Add balena update command for updating the CLI

Change-type: minor

.github/actions/publish/action.yml

@@ -0,0 +1,134 @@
+---
+name: package and draft GitHub release
+# https://github.com/product-os/flowzone/tree/master/.github/actions
+inputs:
+  json:
+    description: 'JSON stringified object containing all the inputs from the calling workflow'
+    required: true
+  secrets:
+    description: 'JSON stringified object containing all the secrets from the calling workflow'
+    required: true
+  variables:
+    description: 'JSON stringified object containing all the variables from the calling workflow'
+    required: true
+
+  # --- custom environment
+  XCODE_APP_LOADER_EMAIL:
+    type: string
+    default: 'accounts+apple@balena.io'
+  NODE_VERSION:
+    type: string
+    default: '16.x'
+  VERBOSE:
+    type: string
+    default: 'true'
+
+runs:
+  # https://docs.github.com/en/actions/creating-actions/creating-a-composite-action
+  using: 'composite'
+  steps:
+    - name: Download custom source artifact
+      uses: actions/download-artifact@v3
+      with:
+        name: custom-${{ github.event.pull_request.head.sha || github.event.head_commit.id }}-${{ runner.os }}-${{ runner.arch }}
+        path: ${{ runner.temp }}
+
+    - name: Extract custom source artifact
+      shell: pwsh
+      working-directory: .
+      run: tar -xf ${{ runner.temp }}/custom.tgz
+
+    - name: Setup Node.js
+      uses: actions/setup-node@v3
+      with:
+        node-version: ${{ inputs.NODE_VERSION }}
+        cache: npm
+
+    - name: Install additional tools
+      if: runner.os == 'Windows'
+      shell: bash
+      run: |
+        choco install yq
+
+    - name: Install additional tools
+      if: runner.os == 'macOS'
+      shell: bash
+      run: |
+        brew install coreutils
+
+    # https://www.electron.build/code-signing.html
+    # https://github.com/Apple-Actions/import-codesign-certs
+    - name: Import Apple code signing certificate
+      if: runner.os == 'macOS'
+      uses: apple-actions/import-codesign-certs@v1
+      with:
+        p12-file-base64: ${{ fromJSON(inputs.secrets).APPLE_SIGNING }}
+        p12-password: ${{ fromJSON(inputs.secrets).APPLE_SIGNING_PASSWORD }}
+
+    - name: Import Windows code signing certificate
+      if: runner.os == 'Windows'
+      shell: powershell
+      run: |
+        Set-Content -Path ${{ runner.temp }}/certificate.base64 -Value $env:WINDOWS_CERTIFICATE
+        certutil -decode ${{ runner.temp }}/certificate.base64 ${{ runner.temp }}/certificate.pfx
+        Remove-Item -path ${{ runner.temp }} -include certificate.base64
+
+        Import-PfxCertificate `
+          -FilePath ${{ runner.temp }}/certificate.pfx `
+          -CertStoreLocation Cert:\CurrentUser\My `
+          -Password (ConvertTo-SecureString -String $env:WINDOWS_CERTIFICATE_PASSWORD -Force -AsPlainText)
+
+      env:
+        WINDOWS_CERTIFICATE: ${{ fromJSON(inputs.secrets).WINDOWS_SIGNING }}
+        WINDOWS_CERTIFICATE_PASSWORD: ${{ fromJSON(inputs.secrets).WINDOWS_SIGNING_PASSWORD }}
+
+    # https://github.com/product-os/scripts/tree/master/shared
+    # https://github.com/product-os/balena-concourse/blob/master/pipelines/github-events/template.yml
+    - name: Package release
+      shell: bash
+      run: |
+        set -ea
+
+        [[ '${{ inputs.VERBOSE }}' =~ on|On|Yes|yes|true|True ]] && set -x
+
+        runner_os="$(echo "${RUNNER_OS}" | tr '[:upper:]' '[:lower:]')"
+        runner_arch="$(echo "${RUNNER_ARCH}" | tr '[:upper:]' '[:lower:]')"
+
+        if [[ $runner_os =~ darwin|macos|osx ]]; then
+            CSC_KEY_PASSWORD=${{ fromJSON(inputs.secrets).APPLE_SIGNING_PASSWORD }}
+            CSC_KEYCHAIN=signing_temp
+            CSC_LINK=${{ fromJSON(inputs.secrets).APPLE_SIGNING }}
+
+        elif [[ $runner_os =~ windows|win ]]; then
+            CSC_KEY_PASSWORD=${{ fromJSON(inputs.secrets).WINDOWS_SIGNING_PASSWORD }}
+            CSC_LINK='${{ runner.temp }}\certificate.pfx'
+
+            # patches/all/oclif.patch
+            MSYSSHELLPATH="$(which bash)"
+            MSYSTEM=MSYS
+
+            # (signtool.exe) https://github.com/actions/runner-images/blob/main/images/win/Windows2019-Readme.md#installed-windows-sdks
+            PATH="/c/Program Files (x86)/Windows Kits/10/bin/${runner_arch}:${PATH}"
+        fi
+
+        npm run package
+
+        find dist -type f -maxdepth 1
+
+      env:
+        # https://github.blog/2020-08-03-github-actions-improvements-for-fork-and-pull-request-workflows/#improvements-for-public-repository-forks
+        # https://docs.github.com/en/actions/managing-workflow-runs/approving-workflow-runs-from-public-forks#about-workflow-runs-from-public-forks
+        CSC_FOR_PULL_REQUEST: true
+        # https://sectigo.com/resource-library/time-stamping-server
+        TIMESTAMP_SERVER: http://timestamp.sectigo.com
+        # Apple notarization (automation/build-bin.ts)
+        XCODE_APP_LOADER_EMAIL: ${{ inputs.XCODE_APP_LOADER_EMAIL }}
+        XCODE_APP_LOADER_PASSWORD: ${{ fromJSON(inputs.secrets).XCODE_APP_LOADER_PASSWORD }}
+        XCODE_APP_LOADER_TEAM_ID: ${{ inputs.XCODE_APP_LOADER_TEAM_ID }}
+
+    - name: Upload artifacts
+      uses: actions/upload-artifact@v3
+      with:
+        name: gh-release-${{ github.event.pull_request.head.sha || github.event.head_commit.id }}
+        path: dist
+        retention-days: 1

