Add commands device support and fleet support matching support

Change-type: minor

.eslintignore

@@ -0,0 +1,2 @@
+/completion/*
+/bin/*

.eslintrc.js

@@ -0,0 +1,21 @@
+module.exports = {
+	extends: ['./node_modules/@balena/lint/config/.eslintrc.js'],
+	parserOptions: {
+		project: 'tsconfig.dev.json',
+	},
+	root: true,
+	rules: {
+		ignoreDefinitionFiles: 0,
+		// to avoid the `warning  Forbidden non-null assertion  @typescript-eslint/no-non-null-assertion`
+		'@typescript-eslint/no-non-null-assertion': 'off',
+		'@typescript-eslint/no-shadow': 'off',
+		'@typescript-eslint/no-var-requires': 'off',
+		'no-restricted-imports': [
+			'error',
+			{
+				paths: ['resin-cli-visuals', 'chalk', 'common-tags', 'resin-cli-form'],
+			},
+		],
+		'@typescript-eslint/no-unused-vars': ['error', { argsIgnorePattern: '^_' }],
+	},
+};

.github/ISSUE_TEMPLATE.md

@@ -67,7 +67,7 @@ fixed it.
 - **Cloud backend: openBalena or balenaCloud?** If unsure, it will be balenaCloud
 - **Operating system version:** e.g. Windows 10, Ubuntu 18.04, macOS 10.14.5
 - **32/64 bit OS and processor:** e.g. 32-bit Windows on 64-bit Intel processor
-- **Install method:** npm or standalone package or executable installer
+- **Install method:** npm or zip package or executable installer
 - **If npm install, Node.js and npm version:** e.g. Node v8.16.0 and npm v6.4.1
 
 # Additional References

.github/actions/publish/action.yml

@@ -18,7 +18,7 @@ inputs:
     default: 'accounts+apple@balena.io'
   NODE_VERSION:
     type: string
-    default: '22.x'
+    default: '20.x'
   VERBOSE:
     type: string
     default: 'true'
@@ -28,7 +28,7 @@ runs:
   using: 'composite'
   steps:
     - name: Download custom source artifact
-      uses: actions/download-artifact@cc203385981b70ca67e1cc392babf9cc229d5806 # v4.1.9
+      uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
       with:
         name: custom-${{ github.event.pull_request.head.sha || github.event.head_commit.id }}-${{ runner.os }}-${{ runner.arch }}
         path: ${{ runner.temp }}
@@ -39,7 +39,7 @@ runs:
       run: tar -xf ${{ runner.temp }}/custom.tgz
 
     - name: Setup Node.js
-      uses: actions/setup-node@cdca7365b2dadb8aad0a33bc7601856ffabcc48e # v4
+      uses: actions/setup-node@1e60f620b9541d16bece96c5465dc8ee9832be0b # v4
       with:
         node-version: ${{ inputs.NODE_VERSION }}
         cache: npm
@@ -48,7 +48,7 @@ runs:
       if: runner.os == 'macOS'
       uses: actions/setup-python@65d7f2d534ac1bc67fcd62888c5f4f3d2cb2b236 # v4
       with:
-        python-version: '3.11'
+        python-version: "3.11"
 
     - name: Install additional tools
       if: runner.os == 'Windows'
@@ -94,7 +94,7 @@ runs:
         runner_arch="$(echo "${RUNNER_ARCH}" | tr '[:upper:]' '[:lower:]')"
 
         if [[ $runner_os =~ darwin|macos|osx ]]; then
-            CSC_KEY_PASSWORD='${{ fromJSON(inputs.secrets).APPLE_SIGNING_PASSWORD }}'
+            CSC_KEY_PASSWORD=${{ fromJSON(inputs.secrets).APPLE_SIGNING_PASSWORD }}
             CSC_KEYCHAIN=signing_temp
             CSC_LINK=${{ fromJSON(inputs.secrets).APPLE_SIGNING }}
 
@@ -112,8 +112,8 @@ runs:
             PATH="/c/Program Files/DigiCert/DigiCert One Signing Manager Tools:${PATH}"
             smksp_registrar.exe list
             smctl.exe keypair ls
-            smctl.exe windows certsync
             /c/Windows/System32/certutil.exe -csp "DigiCert Signing Manager KSP" -key -user
+            smksp_cert_sync.exe
 
             # (signtool.exe) https://github.com/actions/runner-images/blob/main/images/win/Windows2019-Readme.md#installed-windows-sdks
             PATH="/c/Program Files (x86)/Windows Kits/10/bin/${runner_arch}:${PATH}"
@@ -135,11 +135,9 @@ runs:
         XCODE_APP_LOADER_TEAM_ID: ${{ inputs.XCODE_APP_LOADER_TEAM_ID }}
 
     - name: Upload artifacts
-      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+      uses: actions/upload-artifact@50769540e7f4bd5e21e526ee35c689e35e0d6874 # v4
       with:
         name: gh-release-${{ github.event.pull_request.head.sha || github.event.head_commit.id }}-${{ strategy.job-index }}
-        path: |
-          dist
-          !dist/balena
+        path: dist
         retention-days: 1
         if-no-files-found: error

.github/actions/test/action.yml

@@ -15,7 +15,7 @@ inputs:
   # --- custom environment
   NODE_VERSION:
     type: string
-    default: '22.x'
+    default: '20.x'
   VERBOSE:
     type: string
     default: "true"
@@ -26,7 +26,7 @@ runs:
   steps:
     # https://github.com/actions/setup-node#caching-global-packages-data
     - name: Setup Node.js
-      uses: actions/setup-node@cdca7365b2dadb8aad0a33bc7601856ffabcc48e # v4
+      uses: actions/setup-node@1e60f620b9541d16bece96c5465dc8ee9832be0b # v4
       with:
         node-version: ${{ inputs.NODE_VERSION }}
         cache: npm
@@ -58,7 +58,7 @@ runs:
       run: tar --exclude-vcs -acf ${{ runner.temp }}/custom.tgz .
 
     - name: Upload custom artifact
-      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+      uses: actions/upload-artifact@50769540e7f4bd5e21e526ee35c689e35e0d6874 # v4
       with:
         name: custom-${{ github.event.pull_request.head.sha || github.event.head_commit.id }}-${{ runner.os }}-${{ runner.arch }}
         path: ${{ runner.temp }}/custom.tgz

.github/workflows/flowzone.yml

@@ -26,7 +26,7 @@ jobs:
           "os": [
             ["self-hosted", "X64"],
             ["self-hosted", "ARM64"],
-            ["macos-13"],
+            ["macos-12"],
             ["windows-2019"],
             ["macos-latest-xlarge"]
           ]
@@ -36,7 +36,7 @@ jobs:
           "os": [
             ["self-hosted", "X64"],
             ["self-hosted", "ARM64"],
-            ["macos-13"],
+            ["macos-12"],
             ["windows-2019"],
             ["macos-latest-xlarge"]
           ]

.mocharc.js

@@ -2,7 +2,7 @@ module.exports = {
 	reporter: 'spec',
 	require: 'ts-node/register/transpile-only',
 	file: './tests/config-tests',
-	timeout: 48000,
+	timeout: 12000,
 	// To test only, say, 'push.spec.ts', do it as follows so that
 	// requests are authenticated:
 	// spec: ['tests/auth/*.spec.ts', 'tests/**/deploy.spec.ts'],

CHANGELOG.md

@@ -4,498 +4,6 @@ All notable changes to this project will be documented in this file
 automatically by Versionist. DO NOT EDIT THIS FILE MANUALLY!
 This project adheres to [Semantic Versioning](http://semver.org/).
 
-## 22.1.1 - 2025-06-19
-
-* Deploy: Limit the submitted error_message of images that fail to build to 1000 characters [Thodoris Greasidis]
-
-## 22.1.0 - 2025-06-09
-
-* Add support for node 22 [Otavio Jacobi]
-
-<details>
-<summary> Bump etcher-sdk to v10.0.0 [Otavio Jacobi] </summary>
-
-> ### etcher-sdk-10.0.0 - 2025-06-02
-> 
-> * Drop support to node18 and add support to node 22 & 24 [Otavio Jacobi]
-> 
-
-</details>
-
-## 22.0.6 - 2025-06-02
-
-* Remove `request` dependency [myarmolinsky]
-* Replace `request` usage with `got` [myarmolinsky]
-
-## 22.0.5 - 2025-05-29
-
-
-<details>
-<summary> Bump etcher-sdk to v9.1.4 [Otavio Jacobi] </summary>
-
-> ### etcher-sdk-9.1.4 - 2025-05-29
-> 
-> * Run `npm audit fix` which should only do non-breaking changes [Otavio Jacobi]
-> 
-> ### etcher-sdk-9.1.3 - 2025-02-17
-> 
-> * Embed config.json with a fixed timestamp to enable consistent checksums [Pagan Gazzard]
-> 
-> ### etcher-sdk-9.1.2 - 2024-10-09
-> 
-> * Update dependency unzip-stream to v0.3.2 [SECURITY] [Self-hosted Renovate Bot]
-> 
-> ### etcher-sdk-9.1.1 - 2024-10-09
-> 
-> * patch: add EXLOCK flag for windows [Talha Can Havadar]
-> 
-
-</details>
-
-## 22.0.4 - 2025-05-29
-
-* tests: Replace request with got [Otavio Jacobi]
-* deploy-legacy: Replace request with got [Otavio Jacobi]
-
-## 22.0.3 - 2025-05-29
-
-* Bump sentry to v9 [Otavio Jacobi]
-
-## 22.0.2 - 2025-05-28
-
-* Fix balena build to work with --nologs [Otavio Jacobi]
-
-## 22.0.1 - 2025-05-28
-
-* DeviceAPI: Move away from `request` in favor of BalenaSdk request [myarmolinsky]
-* Update `nock` to 14.0.4 [myarmolinsky]
-
-## 22.0.0 - 2025-05-26
-
-* Add migration guide to v22 [Otavio Jacobi]
-* Build standalone without pkg [Otavio Jacobi]
-
-## 21.1.14 - 2025-05-21
-
-
-<details>
-<summary> Bump balena-preload to 18.0.4 [Otavio Jacobi] </summary>
-
-> ### balena-preload-18.0.4 - 2025-05-21
-> 
-> * Fix balena-preload pip deps [Otavio Jacobi]
-> 
-
-</details>
-
-## 21.1.13 - 2025-05-21
-
-
-<details>
-<summary> Bump balena-preload to 18.0.3 [Otavio Jacobi] </summary>
-
-> ### balena-preload-18.0.3 - 2025-03-19
-> 
-> * Update dependency sh to v1.14.3 [balena-renovate[bot]]
-> 
-> ### balena-preload-18.0.2 - 2025-03-19
-> 
-> * Update alpine Docker tag to v3.21 [balena-renovate[bot]]
-> 
-
-</details>
-
-## 21.1.12 - 2025-05-16
-
-* Update @balena/compose dependency to fix error with build secrets. [Ken Bannister]
-
-## 21.1.11 - 2025-05-06
-
-* Fix typos in `os configure` and `config generate` help messages [myarmolinsky]
-
-## 21.1.10 - 2025-05-05
-
-* patch: fix windows signing [Edwin Joassart]
-
-## 21.1.9 - 2025-04-07
-
-
-<details>
-<summary> Update balena-config-json to rely on the balena-image-fs helpers [Thodoris Greasidis] </summary>
-
-> ### balena-config-json-4.2.7 - 2025-04-02
-> 
-> * Fix getBootPartition always warning that the boot partitions were not found [Thodoris Greasidis]
-> 
-> ### balena-config-json-4.2.6 - 2025-04-01
-> 
-> * write: Allow undefined as a value for the deprecated type parameter [Thodoris Greasidis]
-> 
-> <details>
-> <summary> Use the balena-image-fs findPartition() helper to find the boot partition [Thodoris Greasidis] </summary>
-> 
->> #### balena-image-fs-7.5.0 - 2025-03-26
->> 
->> * Add function to find a partition by name/label [Ken Bannister]
->> 
->> #### balena-image-fs-7.4.1 - 2025-02-21
->> 
->> * bump ext2fs to 4.2.4 [Ryan Cooke]
->> 
-> 
-> </details>
-> 
-> 
-> ### balena-config-json-4.2.5 - 2025-03-26
-> 
-> * Update @balena/lint to 9.1.4 [Thodoris Greasidis]
-> 
-> ### balena-config-json-4.2.4 - 2025-03-26
-> 
-> * Switch use ts-mocha instead of manually compiling the tests [Thodoris Greasidis]
-> * Update TypeScript to 5.8.2 [Thodoris Greasidis]
-> 
-> ### balena-config-json-4.2.3 - 2025-03-26
-> 
-> * Update chai to v5 [balena-renovate[bot]]
-> 
-> ### balena-image-fs-7.5.2 - 2025-04-02
-> 
-> * Update dependency jsdoc-to-markdown to v9 [balena-renovate[bot]]
-> 
-> ### balena-image-fs-7.5.1 - 2025-03-26
-> 
-> * Update @balena/lint to v9 [Thodoris Greasidis]
-> * Remove the no longer needed gpt detection helper [Thodoris Greasidis]
-> * Update TypeScript to 5.8.2 [Thodoris Greasidis]
-> * Drop the package-lock.json [Thodoris Greasidis]
-> 
-
-</details>
-
-## 21.1.8 - 2025-04-03
-
-* Update actions/download-artifact action to v4.1.9 [balena-renovate[bot]]
-
-## 21.1.7 - 2025-04-03
-
-* Update actions/upload-artifact digest to ea165f8 [balena-renovate[bot]]
-
-## 21.1.6 - 2025-04-03
-
-* Update actions/setup-node digest to cdca736 [balena-renovate[bot]]
-
-## 21.1.5 - 2025-04-03
-
-* Update dockerode/docker-modem dependencies for fixes [Ken Bannister]
-
-## 21.1.4 - 2025-04-02
-
-* Add comment with secure boot signature file example for preload [Ken Bannister]
-
-## 21.1.3 - 2025-03-28
-
-* Fix device detail for open balena [Otavio Jacobi]
-
-## 21.1.2 - 2025-03-27
-
-* Deny preload for an image with secure boot enabled [Ken Bannister]
-
-## 21.1.1 - 2025-03-26
-
-
-<details>
-<summary> Bump balena-sdk to 21.3.0 [Otavio Jacobi] </summary>
-
-> ### balena-sdk-21.3.0 - 2025-03-26
-> 
-> * device: add `changed_api_heartbeat_state_on__date` to typings [Otavio Jacobi]
-> 
-> ### balena-sdk-21.2.2 - 2025-03-26
-> 
-> * fix  linting [Otavio Jacobi]
-> 
-
-</details>
-
-## 21.1.0 - 2025-03-12
-
-* Add support for new requirement labels feature [Felipe Lalanne]
-
-## 21.0.0 - 2025-03-11
-
-* Drop support for OS versions <2.14.0 [myarmolinsky]
-* api-key generate: Add required argument `expiryDate` [myarmolinsky]
-* Update `balena-preload` to 18.0.1 [myarmolinsky]
-* Add dependency `date-fns` [myarmolinsky]
-* Update `balena-sdk` to 21.2.1 [myarmolinsky]
-
-## 20.2.10 - 2025-03-10
-
-* Update TypeScript to 5.8.2 [Thodoris Greasidis]
-
-## 20.2.9 - 2025-02-26
-
-* Fix CORS issue with X-Balena-Client header [Thodoris Greasidis]
-
-## 20.2.8 - 2025-02-26
-
-* Update balena-config-json dependency and fix test [Ken Bannister]
-
-## 20.2.7 - 2025-02-25
-
-* Use the CLI version in the X-Balena-Client header [Thodoris Greasidis]
-
-## 20.2.6 - 2025-02-25
-
-* Update actions/upload-artifact digest to 4cec3d8 [balena-renovate[bot]]
-
-## 20.2.5 - 2025-02-25
-
-* Update actions/setup-node digest to 1d0ff46 [balena-renovate[bot]]
-
-## 20.2.4 - 2025-02-25
-
-* Pin docker-modem and dockerode to avoid regression [Ken Bannister]
-
-## 20.2.3 - 2025-01-15
-
-* Remove unused old eslint version files [Otavio Jacobi]
-
-## 20.2.2 - 2025-01-12
-
-* Use the promises namespace of balena-image-fs [Thodoris Greasidis]
-
-<details>
-<summary> Update balena-device-init to 8.1.3 & balena-image-fs to 7.3.0 [Thodoris Greasidis] </summary>
-
-> ### balena-image-fs-7.3.0 - 2025-01-06
-> 
-> * Drop Bluebird from devDependencies [Thodoris Greasidis]
-> * flowzone: Remove empty with clause [Thodoris Greasidis]
-> * Add the promises namespace as part of the exposed fs [Thodoris Greasidis]
-> 
-> ### balena-image-fs-7.2.2 - 2024-01-02
-> 
-> * Update dependency @types/node to v20 [Self-hosted Renovate Bot]
-> 
-> ### balena-image-fs-7.2.1 - 2023-12-19
-> 
-> * Remove repo config from flowzone.yml [Kyle Harding]
-> 
-> ### balena-image-fs-7.2.0 - 2023-01-20
-> 
-> * Add support for Node 18 [Akis Kesoglou]
-> 
-> ### balena-image-fs-7.1.2 - 2023-01-05
-> 
-> * Update dependencies [ab77]
-> 
-> ### balena-image-fs-7.1.1 - 2022-12-20
-> 
-> * Update dependency jsdoc-to-markdown to 8.0.0 [Renovate Bot]
-> 
-> ### balena-image-fs-7.1.0 - 2022-12-13
-> 
-> * update dependencies [Zane Hitchcox]
-> 
-> ### balena-device-init-8.1.3 - 2025-01-09
-> 
-> * README: Remove the travisci badge [Thodoris Greasidis]
-> 
-> ### balena-device-init-8.1.2 - 2025-01-09
-> 
-> 
-> <details>
-> <summary> Use the promises namespace of balena-image-fs [Thodoris Greasidis] </summary>
-> 
->> #### balena-image-fs-7.3.0 - 2025-01-06
->> 
->> * Drop Bluebird from devDependencies [Thodoris Greasidis]
->> * flowzone: Remove empty with clause [Thodoris Greasidis]
->> * Add the promises namespace as part of the exposed fs [Thodoris Greasidis]
->> 
->> #### balena-image-fs-7.2.2 - 2024-01-02
->> 
->> * Update dependency @types/node to v20 [Self-hosted Renovate Bot]
->> 
->> #### balena-image-fs-7.2.1 - 2023-12-19
->> 
->> * Remove repo config from flowzone.yml [Kyle Harding]
->> 
->> #### balena-image-fs-7.2.0 - 2023-01-20
->> 
->> * Add support for Node 18 [Akis Kesoglou]
->> 
->> #### balena-image-fs-7.1.2 - 2023-01-05
->> 
->> * Update dependencies [ab77]
->> 
->> #### balena-image-fs-7.1.1 - 2022-12-20
->> 
->> * Update dependency jsdoc-to-markdown to 8.0.0 [Renovate Bot]
->> 
->> #### balena-image-fs-7.1.0 - 2022-12-13
->> 
->> * update dependencies [Zane Hitchcox]
->> 
-> 
-> </details>
-> 
-> 
-> ### balena-device-init-8.1.1 - 2025-01-06
-> 
-> * Convert some parts to async await and simplify [Thodoris Greasidis]
-> * Avoid unnecessary destructuring [Thodoris Greasidis]
-> 
-
-</details>
-
-## 20.2.1 - 2025-01-01
-
-
-<details>
-<summary> Update balena-preload to 17.0.0 [Thodoris Greasidis] </summary>
-
-> ### balena-preload-17.0.0 - 2024-10-21
-> 
-> * Improve typings [Thodoris Greasidis]
-> * Stop returning Bluebird promises & drop it from the dependencies [Thodoris Greasidis]
-> 
-
-</details>
-
-## 20.2.0 - 2024-12-31
-
-
-<details>
-<summary> os configure: Give precedence to the boot partition located in the image over the device-type.json contents [Thodoris Greasidis] </summary>
-
-> ### balena-device-init-8.1.0 - Invalid date
-> 
-> * Try to find the boot partition by inspecting the image [Thodoris Greasidis]
-> 
-> ### balena-device-init-8.0.1 - 2024-12-19
-> 
-> * Drop the unnecessary eslint.config.js [Thodoris Greasidis]
-> * packacke.json: Explicitly set type commonjs [Thodoris Greasidis]
-> 
-
-</details>
-
-## 20.1.6 - 2024-12-30
-
-* Add more realistic os configure tests [Thodoris Greasidis]
-
-## 20.1.5 - 2024-12-20
-
-* Update shrinkwrapped express to v4.21.2 [Oskar Williams]
-
-## 20.1.4 - 2024-12-20
-
-
-<details>
-<summary> Update balena-device-init to 8.0.0 [Thodoris Greasidis] </summary>
-
-> ### balena-device-init-8.0.0 - 2024-12-18
-> 
-> * Avoid running linting in the custom tests [Thodoris Greasidis]
-> * Stop returning Bluebird promises [Thodoris Greasidis]
-> * package: Publish only the build & typings folders [Thodoris Greasidis]
-> * Convert to TypeScript with es6 module notation [Thodoris Greasidis]
-> * Replace gulp, coffeelint & mochainon with tsc, @balena/lint, mocha, chai & sinon [Thodoris Greasidis]
-> * Drop support for node <20.6.0 [Thodoris Greasidis]
-> 
-> ### balena-device-init-7.0.2 - 2024-12-17
-> 
-> * flowzone: Update runner versions [Thodoris Greasidis]
-> * Pin etcher-sdk to 9.0.8 to match resin-device-operations and fix tests [Thodoris Greasidis]
-> 
-
-</details>
-
-## 20.1.3 - 2024-12-20
-
-* Update oclif to 4.17.0 and @oclif/core 4.1.0 [Otavio Jacobi]
-
-## 20.1.2 - 2024-12-17
-
-* Remove unnecessary `Promise.resolve` and `Promise.reject` [Pagan Gazzard]
-
-## 20.1.1 - 2024-12-16
-
-* Update @balena/lint to v9.1.3 [Otavio Jacobi]
-
-## 20.1.0 - 2024-12-12
-
-* `device os-update`: Add handling for updates that require takeover [myarmolinsky]
-* Update `balena-sdk` [myarmolinsky]
-* Update `@balena/compose` [myarmolinsky]
-
-## 20.0.9 - 2024-12-05
-
-* Update shrinkwrapped express to v4.21.1 [Oskar Williams]
-
-## 20.0.8 - 2024-12-04
-
-* Run test and publish with macos-13 [Otavio Jacobi]
-
-## 20.0.7 - 2024-11-23
-
-* Update TypeScript to 5.7.2 [Thodoris Greasidis]
-
-## 20.0.6 - 2024-11-08
-
-* Refactor balena build for clarity [Thodoris Greasidis]
-
-## 20.0.5 - 2024-11-05
-
-* Update actions/upload-artifact digest to b4b15b8 [balena-renovate[bot]]
-
-## 20.0.4 - 2024-11-05
-
-* Update actions/setup-node digest to 39370e3 [balena-renovate[bot]]
-
-## 20.0.3 - 2024-11-05
-
-* api-key generate: Display a descriptive error when the generation fails due to a stale JWT [Thodoris Greasidis]
-
-## 20.0.2 - 2024-10-29
-
-* Restore ability to cat key into `ssh-key add` [myarmolinsky]
-
-## 20.0.1 - 2024-10-29
-
-* Fix sending input to some aliases not working [myarmolinsky]
-
-## 20.0.0 - 2024-10-25
-
-* `device update`: Use detached HUP for os updates [jaomaloy]
-* Drop `-h` flag for help and stop manually adding `help` per command in favor of oclif automatically adding it [myarmolinsky]
-* Stop checking for very old, long-removed commands [myarmolinsky]
-* Deprecate `devices supported` command in favor of `device-type list` [myarmolinsky]
-* Deprecate `notes` command in favor of `device note` [myarmolinsky]
-* Deprecate `tunnel` command in favor of `device tunnel` [myarmolinsky]
-* Deprecate `env add` in favor of `env set` [myarmolinsky]
-* Deprecate `ssh` command in favor of `device ssh` [myarmolinsky]
-* Deprecate `logs` command in favor of `device logs` [myarmolinsky]
-* Deprecate `scan` command in favor of `device detect` [myarmolinsky]
-* Deprecate `orgs` command in favor of `organization list` [myarmolinsky]
-* Deprecate `tags` command in favor of `tag list` [myarmolinsky]
-* Deprecate `envs` command in favor of `env list` [myarmolinsky]
-* Deprecate `key` commands in favor of `ssh-key` [myarmolinsky]
-* Deprecate `keys` command in favor of `key list` [myarmolinsky]
-* Deprecate `releases` command in favor of `release list` [myarmolinsky]
-* Deprecate `fleets` command in favor of `fleet list` [myarmolinsky]
-* Deprecate `api-keys` command in favor of `api-key list` [myarmolinsky]
-* Deprecate `devices` command in favor of `device list` [myarmolinsky]
-* Docs: Show whether an alias is deprecated [myarmolinsky]
-* Update `balena-preload` to 16.0.0 [myarmolinsky]
-* Tests: Drop unused `my_application` resource mock [myarmolinsky]
-* Rename `device.overall_status` values: `IDLE` to `OPERATIONAL`, `OFFLINE` to `DISCONNECTED`; add `REDUCED_FUNCTIONALITY` [myarmolinsky]
-* Update `@balena/compose` to 5.0.0 [myarmolinsky]
-* Bump balena-sdk to 20.3.0 [myarmolinsky]
-
 ## 19.16.0 - 2024-10-23
 
