fleet FLEET
 
-fleet name, slug (preferred), or numeric ID (deprecated)
+fleet name or slug (preferred)
 
 ## device os-update <uuid>
 
@@ -892,6 +923,7 @@ Requires balenaCloud; will not work with openBalena or standalone balenaOS.
 Examples:
 
 	$ balena device os-update 23c73a1
+	$ balena device os-update 23c73a1 --version 2.101.7
 	$ balena device os-update 23c73a1 --version 2.31.0+rev1.prod
 
 ### Arguments
@@ -916,9 +948,6 @@ This command will output the current public URL for the
 specified device.  It can also enable or disable the URL,
 or output the enabled status, using the respective options.
 
-The old command style 'balena device public-url enable <uuid>'
-is deprecated, but still supported.
-
 Examples:
 
 	$ balena device public-url 23c73a1
@@ -932,10 +961,6 @@ Examples:
 
 the uuid of the device to manage
 
-#### LEGACYUUID
-
-
-
 ### Options
 
 #### --enable
@@ -997,7 +1022,7 @@ Register a new device with a balena fleet.
 
 If --uuid is not provided, a new UUID will be automatically assigned.
 
-Fleets may be specified by fleet name, slug, or numeric ID. Fleet slugs are
+Fleets may be specified by fleet name or slug. Fleet slugs are
 the recommended option, as they are unique and unambiguous. Slugs can be
 listed with the `balena fleets` command. Note that slugs may change if the
 fleet is renamed. Fleet names are not unique and may result in  "Fleet is
@@ -1005,21 +1030,20 @@ ambiguous" errors at any time (even if it "used to work in the past"), for
 example if the name clashes with a newly created public fleet, or with fleets
 from other balena accounts that you may be invited to join under any role.
 For this reason, fleet names are especially discouraged in scripts (e.g. CI
-environments). Numeric fleet IDs are deprecated because they consist of an
-implementation detail of the balena backend. We intend to remove support for
-numeric IDs at some point in the future.
+environments).
 
 Examples:
 
 	$ balena device register MyFleet
 	$ balena device register MyFleet --uuid <uuid>
 	$ balena device register myorg/myfleet --uuid <uuid>
+	$ balena device register myorg/myfleet --uuid <uuid> --deviceType <deviceTypeSlug>
 
 ### Arguments
 
 #### FLEET
 
-fleet name, slug (preferred), or numeric ID (deprecated)
+fleet name or slug (preferred)
 
 ### Options
 
@@ -1027,6 +1051,10 @@ fleet name, slug (preferred), or numeric ID (deprecated)
 
 custom uuid
 
+#### --deviceType DEVICETYPE
+
+device type slug (run 'balena devices supported' for possible values)
+
 ## device rename &#60;uuid&#62; [newName]
 
 Rename a device.
@@ -1233,7 +1261,7 @@ name may be null in JSON output (or 'N/A' in tabular output) if the fleet that
 the device belonged to is no longer accessible by the current user (for example,
 in case the current user was removed from the fleet by the fleet's owner).
 
-Fleets may be specified by fleet name, slug, or numeric ID. Fleet slugs are
+Fleets may be specified by fleet name or slug. Fleet slugs are
 the recommended option, as they are unique and unambiguous. Slugs can be
 listed with the `balena fleets` command. Note that slugs may change if the
 fleet is renamed. Fleet names are not unique and may result in  "Fleet is
@@ -1241,9 +1269,7 @@ ambiguous" errors at any time (even if it "used to work in the past"), for
 example if the name clashes with a newly created public fleet, or with fleets
 from other balena accounts that you may be invited to join under any role.
 For this reason, fleet names are especially discouraged in scripts (e.g. CI
-environments). Numeric fleet IDs are deprecated because they consist of an
-implementation detail of the balena backend. We intend to remove support for
-numeric IDs at some point in the future.
+environments).
 
 Examples:
 
@@ -1261,7 +1287,7 @@ Examples:
 
 #### -f, --fleet FLEET
 
-fleet name, slug (preferred), or numeric ID (deprecated)
+fleet name or slug (preferred)
 
 #### -c, --config
 
@@ -1371,7 +1397,7 @@ therefore the --service option cannot be used when the variable name starts
 with a reserved prefix. When defining custom fleet variables, please avoid
 these reserved prefixes.
 
-Fleets may be specified by fleet name, slug, or numeric ID. Fleet slugs are
+Fleets may be specified by fleet name or slug. Fleet slugs are
 the recommended option, as they are unique and unambiguous. Slugs can be
 listed with the `balena fleets` command. Note that slugs may change if the
 fleet is renamed. Fleet names are not unique and may result in  "Fleet is
@@ -1379,9 +1405,7 @@ ambiguous" errors at any time (even if it "used to work in the past"), for
 example if the name clashes with a newly created public fleet, or with fleets
 from other balena accounts that you may be invited to join under any role.
 For this reason, fleet names are especially discouraged in scripts (e.g. CI
-environments). Numeric fleet IDs are deprecated because they consist of an
-implementation detail of the balena backend. We intend to remove support for
-numeric IDs at some point in the future.
+environments).
 
 Examples:
 
@@ -1409,7 +1433,7 @@ variable value; if omitted, use value from this process' environment
 
 #### -f, --fleet FLEET
 
-fleet name, slug (preferred), or numeric ID (deprecated)
+fleet name or slug (preferred)
 
 #### -d, --device DEVICE
 
@@ -1492,7 +1516,7 @@ select a service variable (may be used together with the --device option)
 
 List all tags and their values for the specified fleet, device or release.
 
-Fleets may be specified by fleet name, slug, or numeric ID. Fleet slugs are
+Fleets may be specified by fleet name or slug. Fleet slugs are
 the recommended option, as they are unique and unambiguous. Slugs can be
 listed with the `balena fleets` command. Note that slugs may change if the
 fleet is renamed. Fleet names are not unique and may result in  "Fleet is
@@ -1500,9 +1524,7 @@ ambiguous" errors at any time (even if it "used to work in the past"), for
 example if the name clashes with a newly created public fleet, or with fleets
 from other balena accounts that you may be invited to join under any role.
 For this reason, fleet names are especially discouraged in scripts (e.g. CI
-environments). Numeric fleet IDs are deprecated because they consist of an
-implementation detail of the balena backend. We intend to remove support for
-numeric IDs at some point in the future.
+environments).
 
 Examples:
 
@@ -1516,7 +1538,7 @@ Examples:
 
 #### -f, --fleet FLEET
 
-fleet name, slug (preferred), or numeric ID (deprecated)
+fleet name or slug (preferred)
 
 #### -d, --device DEVICE
 
@@ -1530,7 +1552,7 @@ release id
 
 Remove a tag from a fleet, device or release.
 
-Fleets may be specified by fleet name, slug, or numeric ID. Fleet slugs are
+Fleets may be specified by fleet name or slug. Fleet slugs are
 the recommended option, as they are unique and unambiguous. Slugs can be
 listed with the `balena fleets` command. Note that slugs may change if the
 fleet is renamed. Fleet names are not unique and may result in  "Fleet is
@@ -1538,9 +1560,7 @@ ambiguous" errors at any time (even if it "used to work in the past"), for
 example if the name clashes with a newly created public fleet, or with fleets
 from other balena accounts that you may be invited to join under any role.
 For this reason, fleet names are especially discouraged in scripts (e.g. CI
-environments). Numeric fleet IDs are deprecated because they consist of an
-implementation detail of the balena backend. We intend to remove support for
-numeric IDs at some point in the future.
+environments).
 
 Examples:
 
@@ -1560,7 +1580,7 @@ the key string of the tag
 
 #### -f, --fleet FLEET
 
-fleet name, slug (preferred), or numeric ID (deprecated)
+fleet name or slug (preferred)
 
 #### -d, --device DEVICE
 
@@ -1578,7 +1598,7 @@ You can optionally provide a value to be associated with the created
 tag, as an extra argument after the tag key. If a value isn't
 provided, a tag with an empty value is created.
 
-Fleets may be specified by fleet name, slug, or numeric ID. Fleet slugs are
+Fleets may be specified by fleet name or slug. Fleet slugs are
 the recommended option, as they are unique and unambiguous. Slugs can be
 listed with the `balena fleets` command. Note that slugs may change if the
 fleet is renamed. Fleet names are not unique and may result in  "Fleet is
@@ -1586,9 +1606,7 @@ ambiguous" errors at any time (even if it "used to work in the past"), for
 example if the name clashes with a newly created public fleet, or with fleets
 from other balena accounts that you may be invited to join under any role.
 For this reason, fleet names are especially discouraged in scripts (e.g. CI
-environments). Numeric fleet IDs are deprecated because they consist of an
-implementation detail of the balena backend. We intend to remove support for
-numeric IDs at some point in the future.
+environments).
 
 Examples:
 
@@ -1615,7 +1633,7 @@ the optional value associated with the tag
 
 #### -f, --fleet FLEET
 
-fleet name, slug (preferred), or numeric ID (deprecated)
+fleet name or slug (preferred)
 
 #### -d, --device DEVICE
 
@@ -1900,7 +1918,7 @@ Examples:
 
 #### FLEETORDEVICE
 
-fleet name/slug/id, device uuid, or address of local device
+fleet name/slug, device uuid, or address of local device
 
 #### SERVICE
 
@@ -1968,7 +1986,7 @@ Examples:
 
 #### DEVICEORFLEET
 
-device UUID or fleet name/slug/ID
+device UUID or fleet name/slug
 
 ### Options
 
@@ -2054,9 +2072,11 @@ Development images can be selected by appending `.dev` to the version.
 Examples:
 
 	$ balena os download raspberrypi3 -o ../foo/bar/raspberry-pi.img
+	$ balena os download raspberrypi3 -o ../foo/bar/raspberry-pi.img --version 2.101.7
+	$ balena os download raspberrypi3 -o ../foo/bar/raspberry-pi.img --version 2022.7.0
+	$ balena os download raspberrypi3 -o ../foo/bar/raspberry-pi.img --version ^2.90.0
 	$ balena os download raspberrypi3 -o ../foo/bar/raspberry-pi.img --version 2.60.1+rev1
 	$ balena os download raspberrypi3 -o ../foo/bar/raspberry-pi.img --version 2.60.1+rev1.dev
-	$ balena os download raspberrypi3 -o ../foo/bar/raspberry-pi.img --version ^2.60.0
 	$ balena os download raspberrypi3 -o ../foo/bar/raspberry-pi.img --version 2021.10.2.prod
 	$ balena os download raspberrypi3 -o ../foo/bar/raspberry-pi.img --version latest
 	$ balena os download raspberrypi3 -o ../foo/bar/raspberry-pi.img --version default
@@ -2140,6 +2160,9 @@ confuse the balenaOS "development mode" with a device's "local mode", the latter
 being a supervisor feature that allows the "balena push" command to push a user's
 application directly to a device in the local network.
 
+The '--secureBoot' option is used to configure a balenaOS installer image to opt-in
+secure boot and disk encryption.
+
 The --system-connection (-c) option is used to inject NetworkManager connection
 profiles for additional network interfaces, such as cellular/GSM or additional
 WiFi or ethernet connections. This option may be passed multiple times in case there
@@ -2147,7 +2170,7 @@ are multiple files to inject. See connection profile examples and reference at:
 https://www.balena.io/docs/reference/OS/network/2.x/
 https://developer.gnome.org/NetworkManager/stable/ref-settings.html
 
-Fleets may be specified by fleet name, slug, or numeric ID. Fleet slugs are
+Fleets may be specified by fleet name or slug. Fleet slugs are
 the recommended option, as they are unique and unambiguous. Slugs can be
 listed with the `balena fleets` command. Note that slugs may change if the
 fleet is renamed. Fleet names are not unique and may result in  "Fleet is
@@ -2155,9 +2178,7 @@ ambiguous" errors at any time (even if it "used to work in the past"), for
 example if the name clashes with a newly created public fleet, or with fleets
 from other balena accounts that you may be invited to join under any role.
 For this reason, fleet names are especially discouraged in scripts (e.g. CI
-environments). Numeric fleet IDs are deprecated because they consist of an
-implementation detail of the balena backend. We intend to remove support for
-numeric IDs at some point in the future.
+environments).
 
 Note: This command is currently not supported on Windows natively. Windows users
 are advised to install the Windows Subsystem for Linux (WSL) with Ubuntu, and use
@@ -2186,7 +2207,7 @@ ask advanced configuration questions (when in interactive mode)
 
 #### -f, --fleet FLEET
 
-fleet name, slug (preferred), or numeric ID (deprecated)
+fleet name or slug (preferred)
 
 #### --config CONFIG
 
@@ -2212,6 +2233,10 @@ WiFi SSID (network name) (non-interactive configuration)
 
 Configure balenaOS to operate in development mode
 
+#### --secureBoot
+
+Configure balenaOS installer to opt-in secure boot and disk encryption
+
 #### -d, --device DEVICE
 
 device UUID
@@ -2236,10 +2261,16 @@ paths to local files to place into the 'system-connections' directory
 
 custom key name assigned to generated provisioning api key
 
+#### --provisioning-key-expiry-date PROVISIONING-KEY-EXPIRY-DATE
+
+expiry date assigned to generated provisioning api key (format: YYYY-MM-DD)
+
 ## os initialize &#60;image&#62;
 
 Initialize an os image for a device with a previously
-		configured operating system image.
+		configured operating system image and flash the
+		an external storage drive or the device's storage
+		medium depending on the device type.
 		
 
 Note: Initializing the device may ask for administrative permissions
@@ -2290,13 +2321,16 @@ confuse the balenaOS "development mode" with a device's "local mode", the latter
 being a supervisor feature that allows the "balena push" command to push a user's
 application directly to a device in the local network.
 
+The '--secureBoot' option is used to configure a balenaOS installer image to opt-in
+secure boot and disk encryption.
+
 To configure an image for a fleet of mixed device types, use the --fleet option
 alongside the --deviceType option to specify the target device type.
 
 To avoid interactive questions, specify a command line option for each question that
 would otherwise be asked.
 
-Fleets may be specified by fleet name, slug, or numeric ID. Fleet slugs are
+Fleets may be specified by fleet name or slug. Fleet slugs are
 the recommended option, as they are unique and unambiguous. Slugs can be
 listed with the `balena fleets` command. Note that slugs may change if the
 fleet is renamed. Fleet names are not unique and may result in  "Fleet is
@@ -2304,9 +2338,7 @@ ambiguous" errors at any time (even if it "used to work in the past"), for
 example if the name clashes with a newly created public fleet, or with fleets
 from other balena accounts that you may be invited to join under any role.
 For this reason, fleet names are especially discouraged in scripts (e.g. CI
-environments). Numeric fleet IDs are deprecated because they consist of an
-implementation detail of the balena backend. We intend to remove support for
-numeric IDs at some point in the future.
+environments).
 
 Examples:
 
@@ -2315,6 +2347,7 @@ Examples:
 	$ balena config generate --device 7cf02a6 --version 2.12.7 --deviceApiKey <existingDeviceKey>
 	$ balena config generate --device 7cf02a6 --version 2.12.7 --output config.json
 	$ balena config generate --fleet myorg/fleet --version 2.12.7 --dev
+	$ balena config generate --fleet myorg/fleet --version 2.12.7 --secureBoot
 	$ balena config generate --fleet myorg/fleet --version 2.12.7 --deviceType fincm3
 	$ balena config generate --fleet myorg/fleet --version 2.12.7 --output config.json
 	$ balena config generate --fleet myorg/fleet --version 2.12.7 --network wifi --wifiSsid mySsid --wifiKey abcdefgh --appUpdatePollInterval 15
@@ -2327,12 +2360,16 @@ a balenaOS version
 
 #### -f, --fleet FLEET
 
-fleet name, slug (preferred), or numeric ID (deprecated)
+fleet name or slug (preferred)
 
 #### --dev
 
 Configure balenaOS to operate in development mode
 
+#### --secureBoot
+
+Configure balenaOS installer to opt-in secure boot and disk encryption
+
 #### -d, --device DEVICE
 
 device UUID
@@ -2373,6 +2410,10 @@ supervisor cloud polling interval in minutes (e.g. for device variables)
 
 custom key name assigned to generated provisioning api key
 
+#### --provisioning-key-expiry-date PROVISIONING-KEY-EXPIRY-DATE
+
+expiry date assigned to generated provisioning api key (format: YYYY-MM-DD)
+
 ## config inject &#60;file&#62;
 
 Inject a 'config.json' file to a balenaOS image file or attached SD card or
@@ -2394,10 +2435,6 @@ the path to the config.json file to inject
 
 ### Options
 
-#### -t, --type TYPE
-
-ignored - no longer required
-
 #### -d, --drive DRIVE
 
 path to OS image file (e.g. balena.img) or block device (e.g. /dev/disk2)
@@ -2418,10 +2455,6 @@ Examples:
 
 ### Options
 
-#### -t, --type TYPE
-
-ignored - no longer required
-
 #### -d, --drive DRIVE
 
 path to OS image file (e.g. balena.img) or block device (e.g. /dev/disk2)
@@ -2449,10 +2482,6 @@ Examples:
 
 ### Options
 
-#### -t, --type TYPE
-
-ignored - no longer required
-
 #### -d, --drive DRIVE
 
 path to OS image file (e.g. balena.img) or block device (e.g. /dev/disk2)
@@ -2491,10 +2520,6 @@ the value of the config parameter to write
 
 ### Options
 
-#### -t, --type TYPE
-
-ignored - no longer required
-
 #### -d, --drive DRIVE
 
 path to OS image file (e.g. balena.img) or block device (e.g. /dev/disk2)
@@ -2515,7 +2540,7 @@ Check also the Preloading and Preregistering section of the balena CLI's advance
 masterclass document:
 https://www.balena.io/docs/learn/more/masterclasses/advanced-cli/#5-preloading-and-preregistering
 
-Fleets may be specified by fleet name, slug, or numeric ID. Fleet slugs are
+Fleets may be specified by fleet name or slug. Fleet slugs are
 the recommended option, as they are unique and unambiguous. Slugs can be
 listed with the `balena fleets` command. Note that slugs may change if the
 fleet is renamed. Fleet names are not unique and may result in  "Fleet is
@@ -2523,9 +2548,7 @@ ambiguous" errors at any time (even if it "used to work in the past"), for
 example if the name clashes with a newly created public fleet, or with fleets
 from other balena accounts that you may be invited to join under any role.
 For this reason, fleet names are especially discouraged in scripts (e.g. CI
-environments). Numeric fleet IDs are deprecated because they consist of an
-implementation detail of the balena backend. We intend to remove support for
-numeric IDs at some point in the future.
+environments).
 
 Note that the this command requires Docker to be installed, as further detailed
 in the balena CLI's installation instructions:
@@ -2551,7 +2574,7 @@ the image file path
 
 #### -f, --fleet FLEET
 
-fleet name, slug (preferred), or numeric ID (deprecated)
+fleet name or slug (preferred)
 
 #### -c, --commit COMMIT
 
@@ -2715,6 +2738,7 @@ Examples:
 	$ balena push myFleet
 	$ balena push myFleet --source <source directory>
 	$ balena push myFleet -s <source directory>
+	$ balena push myFleet --source <source directory> --note "this is the note for this release"
 	$ balena push myFleet --release-tag key1 "" key2 "value2 with spaces"
 	$ balena push myorg/myfleet
 	
@@ -2779,7 +2803,7 @@ used (usually $HOME/.balena/secrets.yml|.json)
 
 Don't run a live session on this push. The filesystem will not be monitored,
 and changes will not be synchronized to any running containers. Note that both
-this flag and --detached and required to cause the process to end once the
+this flag and --detached are required to cause the process to end once the
 initial build has completed.
 
 #### -d, --detached
@@ -2831,6 +2855,10 @@ by the 'track latest' release policy but can be used through release pinning.
 Draft releases can be marked as final through the API. Releases are created
 as final by default unless this option is given.
 
+#### --note NOTE
+
+The notes for this release
+
 # Settings
 
 ## settings
@@ -3010,7 +3038,7 @@ the type of device this build is for
 
 #### -f, --fleet FLEET
 
-fleet name, slug (preferred), or numeric ID (deprecated)
+fleet name or slug (preferred)
 
 #### -e, --emulated
 
@@ -3020,14 +3048,6 @@ Use QEMU for ARM architecture emulation during the image build
 
 Alternative Dockerfile name/path, relative to the source folder
 
-#### --dockercompose DOCKERCOMPOSE
-
-Alternative docker-compose.yml name in the source root folder
-
-#### --logs
-
-No-op and deprecated since balena CLI v12.0.0. Build logs are now shown by default.
-
 #### --nologs
 
 Hide the image build log output (produce less verbose output)
@@ -3200,6 +3220,7 @@ Examples:
 
 	$ balena deploy myFleet
 	$ balena deploy myorg/myfleet --build --source myBuildDir/
+	$ balena deploy myorg/myfleet --build --source myBuildDir/ --note "this is the note for this release"
 	$ balena deploy myorg/myfleet myRepo/myImage
 	$ balena deploy myFleet myRepo/myImage --release-tag key1 "" key2 "value2 with spaces"
 
@@ -3207,7 +3228,7 @@ Examples:
 
 #### FLEET
 
-fleet name, slug (preferred), or numeric ID (deprecated)
+fleet name or slug (preferred)
 
 #### IMAGE
 
@@ -3240,6 +3261,10 @@ by the 'track latest' release policy but can be used through release pinning.
 Draft releases can be marked as final through the API. Releases are created
 as final by default unless this option is given.
 
+#### --note NOTE
+
+The notes for this release
+
 #### -e, --emulated
 
 Use QEMU for ARM architecture emulation during the image build
@@ -3248,14 +3273,6 @@ Use QEMU for ARM architecture emulation during the image build
 
 Alternative Dockerfile name/path, relative to the source folder
 
-#### --dockercompose DOCKERCOMPOSE
-
-Alternative docker-compose.yml name in the source root folder
-
-#### --logs
-
-No-op and deprecated since balena CLI v12.0.0. Build logs are now shown by default.
-
 #### --nologs
 
 Hide the image build log output (produce less verbose output)
@@ -3349,7 +3366,7 @@ scan the local network for balenaOS devices and prompt you to select one
 from an interactive picker. This may require administrator/root privileges.
 Likewise, if the fleet option is not provided then a picker will be shown.
 
-Fleets may be specified by fleet name, slug, or numeric ID. Fleet slugs are
+Fleets may be specified by fleet name or slug. Fleet slugs are
 the recommended option, as they are unique and unambiguous. Slugs can be
 listed with the `balena fleets` command. Note that slugs may change if the
 fleet is renamed. Fleet names are not unique and may result in  "Fleet is
@@ -3357,9 +3374,7 @@ ambiguous" errors at any time (even if it "used to work in the past"), for
 example if the name clashes with a newly created public fleet, or with fleets
 from other balena accounts that you may be invited to join under any role.
 For this reason, fleet names are especially discouraged in scripts (e.g. CI
-environments). Numeric fleet IDs are deprecated because they consist of an
-implementation detail of the balena backend. We intend to remove support for
-numeric IDs at some point in the future.
+environments).
 
 Examples:
 
@@ -3380,7 +3395,7 @@ the IP or hostname of device
 
 #### -f, --fleet FLEET
 
-fleet name, slug (preferred), or numeric ID (deprecated)
+fleet name or slug (preferred)
 
 #### -i, --pollInterval POLLINTERVAL
 
@@ -3436,7 +3451,7 @@ or hours, e.g. '12h', '2d'.
 Both --device and --fleet flags accept multiple values, specified as
 a comma-separated list (with no spaces).
 
-Fleets may be specified by fleet name, slug, or numeric ID. Fleet slugs are
+Fleets may be specified by fleet name or slug. Fleet slugs are
 the recommended option, as they are unique and unambiguous. Slugs can be
 listed with the `balena fleets` command. Note that slugs may change if the
 fleet is renamed. Fleet names are not unique and may result in  "Fleet is
@@ -3444,9 +3459,7 @@ ambiguous" errors at any time (even if it "used to work in the past"), for
 example if the name clashes with a newly created public fleet, or with fleets
 from other balena accounts that you may be invited to join under any role.
 For this reason, fleet names are especially discouraged in scripts (e.g. CI
-environments). Numeric fleet IDs are deprecated because they consist of an
-implementation detail of the balena backend. We intend to remove support for
-numeric IDs at some point in the future.
+environments).
 