.github/actions/test/action.yml

@@ -0,0 +1,59 @@
+---
+name: test release
+# https://github.com/product-os/flowzone/tree/master/.github/actions
+inputs:
+  json:
+    description: "JSON stringified object containing all the inputs from the calling workflow"
+    required: true
+  secrets:
+    description: "JSON stringified object containing all the secrets from the calling workflow"
+    required: true
+  variables:
+    description: "JSON stringified object containing all the variables from the calling workflow"
+    required: true
+
+  # --- custom environment
+  NODE_VERSION:
+    type: string
+    default: '16.x'
+  VERBOSE:
+    type: string
+    default: "true"
+
+runs:
+  # https://docs.github.com/en/actions/creating-actions/creating-a-composite-action
+  using: "composite"
+  steps:
+    # https://github.com/actions/setup-node#caching-global-packages-data
+    - name: Setup Node.js
+      uses: actions/setup-node@v3
+      with:
+        node-version: ${{ inputs.NODE_VERSION }}
+        cache: npm
+
+    - name: Test release
+      shell: bash
+      run: |
+        set -ea
+
+        [[ '${{ inputs.VERBOSE }}' =~ on|On|Yes|yes|true|True ]] && set -x
+
+        if [[ -e package-lock.json ]] || [[ -e npm-shrinkwrap.json ]]; then
+            npm ci
+        else
+            npm i
+        fi
+
+        npm run build
+        npm run test
+
+    - name: Compress custom source
+      shell: pwsh
+      run: tar -acf ${{ runner.temp }}/custom.tgz .
+
+    - name: Upload custom artifact
+      uses: actions/upload-artifact@v3
+      with:
+        name: custom-${{ github.event.pull_request.head.sha || github.event.head_commit.id }}-${{ runner.os }}-${{ runner.arch }}
+        path: ${{ runner.temp }}/custom.tgz
+        retention-days: 1

.github/workflows/flowzone.yml

@@ -0,0 +1,29 @@
+name: Flowzone
+
+on:
+  pull_request:
+    types: [opened, synchronize, closed]
+    branches: [main, master]
+  pull_request_target:
+    types: [opened, synchronize, closed]
+    branches: [main, master]
+
+jobs:
+  flowzone:
+    name: Flowzone
+    uses: product-os/flowzone/.github/workflows/flowzone.yml@v4.7.1
+    # prevent duplicate workflow executions for pull_request and pull_request_target
+    if: |
+      (
+        github.event.pull_request.head.repo.full_name == github.repository &&
+        github.event_name == 'pull_request'
+      ) || (
+        github.event.pull_request.head.repo.full_name != github.repository &&
+        github.event_name == 'pull_request_target'
+      )
+    secrets: inherit
+    with:
+      custom_runs_on: '[["self-hosted","Linux","distro:focal","X64"],["self-hosted","Linux","distro:focal","ARM64"],["macos-12"],["windows-2019"]]'
+      repo_config: true
+      repo_description: "The official balena CLI tool."
+      github_prerelease: false

.resinci.yml

@@ -1,15 +0,0 @@
----
-npm:
-  platforms:
-    - name: linux
-      os: ubuntu
-      architecture: x86_64
-      node_versions:
-        - "12"
-        - "14"
-    - name: linux
-      os: alpine
-      architecture: x86_64
-      node_versions:
-        - "12"
-        - "14"

CONTRIBUTING.md

@@ -125,6 +125,39 @@ The README file is manually edited, but subsections are automatically extracted
 
 The `INSTALL*.md` and `TROUBLESHOOTING.md` files are also manually edited.
 
+## Patches folder
+
+The `patches` folder contains patch files created with the
+[patch-package](https://www.npmjs.com/package/patch-package) tool. Small code changes to
+third-party modules can be made by directly editing Javascript files under the `node_modules`
+folder and then running `patch-package` to create the patch files. The patch files are then
+applied immediately after `npm install`, through the `postinstall` script defined in
+`package.json`.
+
+The subfolders of the `patches` folder are documented in the
+[apply-patches.js](https://github.com/balena-io/balena-cli/blob/master/patches/apply-patches.js)
+script.
+
+To make changes to the patch files under the `patches` folder, **do not edit them directly,**
+not even for a "single character change" because the hash values in the patch files also need
+to be recomputed by `patch-packages`. Instead, edit the relevant files under `node_modules`
+directly, and then run `patch-packages` with the `--patch-dir` option to specify the subfolder
+where the patch should be saved. For example, edit `node_modules/exit-hook/index.js` and then
+run:
+
+```sh
+$ npx patch-package --patch-dir patches/all exit-hook
+```
+
+That said, these kinds of patches should be avoided in favour of creating pull requests
+upstream. Patch files create additional maintenance work over time as the patches need to be
+updated when the dependencies are updated, and they prevent the compounding community benefit
+that sharing fixes upstream have on open source projects like the balena CLI. The typical
+scenario where these patches are used is when the upstream maintainers are unresponsive or
+unwilling to merge the required fixes, the fixes are very small and specific to the balena CLI,
+and creating a fork of the upstream repo is likely to be more long-term effort than maintaining
+the patches.
+
 ## Windows
 
 Besides the regular npm installation dependencies, the `npm run build:installer` script

INSTALL-ADVANCED.md

@@ -78,8 +78,8 @@ If you are a Node.js developer, you may wish to install the balena CLI via [npm]
 The npm installation involves building native (platform-specific) binary modules, which require
 some development tools to be installed first, as follows.
 
-> **The balena CLI currently requires Node.js version 10 (min 10.20.0) or 12.**  
-> **Versions 13 and later are not yet fully supported.**
+> **The balena CLI currently requires Node.js version 16.**  
+> **Versions 17 and later are not yet fully supported.**
 