 * device-type list: Add `--all` flag for including no longer supported device types in the list [myarmolinsky]

CONTRIBUTING.md

@@ -14,7 +14,7 @@ The balena CLI is an open source project and your contribution is welcome!
 In order to ease development:
 
 * `npm run build:fast` skips some of the build steps for interactive testing, or
-* `npm run test:source` skips testing the standalone packages (which is rather slow)
+* `npm run test:source` skips testing the standalone zip packages (which is rather slow)
 * `./bin/balena-dev` uses `ts-node/register` to transpile on the fly.
 
 Before opening a PR, test your changes with `npm test`. Keep compatibility in mind, as the CLI is

INSTALL-ADVANCED.md

@@ -8,8 +8,8 @@ There are 3 options to choose from to install balena's CLI:
 
 * [Executable Installer](#executable-installer): the easiest method on Windows and macOS, using the
   traditional graphical desktop application installers.
-* [Standalone tar.gz Package](#standalone-targz-package): these are plain tar.gz files with the balena CLI
-  bundled within. Available for all platforms: Linux, Windows, macOS.
+* [Standalone Zip Package](#standalone-zip-package): these are plain zip files with the balena CLI
+  executable in them: extract and run. Available for all platforms: Linux, Windows, macOS.
   Recommended also for scripted installation in CI (continuous integration) environments.
 * [NPM Installation](#npm-installation): recommended for Node.js developers who may be interested
   in integrating the balena CLI in their existing projects or workflow.
@@ -30,9 +30,9 @@ instructions:
 > If you would like to use WSL, follow the [installations instructions for
 > Linux](./INSTALL-LINUX.md) rather than Windows, as WSL consists of a Linux environment.
 
-If you had previously installed the CLI using a standalone tar package, it may be a good idea to
+If you had previously installed the CLI using a standalone zip package, it may be a good idea to
 check your system's `PATH` environment variable for duplicate entries, as the terminal will use the
-entry that comes first. Check the [Standalone tar.gz Package](#standalone-targz-package) instructions
+entry that comes first. Check the [Standalone Zip Package](#standalone-zip-package) instructions
 for how to modify the PATH variable.
 
 By default, the CLI is installed to the following folders:
@@ -42,17 +42,18 @@ OS  | Folders
 Windows: | `C:\Program Files\balena-cli\`
 macOS:   | `/usr/local/src/balena-cli/` <br> `/usr/local/bin/balena`
 
-## Standalone tar.gz Package
+## Standalone Zip Package
 
-1. Download the latest tar.gz file from the [releases page](https://github.com/balena-io/balena-cli/releases).
+1. Download the latest zip file from the [releases page](https://github.com/balena-io/balena-cli/releases).
    Look for a file name that ends with the word "standalone", for example:  
-   `balena-cli-vX.Y.Z-linux-x64-standalone.tar.gz`  ← _also for the Windows Subsystem for Linux_  
-   `balena-cli-vX.Y.Z-macOS-x64-standalone.tar.gz`
-   `balena-cli-vX.Y.Z-windows-x64-standalone.tar.gz`
+   `balena-cli-vX.Y.Z-linux-x64-standalone.zip`  ← _also for the Windows Subsystem for Linux_  
+   `balena-cli-vX.Y.Z-macOS-x64-standalone.zip`  
+   `balena-cli-vX.Y.Z-windows-x64-standalone.zip`
 
-2. Extract the tar.gz file contents to any folder you choose. The extracted contents will be a `balena` folder containing a `bin` subdirectory.
+2. Extract the zip file contents to any folder you choose. The extracted contents will include a
+   `balena-cli` folder.
 
-3. Add the `balena/bin` folder to the system's `PATH` environment variable.
+3. Add the `balena-cli` folder to the system's `PATH` environment variable.  
    See instructions for:
    [Linux](https://stackoverflow.com/questions/14637979/how-to-permanently-set-path-on-linux-unix) |
    [macOS](https://www.architectryan.com/2012/10/02/add-to-the-path-on-mac-os-x-mountain-lion/#.Uydjga1dXDg) |
@@ -60,14 +61,14 @@ macOS:   | `/usr/local/src/balena-cli/` <br> `/usr/local/bin/balena`
 
 > * If you are using macOS 10.15 or later (Catalina, Big Sur), [check this known issue and
 >   workaround](https://github.com/balena-io/balena-cli/issues/2244).
-> * **Linux Alpine** and **Busybox:** the standalone tar.gz package is not currently compatible with
+> * **Linux Alpine** and **Busybox:** the standalone zip package is not currently compatible with
 >   these "compact" Linux distributions, because of the alternative C libraries they ship with.
 >   For these, consider the [NPM Installation](#npm-installation) option.
-> * Note that moving the `balena/bin/balena` executable out of the extracted `balena` folder on its own
+> * Note that moving the `balena` executable out of the extracted `balena-cli` folder on its own
 >   (e.g. moving it to `/usr/local/bin/balena`) will **not** work, as it depends on the other
->   folders and files also present in the `balena` folder.
+>   folders and files also present in the `balena-cli` folder.
 
-To update the CLI to a new version, download a new release tar.gz file and replace the previous
+To update the CLI to a new version, download a new release zip file and replace the previous
 installation folder. To uninstall, simply delete the folder and edit the PATH environment variable
 as described above.
 
@@ -77,8 +78,8 @@ If you are a Node.js developer, you may wish to install the balena CLI via [npm]
 The npm installation involves building native (platform-specific) binary modules, which require
 some development tools to be installed first, as follows.
 
-> **The balena CLI currently requires Node.js version >=20.6.0**
-> **Versions 23 and later are not yet fully supported.**
+> **The balena CLI currently requires Node.js version ^20.6.0**
+> **Versions 21 and later are not yet fully supported.**
 