 Examples:
 

lib/commands/api-key/revoke.ts

@@ -0,0 +1,80 @@
+/**
+ * @license
+ * Copyright 2016-2020 Balena Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import { flags } from '@oclif/command';
+import Command from '../../command';
+import * as cf from '../../utils/common-flags';
+import { getBalenaSdk, stripIndent } from '../../utils/lazy';
+
+interface FlagsDef {
+	help: void;
+}
+
+interface ArgsDef {
+	ids: string;
+}
+
+export default class RevokeCmd extends Command {
+	public static description = stripIndent`
+		Revoke balenaCloud API keys.
+
+		Revoke balenaCloud API keys with the given
+		comma-separated list of ids.
+
+		The given balenaCloud API keys will no longer be usable.
+`;
+	public static examples = [
+		'$ balena api-key revoke 123',
+		'$ balena api-key revoke 123,124,456',
+	];
+
+	public static args = [
+		{
+			name: 'ids',
+			description: 'the API key ids',
+			required: true,
+		},
+	];
+
+	public static usage = 'api-key revoke <ids>';
+
+	public static flags: flags.Input<FlagsDef> = {
+		help: cf.help,
+	};
+
+	public static authenticated = true;
+
+	public async run() {
+		const { args: params } = this.parse<FlagsDef, ArgsDef>(RevokeCmd);
+
+		try {
+			const apiKeyIds = params.ids.split(',');
+			if (apiKeyIds.filter((apiKeyId) => !apiKeyId.match(/^\d+$/)).length > 0) {
+				console.log('API key ids must be positive integers');
+				return;
+			}
+			await Promise.all(
+				apiKeyIds.map(
+					async (id) => await getBalenaSdk().models.apiKey.revoke(Number(id)),
+				),
+			);
+			console.log('Successfully revoked the given API keys');
+		} catch (e) {
+			throw e;
+		}
+	}
+}

lib/commands/api-keys/index.ts

@@ -0,0 +1,95 @@
+/**
+ * @license
+ * Copyright 2016-2020 Balena Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import { flags } from '@oclif/command';
+import Command from '../../command';
+import * as cf from '../../utils/common-flags';
+import { getBalenaSdk, getVisuals, stripIndent } from '../../utils/lazy';
+
+interface FlagsDef {
+	help: void;
+	user?: void;
+	fleet?: string;
+}
+
+export default class ApiKeysCmd extends Command {
+	public static description = stripIndent`
+		Print a list of balenaCloud API keys.
+
+		Print a list of balenaCloud API keys.
+
+		Print a list of balenaCloud API keys for the current user or for a specific fleet with the \`--fleet\` option.
+`;
+	public static examples = ['$ balena api-keys'];
+
+	public static args = [];
+
+	public static usage = 'api-keys';
+
+	public static flags: flags.Input<FlagsDef> = {
+		help: cf.help,
+		user: flags.boolean({
+			char: 'u',
+			description: 'show API keys for your user',
+		}),
+		fleet: cf.fleet,
+	};
+
+	public static authenticated = true;
+
+	public async run() {
+		const { flags: options } = this.parse<FlagsDef, {}>(ApiKeysCmd);
+
+		try {
+			const { getApplication } = await import('../../utils/sdk');
+			const actorId = options.fleet
+				? (
+						await getApplication(getBalenaSdk(), options.fleet, {
+							$select: 'actor',
+						})
+				  ).actor
+				: await getBalenaSdk().auth.getUserActorId();
+			const keys = await getBalenaSdk().pine.get({
+				resource: 'api_key',
+				options: {
+					$select: ['id', 'created_at', 'name', 'description', 'expiry_date'],
+					$filter: {
+						is_of__actor: actorId,
+						...(options.user
+							? {
+									name: {
+										$ne: null,
+									},
+							  }
+							: {}),
+					},
+					$orderby: 'name asc',
+				},
+			});
+			const fields = ['id', 'name', 'created_at', 'description', 'expiry_date'];
+			const _ = await import('lodash');
+			console.log(
+				getVisuals().table.horizontal(
+					keys.map((key) => _.mapValues(key, (val) => val ?? 'N/a')),
+					fields,
+				),
+			);
+		} catch (e) {
+			throw e;
+		}
+	}
+}

lib/commands/app/create.ts

@@ -0,0 +1,87 @@
+/**
+ * @license
+ * Copyright 2016-2021 Balena Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import { flags } from '@oclif/command';
+
+import Command from '../../command';
+import * as cf from '../../utils/common-flags';
+import { stripIndent } from '../../utils/lazy';
+import { ArgsDef, FlagsDef } from '../../utils/application-create';
+
+export default class AppCreateCmd extends Command {
+	public static description = stripIndent`
+		Create an app.
+
+		Create a new balena app.
+
+		You can specify the organization the app should belong to using
+		the \`--organization\` option. The organization's handle, not its name,
+		should be provided. Organization handles can be listed with the
+		\`balena orgs\` command.
+
+		The app's default device type is specified with the \`--type\` option.
+		The \`balena devices supported\` command can be used to list the available
+		device types.
+
+		Interactive dropdowns will be shown for selection if no device type or
+		organization is specified and there are multiple options to choose from.
+		If there is a single option to choose from, it will be chosen automatically.
+		This interactive behavior can be disabled by explicitly specifying a device
+		type and organization.
+	`;
+
+	public static examples = [
+		'$ balena app create MyApp',
+		'$ balena app create MyApp --organization mmyorg',
+		'$ balena app create MyApp -o myorg --type raspberry-pi',
+	];
+
+	public static args = [
+		{
+			name: 'name',
+			description: 'app name',
+			required: true,
+		},
+	];
+
+	public static usage = 'app create <name>';
+
+	public static flags: flags.Input<FlagsDef> = {
+		organization: flags.string({
+			char: 'o',
+			description: 'handle of the organization the app should belong to',
+		}),
+		type: flags.string({
+			char: 't',
+			description:
+				'app device type (Check available types with `balena devices supported`)',
+		}),
+		help: cf.help,
+	};
+
+	public static authenticated = true;
+
+	public async run() {
+		const { args: params, flags: options } = this.parse<FlagsDef, ArgsDef>(
+			AppCreateCmd,
+		);
+
+		await (
+			await import('../../utils/application-create')
+		).applicationCreateBase('app', options, params);
+	}
+}

lib/commands/block/create.ts

@@ -0,0 +1,96 @@
+/**
+ * @license
+ * Copyright 2016-2021 Balena Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import { flags } from '@oclif/command';
+
+import Command from '../../command';
+import * as cf from '../../utils/common-flags';
+import { stripIndent } from '../../utils/lazy';
+
+interface FlagsDef {
+	organization?: string;
+	type?: string; // application device type
+	help: void;
+}
+
+interface ArgsDef {
+	name: string;
+}
+
+export default class BlockCreateCmd extends Command {
+	public static description = stripIndent`
+		Create an block.
+
+		Create a new balena block.
+
+		You can specify the organization the block should belong to using
+		the \`--organization\` option. The organization's handle, not its name,
+		should be provided. Organization handles can be listed with the
+		\`balena orgs\` command.
+
+		The block's default device type is specified with the \`--type\` option.
+		The \`balena devices supported\` command can be used to list the available
+		device types.
+
+		Interactive dropdowns will be shown for selection if no device type or
+		organization is specified and there are multiple options to choose from.
+		If there is a single option to choose from, it will be chosen automatically.
+		This interactive behavior can be disabled by explicitly specifying a device
+		type and organization.
+	`;
+
+	public static examples = [
+		'$ balena block create MyBlock',
+		'$ balena block create MyBlock --organization mmyorg',
+		'$ balena block create MyBlock -o myorg --type raspberry-pi',
+	];
+
+	public static args = [
+		{
+			name: 'name',
+			description: 'block name',
+			required: true,
+		},
+	];
+
+	public static usage = 'block create <name>';
+
+	public static flags: flags.Input<FlagsDef> = {
+		organization: flags.string({
+			char: 'o',
+			description: 'handle of the organization the block should belong to',
+		}),
+		type: flags.string({
+			char: 't',
+			description:
+				'block device type (Check available types with `balena devices supported`)',
+		}),
+		help: cf.help,
+	};
+
+	public static authenticated = true;
+
+	public async run() {
+		const { args: params, flags: options } = this.parse<FlagsDef, ArgsDef>(
+			BlockCreateCmd,
+		);
+
+		await (
+			await import('../../utils/application-create')
+		).applicationCreateBase('block', options, params);
+	}
+}

lib/commands/build.ts

@@ -20,7 +20,7 @@ import Command from '../command';
 import { getBalenaSdk } from '../utils/lazy';
 import * as cf from '../utils/common-flags';
 import * as compose from '../utils/compose';
-import type { Application, ApplicationType, BalenaSDK } from 'balena-sdk';
+import type { ApplicationType, BalenaSDK } from 'balena-sdk';
 import {
 	buildArgDeprecation,
 	dockerignoreHelp,
@@ -208,7 +208,7 @@ ${dockerignoreHelp}
 	 *   buildEmulated
 	 *   buildOpts: arguments to forward to docker build command
 	 *
-	 * @param {DockerToolbelt} docker
+	 * @param {Dockerode} docker
 	 * @param {Logger} logger
 	 * @param {ComposeOpts} composeOpts
 	 * @param opts
@@ -218,7 +218,9 @@ ${dockerignoreHelp}
 		logger: import('../utils/logger'),
 		composeOpts: ComposeOpts,
 		opts: {
-			app?: Application;
+			app?: {
+				application_type: [Pick<ApplicationType, 'supports_multicontainer'>];
+			};
 			arch: string;
 			deviceType: string;
 			buildEmulated: boolean;
@@ -234,7 +236,7 @@ ${dockerignoreHelp}
 			opts.buildOpts.t,
 		);
 
-		const appType = (opts.app?.application_type as ApplicationType[])?.[0];
+		const appType = opts.app?.application_type?.[0];
 		if (
 			appType != null &&
 			project.descriptors.length > 1 &&

lib/commands/config/generate.ts

@@ -19,13 +19,18 @@ import { flags } from '@oclif/command';
 import Command from '../../command';
 import * as cf from '../../utils/common-flags';
 import { getBalenaSdk, getCliForm, stripIndent } from '../../utils/lazy';
-import { applicationIdInfo, devModeInfo } from '../../utils/messages';
-import type { PineDeferred } from 'balena-sdk';
+import {
+	applicationIdInfo,
+	devModeInfo,
+	secureBootInfo,
+} from '../../utils/messages';
+import type { BalenaSDK, PineDeferred } from 'balena-sdk';
 
 interface FlagsDef {
 	version: string; // OS version
 	fleet?: string;
 	dev?: boolean; // balenaOS development variant
+	secureBoot?: boolean;
 	device?: string;
 	deviceApiKey?: string;
 	deviceType?: string;
@@ -37,6 +42,7 @@ interface FlagsDef {
 	wifiKey?: string;
 	appUpdatePollInterval?: string;
 	'provisioning-key-name'?: string;
+	'provisioning-key-expiry-date'?: string;
 	help: void;
 }
 
@@ -50,6 +56,8 @@ export default class ConfigGenerateCmd extends Command {
 
 		${devModeInfo.split('\n').join('\n\t\t')}
 
+		${secureBootInfo.split('\n').join('\n\t\t')}
+
 		To configure an image for a fleet of mixed device types, use the --fleet option
 		alongside the --deviceType option to specify the target device type.
 
@@ -65,6 +73,7 @@ export default class ConfigGenerateCmd extends Command {
 		'$ balena config generate --device 7cf02a6 --version 2.12.7 --deviceApiKey <existingDeviceKey>',
 		'$ balena config generate --device 7cf02a6 --version 2.12.7 --output config.json',
 		'$ balena config generate --fleet myorg/fleet --version 2.12.7 --dev',
+		'$ balena config generate --fleet myorg/fleet --version 2.12.7 --secureBoot',
 		'$ balena config generate --fleet myorg/fleet --version 2.12.7 --deviceType fincm3',
 		'$ balena config generate --fleet myorg/fleet --version 2.12.7 --output config.json',
 		'$ balena config generate --fleet myorg/fleet --version 2.12.7 --network wifi --wifiSsid mySsid --wifiKey abcdefgh --appUpdatePollInterval 15',
@@ -79,9 +88,14 @@ export default class ConfigGenerateCmd extends Command {
 		}),
 		fleet: { ...cf.fleet, exclusive: ['device'] },
 		dev: cf.dev,
+		secureBoot: cf.secureBoot,
 		device: {
 			...cf.device,
-			exclusive: ['fleet', 'provisioning-key-name'],
+			exclusive: [
+				'fleet',
+				'provisioning-key-name',
+				'provisioning-key-expiry-date',
+			],
 		},
 		deviceApiKey: flags.string({
 			description:
@@ -120,31 +134,42 @@ export default class ConfigGenerateCmd extends Command {
 			description: 'custom key name assigned to generated provisioning api key',
 			exclusive: ['device'],
 		}),
+		'provisioning-key-expiry-date': flags.string({
+			description:
+				'expiry date assigned to generated provisioning api key (format: YYYY-MM-DD)',
+			exclusive: ['device'],
+		}),
 		help: cf.help,
 	};
 
 	public static authenticated = true;
 
+	public async getApplication(balena: BalenaSDK, fleet: string) {
+		const { getApplication } = await import('../../utils/sdk');
+		return await getApplication(balena, fleet, {
+			$select: 'slug',
+			$expand: {
+				is_for__device_type: { $select: 'slug' },
+			},
+		});
+	}
+
 	public async run() {
 		const { flags: options } = this.parse<FlagsDef, {}>(ConfigGenerateCmd);
-
-		const { getApplication } = await import('../../utils/sdk');
-
 		const balena = getBalenaSdk();
 
 		await this.validateOptions(options);
 
 		let resourceDeviceType: string;
-		let application: ApplicationWithDeviceType | null = null;
+		let application: Awaited<ReturnType<typeof this.getApplication>> | null =
+			null;
 		let device:
 			| (DeviceWithDeviceType & { belongs_to__application: PineDeferred })
 			| null = null;
 		if (options.device != null) {
-			const { tryAsInteger } = await import('../../utils/validation');
-			const rawDevice = await balena.models.device.get(
-				tryAsInteger(options.device),
-				{ $expand: { is_of__device_type: { $select: 'slug' } } },
-			);
+			const rawDevice = await balena.models.device.get(options.device, {
+				$expand: { is_of__device_type: { $select: 'slug' } },
+			});
 			if (!rawDevice.belongs_to__application) {
 				const { ExpectedError } = await import('../../errors');
 				throw new ExpectedError(stripIndent`
@@ -157,36 +182,40 @@ export default class ConfigGenerateCmd extends Command {
 			resourceDeviceType = device.is_of__device_type[0].slug;
 		} else {
 			// Disambiguate application (if is a number, it could either be an ID or a numerical name)
-			application = (await getApplication(balena, options.fleet!, {
-				$expand: {
-					is_for__device_type: { $select: 'slug' },
-				},
-			})) as ApplicationWithDeviceType;
+			application = await this.getApplication(balena, options.fleet!);
 			resourceDeviceType = application.is_for__device_type[0].slug;
 		}
 
 		const deviceType = options.deviceType || resourceDeviceType;
 
-		const deviceManifest = await balena.models.device.getManifestBySlug(
-			deviceType,
-		);
-
 		// Check compatibility if application and deviceType provided
 		if (options.fleet && options.deviceType) {
-			const appDeviceManifest = await balena.models.device.getManifestBySlug(
-				resourceDeviceType,
-			);
-
 			const helpers = await import('../../utils/helpers');
 			if (
-				!helpers.areDeviceTypesCompatible(appDeviceManifest, deviceManifest)
+				!(await helpers.areDeviceTypesCompatible(
+					resourceDeviceType,
+					deviceType,
+				))
 			) {
-				throw new balena.errors.BalenaInvalidDeviceType(
+				const { ExpectedError } = await import('../../errors');
+				throw new ExpectedError(
 					`Device type ${options.deviceType} is incompatible with fleet ${options.fleet}`,
 				);
 			}
 		}
 
+		const deviceManifest =
+			await balena.models.config.getDeviceTypeManifestBySlug(deviceType);
+
+		const { validateSecureBootOptionAndWarn } = await import(
+			'../../utils/config'
+		);
+		await validateSecureBootOptionAndWarn(
+			options.secureBoot,
+			deviceType,
+			options.version,
+		);
+
 		// Prompt for values
 		// Pass params as an override: if there is any param with exactly the same name as a
 		// required option, that value is used (and the corresponding question is not asked)
@@ -195,7 +224,9 @@ export default class ConfigGenerateCmd extends Command {
 		});
 		answers.version = options.version;
 		answers.developmentMode = options.dev;
+		answers.secureBoot = options.secureBoot;
 		answers.provisioningKeyName = options['provisioning-key-name'];
+		answers.provisioningKeyExpiryDate = options['provisioning-key-expiry-date'];
 
 		// Generate config
 		const { generateDeviceConfig, generateApplicationConfig } = await import(

lib/commands/config/inject.ts

@@ -57,7 +57,6 @@ export default class ConfigInjectCmd extends Command {
 	public static usage = 'config inject <file>';
 
 	public static flags: flags.Input<FlagsDef> = {
-		...cf.deviceTypeIgnored,
 		drive: cf.driveOrImg,
 		help: cf.help,
 	};

lib/commands/config/read.ts

@@ -47,7 +47,6 @@ export default class ConfigReadCmd extends Command {
 	public static usage = 'config read';
 
 	public static flags: flags.Input<FlagsDef> = {
-		...cf.deviceTypeIgnored,
 		drive: cf.driveOrImg,
 		help: cf.help,
 		json: cf.json,

lib/commands/config/reconfigure.ts

@@ -50,7 +50,6 @@ export default class ConfigReconfigureCmd extends Command {
 	public static usage = 'config reconfigure';
 
 	public static flags: flags.Input<FlagsDef> = {
-		...cf.deviceTypeIgnored,
 		drive: cf.driveOrImg,
 		advanced: flags.boolean({
 			description: 'show advanced commands',

lib/commands/config/write.ts

@@ -64,7 +64,6 @@ export default class ConfigWriteCmd extends Command {
 	public static usage = 'config write <key> <value>';
 
 	public static flags: flags.Input<FlagsDef> = {
-		...cf.deviceTypeIgnored,
 		drive: cf.driveOrImg,
 		help: cf.help,
 	};

lib/commands/deploy.ts

@@ -16,7 +16,7 @@
  */
 
 import { flags } from '@oclif/command';
-import type { ImageDescriptor } from 'resin-compose-parse';
+import type { ImageDescriptor } from '@balena/compose/dist/parse';
 
 import Command from '../command';
 import { ExpectedError } from '../errors';
@@ -43,15 +43,13 @@ import {
 	parseReleaseTagKeysAndValues,
 } from '../utils/compose_ts';
 import { dockerCliFlags } from '../utils/docker';
-import type {
-	Application,
-	ApplicationType,
-	DeviceType,
-	Release,
-} from 'balena-sdk';
+import type { ApplicationType, DeviceType, Release } from 'balena-sdk';
 
-interface ApplicationWithArch extends Application {
+interface ApplicationWithArch {
+	id: number;
 	arch: string;
+	is_for__device_type: [Pick<DeviceType, 'slug'>];
+	application_type: [Pick<ApplicationType, 'slug' | 'supports_multicontainer'>];
 }
 
 interface FlagsDef extends ComposeCliFlags, DockerCliFlags {
@@ -60,6 +58,7 @@ interface FlagsDef extends ComposeCliFlags, DockerCliFlags {
 	nologupload: boolean;
 	'release-tag'?: string[];
 	draft: boolean;
+	note?: string;
 	help: void;
 }
 
@@ -101,6 +100,7 @@ ${dockerignoreHelp}
 	public static examples = [
 		'$ balena deploy myFleet',
 		'$ balena deploy myorg/myfleet --build --source myBuildDir/',
+		'$ balena deploy myorg/myfleet --build --source myBuildDir/ --note "this is the note for this release"',
 		'$ balena deploy myorg/myfleet myRepo/myImage',
 		'$ balena deploy myFleet myRepo/myImage --release-tag key1 "" key2 "value2 with spaces"',
 	];
@@ -114,7 +114,7 @@ ${dockerignoreHelp}
 	];
 
 	public static usage = 'deploy <fleet> [image]';
-	// TODO:  docker-compose naming
+
 	public static flags: flags.Input<FlagsDef> = {
 		source: flags.string({
 			description:
@@ -145,6 +145,7 @@ ${dockerignoreHelp}
 				as final by default unless this option is given.`,
 			default: false,
 		}),
+		note: flags.string({ description: 'The notes for this release' }),
 		...composeCliFlags,
 		...dockerCliFlags,
 		// NOTE: Not supporting -h for help, because of clash with -h in DockerCliFlags
@@ -231,6 +232,9 @@ ${dockerignoreHelp}
 			releaseTagKeys,
 			releaseTagValues,
 		);
+		if (options.note) {
+			await sdk.models.release.setNote(release.id, options.note);
+		}
 	}
 
 	async deployProject(
@@ -256,7 +260,7 @@ ${dockerignoreHelp}
 			'../utils/compose_ts'
 		);
 
-		const appType = (opts.app?.application_type as ApplicationType[])?.[0];
+		const appType = opts.app.application_type[0];
 
 		try {
 			const project = await loadProject(
@@ -313,7 +317,7 @@ ${dockerignoreHelp}
 					projectName: project.name,
 					composition: compositionToBuild,
 					arch: opts.app.arch,
-					deviceType: (opts.app?.is_for__device_type as DeviceType[])?.[0].slug,
+					deviceType: opts.app.is_for__device_type[0].slug,
 					emulated: opts.buildEmulated,
 					buildOpts: opts.buildOpts,
 					inlineLogs: composeOpts.inlineLogs,
@@ -334,7 +338,7 @@ ${dockerignoreHelp}
 			);
 
 			let release: Release | ComposeReleaseInfo['release'];
-			if (appType?.is_legacy) {
+			if (appType.slug === 'legacy-v1' || appType.slug === 'legacy-v2') {
 				const { deployLegacy } = require('../utils/deploy-legacy');
 
 				const msg = getChalk().yellow(

lib/commands/device/identify.ts

@@ -20,7 +20,6 @@ import type { IArg } from '@oclif/parser/lib/args';
 import Command from '../../command';
 import * as cf from '../../utils/common-flags';
 import { getBalenaSdk, stripIndent } from '../../utils/lazy';
-import { tryAsInteger } from '../../utils/validation';
 import { ExpectedError } from '../../errors';
 
 interface FlagsDef {
@@ -43,7 +42,6 @@ export default class DeviceIdentifyCmd extends Command {
 		{
 			name: 'uuid',
 			description: 'the uuid of the device to identify',
-			parse: (dev) => tryAsInteger(dev),
 			required: true,
 		},
 	];

lib/commands/device/index.ts

@@ -21,7 +21,6 @@ import Command from '../../command';
 import * as cf from '../../utils/common-flags';
 import { expandForAppName } from '../../utils/helpers';
 import { getBalenaSdk, getVisuals, stripIndent } from '../../utils/lazy';
-import { tryAsInteger } from '../../utils/validation';
 
 import type { Application, Release } from 'balena-sdk';
 
@@ -44,6 +43,7 @@ interface ExtendedDevice extends DeviceWithDeviceType {
 
 interface FlagsDef {
 	help: void;
+	view: boolean;
 }
 
 interface ArgsDef {
@@ -56,13 +56,15 @@ export default class DeviceCmd extends Command {
 
 		Show information about a single device.
 		`;
-	public static examples = ['$ balena device 7cf02a6'];
+	public static examples = [
+		'$ balena device 7cf02a6',
+		'$ balena device 7cf02a6 --view',
+	];
 
 	public static args: Array<IArg<any>> = [
 		{
 			name: 'uuid',
 			description: 'the device uuid',
-			parse: (dev) => tryAsInteger(dev),
 			required: true,
 		},
 	];
@@ -71,13 +73,19 @@ export default class DeviceCmd extends Command {
 
 	public static flags: flags.Input<FlagsDef> = {
 		help: cf.help,
+		view: flags.boolean({
+			default: false,
+			description: 'open device dashboard page',
+		}),
 	};
 
 	public static authenticated = true;
 	public static primary = true;
 
 	public async run() {
-		const { args: params } = this.parse<FlagsDef, ArgsDef>(DeviceCmd);
+		const { args: params, flags: options } = this.parse<FlagsDef, ArgsDef>(
+			DeviceCmd,
+		);
 
 		const balena = getBalenaSdk();
 
@@ -108,6 +116,14 @@ export default class DeviceCmd extends Command {
 			],
 			...expandForAppName,
 		})) as ExtendedDevice;
+
+		if (options.view) {
+			const open = await import('open');
+			const dashboardUrl = balena.models.device.getDashboardUrl(device.uuid);
+			await open(dashboardUrl, { wait: false });
+			return;
+		}
+
 		device.status = device.overall_status;
 
 		device.dashboard_url = balena.models.device.getDashboardUrl(device.uuid);

lib/commands/device/init.ts

@@ -31,6 +31,7 @@ interface FlagsDef {
 	config?: string;
 	help: void;
 	'provisioning-key-name'?: string;
+	'provisioning-key-expiry-date'?: string;
 }
 
 export default class DeviceInitCmd extends Command {
@@ -69,6 +70,7 @@ export default class DeviceInitCmd extends Command {
 	public static examples = [
 		'$ balena device init',
 		'$ balena device init -f myorg/myfleet',
+		'$ balena device init --fleet myFleet --os-version 2.101.7 --drive /dev/disk5 --config config.json --yes',
 		'$ balena device init --fleet myFleet --os-version 2.83.21+rev1.prod --drive /dev/disk5 --config config.json --yes',
 	];
 
@@ -97,6 +99,10 @@ export default class DeviceInitCmd extends Command {
 		'provisioning-key-name': flags.string({
 			description: 'custom key name assigned to generated provisioning api key',
 		}),
+		'provisioning-key-expiry-date': flags.string({
+			description:
+				'expiry date assigned to generated provisioning api key (format: YYYY-MM-DD)',
+		}),
 		help: cf.help,
 	};
 
@@ -118,20 +124,16 @@ export default class DeviceInitCmd extends Command {
 		const balena = getBalenaSdk();
 
 		// Get application and
-		const application = (await getApplication(
-			balena,
-			options.fleet ||
-				(
-					await (await import('../../utils/patterns')).selectApplication()
-				).id,
-			{
-				$expand: {
-					is_for__device_type: {
-						$select: 'slug',
+		const application = options.fleet
+			? await getApplication(balena, options.fleet, {
+					$select: ['id', 'slug'],
+					$expand: {
+						is_for__device_type: {
+							$select: 'slug',
+						},
 					},
-				},
-			},
-		)) as ApplicationWithDeviceType;
+			  })
+			: await (await import('../../utils/patterns')).selectApplication();
 
 		// Register new device
 		const deviceUuid = balena.models.device.generateUniqueKey();
@@ -185,6 +187,14 @@ export default class DeviceInitCmd extends Command {
 				options['provisioning-key-name'],
 			);
 		}
+
+		if (options['provisioning-key-expiry-date']) {
+			configureCommand.push(
+				'--provisioning-key-expiry-date',
+				options['provisioning-key-expiry-date'],
+			);
+		}
+
 		await runCommand(configureCommand);
 	}
 

lib/commands/device/local-mode.ts

@@ -20,7 +20,6 @@ import type { IArg } from '@oclif/parser/lib/args';
 import Command from '../../command';
 import * as cf from '../../utils/common-flags';
 import { getBalenaSdk, stripIndent } from '../../utils/lazy';
-import { tryAsInteger } from '../../utils/validation';
 
 interface FlagsDef {
 	enable: boolean;
@@ -52,7 +51,6 @@ export default class DeviceLocalModeCmd extends Command {
 		{
 			name: 'uuid',
 			description: 'the uuid of the device to manage',
-			parse: (dev) => tryAsInteger(dev),
 			required: true,
 		},
 	];

lib/commands/device/move.ts

@@ -20,7 +20,7 @@ import type { IArg } from '@oclif/parser/lib/args';
 import type {
 	BalenaSDK,
 	Device,
-	DeviceType,
+	PineOptions,
 	PineTypedResult,
 } from 'balena-sdk';
 import Command from '../../command';
@@ -29,13 +29,6 @@ import { ExpectedError } from '../../errors';
 import { getBalenaSdk, stripIndent } from '../../utils/lazy';
 import { applicationIdInfo } from '../../utils/messages';
 
-type ExtendedDevice = PineTypedResult<
-	Device,
-	typeof import('../../utils/helpers').expandForAppNameAndCpuArch
-> & {
-	application_name?: string;
-};
-
 interface FlagsDef {
 	fleet?: string;
 	help: void;
@@ -81,6 +74,33 @@ export default class DeviceMoveCmd extends Command {
 
 	public static authenticated = true;
 
+	private async getDevices(balena: BalenaSDK, deviceUuids: string[]) {
+		const deviceOptions = {
+			$select: 'belongs_to__application',
+			$expand: {
+				is_of__device_type: {
+					$select: 'is_of__cpu_architecture',
+					$expand: {
+						is_of__cpu_architecture: {
+							$select: 'slug',
+						},
+					},
+				},
+			},
+		} satisfies PineOptions<Device>;
+
+		// TODO: Refacor once `device.get()` accepts an array of uuids`
+		const devices = await Promise.all(
+			deviceUuids.map(
+				(uuid) =>
+					balena.models.device.get(uuid, deviceOptions) as Promise<
+						PineTypedResult<Device, typeof deviceOptions>
+					>,
+			),
+		);
+		return devices;
+	}
+
 	public async run() {
 		const { args: params, flags: options } = this.parse<FlagsDef, ArgsDef>(
 			DeviceMoveCmd,
@@ -88,43 +108,21 @@ export default class DeviceMoveCmd extends Command {
 
 		const balena = getBalenaSdk();
 
-		const { tryAsInteger } = await import('../../utils/validation');
-		const { expandForAppNameAndCpuArch } = await import('../../utils/helpers');
+		// Split uuids string into array of uuids
+		const deviceUuids = params.uuid.split(',');
 