 ### Install development tools
 
@@ -89,7 +89,7 @@ some development tools to be installed first, as follows.
 $ sudo apt-get update && sudo apt-get -y install curl python3 git make g++
 $ curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.38.0/install.sh | bash
 $ . ~/.bashrc
-$ nvm install 12
+$ nvm install 16
 ```
 
 The `curl` command line above uses
@@ -106,15 +106,15 @@ recommended.
 ```sh
 $ curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.38.0/install.sh | bash
 $ . ~/.bashrc
-$ nvm install 12
+$ nvm install 16
 ```
 
 #### **Windows** (not WSL)
 
 Install:
 
-* Node.js v12 from the [Nodejs.org releases page](https://nodejs.org/en/download/releases/).
   * If you'd like the ability to switch between Node.js versions, install
+- Node.js v16 from the [Nodejs.org releases page](https://nodejs.org/en/download/releases/).
     [nvm-windows](https://github.com/coreybutler/nvm-windows#node-version-manager-nvm-for-windows)
     instead.
 * The [MSYS2 shell](https://www.msys2.org/), which provides `git`, `make`, `g++` and more:

automation/build-bin.ts

@@ -45,8 +45,6 @@ const execFileAsync = promisify(execFile);
 export const packageJSON = loadPackageJson();
 export const version = 'v' + packageJSON.version;
 const arch = process.arch;
-const MSYS2_BASH =
-	process.env.MSYSSHELLPATH || 'C:\\msys64\\usr\\bin\\bash.exe';
 
 function dPath(...paths: string[]) {
 	return path.join(ROOT, 'dist', ...paths);
@@ -89,7 +87,7 @@ async function diffPkgOutput(pkgOut: string) {
 		'tests',
 		'test-data',
 		'pkg',
-		`expected-warnings-${process.platform}.txt`,
+		`expected-warnings-${process.platform}-${arch}.txt`,
 	);
 	const absSavedPath = path.join(ROOT, relSavedPath);
 	const ignoreStartsWith = [
@@ -182,9 +180,18 @@ async function execPkg(...args: any[]) {
  * to be directly executed from inside another binary executable.)
  */
 async function buildPkg() {
+	// https://github.com/vercel/pkg#targets
+	let targets = `linux-${arch}`;
+	// TBC: not possible to build for macOS or Windows arm64 on x64 nodes
+	if (process.platform === 'darwin') {
+		targets = `macos-x64`;
+	}
+	if (process.platform === 'win32') {
+		targets = `win-x64`;
+	}
 	const args = [
-		'--target',
-		'host',
+		'--targets',
+		targets,
 		'--output',
 		'build-bin/balena',
 		'package.json',
@@ -425,20 +432,28 @@ async function renameInstallerFiles() {
 
 /**
  * If the CSC_LINK and CSC_KEY_PASSWORD env vars are set, digitally sign the
- * executable installer by running the balena-io/scripts/shared/sign-exe.sh
- * script (which must be in the PATH) using a MSYS2 bash shell.
+ * executable installer using Microsoft SignTool.exe (Sign Tool)
+ * https://learn.microsoft.com/en-us/dotnet/framework/tools/signtool-exe
  */
 async function signWindowsInstaller() {
 	if (process.env.CSC_LINK && process.env.CSC_KEY_PASSWORD) {
 		const exeName = renamedOclifInstallers[process.platform];
 		console.log(`Signing installer "${exeName}"`);
-		await execFileAsync(MSYS2_BASH, [
-			'sign-exe.sh',
+		// trust ...
+		await execFileAsync('signtool.exe', [
+			'sign',
+			'-t',
+			process.env.TIMESTAMP_SERVER || 'http://timestamp.comodoca.com',
 			'-f',
-			exeName,
+			process.env.CSC_LINK,
+			'-p',
+			process.env.CSC_KEY_PASSWORD,
 			'-d',
 			`balena-cli ${version}`,
+			exeName,
 		]);
+		// ... but verify
+		await execFileAsync('signtool.exe', ['verify', '-pa', '-v', exeName]);
 	} else {
 		console.log(
 			'Skipping installer signing step because CSC_* env vars are not set',
@@ -450,14 +465,22 @@ async function signWindowsInstaller() {
  * Wait for Apple Installer Notarization to continue
  */
 async function notarizeMacInstaller(): Promise<void> {
-	const appleId = 'accounts+apple@balena.io';
-	const { notarize } = await import('electron-notarize');
-	await notarize({
-		appBundleId: 'io.balena.etcher',
-		appPath: renamedOclifInstallers.darwin,
-		appleId,
-		appleIdPassword: '@keychain:CLI_PASSWORD',
-	});
+	const teamId = process.env.XCODE_APP_LOADER_TEAM_ID || '66H43P8FRG';
+	const appleId =
+		process.env.XCODE_APP_LOADER_EMAIL || 'accounts+apple@balena.io';
+	const appleIdPassword = process.env.XCODE_APP_LOADER_PASSWORD;
+
+	if (appleIdPassword && teamId) {
+		const { notarize } = await import('@electron/notarize');
+		// https://github.com/electron/notarize#readme
+		await notarize({
+			tool: 'notarytool',
+			teamId,
+			appPath: renamedOclifInstallers.darwin,
+			appleId,
+			appleIdPassword,
+		});
+	}
 }
 
 /**

automation/check-doc.ts

@@ -15,11 +15,12 @@
  * limitations under the License.
  */
 
-const stripIndent = require('common-tags/lib/stripIndent');
-const _ = require('lodash');
-const { promises: fs } = require('fs');
-const path = require('path');
-const simplegit = require('simple-git/promise');
+// tslint:disable-next-line:import-blacklist
+import { stripIndent } from 'common-tags';
+import * as _ from 'lodash';
+import { promises as fs } from 'fs';
+import * as path from 'path';
+import { simpleGit } from 'simple-git';
 
 const ROOT = path.normalize(path.join(__dirname, '..'));
 
@@ -31,7 +32,7 @@ const ROOT = path.normalize(path.join(__dirname, '..'));
  * using `touch`.
  */
 async function checkBuildTimestamps() {
-	const git = simplegit(ROOT);
+	const git = simpleGit(ROOT);
 	const docFile = path.join(ROOT, 'docs', 'balena-cli.md');
 	const [docStat, gitStatus] = await Promise.all([
 		fs.stat(docFile),
@@ -81,4 +82,5 @@ async function run() {
 	}
 }
 
+// tslint:disable-next-line:no-floating-promises
 run();

automation/check-npm-version.js

@@ -6,6 +6,8 @@
  *
  * We don't `require('semver')` to allow this script to be run as a npm
  * 'preinstall' hook, at which point no dependencies have been installed.
+ *
+ * @param {string} version
  */
 function parseSemver(version) {
 	const match = /v?(\d+)\.(\d+).(\d+)/.exec(version);
@@ -16,6 +18,10 @@ function parseSemver(version) {
 	return [parseInt(major, 10), parseInt(minor, 10), parseInt(patch, 10)];
 }
 
+/**
+ * @param {string} v1
+ * @param {string} v2
+ */
 function semverGte(v1, v2) {
 	let v1Array = parseSemver(v1);
 	let v2Array = parseSemver(v2);

automation/update-module.ts

@@ -36,8 +36,8 @@ const run = async (cmd: string) => {
 			}
 			resolve({ stdout, stderr });
 		});
-		p.stdout.pipe(process.stdout);
-		p.stderr.pipe(process.stderr);
+		p.stdout?.pipe(process.stdout);
+		p.stderr?.pipe(process.stderr);
 	});
 };
 

automation/utils.ts

@@ -117,7 +117,7 @@ export async function which(program: string): Promise<string> {
  */
 export async function whichSpawn(
 	programName: string,
-	args?: string[],
+	args: string[] = [],
 ): Promise<void> {