 ### Install development tools
 
@@ -88,7 +89,7 @@ some development tools to be installed first, as follows.
 $ sudo apt-get update && sudo apt-get -y install curl python3 git make g++
 $ curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.38.0/install.sh | bash
 $ . ~/.bashrc
-$ nvm install 22
+$ nvm install 20
 ```
 
 The `curl` command line above uses
@@ -105,7 +106,7 @@ recommended.
 ```sh
 $ curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.38.0/install.sh | bash
 $ . ~/.bashrc
-$ nvm install 22
+$ nvm install 20
 ```
 
 #### **Windows** (not WSL)
@@ -113,7 +114,7 @@ $ nvm install 22
 Install:
 
   * If you'd like the ability to switch between Node.js versions, install
-- Node.js v22 from the [Nodejs.org releases page](https://nodejs.org/en/download/releases/).
+- Node.js v20 from the [Nodejs.org releases page](https://nodejs.org/en/download/releases/).
     [nvm-windows](https://github.com/coreybutler/nvm-windows#node-version-manager-nvm-for-windows)
     instead.
 * The [MSYS2 shell](https://www.msys2.org/), which provides `git`, `make`, `g++` and more:

INSTALL-LINUX.md

@@ -8,15 +8,15 @@ method.
 
 Selected operating system: **Linux**
 
-1. Download the latest tar.gz file from the [latest release
+1. Download the latest zip file from the [latest release
    page](https://github.com/balena-io/balena-cli/releases/latest). Look for a file name that ends
-   with "-standalone.tar.gz", for example:  
-   `balena-cli-vX.Y.Z-linux-x64-standalone.tar.gz`
+   with "-standalone.zip", for example:  
+   `balena-cli-vX.Y.Z-linux-x64-standalone.zip`
 
-2. Extract the tar.gz file contents to any folder you choose, for example `/home/james`.
-   The extracted contents will include a `balena/bin` folder.
+2. Extract the zip file contents to any folder you choose, for example `/home/james`.
+   The extracted contents will include a `balena-cli` folder.
 
-3. Add that folder (e.g. `/home/james/balena/bin`) to the `PATH` environment variable.
+3. Add that folder (e.g. `/home/james/balena-cli`) to the `PATH` environment variable.
    Check this [StackOverflow
    post](https://stackoverflow.com/questions/14637979/how-to-permanently-set-path-on-linux-unix)
    for instructions. Close and reopen the terminal window so that the changes to `PATH`
@@ -27,7 +27,7 @@ Selected operating system: **Linux**
    * `balena version` - should print the CLI's version
    * `balena help` - should print a list of available commands
 
-To update the balena CLI to a new version, download a new release tar.gz file and replace the previous
+To update the balena CLI to a new version, download a new release zip file and replace the previous
 installation folder. To uninstall, simply delete the folder and edit the PATH environment variable
 as described above.
 

INSTALL-MAC.md

@@ -7,8 +7,8 @@ Selected operating system: **macOS**
 
 1. Download the installer from the [latest release
    page](https://github.com/balena-io/balena-cli/releases/latest).
-   Look for a file name that ends with "-installer.pkg":
-   `balena-cli-vX.Y.Z-macOS-x64-installer.pkg`
+   Look for a file name that ends with "-installer.pkg":  
+   `balena-cli-vX.Y.Z-macOS-x64-installer.pkg`  
 
 2. Double click on the downloaded file to run the installer and follow the installer's
    instructions.

INSTALL-WINDOWS.md

@@ -8,7 +8,7 @@ Selected operating system: **Windows**
 1. Download the installer from the [latest release
    page](https://github.com/balena-io/balena-cli/releases/latest).
    Look for a file name that ends with "-installer.exe":  
-   `balena-cli-vX.Y.Z-windows-x64-installer.exe`
+   `balena-cli-vX.Y.Z-windows-x64-installer.exe`  
 
 2. Double click on the downloaded file to run the installer and follow the installer's
    instructions.

MIGRATIONS.md

@@ -1,45 +0,0 @@
-## Migrating to balena CLI v22
-
-This guide outlines the changes introduced in balena CLI v22 and provides instructions for when and how to migrate.
-
----
-
-### For Installer Users (Windows .exe, macOS .pkg)
-
-If you are using the Windows executable (.exe) or macOS package (.pkg) installers, **no changes** are required for this update. You can continue to use the installers as before.
-
----
-
-### For npm Installation Users
-
-If you installed balena CLI via npm, **no changes** are required for this update. Your existing installation and update process remains the same.
-
----
-
-### For Standalone Installation Users
-
-Users of the standalone balena CLI will need to make the following adjustments:
-
-1.  **Archive Format Change**: The distribution archive format has changed from `.zip` to `.tar.gz`. You will need to use the `tar` command instead of `unzip` to extract the CLI.
-
-    * **Previous command (v21.x.x and older):**
-        ```bash
-        unzip balena-cli-v21.1.12-linux-x64-standalone.zip
-        ```
-    * **New command (v22.0.0 and newer):**
-        ```bash
-        tar -xzf balena-cli-v22.0.0-linux-x64-standalone.tar.gz
-        ```
-
-2.  **Executable Path Change**: The path to the balena CLI executable within the extracted folder has been updated.
-
-    * **Previous path (v21.x.x and older):**
-        ```
-        balena-cli/balena
-        ```
-    * **New path (v22.0.0 and newer):**
-        ```
-        balena/bin/balena
-        ```
-
-Please update your scripts and any aliases to reflect these changes if you are using the standalone version.

README.md

@@ -20,8 +20,6 @@ GitHub](https://github.com/balena-io/balena-cli/), and your contribution is also
 Check the [balena CLI installation instructions on
 GitHub](https://github.com/balena-io/balena-cli/blob/master/INSTALL.md).
 
-Note for v22 Migration: If you are upgrading to balena CLI v22 from a previous standalone installation, please [see the v22 Migration Guide](https://github.com/balena-io/balena-cli/blob/master/MIGRATIONS.md) for installation changes.
-
 ## Choosing a shell (command prompt/terminal)
 
 On **Windows,** the standard Command Prompt (`cmd.exe`) and

TROUBLESHOOTING.md

@@ -115,7 +115,7 @@ If nothing seems to help, consider also using a different client-side terminal a
 ## "Docker seems to be unavailable" error when using Windows Subsystem for Linux (WSL)
 
 When running on WSL, the recommendation is to install a CLI release for Linux, like the standalone
-tar.gz package for Linux. However, commands like "balena build" will, by default, attempt to reach the
+zip package for Linux. However, commands like "balena build" will, by default, attempt to reach the
 Docker daemon at the Unix socket path `/var/run/docker.sock`, while Docker Desktop for Windows uses
 a Windows named pipe at `//./pipe/docker_engine` (which the Linux CLI on WSL cannot use). A
 solution is:

automation/build-bin.ts

@@ -15,17 +15,29 @@
  * limitations under the License.
  */
 
+import type { JsonVersions } from '../src/commands/version/index';
+
 import { run as oclifRun } from '@oclif/core';
+import * as archiver from 'archiver';
 import { exec, execFile } from 'child_process';
+import * as filehound from 'filehound';
 import type { Stats } from 'fs';
 import * as fs from 'fs-extra';
 import * as klaw from 'klaw';
 import * as path from 'path';
 import * as rimraf from 'rimraf';
+import * as semver from 'semver';
 import { promisify } from 'util';
 import { notarize } from '@electron/notarize';
 
-import { loadPackageJson, ROOT, whichSpawn } from './utils';
+import { stripIndent } from '../build/utils/lazy';
+import {
+	diffLines,
+	loadPackageJson,
+	ROOT,
+	StdOutTap,
+	whichSpawn,
+} from './utils';
 
 const execFileAsync = promisify(execFile);
 const execAsync = promisify(exec);
@@ -43,6 +55,12 @@ interface PathByPlatform {
 	[platform: string]: string;
 }
 
+const standaloneZips: PathByPlatform = {
+	linux: dPath(`balena-cli-${version}-linux-${arch}-standalone.zip`),
+	darwin: dPath(`balena-cli-${version}-macOS-${arch}-standalone.zip`),
+	win32: dPath(`balena-cli-${version}-windows-${arch}-standalone.zip`),
+};
+
 const getOclifInstallersOriginalNames = async (): Promise<PathByPlatform> => {
 	const { stdout } = await execAsync('git rev-parse --short HEAD');
 	const sha = stdout.trim();
@@ -57,28 +75,260 @@ const renamedOclifInstallers: PathByPlatform = {
 	win32: dPath(`balena-cli-${version}-windows-${arch}-installer.exe`),
 };
 
-const getOclifStandaloneOriginalNames = async (): Promise<PathByPlatform> => {
-	const { stdout } = await execAsync('git rev-parse --short HEAD');
-	const sha = stdout.trim();
-	return {
-		linux: dPath(`balena-${version}-${sha}-linux-${arch}.tar.gz`),
-		darwin: dPath(`balena-${version}-${sha}-darwin-${arch}.tar.gz`),
-		win32: dPath(`balena-${version}-${sha}-win32-${arch}.tar.gz`),
-	};
+export const finalReleaseAssets: { [platform: string]: string[] } = {
+	win32: [standaloneZips['win32'], renamedOclifInstallers['win32']],
+	darwin: [standaloneZips['darwin'], renamedOclifInstallers['darwin']],
+	linux: [standaloneZips['linux']],
 };
 
-const renamedOclifStandalone: PathByPlatform = {
-	linux: dPath(`balena-cli-${version}-linux-${arch}-standalone.tar.gz`),
-	darwin: dPath(`balena-cli-${version}-macOS-${arch}-standalone.tar.gz`),
-	win32: dPath(`balena-cli-${version}-windows-${arch}-standalone.tar.gz`),
-};
+/**
+ * Given the output of `pkg` as a string (containing warning messages),
+ * diff it against previously saved output of known "safe" warnings.
+ * Throw an error if the diff is not empty.
+ */
+async function diffPkgOutput(pkgOut: string) {
+	const { monochrome } = await import('../tests/helpers');
+	const relSavedPath = path.join(
+		'tests',
+		'test-data',
+		'pkg',
+		`expected-warnings-${process.platform}-${arch}.txt`,
+	);
+	const absSavedPath = path.join(ROOT, relSavedPath);
+	const ignoreStartsWith = [
+		'> pkg@',
+		'> Fetching base Node.js binaries',
+		'  fetched-',
+		'prebuild-install WARN install No prebuilt binaries found',
+	];
+	const modulesRE =
+		process.platform === 'win32'
+			? /(?<=[ '])([A-Z]:)?\\.+?\\node_modules(?=\\)/
+			: /(?<=[ '])\/.+?\/node_modules(?=\/)/;
+	const buildRE =
+		process.platform === 'win32'
+			? /(?<=[ '])([A-Z]:)?\\.+\\build(?=\\)/
+			: /(?<=[ '])\/.+\/build(?=\/)/;
+
+	const cleanLines = (chunks: string | string[]) => {
+		const lines = typeof chunks === 'string' ? chunks.split('\n') : chunks;
+		return lines
+			.map((line: string) => monochrome(line)) // remove ASCII colors
+			.filter((line: string) => !/^\s*$/.test(line)) // blank lines
+			.filter((line: string) =>
+				ignoreStartsWith.every((i) => !line.startsWith(i)),
+			)
+			.map((line: string) => {
+				// replace absolute paths with relative paths
+				let replaced = line.replace(modulesRE, 'node_modules');
+				if (replaced === line) {
+					replaced = line.replace(buildRE, 'build');
+				}
+				return replaced;
+			});
+	};
+
+	pkgOut = cleanLines(pkgOut).join('\n');
+	const { readFile } = (await import('fs')).promises;
+	const expectedOut = cleanLines(await readFile(absSavedPath, 'utf8')).join(
+		'\n',
+	);
+	if (expectedOut !== pkgOut) {
+		const sep =
+			'================================================================================';
+		const diff = diffLines(expectedOut, pkgOut);
+		const msg = `pkg output does not match expected output from "${relSavedPath}"
+Diff:
+${sep}
+${diff}
+${sep}
+Check whether the new or changed pkg warnings are safe to ignore, then update
+"${relSavedPath}"
+and share the result of your investigation as comments on the pull request.
+Hint: the fix is often a matter of updating the 'pkg.scripts' or 'pkg.assets'
+sections in the CLI's 'package.json' file, or a matter of updating the
+'buildPkg' function in 'automation/build-bin.ts'.  Sometimes it requires
+patching dependencies: See for example 'patches/all/open+7.0.2.patch'.
+${sep}
+`;
+		throw new Error(msg);
+	}
+}
+
+/**
+ * Call `pkg.exec` to generate the standalone zip file, capturing its warning
+ * messages (stdout and stderr) in order to call diffPkgOutput().
+ */
+async function execPkg(...args: any[]) {
+	const { exec: pkgExec } = await import('@yao-pkg/pkg');
+	const outTap = new StdOutTap(true);
+	try {
+		outTap.tap();
+		await (pkgExec as any)(...args);
+	} catch (err) {
+		outTap.untap();
+		console.log(outTap.stdoutBuf.join(''));
+		console.error(outTap.stderrBuf.join(''));
+		throw err;
+	}
+	outTap.untap();
+	await diffPkgOutput(outTap.allBuf.join(''));
+}
+
+/**
+ * Use the 'pkg' module to create a single large executable file with
+ * the contents of 'node_modules' and the CLI's javascript code.
+ * Also copy a number of native modules (binary '.node' files) that are
+ * compiled during 'npm install' to the 'build-bin' folder, alongside
+ * the single large executable file created by pkg. (This is necessary
+ * because of a pkg limitation that does not allow binary executables
+ * to be directly executed from inside another binary executable.)
+ */
+async function buildPkg() {
+	// https://github.com/vercel/pkg#targets
+	let targets = `linux-${arch}`;
+	if (process.platform === 'darwin') {
+		targets = `macos-${arch}`;
+	}
+	// TBC: not yet possible to build for Windows arm64 on x64 nodes
+	if (process.platform === 'win32') {
+		targets = `win-x64`;
+	}
+	const args = [
+		'--targets',
+		targets,
+		'--output',
+		'build-bin/balena',
+		'package.json',
+	];
+	console.log('=======================================================');
+	console.log(`execPkg ${args.join(' ')}`);
+	console.log(`cwd="${process.cwd()}" ROOT="${ROOT}"`);
+	console.log('=======================================================');
+
+	await execPkg(args);
+
+	const paths: Array<[string, string[], string[]]> = [
+		// [platform, [source path], [destination path]]
+		['*', ['open', 'xdg-open'], ['xdg-open']],
+		['darwin', ['denymount', 'bin', 'denymount'], ['denymount']],
+	];
+	await Promise.all(
+		paths.map(([platform, source, dest]) => {
+			if (platform === '*' || platform === process.platform) {
+				// eg copy from node_modules/open/xdg-open to build-bin/xdg-open
+				return fs.copy(
+					path.join(ROOT, 'node_modules', ...source),
+					path.join(ROOT, 'build-bin', ...dest),
+				);
+			}
+		}),
+	);
+	const nativeExtensionPaths: string[] = await filehound
+		.create()
+		.paths(path.join(ROOT, 'node_modules'))
+		.ext(['node', 'dll'])
+		.find();
+
+	console.log(`\nCopying to build-bin:\n${nativeExtensionPaths.join('\n')}`);
+
+	await Promise.all(
+		nativeExtensionPaths.map((extPath) =>
+			fs.copy(
+				extPath,
+				extPath.replace(
+					path.join(ROOT, 'node_modules'),
+					path.join(ROOT, 'build-bin'),
+				),
+			),
+		),
+	);
+}
+
+/**
+ * Run some basic tests on the built pkg executable.
+ * TODO: test more than just `balena version -j`; integrate with the
+ * existing mocha/chai CLI command testing.
+ */
+async function testPkg() {
+	const pkgBalenaPath = path.join(
+		ROOT,
+		'build-bin',
+		process.platform === 'win32' ? 'balena.exe' : 'balena',
+	);
+	console.log(`Testing standalone package "${pkgBalenaPath}"...`);
+	// Run `balena version -j`, parse its stdout as JSON, and check that the
+	// reported Node.js major version matches semver.major(process.version)
+	let { stdout, stderr } = await execFileAsync(pkgBalenaPath, [
+		'version',
+		'-j',
+	]);
+	const { filterCliOutputForTests } = await import('../tests/helpers');
+	const filtered = filterCliOutputForTests({
+		err: stderr.split(/\r?\n/),
+		out: stdout.split(/\r?\n/),
+	});
+	stdout = filtered.out.join('\n');
+	stderr = filtered.err.join('\n');
+	let pkgNodeVersion = '';
+	let pkgNodeMajorVersion = 0;
+	try {
+		const balenaVersions: JsonVersions = JSON.parse(stdout);
+		pkgNodeVersion = balenaVersions['Node.js'];
+		pkgNodeMajorVersion = semver.major(pkgNodeVersion);
+	} catch (err) {
+		throw new Error(stripIndent`
+			Error parsing JSON output of "balena version -j": ${err}
+			Original output: "${stdout}"`);
+	}
+	if (semver.major(process.version) !== pkgNodeMajorVersion) {
+		throw new Error(
+			`Mismatched major version: built-in pkg Node version="${pkgNodeVersion}" vs process.version="${process.version}"`,
+		);
+	}
+	if (filtered.err.length > 0) {
+		const err = filtered.err.join('\n');
+		throw new Error(`"${pkgBalenaPath}": non-empty stderr "${err}"`);
+	}
+	console.log('Success! (standalone package test successful)');
+}
+
+/**
+ * Create the zip file for the standalone 'pkg' bundle previously created
+ * by the buildPkg() function in 'build-bin.ts'.
+ */
+async function zipPkg() {
+	const outputFile = standaloneZips[process.platform];
+	if (!outputFile) {
+		throw new Error(
+			`Standalone installer unavailable for platform "${process.platform}"`,
+		);
+	}
+	await fs.mkdirp(path.dirname(outputFile));
+	await new Promise((resolve, reject) => {
+		console.log(`Zipping standalone package to "${outputFile}"...`);
+
+		const archive = archiver('zip', {
+			zlib: { level: 7 },
+		});
+		archive.directory(path.join(ROOT, 'build-bin'), 'balena-cli');
+
+		const outputStream = fs.createWriteStream(outputFile);
+
+		outputStream.on('close', resolve);
+		outputStream.on('error', reject);
+
+		archive.on('error', reject);
+		archive.on('warning', console.warn);
+
+		archive.pipe(outputStream);
+		archive.finalize().catch(reject);
+	});
+}
 
 export async function signFilesForNotarization() {
 	console.log('Signing files for notarization');
-	// If signFilesForNotarization is called on the test CI environment (which will not set CSC_LINK)
-	// then we skip the signing process.
-	if (process.platform !== 'darwin' || !process.env.CSC_LINK) {
-		console.log('Skipping signing for notarization');
+	if (process.platform !== 'darwin') {
 		return;
 	}
 	console.log('Deleting unneeded zip files...');
@@ -166,39 +416,20 @@ export async function signFilesForNotarization() {
 	]);
 }
 
-export async function buildStandalone() {
-	console.log(`Building standalone tarball for CLI ${version}`);
-	fs.rmSync('./tmp', { recursive: true, force: true });
-	fs.rmSync('./dist', { recursive: true, force: true });
-	fs.mkdirSync('./dist');
+export async function buildStandaloneZip() {
+	console.log(`Building standalone zip package for CLI ${version}`);
 	try {
-		let packOpts = ['-r', ROOT, '--no-xz'];
-		if (process.platform === 'darwin') {
-			packOpts = packOpts.concat('--targets', `darwin-${arch}`);
-		} else if (process.platform === 'win32') {
-			packOpts = packOpts.concat('--targets', 'win32-x64');
-		} else if (process.platform === 'linux') {
-			packOpts = packOpts.concat('--targets', `linux-${arch}`);
-		}
-
-		console.log(`Building oclif installer for CLI ${version}`);
-		const packCmd = `pack:tarballs`;
-		console.log('=======================================================');
-		console.log(`oclif ${packCmd} ${packOpts.join(' ')}`);
-		console.log(`cwd="${process.cwd()}" ROOT="${ROOT}"`);
-		console.log('=======================================================');
-		const oclifPath = path.join(ROOT, 'node_modules', 'oclif');
-		await oclifRun([packCmd].concat(...packOpts), oclifPath);
-		await renameStandalone();
-