-		// Parse ids string into array of correct types
-		const deviceIds: Array<string | number> = params.uuid
-			.split(',')
-			.map((id) => tryAsInteger(id));
+		const devices = await this.getDevices(balena, deviceUuids);
 
-		// Get devices
-		const devices = await Promise.all(
-			deviceIds.map(
-				(uuid) =>
-					balena.models.device.get(
-						uuid,
-						expandForAppNameAndCpuArch,
-					) as Promise<ExtendedDevice>,
-			),
-		);
-
-		// Map application name for each device
-		for (const device of devices) {
-			const belongsToApplication = device.belongs_to__application;
-			device.application_name = belongsToApplication?.[0]
-				? belongsToApplication[0].app_name
-				: 'N/a';
-		}
-
-		// Disambiguate application (if is a number, it could either be an ID or a numerical name)
+		// Disambiguate application
 		const { getApplication } = await import('../../utils/sdk');
 
 		// Get destination application
 		const application = options.fleet
-			? await getApplication(balena, options.fleet)
+			? await getApplication(balena, options.fleet, { $select: ['id', 'slug'] })
 			: await this.interactivelySelectApplication(balena, devices);
 
 		// Move each device
-		for (const uuid of deviceIds) {
+		for (const uuid of deviceUuids) {
 			try {
 				await balena.models.device.move(uuid, application.id);
 				console.info(`Device ${uuid} was moved to fleet ${application.slug}`);
@@ -137,9 +135,8 @@ export default class DeviceMoveCmd extends Command {
 
 	async interactivelySelectApplication(
 		balena: BalenaSDK,
-		devices: ExtendedDevice[],
+		devices: Awaited<ReturnType<typeof this.getDevices>>,
 	) {
-		const { getExpandedProp } = await import('../../utils/pine');
 		// deduplicate the slugs
 		const deviceCpuArchs = Array.from(
 			new Set(
@@ -149,46 +146,44 @@ export default class DeviceMoveCmd extends Command {
 			),
 		);
 
-		const deviceTypeOptions = {
-			$select: 'slug',
-			$expand: {
-				is_of__cpu_architecture: {
-					$select: 'slug',
-				},
+		const allCpuArches = await balena.pine.get({
+			resource: 'cpu_architecture',
+			options: {
+				$select: ['id', 'slug'],
 			},
-		} as const;
-		const deviceTypes = (await balena.models.deviceType.getAllSupported(
-			deviceTypeOptions,
-		)) as Array<PineTypedResult<DeviceType, typeof deviceTypeOptions>>;
+		});
 
-		const compatibleDeviceTypeSlugs = new Set(
-			deviceTypes
-				.filter((deviceType) => {
-					const deviceTypeArch = getExpandedProp(
-						deviceType.is_of__cpu_architecture,
-						'slug',
-					)!;
-					return deviceCpuArchs.every((deviceCpuArch) =>
-						balena.models.os.isArchitectureCompatibleWith(
-							deviceCpuArch,
-							deviceTypeArch,
-						),
-					);
-				})
-				.map((deviceType) => deviceType.slug),
-		);
+		const compatibleCpuArchIds = allCpuArches
+			.filter((cpuArch) => {
+				return deviceCpuArchs.every((deviceCpuArch) =>
+					balena.models.os.isArchitectureCompatibleWith(
+						deviceCpuArch,
+						cpuArch.slug,
+					),
+				);
+			})
+			.map((deviceType) => deviceType.id);
 
 		const patterns = await import('../../utils/patterns');
 		try {
 			const application = await patterns.selectApplication(
-				(app) =>
-					compatibleDeviceTypeSlugs.has(app.is_for__device_type[0].slug) &&
-					devices.some((device) => device.application_name !== app.app_name),
+				{
+					is_for__device_type: {
+						$any: {
+							$alias: 'dt',
+							$expr: {
+								dt: {
+									is_of__cpu_architecture: { $in: compatibleCpuArchIds },
+								},
+							},
+						},
+					},
+				},
 				true,
 			);
 			return application;
 		} catch (err) {
-			if (!compatibleDeviceTypeSlugs.size) {
+			if (!compatibleCpuArchIds.length) {
 				throw new ExpectedError(
 					`${err.message}\nDo all devices have a compatible architecture?`,
 				);

lib/commands/device/os-update.ts

@@ -20,7 +20,6 @@ import type { IArg } from '@oclif/parser/lib/args';
 import Command from '../../command';
 import * as cf from '../../utils/common-flags';
 import { getBalenaSdk, stripIndent, getCliForm } from '../../utils/lazy';
-import { tryAsInteger } from '../../utils/validation';
 import type { Device } from 'balena-sdk';
 import { ExpectedError } from '../../errors';
 
@@ -47,6 +46,7 @@ export default class DeviceOsUpdateCmd extends Command {
 		`;
 	public static examples = [
 		'$ balena device os-update 23c73a1',
+		'$ balena device os-update 23c73a1 --version 2.101.7',
 		'$ balena device os-update 23c73a1 --version 2.31.0+rev1.prod',
 	];
 
@@ -54,7 +54,6 @@ export default class DeviceOsUpdateCmd extends Command {
 		{
 			name: 'uuid',
 			description: 'the uuid of the device to update',
-			parse: (dev) => tryAsInteger(dev),
 			required: true,
 		},
 	];

lib/commands/device/pin.ts

@@ -0,0 +1,103 @@
+/**
+ * @license
+ * Copyright 2016-2020 Balena Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import { flags } from '@oclif/command';
+import type { IArg } from '@oclif/parser/lib/args';
+import Command from '../../command';
+import * as cf from '../../utils/common-flags';
+import { getBalenaSdk, stripIndent } from '../../utils/lazy';
+import { getExpandedProp } from '../../utils/pine';
+
+interface FlagsDef {
+	help: void;
+}
+
+interface ArgsDef {
+	uuid: string;
+	releaseToPinTo?: string;
+}
+
+export default class DevicePinCmd extends Command {
+	public static description = stripIndent`
+		Pin a device to a release.
+
+		Pin a device to a release.
+
+		Note, if the commit is omitted, the currently pinned release will be printed, with instructions for how to see a list of releases
+		`;
+	public static examples = [
+		'$ balena device pin 7cf02a6',
+		'$ balena device pin 7cf02a6 91165e5',
+	];
+
+	public static args: Array<IArg<any>> = [
+		{
+			name: 'uuid',
+			description: 'the uuid of the device to pin to a release',
+			required: true,
+		},
+		{
+			name: 'releaseToPinTo',
+			description: 'the commit of the release for the device to get pinned to',
+		},
+	];
+
+	public static usage = 'device pin <uuid> [releaseToPinTo]';
+
+	public static flags: flags.Input<FlagsDef> = {
+		help: cf.help,
+	};
+
+	public static authenticated = true;
+
+	public async run() {
+		const { args: params } = this.parse<FlagsDef, ArgsDef>(DevicePinCmd);
+
+		const balena = getBalenaSdk();
+
+		const device = await balena.models.device.get(params.uuid, {
+			$expand: {
+				should_be_running__release: {
+					$select: 'commit',
+				},
+				belongs_to__application: {
+					$select: 'slug',
+				},
+			},
+		});
+
+		const pinnedRelease = getExpandedProp(
+			device.should_be_running__release,
+			'commit',
+		);
+		const appSlug = getExpandedProp(device.belongs_to__application, 'slug');
+
+		const releaseToPinTo = params.releaseToPinTo;
+
+		if (!releaseToPinTo) {
+			console.log(
+				`${
+					pinnedRelease
+						? `This device is currently pinned to ${pinnedRelease}.`
+						: 'This device is not currently pinned to any release.'
+				} \n\nTo see a list of all releases this device can be pinned to, run \`balena releases ${appSlug}\`.`,
+			);
+		} else {
+			await balena.models.device.pinToRelease(params.uuid, releaseToPinTo);
+		}
+	}
+}

lib/commands/device/public-url.ts

@@ -21,7 +21,6 @@ import Command from '../../command';
 import { ExpectedError } from '../../errors';
 import * as cf from '../../utils/common-flags';
 import { getBalenaSdk, stripIndent } from '../../utils/lazy';
-import { tryAsInteger } from '../../utils/validation';
 
 interface FlagsDef {
 	enable: boolean;
@@ -32,8 +31,6 @@ interface FlagsDef {
 
 interface ArgsDef {
 	uuid: string;
-	// Optional hidden arg to support old command format
-	legacyUuid?: string;
 }
 
 export default class DevicePublicUrlCmd extends Command {
@@ -43,9 +40,6 @@ export default class DevicePublicUrlCmd extends Command {
 		This command will output the current public URL for the
 		specified device.  It can also enable or disable the URL,
 		or output the enabled status, using the respective options.
-
-		The old command style 'balena device public-url enable <uuid>'
-		is deprecated, but still supported.
 	`;
 
 	public static examples = [
@@ -59,15 +53,8 @@ export default class DevicePublicUrlCmd extends Command {
 		{
 			name: 'uuid',
 			description: 'the uuid of the device to manage',
-			parse: (dev) => tryAsInteger(dev),
 			required: true,
 		},
-		{
-			// Optional hidden arg to support old command format
-			name: 'legacyUuid',
-			parse: (dev) => tryAsInteger(dev),
-			hidden: true,
-		},
 	];
 
 	public static usage = 'device public-url <uuid>';
@@ -95,25 +82,6 @@ export default class DevicePublicUrlCmd extends Command {
 			DevicePublicUrlCmd,
 		);
 
-		// Legacy command format support.
-		// Previously this command used the following format
-		// (changed due to oclif technicalities):
-		//   `balena device public-url enable|disable|status <uuid>`
-		if (params.legacyUuid) {
-			const action = params.uuid;
-			if (!['enable', 'disable', 'status'].includes(action)) {
-				throw new ExpectedError(
-					`Unexpected arguments: ${params.uuid} ${params.legacyUuid}`,
-				);
-			}
-
-			options.enable = action === 'enable';
-			options.disable = action === 'disable';
-			options.status = action === 'status';
-			params.uuid = params.legacyUuid;
-			delete params.legacyUuid;
-		}
-
 		const balena = getBalenaSdk();
 
 		if (options.enable) {

lib/commands/device/purge.ts

@@ -63,17 +63,14 @@ export default class DevicePurgeCmd extends Command {
 	public async run() {
 		const { args: params } = this.parse<FlagsDef, ArgsDef>(DevicePurgeCmd);
 
-		const { tryAsInteger } = await import('../../utils/validation');
 		const balena = getBalenaSdk();
 		const ux = getCliUx();
 
-		const deviceIds = params.uuid.split(',').map((id) => {
-			return tryAsInteger(id);
-		});
+		const deviceUuids = params.uuid.split(',');
 
-		for (const deviceId of deviceIds) {
-			ux.action.start(`Purging data from device ${deviceId}`);
-			await balena.models.device.purge(deviceId);
+		for (const uuid of deviceUuids) {
+			ux.action.start(`Purging data from device ${uuid}`);
+			await balena.models.device.purge(uuid);
 			ux.action.stop();
 		}
 	}

lib/commands/device/reboot.ts

@@ -20,7 +20,6 @@ import type { IArg } from '@oclif/parser/lib/args';
 import Command from '../../command';
 import * as cf from '../../utils/common-flags';
 import { getBalenaSdk, stripIndent } from '../../utils/lazy';
-import { tryAsInteger } from '../../utils/validation';
 
 interface FlagsDef {
 	force: boolean;
@@ -43,7 +42,6 @@ export default class DeviceRebootCmd extends Command {
 		{
 			name: 'uuid',
 			description: 'the uuid of the device to reboot',
-			parse: (dev) => tryAsInteger(dev),
 			required: true,
 		},
 	];

lib/commands/device/register.ts

@@ -25,6 +25,7 @@ import { applicationIdInfo } from '../../utils/messages';
 
 interface FlagsDef {
 	uuid?: string;
+	deviceType?: string;
 	help: void;
 }
 
@@ -47,6 +48,7 @@ export default class DeviceRegisterCmd extends Command {
 		'$ balena device register MyFleet',
 		'$ balena device register MyFleet --uuid <uuid>',
 		'$ balena device register myorg/myfleet --uuid <uuid>',
+		'$ balena device register myorg/myfleet --uuid <uuid> --deviceType <deviceTypeSlug>',
 	];
 
 	public static args: Array<IArg<any>> = [ca.fleetRequired];
@@ -58,6 +60,10 @@ export default class DeviceRegisterCmd extends Command {
 			description: 'custom uuid',
 			char: 'u',
 		}),
+		deviceType: flags.string({
+			description:
+				"device type slug (run 'balena devices supported' for possible values)",
+		}),
 		help: cf.help,
 	};
 
@@ -72,12 +78,18 @@ export default class DeviceRegisterCmd extends Command {
 
 		const balena = getBalenaSdk();
 
-		const application = await getApplication(balena, params.fleet);
+		const application = await getApplication(balena, params.fleet, {
+			$select: ['id', 'slug'],
+		});
 		const uuid = options.uuid ?? balena.models.device.generateUniqueKey();
 
 		console.info(`Registering to ${application.slug}: ${uuid}`);
 
-		const result = await balena.models.device.register(application.id, uuid);
+		const result = await balena.models.device.register(
+			application.id,
+			uuid,
+			options.deviceType,
+		);
 
 		return result && result.uuid;
 	}

lib/commands/device/rename.ts

@@ -20,7 +20,6 @@ import type { IArg } from '@oclif/parser/lib/args';
 import Command from '../../command';
 import * as cf from '../../utils/common-flags';
 import { getBalenaSdk, stripIndent, getCliForm } from '../../utils/lazy';
-import { tryAsInteger } from '../../utils/validation';
 
 interface FlagsDef {
 	help: void;
@@ -48,7 +47,6 @@ export default class DeviceRenameCmd extends Command {
 		{
 			name: 'uuid',
 			description: 'the uuid of the device to rename',
-			parse: (dev) => tryAsInteger(dev),
 			required: true,
 		},
 		{

lib/commands/device/restart.ts

@@ -82,24 +82,21 @@ export default class DeviceRestartCmd extends Command {
 			DeviceRestartCmd,
 		);
 
-		const { tryAsInteger } = await import('../../utils/validation');
 		const balena = getBalenaSdk();
 		const ux = getCliUx();
 
-		const deviceIds = params.uuid.split(',').map((id) => {
-			return tryAsInteger(id);
-		});
+		const deviceUuids = params.uuid.split(',');
 		const serviceNames = options.service?.split(',');
 
-		// Iterate sequentially through deviceIds.
+		// Iterate sequentially through deviceUuids.
 		// We may later want to add a batching feature,
 		// so that n devices are processed in parallel
-		for (const deviceId of deviceIds) {
-			ux.action.start(`Restarting services on device ${deviceId}`);
+		for (const uuid of deviceUuids) {
+			ux.action.start(`Restarting services on device ${uuid}`);
 			if (serviceNames) {
-				await this.restartServices(balena, deviceId, serviceNames);
+				await this.restartServices(balena, uuid, serviceNames);
 			} else {
-				await this.restartAllServices(balena, deviceId);
+				await this.restartAllServices(balena, uuid);
 			}
 			ux.action.stop();
 		}
@@ -107,7 +104,7 @@ export default class DeviceRestartCmd extends Command {
 
 	async restartServices(
 		balena: BalenaSDK,
-		deviceId: number | string,
+		deviceUuid: string,
 		serviceNames: string[],
 	) {
 		const { ExpectedError, instanceOf } = await import('../../errors');
@@ -116,7 +113,7 @@ export default class DeviceRestartCmd extends Command {
 		// Get device
 		let device: DeviceWithServiceDetails<CurrentServiceWithCommit>;
 		try {
-			device = await balena.models.device.getWithServiceDetails(deviceId, {
+			device = await balena.models.device.getWithServiceDetails(deviceUuid, {
 				$expand: {
 					is_running__release: { $select: 'commit' },
 				},
@@ -124,7 +121,7 @@ export default class DeviceRestartCmd extends Command {
 		} catch (e) {
 			const { BalenaDeviceNotFound } = await import('balena-errors');
 			if (instanceOf(e, BalenaDeviceNotFound)) {
-				throw new ExpectedError(`Device ${deviceId} not found.`);
+				throw new ExpectedError(`Device ${deviceUuid} not found.`);
 			} else {
 				throw e;
 			}
@@ -136,7 +133,7 @@ export default class DeviceRestartCmd extends Command {
 		serviceNames.forEach((service) => {
 			if (!device.current_services[service]) {
 				throw new ExpectedError(
-					`Service ${service} not found on device ${deviceId}.`,
+					`Service ${service} not found on device ${deviceUuid}.`,
 				);
 			}
 		});
@@ -155,7 +152,7 @@ export default class DeviceRestartCmd extends Command {
 			if (serviceContainer) {
 				restartPromises.push(
 					balena.models.device.restartService(
-						deviceId,
+						deviceUuid,
 						serviceContainer.image_id,
 					),
 				);
@@ -166,32 +163,32 @@ export default class DeviceRestartCmd extends Command {
 			await Promise.all(restartPromises);
 		} catch (e) {
 			if (e.message.toLowerCase().includes('no online device')) {
-				throw new ExpectedError(`Device ${deviceId} is not online.`);
+				throw new ExpectedError(`Device ${deviceUuid} is not online.`);
 			} else {
 				throw e;
 			}
 		}
 	}
 
-	async restartAllServices(balena: BalenaSDK, deviceId: number | string) {
+	async restartAllServices(balena: BalenaSDK, deviceUuid: string) {
 		// Note: device.restartApplication throws `BalenaDeviceNotFound: Device not found` if device not online.
 		// Need to use device.get first to distinguish between non-existant and offline devices.
 		// Remove this workaround when SDK issue resolved: https://github.com/balena-io/balena-sdk/issues/649
 		const { instanceOf, ExpectedError } = await import('../../errors');
 		try {
-			const device = await balena.models.device.get(deviceId);
+			const device = await balena.models.device.get(deviceUuid);
 			if (!device.is_online) {
-				throw new ExpectedError(`Device ${deviceId} is not online.`);
+				throw new ExpectedError(`Device ${deviceUuid} is not online.`);
 			}
 		} catch (e) {
 			const { BalenaDeviceNotFound } = await import('balena-errors');
 			if (instanceOf(e, BalenaDeviceNotFound)) {
-				throw new ExpectedError(`Device ${deviceId} not found.`);
+				throw new ExpectedError(`Device ${deviceUuid} not found.`);
 			} else {
 				throw e;
 			}
 		}
 
-		await balena.models.device.restartApplication(deviceId);
+		await balena.models.device.restartApplication(deviceUuid);
 	}
 }

lib/commands/device/rm.ts

@@ -20,7 +20,6 @@ import type { IArg } from '@oclif/parser/lib/args';
 import Command from '../../command';
 import * as cf from '../../utils/common-flags';
 import { getBalenaSdk, stripIndent } from '../../utils/lazy';
-import { tryAsInteger } from '../../utils/validation';
 
 interface FlagsDef {
 	yes: boolean;
@@ -84,7 +83,7 @@ export default class DeviceRmCmd extends Command {
 		// Remove
 		for (const uuid of uuids) {
 			try {
-				await balena.models.device.remove(tryAsInteger(uuid));
+				await balena.models.device.remove(uuid);
 			} catch (err) {
 				console.info(`${err.message}, uuid: ${uuid}`);
 				process.exitCode = 1;

lib/commands/device/shutdown.ts

@@ -20,7 +20,6 @@ import type { IArg } from '@oclif/parser/lib/args';
 import Command from '../../command';
 import * as cf from '../../utils/common-flags';
 import { getBalenaSdk, stripIndent } from '../../utils/lazy';
-import { tryAsInteger } from '../../utils/validation';
 import { ExpectedError } from '../../errors';
 
 interface FlagsDef {
@@ -44,7 +43,6 @@ export default class DeviceShutdownCmd extends Command {
 		{
 			name: 'uuid',
 			description: 'the uuid of the device to shutdown',
-			parse: (dev) => tryAsInteger(dev),
 			required: true,
 		},
 	];

lib/commands/device/track-fleet.ts

@@ -0,0 +1,63 @@
+/**
+ * @license
+ * Copyright 2016-2020 Balena Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import { flags } from '@oclif/command';
+import type { IArg } from '@oclif/parser/lib/args';
+import Command from '../../command';
+import * as cf from '../../utils/common-flags';
+import { getBalenaSdk, stripIndent } from '../../utils/lazy';
+
+interface FlagsDef {
+	help: void;
+}
+
+interface ArgsDef {
+	uuid: string;
+}
+
+export default class DeviceTrackFleetCmd extends Command {
+	public static description = stripIndent`
+		Make a device track the fleet's pinned release.
+
+		Make a device track the fleet's pinned release.
+		`;
+	public static examples = ['$ balena device track-fleet 7cf02a6'];
+
+	public static args: Array<IArg<any>> = [
+		{
+			name: 'uuid',
+			description: "the uuid of the device to make track the fleet's release",
+			required: true,
+		},
+	];
+
+	public static usage = 'device track-fleet <uuid>';
+
+	public static flags: flags.Input<FlagsDef> = {
+		help: cf.help,
+	};
+
+	public static authenticated = true;
+
+	public async run() {
+		const { args: params } = this.parse<FlagsDef, ArgsDef>(DeviceTrackFleetCmd);
+
+		const balena = getBalenaSdk();
+
+		await balena.models.device.trackApplicationRelease(params.uuid);
+	}
+}

lib/commands/devices/index.ts

@@ -22,13 +22,7 @@ import { expandForAppName } from '../../utils/helpers';
 import { getBalenaSdk, getVisuals, stripIndent } from '../../utils/lazy';
 import { applicationIdInfo, jsonInfo } from '../../utils/messages';
 
-import type { Application } from 'balena-sdk';
-
-interface ExtendedDevice extends DeviceWithDeviceType {
-	dashboard_url?: string;
-	fleet?: string | null; // 'org/name' slug
-	device_type?: string | null;
-}
+import type { Device, PineOptions } from 'balena-sdk';
 
 interface FlagsDef {
 	fleet?: string;
@@ -36,6 +30,18 @@ interface FlagsDef {
 	json: boolean;
 }
 
+const devicesSelectFields = {
+	$select: [
+		'id',
+		'uuid',
+		'device_name',
+		'status',
+		'is_online',
+		'supervisor_version',
+		'os_version',
+	],
+} satisfies PineOptions<Device>;
+
 export default class DevicesCmd extends Command {
 	public static description = stripIndent`
 		List all devices.
@@ -70,36 +76,39 @@ export default class DevicesCmd extends Command {
 		const { flags: options } = this.parse<FlagsDef, {}>(DevicesCmd);
 
 		const balena = getBalenaSdk();
+		const devicesOptions = {
+			...devicesSelectFields,
+			...expandForAppName,
+			$orderby: { device_name: 'asc' },
+		} satisfies PineOptions<Device>;
 
-		let devices;
+		const devices = (
+			await (async () => {
+				if (options.fleet != null) {
+					const { getApplication } = await import('../../utils/sdk');
+					const application = await getApplication(balena, options.fleet, {
+						$select: 'slug',
+						$expand: {
+							owns__device: devicesOptions,
+						},
+					});
+					return application.owns__device;
+				}
 
-		if (options.fleet != null) {
-			const { getApplication } = await import('../../utils/sdk');
-			const application = await getApplication(balena, options.fleet);
-			devices = (await balena.models.device.getAllByApplication(
-				application.id,
-				expandForAppName,
-			)) as ExtendedDevice[];
-		} else {
-			devices = (await balena.models.device.getAll(
-				expandForAppName,
-			)) as ExtendedDevice[];
-		}
+				return await balena.pine.get({
+					resource: 'device',
+					options: devicesOptions,
+				});
+			})()
+		).map((device) => ({
+			...device,
+			dashboard_url: balena.models.device.getDashboardUrl(device.uuid),
+			fleet: device.belongs_to__application?.[0]?.slug || null,
+			uuid: options.json ? device.uuid : device.uuid.slice(0, 7),
+			device_type: device.is_of__device_type?.[0]?.slug || null,
+		}));
 
-		devices = devices.map(function (device) {
-			device.dashboard_url = balena.models.device.getDashboardUrl(device.uuid);
-
-			const belongsToApplication =
-				device.belongs_to__application as Application[];
-			device.fleet = belongsToApplication?.[0]?.slug || null;
-
-			device.uuid = options.json ? device.uuid : device.uuid.slice(0, 7);
-
-			device.device_type = device.is_of__device_type?.[0]?.slug || null;
-			return device;
-		});
-
-		const fields = [
+		const fields: Array<keyof (typeof devices)[number]> = [
 			'id',
 			'uuid',
 			'device_name',

lib/commands/devices/supported.ts

@@ -15,6 +15,7 @@
  * limitations under the License.
  */
 import { flags } from '@oclif/command';
+import type * as BalenaSdk from 'balena-sdk';
 import * as _ from 'lodash';
 import Command from '../../command';
 
@@ -59,36 +60,38 @@ export default class DevicesSupportedCmd extends Command {
 
 	public async run() {
 		const { flags: options } = this.parse<FlagsDef, {}>(DevicesSupportedCmd);
-		const [dts, configDTs] = await Promise.all([
-			getBalenaSdk().models.deviceType.getAllSupported({
-				$expand: { is_of__cpu_architecture: { $select: 'slug' } },
-				$select: ['slug', 'name'],
-			}),
-			getBalenaSdk().models.config.getDeviceTypes(),
-		]);
-		const dtsBySlug = _.keyBy(dts, (dt) => dt.slug);
-		const configDTsBySlug = _.keyBy(configDTs, (dt) => dt.slug);
+		const pineOptions = {
+			$select: ['slug', 'name'],
+			$expand: {
+				is_of__cpu_architecture: { $select: 'slug' },
+				device_type_alias: {
+					$select: 'is_referenced_by__alias',
+					$orderby: { is_referenced_by__alias: 'asc' },
+				},
+			},
+		} satisfies BalenaSdk.PineOptions<BalenaSdk.DeviceType>;
+		const dts = (await getBalenaSdk().models.deviceType.getAllSupported(
+			pineOptions,
+		)) as Array<
+			BalenaSdk.PineTypedResult<BalenaSdk.DeviceType, typeof pineOptions>
+		>;
 		interface DT {
 			slug: string;
 			aliases: string[];
 			arch: string;
 			name: string;
 		}
-		let deviceTypes: DT[] = [];
-		for (const slug of Object.keys(dtsBySlug)) {
-			const configDT: Partial<typeof configDTs[0]> =
-				configDTsBySlug[slug] || {};
-			const aliases = (configDT.aliases || []).filter(
-				(alias) => alias !== slug,
-			);
-			const dt: Partial<typeof dts[0]> = dtsBySlug[slug] || {};
-			deviceTypes.push({
-				slug,
+		let deviceTypes = dts.map((dt): DT => {
+			const aliases = dt.device_type_alias
+				.map((dta) => dta.is_referenced_by__alias)
+				.filter((alias) => alias !== dt.slug);
+			return {
+				slug: dt.slug,
 				aliases: options.json ? aliases : [aliases.join(', ')],
-				arch: (dt.is_of__cpu_architecture as any)?.[0]?.slug || 'n/a',
+				arch: dt.is_of__cpu_architecture[0]?.slug || 'n/a',
 				name: dt.name || 'N/A',
-			});
-		}
+			};
+		});
 		const fields = ['slug', 'aliases', 'arch', 'name'];
 		deviceTypes = _.sortBy(deviceTypes, fields);
 		if (options.json) {

lib/commands/env/add.ts

@@ -151,16 +151,15 @@ export default class EnvAddCmd extends Command {
 
 		const varType = isConfigVar ? 'configVar' : 'envVar';
 		if (options.fleet) {
-			const { getFleetSlug } = await import('../../utils/sdk');
-			for (const app of options.fleet.split(',')) {
+			for (const appSlug of await resolveFleetSlugs(balena, options.fleet)) {
 				try {
 					await balena.models.application[varType].set(
-						await getFleetSlug(balena, app),
+						appSlug,
 						params.name,
 						params.value,
 					);
 				} catch (err) {
-					console.error(`${err.message}, fleet: ${app}`);
+					console.error(`${err.message}, fleet: ${appSlug}`);
 					process.exitCode = 1;
 				}
 			}
@@ -181,6 +180,25 @@ export default class EnvAddCmd extends Command {
 	}
 }
 