 	const program = await which(programName);
 	let error: Error | undefined;

completion/_balena

@@ -8,19 +8,21 @@ _balena() {
   local context state line curcontext="$curcontext"
 
   # Valid top-level completions
-  main_commands=( build deploy envs fleets join keys leave login logout logs note orgs preload push releases scan settings ssh support tags tunnel version whoami api-key config device device devices env fleet fleet internal key key local os release release tag util )
+  main_commands=( build deploy envs fleets join keys leave login logout logs note orgs preload push releases scan settings ssh support tags tunnel version whoami api-key api-keys app block config device device devices env fleet fleet internal key key local os release release tag util )
   # Sub-completions
-  api_key_cmds=( generate )
+  api_key_cmds=( generate revoke )
+  app_cmds=( create )
+  block_cmds=( create )
   config_cmds=( generate inject read reconfigure write )
-  device_cmds=( deactivate identify init local-mode move os-update public-url purge reboot register rename restart rm shutdown )
+  device_cmds=( deactivate identify init local-mode move os-update pin public-url purge reboot register rename restart rm shutdown track-fleet )
   devices_cmds=( supported )
   env_cmds=( add rename rm )
-  fleet_cmds=( create purge rename restart rm )
+  fleet_cmds=( create pin purge rename restart rm track-latest )
   internal_cmds=( osinit )
   key_cmds=( add rm )
   local_cmds=( configure flash )
   os_cmds=( build-config configure download initialize versions )
-  release_cmds=( finalize )
+  release_cmds=( finalize invalidate validate )
   tag_cmds=( rm set )
 
 
@@ -43,6 +45,12 @@ _balena_sec_cmds() {
       "api-key")
         _describe -t api_key_cmds 'api-key_cmd' api_key_cmds "$@" && ret=0
       ;;
+      "app")
+        _describe -t app_cmds 'app_cmd' app_cmds "$@" && ret=0
+      ;;
+      "block")
+        _describe -t block_cmds 'block_cmd' block_cmds "$@" && ret=0
+      ;;
       "config")
         _describe -t config_cmds 'config_cmd' config_cmds "$@" && ret=0
       ;;

completion/balena-completion.bash

@@ -7,19 +7,21 @@ _balena_complete()
   local cur prev
 
   # Valid top-level completions
-  main_commands="build deploy envs fleets join keys leave login logout logs note orgs preload push releases scan settings ssh support tags tunnel version whoami api-key config device device devices env fleet fleet internal key key local os release release tag util"
+  main_commands="build deploy envs fleets join keys leave login logout logs note orgs preload push releases scan settings ssh support tags tunnel version whoami api-key api-keys app block config device device devices env fleet fleet internal key key local os release release tag util"
   # Sub-completions
-  api_key_cmds="generate"
+  api_key_cmds="generate revoke"
+  app_cmds="create"
+  block_cmds="create"
   config_cmds="generate inject read reconfigure write"
-  device_cmds="deactivate identify init local-mode move os-update public-url purge reboot register rename restart rm shutdown"
+  device_cmds="deactivate identify init local-mode move os-update pin public-url purge reboot register rename restart rm shutdown track-fleet"
   devices_cmds="supported"
   env_cmds="add rename rm"
-  fleet_cmds="create purge rename restart rm"
+  fleet_cmds="create pin purge rename restart rm track-latest"
   internal_cmds="osinit"
   key_cmds="add rm"
   local_cmds="configure flash"
   os_cmds="build-config configure download initialize versions"
-  release_cmds="finalize"
+  release_cmds="finalize invalidate validate"
   tag_cmds="rm set"
 
 
@@ -37,6 +39,12 @@ _balena_complete()
       api-key)
         COMPREPLY=( $(compgen -W "$api_key_cmds" -- $cur) )
         ;;
+      app)
+        COMPREPLY=( $(compgen -W "$app_cmds" -- $cur) )
+        ;;
+      block)
+        COMPREPLY=( $(compgen -W "$block_cmds" -- $cur) )
+        ;;
       config)
         COMPREPLY=( $(compgen -W "$config_cmds" -- $cur) )
         ;;

docs/balena-cli.md

@@ -333,11 +333,35 @@ Examples:
 
 ### Options
 
+#### --fields FIELDS
+
+only show provided fields (comma-separated)
+
+#### -j, --json
+
+output in json format
+
+#### --filter FILTER
+
+filter results by substring matching of a given field, eg: --filter field=foo
+
+#### --no-header
+
+hide table header from output
+
+#### --no-truncate
+
+do not truncate output to fit screen
+
+#### --sort SORT
+
+field to sort by (prepend '-' for descending order)
+
 ## fleet <fleet>
 
 Display detailed information about a single fleet.
 
-Fleets may be specified by fleet name, slug, or numeric ID. Fleet slugs are
+Fleets may be specified by fleet name or slug. Fleet slugs are
 the recommended option, as they are unique and unambiguous. Slugs can be
 listed with the `balena fleets` command. Note that slugs may change if the
 fleet is renamed. Fleet names are not unique and may result in  "Fleet is
@@ -345,23 +369,34 @@ ambiguous" errors at any time (even if it "used to work in the past"), for
 example if the name clashes with a newly created public fleet, or with fleets
 from other balena accounts that you may be invited to join under any role.
 For this reason, fleet names are especially discouraged in scripts (e.g. CI
-environments). Numeric fleet IDs are deprecated because they consist of an
-implementation detail of the balena backend. We intend to remove support for
-numeric IDs at some point in the future.
+environments).
 
 Examples:
 
 	$ balena fleet MyFleet
 	$ balena fleet myorg/myfleet
+	$ balena fleet myorg/myfleet --view
 
 ### Arguments
 
 #### FLEET
 
-fleet name, slug (preferred), or numeric ID (deprecated)
+fleet name or slug (preferred)
 
 ### Options
 
+#### --view
+
+open fleet dashboard page
+
+#### --fields FIELDS
+
+only show provided fields (comma-separated)
+
+#### -j, --json
+
+output in json format
+
 ## fleet create <name>
 
 Create a new balena fleet.
@@ -408,7 +443,7 @@ fleet device type (Check available types with `balena devices supported`)
 Purge data from all devices belonging to a fleet.
 This will clear the fleet's '/data' directory.
 
-Fleets may be specified by fleet name, slug, or numeric ID. Fleet slugs are
+Fleets may be specified by fleet name or slug. Fleet slugs are
 the recommended option, as they are unique and unambiguous. Slugs can be
 listed with the `balena fleets` command. Note that slugs may change if the
 fleet is renamed. Fleet names are not unique and may result in  "Fleet is
@@ -416,9 +451,7 @@ ambiguous" errors at any time (even if it "used to work in the past"), for