-		console.log(`Standalone tarball package build completed`);
+		await buildPkg();
+		await testPkg();
+		await zipPkg();
+		console.log(`Standalone zip package build completed`);
 	} catch (error) {
-		console.error(`Error creating or testing standalone tarball package`);
+		console.error(`Error creating or testing standalone zip package`);
 		throw error;
 	}
 }
 
-async function renameInstallers() {
+async function renameInstallerFiles() {
 	const oclifInstallers = await getOclifInstallersOriginalNames();
 	if (await fs.pathExists(oclifInstallers[process.platform])) {
 		await fs.rename(
@@ -208,16 +439,6 @@ async function renameInstallers() {
 	}
 }
 
-async function renameStandalone() {
-	const oclifStandalone = await getOclifStandaloneOriginalNames();
-	if (await fs.pathExists(oclifStandalone[process.platform])) {
-		await fs.rename(
-			oclifStandalone[process.platform],
-			renamedOclifStandalone[process.platform],
-		);
-	}
-}
-
 /**
  * If the CSC_LINK and CSC_KEY_PASSWORD env vars are set, digitally sign the
  * executable installer using Microsoft SignTool.exe (Sign Tool)
@@ -225,7 +446,7 @@ async function renameStandalone() {
  */
 async function signWindowsInstaller() {
 	if (process.env.SM_CODE_SIGNING_CERT_SHA1_HASH) {
-		const exeName = (await getOclifInstallersOriginalNames())[process.platform];
+		const exeName = renamedOclifInstallers[process.platform];
 		console.log(`Signing installer "${exeName}"`);
 		// trust ...
 		await execFileAsync('signtool.exe', [
@@ -259,14 +480,12 @@ async function notarizeMacInstaller(): Promise<void> {
 	const appleId =
 		process.env.XCODE_APP_LOADER_EMAIL || 'accounts+apple@balena.io';
 	const appleIdPassword = process.env.XCODE_APP_LOADER_PASSWORD;
-	const appPath = (await getOclifInstallersOriginalNames())[process.platform];
-	console.log(`Notarizing file "${appPath}"`);
 
 	if (appleIdPassword && teamId) {
 		await notarize({
 			tool: 'notarytool',
 			teamId,
-			appPath,
+			appPath: renamedOclifInstallers.darwin,
 			appleId,
 			appleIdPassword,
 		});
@@ -306,6 +525,7 @@ export async function buildOclifInstaller() {
 		console.log('=======================================================');
 		const oclifPath = path.join(ROOT, 'node_modules', 'oclif');
 		await oclifRun([packCmd].concat(...packOpts), oclifPath);
+		await renameInstallerFiles();
 		// The Windows installer is explicitly signed here (oclif doesn't do it).
 		// The macOS installer is automatically signed by oclif (which runs the
 		// `pkgbuild` tool), using the certificate name given in package.json
@@ -317,7 +537,6 @@ export async function buildOclifInstaller() {
 			await notarizeMacInstaller(); // Notarize
 			console.log('Package notarized.');
 		}
-		await renameInstallers();
 		console.log(`oclif installer build completed`);
 	}
 }
@@ -353,5 +572,4 @@ export async function testShrinkwrap(): Promise<void> {
 	if (process.platform !== 'win32') {
 		await whichSpawn(path.resolve(__dirname, 'test-lock-deduplicated.sh'));
 	}
-	await Promise.resolve();
 }

automation/capitanodoc/capitanodoc.ts

@@ -145,7 +145,7 @@ export async function getCapitanoDoc(): Promise<typeof capitanoDoc> {
 				throw new Error(`Error parsing section title`);
 			}
 			// match[1] has the title, match[2] has the rest
-			return match?.[2];
+			return match && match[2];
 		}),
 		mdParser.getSectionOfTitle('Installation'),
 		mdParser.getSectionOfTitle('Choosing a shell (command prompt/terminal)'),

automation/capitanodoc/markdown.ts

@@ -25,14 +25,7 @@ function renderOclifCommand(command: Category['commands'][0]): string[] {
 	const result = [`## ${ent.encode(command.name || '')}`];
 	if (command.aliases?.length) {
 		result.push('### Aliases');
-		result.push(
-			command.aliases
-				.map(
-					(alias) =>
-						`- \`${alias}\`${command.deprecateAliases ? ' *(deprecated)*' : ''}`,
-				)
-				.join('\n'),
-		);
+		result.push(command.aliases.map((alias) => `- \`${alias}\``).join('\n'));
 		result.push(
 			`\nTo use one of the aliases, replace \`${command.name}\` with the alias.`,
 		);

automation/run.ts

@@ -19,7 +19,7 @@ import * as _ from 'lodash';
 
 import {
 	buildOclifInstaller,
-	buildStandalone,
+	buildStandaloneZip,
 	catchUncommitted,
 	signFilesForNotarization,
 	testShrinkwrap,
@@ -36,7 +36,7 @@ process.env.DEBUG = ['0', 'no', 'false', '', undefined].includes(
  * Trivial command-line parser. Check whether the command-line argument is one
  * of the following strings, then call the appropriate functions:
  *     'build:installer'   (to build a native oclif installer)
- * 	   'build:standalone'  (to build a standalone package)
+ * 	   'build:standalone'  (to build a standalone pkg package)
  *
  * @param args Arguments to parse (default is process.argv.slice(2))
  */
@@ -49,7 +49,7 @@ async function parse(args?: string[]) {
 	}
 	const commands: { [cmd: string]: () => void | Promise<void> } = {
 		'build:installer': buildOclifInstaller,
-		'build:standalone': buildStandalone,
+		'build:standalone': buildStandaloneZip,
 		'sign:binaries': signFilesForNotarization,
 		'catch-uncommitted': catchUncommitted,
 		'test-shrinkwrap': testShrinkwrap,

automation/update-module.ts

@@ -3,7 +3,7 @@ import * as semver from 'semver';
 
 const changeTypes = ['major', 'minor', 'patch'] as const;
 
-const validateChangeType = (maybeChangeType = 'minor') => {
+const validateChangeType = (maybeChangeType: string = 'minor') => {
 	maybeChangeType = maybeChangeType.toLowerCase();
 	switch (maybeChangeType) {
 		case 'patch':
@@ -136,4 +136,5 @@ async function main() {
 	}
 }
 
-void main();
+// eslint-disable-next-line @typescript-eslint/no-floating-promises
+main();

automation/utils.ts

@@ -18,10 +18,72 @@
 import { spawn } from 'child_process';
 import * as path from 'path';
 import * as fs from 'fs';
-import * as whichMod from 'which';
+import { diffTrimmedLines } from 'diff';
 
 export const ROOT = path.join(__dirname, '..');
 
+/** Tap and buffer this process' stdout and stderr */
+export class StdOutTap {
+	public stdoutBuf: string[] = [];
+	public stderrBuf: string[] = [];
+	public allBuf: string[] = []; // both stdout and stderr
+
+	protected origStdoutWrite: typeof process.stdout.write;
+	protected origStderrWrite: typeof process.stdout.write;
+
+	constructor(protected printDots = false) {}
+
+	tap() {
+		this.origStdoutWrite = process.stdout.write;
+		this.origStderrWrite = process.stderr.write;
+
+		process.stdout.write = (chunk: string, ...args: any[]): boolean => {
+			this.stdoutBuf.push(chunk);
+			this.allBuf.push(chunk);
+			const str = this.printDots ? '.' : chunk;
+			return this.origStdoutWrite.call(process.stdout, str, ...args);
+		};
+
+		process.stderr.write = (chunk: string, ...args: any[]): boolean => {
+			this.stderrBuf.push(chunk);
+			this.allBuf.push(chunk);
+			const str = this.printDots ? '.' : chunk;
+			return this.origStderrWrite.call(process.stderr, str, ...args);
+		};
+	}
+
+	untap() {
+		process.stdout.write = this.origStdoutWrite;
+		process.stderr.write = this.origStderrWrite;
+		if (this.printDots) {
+			console.error('');
+		}
+	}
+}
+
+/**
+ * Diff strings by line, using the 'diff' npm package:
+ * https://www.npmjs.com/package/diff
+ */
+export function diffLines(str1: string, str2: string): string {
+	const diffObjs = diffTrimmedLines(str1, str2);
+	const prefix = (chunk: string, char: string) =>
+		chunk
+			.split('\n')
+			.map((line: string) => `${char} ${line}`)
+			.join('\n');
+	const diffStr = diffObjs
+		.map((part: any) => {
+			return part.added
+				? prefix(part.value, '+')
+				: part.removed
+					? prefix(part.value, '-')
+					: prefix(part.value, ' ');
+		})
+		.join('\n');
+	return diffStr;
+}
+
 export function loadPackageJson() {
 	const packageJsonPath = path.join(ROOT, 'package.json');
 
@@ -39,6 +101,7 @@ export function loadPackageJson() {
  * @returns The program's full path, e.g. 'C:\WINDOWS\System32\OpenSSH\ssh.EXE'
  */
 export async function which(program: string): Promise<string> {
+	const whichMod = await import('which');
 	let programPath: string;
 	try {
 		programPath = await whichMod(program);
@@ -69,7 +132,7 @@ export async function whichSpawn(
 					.on('error', reject)
 					.on('close', resolve);
 			} catch (err) {
-				reject(err as Error);
+				reject(err);
 			}
 		});
 	} catch (err) {

bin/dev.js

@@ -57,10 +57,7 @@ require('ts-node').register({
 	project: path.join(rootDir, 'tsconfig.json'),
 	transpileOnly: true,
 });
-void require('../src/app').run(undefined, {
-	dir: __dirname,
-	development: true,
-});
+require('../src/app').run(undefined, { dir: __dirname, development: true });
 
 // Modify package.json oclif paths from build/ -> src/, or vice versa
 function modifyOclifPaths(revert) {

bin/run.js

@@ -5,7 +5,7 @@
 process.env.UV_THREADPOOL_SIZE = '64';
 
 // Disable oclif registering ts-node
-process.env.OCLIF_TS_NODE = '0';
+process.env.OCLIF_TS_NODE = 0;
 
 async function run() {
 	// Use fast-boot to cache require lookups, speeding up startup
@@ -18,4 +18,4 @@ async function run() {
 	await require('../build/app').run(undefined, { dir: __dirname });
 }
 
-void run();
+run();

completion/_balena

@@ -15,9 +15,9 @@ _balena() {
   block_cmds=( create )
   config_cmds=( generate inject read reconfigure write )
   device_type_cmds=( list )
-  device_cmds=( deactivate detect identify init list local-mode logs move note os-update pin public-url purge reboot register rename restart rm shutdown ssh start-service stop-service track-fleet tunnel )
+  device_cmds=( deactivate detect identify init list local-mode logs move note os-update pin public-url purge reboot register rename restart rm shutdown ssh start-service stop-service support track-fleet tunnel )
   env_cmds=( list rename rm set )
-  fleet_cmds=( create list pin purge rename restart rm track-latest )
+  fleet_cmds=( create list pin purge rename restart rm support track-latest )
   internal_cmds=( osinit )
   local_cmds=( configure flash )
   organization_cmds=( list )
@@ -29,7 +29,7 @@ _balena() {
 
   _arguments -C \
     '(- 1 *)--version[show version and exit]' \
-    '(- 1 *)--help[show help options and exit]' \
+    '(- 1 *)'{-h,--help}'[show help options and exit]' \
     '1:first command:_balena_main_cmds' \
     '2:second command:_balena_sec_cmds' \
   && ret=0

completion/balena-completion.bash

@@ -14,9 +14,9 @@ _balena_complete()
   block_cmds="create"
   config_cmds="generate inject read reconfigure write"
   device_type_cmds="list"
-  device_cmds="deactivate detect identify init list local-mode logs move note os-update pin public-url purge reboot register rename restart rm shutdown ssh start-service stop-service track-fleet tunnel"
+  device_cmds="deactivate detect identify init list local-mode logs move note os-update pin public-url purge reboot register rename restart rm shutdown ssh start-service stop-service support track-fleet tunnel"
   env_cmds="list rename rm set"
-  fleet_cmds="create list pin purge rename restart rm track-latest"
+  fleet_cmds="create list pin purge rename restart rm support track-latest"
   internal_cmds="osinit"
   local_cmds="configure flash"
   organization_cmds="list"

completion/templates/zsh.template

@@ -14,7 +14,7 @@ $sub_cmds$
 
   _arguments -C \
     '(- 1 *)--version[show version and exit]' \
-    '(- 1 *)--help[show help options and exit]' \
+    '(- 1 *)'{-h,--help}'[show help options and exit]' \
     '1:first command:_balena_main_cmds' \
     '2:second command:_balena_sec_cmds' \
   && ret=0

docs/balena-cli.md

@@ -13,8 +13,6 @@ GitHub](https://github.com/balena-io/balena-cli/), and your contribution is also
 Check the [balena CLI installation instructions on
 GitHub](https://github.com/balena-io/balena-cli/blob/master/INSTALL.md).
 
-Note for v22 Migration: If you are upgrading to balena CLI v22 from a previous standalone installation, please [see the v22 Migration Guide](https://github.com/balena-io/balena-cli/blob/master/MIGRATIONS.md) for installation changes.
-
 ## Choosing a shell (command prompt/terminal)
 
 On **Windows,** the standard Command Prompt (`cmd.exe`) and
@@ -224,6 +222,7 @@ are encouraged to regularly update the balena CLI to the latest version.
 	- [device ssh](#device-ssh)
 	- [device start-service](#device-start-service)
 	- [device stop-service](#device-stop-service)
+	- [device support](#device-support)
 	- [device track-fleet](#device-track-fleet)
 	- [device tunnel](#device-tunnel)
 
@@ -244,6 +243,7 @@ are encouraged to regularly update the balena CLI to the latest version.
 	- [fleet rename](#fleet-rename)
 	- [fleet restart](#fleet-restart)
 	- [fleet rm](#fleet-rm)
+	- [fleet support](#fleet-support)
 	- [fleet track-latest](#fleet-track-latest)
 
 - Local
@@ -328,8 +328,6 @@ or to authenticate requests to the API with an 'Authorization: Bearer <key>' hea
 Examples:
 
 	$ balena api-key generate "Jenkins Key"
-	$ balena api-key generate "Jenkins Key" 2025-10-30
-	$ balena api-key generate "Jenkins Key" never
 
 ### Arguments
 
@@ -337,15 +335,13 @@ Examples:
 
 the API key name
 
-#### EXPIRYDATE
-
-the expiry date of the API key as an ISO date string, or "never" for no expiry
+### Options
 
 ## api-key list
 
 ### Aliases
 
-- `api-keys` *(deprecated)*
+- `api-keys`
 
 
 To use one of the aliases, replace `api-key list` with the alias.
@@ -390,6 +386,8 @@ Examples:
 
 the API key ids
 
+### Options
+
 # Apps
 
 ## app create
@@ -576,9 +574,9 @@ Generate a config.json file for a device or fleet.
 The target balenaOS version must be specified with the --version option.
 
 The '--dev' option is used to configure balenaOS to operate in development mode,
-allowing unauthenticated root ssh access and exposing network ports such as
+allowing anauthenticated root ssh access and exposing network ports such as
 balenaEngine's 2375 (unencrypted). This option causes `"developmentMode": true`
-to be inserted in the 'config.json' file in the image's boot partition. Development
+to be inserted in the 'config.json' file in the image's boot partion. Development
 mode (as a configurable option) is applicable to balenaOS releases from early
 2022. Older releases have separate development and production balenaOS images
 that cannot be reconfigured through 'config.json' or the '--dev' option. Do not
@@ -1233,7 +1231,7 @@ Docker host TLS key file
 
 ### Aliases
 
-- `devices supported` *(deprecated)*
+- `devices supported`
 
 
 To use one of the aliases, replace `device-type list` with the alias.
@@ -1300,7 +1298,7 @@ answer "yes" to all questions (non interactive use)
 
 ### Aliases
 
-- `scan` *(deprecated)*
+- `scan`
 
 
 To use one of the aliases, replace `device detect` with the alias.
@@ -1350,6 +1348,8 @@ Examples:
 
 the uuid of the device to identify
 
+### Options
+
 ## device
 
 ### Description
@@ -1475,7 +1475,7 @@ expiry date assigned to generated provisioning api key (format: YYYY-MM-DD)
 
 ### Aliases
 
-- `devices` *(deprecated)*
+- `devices`
 
 
 To use one of the aliases, replace `device list` with the alias.
@@ -1556,7 +1556,7 @@ output boolean indicating local mode status
 
 ### Aliases
 
-- `logs` *(deprecated)*
+- `logs`
 
 
 To use one of the aliases, replace `device logs` with the alias.
@@ -1657,7 +1657,7 @@ fleet name or slug (preferred)
 
 ### Aliases
 
-- `notes` *(deprecated)*
+- `notes`
 
 
 To use one of the aliases, replace `device note` with the alias.
@@ -1751,6 +1751,8 @@ the uuid of the device to pin to a release
 
 the commit of the release for the device to get pinned to
 
+### Options
+
 ## device public-url
 
 ### Description
@@ -1807,6 +1809,8 @@ Examples:
 
 comma-separated list (no blank spaces) of device UUIDs
 
+### Options
+
 ## device reboot
 
 ### Description
@@ -1893,6 +1897,8 @@ the uuid of the device to rename
 
 the new name for the device
 
+### Options
+
 ## device restart
 
 ### Description
@@ -1978,7 +1984,7 @@ force action if the update lock is set
 
 ### Aliases
 
-- `ssh` *(deprecated)*
+- `ssh`
 
 
 To use one of the aliases, replace `device ssh` with the alias.
@@ -2072,6 +2078,8 @@ comma-separated list (no blank spaces) of device UUIDs
 
 comma-separated list (no blank spaces) of service names
 
+### Options
+
 ## device stop-service
 
 ### Description
@@ -2096,6 +2104,42 @@ comma-separated list (no blank spaces) of device UUIDs
 
 comma-separated list (no blank spaces) of service names
 
+### Options
+
+## device support
+
+### Description
+
+Grant or revoke balena support agent access to devices
+on balenaCloud. (This command does not apply to openBalena.)
+Access will be automatically revoked once the specified duration has elapsed.
+
+Duration defaults to 24h, but can be specified using --duration flag in days
+or hours, e.g. '12h', '2d'.
+
+Multiple values can specified as a comma-separated list (with no spaces).
+
+Examples:
+
+	balena support enable ab346f,cd457a --duration 3d
+	balena support disable ab346f,cd457a
+
+### Arguments
+
+#### ACTION
+
+enable|disable support access
+
+#### UUID
+
+comma-separated list (no blank spaces) of device UUIDs to be moved
+
+### Options
+
+#### -t, --duration DURATION
+
+length of time to enable support for, in (h)ours or (d)ays, e.g. 12h, 2d
+
 ## device track-fleet
 
 ### Description
@@ -2112,11 +2156,13 @@ Examples:
 
 the uuid of the device to make track the fleet's release
 
+### Options
+
 ## device tunnel
 
 ### Aliases
 
-- `tunnel` *(deprecated)*
+- `tunnel`
 
 
 To use one of the aliases, replace `device tunnel` with the alias.
@@ -2178,7 +2224,7 @@ port mapping in the format <remotePort>[:[localIP:]localPort]
 
 ### Aliases
 
-- `envs` *(deprecated)*
+- `envs`
 
 
 To use one of the aliases, replace `env list` with the alias.
@@ -2396,7 +2442,7 @@ do not prompt for confirmation before deleting the variable
 
 ### Aliases
 
-- `env add` *(deprecated)*
+- `env add`
 
 
 To use one of the aliases, replace `env set` with the alias.
@@ -2563,7 +2609,7 @@ produce JSON output instead of tabular output
 
 ### Aliases
 
-- `fleets` *(deprecated)*
+- `fleets`
 
 
 To use one of the aliases, replace `fleet list` with the alias.
@@ -2608,6 +2654,8 @@ the slug of the fleet to pin to a release
 
 the commit of the release for the fleet to get pinned to
 
+### Options
+
 ## fleet purge
 
 ### Description
@@ -2636,6 +2684,8 @@ Examples:
 
 fleet name or slug (preferred)
 
+### Options
+
 ## fleet rename
 
 ### Description
@@ -2671,6 +2721,8 @@ fleet name or slug (preferred)
 
 the new name for the fleet
 
+### Options
+
 ## fleet restart
 
 ### Description
@@ -2698,6 +2750,8 @@ Examples:
 
 fleet name or slug (preferred)
 
+### Options
+
 ## fleet rm
 
 ### Description
@@ -2734,6 +2788,50 @@ fleet name or slug (preferred)
 
 answer "yes" to all questions (non interactive use)
 
+## fleet support
+
+### Description
+
+Grant or revoke balena support agent access to fleets
+on balenaCloud. (This command does not apply to openBalena.)
+Access will be automatically revoked once the specified duration has elapsed.
+