+// TODO: Stop accepting application names in the next major
+// and just drop this in favor of doing the .split(',') directly.
+async function resolveFleetSlugs(
+	balena: BalenaSdk.BalenaSDK,
+	fleetOption: string,
+) {
+	const fleetSlugs: string[] = [];
+	const { getFleetSlug } = await import('../../utils/sdk');
+	for (const appNameOrSlug of fleetOption.split(',')) {
+		try {
+			fleetSlugs.push(await getFleetSlug(balena, appNameOrSlug));
+		} catch (err) {
+			console.error(`${err.message}, fleet: ${appNameOrSlug}`);
+			process.exitCode = 1;
+		}
+	}
+	return fleetSlugs;
+}
+
 /**
  * Add service variables for a device or fleet.
  */
@@ -190,17 +208,17 @@ async function setServiceVars(
 	options: FlagsDef,
 ) {
 	if (options.fleet) {
-		for (const app of options.fleet.split(',')) {
+		for (const appSlug of await resolveFleetSlugs(sdk, options.fleet)) {
 			for (const service of options.service!.split(',')) {
 				try {
-					const serviceId = await getServiceIdForApp(sdk, app, service);
+					const serviceId = await getServiceIdForApp(sdk, appSlug, service);
 					await sdk.models.service.var.set(
 						serviceId,
 						params.name,
 						params.value!,
 					);
 				} catch (err) {
-					console.error(`${err.message}, fleet: ${app}`);
+					console.error(`${err.message}, fleet: ${appSlug}`);
 					process.exitCode = 1;
 				}
 			}
@@ -245,11 +263,11 @@ async function setServiceVars(
  */
 async function getServiceIdForApp(
 	sdk: BalenaSdk.BalenaSDK,
-	appName: string,
+	appSlug: string,
 	serviceName: string,
 ): Promise<number> {
 	let serviceId: number | undefined;
-	const services = await sdk.models.service.getAllByApplication(appName, {
+	const services = await sdk.models.service.getAllByApplication(appSlug, {
 		$filter: { service_name: serviceName },
 	});
 	if (services.length > 0) {
@@ -257,7 +275,7 @@ async function getServiceIdForApp(
 	}
 	if (serviceId === undefined) {
 		throw new ExpectedError(
-			`Cannot find service ${serviceName} for fleet ${appName}`,
+			`Cannot find service ${serviceName} for fleet ${appSlug}`,
 		);
 	}
 	return serviceId;

lib/commands/fleet/create.ts

@@ -16,22 +16,11 @@
  */
 
 import { flags } from '@oclif/command';
-import type { Application } from 'balena-sdk';
 
 import Command from '../../command';
-import { ExpectedError } from '../../errors';
 import * as cf from '../../utils/common-flags';
-import { getBalenaSdk, stripIndent } from '../../utils/lazy';
-
-interface FlagsDef {
-	organization?: string;
-	type?: string; // application device type
-	help: void;
-}
-
-interface ArgsDef {
-	name: string;
-}
+import { stripIndent } from '../../utils/lazy';
+import { ArgsDef, FlagsDef } from '../../utils/application-create';
 
 export default class FleetCreateCmd extends Command {
 	public static description = stripIndent`
@@ -91,59 +80,8 @@ export default class FleetCreateCmd extends Command {
 			FleetCreateCmd,
 		);
 
-		// Ascertain device type
-		const deviceType =
-			options.type ||
-			(await (await import('../../utils/patterns')).selectDeviceType());
-
-		// Ascertain organization
-		const organization =
-			options.organization?.toLowerCase() || (await this.getOrganization());
-
-		// Create application
-		let application: Application;
-		try {
-			application = await getBalenaSdk().models.application.create({
-				name: params.name,
-				deviceType,
-				organization,
-			});
-		} catch (err) {
-			if ((err.message || '').toLowerCase().includes('unique')) {
-				// BalenaRequestError: Request error: "organization" and "app_name" must be unique.
-				throw new ExpectedError(
-					`Error: fleet "${params.name}" already exists in organization "${organization}".`,
-				);
-			} else if ((err.message || '').toLowerCase().includes('unauthorized')) {
-				// BalenaRequestError: Request error: Unauthorized
-				throw new ExpectedError(
-					`Error: You are not authorized to create fleets in organization "${organization}".`,
-				);
-			}
-
-			throw err;
-		}
-
-		// Output
-		console.log(
-			`Fleet created: slug "${application.slug}", device type "${deviceType}"`,
-		);
-	}
-
-	async getOrganization() {
-		const { getOwnOrganizations } = await import('../../utils/sdk');
-		const organizations = await getOwnOrganizations(getBalenaSdk());
-
-		if (organizations.length === 0) {
-			// User is not a member of any organizations (should not happen).
-			throw new Error('This account is not a member of any organizations');
-		} else if (organizations.length === 1) {
-			// User is a member of only one organization - use this.
-			return organizations[0].handle;
-		} else {
-			// User is a member of multiple organizations -
-			const { selectOrganization } = await import('../../utils/patterns');
-			return selectOrganization(organizations);
-		}
+		await (
+			await import('../../utils/application-create')
+		).applicationCreateBase('fleet', options, params);
 	}
 }

lib/commands/fleet/index.ts

@@ -15,19 +15,19 @@
  * limitations under the License.
  */
 
-import type { flags } from '@oclif/command';
-import type { Release } from 'balena-sdk';
+import type { flags as flagsType } from '@oclif/command';
+import { flags } from '@oclif/command';
 
 import Command from '../../command';
 import * as cf from '../../utils/common-flags';
 import * as ca from '../../utils/common-args';
-import { getBalenaSdk, getVisuals, stripIndent } from '../../utils/lazy';
+import { getBalenaSdk, stripIndent } from '../../utils/lazy';
 import { applicationIdInfo } from '../../utils/messages';
-import { isV14 } from '../../utils/version';
 import type { DataOutputOptions } from '../../framework';
 
 interface FlagsDef extends DataOutputOptions {
 	help: void;
+	view: boolean;
 }
 
 interface ArgsDef {
@@ -45,15 +45,20 @@ export default class FleetCmd extends Command {
 	public static examples = [
 		'$ balena fleet MyFleet',
 		'$ balena fleet myorg/myfleet',
+		'$ balena fleet myorg/myfleet --view',
 	];
 
 	public static args = [ca.fleetRequired];
 
 	public static usage = 'fleet <fleet>';
 
-	public static flags: flags.Input<FlagsDef> = {
+	public static flags: flagsType.Input<FlagsDef> = {
 		help: cf.help,
-		...(isV14() ? cf.dataOutputFlags : {}),
+		view: flags.boolean({
+			default: false,
+			description: 'open fleet dashboard page',
+		}),
+		...cf.dataOutputFlags,
 	};
 
 	public static authenticated = true;
@@ -66,38 +71,34 @@ export default class FleetCmd extends Command {
 
 		const { getApplication } = await import('../../utils/sdk');
 
-		const application = (await getApplication(getBalenaSdk(), params.fleet, {
+		const balena = getBalenaSdk();
+
+		const application = await getApplication(balena, params.fleet, {
 			$expand: {
 				is_for__device_type: { $select: 'slug' },
 				should_be_running__release: { $select: 'commit' },
 			},
-		})) as ApplicationWithDeviceType & {
-			should_be_running__release: [Release?];
-			// For display purposes:
-			device_type: string;
-			commit?: string;
+		});
+
+		if (options.view) {
+			const open = await import('open');
+			const dashboardUrl = balena.models.application.getDashboardUrl(
+				application.id,
+			);
+			await open(dashboardUrl, { wait: false });
+			return;
+		}
+
+		const outputApplication = {
+			...application,
+			device_type: application.is_for__device_type[0].slug,
+			commit: application.should_be_running__release[0]?.commit,
 		};
 
-		application.device_type = application.is_for__device_type[0].slug;
-		application.commit = application.should_be_running__release[0]?.commit;
-
-		if (isV14()) {
-			await this.outputData(
-				application,
-				['app_name', 'id', 'device_type', 'slug', 'commit'],
-				options,
-			);
-		} else {
-			// Emulate table.vertical title output, but avoid uppercasing and inserting spaces
-			console.log(`== ${application.slug}`);
-			console.log(
-				getVisuals().table.vertical(application, [
-					'id',
-					'device_type',
-					'slug',
-					'commit',
-				]),
-			);
-		}
+		await this.outputData(
+			outputApplication,
+			['app_name', 'id', 'device_type', 'slug', 'commit'],
+			options,
+		);
 	}
 }

lib/commands/fleet/pin.ts

@@ -0,0 +1,100 @@
+/**
+ * @license
+ * Copyright 2016-2020 Balena Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import { flags } from '@oclif/command';
+import type { IArg } from '@oclif/parser/lib/args';
+import Command from '../../command';
+import * as cf from '../../utils/common-flags';
+import { getBalenaSdk, stripIndent } from '../../utils/lazy';
+import { getExpandedProp } from '../../utils/pine';
+
+interface FlagsDef {
+	help: void;
+}
+
+interface ArgsDef {
+	slug: string;
+	releaseToPinTo?: string;
+}
+
+export default class FleetPinCmd extends Command {
+	public static description = stripIndent`
+		Pin a fleet to a release.
+
+		Pin a fleet to a release.
+
+		Note, if the commit is omitted, the currently pinned release will be printed, with instructions for how to see a list of releases
+		`;
+	public static examples = [
+		'$ balena fleet pin myfleet',
+		'$ balena fleet pin myorg/myfleet 91165e5',
+	];
+
+	public static args: Array<IArg<any>> = [
+		{
+			name: 'slug',
+			description: 'the slug of the fleet to pin to a release',
+			required: true,
+		},
+		{
+			name: 'releaseToPinTo',
+			description: 'the commit of the release for the fleet to get pinned to',
+		},
+	];
+
+	public static usage = 'fleet pin <slug> [releaseToPinTo]';
+
+	public static flags: flags.Input<FlagsDef> = {
+		help: cf.help,
+	};
+
+	public static authenticated = true;
+
+	public async run() {
+		const { args: params } = this.parse<FlagsDef, ArgsDef>(FleetPinCmd);
+
+		const balena = getBalenaSdk();
+
+		const fleet = await balena.models.application.get(params.slug, {
+			$expand: {
+				should_be_running__release: {
+					$select: 'commit',
+				},
+			},
+		});
+
+		const pinnedRelease = getExpandedProp(
+			fleet.should_be_running__release,
+			'commit',
+		);
+
+		const releaseToPinTo = params.releaseToPinTo;
+		const slug = params.slug;
+
+		if (!releaseToPinTo) {
+			console.log(
+				`${
+					pinnedRelease
+						? `This fleet is currently pinned to ${pinnedRelease}.`
+						: 'This fleet is not currently pinned to any release.'
+				} \n\nTo see a list of all releases this fleet can be pinned to, run \`balena releases ${slug}\`.`,
+			);
+		} else {
+			await balena.models.application.pinToRelease(slug, releaseToPinTo);
+		}
+	}
+}

lib/commands/fleet/purge.ts

@@ -65,7 +65,9 @@ export default class FleetPurgeCmd extends Command {
 
 		// balena.models.application.purge only accepts a numeric id
 		// so we must first fetch the app to get it's id,
-		const application = await getApplication(balena, params.fleet);
+		const application = await getApplication(balena, params.fleet, {
+			$select: 'id',
+		});
 
 		try {
 			await balena.models.application.purge(application.id);

lib/commands/fleet/rename.ts

@@ -16,7 +16,6 @@
  */
 
 import type { flags } from '@oclif/command';
-import type { ApplicationType } from 'balena-sdk';
 
 import Command from '../../command';
 import * as cf from '../../utils/common-flags';
@@ -78,9 +77,10 @@ export default class FleetRenameCmd extends Command {
 		// Disambiguate target application (if params.params is a number, it could either be an ID or a numerical name)
 		const { getApplication } = await import('../../utils/sdk');
 		const application = await getApplication(balena, params.fleet, {
+			$select: ['id', 'app_name', 'slug'],
 			$expand: {
 				application_type: {
-					$select: ['is_legacy'],
+					$select: 'slug',
 				},
 			},
 		});
@@ -91,8 +91,8 @@ export default class FleetRenameCmd extends Command {
 		}
 
 		// Check app supports renaming
-		const appType = (application.application_type as ApplicationType[])?.[0];
-		if (appType.is_legacy) {
+		const appType = application.application_type[0];
+		if (appType.slug === 'legacy-v1' || appType.slug === 'legacy-v2') {
 			throw new ExpectedError(
 				`Fleet ${params.fleet} is of 'legacy' type, and cannot be renamed.`,
 			);
@@ -133,9 +133,9 @@ export default class FleetRenameCmd extends Command {
 		}
 
 		// Get application again, to be sure of results
-		const renamedApplication = await balena.models.application.get(
-			application.id,
-		);
+		const renamedApplication = await getApplication(balena, application.id, {
+			$select: ['app_name', 'slug'],
+		});
 
 		// Output result
 		console.log(`Fleet renamed`);

lib/commands/fleet/restart.ts

@@ -62,9 +62,11 @@ export default class FleetRestartCmd extends Command {
 
 		const balena = getBalenaSdk();
 
-		// Disambiguate application (if is a number, it could either be an ID or a numerical name)
-		const application = await getApplication(balena, params.fleet);
+		// Disambiguate application
+		const application = await getApplication(balena, params.fleet, {
+			$select: 'slug',
+		});
 
-		await balena.models.application.restart(application.id);
+		await balena.models.application.restart(application.slug);
 	}
 }

lib/commands/fleet/rm.ts

@@ -76,9 +76,11 @@ export default class FleetRmCmd extends Command {
 		);
 
 		// Disambiguate application (if is a number, it could either be an ID or a numerical name)
-		const application = await getApplication(balena, params.fleet);
+		const application = await getApplication(balena, params.fleet, {
+			$select: 'slug',
+		});
 
 		// Remove
-		await balena.models.application.remove(application.id);
+		await balena.models.application.remove(application.slug);
 	}
 }

lib/commands/fleet/track-latest.ts

@@ -0,0 +1,66 @@
+/**
+ * @license
+ * Copyright 2016-2020 Balena Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import { flags } from '@oclif/command';
+import type { IArg } from '@oclif/parser/lib/args';
+import Command from '../../command';
+import * as cf from '../../utils/common-flags';
+import { getBalenaSdk, stripIndent } from '../../utils/lazy';
+
+interface FlagsDef {
+	help: void;
+}
+
+interface ArgsDef {
+	slug: string;
+}
+
+export default class FleetTrackLatestCmd extends Command {
+	public static description = stripIndent`
+		Make this fleet track the latest release.
+
+		Make this fleet track the latest release.
+		`;
+	public static examples = [
+		'$ balena fleet track-latest myorg/myfleet',
+		'$ balena fleet track-latest myfleet',
+	];
+
+	public static args: Array<IArg<any>> = [
+		{
+			name: 'slug',
+			description: 'the slug of the fleet to make track the latest release',
+			required: true,
+		},
+	];
+
+	public static usage = 'fleet track-latest <slug>';
+
+	public static flags: flags.Input<FlagsDef> = {
+		help: cf.help,
+	};
+
+	public static authenticated = true;
+
+	public async run() {
+		const { args: params } = this.parse<FlagsDef, ArgsDef>(FleetTrackLatestCmd);
+
+		const balena = getBalenaSdk();
+
+		await balena.models.application.trackLatestRelease(params.slug);
+	}
+}

lib/commands/fleets.ts

@@ -15,15 +15,15 @@
  * limitations under the License.
  */
 
+import type * as BalenaSdk from 'balena-sdk';
 import { flags } from '@oclif/command';
 
 import Command from '../command';
 import * as cf from '../utils/common-flags';
-import { getBalenaSdk, getVisuals, stripIndent } from '../utils/lazy';
-import { isV14 } from '../utils/version';
+import { getBalenaSdk, stripIndent } from '../utils/lazy';
 import type { DataSetOutputOptions } from '../framework';
 
-interface ExtendedApplication extends ApplicationWithDeviceType {
+interface ExtendedApplication extends ApplicationWithDeviceTypeSlug {
 	device_count: number;
 	online_devices: number;
 	device_type?: string;
@@ -49,7 +49,7 @@ export default class FleetsCmd extends Command {
 	public static usage = 'fleets';
 
 	public static flags: flags.Input<FlagsDef> = {
-		...(isV14() ? cf.dataSetOutputFlags : {}),
+		...cf.dataSetOutputFlags,
 		help: cf.help,
 	};
 
@@ -61,15 +61,20 @@ export default class FleetsCmd extends Command {
 
 		const balena = getBalenaSdk();
 
+		const pineOptions = {
+			$select: ['id', 'app_name', 'slug'],
+			$expand: {
+				is_for__device_type: { $select: 'slug' },
+				owns__device: { $select: 'is_online' },
+			},
+		} satisfies BalenaSdk.PineOptions<BalenaSdk.Application>;
 		// Get applications
 		const applications =
-			(await balena.models.application.getAllDirectlyAccessible({
-				$select: ['id', 'app_name', 'slug'],
-				$expand: {
-					is_for__device_type: { $select: 'slug' },
-					owns__device: { $select: 'is_online' },
-				},
-			})) as ExtendedApplication[];
+			(await balena.models.application.getAllDirectlyAccessible(
+				pineOptions,
+			)) as Array<
+				BalenaSdk.PineTypedResult<BalenaSdk.Application, typeof pineOptions>
+			> as ExtendedApplication[];
 
 		// Add extended properties
 		applications.forEach((application) => {
@@ -79,30 +84,17 @@ export default class FleetsCmd extends Command {
 			application.device_type = application.is_for__device_type[0].slug;
 		});
 
-		if (isV14()) {
-			await this.outputData(
-				applications,
-				[
-					'id',
-					'app_name',
-					'slug',
-					'device_type',
-					'device_count',
-					'online_devices',
-				],
-				options,
-			);
-		} else {
-			console.log(
-				getVisuals().table.horizontal(applications, [
-					'id',
-					'app_name => NAME',
-					'slug',
-					'device_type',
-					'online_devices',
-					'device_count',
-				]),
-			);
-		}
+		await this.outputData(
+			applications,
+			[
+				'id',
+				'app_name',
+				'slug',
+				'device_type',
+				'device_count',
+				'online_devices',
+			],
+			options,
+		);
 	}
 }

lib/commands/note.ts

@@ -88,6 +88,6 @@ export default class NoteCmd extends Command {
 
 		const balena = getBalenaSdk();
 
-		return balena.models.device.note(options.device!, params.note);
+		return balena.models.device.setNote(options.device, params.note);
 	}
 }

lib/commands/orgs.ts

@@ -46,7 +46,9 @@ export default class OrgsCmd extends Command {
 		const { getOwnOrganizations } = await import('../utils/sdk');
 
 		// Get organizations
-		const organizations = await getOwnOrganizations(getBalenaSdk());
+		const organizations = await getOwnOrganizations(getBalenaSdk(), {
+			$select: ['name', 'handle'],
+		});
 
 		// Display
 		console.log(

lib/commands/os/configure.ts

@@ -23,7 +23,11 @@ import Command from '../../command';
 import { ExpectedError } from '../../errors';
 import * as cf from '../../utils/common-flags';
 import { getBalenaSdk, stripIndent, getCliForm } from '../../utils/lazy';
-import { applicationIdInfo, devModeInfo } from '../../utils/messages';
+import {
+	applicationIdInfo,
+	devModeInfo,
+	secureBootInfo,
+} from '../../utils/messages';
 
 const CONNECTIONS_FOLDER = '/system-connections';
 
@@ -36,6 +40,7 @@ interface FlagsDef {
 	'config-wifi-key'?: string;
 	'config-wifi-ssid'?: string;
 	dev?: boolean; // balenaOS development variant
+	secureBoot?: boolean;
 	device?: string; // device UUID
 	'device-type'?: string;
 	help?: void;
@@ -43,6 +48,7 @@ interface FlagsDef {
 	'system-connection': string[];
 	'initial-device-name'?: string;
 	'provisioning-key-name'?: string;
+	'provisioning-key-expiry-date'?: string;
 }
 
 interface ArgsDef {
@@ -52,12 +58,14 @@ interface ArgsDef {
 interface Answers {
 	appUpdatePollInterval: number; // in minutes
 	developmentMode?: boolean; // balenaOS development variant
+	secureBoot?: boolean;
 	deviceType: string; // e.g. "raspberrypi3"
 	network: 'ethernet' | 'wifi';
 	version: string; // e.g. "2.32.0+rev1"
 	wifiSsid?: string;
 	wifiKey?: string;
 	provisioningKeyName?: string;
+	provisioningKeyExpiryDate?: string;
 }
 
 export default class OsConfigureCmd extends Command {
@@ -78,6 +86,8 @@ export default class OsConfigureCmd extends Command {
 
 		${devModeInfo.split('\n').join('\n\t\t')}
 
+		${secureBootInfo.split('\n').join('\n\t\t')}
+
 		The --system-connection (-c) option is used to inject NetworkManager connection
 		profiles for additional network interfaces, such as cellular/GSM or additional
 		WiFi or ethernet connections. This option may be passed multiple times in case there
@@ -121,7 +131,7 @@ export default class OsConfigureCmd extends Command {
 		config: flags.string({
 			description:
 				'path to a pre-generated config.json file to be injected in the OS image',
-			exclusive: ['provisioning-key-name'],
+			exclusive: ['provisioning-key-name', 'provisioning-key-expiry-date'],
 		}),
 		'config-app-update-poll-interval': flags.integer({
 			description:
@@ -138,7 +148,15 @@ export default class OsConfigureCmd extends Command {
 			description: 'WiFi SSID (network name) (non-interactive configuration)',
 		}),
 		dev: cf.dev,
-		device: { ...cf.device, exclusive: ['fleet', 'provisioning-key-name'] },
+		secureBoot: cf.secureBoot,
+		device: {
+			...cf.device,
+			exclusive: [
+				'fleet',
+				'provisioning-key-name',
+				'provisioning-key-expiry-date',
+			],
+		},
 		'device-type': flags.string({
 			description:
 				'device type slug (e.g. "raspberrypi3") to override the fleet device type',
@@ -161,6 +179,11 @@ export default class OsConfigureCmd extends Command {
 			description: 'custom key name assigned to generated provisioning api key',
 			exclusive: ['config', 'device'],
 		}),
+		'provisioning-key-expiry-date': flags.string({
+			description:
+				'expiry date assigned to generated provisioning api key (format: YYYY-MM-DD)',
+			exclusive: ['config', 'device'],
+		}),
 		help: cf.help,
 	};
 
@@ -181,7 +204,7 @@ export default class OsConfigureCmd extends Command {
 		const helpers = await import('../../utils/helpers');
 		const { getApplication } = await import('../../utils/sdk');
 
-		let app: ApplicationWithDeviceType | undefined;
+		let app: ApplicationWithDeviceTypeSlug | undefined;
 		let device;
 		let deviceTypeSlug: string;
 
@@ -200,8 +223,8 @@ export default class OsConfigureCmd extends Command {
 				$expand: {
 					is_for__device_type: { $select: 'slug' },
 				},
-			})) as ApplicationWithDeviceType;
-			await checkDeviceTypeCompatibility(balena, options, app);
+			})) as ApplicationWithDeviceTypeSlug;
+			await checkDeviceTypeCompatibility(options, app);
 			deviceTypeSlug =
 				options['device-type'] || app.is_for__device_type[0].slug;
 		}
@@ -224,6 +247,15 @@ export default class OsConfigureCmd extends Command {
 		const { validateDevOptionAndWarn } = await import('../../utils/config');
 		await validateDevOptionAndWarn(options.dev, osVersion);
 
+		const { validateSecureBootOptionAndWarn } = await import(
+			'../../utils/config'
+		);
+		await validateSecureBootOptionAndWarn(
+			options.secureBoot,
+			deviceTypeSlug,
+			osVersion,
+		);
+
 		const answers: Answers = await askQuestionsForDeviceType(
 			deviceTypeManifest,
 			options,
@@ -234,7 +266,9 @@ export default class OsConfigureCmd extends Command {
 		}
 		answers.version = osVersion;
 		answers.developmentMode = options.dev;
+		answers.secureBoot = options.secureBoot;
 		answers.provisioningKeyName = options['provisioning-key-name'];
+		answers.provisioningKeyExpiryDate = options['provisioning-key-expiry-date'];
 
 		if (_.isEmpty(configJson)) {
 			if (device) {
@@ -346,17 +380,19 @@ async function getOsVersionFromImage(
  * @param app Balena SDK Application model object
  */
 async function checkDeviceTypeCompatibility(
-	sdk: BalenaSdk.BalenaSDK,
 	options: FlagsDef,
-	app: ApplicationWithDeviceType,
+	app: {
+		is_for__device_type: [Pick<BalenaSdk.DeviceType, 'slug'>];
+	},
 ) {
 	if (options['device-type']) {
-		const [appDeviceType, optionDeviceType] = await Promise.all([
-			sdk.models.device.getManifestBySlug(app.is_for__device_type[0].slug),
-			sdk.models.device.getManifestBySlug(options['device-type']),
-		]);
 		const helpers = await import('../../utils/helpers');
-		if (!helpers.areDeviceTypesCompatible(appDeviceType, optionDeviceType)) {
+		if (
+			!(await helpers.areDeviceTypesCompatible(
+				app.is_for__device_type[0].slug,
+				options['device-type'],
+			))
+		) {
 			throw new ExpectedError(
 				`Device type ${options['device-type']} is incompatible with fleet ${options.fleet}`,
 			);

lib/commands/os/download.ts

@@ -53,9 +53,11 @@ export default class OsDownloadCmd extends Command {
 `;
 	public static examples = [
 		'$ balena os download raspberrypi3 -o ../foo/bar/raspberry-pi.img',
+		'$ balena os download raspberrypi3 -o ../foo/bar/raspberry-pi.img --version 2.101.7',
+		'$ balena os download raspberrypi3 -o ../foo/bar/raspberry-pi.img --version 2022.7.0',
+		'$ balena os download raspberrypi3 -o ../foo/bar/raspberry-pi.img --version ^2.90.0',
 		'$ balena os download raspberrypi3 -o ../foo/bar/raspberry-pi.img --version 2.60.1+rev1',
 		'$ balena os download raspberrypi3 -o ../foo/bar/raspberry-pi.img --version 2.60.1+rev1.dev',
-		'$ balena os download raspberrypi3 -o ../foo/bar/raspberry-pi.img --version ^2.60.0',
 		'$ balena os download raspberrypi3 -o ../foo/bar/raspberry-pi.img --version 2021.10.2.prod',
 		'$ balena os download raspberrypi3 -o ../foo/bar/raspberry-pi.img --version latest',
 		'$ balena os download raspberrypi3 -o ../foo/bar/raspberry-pi.img --version default',

lib/commands/os/initialize.ts

@@ -42,7 +42,9 @@ export default class OsInitializeCmd extends Command {
 		Initialize an os image for a device.
 