 example if the name clashes with a newly created public fleet, or with fleets
 from other balena accounts that you may be invited to join under any role.
 For this reason, fleet names are especially discouraged in scripts (e.g. CI
-environments). Numeric fleet IDs are deprecated because they consist of an
-implementation detail of the balena backend. We intend to remove support for
-numeric IDs at some point in the future.
+environments).
 
 Examples:
 
@@ -429,7 +462,7 @@ Examples:
 
 #### FLEET
 
-fleet name, slug (preferred), or numeric ID (deprecated)
+fleet name or slug (preferred)
 
 ### Options
 
@@ -440,7 +473,7 @@ Rename a fleet.
 Note, if the `newName` parameter is omitted, it will be
 prompted for interactively.
 
-Fleets may be specified by fleet name, slug, or numeric ID. Fleet slugs are
+Fleets may be specified by fleet name or slug. Fleet slugs are
 the recommended option, as they are unique and unambiguous. Slugs can be
 listed with the `balena fleets` command. Note that slugs may change if the
 fleet is renamed. Fleet names are not unique and may result in  "Fleet is
@@ -448,9 +481,7 @@ ambiguous" errors at any time (even if it "used to work in the past"), for
 example if the name clashes with a newly created public fleet, or with fleets
 from other balena accounts that you may be invited to join under any role.
 For this reason, fleet names are especially discouraged in scripts (e.g. CI
-environments). Numeric fleet IDs are deprecated because they consist of an
-implementation detail of the balena backend. We intend to remove support for
-numeric IDs at some point in the future.
+environments).
 
 Examples:
 
@@ -462,7 +493,7 @@ Examples:
 
 #### FLEET
 
-fleet name, slug (preferred), or numeric ID (deprecated)
+fleet name or slug (preferred)
 
 #### NEWNAME
 
@@ -474,7 +505,7 @@ the new name for the fleet
 
 Restart all devices belonging to a fleet.
 
-Fleets may be specified by fleet name, slug, or numeric ID. Fleet slugs are
+Fleets may be specified by fleet name or slug. Fleet slugs are
 the recommended option, as they are unique and unambiguous. Slugs can be
 listed with the `balena fleets` command. Note that slugs may change if the
 fleet is renamed. Fleet names are not unique and may result in  "Fleet is
@@ -482,9 +513,7 @@ ambiguous" errors at any time (even if it "used to work in the past"), for
 example if the name clashes with a newly created public fleet, or with fleets
 from other balena accounts that you may be invited to join under any role.
 For this reason, fleet names are especially discouraged in scripts (e.g. CI
-environments). Numeric fleet IDs are deprecated because they consist of an
-implementation detail of the balena backend. We intend to remove support for
-numeric IDs at some point in the future.
+environments).
 
 Examples:
 
@@ -495,7 +524,7 @@ Examples:
 
 #### FLEET
 
-fleet name, slug (preferred), or numeric ID (deprecated)
+fleet name or slug (preferred)
 
 ### Options
 
@@ -505,7 +534,7 @@ Permanently remove a fleet.
 
 The --yes option may be used to avoid interactive confirmation.
 
-Fleets may be specified by fleet name, slug, or numeric ID. Fleet slugs are
+Fleets may be specified by fleet name or slug. Fleet slugs are
 the recommended option, as they are unique and unambiguous. Slugs can be
 listed with the `balena fleets` command. Note that slugs may change if the
 fleet is renamed. Fleet names are not unique and may result in  "Fleet is
@@ -513,9 +542,7 @@ ambiguous" errors at any time (even if it "used to work in the past"), for
 example if the name clashes with a newly created public fleet, or with fleets
 from other balena accounts that you may be invited to join under any role.
 For this reason, fleet names are especially discouraged in scripts (e.g. CI
-environments). Numeric fleet IDs are deprecated because they consist of an
-implementation detail of the balena backend. We intend to remove support for
-numeric IDs at some point in the future.
+environments).
 
 Examples:
 
@@ -527,7 +554,7 @@ Examples:
 
 #### FLEET
 
-fleet name, slug (preferred), or numeric ID (deprecated)
+fleet name or slug (preferred)
 
 ### Options
 
@@ -618,7 +645,7 @@ List all of your devices.
 
 Devices can be filtered by fleet with the `--fleet` option.
 
-Fleets may be specified by fleet name, slug, or numeric ID. Fleet slugs are
+Fleets may be specified by fleet name or slug. Fleet slugs are
 the recommended option, as they are unique and unambiguous. Slugs can be
 listed with the `balena fleets` command. Note that slugs may change if the
 fleet is renamed. Fleet names are not unique and may result in  "Fleet is
@@ -626,9 +653,7 @@ ambiguous" errors at any time (even if it "used to work in the past"), for
 example if the name clashes with a newly created public fleet, or with fleets
 from other balena accounts that you may be invited to join under any role.
 For this reason, fleet names are especially discouraged in scripts (e.g. CI
-environments). Numeric fleet IDs are deprecated because they consist of an
-implementation detail of the balena backend. We intend to remove support for
-numeric IDs at some point in the future.
+environments).
 
 The --json option is recommended when scripting the output of this command,
 because field names are less likely to change in JSON format and because it
@@ -646,7 +671,7 @@ Examples:
 
 #### -f, --fleet FLEET
 
-fleet name, slug (preferred), or numeric ID (deprecated)
+fleet name or slug (preferred)
 
 #### -j, --json
 
@@ -680,6 +705,7 @@ Show information about a single device.
 Examples:
 
 	$ balena device 7cf02a6
+	$ balena device 7cf02a6 --view
 
 ### Arguments
 
@@ -689,6 +715,10 @@ the device uuid
 
 ### Options
 
+#### --view
+
+open device dashboard page
+
 ## device deactivate <uuid>
 
 Deactivate a device.
@@ -753,7 +783,7 @@ If the '--fleet' or '--drive' options are omitted, interactive menus will be
 presented with values to choose from. If the '--os-version' option is omitted,
 the latest released OS version for the fleet's default device type will be used.
 
-Fleets may be specified by fleet name, slug, or numeric ID. Fleet slugs are
+Fleets may be specified by fleet name or slug. Fleet slugs are
 the recommended option, as they are unique and unambiguous. Slugs can be
 listed with the `balena fleets` command. Note that slugs may change if the
 fleet is renamed. Fleet names are not unique and may result in  "Fleet is
@@ -761,9 +791,7 @@ ambiguous" errors at any time (even if it "used to work in the past"), for
 example if the name clashes with a newly created public fleet, or with fleets
 from other balena accounts that you may be invited to join under any role.