+Duration defaults to 24h, but can be specified using --duration flag in days
+or hours, e.g. '12h', '2d'.
+
+Multiple values can specified as a comma-separated list (with no spaces).
+
+Fleets may be specified by fleet name or slug. Fleet slugs are
+the recommended option, as they are unique and unambiguous. Slugs can be
+listed with the `balena fleet list` command. Note that slugs may change if the
+fleet is renamed. Fleet names are not unique and may result in  "Fleet is
+ambiguous" errors at any time (even if it "used to work in the past"), for
+example if the name clashes with a newly created public fleet, or with fleets
+from other balena accounts that you may be invited to join under any role.
+For this reason, fleet names are especially discouraged in scripts (e.g. CI
+environments).
+
+Examples:
+
+	balena support enable myorg/myfleet,notmyorg/notmyfleet --duration 3d
+	balena support disable myorg/myfleet
+
+### Arguments
+
+#### ACTION
+
+enable|disable support access
+
+#### FLEET
+
+comma-separated list (no spaces) of fleet names or slugs (preferred)
+
+### Options
+
+#### -t, --duration DURATION
+
+length of time to enable support for, in (h)ours or (d)ays, e.g. 12h, 2d
+
 ## fleet track-latest
 
 ### Description
@@ -2751,6 +2849,8 @@ Examples:
 
 the slug of the fleet to make track the latest release
 
+### Options
+
 # Local
 
 ## local configure
@@ -2770,6 +2870,8 @@ Examples:
 
 path of drive or image to configure
 
+### Options
+
 ## local flash
 
 ### Description
@@ -2810,7 +2912,7 @@ answer "yes" to all questions (non interactive use)
 
 ### Aliases
 
-- `orgs` *(deprecated)*
+- `orgs`
 
 
 To use one of the aliases, replace `organization list` with the alias.
@@ -2823,6 +2925,8 @@ Examples:
 
 	$ balena organization list
 
+### Options
+
 # OS
 
 ## os build-config
@@ -2874,9 +2978,9 @@ The --device-type option is used to override the fleet's default device type,
 in case of a fleet with mixed device types.
 
 The '--dev' option is used to configure balenaOS to operate in development mode,
-allowing unauthenticated root ssh access and exposing network ports such as
+allowing anauthenticated root ssh access and exposing network ports such as
 balenaEngine's 2375 (unencrypted). This option causes `"developmentMode": true`
-to be inserted in the 'config.json' file in the image's boot partition. Development
+to be inserted in the 'config.json' file in the image's boot partion. Development
 mode (as a configurable option) is applicable to balenaOS releases from early
 2022. Older releases have separate development and production balenaOS images
 that cannot be reconfigured through 'config.json' or the '--dev' option. Do not
@@ -3193,6 +3297,8 @@ Examples:
 
 the device IP or hostname
 
+### Options
+
 # Preload
 
 ## preload
@@ -3251,9 +3357,9 @@ fleet name or slug (preferred)
 
 The commit hash of the release to preload. Use "current" to specify the current
 release (ignored if no appId is given). The current release is usually also the
-latest, but can be pinned to a specific release. See:
-https://www.balena.io/docs/learn/deploy/release-strategy/release-policy/
-https://www.balena.io/docs/learn/more/masterclasses/fleet-management/#63-pin-using-the-api
+latest, but can be pinned to a specific release. See:  
+https://www.balena.io/docs/learn/deploy/release-strategy/release-policy/  
+https://www.balena.io/docs/learn/more/masterclasses/fleet-management/#63-pin-using-the-api  
 https://github.com/balena-io-examples/staged-releases
 
 #### -s, --splash-image SPLASH-IMAGE
@@ -3560,6 +3666,8 @@ Examples:
 
 the commit or ID of the release to finalize
 
+### Options
+
 ## release
 
 ### Description
@@ -3613,11 +3721,13 @@ Examples:
 
 the commit or ID of the release to invalidate
 
+### Options
+
 ## release list
 
 ### Aliases
 
-- `releases` *(deprecated)*
+- `releases`
 
 
 To use one of the aliases, replace `release list` with the alias.
@@ -3678,6 +3788,8 @@ Examples:
 
 the commit or ID of the release to validate
 
+### Options
+
 # Settings
 
 ## settings
@@ -3690,13 +3802,15 @@ Examples:
 
 	$ balena settings
 
+### Options
+
 # SSH Keys
 
 ## ssh-key add
 
 ### Aliases
 
-- `key add` *(deprecated)*
+- `key add`
 
 
 To use one of the aliases, replace `ssh-key add` with the alias.
@@ -3738,11 +3852,13 @@ the SSH key name
 
 the path to the public key file
 
+### Options
+
 ## ssh-key
 
 ### Aliases
 
-- `key` *(deprecated)*
+- `key`
 
 
 To use one of the aliases, replace `ssh-key` with the alias.
@@ -3761,12 +3877,14 @@ Examples:
 
 balenaCloud ID for the SSH key
 
+### Options
+
 ## ssh-key list
 
 ### Aliases
 
-- `keys` *(deprecated)*
-- `key list` *(deprecated)*
+- `keys`
+- `key list`
 
 
 To use one of the aliases, replace `ssh-key list` with the alias.
@@ -3779,11 +3897,13 @@ Examples:
 
 	$ balena ssh-key list
 
+### Options
+
 ## ssh-key rm
 
 ### Aliases
 
-- `key rm` *(deprecated)*
+- `key rm`
 
 
 To use one of the aliases, replace `ssh-key rm` with the alias.
@@ -3869,7 +3989,7 @@ length of time to enable support for, in (h)ours or (d)ays, e.g. 12h, 2d
 
 ### Aliases
 
-- `tags` *(deprecated)*
+- `tags`
 
 
 To use one of the aliases, replace `tag list` with the alias.
@@ -4018,6 +4138,8 @@ release id
 List available drives which are usable for writing an OS image to.
 Does not list system drives.
 
+### Options
+
 # Version
 
 ## version

eslint.config.js

@@ -1,32 +0,0 @@
-const { FlatCompat } = require('@eslint/eslintrc');
-
-const compat = new FlatCompat({
-	baseDirectory: __dirname,
-});
-module.exports = [
-	...require('@balena/lint/config/eslint.config'),
-	...compat.config({
-		parserOptions: {
-			project: 'tsconfig.dev.json',
-		},
-		ignorePatterns: ['**/generate-completion.js', '**/bin/**/*'],
-		rules: {
-			ignoreDefinitionFiles: 0,
-			'@typescript-eslint/no-non-null-assertion': 'off',
-			'@typescript-eslint/no-shadow': 'off',
-			'@typescript-eslint/no-var-requires': 'off',
-			'@typescript-eslint/no-require-imports': 'off',
-			'@typescript-eslint/no-unnecessary-type-assertion': 'off',
-			'@typescript-eslint/prefer-nullish-coalescing': 'warn',
-
-			'no-restricted-imports': ['error', {
-				paths: ['resin-cli-visuals', 'chalk', 'common-tags', 'resin-cli-form'],
-			}],
-
-			'@typescript-eslint/no-unused-vars': ['error', {
-				argsIgnorePattern: '^_',
-				caughtErrorsIgnorePattern: '^_',
-			}],
-		},
-	}),
-];

package.json

@@ -1,6 +1,6 @@
 {
   "name": "balena-cli",
-  "version": "22.1.1",
+  "version": "19.16.0",
   "description": "The official balena Command Line Interface",
   "main": "./build/app.js",
   "homepage": "https://github.com/balena-io/balena-cli",
@@ -24,6 +24,26 @@
   "bin": {
     "balena": "./bin/run.js"
   },
+  "pkg": {
+    "scripts": [
+      "build/**/*.js",
+      "node_modules/balena-sdk/es2018/index.js",
+      "node_modules/pinejs-client-request/node_modules/pinejs-client-core/es2018/index.js",
+      "node_modules/@balena/compose/dist/parse/schemas/*.json"
+    ],
+    "assets": [
+      "build/auth/pages/*.ejs",
+      "node_modules/balena-sdk/node_modules/balena-pine/**/*",
+      "node_modules/balena-pine/**/*",
+      "node_modules/pinejs-client-core/**/*",
+      "node_modules/open/xdg-open",
+      "node_modules/windosu/*.bat",
+      "node_modules/windosu/*.cmd",
+      "node_modules/axios/**/*",
+      "npm-shrinkwrap.json",
+      "oclif.manifest.json"
+    ]
+  },
   "scripts": {
     "postinstall": "node patches/apply-patches.js",
     "prebuild": "rimraf build/ build-bin/",
@@ -38,7 +58,6 @@
     "build:completion": "node completion/generate-completion.js",
     "build:standalone": "ts-node --transpile-only automation/run.ts build:standalone",
     "build:installer": "ts-node --transpile-only automation/run.ts build:installer",
-    "deduplicate-dependencies": "npm dd && git add npm-shrinkwrap.json && git commit --message \"Deduplicate dependencies\"",
     "package": "npm run build:fast && npm run build:standalone && npm run build:installer",
     "pretest": "npm run build",
     "test": "npm run test:shrinkwrap && npm run test:core",
@@ -72,7 +91,7 @@
   "author": "Balena Inc. (https://balena.io/)",
   "license": "Apache-2.0",
   "engines": {
-    "node": ">=20.6.0 <23"
+    "node": "^20.6.0"
   },
   "oclif": {
     "bin": "balena",
@@ -92,14 +111,16 @@
     }
   },
   "devDependencies": {
-    "@balena/lint": "^9.1.3",
+    "@balena/lint": "^8.0.0",
     "@electron/notarize": "^2.0.0",
+    "@types/archiver": "^6.0.2",
     "@types/bluebird": "^3.5.36",
     "@types/body-parser": "^1.19.2",
     "@types/chai": "^4.3.0",
     "@types/chai-as-promised": "^7.1.4",
     "@types/cli-truncate": "^2.0.0",
     "@types/common-tags": "^1.8.1",
+    "@types/diff": "^5.0.3",
     "@types/dockerode": "3.3.23",
     "@types/ejs": "^3.1.0",
     "@types/express": "^4.17.13",
@@ -124,6 +145,7 @@
     "@types/node-cleanup": "^2.1.2",
     "@types/prettyjson": "^0.0.33",
     "@types/progress-stream": "^2.0.2",
+    "@types/request": "^2.48.7",
     "@types/rewire": "^2.5.30",
     "@types/rimraf": "^3.0.2",
     "@types/semver": "^7.3.9",
@@ -137,12 +159,16 @@
     "@types/update-notifier": "^4.1.1",
     "@types/which": "^2.0.1",
     "@types/window-size": "^1.1.1",
+    "@yao-pkg/pkg": "^5.11.1",
+    "archiver": "^7.0.1",
     "catch-uncommitted": "^2.0.0",
     "chai": "^4.3.4",
     "chai-as-promised": "^7.1.1",
     "cross-env": "^7.0.3",
     "deep-object-diff": "^1.1.0",
+    "diff": "^5.0.0",
     "ent": "^2.2.0",
+    "filehound": "^1.17.5",
     "fs-extra": "^11.2.0",
     "http-proxy": "^1.18.1",
     "husky": "^9.1.5",
@@ -153,28 +179,28 @@
     "mocha": "^10.6.0",
     "mock-fs": "^5.2.0",
     "mock-require": "^3.0.3",
-    "nock": "^14.0.4",
-    "oclif": "^4.17.0",
+    "nock": "^13.2.1",
+    "oclif": "^4.14.0",
     "rewire": "^7.0.0",
     "simple-git": "^3.14.1",
     "sinon": "^19.0.0",
     "string-to-stream": "^3.0.1",
     "ts-node": "^10.4.0",
-    "typescript": "^5.8.2"
+    "typescript": "^5.6.2"
   },
   "dependencies": {
-    "@balena/compose": "^7.0.9",
+    "@balena/compose": "^4.0.1",
     "@balena/dockerignore": "^1.0.2",
     "@balena/env-parsing": "^1.1.8",
     "@balena/es-version": "^1.0.1",
-    "@oclif/core": "^4.1.0",
-    "@sentry/node": "^9.0.0",
-    "balena-config-json": "^4.2.7",
-    "balena-device-init": "^8.1.11",
+    "@oclif/core": "^4.0.25",
+    "@sentry/node": "^6.16.1",
+    "balena-config-json": "^4.2.0",
+    "balena-device-init": "^7.0.1",
     "balena-errors": "^4.7.3",
-    "balena-image-fs": "^7.5.2",
-    "balena-preload": "^18.0.4",
-    "balena-sdk": "^21.3.0",
+    "balena-image-fs": "^7.0.6",
+    "balena-preload": "^15.0.6",
+    "balena-sdk": "^19.7.3",
     "balena-semver": "^2.3.0",
     "balena-settings-client": "^5.0.2",
     "balena-settings-storage": "^8.1.0",
@@ -185,13 +211,12 @@
     "cli-truncate": "^2.1.0",
     "color-hash": "^1.1.1",
     "common-tags": "^1.7.2",
-    "date-fns": "^4.1.0",
     "denymount": "^2.3.0",
-    "docker-modem": "^5.0.6",
+    "docker-modem": "^5.0.3",
     "docker-progress": "^5.1.3",
-    "dockerode": "^4.0.5",
+    "dockerode": "^4.0.2",
     "ejs": "^3.1.6",
-    "etcher-sdk": "^10.0.0",
+    "etcher-sdk": "9.1.0",
     "express": "^4.17.2",
     "fast-boot2": "^1.1.0",
     "fast-levenshtein": "^3.0.0",
@@ -206,7 +231,6 @@
     "is-root": "^2.1.0",
     "js-yaml": "^4.1.0",
     "JSONStream": "^1.0.3",
-    "jwt-decode": "^3.1.2",
     "livepush": "^3.5.1",
     "lodash": "^4.17.21",
     "mime": "^2.4.6",
@@ -219,8 +243,9 @@
     "prettyjson": "^1.2.5",
     "progress-stream": "^2.0.0",
     "reconfix": "^1.0.0-v0-1-0-fork-46760acff4d165f5238bfac5e464256ef1944476",
-    "resin-cli-form": "^4.0.0",
-    "resin-cli-visuals": "^3.0.0",
+    "request": "^2.88.2",
+    "resin-cli-form": "^3.0.0",
+    "resin-cli-visuals": "^2.0.1",
     "resin-doodles": "^0.2.0",
     "resin-stream-logger": "^0.1.2",
     "rimraf": "^3.0.2",
@@ -248,6 +273,6 @@
     }
   },
   "versionist": {
-    "publishedAt": "2025-06-19T09:32:53.877Z"
+    "publishedAt": "2024-10-23T13:18:19.578Z"
   }
 }

patches/all/@oclif+core+4.0.18.patch

@@ -1,5 +1,5 @@
 diff --git a/node_modules/@oclif/core/lib/help/command.js b/node_modules/@oclif/core/lib/help/command.js
-index 33105a0..0436982 100644
+index 90922c8..6b7f417 100644
 --- a/node_modules/@oclif/core/lib/help/command.js
 +++ b/node_modules/@oclif/core/lib/help/command.js
 @@ -58,7 +58,8 @@ class CommandHelp extends formatter_1.HelpFormatter {
@@ -13,10 +13,10 @@ index 33105a0..0436982 100644
              if (a.default)
                  description = `${(0, theme_1.colorize)(this.config?.theme?.flagDefaultValue, `[default: ${a.default}]`)} ${description}`;
 diff --git a/node_modules/@oclif/core/lib/help/index.js b/node_modules/@oclif/core/lib/help/index.js
-index 0b48c0e..ff4fed4 100644
+index 4a34b89..d7eb6ac 100644
 --- a/node_modules/@oclif/core/lib/help/index.js
 +++ b/node_modules/@oclif/core/lib/help/index.js
-@@ -173,11 +173,12 @@ class Help extends HelpBase {
+@@ -172,11 +172,12 @@ class Help extends HelpBase {
          }
          this.log(this.formatCommand(command));
          this.log('');

patches/all/oclif+4.14.0.dev.patch

@@ -1,8 +1,8 @@
 diff --git a/node_modules/oclif/lib/commands/pack/win.js b/node_modules/oclif/lib/commands/pack/win.js
-index bfe9205..482519e 100644
+index ef7f90e..8264b7c 100644
 --- a/node_modules/oclif/lib/commands/pack/win.js
 +++ b/node_modules/oclif/lib/commands/pack/win.js
-@@ -86,6 +86,12 @@ InstallDir "\$PROGRAMFILES${arch === 'x64' ? '64' : ''}\\${config.dirname}"
+@@ -76,6 +76,12 @@ InstallDir "\$PROGRAMFILES${arch === 'x64' ? '64' : ''}\\${config.dirname}"
  ${customization}
  
  Section "${config.name} CLI \${VERSION}"
@@ -16,18 +16,20 @@ index bfe9205..482519e 100644
    File /r bin
    File /r client
 diff --git a/node_modules/oclif/lib/tarballs/build.js b/node_modules/oclif/lib/tarballs/build.js
-index f0c8d95..a72400e 100644
+index 14d5a6e..7b42a6f 100644
 --- a/node_modules/oclif/lib/tarballs/build.js
 +++ b/node_modules/oclif/lib/tarballs/build.js
-@@ -218,6 +218,11 @@ const extractCLI = async (tarball, c) => {
+@@ -200,6 +200,13 @@ const extractCLI = async (tarball, c) => {
          (0, promises_1.rm)(path.join(workspace, path.basename(tarball)), { recursive: true }),
          (0, fs_extra_1.remove)(path.join(workspace, 'bin', 'run.cmd')),
      ]);
++
 +    // The oclif installers are a production installation, while the source
 +    // `bin` folder may contain a `.fast-boot.json` file of a dev installation.
 +    // This has previously led to issues preventing the CLI from starting, so
 +    // delete `.fast-boot.json` (if any) from the destination folder.
 +    await (0, fs_extra_1.remove)(path.join(workspace, 'bin', '.fast-boot.json'));
++
  };
  const buildTarget = async (target, c, options) => {
-     if (target.platform === 'win32' && target.arch === 'arm64' && (0, semver_1.lt)(c.nodeVersion, '20.0.0')) {
+     const workspace = c.workspace(target);

patches/all/open+7.4.2.patch

@@ -0,0 +1,16 @@
+diff --git a/node_modules/open/index.js b/node_modules/open/index.js
+index 13147d0..ff161dd 100644
+--- a/node_modules/open/index.js
++++ b/node_modules/open/index.js
+@@ -10,7 +10,10 @@ const pAccess = promisify(fs.access);
+ const pReadFile = promisify(fs.readFile);
+ 
+ // Path to included `xdg-open`.
+-const localXdgOpenPath = path.join(__dirname, 'xdg-open');
++const localXdgOpenPath = process.pkg
++	? path.join(path.dirname(process.execPath), 'xdg-open')
++	: path.join(__dirname, 'xdg-open');
++
+ 
+ /**
+ Get the mount point for fixed drives in WSL.

patches/unix/node-gyp-build+4.6.0.patch

@@ -0,0 +1,14 @@
+diff --git a/node_modules/node-gyp-build/node-gyp-build.js b/node_modules/node-gyp-build/node-gyp-build.js
+index 61b398e..3cc3be8 100644
+--- a/node_modules/node-gyp-build/node-gyp-build.js
++++ b/node_modules/node-gyp-build/node-gyp-build.js
+@@ -30,6 +30,9 @@ load.resolve = load.path = function (dir) {
+     if (process.env[name + '_PREBUILD']) dir = process.env[name + '_PREBUILD']
+   } catch (err) {}
+ 
++  // pkg fix: native node modules are located externally to the pkg executable
++  dir = dir.replace(/^\/snapshot\/.+?\/node_modules\//, path.dirname(process.execPath) + path.sep)
++
+   if (!prebuildsOnly) {
+     var release = getFirst(path.join(dir, 'build/Release'), matchBuild)
+     if (release) return release

patches/win32/windosu+0.3.0.patch

@@ -0,0 +1,38 @@
+diff --git a/node_modules/windosu/lib/pipe.js b/node_modules/windosu/lib/pipe.js
+index dc81fa5..a381cc7 100644
+--- a/node_modules/windosu/lib/pipe.js
++++ b/node_modules/windosu/lib/pipe.js
+@@ -42,7 +42,8 @@ function pipe(path, options) {
+     return d.promise;
+ }
+ module.exports = pipe;
+-if (module === require.main) {
++
++function main() {
+     if (!process.argv[4]) {
+         console.error('Incorrect arguments!');
+         process.exit(-1);
+@@ -52,3 +53,8 @@ if (module === require.main) {
+         serve: process.argv[3] == 'server'
+     });
+ }
++module.exports.main = main;
++
++if (module === require.main) {
++    main();
++}
+diff --git a/node_modules/windosu/lib/windosu.js b/node_modules/windosu/lib/windosu.js
+index 6502812..dd0391a 100644
+--- a/node_modules/windosu/lib/windosu.js
++++ b/node_modules/windosu/lib/windosu.js
+@@ -16,7 +16,9 @@ module.exports.exec = function (command, options, callback) {
+                         temp: temp,
+                         command: command,
+                         cliWidth: cliWidth(),
+-                        pipe: '"' + process.execPath + '" "' + path.join(__dirname, 'pipe.js') + '"',
++                        pipe: process.pkg
++                            ? '"' + process.execPath + '" pkgExec "' + path.join(__dirname, 'pipe.js') + '::main"'
++                            : '"' + process.execPath + '" "' + path.join(__dirname, 'pipe.js') + '"',
+                         input: inputName = id + '-in',
+                         output: outputName = id + '-out',
+                         stderr_redir: process.stdout.isTTY ? '2>&1' : '2> %ERROR%'

repo.yml

@@ -6,10 +6,6 @@ upstream:
     url: 'https://github.com/balena-io/balena-sdk'
   - repo: 'balena-config-json'
     url: 'https://github.com/balena-io-modules/balena-config-json'
-  - repo: 'balena-image-fs'
-    url: 'https://github.com/balena-io-modules/balena-image-fs'
-  - repo: 'balena-device-init'
-    url: 'https://github.com/balena-io-modules/balena-device-init'
   - repo: 'balena-image-manager'
     url: 'https://github.com/balena-io-modules/balena-image-manager'
   - repo: 'balena-preload'

src/app.ts

@@ -34,14 +34,18 @@ export const setupSentry = onceAsync(async () => {
 	const config = await import('./config');
 	const Sentry = await import('@sentry/node');
 	Sentry.init({
+		autoSessionTracking: false,
 		dsn: config.sentryDsn,
 		release: packageJSON.version,
 	});
-	Sentry.getCurrentScope().setExtras({
-		is_pkg: !!(process as any).pkg,
-		node_version: process.version,
-		platform: process.platform,