 		Initialize an os image for a device with a previously
-		configured operating system image.
+		configured operating system image and flash the
+		an external storage drive or the device's storage
+		medium depending on the device type.
 		${INIT_WARNING_MESSAGE}
 	`;
 

lib/commands/preload.ts

@@ -31,7 +31,14 @@ import { parseAsInteger } from '../utils/validation';
 
 import { flags } from '@oclif/command';
 import * as _ from 'lodash';
-import type { Application, BalenaSDK, PineExpand, Release } from 'balena-sdk';
+import type {
+	Application,
+	BalenaSDK,
+	PineExpand,
+	PineOptions,
+	PineTypedResult,
+	Release,
+} from 'balena-sdk';
 import type { Preloader } from 'balena-preload';
 
 interface FlagsDef extends DockerConnectionCliFlags {
@@ -39,7 +46,7 @@ interface FlagsDef extends DockerConnectionCliFlags {
 	commit?: string;
 	'splash-image'?: string;
 	'dont-check-arch': boolean;
-	'pin-device-to-release': boolean;
+	'pin-device-to-release'?: boolean;
 	'additional-space'?: number;
 	'add-certificate'?: string[];
 	help: void;
@@ -115,7 +122,7 @@ https://github.com/balena-io-examples/staged-releases\
 				'disable architecture compatibility check between image and fleet',
 		}),
 		'pin-device-to-release': flags.boolean({
-			default: false,
+			allowNo: true,
 			description:
 				'pin the preloaded device to the preloaded release on provision',
 			char: 'p',
@@ -187,7 +194,7 @@ Can be repeated to add multiple certificates.\
 			: undefined;
 
 		const progressBars: {
-			[key: string]: ReturnType<typeof getVisuals>['Progress'];
+			[key: string]: InstanceType<ReturnType<typeof getVisuals>['Progress']>;
 		} = {};
 
 		const progressHandler = function (event: {
@@ -201,7 +208,7 @@ Can be repeated to add multiple certificates.\
 		};
 
 		const spinners: {
-			[key: string]: ReturnType<typeof getVisuals>['Spinner'];
+			[key: string]: InstanceType<ReturnType<typeof getVisuals>['Spinner']>;
 		} = {};
 
 		const spinnerHandler = function (event: { name: string; action: string }) {
@@ -223,7 +230,7 @@ Can be repeated to add multiple certificates.\
 		const splashImage = options['splash-image'];
 		const additionalSpace = options['additional-space'];
 		const dontCheckArch = options['dont-check-arch'] || false;
-		const pinDevice = options['pin-device-to-release'] || false;
+		const pinDevice = options['pin-device-to-release'];
 
 		if (dontCheckArch && !fleetSlug) {
 			throw new ExpectedError(
@@ -242,7 +249,7 @@ Can be repeated to add multiple certificates.\
 		const dockerUtils = await import('../utils/docker');
 		const docker = await dockerUtils.getDocker(options);
 		const preloader = new balenaPreload.Preloader(
-			null,
+			undefined,
 			docker,
 			fleetSlug,
 			commit,
@@ -250,7 +257,7 @@ Can be repeated to add multiple certificates.\
 			splashImage,
 			undefined, // TODO: Currently always undefined, investigate approach in ssh command.
 			dontCheckArch,
-			pinDevice,
+			pinDevice ?? false,
 			certificates,
 			additionalSpace,
 		);
@@ -288,7 +295,7 @@ Can be repeated to add multiple certificates.\
 				preloader.on('error', reject);
 				resolve(
 					this.prepareAndPreload(preloader, balena, {
-						appId: fleetSlug,
+						slug: fleetSlug,
 						commit,
 						pinDevice,
 					}),
@@ -308,7 +315,7 @@ Can be repeated to add multiple certificates.\
 		}
 	}
 
-	readonly applicationExpandOptions: PineExpand<Application> = {
+	readonly applicationExpandOptions = {
 		owns__release: {
 			$select: ['id', 'commit', 'end_timestamp', 'composition'],
 			$expand: {
@@ -329,7 +336,7 @@ Can be repeated to add multiple certificates.\
 		should_be_running__release: {
 			$select: 'commit',
 		},
-	};
+	} satisfies PineExpand<Application>;
 
 	isCurrentCommit(commit: string) {
 		return commit === 'latest' || commit === 'current';
@@ -343,7 +350,7 @@ Can be repeated to add multiple certificates.\
 		} catch {
 			throw new Error(`Device type "${deviceTypeSlug}" not found in API query`);
 		}
-		return (await balena.models.application.getAllDirectlyAccessible({
+		const options = {
 			$select: ['id', 'slug', 'should_track_latest_release'],
 			$expand: this.applicationExpandOptions,
 			$filter: {
@@ -388,11 +395,10 @@ Can be repeated to add multiple certificates.\
 				},
 			},
 			$orderby: 'slug asc',
-		})) as Array<
-			ApplicationWithDeviceType & {
-				should_be_running__release: [Release?];
-			}
-		>;
+		} satisfies PineOptions<Application>;
+		return (await balena.models.application.getAllDirectlyAccessible(
+			options,
+		)) as Array<PineTypedResult<Application, typeof options>>;
 	}
 
 	async selectApplication(deviceTypeSlug: string) {
@@ -442,16 +448,16 @@ Can be repeated to add multiple certificates.\
 	}
 
 	async offerToDisableAutomaticUpdates(
-		application: Application,
+		application: Pick<Application, 'id' | 'should_track_latest_release'>,
 		commit: string,
-		pinDevice: boolean,
+		pinDevice: boolean | undefined,
 	) {
 		const balena = getBalenaSdk();
 
 		if (
 			this.isCurrentCommit(commit) ||
 			!application.should_track_latest_release ||
-			pinDevice
+			pinDevice != null
 		) {
 			return;
 		}
@@ -470,8 +476,9 @@ through the web dashboard or programatically through the balena API / SDK.
 Documentation about release policies and pinning can be found at:
 https://www.balena.io/docs/learn/deploy/release-strategy/release-policy/
 
-Alternatively, the --pin-device-to-release flag may be used to pin only the
-preloaded device to the selected release.
+Alternatively, the --pin-device-to-release or --no-pin-device-to-release flags may be used
+to avoid this interactive confirmation and pin only the preloaded device to the selected release
+or keep it unpinned respectively.
 
 Would you like to disable automatic updates for this fleet now?\
 `;
@@ -491,28 +498,28 @@ Would you like to disable automatic updates for this fleet now?\
 		});
 	}
 
-	async getAppWithReleases(balenaSdk: BalenaSDK, appId: string) {
+	async getAppWithReleases(balenaSdk: BalenaSDK, slug: string) {
 		const { getApplication } = await import('../utils/sdk');
 
-		return (await getApplication(balenaSdk, appId, {
+		return await getApplication(balenaSdk, slug, {
 			$expand: this.applicationExpandOptions,
-		})) as Application & { should_be_running__release: [Release?] };
+		});
 	}
 
 	async prepareAndPreload(
 		preloader: Preloader,
 		balenaSdk: BalenaSDK,
 		options: {
-			appId?: string;
+			slug?: string;
 			commit?: string;
-			pinDevice: boolean;
+			pinDevice?: boolean;
 		},
 	) {
 		await preloader.prepare();
 
-		const application = options.appId
-			? await this.getAppWithReleases(balenaSdk, options.appId)
-			: await this.selectApplication(preloader.config.deviceType);
+		const application = options.slug
+			? await this.getAppWithReleases(balenaSdk, options.slug)
+			: await this.selectApplication(preloader.config!.deviceType);
 
 		let commit: string; // commit hash or the strings 'latest' or 'current'
 
@@ -523,7 +530,7 @@ Would you like to disable automatic updates for this fleet now?\
 			if (this.isCurrentCommit(options.commit)) {
 				if (!appCommit) {
 					throw new Error(
-						`Unexpected empty commit hash for fleet ID "${application.id}"`,
+						`Unexpected empty commit hash for fleet slug "${application.slug}"`,
 					);
 				}
 				// handle `--commit current` (and its `--commit latest` synonym)

lib/commands/push.ts

@@ -22,7 +22,7 @@ import { getBalenaSdk, stripIndent } from '../utils/lazy';
 import { dockerignoreHelp, registrySecretsHelp } from '../utils/messages';
 import type { BalenaSDK } from 'balena-sdk';
 import { ExpectedError, instanceOf } from '../errors';
-import { RegistrySecrets } from 'resin-multibuild';
+import { RegistrySecrets } from '@balena/compose/dist/multibuild';
 import { lowercaseIfSlug } from '../utils/normalization';
 import {
 	applyReleaseTagKeysAndValues,
@@ -55,6 +55,7 @@ interface FlagsDef {
 	'multi-dockerignore': boolean;
 	'release-tag'?: string[];
 	draft: boolean;
+	note?: string;
 	help: void;
 }
 
@@ -97,6 +98,7 @@ export default class PushCmd extends Command {
 		'$ balena push myFleet',
 		'$ balena push myFleet --source <source directory>',
 		'$ balena push myFleet -s <source directory>',
+		'$ balena push myFleet --source <source directory> --note "this is the note for this release"',
 		'$ balena push myFleet --release-tag key1 "" key2 "value2 with spaces"',
 		'$ balena push myorg/myfleet',
 		'',
@@ -138,7 +140,6 @@ export default class PushCmd extends Command {
 			char: 'e',
 			default: false,
 		}),
-		// TODO:  docker-compose naming
 		dockerfile: flags.string({
 			description:
 				'Alternative Dockerfile name/path, relative to the source folder',
@@ -177,7 +178,7 @@ export default class PushCmd extends Command {
 			description: stripIndent`
 				Don't run a live session on this push. The filesystem will not be monitored,
 				and changes will not be synchronized to any running containers. Note that both
-				this flag and --detached and required to cause the process to end once the
+				this flag and --detached are required to cause the process to end once the
 				initial build has completed.`,
 			default: false,
 		}),
@@ -242,6 +243,7 @@ export default class PushCmd extends Command {
 				as final by default unless this option is given.`,
 			default: false,
 		}),
+		note: flags.string({ description: 'The notes for this release' }),
 		help: cf.help,
 	};
 
@@ -326,7 +328,7 @@ export default class PushCmd extends Command {
 		]);
 
 		const application = await getApplication(sdk, appNameOrSlug, {
-			$select: ['app_name', 'slug'],
+			$select: 'slug',
 		});
 
 		const opts = {
@@ -355,6 +357,9 @@ export default class PushCmd extends Command {
 				releaseTagKeys,
 				releaseTagValues,
 			);
+			if (options.note) {
+				await sdk.models.release.setNote(releaseId, options.note);
+			}
 		} else if (releaseTagKeys.length > 0) {
 			throw new Error(stripIndent`
 				A release ID could not be parsed out of the builder's output.

lib/commands/release/invalidate.ts

@@ -0,0 +1,83 @@
+/**
+ * @license
+ * Copyright 2016-2020 Balena Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import { flags } from '@oclif/command';
+import Command from '../../command';
+import * as cf from '../../utils/common-flags';
+import { getBalenaSdk, stripIndent } from '../../utils/lazy';
+import { tryAsInteger } from '../../utils/validation';
+
+interface FlagsDef {
+	help: void;
+}
+
+interface ArgsDef {
+	commitOrId: string | number;
+}
+
+export default class ReleaseInvalidateCmd extends Command {
+	public static description = stripIndent`
+		Invalidate a release.
+
+		Invalidate a release.
+
+		Invalid releases are not automatically deployed to devices tracking the latest
+		release. For an invalid release to be deployed to a device, the device should be
+		explicity pinned to that release.
+`;
+	public static examples = [
+		'$ balena release invalidate a777f7345fe3d655c1c981aa642e5555',
+		'$ balena release invalidate 1234567',
+	];
+
+	public static usage = 'release invalidate <commitOrId>';
+
+	public static flags: flags.Input<FlagsDef> = {
+		help: cf.help,
+	};
+
+	public static args = [
+		{
+			name: 'commitOrId',
+			description: 'the commit or ID of the release to invalidate',
+			required: true,
+			parse: (commitOrId: string) => tryAsInteger(commitOrId),
+		},
+	];
+
+	public static authenticated = true;
+
+	public async run() {
+		const { args: params } = this.parse<FlagsDef, ArgsDef>(
+			ReleaseInvalidateCmd,
+		);
+
+		const balena = getBalenaSdk();
+
+		const release = await balena.models.release.get(params.commitOrId, {
+			$select: ['id', 'is_invalidated'],
+		});
+
+		if (release.is_invalidated) {
+			console.log(`Release ${params.commitOrId} is already invalidated!`);
+			return;
+		}
+
+		await balena.models.release.setIsInvalidated(release.id, true);
+		console.log(`Release ${params.commitOrId} invalidated`);
+	}
+}

lib/commands/release/validate.ts

@@ -0,0 +1,80 @@
+/**
+ * @license
+ * Copyright 2016-2020 Balena Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import { flags } from '@oclif/command';
+import Command from '../../command';
+import * as cf from '../../utils/common-flags';
+import { getBalenaSdk, stripIndent } from '../../utils/lazy';
+import { tryAsInteger } from '../../utils/validation';
+
+interface FlagsDef {
+	help: void;
+}
+
+interface ArgsDef {
+	commitOrId: string | number;
+}
+
+export default class ReleaseValidateCmd extends Command {
+	public static description = stripIndent`
+		Validate a release.
+
+		Validate a release.
+
+		Valid releases are automatically deployed to devices tracking the latest
+		release if they are finalized.
+`;
+	public static examples = [
+		'$ balena release validate a777f7345fe3d655c1c981aa642e5555',
+		'$ balena release validate 1234567',
+	];
+
+	public static usage = 'release validate <commitOrId>';
+
+	public static flags: flags.Input<FlagsDef> = {
+		help: cf.help,
+	};
+
+	public static args = [
+		{
+			name: 'commitOrId',
+			description: 'the commit or ID of the release to validate',
+			required: true,
+			parse: (commitOrId: string) => tryAsInteger(commitOrId),
+		},
+	];
+
+	public static authenticated = true;
+
+	public async run() {
+		const { args: params } = this.parse<FlagsDef, ArgsDef>(ReleaseValidateCmd);
+
+		const balena = getBalenaSdk();
+
+		const release = await balena.models.release.get(params.commitOrId, {
+			$select: ['id', 'is_invalidated'],
+		});
+
+		if (!release.is_invalidated) {
+			console.log(`Release ${params.commitOrId} is already validated!`);
+			return;
+		}
+
+		await balena.models.release.setIsInvalidated(release.id, false);
+		console.log(`Release ${params.commitOrId} validated`);
+	}
+}

lib/commands/scan.ts

@@ -16,7 +16,6 @@
  */
 
 import { flags } from '@oclif/command';
-import type { LocalBalenaOsDevice } from 'balena-sync';
 import Command from '../command';
 import * as cf from '../utils/common-flags';
 import { getCliUx, stripIndent } from '../utils/lazy';
@@ -72,7 +71,7 @@ export default class ScanCmd extends Command {
 
 	public async run() {
 		const _ = await import('lodash');
-		const { discover } = await import('balena-sync');
+		const { discoverLocalBalenaOsDevices } = await import('../utils/discover');
 		const prettyjson = await import('prettyjson');
 		const dockerUtils = await import('../utils/docker');
 
@@ -88,8 +87,7 @@ export default class ScanCmd extends Command {
 		const ux = getCliUx();
 		ux.action.start('Scanning for local balenaOS devices');
 
-		const localDevices: LocalBalenaOsDevice[] =
-			await discover.discoverLocalBalenaOsDevices(discoverTimeout);
+		const localDevices = await discoverLocalBalenaOsDevices(discoverTimeout);
 		const engineReachableDevices: boolean[] = await Promise.all(
 			localDevices.map(async ({ address }: { address: string }) => {
 				const docker = await dockerUtils.createClient({
@@ -106,7 +104,7 @@ export default class ScanCmd extends Command {
 			}),
 		);
 
-		const developmentDevices: LocalBalenaOsDevice[] = localDevices.filter(
+		const developmentDevices = localDevices.filter(
 			(_localDevice, index) => engineReachableDevices[index],
 		);
 
@@ -116,18 +114,15 @@ export default class ScanCmd extends Command {
 			_.isEqual,
 		);
 
-		const productionDevicesInfo = _.map(
-			productionDevices,
-			(device: LocalBalenaOsDevice) => {
-				return {
-					host: device.host,
-					address: device.address,
-					osVariant: 'production',
-					dockerInfo: undefined,
-					dockerVersion: undefined,
-				};
-			},
-		);
+		const productionDevicesInfo = productionDevices.map((device) => {
+			return {
+				host: device.host,
+				address: device.address,
+				osVariant: 'production',
+				dockerInfo: undefined,
+				dockerVersion: undefined,
+			};
+		});
 
 		// Query devices for info
 		const devicesInfo = await Promise.all(

lib/commands/ssh.ts

@@ -76,8 +76,7 @@ export default class SshCmd extends Command {
 	public static args = [
 		{
 			name: 'fleetOrDevice',
-			description:
-				'fleet name/slug/id, device uuid, or address of local device',
+			description: 'fleet name/slug, device uuid, or address of local device',
 			required: true,
 		},
 		{

lib/commands/support.ts

@@ -149,7 +149,7 @@ export default class SupportCmd extends Command {
 			console.log(
 				`Access has been granted for ${duration}, expiring ${new Date(
 					expiryTs,
-				).toLocaleString()}`,
+				).toISOString()}`,
 			);
 		}
 	}

lib/commands/tag/rm.ts

@@ -90,8 +90,6 @@ export default class TagRmCmd extends Command {
 			throw new ExpectedError(TagRmCmd.missingResourceMessage);
 		}
 
-		const { tryAsInteger } = await import('../../utils/validation');
-
 		if (options.fleet) {
 			const { getFleetSlug } = await import('../../utils/sdk');
 			return balena.models.application.tags.remove(
@@ -100,10 +98,7 @@ export default class TagRmCmd extends Command {
 			);
 		}
 		if (options.device) {
-			return balena.models.device.tags.remove(
-				tryAsInteger(options.device),
-				params.tagKey,
-			);
+			return balena.models.device.tags.remove(options.device, params.tagKey);
 		}
 		if (options.release) {
 			const { disambiguateReleaseParam } = await import(

lib/commands/tag/set.ts

@@ -105,8 +105,6 @@ export default class TagSetCmd extends Command {
 
 		params.value ??= '';
 
-		const { tryAsInteger } = await import('../../utils/validation');
-
 		if (options.fleet) {
 			const { getFleetSlug } = await import('../../utils/sdk');
 			return balena.models.application.tags.set(
@@ -117,7 +115,7 @@ export default class TagSetCmd extends Command {
 		}
 		if (options.device) {
 			return balena.models.device.tags.set(
-				tryAsInteger(options.device),
+				options.device,
 				params.tagKey,
 				params.value,
 			);

lib/commands/tags.ts

@@ -76,8 +76,6 @@ export default class TagsCmd extends Command {
 			throw new ExpectedError(this.missingResourceMessage);
 		}
 
-		const { tryAsInteger } = await import('../utils/validation');
-
 		let tags;
 
 		if (options.fleet) {
@@ -87,9 +85,7 @@ export default class TagsCmd extends Command {
 			);
 		}
 		if (options.device) {
-			tags = await balena.models.device.tags.getAllByDevice(
-				tryAsInteger(options.device),
-			);
+			tags = await balena.models.device.tags.getAllByDevice(options.device);
 		}
 		if (options.release) {
 			const { disambiguateReleaseParam } = await import(

lib/commands/tunnel.ts

@@ -82,7 +82,7 @@ export default class TunnelCmd extends Command {
 	public static args = [
 		{
 			name: 'deviceOrFleet',
-			description: 'device UUID or fleet name/slug/ID',
+			description: 'device UUID or fleet name/slug',
 			required: true,
 			parse: lowercaseIfSlug,
 		},
@@ -153,19 +153,19 @@ export default class TunnelCmd extends Command {
 						try {
 							await handler(client);
 							logConnection(
-								client.remoteAddress || '',
-								client.remotePort || 0,
-								client.localAddress,
-								client.localPort,
+								client.remoteAddress ?? '',
+								client.remotePort ?? 0,
+								client.localAddress ?? '',
+								client.localPort ?? 0,
 								uuid,
 								remotePort,
 							);
 						} catch (err) {
 							logConnection(
-								client.remoteAddress || '',
-								client.remotePort || 0,
-								client.localAddress,
-								client.localPort,
+								client.remoteAddress ?? '',
+								client.remotePort ?? 0,
+								client.localAddress ?? '',
+								client.localPort ?? 0,
 								uuid,
 								remotePort,
 								err,

lib/deprecation.ts

@@ -86,7 +86,7 @@ export class DeprecationChecker {
 	 * @param version Semver without 'v' prefix, e.g. '12.0.0.'
 	 */
 	protected getNpmUrl(version: string) {
-		return `http://registry.npmjs.org/balena-cli/${version}`;
+		return `https://registry.npmjs.org/balena-cli/${version}`;
 	}
 
 	/**

lib/errors.ts

@@ -177,7 +177,16 @@ const messages: {
 		Looks like the session token has expired.
 		Try logging in again with the "balena login" command.`,
 
-	BalenaInvalidDeviceType: (error: Error & { deviceTypeSlug?: string }) => {
+	BalenaInvalidDeviceType: (
+		error: Error & { deviceTypeSlug?: string; type?: string },
+	) => {
+		// TODO: The SDK should be throwing a different Error for this case.
+		if (
+			typeof error.type === 'string' &&
+			error.type.startsWith('Incompatible ')
+		) {
+			return error.type;
+		}
 		const slug = error.deviceTypeSlug ? `"${error.deviceTypeSlug}"` : 'slug';
 		return stripIndent`
 			Device type ${slug} not recognized. Perhaps misspelled?

lib/events.ts

@@ -24,7 +24,7 @@ import { stripIndent } from './utils/lazy';
  * @param commandSignature A string like, for example:
  *      "push <fleetOrDevice>"
  * That's literally so: "fleetOrDevice" is NOT replaced with the actual
- * fleet ID or device ID. The purpose is to find out the most / least
+ * fleet slug or device uuid. The purpose is to find out the most / least
  * used command verbs, so we can focus our development effort where it is most
  * beneficial to end users.
  *
@@ -73,38 +73,52 @@ export async function trackCommand(commandSignature: string) {
 	}
 }
 
+const TIMEOUT = 4000;
+
 /**
  * Make the event tracking HTTPS request to balenaCloud's '/mixpanel' endpoint.
  */
 async function sendEvent(balenaUrl: string, event: string, username?: string) {
 	const { default: got } = await import('got');
 	const trackData = {
-		event,
-		properties: {
-			arch: process.arch,
-			balenaUrl, // e.g. 'balena-cloud.com' or 'balena-staging.com'
-			distinct_id: username,
-			mp_lib: 'node',
-			node: process.version,
-			platform: process.platform,
-			token: 'balena-main',
-			version: packageJSON.version,
-		},
-	};
-	const url = `https://api.${balenaUrl}/mixpanel/track`;
-	const searchParams = {
-		ip: 0,
-		verbose: 0,
-		data: Buffer.from(JSON.stringify(trackData)).toString('base64'),
+		api_key: 'balena-main',
+		events: [
+			{
+				event_type: event,
+				user_id: username,
+				version_name: packageJSON.version,
+				event_properties: {
+					balenaUrl, // e.g. 'balena-cloud.com' or 'balena-staging.com'
+					arch: process.arch,
+					platform: process.platform,
+					node: process.version,
+				},
+			},
+		],
 	};
+	const url = `https://data.${balenaUrl}/amplitude/2/httpapi`;
+
 	try {
-		await got(url, { searchParams, retry: 0, timeout: 4000 });
+		await got.post(url, {
+			json: trackData,
+			retry: 0,
+			timeout: {
+				// Starts when the request is initiated.
+				request: TIMEOUT,
+				// Starts when request has been flushed.
+				// Exits the request as soon as it's sent.
+				response: 0,
+			},
+		});
 	} catch (e) {
 		if (process.env.DEBUG) {
 			console.error(`[debug] Event tracking error: ${e.message || e}`);
 		}
 
-		if (e instanceof got.TimeoutError) {
+		if (
+			e instanceof got.TimeoutError &&
+			TIMEOUT < (e.timings.phases.total ?? 0)
+		) {
 			console.error(stripIndent`
 				Timeout submitting analytics event to balenaCloud/openBalena.
 				If you are using the balena CLI in an air-gapped environment with a filtered

lib/help.ts

@@ -91,7 +91,7 @@ export default class BalenaHelp extends Help {
 			.map((pc) => {
 				return commands.find((c) => c.id === pc.replace(' ', ':'));
 			})
-			.filter((c): c is typeof commands[0] => !!c);
+			.filter((c): c is (typeof commands)[0] => !!c);
 
 		let usageLength = 0;
 		for (const cmd of primaryCommands) {

lib/utils/application-create.ts

@@ -0,0 +1,58 @@
+import { ExpectedError } from '../errors';
+import { getBalenaSdk } from './lazy';
+
+export interface FlagsDef {
+	organization?: string;
+	type?: string; // application device type
+	help: void;
+}
+
+export interface ArgsDef {
+	name: string;
+}
+
+export async function applicationCreateBase(
+	resource: 'fleet' | 'app' | 'block',
+	options: FlagsDef,
+	params: ArgsDef,
+) {
+	// Ascertain device type
+	const deviceType =
+		options.type || (await (await import('./patterns')).selectDeviceType());
+
+	// Ascertain organization
+	const organization =
+		options.organization?.toLowerCase() ||
+		(await (await import('./patterns')).getAndSelectOrganization());
+
+	// Create application
+	try {
+		const application = await getBalenaSdk().models.application.create({
+			name: params.name,
+			deviceType,
+			organization,
+		});
+
+		// Output
+		const { capitalize } = await import('lodash');
+		console.log(
+			`${capitalize(resource)} created: slug "${
+				application.slug
+			}", device type "${deviceType}"`,
+		);
+	} catch (err) {
+		if ((err.message || '').toLowerCase().includes('unique')) {
+			// BalenaRequestError: Request error: "organization" and "app_name" must be unique.
+			throw new ExpectedError(
+				`Error: An app or block or fleet with the name "${params.name}" already exists in organization "${organization}".`,
+			);
+		} else if ((err.message || '').toLowerCase().includes('unauthorized')) {
+			// BalenaRequestError: Request error: Unauthorized
+			throw new ExpectedError(
+				`Error: You are not authorized to create ${resource}s in organization "${organization}".`,
+			);
+		}
+
+		throw err;
+	}
+}

lib/utils/cloud.ts

@@ -107,16 +107,6 @@ export const getDeviceAndMaybeAppFromUUID = _.memoize(
 	(_sdk, deviceUUID) => deviceUUID,
 );
 