 For this reason, fleet names are especially discouraged in scripts (e.g. CI
-environments). Numeric fleet IDs are deprecated because they consist of an
-implementation detail of the balena backend. We intend to remove support for
-numeric IDs at some point in the future.
+environments).
 
 Image configuration questions will be asked interactively unless a pre-configured
 'config.json' file is provided with the '--config' option.  The file can be
@@ -773,13 +801,14 @@ Examples:
 
 	$ balena device init
 	$ balena device init -f myorg/myfleet
+	$ balena device init --fleet myFleet --os-version 2.101.7 --drive /dev/disk5 --config config.json --yes
 	$ balena device init --fleet myFleet --os-version 2.83.21+rev1.prod --drive /dev/disk5 --config config.json --yes
 
 ### Options
 
 #### -f, --fleet FLEET
 
-fleet name, slug (preferred), or numeric ID (deprecated)
+fleet name or slug (preferred)
 
 #### -y, --yes
 
@@ -811,6 +840,10 @@ path to the config JSON file, see `balena os build-config`
 
 custom key name assigned to generated provisioning api key
 
+#### --provisioning-key-expiry-date PROVISIONING-KEY-EXPIRY-DATE
+
+expiry date assigned to generated provisioning api key (format: YYYY-MM-DD)
+
 ## device local-mode <uuid>
 
 Output current local mode status, or enable/disable local mode
@@ -849,7 +882,7 @@ Move one or more devices to another fleet.
 
 If --fleet is omitted, the fleet will be prompted for interactively.
 
-Fleets may be specified by fleet name, slug, or numeric ID. Fleet slugs are
+Fleets may be specified by fleet name or slug. Fleet slugs are
 the recommended option, as they are unique and unambiguous. Slugs can be
 listed with the `balena fleets` command. Note that slugs may change if the
 fleet is renamed. Fleet names are not unique and may result in  "Fleet is
@@ -857,9 +890,7 @@ ambiguous" errors at any time (even if it "used to work in the past"), for
 example if the name clashes with a newly created public fleet, or with fleets
 from other balena accounts that you may be invited to join under any role.
 For this reason, fleet names are especially discouraged in scripts (e.g. CI
-environments). Numeric fleet IDs are deprecated because they consist of an
-implementation detail of the balena backend. We intend to remove support for
-numeric IDs at some point in the future.
+environments).
 
 Examples:
 
@@ -878,7 +909,7 @@ comma-separated list (no blank spaces) of device UUIDs to be moved
 
 #### -f, --fleet FLEET
 
-fleet name, slug (preferred), or numeric ID (deprecated)
+fleet name or slug (preferred)
 
 ## device os-update <uuid>
 
@@ -892,6 +923,7 @@ Requires balenaCloud; will not work with openBalena or standalone balenaOS.
 Examples:
 
 	$ balena device os-update 23c73a1
+	$ balena device os-update 23c73a1 --version 2.101.7
 	$ balena device os-update 23c73a1 --version 2.31.0+rev1.prod
 
 ### Arguments
@@ -916,9 +948,6 @@ This command will output the current public URL for the
 specified device.  It can also enable or disable the URL,
 or output the enabled status, using the respective options.
 
-The old command style 'balena device public-url enable <uuid>'
-is deprecated, but still supported.
-
 Examples:
 
 	$ balena device public-url 23c73a1
@@ -932,10 +961,6 @@ Examples:
 
 the uuid of the device to manage
 
-#### LEGACYUUID
-
-
-
 ### Options
 
 #### --enable
@@ -997,7 +1022,7 @@ Register a new device with a balena fleet.
 
 If --uuid is not provided, a new UUID will be automatically assigned.
 
-Fleets may be specified by fleet name, slug, or numeric ID. Fleet slugs are
+Fleets may be specified by fleet name or slug. Fleet slugs are
 the recommended option, as they are unique and unambiguous. Slugs can be
 listed with the `balena fleets` command. Note that slugs may change if the
 fleet is renamed. Fleet names are not unique and may result in  "Fleet is
@@ -1005,21 +1030,20 @@ ambiguous" errors at any time (even if it "used to work in the past"), for
 example if the name clashes with a newly created public fleet, or with fleets
 from other balena accounts that you may be invited to join under any role.
 For this reason, fleet names are especially discouraged in scripts (e.g. CI
-environments). Numeric fleet IDs are deprecated because they consist of an
-implementation detail of the balena backend. We intend to remove support for
-numeric IDs at some point in the future.
+environments).
 
 Examples:
 
 	$ balena device register MyFleet
 	$ balena device register MyFleet --uuid <uuid>
 	$ balena device register myorg/myfleet --uuid <uuid>
+	$ balena device register myorg/myfleet --uuid <uuid> --deviceType <deviceTypeSlug>
 
 ### Arguments
 
 #### FLEET
 
-fleet name, slug (preferred), or numeric ID (deprecated)
+fleet name or slug (preferred)
 
 ### Options
 
@@ -1027,6 +1051,10 @@ fleet name, slug (preferred), or numeric ID (deprecated)
 
 custom uuid
 
+#### --deviceType DEVICETYPE
+
+device type slug (run 'balena devices supported' for possible values)
+
 ## device rename &#60;uuid&#62; [newName]
 
 Rename a device.
@@ -1233,7 +1261,7 @@ name may be null in JSON output (or 'N/A' in tabular output) if the fleet that
 the device belonged to is no longer accessible by the current user (for example,
 in case the current user was removed from the fleet by the fleet's owner).
 
-Fleets may be specified by fleet name, slug, or numeric ID. Fleet slugs are
+Fleets may be specified by fleet name or slug. Fleet slugs are
 the recommended option, as they are unique and unambiguous. Slugs can be
 listed with the `balena fleets` command. Note that slugs may change if the
 fleet is renamed. Fleet names are not unique and may result in  "Fleet is
@@ -1241,9 +1269,7 @@ ambiguous" errors at any time (even if it "used to work in the past"), for
 example if the name clashes with a newly created public fleet, or with fleets
 from other balena accounts that you may be invited to join under any role.
 For this reason, fleet names are especially discouraged in scripts (e.g. CI
-environments). Numeric fleet IDs are deprecated because they consist of an
-implementation detail of the balena backend. We intend to remove support for
-numeric IDs at some point in the future.
+environments).
 
 Examples:
 
@@ -1261,7 +1287,7 @@ Examples:
 
 #### -f, --fleet FLEET
 
-fleet name, slug (preferred), or numeric ID (deprecated)
+fleet name or slug (preferred)
 
 #### -c, --config
 
@@ -1371,7 +1397,7 @@ therefore the --service option cannot be used when the variable name starts
 with a reserved prefix. When defining custom fleet variables, please avoid
 these reserved prefixes.
 