+	Sentry.configureScope((scope) => {
+		scope.setExtras({
+			is_pkg: !!(process as any).pkg,
+			node_version: process.version,
+			platform: process.platform,
+		});
 	});
+	return Sentry.getCurrentHub();
 });
 
 async function checkNodeVersion() {
@@ -97,9 +101,11 @@ async function init() {
 
 /** Execute the oclif parser and the CLI command. */
 async function oclifRun(command: string[], options: AppOptions) {
-	let deprecationPromise: Promise<void> | undefined;
+	let deprecationPromise: Promise<void>;
 	// check and enforce the CLI's deprecation policy
-	if (!(unsupportedFlag || process.env.BALENARC_UNSUPPORTED)) {
+	if (unsupportedFlag || process.env.BALENARC_UNSUPPORTED) {
+		deprecationPromise = Promise.resolve();
+	} else {
 		const { DeprecationChecker } = await import('./deprecation');
 		const deprecationChecker = new DeprecationChecker(packageJSON.version);
 		// warnAndAbortIfDeprecated uses previously cached data only
@@ -155,12 +161,18 @@ async function oclifRun(command: string[], options: AppOptions) {
 /** CLI entrypoint. Called by the `bin/run.js` and `bin/dev.js` scripts. */
 export async function run(cliArgs = process.argv, options: AppOptions) {
 	try {
-		const { setOfflineModeEnvVars, normalizeEnvVars } = await import(
+		const { setOfflineModeEnvVars, normalizeEnvVars, pkgExec } = await import(
 			'./utils/bootstrap'
 		);
 		setOfflineModeEnvVars();
 		normalizeEnvVars();
 
+		// The 'pkgExec' special/internal command provides a Node.js interpreter
+		// for use of the standalone zip package. See pkgExec function.
+		if (cliArgs.length > 3 && cliArgs[2] === 'pkgExec') {
+			return pkgExec(cliArgs[3], cliArgs.slice(4));
+		}
+
 		await init();
 
 		// Look for commands that have been removed and if so, exit with a notice

src/commands/api-key/generate.ts

@@ -17,28 +17,8 @@
 
 import { Args, Command } from '@oclif/core';
 import { ExpectedError } from '../../errors';
-import { getBalenaSdk, getCliForm, stripIndent } from '../../utils/lazy';
-import {
-	formatDuration,
-	intervalToDuration,
-	isValid,
-	parseISO,
-} from 'date-fns';
-
-// In days
-const durations = [1, 7, 30, 90];
-
-async function isLoggedInWithJwt() {
-	const balena = getBalenaSdk();
-	try {
-		const token = await balena.auth.getToken();
-		const { default: jwtDecode } = await import('jwt-decode');
-		jwtDecode(token);
-		return true;
-	} catch {
-		return false;
-	}
-}
+import * as cf from '../../utils/common-flags';
+import { getBalenaSdk, stripIndent } from '../../utils/lazy';
 
 export default class GenerateCmd extends Command {
 	public static description = stripIndent`
@@ -50,21 +30,17 @@ export default class GenerateCmd extends Command {
 		This key can be used to log into the CLI using 'balena login --token <key>',
 		or to authenticate requests to the API with an 'Authorization: Bearer <key>' header.
 `;
-	public static examples = [
-		'$ balena api-key generate "Jenkins Key"',
-		'$ balena api-key generate "Jenkins Key" 2025-10-30',
-		'$ balena api-key generate "Jenkins Key" never',
-	];
+	public static examples = ['$ balena api-key generate "Jenkins Key"'];
 
 	public static args = {
 		name: Args.string({
 			description: 'the API key name',
 			required: true,
 		}),
-		expiryDate: Args.string({
-			description:
-				'the expiry date of the API key as an ISO date string, or "never" for no expiry',
-		}),
+	};
+
+	public static flags = {
+		help: cf.help,
 	};
 
 	public static authenticated = true;
@@ -72,70 +48,11 @@ export default class GenerateCmd extends Command {
 	public async run() {
 		const { args: params } = await this.parse(GenerateCmd);
 
-		let expiryDateResponse: string | number | undefined = params.expiryDate;
 		let key;
 		try {
-			if (!expiryDateResponse) {
-				expiryDateResponse = await getCliForm().ask({
-					message: 'Please pick an expiry date for the API key',
-					type: 'list',
-					choices: [...durations, 'custom', 'never'].map((duration) => ({
-						name:
-							duration === 'never'
-								? 'No expiration'
-								: typeof duration === 'number'
-									? formatDuration(
-											intervalToDuration({
-												start: 0,
-												end: duration * 24 * 60 * 60 * 1000,
-											}),
-										)
-									: 'Custom expiration',
-						value: duration,
-					})),
-				});
-			}
-			let expiryDate: Date | null;
-			if (expiryDateResponse === 'never') {
-				expiryDate = null;
-			} else if (expiryDateResponse === 'custom') {
-				do {
-					expiryDate = parseISO(
-						await getCliForm().ask({
-							message:
-								'Please enter an expiry date for the API key as an ISO date string',
-							type: 'input',
-						}),
-					);
-					if (!isValid(expiryDate)) {
-						console.error('Invalid date format');
-					}
-				} while (!isValid(expiryDate));
-			} else if (typeof expiryDateResponse === 'string') {
-				expiryDate = parseISO(expiryDateResponse);
-				if (!isValid(expiryDate)) {
-					throw new Error(
-						'Invalid date format, please use a valid ISO date string',
-					);
-				}
-			} else {
-				expiryDate = new Date(
-					Date.now() + expiryDateResponse * 24 * 60 * 60 * 1000,
-				);
-			}
-			key = await getBalenaSdk().models.apiKey.create({
-				name: params.name,
-				expiryDate: expiryDate === null ? null : expiryDate.toISOString(),
-			});
+			key = await getBalenaSdk().models.apiKey.create(params.name);
 		} catch (e) {
 			if (e.name === 'BalenaNotLoggedIn') {
-				if (await isLoggedInWithJwt()) {
-					throw new ExpectedError(stripIndent`
-						This command requires you to have been recently authenticated.
-						Please login again with 'balena login'.
-						In case you are using the Web authorization method, you need to logout and re-login to the dashboard first.
-					`);
-				}
 				throw new ExpectedError(stripIndent`
 					This command cannot be run when logged in with an API key.
 					Please login again with 'balena login' and select an alternative method.

src/commands/api-key/list.ts

@@ -21,7 +21,6 @@ import { getBalenaSdk, getVisuals, stripIndent } from '../../utils/lazy';
 
 export default class APIKeyListCmd extends Command {
 	public static aliases = ['api-keys'];
-	public static deprecateAliases = true;
 
 	public static description = stripIndent`
 		Print a list of balenaCloud API keys.
@@ -33,6 +32,7 @@ export default class APIKeyListCmd extends Command {
 	public static examples = ['$ balena api-key list'];
 
 	public static flags = {
+		help: cf.help,
 		user: Flags.boolean({
 			char: 'u',
 			description: 'show API keys for your user',
@@ -51,7 +51,7 @@ export default class APIKeyListCmd extends Command {
 					await getApplication(getBalenaSdk(), options.fleet, {
 						$select: 'actor',
 					})
-				).actor.__id
+				).actor
 			: await getBalenaSdk().auth.getActorId();
 		const keys = await getBalenaSdk().pine.get({
 			resource: 'api_key',

src/commands/api-key/revoke.ts

@@ -16,6 +16,7 @@
  */
 
 import { Args, Command } from '@oclif/core';
+import * as cf from '../../utils/common-flags';
 import { getBalenaSdk, stripIndent } from '../../utils/lazy';
 
 export default class RevokeCmd extends Command {
@@ -39,6 +40,10 @@ export default class RevokeCmd extends Command {
 		}),
 	};
 
+	public static flags = {
+		help: cf.help,
+	};
+
 	public static authenticated = true;
 
 	public async run() {
@@ -50,9 +55,9 @@ export default class RevokeCmd extends Command {
 			return;
 		}
 		await Promise.all(
-			apiKeyIds.map(async (id) => {
-				await getBalenaSdk().models.apiKey.revoke(Number(id));
-			}),
+			apiKeyIds.map(
+				async (id) => await getBalenaSdk().models.apiKey.revoke(Number(id)),
+			),
 		);
 		console.log('Successfully revoked the given API keys');
 	}

src/commands/app/create.ts

@@ -16,6 +16,7 @@
  */
 
 import { Flags, Args, Command } from '@oclif/core';
+import * as cf from '../../utils/common-flags';
 import { stripIndent } from '../../utils/lazy';
 
 export default class AppCreateCmd extends Command {
@@ -63,6 +64,7 @@ export default class AppCreateCmd extends Command {
 			description:
 				'app device type (Check available types with `balena device-type list`)',
 		}),
+		help: cf.help,
 	};
 
 	public static authenticated = true;

src/commands/block/create.ts

@@ -16,6 +16,7 @@
  */
 
 import { Flags, Args, Command } from '@oclif/core';
+import * as cf from '../../utils/common-flags';
 import { stripIndent } from '../../utils/lazy';
 
 export default class BlockCreateCmd extends Command {
@@ -63,6 +64,7 @@ export default class BlockCreateCmd extends Command {
 			description:
 				'block device type (Check available types with `balena device-type list`)',
 		}),
+		help: cf.help,
 	};
 
 	public static authenticated = true;

src/commands/build/index.ts

@@ -36,16 +36,15 @@ import { buildProject, composeCliFlags } from '../../utils/compose_ts';
 import type { BuildOpts, DockerCliFlags } from '../../utils/docker';
 import { dockerCliFlags } from '../../utils/docker';
 
-type ComposeGenerateOptsParam = Parameters<typeof compose.generateOpts>[0];
-
-interface PrepareBuildOpts
-	extends ComposeCliFlags,
-		DockerCliFlags,
-		ComposeGenerateOptsParam {
+// TODO: For this special one we can't use Interfaces.InferredFlags/InferredArgs
+// because of the 'registry-secrets' type which is defined in the actual code
+// as a path (string | undefined) but then the cli turns it into an object
+interface FlagsDef extends ComposeCliFlags, DockerCliFlags {
 	arch?: string;
 	deviceType?: string;
 	fleet?: string;
-	source?: string;
+	source?: string; // Not part of command profile - source param copied here.
+	help: void;
 }
 
 export default class BuildCmd extends Command {
@@ -96,6 +95,9 @@ ${dockerignoreHelp}
 		fleet: cf.fleet,
 		...composeCliFlags,
 		...dockerCliFlags,
+		// NOTE: Not supporting -h for help, because of clash with -h in DockerCliFlags
+		// Revisit this in future release.
+		help: Flags.help({}),
 	};
 
 	public static primary = true;
@@ -115,31 +117,29 @@ ${dockerignoreHelp}
 		const logger = Logger.getLogger();
 		logger.logDebug('Parsing input...');
 
-		const prepareBuildOpts = {
-			...options,
-			source: params.source,
-		};
+		// `build` accepts `source` as a parameter, but compose expects it as an option
+		options.source = params.source;
+		delete params.source;
 
-		await this.resolveArchFromDeviceType(sdk, prepareBuildOpts);
+		await this.resolveArchFromDeviceType(sdk, options);
 
-		await this.validateOptions(prepareBuildOpts, sdk);
+		await this.validateOptions(options, sdk);
 
 		// Build args are under consideration for removal - warn user
-		if (prepareBuildOpts.buildArg) {
+		if (options.buildArg) {
 			console.log(buildArgDeprecation);
 		}
 
-		const app = await this.getAppAndResolveArch(prepareBuildOpts);
+		const app = await this.getAppAndResolveArch(options);
 
-		const { docker, buildOpts, composeOpts } =
-			await this.prepareBuild(prepareBuildOpts);
+		const { docker, buildOpts, composeOpts } = await this.prepareBuild(options);
 
 		try {
 			await this.buildProject(docker, logger, composeOpts, {
 				appType: app?.application_type?.[0],
-				arch: prepareBuildOpts.arch!,
-				deviceType: prepareBuildOpts.deviceType!,
-				buildEmulated: prepareBuildOpts.emulated,
+				arch: options.arch!,
+				deviceType: options.deviceType!,
+				buildEmulated: options.emulated,
 				buildOpts,
 			});
 		} catch (err) {
@@ -151,7 +151,7 @@ ${dockerignoreHelp}
 		logger.logSuccess('Build succeeded!');
 	}
 
-	protected async validateOptions(opts: PrepareBuildOpts, sdk: BalenaSDK) {
+	protected async validateOptions(opts: FlagsDef, sdk: BalenaSDK) {
 		// Validate option combinations
 		if (
 			(opts.fleet == null && (opts.arch == null || opts.deviceType == null)) ||
@@ -179,10 +179,7 @@ ${dockerignoreHelp}
 		opts['registry-secrets'] = registrySecrets;
 	}
 
-	protected async resolveArchFromDeviceType(
-		sdk: BalenaSDK,
-		opts: PrepareBuildOpts,
-	) {
+	protected async resolveArchFromDeviceType(sdk: BalenaSDK, opts: FlagsDef) {
 		if (opts.deviceType != null && opts.arch == null) {
 			try {
 				const deviceTypeOpts = {
@@ -215,7 +212,7 @@ ${dockerignoreHelp}
 		}
 	}
 
-	protected async getAppAndResolveArch(opts: PrepareBuildOpts) {
+	protected async getAppAndResolveArch(opts: FlagsDef) {
 		if (opts.fleet) {
 			const { getAppWithArch } = await import('../../utils/helpers');
 			const app = await getAppWithArch(opts.fleet);
@@ -225,7 +222,7 @@ ${dockerignoreHelp}
 		}
 	}
 
-	protected async prepareBuild(options: PrepareBuildOpts) {
+	protected async prepareBuild(options: FlagsDef) {
 		const { getDocker, generateBuildOpts } = await import('../../utils/docker');
 		const [docker, buildOpts, composeOpts] = await Promise.all([
 			getDocker(options),

src/commands/config/generate.ts

@@ -117,6 +117,7 @@ export default class ConfigGenerateCmd extends Command {
 				'expiry date assigned to generated provisioning api key (format: YYYY-MM-DD)',
 			exclusive: ['device'],
 		}),
+		help: cf.help,
 	};
 
 	public static authenticated = true;

src/commands/config/inject.ts

@@ -44,6 +44,7 @@ export default class ConfigInjectCmd extends Command {
 
 	public static flags = {
 		drive: cf.driveOrImg,
+		help: cf.help,
 	};
 
 	public static root = true;
@@ -64,12 +65,7 @@ export default class ConfigInjectCmd extends Command {
 		);
 
 		const config = await import('balena-config-json');
-		await config.write(
-			drive,
-			// Will be removed in the next major of balena-config-json
-			undefined,
-			configJSON,
-		);
+		await config.write(drive, '', configJSON);
 
 		console.info('Done');
 	}

src/commands/config/read.ts

@@ -38,6 +38,7 @@ export default class ConfigReadCmd extends Command {
 
 	public static flags = {
 		drive: cf.driveOrImg,
+		help: cf.help,
 		json: cf.json,
 	};
 
@@ -54,7 +55,7 @@ export default class ConfigReadCmd extends Command {
 		await safeUmount(drive);
 
 		const config = await import('balena-config-json');
-		const configJSON = await config.read(drive);
+		const configJSON = await config.read(drive, '');
 
 		if (options.json) {
 			console.log(JSON.stringify(configJSON, null, 4));

src/commands/config/reconfigure.ts

@@ -44,6 +44,7 @@ export default class ConfigReconfigureCmd extends Command {
 			description: 'show advanced commands',
 			char: 'v',
 		}),
+		help: cf.help,
 		version: Flags.string({
 			description: 'balenaOS version, for example "2.32.0" or "2.44.0+rev1"',
 		}),
@@ -62,7 +63,7 @@ export default class ConfigReconfigureCmd extends Command {
 		await safeUmount(drive);
 
 		const config = await import('balena-config-json');
-		const { uuid } = await config.read(drive);
+		const { uuid } = await config.read(drive, '');
 		await safeUmount(drive);
 
 		if (!uuid) {

src/commands/config/write.ts

@@ -49,6 +49,7 @@ export default class ConfigWriteCmd extends Command {
 
 	public static flags = {
 		drive: cf.driveOrImg,
+		help: cf.help,
 	};
 
 	public static root = true;
@@ -64,19 +65,14 @@ export default class ConfigWriteCmd extends Command {
 		await safeUmount(drive);
 
 		const config = await import('balena-config-json');
-		const configJSON = await config.read(drive);
+		const configJSON = await config.read(drive, '');
 
 		console.info(`Setting ${params.key} to ${params.value}`);
 		ConfigWriteCmd.updateConfigJson(configJSON, params.key, params.value);
 
 		await denyMount(drive, async () => {
 			await safeUmount(drive);
-			await config.write(
-				drive,
-				// Will be removed in the next major of balena-config-json
-				undefined,
-				configJSON,
-			);
+			await config.write(drive, '', configJSON);
 		});
 
 		console.info('Done');

src/commands/deploy/index.ts

@@ -60,6 +60,7 @@ interface FlagsDef extends ComposeCliFlags, DockerCliFlags {
 	'release-tag'?: string[];
 	draft: boolean;
 	note?: string;
+	help: void;
 }
 
 export default class DeployCmd extends Command {
@@ -138,6 +139,9 @@ ${dockerignoreHelp}
 		note: Flags.string({ description: 'The notes for this release' }),
 		...composeCliFlags,
 		...dockerCliFlags,
+		// NOTE: Not supporting -h for help, because of clash with -h in DockerCliFlags
+		// Revisit this in future release.
+		help: Flags.help({}),
 	};
 
 	public static authenticated = true;
@@ -368,7 +372,6 @@ ${dockerignoreHelp}
 					!opts.shouldUploadLogs,
 					composeOpts.projectPath,
 					opts.createAsDraft,
-					project.descriptors,
 				);
 			}
 

src/commands/device-type/list.ts

@@ -17,11 +17,11 @@
 import { Flags, Command } from '@oclif/core';
 import type * as BalenaSdk from 'balena-sdk';
 import * as _ from 'lodash';
+import * as cf from '../../utils/common-flags';
 import { getBalenaSdk, getVisuals, stripIndent } from '../../utils/lazy';
 
 export default class DeviceTypeListCmd extends Command {
 	public static aliases = ['devices supported'];
-	public static deprecateAliases = true;
 
 	public static description = stripIndent`
 		List the device types supported by balena (like 'raspberrypi3' or 'intel-nuc').
@@ -45,6 +45,7 @@ export default class DeviceTypeListCmd extends Command {
 	];
 
 	public static flags = {
+		help: cf.help,
 		json: Flags.boolean({
 			char: 'j',
 			description: 'produce JSON output instead of tabular output',

src/commands/device/deactivate.ts

@@ -42,6 +42,7 @@ export default class DeviceDeactivateCmd extends Command {
 
 	public static flags = {
 		yes: cf.yes,
+		help: cf.help,
 	};
 
 	public static authenticated = true;

src/commands/device/detect.ts

@@ -16,11 +16,11 @@
  */
 
 import { Flags, Command } from '@oclif/core';
+import * as cf from '../../utils/common-flags';
 import { getCliUx, stripIndent } from '../../utils/lazy';
 
 export default class DeviceDetectCmd extends Command {
 	public static aliases = ['scan'];
-	public static deprecateAliases = true;
 
 	public static description = stripIndent`
 		Scan for balenaOS devices on your local network.
@@ -49,6 +49,7 @@ export default class DeviceDetectCmd extends Command {
 			char: 't',
 			description: 'scan timeout in seconds',
 		}),
+		help: cf.help,
 		json: Flags.boolean({
 			default: false,
 			char: 'j',
@@ -91,7 +92,7 @@ export default class DeviceDetectCmd extends Command {
 				try {
 					await docker.ping();
 					return true;
-				} catch {
+				} catch (err) {
 					return false;
 				}
 			}),

src/commands/device/identify.ts

@@ -16,6 +16,7 @@
  */
 
 import { Args, Command } from '@oclif/core';
+import * as cf from '../../utils/common-flags';
 import { getBalenaSdk, stripIndent } from '../../utils/lazy';
 import { ExpectedError } from '../../errors';
 
@@ -34,6 +35,10 @@ export default class DeviceIdentifyCmd extends Command {
 		}),
 	};
 
+	public static flags = {
+		help: cf.help,
+	};
+
 	public static authenticated = true;
 
 	public async run() {

src/commands/device/index.ts

@@ -63,6 +63,7 @@ export default class DeviceCmd extends Command {
 
 	public static flags = {
 		json: cf.json,
+		help: cf.help,
 		view: Flags.boolean({
 			default: false,
 			description: 'open device dashboard page',