-/** Given a device type alias like 'nuc', return the actual slug like 'intel-nuc'. */
-export const unaliasDeviceType = _.memoize(async function (
-	sdk: SDK.BalenaSDK,
-	deviceType: string,
-): Promise<string> {
-	return (
-		(await sdk.models.device.getManifestBySlug(deviceType)).slug || deviceType
-	);
-});
-
 /**
  * Download balenaOS image for the specified `deviceType`.
  * `OSVersion` may be one of:
@@ -255,8 +245,8 @@ export async function getOsVersions(
 	);
 	// if slug is an alias, fetch the real slug
 	if (!versions.length) {
-		// unaliasDeviceType() produces a nice error msg if slug is invalid
-		slug = await unaliasDeviceType(sdk, slug);
+		// unalias device type slug
+		slug = (await sdk.models.deviceType.get(slug, { $select: 'slug' })).slug;
 		if (slug !== deviceType) {
 			versions = await sdk.models.os.getAvailableOsVersions(slug);
 		}

lib/utils/common-args.ts

@@ -18,7 +18,7 @@ import { lowercaseIfSlug } from './normalization';
 
 export const fleetRequired = {
 	name: 'fleet',
-	description: 'fleet name, slug (preferred), or numeric ID (deprecated)',
+	description: 'fleet name or slug (preferred)',
 	required: true,
 	parse: lowercaseIfSlug,
 };

lib/utils/common-flags.ts

@@ -19,13 +19,12 @@ import { flags } from '@oclif/command';
 import { stripIndent } from './lazy';
 import { lowercaseIfSlug } from './normalization';
 
-import { isV14 } from './version';
 import type { IBooleanFlag } from '@oclif/parser/lib/flags';
 import type { DataOutputOptions, DataSetOutputOptions } from '../framework';
 
 export const fleet = flags.string({
 	char: 'f',
-	description: 'fleet name, slug (preferred), or numeric ID (deprecated)',
+	description: 'fleet name or slug (preferred)',
 	parse: lowercaseIfSlug,
 });
 
@@ -75,6 +74,12 @@ export const dev: IBooleanFlag<boolean> = flags.boolean({
 	default: false,
 });
 
+export const secureBoot: IBooleanFlag<boolean> = flags.boolean({
+	description:
+		'Configure balenaOS installer to opt-in secure boot and disk encryption',
+	default: false,
+});
+
 export const drive = flags.string({
 	char: 'd',
 	description: stripIndent`
@@ -97,19 +102,6 @@ export const deviceType = flags.string({
 	required: true,
 });
 
-export const deviceTypeIgnored = {
-	...(isV14()
-		? {}
-		: {
-				type: flags.string({
-					description: 'ignored - no longer required',
-					char: 't',
-					required: false,
-					hidden: true,
-				}),
-		  }),
-};
-
 export const json: IBooleanFlag<boolean> = flags.boolean({
 	char: 'j',
 	description: 'produce JSON output instead of tabular output',

lib/utils/compose-types.d.ts

@@ -15,8 +15,11 @@
  * limitations under the License.
  */
 
-import type { ImageModel, ReleaseModel } from 'balena-release/build/models';
-import type { Composition, ImageDescriptor } from 'resin-compose-parse';
+import type {
+	ImageModel,
+	ReleaseModel,
+} from '@balena/compose/dist/release/models';
+import type { Composition, ImageDescriptor } from '@balena/compose/dist/parse';
 import type { Pack } from 'tar-stream';
 
 interface Image {
@@ -39,7 +42,7 @@ export interface BuiltImage {
 
 export interface TaggedImage {
 	localImage: import('dockerode').Image;
-	serviceImage: import('balena-release/build/models').ImageModel;
+	serviceImage: import('@balena/compose/dist/release/models').ImageModel;
 	serviceName: string;
 	logs: string;
 	props: BuiltImage.props;
@@ -61,8 +64,6 @@ export interface ComposeOpts {
 export interface ComposeCliFlags {
 	emulated: boolean;
 	dockerfile?: string;
-	dockercompose?: string;
-	logs: boolean;
 	nologs: boolean;
 	'multi-dockerignore': boolean;
 	'noparent-check': boolean;
@@ -79,7 +80,9 @@ export interface ComposeProject {
 }
 
 export interface Release {
-	client: ReturnType<typeof import('balena-release').createClient>;
+	client: ReturnType<
+		typeof import('@balena/compose/dist/release').createClient
+	>;
 	release: Pick<
 		ReleaseModel,
 		| 'id'

lib/utils/compose.ts

@@ -19,7 +19,7 @@ import type { Renderer } from './compose_ts';
 import type * as SDK from 'balena-sdk';
 import type Dockerode = require('dockerode');
 import * as path from 'path';
-import type { Composition, ImageDescriptor } from 'resin-compose-parse';
+import type { Composition, ImageDescriptor } from '@balena/compose/dist/parse';
 import type {
 	BuiltImage,
 	ComposeOpts,
@@ -64,7 +64,7 @@ export function createProject(
 ): ComposeProject {
 	const yml = require('js-yaml') as typeof import('js-yaml');
 	const compose =
-		require('resin-compose-parse') as typeof import('resin-compose-parse');
+		require('@balena/compose/dist/parse') as typeof import('@balena/compose/dist/parse');
 
 	// both methods below may throw.
 	const rawComposition = yml.load(composeStr);
@@ -107,7 +107,7 @@ export const createRelease = async function (
 	const _ = require('lodash') as typeof import('lodash');
 	const crypto = require('crypto') as typeof import('crypto');
 	const releaseMod =
-		require('balena-release') as typeof import('balena-release');
+		require('@balena/compose/dist/release') as typeof import('@balena/compose/dist/release');
 
 	const client = releaseMod.createClient({ apiEndpoint, auth });
 
@@ -214,7 +214,7 @@ export const getPreviousRepos = (
 					image: [SDK.Image];
 				}>;
 				const { getRegistryAndName } =
-					require('resin-multibuild') as typeof import('resin-multibuild');
+					require('@balena/compose/dist/multibuild') as typeof import('@balena/compose/dist/multibuild');
 				return Promise.all(
 					images.map(function (d) {
 						const imageName = d.image[0].is_stored_at__image_location || '';

lib/utils/compose_ts.ts

@@ -16,7 +16,7 @@
  */
 import { flags } from '@oclif/command';
 import { BalenaSDK } from 'balena-sdk';
-import type { TransposeOptions } from 'docker-qemu-transpose';
+import type { TransposeOptions } from '@balena/compose/dist/emulate';
 import type * as Dockerode from 'dockerode';
 import { promises as fs } from 'fs';
 import jsyaml = require('js-yaml');
@@ -26,8 +26,8 @@ import type {
 	BuildConfig,
 	Composition,
 	ImageDescriptor,
-} from 'resin-compose-parse';
-import type * as MultiBuild from 'resin-multibuild';
+} from '@balena/compose/dist/parse';
+import type * as MultiBuild from '@balena/compose/dist/multibuild';
 import * as semver from 'semver';
 import type { Duplex, Readable } from 'stream';
 import type { Pack } from 'tar-stream';
@@ -118,7 +118,7 @@ export async function loadProject(
 	image?: string,
 	imageTag?: string,
 ): Promise<ComposeProject> {
-	const compose = await import('resin-compose-parse');
+	const compose = await import('@balena/compose/dist/parse');
 	const { createProject } = await import('./compose');
 	let composeName: string;
 	let composeStr: string;
@@ -262,7 +262,7 @@ export async function buildProject(
 	opts: BuildProjectOpts,
 ): Promise<BuiltImage[]> {
 	await checkBuildSecretsRequirements(opts.docker, opts.projectPath);
-	const compose = await import('resin-compose-parse');
+	const compose = await import('@balena/compose/dist/parse');
 	const imageDescriptors = compose.parse(opts.composition);
 	const renderer = await startRenderer({ imageDescriptors, ...opts });
 	let buildSummaryByService: Dictionary<string> | undefined;
@@ -333,7 +333,7 @@ async function $buildProject(
 	logger.logDebug('Prepared tasks; building...');
 
 	const { BALENA_ENGINE_TMP_PATH } = await import('../config');
-	const builder = await import('resin-multibuild');
+	const builder = await import('@balena/compose/dist/multibuild');
 
 	const builtImages = await builder.performBuilds(
 		tasks,
@@ -481,8 +481,9 @@ async function qemuTransposeBuildStream({
 		throw new Error(`No buildStream for task '${task.tag}'`);
 	}
 
-	const transpose = await import('docker-qemu-transpose');
-	const { toPosixPath } = (await import('resin-multibuild')).PathUtils;
+	const transpose = await import('@balena/compose/dist/emulate');
+	const { toPosixPath } = (await import('@balena/compose/dist/multibuild'))
+		.PathUtils;
 
 	const transposeOptions: TransposeOptions = {
 		hostQemuPath: toPosixPath(binPath),
@@ -508,9 +509,9 @@ async function setTaskProgressHooks({
 	inlineLogs?: boolean;
 	renderer: Renderer;
 	task: BuildTaskPlus;
-	transposeOptions?: import('docker-qemu-transpose').TransposeOptions;
+	transposeOptions?: import('@balena/compose/dist/emulate').TransposeOptions;
 }) {
-	const transpose = await import('docker-qemu-transpose');
+	const transpose = await import('@balena/compose/dist/emulate');
 	// Get the service-specific log stream
 	const logStream = renderer.streams[task.serviceName];
 	task.logBuffer = [];
@@ -724,16 +725,16 @@ export async function getServiceDirsFromComposition(
  *
  * The `image` argument may therefore refer to either a `build` or `image` property
  * of a service in a docker-compose.yml file, which is a bit confusing but it matches
- * the `ImageDescriptor.image` property as defined by `resin-compose-parse`.
+ * the `ImageDescriptor.image` property as defined by `@balena/compose/parse`.
  *
- * Note that `resin-compose-parse` "normalizes" the docker-compose.yml file such
+ * Note that `@balena/compose/parse` "normalizes" the docker-compose.yml file such
  * that, if `services.service.build` is a string, it is converted to a BuildConfig
  * object with the string value assigned to `services.service.build.context`:
- * https://github.com/balena-io-modules/resin-compose-parse/blob/v2.1.3/src/compose.ts#L166-L167
+ * https://github.com/balena-io-modules/balena-compose/blob/v0.1.0/lib/parse/compose.ts#L166-L167
  * This is why this implementation works when `services.service.build` is defined
  * as a string in the docker-compose.yml file.
  *
- * @param image The `ImageDescriptor.image` attribute parsed with `resin-compose-parse`
+ * @param image The `ImageDescriptor.image` attribute parsed with `@balena/compose/parse`
  */
 export function isBuildConfig(
 	image: string | BuildConfig,
@@ -759,7 +760,8 @@ export async function tarDirectory(
 	}: TarDirectoryOptions,
 ): Promise<import('stream').Readable> {
 	const { filterFilesWithDockerignore } = await import('./ignore');
-	const { toPosixPath } = (await import('resin-multibuild')).PathUtils;
+	const { toPosixPath } = (await import('@balena/compose/dist/multibuild'))
+		.PathUtils;
 
 	let readFile: (file: string) => Promise<Buffer>;
 	if (process.platform === 'win32') {
@@ -941,7 +943,7 @@ async function parseRegistrySecrets(
 			throw new ExpectedError('Filename must end with .json, .yml or .yaml');
 		}
 		const raw = (await fs.readFile(secretsFilename)).toString();
-		const multiBuild = await import('resin-multibuild');
+		const multiBuild = await import('@balena/compose/dist/multibuild');
 		const registrySecrets =
 			new multiBuild.RegistrySecretValidator().validateRegistrySecrets(
 				isYaml ? require('js-yaml').load(raw) : JSON.parse(raw),
@@ -970,7 +972,7 @@ export async function makeBuildTasks(
 	releaseHash: string = 'unavailable',
 	preprocessHook?: (dockerfile: string) => string,
 ): Promise<MultiBuild.BuildTask[]> {
-	const multiBuild = await import('resin-multibuild');
+	const multiBuild = await import('@balena/compose/dist/multibuild');
 	const buildTasks = await multiBuild.splitBuildStream(composition, tarStream);
 
 	logger.logDebug('Found build tasks:');
@@ -1016,7 +1018,7 @@ async function performResolution(
 	releaseHash: string,
 	preprocessHook?: (dockerfile: string) => string,
 ): Promise<MultiBuild.BuildTask[]> {
-	const multiBuild = await import('resin-multibuild');
+	const multiBuild = await import('@balena/compose/dist/multibuild');
 	const resolveListeners: MultiBuild.ResolveListeners = {};
 	const resolvePromise = new Promise<never>((_resolve, reject) => {
 		resolveListeners.error = [reject];
@@ -1081,7 +1083,7 @@ async function validateSpecifiedDockerfile(
 	dockerfilePath: string,
 ): Promise<string> {
 	const { contains, toNativePath, toPosixPath } = (
-		await import('resin-multibuild')
+		await import('@balena/compose/dist/multibuild')
 	).PathUtils;
 
 	const nativeProjectPath = path.normalize(projectPath);
@@ -1241,7 +1243,7 @@ async function pushAndUpdateServiceImages(
 	token: string,
 	images: TaggedImage[],
 	afterEach: (
-		serviceImage: import('balena-release/build/models').ImageModel,
+		serviceImage: import('@balena/compose/dist/release/models').ImageModel,
 		props: object,
 	) => void,
 ) {
@@ -1326,12 +1328,14 @@ async function pushAndUpdateServiceImages(
 async function pushServiceImages(
 	docker: Dockerode,
 	logger: Logger,
-	pineClient: ReturnType<typeof import('balena-release').createClient>,
+	pineClient: ReturnType<
+		typeof import('@balena/compose/dist/release').createClient
+	>,
 	taggedImages: TaggedImage[],
 	token: string,
 	skipLogUpload: boolean,
 ): Promise<void> {
-	const releaseMod = await import('balena-release');
+	const releaseMod = await import('@balena/compose/dist/release');
 	logger.logInfo('Pushing images to registry...');
 	await pushAndUpdateServiceImages(
 		docker,
@@ -1361,8 +1365,8 @@ export async function deployProject(
 	skipLogUpload: boolean,
 	projectPath: string,
 	isDraft: boolean,
-): Promise<import('balena-release/build/models').ReleaseModel> {
-	const releaseMod = await import('balena-release');
+): Promise<import('@balena/compose/dist/release/models').ReleaseModel> {
+	const releaseMod = await import('@balena/compose/dist/release');
 	const { createRelease, tagServiceImages } = await import('./compose');
 	const tty = (await import('./tty'))(process.stdout);
 
@@ -1639,7 +1643,6 @@ function truncateString(str: string, len: number): string {
 	return str.slice(0, str.lastIndexOf('\n'));
 }
 
-// TODO:  docker-compose naming
 export const composeCliFlags: flags.Input<ComposeCliFlags> = {
 	emulated: flags.boolean({
 		description:
@@ -1650,14 +1653,6 @@ export const composeCliFlags: flags.Input<ComposeCliFlags> = {
 		description:
 			'Alternative Dockerfile name/path, relative to the source folder',
 	}),
-	dockercompose: flags.string({
-		description:
-			'Alternative docker-compose.yml name in the source root folder',
-	}),
-	logs: flags.boolean({
-		description:
-			'No-op and deprecated since balena CLI v12.0.0. Build logs are now shown by default.',
-	}),
 	nologs: flags.boolean({
 		description:
 			'Hide the image build log output (produce less verbose output)',

lib/utils/config.ts

@@ -52,10 +52,14 @@ export interface ImgConfig {
 	os?: {
 		sshKeys?: string[];
 	};
+
+	installer?: {
+		secureboot?: boolean;
+	};
 }
 
 export async function generateApplicationConfig(
-	application: BalenaSdk.Application,
+	application: Pick<BalenaSdk.Application, 'slug'>,
 	options: {
 		version: string;
 		appUpdatePollInterval?: number;
@@ -63,6 +67,7 @@ export async function generateApplicationConfig(
 		os?: {
 			sshKeys?: string[];
 		};
+		secureBoot?: boolean;
 	},
 ): Promise<ImgConfig> {
 	options = {
@@ -84,6 +89,12 @@ export async function generateApplicationConfig(
 			: options.os.sshKeys;
 	}
 
+	// configure installer secure boot opt-in if specified
+	if (options.secureBoot) {
+		config.installer ??= {};
+		config.installer.secureboot = options.secureBoot;
+	}
+
 	return config;
 }
 
@@ -165,3 +176,54 @@ export async function validateDevOptionAndWarn(
 		and exposes network ports such as 2375 that allows unencrypted access to balenaEngine.
 		Therefore, development mode should only be used in private, trusted local networks.`);
 }
+
+/**
+ * Chech whether the `--secureBoot` option of commands related to OS configuration
+ * such as `os configure` and `config generate` is compatible with a given
+ * OS release, and print a warning regarding the consequences of using that
+ * option.
+ */
+export async function validateSecureBootOptionAndWarn(
+	secureBoot?: boolean,
+	slug?: string,
+	version?: string,
+	logger?: import('./logger'),
+) {
+	if (!secureBoot) {
+		return;
+	}
+	const { ExpectedError } = await import('../errors');
+	if (!version) {
+		throw new ExpectedError(`Error: No version provided`);
+	}
+	if (!slug) {
+		throw new ExpectedError(`Error: No device type provided`);
+	}
+	const sdk = getBalenaSdk();
+	const [osRelease] = await sdk.models.os.getAllOsVersions(slug, {
+		$select: 'contract',
+		$filter: { raw_version: `${version.replace(/^v/, '')}` },
+	});
+	if (!osRelease) {
+		throw new ExpectedError(`Error: No ${version} release for ${slug}`);
+	}
+
+	const contract = osRelease.contract ? JSON.parse(osRelease.contract) : null;
+	if (
+		contract?.provides.some((entry: Dictionary<string>) => {
+			return entry.type === 'sw.feature' && entry.slug === 'secureboot';
+		})
+	) {
+		if (!logger) {
+			const Logger = await import('./logger');
+			logger = Logger.getLogger();
+		}
+		logger.logInfo(stripIndent`
+			The '--secureBoot' option is being used to configure a balenaOS installer image
+			into secure boot and full disk encryption.`);
+	} else {
+		throw new ExpectedError(
+			`Error: The '--secureBoot' option is not supported for ${slug} in ${version}`,
+		);
+	}
+}

lib/utils/device/deploy.ts

@@ -18,13 +18,13 @@
 import * as semver from 'balena-semver';
 import * as Docker from 'dockerode';
 import * as _ from 'lodash';
-import { Composition } from 'resin-compose-parse';
+import { Composition } from '@balena/compose/dist/parse';
 import {
 	BuildTask,
 	getAuthConfigObj,
 	LocalImage,
 	RegistrySecrets,
-} from 'resin-multibuild';
+} from '@balena/compose/dist/multibuild';
 import type { Readable } from 'stream';
 
 import { BALENA_ENGINE_TMP_PATH } from '../../config';
@@ -44,7 +44,7 @@ import { displayBuildLog } from './logs';
 import { stripIndent } from '../lazy';
 
 const LOCAL_APPNAME = 'localapp';
-const LOCAL_RELEASEHASH = 'localrelease';
+const LOCAL_RELEASEHASH = '10ca12e1ea5e';
 const LOCAL_PROJECT_NAME = 'local_image';
 
 // Define the logger here so the debug output
@@ -209,9 +209,9 @@ export async function deployToDevice(opts: DeviceDeployOptions): Promise<void> {
 	globalLogger.logDebug('Fetching device information...');
 	const deviceInfo = await api.getDeviceInformation();
 
-	let buildLogs: Dictionary<string> | undefined;
+	let imageIds: Dictionary<string[]> | undefined;
 	if (!opts.nolive) {
-		buildLogs = {};
+		imageIds = {};
 	}
 
 	const { awaitInterruptibleTask } = await import('../helpers');
@@ -223,7 +223,7 @@ export async function deployToDevice(opts: DeviceDeployOptions): Promise<void> {
 		deviceInfo,
 		globalLogger,
 		opts,
-		buildLogs,
+		imageIds,
 	);
 
 	globalLogger.outputDeferredMessages();
@@ -265,7 +265,7 @@ export async function deployToDevice(opts: DeviceDeployOptions): Promise<void> {
 			docker,
 			logger: globalLogger,
 			composition: project.composition,
-			buildLogs: buildLogs!,
+			imageIds: imageIds!,
 			deployOpts: opts,
 		});
 		promises.push(livepush.init());
@@ -312,6 +312,14 @@ function connectToDocker(host: string, port: number): Docker {
 	});
 }
 
+function extractDockerArrowMessage(outputLine: string): string | undefined {
+	const arrowTest = /^.*\s*-+>\s*(.+)/i;
+	const match = arrowTest.exec(outputLine);
+	if (match != null) {
+		return match[1];
+	}
+}
+
 async function performBuilds(
 	composition: Composition,
 	tarStream: Readable,
@@ -319,9 +327,9 @@ async function performBuilds(
 	deviceInfo: DeviceInfo,
 	logger: Logger,
 	opts: DeviceDeployOptions,
-	buildLogs?: Dictionary<string>,
+	imageIds?: Dictionary<string[]>,
 ): Promise<BuildTask[]> {
-	const multibuild = await import('resin-multibuild');
+	const multibuild = await import('@balena/compose/dist/multibuild');
 
 	const buildTasks = await makeBuildTasks(
 		composition,
@@ -345,14 +353,29 @@ async function performBuilds(
 	// If we're passed a build logs object make sure to set it
 	// up properly
 	let logHandlers: ((serviceName: string, line: string) => void) | undefined;
-	if (buildLogs != null) {
+
+	const lastArrowMessage: Dictionary<string> = {};
+
+	if (imageIds != null) {
 		for (const task of buildTasks) {
 			if (!task.external) {
-				buildLogs[task.serviceName] = '';
+				imageIds[task.serviceName] = [];
 			}
 		}
 		logHandlers = (serviceName: string, line: string) => {
-			buildLogs[serviceName] += `${line}\n`;
+			// If this was a from line, take the last found
+			// image id and save it
+			if (
+				/step \d+(?:\/\d+)?\s*:\s*FROM/i.test(line) &&
+				lastArrowMessage[serviceName] != null
+			) {
+				imageIds[serviceName].push(lastArrowMessage[serviceName]);
+			} else {
+				const msg = extractDockerArrowMessage(line);
+				if (msg != null) {
+					lastArrowMessage[serviceName] = msg;
+				}
+			}
 		};
 	}
 
@@ -370,7 +393,7 @@ async function performBuilds(
 	const imagesToRemove: string[] = [];
 
 	// Now tag any external images with the correct name that they should be,
-	// as this won't be done by resin-multibuild
+	// as this won't be done by @balena/compose/multibuild
 	await Promise.all(
 		localImages.map(async (localImage) => {
 			if (localImage.external) {
@@ -413,12 +436,26 @@ export async function rebuildSingleTask(
 	// the logs, so any calller who wants to keep track of
 	// this should provide the following callback
 	containerIdCb?: (id: string) => void,
-): Promise<string> {
-	const multibuild = await import('resin-multibuild');
+): Promise<string[]> {
+	const multibuild = await import('@balena/compose/dist/multibuild');
 	// First we run the build task, to get the new image id
-	let buildLogs = '';
+	const stageIds = [] as string[];
+	let lastArrowMessage: string | undefined;
+
 	const logHandler = (_s: string, line: string) => {
-		buildLogs += `${line}\n`;
+		// If this was a FROM line, take the last found
+		// image id and save it as a stage id
+		if (
+			/step \d+(?:\/\d+)?\s*:\s*FROM/i.test(line) &&
+			lastArrowMessage != null
+		) {
+			stageIds.push(lastArrowMessage);
+		} else {
+			const msg = extractDockerArrowMessage(line);
+			if (msg != null) {
+				lastArrowMessage = msg;
+			}
+		}
 
 		if (containerIdCb != null) {
 			const match = line.match(/^\s*--->\s*Running\s*in\s*([a-f0-9]*)\s*$/i);
@@ -477,7 +514,7 @@ export async function rebuildSingleTask(
 		]);
 	}
 
-	return buildLogs;
+	return stageIds;
 }
 
 function assignOutputHandlers(
@@ -533,10 +570,17 @@ async function assignDockerBuildOpts(
 	await Promise.all(
 		buildTasks.map(async (task: BuildTask) => {
 			task.dockerOpts = {
-				cachefrom: images,
-				labels: {
-					'io.resin.local.image': '1',
-					'io.resin.local.service': task.serviceName,
+				...(task.dockerOpts || {}),
+				...{
+					cachefrom: images,
+					labels: {
+						'io.resin.local.image': '1',
+						'io.resin.local.service': task.serviceName,
+					},
+					t: getImageNameFromTask(task),
+					nocache: opts.nocache,
+					forcerm: true,
+					pull: opts.pull,
 				},
 				t: getImageNameFromTask(task),
 				nocache: opts.nocache,
@@ -544,7 +588,7 @@ async function assignDockerBuildOpts(
 				pull: opts.pull,
 			};
 			if (task.external) {
-				task.dockerOpts.authconfig = await getAuthConfigObj(
+				task.dockerOpts.authconfig = getAuthConfigObj(
 					task.imageName!,
 					opts.registrySecrets,
 				);

lib/utils/device/live.ts

@@ -21,8 +21,8 @@ import * as fs from 'fs';
 import Livepush, { ContainerNotRunningError } from 'livepush';
 import * as _ from 'lodash';
 import * as path from 'path';
-import type { Composition } from 'resin-compose-parse';
-import type { BuildTask } from 'resin-multibuild';
+import type { Composition } from '@balena/compose/dist/parse';
+import type { BuildTask } from '@balena/compose/dist/multibuild';
 
 import { instanceOf } from '../../errors';
 import Logger = require('../logger');
@@ -52,7 +52,6 @@ interface MonitoredContainer {
 	containerId: string;
 }
 
-type BuildLogs = Dictionary<string>;
 type StageImageIDs = Dictionary<string[]>;
 
 export interface LivepushOpts {
@@ -62,7 +61,7 @@ export interface LivepushOpts {
 	docker: Dockerode;
 	api: DeviceAPI;
 	logger: Logger;
-	buildLogs: BuildLogs;
+	imageIds: StageImageIDs;
 	deployOpts: DeviceDeployOptions;
 }
 
@@ -97,7 +96,7 @@ export class LivepushManager {
 		this.api = opts.api;
 		this.logger = opts.logger;
 		this.deployOpts = opts.deployOpts;
-		this.imageIds = LivepushManager.getMultistageImageIDs(opts.buildLogs);
+		this.imageIds = opts.imageIds;
 	}
 
 	public async init(): Promise<void> {
@@ -250,7 +249,7 @@ export class LivepushManager {
 			cwd: serviceContext,
 			followSymlinks: true,
 			ignoreInitial: true,
-			ignored: (filePath: string, stats: fs.Stats | undefined) => {
+			ignored: (filePath: string, stats?: fs.Stats) => {
 				if (!stats) {
 					try {
 						// sync because chokidar defines a sync interface
@@ -297,33 +296,6 @@ export class LivepushManager {
 		return new Dockerfile(content).generateLiveDockerfile();
 	}
 