-Fleets may be specified by fleet name, slug, or numeric ID. Fleet slugs are
+Fleets may be specified by fleet name or slug. Fleet slugs are
 the recommended option, as they are unique and unambiguous. Slugs can be
 listed with the `balena fleets` command. Note that slugs may change if the
 fleet is renamed. Fleet names are not unique and may result in  "Fleet is
@@ -1379,9 +1405,7 @@ ambiguous" errors at any time (even if it "used to work in the past"), for
 example if the name clashes with a newly created public fleet, or with fleets
 from other balena accounts that you may be invited to join under any role.
 For this reason, fleet names are especially discouraged in scripts (e.g. CI
-environments). Numeric fleet IDs are deprecated because they consist of an
-implementation detail of the balena backend. We intend to remove support for
-numeric IDs at some point in the future.
+environments).
 
 Examples:
 
@@ -1409,7 +1433,7 @@ variable value; if omitted, use value from this process' environment
 
 #### -f, --fleet FLEET
 
-fleet name, slug (preferred), or numeric ID (deprecated)
+fleet name or slug (preferred)
 
 #### -d, --device DEVICE
 
@@ -1492,7 +1516,7 @@ select a service variable (may be used together with the --device option)
 
 List all tags and their values for the specified fleet, device or release.
 
-Fleets may be specified by fleet name, slug, or numeric ID. Fleet slugs are
+Fleets may be specified by fleet name or slug. Fleet slugs are
 the recommended option, as they are unique and unambiguous. Slugs can be
 listed with the `balena fleets` command. Note that slugs may change if the
 fleet is renamed. Fleet names are not unique and may result in  "Fleet is
@@ -1500,9 +1524,7 @@ ambiguous" errors at any time (even if it "used to work in the past"), for
 example if the name clashes with a newly created public fleet, or with fleets
 from other balena accounts that you may be invited to join under any role.
 For this reason, fleet names are especially discouraged in scripts (e.g. CI
-environments). Numeric fleet IDs are deprecated because they consist of an
-implementation detail of the balena backend. We intend to remove support for
-numeric IDs at some point in the future.
+environments).
 
 Examples:
 
@@ -1516,7 +1538,7 @@ Examples:
 
 #### -f, --fleet FLEET
 
-fleet name, slug (preferred), or numeric ID (deprecated)
+fleet name or slug (preferred)
 
 #### -d, --device DEVICE
 
@@ -1530,7 +1552,7 @@ release id
 
 Remove a tag from a fleet, device or release.
 
-Fleets may be specified by fleet name, slug, or numeric ID. Fleet slugs are
+Fleets may be specified by fleet name or slug. Fleet slugs are
 the recommended option, as they are unique and unambiguous. Slugs can be
 listed with the `balena fleets` command. Note that slugs may change if the
 fleet is renamed. Fleet names are not unique and may result in  "Fleet is
@@ -1538,9 +1560,7 @@ ambiguous" errors at any time (even if it "used to work in the past"), for
 example if the name clashes with a newly created public fleet, or with fleets
 from other balena accounts that you may be invited to join under any role.
 For this reason, fleet names are especially discouraged in scripts (e.g. CI
-environments). Numeric fleet IDs are deprecated because they consist of an
-implementation detail of the balena backend. We intend to remove support for
-numeric IDs at some point in the future.
+environments).
 
 Examples:
 
@@ -1560,7 +1580,7 @@ the key string of the tag
 
 #### -f, --fleet FLEET
 
-fleet name, slug (preferred), or numeric ID (deprecated)
+fleet name or slug (preferred)
 
 #### -d, --device DEVICE
 
@@ -1578,7 +1598,7 @@ You can optionally provide a value to be associated with the created
 tag, as an extra argument after the tag key. If a value isn't
 provided, a tag with an empty value is created.
 
-Fleets may be specified by fleet name, slug, or numeric ID. Fleet slugs are
+Fleets may be specified by fleet name or slug. Fleet slugs are
 the recommended option, as they are unique and unambiguous. Slugs can be
 listed with the `balena fleets` command. Note that slugs may change if the
 fleet is renamed. Fleet names are not unique and may result in  "Fleet is
@@ -1586,9 +1606,7 @@ ambiguous" errors at any time (even if it "used to work in the past"), for
 example if the name clashes with a newly created public fleet, or with fleets
 from other balena accounts that you may be invited to join under any role.
 For this reason, fleet names are especially discouraged in scripts (e.g. CI
-environments). Numeric fleet IDs are deprecated because they consist of an
-implementation detail of the balena backend. We intend to remove support for
-numeric IDs at some point in the future.
+environments).
 
 Examples:
 
@@ -1615,7 +1633,7 @@ the optional value associated with the tag
 
 #### -f, --fleet FLEET
 
-fleet name, slug (preferred), or numeric ID (deprecated)
+fleet name or slug (preferred)
 
 #### -d, --device DEVICE
 
@@ -1900,7 +1918,7 @@ Examples:
 
 #### FLEETORDEVICE
 
-fleet name/slug/id, device uuid, or address of local device
+fleet name/slug, device uuid, or address of local device
 
 #### SERVICE
 
@@ -1968,7 +1986,7 @@ Examples:
 
 #### DEVICEORFLEET
 
-device UUID or fleet name/slug/ID
+device UUID or fleet name/slug
 
 ### Options
 
@@ -2054,9 +2072,11 @@ Development images can be selected by appending `.dev` to the version.
 Examples:
 
 	$ balena os download raspberrypi3 -o ../foo/bar/raspberry-pi.img
+	$ balena os download raspberrypi3 -o ../foo/bar/raspberry-pi.img --version 2.101.7
+	$ balena os download raspberrypi3 -o ../foo/bar/raspberry-pi.img --version 2022.7.0
+	$ balena os download raspberrypi3 -o ../foo/bar/raspberry-pi.img --version ^2.90.0
 	$ balena os download raspberrypi3 -o ../foo/bar/raspberry-pi.img --version 2.60.1+rev1
 	$ balena os download raspberrypi3 -o ../foo/bar/raspberry-pi.img --version 2.60.1+rev1.dev
-	$ balena os download raspberrypi3 -o ../foo/bar/raspberry-pi.img --version ^2.60.0
 	$ balena os download raspberrypi3 -o ../foo/bar/raspberry-pi.img --version 2021.10.2.prod
 	$ balena os download raspberrypi3 -o ../foo/bar/raspberry-pi.img --version latest
 	$ balena os download raspberrypi3 -o ../foo/bar/raspberry-pi.img --version default
@@ -2140,6 +2160,9 @@ confuse the balenaOS "development mode" with a device's "local mode", the latter
 being a supervisor feature that allows the "balena push" command to push a user's
 application directly to a device in the local network.
 
+The '--secureBoot' option is used to configure a balenaOS installer image to opt-in
+secure boot and disk encryption.
+