@@ -77,59 +78,45 @@ export default class DeviceCmd extends Command {
 
 		const balena = getBalenaSdk();
 
-		let device: ExtendedDevice;
-		if (options.json) {
-			const [deviceBase, deviceComputed] = await Promise.all([
-				balena.models.device.get(params.uuid, {
-					$expand: {
-						device_tag: {
-							$select: ['tag_key', 'value'],
+		const device = (await balena.models.device.get(
+			params.uuid,
+			options.json
+				? {
+						$expand: {
+							device_tag: {
+								$select: ['tag_key', 'value'],
+							},
+							...expandForAppName.$expand,
 						},
-						...expandForAppName.$expand,
+					}
+				: {
+						$select: [
+							'device_name',
+							'id',
+							'overall_status',
+							'is_online',
+							'ip_address',
+							'mac_address',
+							'last_connectivity_event',
+							'uuid',
+							'supervisor_version',
+							'is_web_accessible',
+							'note',
+							'os_version',
+							'memory_usage',
+							'memory_total',
+							'public_address',
+							'storage_block_device',
+							'storage_usage',
+							'storage_total',
+							'cpu_usage',
+							'cpu_temp',
+							'cpu_id',
+							'is_undervolted',
+						],
+						...expandForAppName,
 					},
-				}),
-				balena.models.device.get(params.uuid, {
-					$select: [
-						'overall_status',
-						'overall_progress',
-						'should_be_running__release',
-					],
-				}),
-			]);
-
-			device = {
-				...deviceBase,
-				...deviceComputed,
-			} as ExtendedDevice;
-		} else {
-			device = (await balena.models.device.get(params.uuid, {
-				$select: [
-					'device_name',
-					'id',
-					'overall_status',
-					'is_online',
-					'ip_address',
-					'mac_address',
-					'last_connectivity_event',
-					'uuid',
-					'supervisor_version',
-					'is_web_accessible',
-					'note',
-					'os_version',
-					'memory_usage',
-					'memory_total',
-					'public_address',
-					'storage_block_device',
-					'storage_usage',
-					'storage_total',
-					'cpu_usage',
-					'cpu_temp',
-					'cpu_id',
-					'is_undervolted',
-				],
-				...expandForAppName,
-			})) as ExtendedDevice;
-		}
+		)) as ExtendedDevice;
 
 		if (options.view) {
 			const open = await import('open');

src/commands/device/init.ts

@@ -28,6 +28,7 @@ interface FlagsDef {
 	'os-version'?: string;
 	drive?: string;
 	config?: string;
+	help: void;
 	'provisioning-key-name'?: string;
 	'provisioning-key-expiry-date'?: string;
 }
@@ -99,6 +100,7 @@ export default class DeviceInitCmd extends Command {
 			description:
 				'expiry date assigned to generated provisioning api key (format: YYYY-MM-DD)',
 		}),
+		help: cf.help,
 	};
 
 	public static authenticated = true;
@@ -155,7 +157,7 @@ export default class DeviceInitCmd extends Command {
 			try {
 				logger.logDebug(`Process failed, removing device ${device.uuid}`);
 				await balena.models.device.remove(device.uuid);
-			} catch {
+			} catch (e) {
 				// Ignore removal failures, and throw original error
 			}
 			throw e;

src/commands/device/list.ts

@@ -37,7 +37,6 @@ const devicesSelectFields = {
 
 export default class DeviceListCmd extends Command {
 	public static aliases = ['devices'];
-	public static deprecateAliases = true;
 
 	public static description = stripIndent`
 		List all devices.
@@ -59,6 +58,7 @@ export default class DeviceListCmd extends Command {
 	public static flags = {
 		fleet: cf.fleet,
 		json: cf.json,
+		help: cf.help,
 	};
 
 	public static primary = true;

src/commands/device/local-mode.ts

@@ -16,6 +16,7 @@
  */
 
 import { Flags, Args, Command } from '@oclif/core';
+import * as cf from '../../utils/common-flags';
 import { getBalenaSdk, stripIndent } from '../../utils/lazy';
 
 export default class DeviceLocalModeCmd extends Command {
@@ -53,6 +54,7 @@ export default class DeviceLocalModeCmd extends Command {
 			description: 'output boolean indicating local mode status',
 			exclusive: ['enable', 'disable'],
 		}),
+		help: cf.help,
 	};
 
 	public static authenticated = true;

src/commands/device/logs.ts

@@ -16,6 +16,7 @@
  */
 
 import { Flags, Args, Command } from '@oclif/core';
+import * as cf from '../../utils/common-flags';
 import { getBalenaSdk, stripIndent } from '../../utils/lazy';
 import type { LogMessage } from 'balena-sdk';
 
@@ -23,7 +24,6 @@ const MAX_RETRY = 1000;
 
 export default class DeviceLogsCmd extends Command {
 	public static aliases = ['logs'];
-	public static deprecateAliases = true;
 
 	public static description = stripIndent`
 		Show device logs.
@@ -86,6 +86,7 @@ export default class DeviceLogsCmd extends Command {
 				'Only show system logs. This can be used in combination with --service.',
 			char: 'S',
 		}),
+		help: cf.help,
 	};
 
 	public static primary = true;
@@ -135,7 +136,7 @@ export default class DeviceLogsCmd extends Command {
 			logger.logDebug('Checking we can access device');
 			try {
 				await deviceApi.ping();
-			} catch {
+			} catch (e) {
 				const { ExpectedError } = await import('../../errors');
 				throw new ExpectedError(
 					`Cannot access device at address ${params.device}.  Device may not be in local mode.`,

src/commands/device/move.ts

@@ -55,6 +55,7 @@ export default class DeviceMoveCmd extends Command {
 
 	public static flags = {
 		fleet: cf.fleet,
+		help: cf.help,
 	};
 
 	public static authenticated = true;

src/commands/device/note.ts

@@ -22,7 +22,6 @@ import { getBalenaSdk, stripIndent } from '../../utils/lazy';
 
 export default class DeviceNoteCmd extends Command {
 	public static aliases = ['notes'];
-	public static deprecateAliases = true;
 
 	public static description = stripIndent`
 		Set a device note.
@@ -50,6 +49,7 @@ export default class DeviceNoteCmd extends Command {
 			exclusive: ['device'],
 			hidden: true,
 		}),
+		help: cf.help,
 	};
 
 	public static authenticated = true;

src/commands/device/os-update.ts

@@ -20,7 +20,6 @@ import * as cf from '../../utils/common-flags';
 import { getBalenaSdk, stripIndent, getCliForm } from '../../utils/lazy';
 import type { Device } from 'balena-sdk';
 import { ExpectedError } from '../../errors';
-import { getExpandedProp } from '../../utils/pine';
 
 export default class DeviceOsUpdateCmd extends Command {
 	public static description = stripIndent`
@@ -58,6 +57,7 @@ export default class DeviceOsUpdateCmd extends Command {
 			exclusive: ['version'],
 		}),
 		yes: cf.yes,
+		help: cf.help,
 	};
 
 	public static authenticated = true;
@@ -127,64 +127,27 @@ export default class DeviceOsUpdateCmd extends Command {
 				);
 			}
 		} else {
-			const choices = await Promise.all(
-				hupVersionInfo.versions.map(async (version) => {
-					const takeoverRequired =
-						(await sdk.models.os.getOsUpdateType(
-							getExpandedProp(is_of__device_type, 'slug')!,
-							currentOsVersion,
-							version,
-						)) === 'takeover';
-
-					return {
-						name: `${version}${hupVersionInfo.recommended === version ? ' (recommended)' : ''}${takeoverRequired ? ' ADVANCED UPDATE: Requires disk re-partitioning with no rollback option' : ''}`,
-						value: version,
-					};
-				}),
-			);
 			targetOsVersion = await getCliForm().ask({
 				message: 'Target OS version',
 				type: 'list',
-				choices,
+				choices: hupVersionInfo.versions.map((version) => ({
+					name:
+						hupVersionInfo.recommended === version
+							? `${version} (recommended)`
+							: version,
+					value: version,
+				})),
 			});
 		}
 
-		const takeoverRequired =
-			(await sdk.models.os.getOsUpdateType(
-				getExpandedProp(is_of__device_type, 'slug')!,
-				currentOsVersion,
-				targetOsVersion,
-			)) === 'takeover';
 		const patterns = await import('../../utils/patterns');
-		// Warn the user if the update requires a takeover
-		if (takeoverRequired) {
-			await patterns.confirm(
-				options.yes || false,
-				stripIndent`Before you proceed, note that this update process is different from a regular HostOS Update:
-DATA LOSS: This update requires disk re-partitioning, which will erase all data stored on the device.
-NO ROLLBACK: Unlike our HostOS update mechanism, this process does not allow reverting to a previous version in case of failure.
-Make sure to back up all important data before continuing. For more details, check our documentation: https://docs.balena.io/reference/OS/updates/update-process/
-`,
-			);
-		}
 		// Confirm and start update
 		await patterns.confirm(
 			options.yes || false,
 			'Host OS updates require a device restart when they complete. Are you sure you want to proceed?',
 		);
 
-		await sdk.models.device
-			.startOsUpdate(uuid, targetOsVersion, {
-				runDetached: true,
-			})
-			.then(() => {
-				console.log(
-					`The balena OS update has started. You can keep track of the progress via the dashboard.\n` +
-						`To open the dashboard page related to a device via the CLI, you can use \`balena device UUID --view\``,
-				);
-			})
-			.catch((error) => {
-				console.error(`Failed to start OS update for device ${uuid}:`, error);
-			});
+		await sdk.models.device.startOsUpdate(uuid, targetOsVersion);
+		await patterns.awaitDeviceOsUpdate(uuid, targetOsVersion);
 	}
 }

src/commands/device/pin.ts

@@ -16,6 +16,7 @@
  */
 
 import { Args, Command } from '@oclif/core';
+import * as cf from '../../utils/common-flags';
 import { getBalenaSdk, stripIndent } from '../../utils/lazy';
 import { getExpandedProp } from '../../utils/pine';
 
@@ -42,6 +43,10 @@ export default class DevicePinCmd extends Command {
 		}),
 	};
 
+	public static flags = {
+		help: cf.help,
+	};
+
 	public static authenticated = true;
 
 	public async run() {
@@ -51,7 +56,7 @@ export default class DevicePinCmd extends Command {
 
 		const device = await balena.models.device.get(params.uuid, {
 			$expand: {
-				is_pinned_on__release: {
+				should_be_running__release: {
 					$select: 'commit',
 				},
 				belongs_to__application: {
@@ -61,7 +66,7 @@ export default class DevicePinCmd extends Command {
 		});
 
 		const pinnedRelease = getExpandedProp(
-			device.is_pinned_on__release,
+			device.should_be_running__release,
 			'commit',
 		);
 		const appSlug = getExpandedProp(device.belongs_to__application, 'slug');

src/commands/device/public-url.ts

@@ -17,6 +17,7 @@
 
 import { Flags, Args, Command } from '@oclif/core';
 import { ExpectedError } from '../../errors';
+import * as cf from '../../utils/common-flags';
 import { getBalenaSdk, stripIndent } from '../../utils/lazy';
 
 export default class DevicePublicUrlCmd extends Command {
@@ -55,6 +56,7 @@ export default class DevicePublicUrlCmd extends Command {
 			description: 'determine if public URL is enabled',
 			exclusive: ['enable', 'disable'],
 		}),
+		help: cf.help,
 	};
 
 	public static authenticated = true;

src/commands/device/purge.ts

@@ -16,6 +16,7 @@
  */
 
 import { Args, Command } from '@oclif/core';
+import * as cf from '../../utils/common-flags';
 import { getBalenaSdk, getCliUx, stripIndent } from '../../utils/lazy';
 
 export default class DevicePurgeCmd extends Command {
@@ -40,6 +41,10 @@ export default class DevicePurgeCmd extends Command {
 		}),
 	};
 
+	public static flags = {
+		help: cf.help,
+	};
+
 	public static authenticated = true;
 
 	public async run() {

src/commands/device/reboot.ts

@@ -36,6 +36,7 @@ export default class DeviceRebootCmd extends Command {
 
 	public static flags = {
 		force: cf.force,
+		help: cf.help,
 	};
 
 	public static authenticated = true;

src/commands/device/register.ts

@@ -16,6 +16,7 @@
  */
 
 import { Flags, Command } from '@oclif/core';
+import * as cf from '../../utils/common-flags';
 import * as ca from '../../utils/common-args';
 import { getBalenaSdk, stripIndent } from '../../utils/lazy';
 import { applicationIdInfo } from '../../utils/messages';
@@ -51,6 +52,7 @@ export default class DeviceRegisterCmd extends Command {
 			description:
 				"device type slug (run 'balena device-type list' for possible values)",
 		}),
+		help: cf.help,
 	};
 
 	public static authenticated = true;
@@ -76,6 +78,6 @@ export default class DeviceRegisterCmd extends Command {
 			options.deviceType,
 		);
 
-		return result.uuid;
+		return result && result.uuid;
 	}
 }

src/commands/device/rename.ts

@@ -16,6 +16,7 @@
  */
 
 import { Args, Command } from '@oclif/core';
+import * as cf from '../../utils/common-flags';
 import { getBalenaSdk, stripIndent, getCliForm } from '../../utils/lazy';
 
 export default class DeviceRenameCmd extends Command {
@@ -41,6 +42,10 @@ export default class DeviceRenameCmd extends Command {
 		}),
 	};
 
+	public static flags = {
+		help: cf.help,
+	};
+
 	public static authenticated = true;
 
 	public async run() {

src/commands/device/restart.ts

@@ -16,6 +16,7 @@
  */
 
 import { Flags, Args, Command } from '@oclif/core';
+import * as cf from '../../utils/common-flags';
 import { getBalenaSdk, getCliUx, stripIndent } from '../../utils/lazy';
 import type {
 	BalenaSDK,
@@ -57,6 +58,7 @@ export default class DeviceRestartCmd extends Command {
 				'comma-separated list (no blank spaces) of service names to restart',
 			char: 's',
 		}),
+		help: cf.help,
 	};
 
 	public static authenticated = true;
@@ -154,7 +156,7 @@ export default class DeviceRestartCmd extends Command {
 
 	async restartAllServices(balena: BalenaSDK, deviceUuid: string) {
 		// Note: device.restartApplication throws `BalenaDeviceNotFound: Device not found` if device not online.
-		// Need to use device.get first to distinguish between non-existant and disconnected devices.
+		// Need to use device.get first to distinguish between non-existant and offline devices.
 		// Remove this workaround when SDK issue resolved: https://github.com/balena-io/balena-sdk/issues/649
 		const { instanceOf, ExpectedError } = await import('../../errors');
 		try {

src/commands/device/rm.ts

@@ -44,6 +44,7 @@ export default class DeviceRmCmd extends Command {
 
 	public static flags = {
 		yes: cf.yes,
+		help: cf.help,
 	};
 
 	public static authenticated = true;

src/commands/device/shutdown.ts

@@ -37,6 +37,7 @@ export default class DeviceShutdownCmd extends Command {
 
 	public static flags = {
 		force: cf.force,
+		help: cf.help,
 	};
 
 	public static authenticated = true;

src/commands/device/ssh.ts

@@ -16,6 +16,7 @@
  */
 
 import { Flags, Args, Command } from '@oclif/core';
+import * as cf from '../../utils/common-flags';
 import { getBalenaSdk, stripIndent } from '../../utils/lazy';
 import {
 	parseAsInteger,
@@ -24,7 +25,6 @@ import {
 
 export default class DeviceSSHCmd extends Command {
 	public static aliases = ['ssh'];
-	public static deprecateAliases = true;
 
 	public static description = stripIndent`
 		Open a SSH prompt on a device's host OS or service container.
@@ -82,7 +82,7 @@ export default class DeviceSSHCmd extends Command {
 				SSH server port number (default 22222) if the target is an IP address or .local
 				hostname. Otherwise, port number for the balenaCloud gateway (default 22).`,
 			char: 'p',
-			parse: (p) => parseAsInteger(p, 'port'),
+			parse: async (p) => parseAsInteger(p, 'port'),
 		}),
 		tty: Flags.boolean({
 			default: false,
@@ -99,6 +99,7 @@ export default class DeviceSSHCmd extends Command {
 			default: false,
 			description: 'bypass global proxy configuration for the ssh connection',
 		}),
+		help: cf.help,
 	};
 
 	public static primary = true;
@@ -110,14 +111,13 @@ export default class DeviceSSHCmd extends Command {
 		// Local connection
 		if (validateLocalHostnameOrIp(params.fleetOrDevice)) {
 			const { performLocalDeviceSSH } = await import('../../utils/device/ssh');
-			await performLocalDeviceSSH({
+			return await performLocalDeviceSSH({
 				hostname: params.fleetOrDevice,
 				port: options.port || 'local',
 				forceTTY: options.tty,
 				verbose: options.verbose,
 				service: params.service,
 			});
-			return;
 		}
 
 		// Remote connection
@@ -133,7 +133,7 @@ export default class DeviceSSHCmd extends Command {
 		const useProxy = !!proxyConfig && !options.noproxy;
 
 		// this will be a tunnelled SSH connection...
-		checkNotUsingOfflineMode();
+		await checkNotUsingOfflineMode();
 		await checkLoggedIn();
 		const deviceUuid = await getOnlineTargetDeviceUuid(
 			sdk,

src/commands/device/start-service.ts

@@ -16,6 +16,7 @@
  */
 
 import { Args, Command } from '@oclif/core';
+import * as cf from '../../utils/common-flags';
 import { getBalenaSdk, getCliUx, stripIndent } from '../../utils/lazy';
 import type { BalenaSDK } from 'balena-sdk';
 
@@ -44,6 +45,10 @@ export default class DeviceStartServiceCmd extends Command {
 		}),
 	};
 
+	public static flags = {
+		help: cf.help,
+	};
+
 	public static authenticated = true;
 
 	public async run() {

src/commands/device/stop-service.ts

@@ -16,6 +16,7 @@
  */
 
 import { Args, Command } from '@oclif/core';
+import * as cf from '../../utils/common-flags';
 import { getBalenaSdk, getCliUx, stripIndent } from '../../utils/lazy';
 import type { BalenaSDK } from 'balena-sdk';
 
@@ -44,6 +45,10 @@ export default class DeviceStopServiceCmd extends Command {
 		}),
 	};
 
+	public static flags = {
+		help: cf.help,
+	};
+
 	public static authenticated = true;
 
 	public async run() {

src/commands/device/support.ts

@@ -0,0 +1,111 @@
+/**
+ * @license
+ * Copyright 2016-2020 Balena Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import { Flags, Args, Command } from '@oclif/core';
+import { ExpectedError } from '../../errors';
+import * as cf from '../../utils/common-flags';
+import { getBalenaSdk, getCliUx, stripIndent } from '../../utils/lazy';
+
+export default class DeviceSupportCmd extends Command {
+	public static description = stripIndent`
+		Grant or revoke support access for devices.
+
+		Grant or revoke balena support agent access to devices
+		on balenaCloud. (This command does not apply to openBalena.)
+		Access will be automatically revoked once the specified duration has elapsed.
+
+		Duration defaults to 24h, but can be specified using --duration flag in days
+		or hours, e.g. '12h', '2d'.
+
+		Multiple values can specified as a comma-separated list (with no spaces).
+	`;
+
+	public static examples = [
+		'balena support enable ab346f,cd457a --duration 3d',
+		'balena support disable ab346f,cd457a',
+	];
+
+	public static args = {
+		action: Args.string({
+			description: 'enable|disable support access',
+			options: ['enable', 'disable'],
+			required: true,
+		}),
+		uuid: Args.string({
+			description:
+				'comma-separated list (no blank spaces) of device UUIDs to be moved',
+			required: true,
+		}),
+	};
+
+	public static flags = {
+		duration: Flags.string({
+			description:
+				'length of time to enable support for, in (h)ours or (d)ays, e.g. 12h, 2d',
+			char: 't',
+		}),
+		help: cf.help,
+	};
+
+	public static authenticated = true;
+
+	public async run() {
+		const { args: params, flags: options } = await this.parse(DeviceSupportCmd);
+
+		const balena = getBalenaSdk();
+		const ux = getCliUx();
+
+		const enabling = params.action === 'enable';
+