-	private static getMultistageImageIDs(buildLogs: BuildLogs): StageImageIDs {
-		const stageIds: StageImageIDs = {};
-		_.each(buildLogs, (log, serviceName) => {
-			stageIds[serviceName] = [];
-
-			const lines = log.split(/\r?\n/);
-			let lastArrowMessage: string | undefined;
-			for (const line of lines) {
-				// If this was a from line, take the last found
-				// image id and save it
-				if (
-					/step \d+(?:\/\d+)?\s*:\s*FROM/i.test(line) &&
-					lastArrowMessage != null
-				) {
-					stageIds[serviceName].push(lastArrowMessage);
-				} else {
-					const msg = LivepushManager.extractDockerArrowMessage(line);
-					if (msg != null) {
-						lastArrowMessage = msg;
-					}
-				}
-			}
-		});
-
-		return stageIds;
-	}
-
 	private async awaitDeviceStateSettle(): Promise<void> {
 		// Cache the state to avoid unnecessary calls
 		this.lastDeviceStatus = await this.api.getStatus();
@@ -405,9 +377,9 @@ export class LivepushManager {
 				);
 			}
 
-			let buildLog: string;
+			let stageImages: string[];
 			try {
-				buildLog = await rebuildSingleTask(
+				stageImages = await rebuildSingleTask(
 					serviceName,
 					this.docker,
 					this.logger,
@@ -466,17 +438,13 @@ export class LivepushManager {
 				);
 			}
 
-			const buildLogs: Dictionary<string> = {};
-			buildLogs[serviceName] = buildLog;
-			const stageImages = LivepushManager.getMultistageImageIDs(buildLogs);
-
 			const dockerfile = new Dockerfile(buildTask.dockerfile!);
 
 			instance.livepush = await Livepush.init({
 				dockerfile,
 				context: buildTask.context!,
 				containerId: container.containerId,
-				stageImages: stageImages[serviceName],
+				stageImages,
 				docker: this.docker,
 			});
 			this.assignLivepushOutputHandlers(serviceName, instance.livepush);
@@ -536,16 +504,6 @@ export class LivepushManager {
 		});
 	}
 
-	private static extractDockerArrowMessage(
-		outputLine: string,
-	): string | undefined {
-		const arrowTest = /^.*\s*-+>\s*(.+)/i;
-		const match = arrowTest.exec(outputLine);
-		if (match != null) {
-			return match[1];
-		}
-	}
-
 	private getDockerfilePathFromTask(task: BuildTask): string[] {
 		switch (task.projectType) {
 			case 'Standard Dockerfile':

lib/utils/device/logs.ts

@@ -155,12 +155,8 @@ export function displayLogObject<T extends Log>(
 	system: boolean,
 	filterServices?: string[],
 ): void {
-	let toPrint: string;
-	if (obj.timestamp != null) {
-		toPrint = `[${new Date(obj.timestamp).toLocaleString()}]`;
-	} else {
-		toPrint = `[${new Date().toLocaleString()}]`;
-	}
+	const d = obj.timestamp != null ? new Date(obj.timestamp) : new Date();
+	let toPrint = `[${d.toISOString()}]`;
 
 	if (obj.serviceName != null) {
 		if (filterServices) {

lib/utils/discover.ts

@@ -0,0 +1,40 @@
+import { enumerateServices, findServices } from 'resin-discoverable-services';
+
+interface LocalBalenaOsDevice {
+	address: string;
+	host: string;
+	osVariant?: string;
+	port: number;
+}
+
+// Although we only check for 'balena-ssh', we know, implicitly, that balenaOS
+// devices come with 'rsync' installed that can be used over SSH.
+const avahiBalenaSshTag = 'resin-ssh';
+
+export async function discoverLocalBalenaOsDevices(
+	timeout = 4000,
+): Promise<LocalBalenaOsDevice[]> {
+	const availableServices = await enumerateServices();
+	const serviceDefinitions = Array.from(availableServices)
+		.filter((s) => Array.from(s.tags).includes(avahiBalenaSshTag))
+		.map((s) => s.service);
+
+	if (serviceDefinitions.length === 0) {
+		throw new Error(
+			`Could not find any available '${avahiBalenaSshTag}' services`,
+		);
+	}
+
+	const services = await findServices(serviceDefinitions, timeout);
+	return services.map(function (service) {
+		// User referer address to get device IP. This will work fine assuming that
+		// a device only advertises own services.
+		const {
+			referer: { address },
+			host,
+			port,
+		} = service;
+
+		return { address, host, port };
+	});
+}

lib/utils/docker.ts

@@ -105,7 +105,7 @@ export interface BuildOpts {
 	cachefrom?: string[];
 	nocache?: boolean;
 	pull?: boolean;
-	registryconfig?: import('resin-multibuild').RegistrySecrets;
+	registryconfig?: import('@balena/compose/dist/multibuild').RegistrySecrets;
 	squash?: boolean;
 	t?: string; // only the tag portion of the image name, e.g. 'abc' in 'myimg:abc'
 }
@@ -132,7 +132,7 @@ export function generateBuildOpts(options: {
 	'cache-from'?: string;
 	nocache: boolean;
 	pull?: boolean;
-	'registry-secrets'?: import('resin-multibuild').RegistrySecrets;
+	'registry-secrets'?: import('@balena/compose/dist/multibuild').RegistrySecrets;
 	squash: boolean;
 	tag?: string;
 }): BuildOpts {

lib/utils/helpers.ts

@@ -107,21 +107,53 @@ export async function getManifest(
 	deviceType: string,
 ): Promise<BalenaSdk.DeviceTypeJson.DeviceType> {
 	const init = await import('balena-device-init');
+	const sdk = getBalenaSdk();
 	const manifest = await init.getImageManifest(image);
-	if (manifest != null) {
-		return manifest;
+	if (
+		manifest != null &&
+		manifest.slug !== deviceType &&
+		manifest.slug !== (await sdk.models.deviceType.get(deviceType)).slug
+	) {
+		const { ExpectedError } = await import('../errors');
+		throw new ExpectedError(
+			`The device type of the provided OS image ${manifest.slug}, does not match the expected device type ${deviceType}`,
+		);
 	}
-	return getBalenaSdk().models.device.getManifestBySlug(deviceType);
+	return (
+		manifest ??
+		(await sdk.models.config.getDeviceTypeManifestBySlug(deviceType))
+	);
 }
 
-export const areDeviceTypesCompatible = (
-	appDeviceType: BalenaSdk.DeviceTypeJson.DeviceType,
-	osDeviceType: BalenaSdk.DeviceTypeJson.DeviceType,
-) =>
-	getBalenaSdk().models.os.isArchitectureCompatibleWith(
-		osDeviceType.arch,
-		appDeviceType.arch,
-	) && !!appDeviceType.isDependent === !!osDeviceType.isDependent;
+export const areDeviceTypesCompatible = async (
+	appDeviceTypeSlug: string,
+	osDeviceTypeSlug: string,
+) => {
+	if (appDeviceTypeSlug === osDeviceTypeSlug) {
+		return true;
+	}
+	const sdk = getBalenaSdk();
+	const pineOptions = {
+		$select: 'is_of__cpu_architecture',
+		$expand: {
+			is_of__cpu_architecture: {
+				$select: 'slug',
+			},
+		},
+	} satisfies BalenaSdk.PineOptions<BalenaSdk.DeviceType>;
+	const [appDeviceType, osDeviceType] = await Promise.all(
+		[appDeviceTypeSlug, osDeviceTypeSlug].map(
+			(dtSlug) =>
+				sdk.models.deviceType.get(dtSlug, pineOptions) as Promise<
+					BalenaSdk.PineTypedResult<BalenaSdk.DeviceType, typeof pineOptions>
+				>,
+		),
+	);
+	return sdk.models.os.isArchitectureCompatibleWith(
+		osDeviceType.is_of__cpu_architecture[0].slug,
+		appDeviceType.is_of__cpu_architecture[0].slug,
+	);
+};
 
 export async function osProgressHandler(step: InitializeEmitter) {
 	step.on('stdout', process.stdout.write.bind(process.stdout));
@@ -148,14 +180,13 @@ export async function osProgressHandler(step: InitializeEmitter) {
 	});
 }
 
-export async function getAppWithArch(
-	applicationName: string,
-): Promise<ApplicationWithDeviceType & { arch: string }> {
+export async function getAppWithArch(applicationName: string) {
 	const { getApplication } = await import('./sdk');
-	const options: BalenaSdk.PineOptions<BalenaSdk.Application> = {
+	const balena = getBalenaSdk();
+	const app = await getApplication(balena, applicationName, {
 		$expand: {
 			application_type: {
-				$select: ['name', 'slug', 'supports_multicontainer', 'is_legacy'],
+				$select: ['name', 'slug', 'supports_multicontainer'],
 			},
 			is_for__device_type: {
 				$select: 'slug',
@@ -166,20 +197,10 @@ export async function getAppWithArch(
 				},
 			},
 		},
-	};
-	const balena = getBalenaSdk();
-	const app = (await getApplication(
-		balena,
-		applicationName,
-		options,
-	)) as ApplicationWithDeviceType;
-	const { getExpanded } = await import('./pine');
-
+	});
 	return {
 		...app,
-		arch: getExpanded(
-			getExpanded(app.is_for__device_type)!.is_of__cpu_architecture,
-		)!.slug,
+		arch: app.is_for__device_type[0].is_of__cpu_architecture[0].slug,
 	};
 }
 
@@ -410,25 +431,11 @@ export function getProxyConfig(): ProxyConfig | undefined {
 
 export const expandForAppName = {
 	$expand: {
-		belongs_to__application: { $select: ['app_name', 'slug'] as any },
+		belongs_to__application: { $select: ['app_name', 'slug'] },
 		is_of__device_type: { $select: 'slug' },
 		is_running__release: { $select: 'commit' },
 	},
-} as const;
-
-export const expandForAppNameAndCpuArch = {
-	$expand: {
-		...expandForAppName.$expand,
-		is_of__device_type: {
-			$select: 'slug',
-			$expand: {
-				is_of__cpu_architecture: {
-					$select: 'slug',
-				},
-			},
-		},
-	},
-} as const;
+} satisfies BalenaSdk.PineOptions<BalenaSdk.Device>;
 
 /**
  * Use the `readline` library on Windows to install SIGINT handlers.

lib/utils/ignore.ts

@@ -92,7 +92,6 @@ async function readDockerIgnoreFile(projectDir: string): Promise<string> {
 	return dockerIgnoreStr;
 }
 
-// TODO:  docker-compose naming
 /**
  * Create an instance of '@balena/dockerignore', initialized with the contents
  * of a .dockerignore file (if any) found at the given directory argument, plus

lib/utils/messages.ts

@@ -86,7 +86,6 @@ If the --registry-secrets option is not specified, and a secrets.yml or
 secrets.json file exists in the balena directory (usually $HOME/.balena),
 this file will be used instead.`;
 
-// TODO:  docker-compose naming
 export const dockerignoreHelp =
 	'DOCKERIGNORE AND GITIGNORE FILES  \n' +
 	`By default, the balena CLI will use a single ".dockerignore" file (if any) at
@@ -138,7 +137,7 @@ adding exception patterns to the applicable .dockerignore file(s), for example
 - https://www.npmjs.com/package/@balena/dockerignore`;
 
 export const applicationIdInfo = `\
-Fleets may be specified by fleet name, slug, or numeric ID. Fleet slugs are
+Fleets may be specified by fleet name or slug. Fleet slugs are
 the recommended option, as they are unique and unambiguous. Slugs can be
 listed with the \`balena fleets\` command. Note that slugs may change if the
 fleet is renamed. Fleet names are not unique and may result in  "Fleet is
@@ -146,9 +145,7 @@ ambiguous" errors at any time (even if it "used to work in the past"), for
 example if the name clashes with a newly created public fleet, or with fleets
 from other balena accounts that you may be invited to join under any role.
 For this reason, fleet names are especially discouraged in scripts (e.g. CI
-environments). Numeric fleet IDs are deprecated because they consist of an
-implementation detail of the balena backend. We intend to remove support for
-numeric IDs at some point in the future.`;
+environments).`;
 
 export const applicationNameNote = `\
 Fleets may be specified by fleet name or slug. Slugs are recommended because
@@ -172,6 +169,10 @@ confuse the balenaOS "development mode" with a device's "local mode", the latter
 being a supervisor feature that allows the "balena push" command to push a user's
 application directly to a device in the local network.`;
 
+export const secureBootInfo = `\
+The '--secureBoot' option is used to configure a balenaOS installer image to opt-in
+secure boot and disk encryption.`;
+
 export const jsonInfo = `\
 The --json option is recommended when scripting the output of this command,
 because field names are less likely to change in JSON format and because it

lib/utils/patterns.ts

@@ -14,8 +14,15 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-import type { Application, BalenaSDK, Device, Organization } from 'balena-sdk';
-import _ = require('lodash');
+import type {
+	Application,
+	BalenaSDK,
+	Device,
+	Organization,
+	PineFilter,
+	PineOptions,
+	PineTypedResult,
+} from 'balena-sdk';
 
 import { instanceOf, NotLoggedInError, ExpectedError } from '../errors';
 import { getBalenaSdk, getVisuals, stripIndent, getCliForm } from './lazy';
@@ -108,22 +115,22 @@ export function askLoginType() {
 	});
 }
 
-export function selectDeviceType() {
-	return getBalenaSdk()
-		.models.config.getDeviceTypes()
-		.then((deviceTypes) => {
-			deviceTypes = _.sortBy(deviceTypes, 'name').filter(
-				(dt) => dt.state !== 'DISCONTINUED',
-			);
-			return getCliForm().ask({
-				message: 'Device Type',
-				type: 'list',
-				choices: _.map(deviceTypes, ({ slug: value, name }) => ({
-					name,
-					value,
-				})),
-			});
-		});
+export async function selectDeviceType() {
+	const sdk = getBalenaSdk();
+	let deviceTypes = await sdk.models.deviceType.getAllSupported();
+	if (deviceTypes.length === 0) {
+		// Without this open-balena users would get an empty list
+		// until we add a hostApps import in open-balena.
+		deviceTypes = await sdk.models.deviceType.getAll();
+	}
+	return getCliForm().ask({
+		message: 'Device Type',
+		type: 'list',
+		choices: deviceTypes.map(({ slug: value, name }) => ({
+			name,
+			value,
+		})),
+	});
 }
 
 /**
@@ -157,46 +164,60 @@ export async function confirm(
 	}
 }
 
-export function selectApplication(
-	filter?: (app: ApplicationWithDeviceType) => boolean,
+const selectApplicationPineOptions = {
+	$select: ['id', 'slug', 'app_name'],
+	$expand: {
+		is_for__device_type: {
+			$select: 'slug',
+		},
+	},
+} satisfies PineOptions<Application>;
+
+type SelectApplicationResult = PineTypedResult<
+	Application,
+	typeof selectApplicationPineOptions
+>;
+
+export async function selectApplication(
+	filter?:
+		| PineFilter<Application>
+		| ((app: SelectApplicationResult) => boolean),
 	errorOnEmptySelection = false,
 ) {
 	const balena = getBalenaSdk();
-	return balena.models.application
-		.hasAny()
-		.then(async (hasAnyApplications) => {
-			if (!hasAnyApplications) {
-				throw new ExpectedError('No fleets found');
-			}
+	let apps = (await balena.models.application.getAllDirectlyAccessible({
+		...selectApplicationPineOptions,
+		...(filter != null && typeof filter === 'object' && { $filter: filter }),
+	})) as SelectApplicationResult[];
 
-			const apps = (await balena.models.application.getAllDirectlyAccessible({
-				$expand: {
-					is_for__device_type: {
-						$select: 'slug',
-					},
-				},
-			})) as ApplicationWithDeviceType[];
-			return apps.filter(filter || _.constant(true));
-		})
-		.then((applications) => {
-			if (errorOnEmptySelection && applications.length === 0) {
-				throw new ExpectedError('No suitable fleets found for selection');
-			}
-			return getCliForm().ask({
-				message: 'Select an application',
-				type: 'list',
-				choices: _.map(applications, (application) => ({
-					name: `${application.app_name} (${application.slug}) [${application.is_for__device_type[0].slug}]`,
-					value: application,
-				})),
-			});
-		});
+	if (!apps.length) {
+		throw new ExpectedError('No fleets found');
+	}
+
+	if (filter != null && typeof filter === 'function') {
+		apps = apps.filter(filter);
+	}
+
+	if (errorOnEmptySelection && apps.length === 0) {
+		throw new ExpectedError('No suitable fleets found for selection');
+	}
+	return getCliForm().ask({
+		message: 'Select an application',
+		type: 'list',
+		choices: apps.map((application) => ({
+			name: `${application.app_name} (${application.slug}) [${application.is_for__device_type[0].slug}]`,
+			value: application,
+		})),
+	});
 }
 
-export async function selectOrganization(organizations?: Organization[]) {
+export async function selectOrganization(
+	organizations?: Array<Pick<Organization, 'handle' | 'name'>>,
+) {
 	// Use either provided orgs (if e.g. already loaded) or load from cloud
-	organizations =
-		organizations || (await getBalenaSdk().models.organization.getAll());
+	organizations ??= await getBalenaSdk().models.organization.getAll({
+		$select: ['name', 'handle'],
+	});
 	return getCliForm().ask({
 		message: 'Select an organization',
 		type: 'list',
@@ -207,6 +228,24 @@ export async function selectOrganization(organizations?: Organization[]) {
 	});
 }
 
+export async function getAndSelectOrganization() {
+	const { getOwnOrganizations } = await import('./sdk');
+	const organizations = await getOwnOrganizations(getBalenaSdk(), {
+		$select: ['name', 'handle'],
+	});
+
+	if (organizations.length === 0) {
+		// User is not a member of any organizations (should not happen).
+		throw new Error('This account is not a member of any organizations');
+	} else if (organizations.length === 1) {
+		// User is a member of only one organization - use this.
+		return organizations[0].handle;
+	} else {
+		// User is a member of multiple organizations -
+		return selectOrganization(organizations);
+	}
+}
+
 export async function awaitDeviceOsUpdate(
 	uuid: string,
 	targetOsVersion: string,
@@ -252,116 +291,88 @@ export async function awaitDeviceOsUpdate(
 	return uuid;
 }
 
-export function inferOrSelectDevice(preferredUuid: string) {
-	const balena = getBalenaSdk();
-	return balena.models.device.getAll().then((devices) => {
-		const onlineDevices = devices.filter((device) => device.is_online);
-		if (_.isEmpty(onlineDevices)) {
-			throw new ExpectedError("You don't have any devices online");
-		}
-
-		const defaultUuid = _(onlineDevices).map('uuid').includes(preferredUuid)
-			? preferredUuid
-			: onlineDevices[0].uuid;
-
-		return getCliForm().ask({
-			message: 'Select a device',
-			type: 'list',
-			default: defaultUuid,
-			choices: _.map(onlineDevices, (device) => ({
-				name: `${device.device_name || 'Untitled'} (${device.uuid.slice(
-					0,
-					7,
-				)})`,
-				value: device.uuid,
-			})),
-		});
-	});
-}
-
 /*
- * Given applicationOrDevice, which may be
- *  - an application name
- *  - an application slug
- *  - an application id (integer)
+ * Given fleetOrDevice, which may be
+ *  - a fleet name
+ *  - a fleet slug
  *  - a device uuid
  * Either:
  *  - in case of device uuid, return uuid of device after verifying that it exists and is online.
- *  - in case of application, return uuid of device user selects from list of online devices.
- *
- * 	TODO: Modify this when app IDs dropped.
+ *  - in case of fleet, return uuid of device user selects from list of online devices.
  */
 export async function getOnlineTargetDeviceUuid(
 	sdk: BalenaSDK,
-	applicationOrDevice: string,
+	fleetOrDevice: string,
 ) {
 	const logger = (await import('../utils/logger')).getLogger();
 
 	// If looks like UUID, probably device
-	if (validation.validateUuid(applicationOrDevice)) {
+	if (validation.validateUuid(fleetOrDevice)) {
 		let device: Device;
 		try {
 			logger.logDebug(
-				`Trying to fetch device by UUID ${applicationOrDevice} (${typeof applicationOrDevice})`,
+				`Trying to fetch device by UUID ${fleetOrDevice} (${typeof fleetOrDevice})`,
 			);
-			device = await sdk.models.device.get(applicationOrDevice, {
+			device = await sdk.models.device.get(fleetOrDevice, {
 				$select: ['uuid', 'is_online'],
 			});
 
 			if (!device.is_online) {
-				throw new ExpectedError(
-					`Device with UUID ${applicationOrDevice} is offline`,
-				);
+				throw new ExpectedError(`Device with UUID ${fleetOrDevice} is offline`);
 			}
 
 			return device.uuid;
 		} catch (err) {
 			const { BalenaDeviceNotFound } = await import('balena-errors');
 			if (instanceOf(err, BalenaDeviceNotFound)) {
-				logger.logDebug(`Device with UUID ${applicationOrDevice} not found`);
-				// Now try app
+				logger.logDebug(`Device with UUID ${fleetOrDevice} not found`);
+				// Now try application
 			} else {
 				throw err;
 			}
 		}
 	}
 
-	// Not a device UUID, try app
-	let app: Application;
-	try {
-		logger.logDebug(`Fetching fleet ${applicationOrDevice}`);
-		const { getApplication } = await import('./sdk');
-		app = await getApplication(sdk, applicationOrDevice);
-	} catch (err) {
-		const { BalenaApplicationNotFound } = await import('balena-errors');
-		if (instanceOf(err, BalenaApplicationNotFound)) {
-			throw new ExpectedError(
-				`Fleet or Device not found: ${applicationOrDevice}`,
-			);
-		} else {
-			throw err;
+	// Not a device UUID, try application
+	const application = await (async () => {
+		try {
+			logger.logDebug(`Fetching fleet ${fleetOrDevice}`);
+			const { getApplication } = await import('./sdk');
+			return await getApplication(sdk, fleetOrDevice, {
+				$select: ['id', 'slug'],
+				$expand: {
+					owns__device: {
+						$select: ['device_name', 'uuid'],
+						$filter: { is_online: true },
+					},
+				},
+			});
+		} catch (err) {
+			const { BalenaApplicationNotFound } = await import('balena-errors');
+			if (instanceOf(err, BalenaApplicationNotFound)) {
+				throw new ExpectedError(`Fleet or Device not found: ${fleetOrDevice}`);
+			} else {
+				throw err;
+			}
 		}
-	}
+	})();
 
 	// App found, load its devices
-	const devices = await sdk.models.device.getAllByApplication(app.id, {
-		$select: ['device_name', 'uuid'],
-		$filter: { is_online: true },
-	});
+	const devices = application.owns__device;
 
 	// Throw if no devices online
-	if (_.isEmpty(devices)) {
+	if (!devices.length) {
 		throw new ExpectedError(
-			`Fleet ${app.slug} found, but has no devices online.`,
+			`Fleet ${application.slug} found, but has no devices online.`,
 		);
 	}
 
-	// Ask user to select from online devices for application
+	// Ask user to select from online devices for fleet
 	return getCliForm().ask({
-		message: `Select a device on fleet ${app.slug}`,
+		message: `Select a device on fleet ${application.slug}`,
 		type: 'list',
 		default: devices[0].uuid,
-		choices: _.map(devices, (device) => ({
+		choices: devices.map((device) => ({
 			name: `${device.device_name || 'Untitled'} (${device.uuid.slice(0, 7)})`,
 			value: device.uuid,
 		})),
@@ -375,7 +386,7 @@ export function selectFromList<T>(
 	return getCliForm().ask<T>({
 		message,
 		type: 'list',
-		choices: _.map(choices, (s) => ({
+		choices: choices.map((s) => ({
 			name: s.name,
 			value: s,
 		})),

lib/utils/pine.ts

@@ -16,10 +16,10 @@ limitations under the License.
 
 import type { OptionalNavigationResource } from 'balena-sdk';
 
-export const getExpanded = <T>(obj: OptionalNavigationResource<T>) =>
+export const getExpanded = <T extends {}>(obj: OptionalNavigationResource<T>) =>
 	(Array.isArray(obj) && obj[0]) || undefined;
 
-export const getExpandedProp = <T, K extends keyof T>(
+export const getExpandedProp = <T extends {}, K extends keyof T>(
 	obj: OptionalNavigationResource<T>,
 	key: K,
 ) => (Array.isArray(obj) && obj[0] && obj[0][key]) || undefined;

lib/utils/promote.ts

@@ -163,12 +163,61 @@ async function getOsVersion(deviceIp: string): Promise<string> {
 	return match[1];
 }
 
+const dockerPort = 2375;
+const dockerTimeout = 2000;
+
+async function selectLocalBalenaOsDevice(timeout = 4000): Promise<string> {
+	const { discoverLocalBalenaOsDevices } = await import('../utils/discover');
+	const { SpinnerPromise } = getVisuals();
+	const devices = await new SpinnerPromise({
+		promise: discoverLocalBalenaOsDevices(timeout),
+		startMessage: 'Discovering local balenaOS devices..',
+		stopMessage: 'Reporting discovered devices',
+	});
+
+	const responsiveDevices: typeof devices = [];
+	const Docker = await import('dockerode');
+	await Promise.all(
+		devices.map(async function (device) {
+			const address = device?.address;
+			if (!address) {
+				return;
+			}
+
+			try {
+				const docker = new Docker({
+					host: address,
+					port: dockerPort,
+					timeout: dockerTimeout,
+				});
+				await docker.ping();
+				responsiveDevices.push(device);
+			} catch {
+				return;
+			}
+		}),
+	);
+
+	if (!responsiveDevices.length) {
+		throw new Error('Could not find any local balenaOS devices');
+	}
+
+	return getCliForm().ask({
+		message: 'select a device',
+		type: 'list',
+		default: devices[0].address,
+		choices: responsiveDevices.map((device) => ({
+			name: `${device.host || 'untitled'} (${device.address})`,
+			value: device.address,
+		})),
+	});
+}
+
 async function selectLocalDevice(): Promise<string> {
-	const { forms } = await import('balena-sync');
-	let hostnameOrIp;
 	try {
-		hostnameOrIp = await forms.selectLocalBalenaOsDevice();
+		const hostnameOrIp = await selectLocalBalenaOsDevice();
 		console.error(`==> Selected device: ${hostnameOrIp}`);
+		return hostnameOrIp;
 	} catch (e) {
 		if (e.message.toLowerCase().includes('could not find any')) {
 			throw new ExpectedError(e);
@@ -176,13 +225,11 @@ async function selectLocalDevice(): Promise<string> {
 			throw e;
 		}
 	}
-
-	return hostnameOrIp;
 }
 
 async function selectAppFromList(
-	applications: ApplicationWithDeviceType[],
-): Promise<ApplicationWithDeviceType> {
+	applications: ApplicationWithDeviceTypeSlug[],
+): Promise<ApplicationWithDeviceTypeSlug> {
 	const _ = await import('lodash');
 	const { selectFromList } = await import('../utils/patterns');
 