+		if (options.duration != null && !enabling) {
+			throw new ExpectedError(
+				'--duration option is only applicable when enabling support',
+			);
+		}
+
+		// Calculate expiry ts
+		const durationDefault = '24h';
+		const duration = options.duration || durationDefault;
+		const { parseDuration } = await import('../../utils/helpers');
+		const expiryTs = Date.now() + parseDuration(duration);
+
+		const deviceUuids = params.uuid?.split(',') || [];
+
+		const enablingMessage = 'Enabling support access for';
+		const disablingMessage = 'Disabling support access for';
+
+		// Process devices
+		for (const deviceUuid of deviceUuids) {
+			if (enabling) {
+				ux.action.start(`${enablingMessage} device ${deviceUuid}`);
+				await balena.models.device.grantSupportAccess(deviceUuid, expiryTs);
+			} else if (params.action === 'disable') {
+				ux.action.start(`${disablingMessage} device ${deviceUuid}`);
+				await balena.models.device.revokeSupportAccess(deviceUuid);
+			}
+			ux.action.stop();
+		}
+
+		if (enabling) {
+			console.log(
+				`Access has been granted for ${duration}, expiring ${new Date(
+					expiryTs,
+				).toISOString()}`,
+			);
+		}
+	}
+}

src/commands/device/track-fleet.ts

@@ -16,6 +16,7 @@
  */
 
 import { Args, Command } from '@oclif/core';
+import * as cf from '../../utils/common-flags';
 import { getBalenaSdk, stripIndent } from '../../utils/lazy';
 
 export default class DeviceTrackFleetCmd extends Command {
@@ -33,6 +34,10 @@ export default class DeviceTrackFleetCmd extends Command {
 		}),
 	};
 
+	public static flags = {
+		help: cf.help,
+	};
+
 	public static authenticated = true;
 
 	public async run() {

src/commands/device/tunnel.ts

@@ -21,6 +21,7 @@ import {
 	InvalidPortMappingError,
 	ExpectedError,
 } from '../../errors';
+import * as cf from '../../utils/common-flags';
 import { getBalenaSdk, stripIndent } from '../../utils/lazy';
 import { lowercaseIfSlug } from '../../utils/normalization';
 
@@ -28,7 +29,6 @@ import type { Server, Socket } from 'net';
 
 export default class DeviceTunnelCmd extends Command {
 	public static aliases = ['tunnel'];
-	public static deprecateAliases = true;
 
 	public static description = stripIndent`
 		Tunnel local ports to your balenaOS device.
@@ -86,6 +86,7 @@ export default class DeviceTunnelCmd extends Command {
 			char: 'p',
 			multiple: true,
 		}),
+		help: cf.help,
 	};
 
 	public static primary = true;

src/commands/env/list.ts

@@ -47,7 +47,6 @@ interface ServiceEnvironmentVariableInfo
 
 export default class EnvListCmd extends Command {
 	public static aliases = ['envs'];
-	public static deprecateAliases = true;
 
 	public static description = stripIndent`
 		List the environment or config variables of a fleet, device or service.
@@ -105,6 +104,7 @@ export default class EnvListCmd extends Command {
 			exclusive: ['service'],
 		}),
 		device: { ...cf.device, exclusive: ['fleet'] },
+		help: cf.help,
 		json: cf.json,
 		service: { ...cf.service, exclusive: ['config'] },
 	};

src/commands/env/rename.ts

@@ -15,6 +15,7 @@
  * limitations under the License.
  */
 import { Args, Command } from '@oclif/core';
+import * as cf from '../../utils/common-flags';
 import * as ec from '../../utils/env-common';
 import { getBalenaSdk, stripIndent } from '../../utils/lazy';
 import { parseAsInteger } from '../../utils/validation';
@@ -41,7 +42,7 @@ export default class EnvRenameCmd extends Command {
 		id: Args.integer({
 			required: true,
 			description: "variable's numeric database ID",
-			parse: (input) => parseAsInteger(input, 'id'),
+			parse: async (input) => parseAsInteger(input, 'id'),
 		}),
 		value: Args.string({
 			required: true,
@@ -54,6 +55,7 @@ export default class EnvRenameCmd extends Command {
 		config: ec.booleanConfig,
 		device: ec.booleanDevice,
 		service: ec.booleanService,
+		help: cf.help,
 	};
 
 	public async run() {

src/commands/env/rm.ts

@@ -46,7 +46,7 @@ export default class EnvRmCmd extends Command {
 		id: Args.integer({
 			required: true,
 			description: "variable's numeric database ID",
-			parse: (input) => parseAsInteger(input, 'id'),
+			parse: async (input) => parseAsInteger(input, 'id'),
 		}),
 	};
 

src/commands/env/set.ts

@@ -25,6 +25,7 @@ import { applicationIdInfo } from '../../utils/messages';
 interface FlagsDef {
 	fleet?: string;
 	device?: string; // device UUID
+	help: void;
 	quiet: boolean;
 	service?: string; // service name
 }
@@ -36,7 +37,6 @@ interface ArgsDef {
 
 export default class EnvSetCmd extends Command {
 	public static aliases = ['env add'];
-	public static deprecateAliases = true;
 
 	public static description = stripIndent`
 		Add or update env or config variable to fleets, devices or services.
@@ -97,6 +97,7 @@ export default class EnvSetCmd extends Command {
 	public static flags = {
 		fleet: { ...cf.fleet, exclusive: ['device'] },
 		device: { ...cf.device, exclusive: ['fleet'] },
+		help: cf.help,
 		quiet: cf.quiet,
 		service: cf.service,
 	};

src/commands/fleet/create.ts

@@ -16,6 +16,7 @@
  */
 
 import { Flags, Args, Command } from '@oclif/core';
+import * as cf from '../../utils/common-flags';
 import { stripIndent } from '../../utils/lazy';
 
 export default class FleetCreateCmd extends Command {
@@ -63,6 +64,7 @@ export default class FleetCreateCmd extends Command {
 			description:
 				'fleet device type (Check available types with `balena device-type list`)',
 		}),
+		help: cf.help,
 	};
 
 	public static authenticated = true;

src/commands/fleet/index.ts

@@ -40,6 +40,7 @@ export default class FleetCmd extends Command {
 	};
 
 	public static flags = {
+		help: cf.help,
 		view: Flags.boolean({
 			default: false,
 			description: 'open fleet dashboard page',

src/commands/fleet/list.ts

@@ -28,7 +28,6 @@ interface ExtendedApplication extends ApplicationWithDeviceTypeSlug {
 
 export default class FleetListCmd extends Command {
 	public static aliases = ['fleets'];
-	public static deprecateAliases = true;
 
 	public static description = stripIndent`
 		List all fleets.
@@ -42,6 +41,7 @@ export default class FleetListCmd extends Command {
 	public static examples = ['$ balena fleet list'];
 
 	public static flags = {
+		help: cf.help,
 		json: cf.json,
 	};
 

src/commands/fleet/pin.ts

@@ -16,6 +16,7 @@
  */
 
 import { Args, Command } from '@oclif/core';
+import * as cf from '../../utils/common-flags';
 import { getBalenaSdk, stripIndent } from '../../utils/lazy';
 import { getExpandedProp } from '../../utils/pine';
 
@@ -42,6 +43,10 @@ export default class FleetPinCmd extends Command {
 		}),
 	};
 
+	public static flags = {
+		help: cf.help,
+	};
+
 	public static authenticated = true;
 
 	public async run() {

src/commands/fleet/purge.ts

@@ -16,6 +16,7 @@
  */
 
 import { Command } from '@oclif/core';
+import * as cf from '../../utils/common-flags';
 import * as ca from '../../utils/common-args';
 import { getBalenaSdk, stripIndent } from '../../utils/lazy';
 import { applicationIdInfo } from '../../utils/messages';
@@ -39,6 +40,10 @@ export default class FleetPurgeCmd extends Command {
 		fleet: ca.fleetRequired,
 	};
 
+	public static flags = {
+		help: cf.help,
+	};
+
 	public static authenticated = true;
 
 	public async run() {

src/commands/fleet/rename.ts

@@ -16,6 +16,7 @@
  */
 
 import { Args, Command } from '@oclif/core';
+import * as cf from '../../utils/common-flags';
 import * as ca from '../../utils/common-args';
 import { getBalenaSdk, stripIndent, getCliForm } from '../../utils/lazy';
 import { applicationIdInfo } from '../../utils/messages';
@@ -45,6 +46,10 @@ export default class FleetRenameCmd extends Command {
 		}),
 	};
 
+	public static flags = {
+		help: cf.help,
+	};
+
 	public static authenticated = true;
 
 	public async run() {

src/commands/fleet/restart.ts

@@ -16,6 +16,7 @@
  */
 
 import { Command } from '@oclif/core';
+import * as cf from '../../utils/common-flags';
 import * as ca from '../../utils/common-args';
 import { getBalenaSdk, stripIndent } from '../../utils/lazy';
 import { applicationIdInfo } from '../../utils/messages';
@@ -38,6 +39,10 @@ export default class FleetRestartCmd extends Command {
 		fleet: ca.fleetRequired,
 	};
 
+	public static flags = {
+		help: cf.help,
+	};
+
 	public static authenticated = true;
 
 	public async run() {

src/commands/fleet/rm.ts

@@ -44,6 +44,7 @@ export default class FleetRmCmd extends Command {
 
 	public static flags = {
 		yes: cf.yes,
+		help: cf.help,
 	};
 
 	public static authenticated = true;

src/commands/fleet/support.ts

@@ -0,0 +1,117 @@
+/**
+ * @license
+ * Copyright 2016-2020 Balena Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import { Flags, Args, Command } from '@oclif/core';
+import { ExpectedError } from '../../errors';
+import * as cf from '../../utils/common-flags';
+import { getBalenaSdk, getCliUx, stripIndent } from '../../utils/lazy';
+import { applicationIdInfo } from '../../utils/messages';
+
+export default class FleetSupportCmd extends Command {
+	public static description = stripIndent`
+		Grant or revoke support access for fleets.
+
+		Grant or revoke balena support agent access to fleets
+		on balenaCloud. (This command does not apply to openBalena.)
+		Access will be automatically revoked once the specified duration has elapsed.
+
+		Duration defaults to 24h, but can be specified using --duration flag in days
+		or hours, e.g. '12h', '2d'.
+
+		Multiple values can specified as a comma-separated list (with no spaces).
+
+		${applicationIdInfo.split('\n').join('\n\t\t')}
+	`;
+
+	public static examples = [
+		'balena support enable myorg/myfleet,notmyorg/notmyfleet --duration 3d',
+		'balena support disable myorg/myfleet',
+	];
+
+	public static args = {
+		action: Args.string({
+			description: 'enable|disable support access',
+			options: ['enable', 'disable'],
+			required: true,
+		}),
+		fleet: Args.string({
+			description:
+				'comma-separated list (no spaces) of fleet names or slugs (preferred)',
+			required: true,
+		}),
+	};
+
+	public static flags = {
+		duration: Flags.string({
+			description:
+				'length of time to enable support for, in (h)ours or (d)ays, e.g. 12h, 2d',
+			char: 't',
+		}),
+		help: cf.help,
+	};
+
+	public static authenticated = true;
+
+	public async run() {
+		const { args: params, flags: options } = await this.parse(FleetSupportCmd);
+
+		const balena = getBalenaSdk();
+		const ux = getCliUx();
+
+		const enabling = params.action === 'enable';
+
+		if (options.duration != null && !enabling) {
+			throw new ExpectedError(
+				'--duration option is only applicable when enabling support',
+			);
+		}
+
+		// Calculate expiry ts
+		const durationDefault = '24h';
+		const duration = options.duration || durationDefault;
+		const { parseDuration } = await import('../../utils/helpers');
+		const expiryTs = Date.now() + parseDuration(duration);
+
+		const appNames = params.fleet?.split(',') || [];
+
+		const enablingMessage = 'Enabling support access for';
+		const disablingMessage = 'Disabling support access for';
+
+		const { getFleetSlug } = await import('../../utils/sdk');
+
+		// Process applications
+		for (const appName of appNames) {
+			const slug = await getFleetSlug(balena, appName);
+			if (enabling) {
+				ux.action.start(`${enablingMessage} fleet ${slug}`);
+				await balena.models.application.grantSupportAccess(slug, expiryTs);
+			} else if (params.action === 'disable') {
+				ux.action.start(`${disablingMessage} fleet ${slug}`);
+				await balena.models.application.revokeSupportAccess(slug);
+			}
+			ux.action.stop();
+		}
+
+		if (enabling) {
+			console.log(
+				`Access has been granted for ${duration}, expiring ${new Date(
+					expiryTs,
+				).toISOString()}`,
+			);
+		}
+	}
+}

src/commands/fleet/track-latest.ts

@@ -16,6 +16,7 @@
  */
 
 import { Args, Command } from '@oclif/core';
+import * as cf from '../../utils/common-flags';
 import { getBalenaSdk, stripIndent } from '../../utils/lazy';
 
 export default class FleetTrackLatestCmd extends Command {
@@ -36,6 +37,10 @@ export default class FleetTrackLatestCmd extends Command {
 		}),
 	};
 
+	public static flags = {
+		help: cf.help,
+	};
+
 	public static authenticated = true;
 
 	public async run() {

src/commands/join/index.ts

@@ -65,6 +65,7 @@ export default class JoinCmd extends Command {
 			description: 'the interval in minutes to check for updates',
 			char: 'i',
 		}),
+		help: cf.help,
 	};
 
 	public static authenticated = true;

src/commands/leave/index.ts

@@ -16,6 +16,7 @@
  */
 
 import { Args, Command } from '@oclif/core';
+import * as cf from '../../utils/common-flags';
 import { stripIndent } from '../../utils/lazy';
 import { parseAsLocalHostnameOrIp } from '../../utils/validation';
 
@@ -48,6 +49,10 @@ export default class LeaveCmd extends Command {
 		}),
 	};
 
+	public static flags = {
+		help: cf.help,
+	};
+
 	public static authenticated = true;
 	public static primary = true;
 

src/commands/local/configure.ts

@@ -16,6 +16,8 @@
  */
 
 import { Args, Command } from '@oclif/core';
+import { promisify } from 'util';
+import * as cf from '../../utils/common-flags';
 import { stripIndent } from '../../utils/lazy';
 
 export default class LocalConfigureCmd extends Command {
@@ -37,6 +39,10 @@ export default class LocalConfigureCmd extends Command {
 		}),
 	};
 
+	public static flags = {
+		help: cf.help,
+	};
+
 	public static root = true;
 	public static offlineCompatible = true;
 
@@ -236,7 +242,7 @@ export default class LocalConfigureCmd extends Command {
 		const bootPartition = await getBootPartition(target);
 
 		const files = await imagefs.interact(target, bootPartition, async (_fs) => {
-			return await _fs.promises.readdir(this.CONNECTIONS_FOLDER);
+			return await promisify(_fs.readdir)(this.CONNECTIONS_FOLDER);
 		});
 
 		let connectionFileName;
@@ -245,11 +251,13 @@ export default class LocalConfigureCmd extends Command {
 		} else if (_.includes(files, 'resin-sample.ignore')) {
 			// Fresh image, new mode, accoding to https://github.com/balena-os/meta-balena/pull/770/files
 			await imagefs.interact(target, bootPartition, async (_fs) => {
-				const contents = await _fs.promises.readFile(
+				const readFileAsync = promisify(_fs.readFile);
+				const writeFileAsync = promisify(_fs.writeFile);
+				const contents = await readFileAsync(
 					`${this.CONNECTIONS_FOLDER}/resin-sample.ignore`,
 					{ encoding: 'utf8' },
 				);
-				await _fs.promises.writeFile(
+				return await writeFileAsync(
 					`${this.CONNECTIONS_FOLDER}/resin-wifi`,
 					contents,
 				);
@@ -266,13 +274,13 @@ export default class LocalConfigureCmd extends Command {
 		} else {
 			// In case there's no file at all (shouldn't happen normally, but the file might have been removed)
 			await imagefs.interact(target, bootPartition, async (_fs) => {
-				await _fs.promises.writeFile(
+				return await promisify(_fs.writeFile)(
 					`${this.CONNECTIONS_FOLDER}/resin-wifi`,
 					this.CONNECTION_FILE,
 				);
 			});
 		}
-		return this.getConfigurationSchema(bootPartition, connectionFileName);
+		return await this.getConfigurationSchema(bootPartition, connectionFileName);
 	}
 
 	async removeHostname(schema: any) {

src/commands/local/flash.ts

@@ -48,6 +48,7 @@ export default class LocalFlashCmd extends Command {
 	public static flags = {
 		drive: cf.drive,
 		yes: cf.yes,
+		help: cf.help,
 	};
 
 	public static offlineCompatible = true;

src/commands/login/index.ts

@@ -16,6 +16,7 @@
  */
 
 import { Flags, Args, Command } from '@oclif/core';
+import * as cf from '../../utils/common-flags';
 import { getBalenaSdk, stripIndent, getCliForm } from '../../utils/lazy';
 import { ExpectedError } from '../../errors';
 import type { WhoamiResult } from 'balena-sdk';
@@ -28,6 +29,7 @@ interface FlagsDef {
 	user?: string;
 	password?: string;
 	port?: number;
+	help: void;
 	hideExperimentalWarning: boolean;
 }
 
@@ -109,6 +111,7 @@ export default class LoginCmd extends Command {
 			default: false,
 			description: 'Hides warning for experimental features',
 		}),
+		help: cf.help,
 	};
 
 	public static primary = true;
@@ -132,7 +135,7 @@ export default class LoginCmd extends Command {
 		// We can safely assume this won't be undefined as doLogin will throw if this call fails
 		// We also don't need to worry too much about the amount of calls to whoami
 		// as these are cached by the SDK
-		const whoamiResult = (await balena.auth.whoami())!;
+		const whoamiResult = (await balena.auth.whoami()) as WhoamiResult;
 
 		if (whoamiResult.actorType !== 'user' && !options.hideExperimentalWarning) {
 			console.info(stripIndent`
@@ -168,7 +171,7 @@ ${messages.reachingOut}`);
 
 	async doLogin(
 		loginOptions: FlagsDef,
-		balenaUrl = 'balena-cloud.com',
+		balenaUrl: string = 'balena-cloud.com',
 		token?: string,
 	): Promise<void> {
 		// Token

src/commands/organization/list.ts

@@ -16,11 +16,11 @@
  */
 
 import { Command } from '@oclif/core';
+import * as cf from '../../utils/common-flags';
 import { getBalenaSdk, getVisuals, stripIndent } from '../../utils/lazy';
 
 export default class OrganizationListCmd extends Command {
 	public static aliases = ['orgs'];
-	public static deprecateAliases = true;
 
 	public static description = stripIndent`
 		List all organizations.
@@ -29,6 +29,10 @@ export default class OrganizationListCmd extends Command {
 `;
 	public static examples = ['$ balena organization list'];
 
+	public static flags = {
+		help: cf.help,
+	};
+
 	public static authenticated = true;
 
 	public async run() {

src/commands/os/build-config.ts

@@ -16,6 +16,7 @@
  */
 
 import { Flags, Args, Command } from '@oclif/core';
+import * as cf from '../../utils/common-flags';
 import { getCliForm, stripIndent } from '../../utils/lazy';
 import * as _ from 'lodash';
 import type { DeviceTypeJson } from 'balena-sdk';
@@ -54,6 +55,7 @@ export default class OsBuildConfigCmd extends Command {
 			char: 'o',
 			required: true,
 		}),
+		help: cf.help,
 	};
 
 	public static authenticated = true;

src/commands/os/configure.ts

@@ -18,6 +18,7 @@
 import { Flags, Args, Command } from '@oclif/core';
 import type { Interfaces } from '@oclif/core';
 import type * as BalenaSdk from 'balena-sdk';
+import { promisify } from 'util';
 import * as _ from 'lodash';
 import { ExpectedError } from '../../errors';
 import * as cf from '../../utils/common-flags';
@@ -153,6 +154,7 @@ export default class OsConfigureCmd extends Command {
 				'expiry date assigned to generated provisioning api key (format: YYYY-MM-DD)',
 			exclusive: ['config', 'device'],
 		}),
+		help: cf.help,
 	};
 
 	public static authenticated = true;
@@ -291,7 +293,7 @@ export default class OsConfigureCmd extends Command {
 
 			for (const { name, content } of files) {
 				await imagefs.interact(image, bootPartition, async (_fs) => {
-					await _fs.promises.writeFile(
+					return await promisify(_fs.writeFile)(
 						path.join(CONNECTIONS_FOLDER, name),
 						content,
 					);