@@ -198,56 +245,83 @@ async function selectAppFromList(
 
 async function getOrSelectApplication(
 	sdk: BalenaSdk.BalenaSDK,
-	deviceType: string,
+	deviceTypeSlug: string,
 	appName?: string,
-): Promise<ApplicationWithDeviceType> {
-	const _ = await import('lodash');
+): Promise<ApplicationWithDeviceTypeSlug> {
+	const pineOptions = {
+		$select: 'slug',
+		$expand: {
+			is_of__cpu_architecture: {
+				$select: 'slug',
+			},
+		},
+	} satisfies BalenaSdk.PineOptions<BalenaSdk.DeviceType>;
+	const deviceType = (await sdk.models.deviceType.get(
+		deviceTypeSlug,
+		pineOptions,
+	)) as BalenaSdk.PineTypedResult<BalenaSdk.DeviceType, typeof pineOptions>;
+	const allCpuArches = await sdk.pine.get({
+		resource: 'cpu_architecture',
+		options: {
+			$select: ['id', 'slug'],
+		},
+	});
 
-	const allDeviceTypes = await sdk.models.config.getDeviceTypes();
-	const deviceTypeManifest = _.find(allDeviceTypes, { slug: deviceType });
-	if (!deviceTypeManifest) {
-		throw new ExpectedError(`"${deviceType}" is not a valid device type`);
-	}
-	const compatibleDeviceTypes = _(allDeviceTypes)
-		.filter(
-			(dt) =>
-				sdk.models.os.isArchitectureCompatibleWith(
-					deviceTypeManifest.arch,
-					dt.arch,
-				) &&
-				!!dt.isDependent === !!deviceTypeManifest.isDependent &&
-				dt.state !== 'DISCONTINUED',
+	const compatibleCpuArchIds = allCpuArches
+		.filter((cpuArch) =>
+			sdk.models.os.isArchitectureCompatibleWith(
+				deviceType.is_of__cpu_architecture[0].slug,
+				cpuArch.slug,
+			),
 		)
-		.map((type) => type.slug)
-		.value();
+		.map((cpu) => cpu.id);
 
 	if (!appName) {
-		return createOrSelectApp(sdk, compatibleDeviceTypes, deviceType);
+		return createOrSelectApp(
+			sdk,
+			{
+				is_for__device_type: {
+					$any: {
+						$alias: 'dt',
+						$expr: {
+							dt: {
+								is_of__cpu_architecture: { $in: compatibleCpuArchIds },
+							},
+						},
+					},
+				},
+			},
+			deviceTypeSlug,
+		);
 	}
 
-	const options: BalenaSdk.PineOptions<BalenaSdk.Application> = {
+	const options = {
 		$expand: {
-			is_for__device_type: { $select: 'slug' },
+			is_for__device_type: { $select: ['slug', 'is_of__cpu_architecture'] },
 		},
-	};
+	} satisfies BalenaSdk.PineOptions<BalenaSdk.Application>;
 
 	// Check for a fleet slug of the form `user/fleet` and update the API query.
 	let name: string;
 	const match = appName.split('/');
 	if (match.length > 1) {
 		// These will match at most one fleet
-		options.$filter = { slug: appName.toLowerCase() };
+		(options as BalenaSdk.PineOptions<BalenaSdk.Application>).$filter = {
+			slug: appName.toLowerCase(),
+		};
 		name = match[1];
 	} else {
 		// We're given an application; resolve it if it's ambiguous and also validate
 		// it's of appropriate device type.
-		options.$filter = { app_name: appName };
+		(options as BalenaSdk.PineOptions<BalenaSdk.Application>).$filter = {
+			app_name: appName,
+		};
 		name = appName;
 	}
 
 	const applications = (await sdk.models.application.getAllDirectlyAccessible(
 		options,
-	)) as ApplicationWithDeviceType[];
+	)) as Array<BalenaSdk.PineTypedResult<BalenaSdk.Application, typeof options>>;
 
 	if (applications.length === 0) {
 		await confirm(
@@ -257,13 +331,16 @@ async function getOrSelectApplication(
 			undefined,
 			true,
 		);
-		return await createApplication(sdk, deviceType, name);
+		return await createApplication(sdk, deviceTypeSlug, name);
 	}
 
 	// We've found at least one fleet with the given name.
 	// Filter out fleets for non-matching device types and see what we're left with.
+	const compatibleCpuArchIdsSet = new Set(compatibleCpuArchIds);
 	const validApplications = applications.filter((app) =>
-		_.includes(compatibleDeviceTypes, app.is_for__device_type[0].slug),
+		compatibleCpuArchIdsSet.has(
+			app.is_for__device_type[0].is_of__cpu_architecture.__id,
+		),
 	);
 
 	if (validApplications.length === 0) {
@@ -279,21 +356,14 @@ async function getOrSelectApplication(
 
 async function createOrSelectApp(
 	sdk: BalenaSdk.BalenaSDK,
-	compatibleDeviceTypes: string[],
+	compatibleDeviceTypesFilter: BalenaSdk.PineFilter<BalenaSdk.Application>,
 	deviceType: string,
-): Promise<ApplicationWithDeviceType> {
+): Promise<ApplicationWithDeviceTypeSlug> {
 	// No fleet specified, show a list to select one.
 	const applications = (await sdk.models.application.getAllDirectlyAccessible({
 		$expand: { is_for__device_type: { $select: 'slug' } },
-		$filter: {
-			is_for__device_type: {
-				$any: {
-					$alias: 'dt',
-					$expr: { dt: { slug: { $in: compatibleDeviceTypes } } },
-				},
-			},
-		},
-	})) as ApplicationWithDeviceType[];
+		$filter: compatibleDeviceTypesFilter,
+	})) as ApplicationWithDeviceTypeSlug[];
 
 	if (applications.length === 0) {
 		await confirm(
@@ -313,7 +383,7 @@ async function createApplication(
 	sdk: BalenaSdk.BalenaSDK,
 	deviceType: string,
 	name?: string,
-): Promise<ApplicationWithDeviceType> {
+): Promise<ApplicationWithDeviceTypeSlug> {
 	const validation = await import('./validation');
 
 	const username = await sdk.auth.whoami();
@@ -334,13 +404,7 @@ async function createApplication(
 				try {
 					await sdk.models.application.getDirectlyAccessible(appName, {
 						$filter: {
-							$or: [
-								{ slug: { $startswith: `${username!.toLowerCase()}/` } },
-								// TODO: do we still need the following filter? Is it for
-								// old openBalena instances where slugs were equal to the
-								// app name and did not contain the slash character?
-								{ $not: { slug: { $contains: '/' } } },
-							],
+							slug: { $startswith: `${username!.toLowerCase()}/` },
 						},
 					});
 					// TODO: This is the only example in the codebase where `printErrorMessage()`
@@ -367,12 +431,12 @@ async function createApplication(
 		$expand: {
 			is_for__device_type: { $select: 'slug' },
 		},
-	})) as ApplicationWithDeviceType;
+	})) as ApplicationWithDeviceTypeSlug;
 }
 
 async function generateApplicationConfig(
 	sdk: BalenaSdk.BalenaSDK,
-	app: ApplicationWithDeviceType,
+	app: ApplicationWithDeviceTypeSlug,
 	options: {
 		version: string;
 		appUpdatePollInterval?: number;
@@ -380,7 +444,7 @@ async function generateApplicationConfig(
 ) {
 	const { generateApplicationConfig: configGen } = await import('./config');
 
-	const manifest = await sdk.models.device.getManifestBySlug(
+	const manifest = await sdk.models.config.getDeviceTypeManifestBySlug(
 		app.is_for__device_type[0].slug,
 	);
 	const opts =

lib/utils/qemu.ts

@@ -21,7 +21,7 @@ import { ExpectedError } from '../errors';
 import { getBalenaSdk, stripIndent } from './lazy';
 import Logger = require('./logger');
 
-export const QEMU_VERSION = 'v6.0.0+balena1';
+export const QEMU_VERSION = 'v7.0.0+balena1';
 export const QEMU_BIN_NAME = 'qemu-execve';
 
 export function qemuPathInContext(context: string) {

lib/utils/remote-build.ts

@@ -17,7 +17,7 @@ import type { BalenaSDK } from 'balena-sdk';
 import * as JSONStream from 'JSONStream';
 import * as readline from 'readline';
 import * as request from 'request';
-import { RegistrySecrets } from 'resin-multibuild';
+import { RegistrySecrets } from '@balena/compose/dist/multibuild';
 import type * as Stream from 'stream';
 import streamToPromise = require('stream-to-promise');
 import type { Pack } from 'tar-stream';

lib/utils/sdk.ts

@@ -20,11 +20,21 @@ import type {
 	BalenaSDK,
 	Organization,
 	PineOptions,
+	PineTypedResult,
 } from 'balena-sdk';
 
+export async function getApplication(
+	sdk: BalenaSDK,
+	nameOrSlugOrId: string | number,
+): Promise<Application>;
+export async function getApplication<TP extends PineOptions<Application>>(
+	sdk: BalenaSDK,
+	nameOrSlugOrId: string | number,
+	options?: TP,
+): Promise<PineTypedResult<Application, TP>>;
 /**
  * Get a fleet object, disambiguating the fleet identifier which may be a
- * a fleet slug, name or numeric database ID (as a string).
+ * a fleet slug or name.
  * TODO: add support for fleet UUIDs.
  */
 export async function getApplication(
@@ -32,46 +42,27 @@ export async function getApplication(
 	nameOrSlugOrId: string | number,
 	options?: PineOptions<Application>,
 ): Promise<Application> {
-	const { looksLikeFleetSlug, looksLikeInteger } = await import('./validation');
+	const { looksLikeFleetSlug } = await import('./validation');
 	if (
 		typeof nameOrSlugOrId === 'string' &&
-		looksLikeFleetSlug(nameOrSlugOrId)
+		!looksLikeFleetSlug(nameOrSlugOrId)
 	) {
-		return await sdk.models.application.getDirectlyAccessible(
+		// Not a slug: must be an app name.
+		// TODO: revisit this logic when we add support for fleet UUIDs.
+		return await sdk.models.application.getAppByName(
 			nameOrSlugOrId,
 			options,
+			'directly_accessible',
 		);
 	}
-	if (typeof nameOrSlugOrId === 'number' || looksLikeInteger(nameOrSlugOrId)) {
-		try {
-			// Test for existence of app with this numerical ID
-			return await sdk.models.application.getDirectlyAccessible(
-				Number(nameOrSlugOrId),
-				options,
-			);
-		} catch (e) {
-			if (typeof nameOrSlugOrId === 'number') {
-				throw e;
-			}
-			const { instanceOf } = await import('../errors');
-			const { BalenaApplicationNotFound } = await import('balena-errors');
-			if (!instanceOf(e, BalenaApplicationNotFound)) {
-				throw e;
-			}
-			// App with this numerical ID not found, but there may be an app with this numerical name.
-		}
-	}
-	// Not a slug and not a numeric database ID: must be an app name.
-	// TODO: revisit this logic when we add support for fleet UUIDs.
-	return await sdk.models.application.getAppByName(
+	return await sdk.models.application.getDirectlyAccessible(
 		nameOrSlugOrId,
 		options,
-		'directly_accessible',
 	);
 }
 
 /**
- * Given a fleet name, slug or numeric database ID, return its slug.
+ * Given a fleet name or slug, return its slug.
  * This function conditionally makes an async SDK/API call to retrieve the
  * application object, which can be wasteful if the application object is
  * required before or after the call to this function. If this is the case,
@@ -79,38 +70,50 @@ export async function getApplication(
  */
 export async function getFleetSlug(
 	sdk: BalenaSDK,
-	nameOrSlugOrId: string | number,
+	nameOrSlug: string,
 ): Promise<string> {
 	const { looksLikeFleetSlug } = await import('./validation');
-	if (
-		typeof nameOrSlugOrId === 'string' &&
-		looksLikeFleetSlug(nameOrSlugOrId)
-	) {
-		return nameOrSlugOrId.toLowerCase();
+	if (!looksLikeFleetSlug(nameOrSlug)) {
+		// Not a slug: must be an app name.
+		// TODO: revisit this logic when we add support for fleet UUIDs.
+		return (await getApplication(sdk, nameOrSlug, { $select: 'slug' })).slug;
 	}
-	return (await getApplication(sdk, nameOrSlugOrId)).slug;
+	return nameOrSlug.toLowerCase();
 }
 
+export async function getOwnOrganizations(
+	sdk: BalenaSDK,
+): Promise<Organization[]>;
+export async function getOwnOrganizations<TP extends PineOptions<Organization>>(
+	sdk: BalenaSDK,
+	options: TP,
+): Promise<Array<PineTypedResult<Organization, TP>>>;
 /**
  * Wraps the sdk organization.getAll method,
  * restricting to those orgs user is a member of
  */
 export async function getOwnOrganizations(
 	sdk: BalenaSDK,
+	options?: PineOptions<Organization>,
 ): Promise<Organization[]> {
-	return await sdk.models.organization.getAll({
-		$filter: {
-			organization_membership: {
-				$any: {
-					$alias: 'orm',
-					$expr: {
-						orm: {
-							user: await sdk.auth.getUserId(),
+	return await sdk.models.organization.getAll(
+		sdk.utils.mergePineOptions(
+			{
+				$filter: {
+					organization_membership: {
+						$any: {
+							$alias: 'orm',
+							$expr: {
+								orm: {
+									user: await sdk.auth.getUserId(),
+								},
+							},
 						},
 					},
 				},
+				$orderby: 'name asc',
 			},
-		},
-		$orderby: 'name asc',
-	});
+			options,
+		),
+	);
 }

lib/utils/ssh.ts

@@ -151,23 +151,23 @@ export async function runRemoteCommand({
 	let exitCode: number | undefined;
 	let exitSignal: NodeJS.Signals | undefined;
 	try {
-		[exitCode, exitSignal] = await new Promise<[number, NodeJS.Signals]>(
-			(resolve, reject) => {
-				const ps = spawn(program, args, { stdio })
-					.on('error', reject)
-					.on('close', (code, signal) => resolve([code, signal]));
+		[exitCode, exitSignal] = await new Promise((resolve, reject) => {
+			const ps = spawn(program, args, { stdio })
+				.on('error', reject)
+				.on('close', (code, signal) =>
+					resolve([code ?? undefined, signal ?? undefined]),
+				);
 
-				if (ps.stdin && stdin && typeof stdin !== 'string') {
-					stdin.pipe(ps.stdin);
-				}
-				if (ps.stdout && stdout && typeof stdout !== 'string') {
-					ps.stdout.pipe(stdout);
-				}
-				if (ps.stderr && stderr && typeof stderr !== 'string') {
-					ps.stderr.pipe(stderr);
-				}
-			},
-		);
+			if (ps.stdin && stdin && typeof stdin !== 'string') {
+				stdin.pipe(ps.stdin);
+			}
+			if (ps.stdout && stdout && typeof stdout !== 'string') {
+				ps.stdout.pipe(stdout);
+			}
+			if (ps.stderr && stderr && typeof stderr !== 'string') {
+				ps.stderr.pipe(stderr);
+			}
+		});
 	} catch (error) {
 		const msg = [
 			`ssh failed with exit code=${exitCode} signal=${exitSignal}:`,

lib/utils/update.ts

@@ -19,8 +19,10 @@ import * as UpdateNotifier from 'update-notifier';
 
 import packageJSON = require('../../package.json');
 
-// Check for an update once a day. 1 day granularity should be
-// enough, rather than every run.
+// Check for an update at most once a day. 1 day granularity should be
+// enough, rather than every run. Note because we show the information
+// from the *last* time we ran, if the cli has not been run for a while
+// the update info can be out of date.
 const balenaUpdateInterval = 1000 * 60 * 60 * 24 * 1;
 
 let notifier: UpdateNotifier.UpdateNotifier;

lib/utils/version.ts

@@ -21,13 +21,3 @@ import { version } from '../../package.json';
 export function isVersionGTE(v: string): boolean {
 	return semver.gte(process.env.BALENA_CLI_VERSION_OVERRIDE || version, v);
 }
-
-let v14: boolean;
-
-/** Feature switch for the next major version of the CLI */
-export function isV14(): boolean {
-	if (v14 === undefined) {
-		v14 = isVersionGTE('14.0.0');
-	}
-	return v14;
-}

package.json

@@ -1,6 +1,6 @@
 {
   "name": "balena-cli",
-  "version": "13.4.1",
+  "version": "16.7.5",
   "description": "The official balena Command Line Interface",
   "main": "./build/app.js",
   "homepage": "https://github.com/balena-io/balena-cli",
@@ -27,9 +27,8 @@
     "scripts": [
       "build/**/*.js",
       "node_modules/balena-sdk/es2018/index.js",
-      "node_modules/balena-sync/build/**/*.js",
       "node_modules/pinejs-client-request/node_modules/pinejs-client-core/es2018/index.js",
-      "node_modules/resin-compose-parse/build/schemas/*.json"
+      "node_modules/@balena/compose/dist/parse/schemas/*.json"
     ],
     "assets": [
       "build/auth/pages/*.ejs",
@@ -90,12 +89,11 @@
   "author": "Balena Inc. (https://balena.io/)",
   "license": "Apache-2.0",
   "engines": {
-    "node": ">=12.8.0 <13.0.0",
-    "npm": "<7.0.0"
+    "node": ">=16 <18"
   },
   "husky": {
     "hooks": {
-      "pre-commit": "node automation/check-npm-version.js && node automation/check-doc.js"
+      "pre-commit": "node automation/check-npm-version.js && ts-node automation/check-doc.ts"
     }
   },
   "oclif": {
@@ -115,7 +113,8 @@
     ]
   },
   "devDependencies": {
-    "@balena/lint": "^6.2.0",
+    "@balena/lint": "^6.2.2",
+    "@electron/notarize": "^2.0.0",
     "@oclif/config": "^1.18.2",
     "@oclif/parser": "^3.8.6",
     "@octokit/plugin-throttling": "^3.5.1",
@@ -127,13 +126,14 @@
     "@types/chai-as-promised": "^7.1.4",
     "@types/cli-truncate": "^2.0.0",
     "@types/common-tags": "^1.8.1",
-    "@types/dockerode": "^3.3.8",
+    "@types/dockerode": "^3.3.9",
     "@types/ejs": "^3.1.0",
     "@types/express": "^4.17.13",
     "@types/fs-extra": "^9.0.13",
     "@types/global-agent": "^2.1.1",
     "@types/global-tunnel-ng": "^2.1.1",
     "@types/http-proxy": "^1.17.8",
+    "@types/inquirer": "^7.3.3",
     "@types/intercept-stdout": "^0.1.0",
     "@types/is-root": "^2.1.2",
     "@types/js-yaml": "^4.0.5",
@@ -147,7 +147,7 @@
     "@types/ndjson": "^2.0.1",
     "@types/net-keepalive": "^0.4.1",
     "@types/nock": "^11.1.0",
-    "@types/node": "^12.20.42",
+    "@types/node": "^16.18.25",
     "@types/node-cleanup": "^2.1.2",
     "@types/parse-link-header": "^1.0.1",
     "@types/prettyjson": "^0.0.30",
@@ -171,7 +171,6 @@
     "cross-env": "^7.0.3",
     "deep-object-diff": "^1.1.0",
     "diff": "^5.0.0",
-    "electron-notarize": "^1.0.0",
     "ent": "^2.2.0",
     "filehound": "^1.17.5",
     "fs-extra": "^9.1.0",
@@ -184,16 +183,17 @@
     "mocha": "^8.4.0",
     "mock-require": "^3.0.3",
     "nock": "^13.2.1",
-    "parse-link-header": "^1.0.1",
-    "pkg": "^5.5.1",
+    "parse-link-header": "^2.0.0",
+    "pkg": "^5.8.1",
     "publish-release": "^1.6.1",
     "rewire": "^5.0.0",
-    "simple-git": "^2.48.0",
+    "simple-git": "^3.14.1",
     "sinon": "^11.1.2",
     "ts-node": "^10.4.0",
-    "typescript": "^4.5.4"
+    "typescript": "^5.1.3"
   },
   "dependencies": {
+    "@balena/compose": "^3.0.2",
     "@balena/dockerignore": "^1.0.2",
     "@balena/es-version": "^1.0.1",
     "@oclif/command": "^1.8.16",
@@ -201,19 +201,16 @@
     "@sentry/node": "^6.16.1",
     "@types/fast-levenshtein": "0.0.1",
     "@types/update-notifier": "^4.1.1",
-    "JSONStream": "^1.0.3",
     "balena-config-json": "^4.2.0",
     "balena-device-init": "^6.0.0",
-    "balena-errors": "^4.7.1",
+    "balena-errors": "^4.7.3",
     "balena-image-fs": "^7.0.6",
-    "balena-image-manager": "^7.1.1",
-    "balena-preload": "^12.0.0",
-    "balena-release": "^3.2.0",
-    "balena-sdk": "^16.9.0",
+    "balena-image-manager": "^9.0.0",
+    "balena-preload": "^14.0.0",
+    "balena-sdk": "^17.8.0",
     "balena-semver": "^2.3.0",
-    "balena-settings-client": "^4.0.7",
+    "balena-settings-client": "^5.0.2",
     "balena-settings-storage": "^7.0.0",
-    "balena-sync": "^11.0.2",
     "bluebird": "^3.7.2",
     "body-parser": "^1.19.1",
     "chalk": "^3.0.0",
@@ -225,11 +222,10 @@
     "common-tags": "^1.7.2",
     "denymount": "^2.3.0",
     "docker-modem": "3.0.0",
-    "docker-progress": "^5.0.1",
-    "docker-qemu-transpose": "^1.1.1",
-    "dockerode": "^3.3.1",
+    "docker-progress": "^5.1.3",
+    "dockerode": "3.3.3",
     "ejs": "^3.1.6",
-    "etcher-sdk": "^6.2.1",
+    "etcher-sdk": "^8.5.3",
     "event-stream": "3.3.4",
     "express": "^4.17.2",
     "fast-boot2": "^1.1.0",
@@ -245,6 +241,7 @@
     "is-elevated": "^3.0.0",
     "is-root": "^2.1.0",
     "js-yaml": "^4.1.0",
+    "JSONStream": "^1.0.3",
     "klaw": "^3.0.0",
     "livepush": "^3.5.1",
     "lodash": "^4.17.21",
@@ -263,10 +260,9 @@
     "reconfix": "^1.0.0-v0-1-0-fork-46760acff4d165f5238bfac5e464256ef1944476",
     "request": "^2.88.2",
     "resin-cli-form": "^2.0.2",
-    "resin-cli-visuals": "^1.8.0",
-    "resin-compose-parse": "^2.1.3",
+    "resin-cli-visuals": "^1.8.3",
+    "resin-discoverable-services": "^2.0.4",
     "resin-doodles": "^0.2.0",
-    "resin-multibuild": "^4.12.2",
     "resin-stream-logger": "^0.1.2",
     "rimraf": "^3.0.2",
     "semver": "^7.3.5",
@@ -288,6 +284,6 @@
     "windosu": "^0.3.0"
   },
   "versionist": {
-    "publishedAt": "2022-04-11T16:10:47.566Z"
+    "publishedAt": "2023-07-21T06:59:21.487Z"
   }
 }

patches/all/@oclif+parser+3.8.10.patch

@@ -1,24 +1,24 @@
 diff --git a/node_modules/@oclif/parser/lib/errors.js b/node_modules/@oclif/parser/lib/errors.js
-index 0c93a81..95d06be 100644
+index 39936e3..23e3925 100644
 --- a/node_modules/@oclif/parser/lib/errors.js
 +++ b/node_modules/@oclif/parser/lib/errors.js
-@@ -13,7 +13,8 @@ const m = deps_1.default()
+@@ -14,7 +14,8 @@ const m = deps_1.default()
      .add('list', () => require('./list'));
  class CLIParseError extends errors_1.CLIError {
      constructor(options) {
 -        options.message += '\nSee more help with --help';
-+        const help = options.command ? `\`${options.command} --help\`` : '--help';
-+        options.message += `\nSee more help with ${help}`;
++    		const help = options.command ? `\`${options.command} --help\`` : '--help';
++    		options.message += `\nSee more help with ${help}`;
          super(options.message);
          this.parse = options.parse;
      }
-@@ -34,22 +35,24 @@ class InvalidArgsSpecError extends CLIParseError {
+@@ -35,22 +36,24 @@ class InvalidArgsSpecError extends CLIParseError {
  exports.InvalidArgsSpecError = InvalidArgsSpecError;
  class RequiredArgsError extends CLIParseError {
      constructor({ args, parse }) {
 -        let message = `Missing ${args.length} required arg${args.length === 1 ? '' : 's'}`;
-+        const command = 'balena ' + parse.input.context.id.replace(/:/g, ' ');
-+        let message = `Missing ${args.length} required argument${args.length === 1 ? '' : 's'}`;
++    		const command = 'balena ' + parse.input.context.id.replace(/:/g, ' ');
++    		let message = `Missing ${args.length} required argument${args.length === 1 ? '' : 's'}`;
          const namedArgs = args.filter(a => a.name);
          if (namedArgs.length > 0) {
              const list = m.list.renderList(namedArgs.map(a => [a.name, a.description]));
@@ -32,7 +32,7 @@ index 0c93a81..95d06be 100644
  exports.RequiredArgsError = RequiredArgsError;
  class RequiredFlagError extends CLIParseError {
      constructor({ flag, parse }) {
-+        const command = 'balena ' + parse.input.context.id.replace(/:/g, ' ');
++    		const command = 'balena ' + parse.input.context.id.replace(/:/g, ' ');
          const usage = m.list.renderList(m.help.flagUsages([flag], { displayRequired: false }));
          const message = `Missing required flag:\n${usage}`;
 -        super({ parse, message });
@@ -41,15 +41,15 @@ index 0c93a81..95d06be 100644
      }
  }
 diff --git a/node_modules/@oclif/parser/lib/list.js b/node_modules/@oclif/parser/lib/list.js
-index 3907cc0..b689ca1 100644
+index 9d020b7..6ea9eb9 100644
 --- a/node_modules/@oclif/parser/lib/list.js
 +++ b/node_modules/@oclif/parser/lib/list.js
-@@ -21,7 +21,7 @@ function renderList(items) {
+@@ -22,7 +22,7 @@ function renderList(items) {
          }
          left = left.padEnd(maxLength);
          right = linewrap(maxLength + 2, right);
 -        return `${left}  ${right}`;
-+        return `${left} : ${right}`;
++  			return `${left} : ${right}`;
      });
      return lines.join('\n');
  }

patches/all/open+7.4.2.patch

@@ -1,15 +1,16 @@
 diff --git a/node_modules/open/index.js b/node_modules/open/index.js
-index 3bf5373..e042b64 100644
+index 13147d0..ff161dd 100644
 --- a/node_modules/open/index.js
 +++ b/node_modules/open/index.js
-@@ -11,7 +11,9 @@ const pAccess = promisify(fs.access);
- const pExecFile = promisify(childProcess.execFile);
+@@ -10,7 +10,10 @@ const pAccess = promisify(fs.access);
+ const pReadFile = promisify(fs.readFile);
  
  // Path to included `xdg-open`.
 -const localXdgOpenPath = path.join(__dirname, 'xdg-open');
 +const localXdgOpenPath = process.pkg
 +	? path.join(path.dirname(process.execPath), 'xdg-open')
 +	: path.join(__dirname, 'xdg-open');
++
  
- // Convert a path from WSL format to Windows format:
- // `/mnt/c/Program Files/Example/MyApp.exe` → `C:\Program Files\Example\MyApp.exe`
+ /**
+ Get the mount point for fixed drives in WSL.