 The --system-connection (-c) option is used to inject NetworkManager connection
 profiles for additional network interfaces, such as cellular/GSM or additional
 WiFi or ethernet connections. This option may be passed multiple times in case there
@@ -2147,7 +2170,7 @@ are multiple files to inject. See connection profile examples and reference at:
 https://www.balena.io/docs/reference/OS/network/2.x/
 https://developer.gnome.org/NetworkManager/stable/ref-settings.html
 
-Fleets may be specified by fleet name, slug, or numeric ID. Fleet slugs are
+Fleets may be specified by fleet name or slug. Fleet slugs are
 the recommended option, as they are unique and unambiguous. Slugs can be
 listed with the `balena fleets` command. Note that slugs may change if the
 fleet is renamed. Fleet names are not unique and may result in  "Fleet is
@@ -2155,9 +2178,7 @@ ambiguous" errors at any time (even if it "used to work in the past"), for
 example if the name clashes with a newly created public fleet, or with fleets
 from other balena accounts that you may be invited to join under any role.
 For this reason, fleet names are especially discouraged in scripts (e.g. CI
-environments). Numeric fleet IDs are deprecated because they consist of an
-implementation detail of the balena backend. We intend to remove support for
-numeric IDs at some point in the future.
+environments).
 
 Note: This command is currently not supported on Windows natively. Windows users
 are advised to install the Windows Subsystem for Linux (WSL) with Ubuntu, and use
@@ -2186,7 +2207,7 @@ ask advanced configuration questions (when in interactive mode)
 
 #### -f, --fleet FLEET
 
-fleet name, slug (preferred), or numeric ID (deprecated)
+fleet name or slug (preferred)
 
 #### --config CONFIG
 
@@ -2212,6 +2233,10 @@ WiFi SSID (network name) (non-interactive configuration)
 
 Configure balenaOS to operate in development mode
 
+#### --secureBoot
+
+Configure balenaOS installer to opt-in secure boot and disk encryption
+
 #### -d, --device DEVICE
 
 device UUID
@@ -2236,10 +2261,16 @@ paths to local files to place into the 'system-connections' directory
 
 custom key name assigned to generated provisioning api key
 
+#### --provisioning-key-expiry-date PROVISIONING-KEY-EXPIRY-DATE
+
+expiry date assigned to generated provisioning api key (format: YYYY-MM-DD)
+
 ## os initialize &#60;image&#62;
 
 Initialize an os image for a device with a previously
-		configured operating system image.
+		configured operating system image and flash the
+		an external storage drive or the device's storage
+		medium depending on the device type.
 		
 
 Note: Initializing the device may ask for administrative permissions
@@ -2290,13 +2321,16 @@ confuse the balenaOS "development mode" with a device's "local mode", the latter
 being a supervisor feature that allows the "balena push" command to push a user's
 application directly to a device in the local network.
 
+The '--secureBoot' option is used to configure a balenaOS installer image to opt-in
+secure boot and disk encryption.
+
 To configure an image for a fleet of mixed device types, use the --fleet option
 alongside the --deviceType option to specify the target device type.
 
 To avoid interactive questions, specify a command line option for each question that
 would otherwise be asked.
 
-Fleets may be specified by fleet name, slug, or numeric ID. Fleet slugs are
+Fleets may be specified by fleet name or slug. Fleet slugs are
 the recommended option, as they are unique and unambiguous. Slugs can be
 listed with the `balena fleets` command. Note that slugs may change if the
 fleet is renamed. Fleet names are not unique and may result in  "Fleet is
@@ -2304,9 +2338,7 @@ ambiguous" errors at any time (even if it "used to work in the past"), for
 example if the name clashes with a newly created public fleet, or with fleets
 from other balena accounts that you may be invited to join under any role.
 For this reason, fleet names are especially discouraged in scripts (e.g. CI
-environments). Numeric fleet IDs are deprecated because they consist of an
-implementation detail of the balena backend. We intend to remove support for
-numeric IDs at some point in the future.
+environments).
 
 Examples:
 
@@ -2315,6 +2347,7 @@ Examples:
 	$ balena config generate --device 7cf02a6 --version 2.12.7 --deviceApiKey <existingDeviceKey>
 	$ balena config generate --device 7cf02a6 --version 2.12.7 --output config.json
 	$ balena config generate --fleet myorg/fleet --version 2.12.7 --dev
+	$ balena config generate --fleet myorg/fleet --version 2.12.7 --secureBoot
 	$ balena config generate --fleet myorg/fleet --version 2.12.7 --deviceType fincm3
 	$ balena config generate --fleet myorg/fleet --version 2.12.7 --output config.json
 	$ balena config generate --fleet myorg/fleet --version 2.12.7 --network wifi --wifiSsid mySsid --wifiKey abcdefgh --appUpdatePollInterval 15
@@ -2327,12 +2360,16 @@ a balenaOS version
 
 #### -f, --fleet FLEET
 
-fleet name, slug (preferred), or numeric ID (deprecated)
+fleet name or slug (preferred)
 
 #### --dev
 
 Configure balenaOS to operate in development mode
 
+#### --secureBoot
+
+Configure balenaOS installer to opt-in secure boot and disk encryption
+
 #### -d, --device DEVICE
 
 device UUID
@@ -2373,6 +2410,10 @@ supervisor cloud polling interval in minutes (e.g. for device variables)
 
 custom key name assigned to generated provisioning api key
 
+#### --provisioning-key-expiry-date PROVISIONING-KEY-EXPIRY-DATE
+
+expiry date assigned to generated provisioning api key (format: YYYY-MM-DD)
+
 ## config inject &#60;file&#62;
 
 Inject a 'config.json' file to a balenaOS image file or attached SD card or
@@ -2394,10 +2435,6 @@ the path to the config.json file to inject
 
 ### Options
 
-#### -t, --type TYPE
-
-ignored - no longer required
-
 #### -d, --drive DRIVE
 
 path to OS image file (e.g. balena.img) or block device (e.g. /dev/disk2)
@@ -2418,10 +2455,6 @@ Examples:
 
 ### Options
 
-#### -t, --type TYPE
-
-ignored - no longer required
-
 #### -d, --drive DRIVE
 
 path to OS image file (e.g. balena.img) or block device (e.g. /dev/disk2)
@@ -2449,10 +2482,6 @@ Examples:
 
 ### Options
 
-#### -t, --type TYPE
-
-ignored - no longer required
-
 #### -d, --drive DRIVE
 
 path to OS image file (e.g. balena.img) or block device (e.g. /dev/disk2)
@@ -2491,10 +2520,6 @@ the value of the config parameter to write
 
 ### Options
 
-#### -t, --type TYPE
-
-ignored - no longer required
-
 #### -d, --drive DRIVE
 
 path to OS image file (e.g. balena.img) or block device (e.g. /dev/disk2)
@@ -2515,7 +2540,7 @@ Check also the Preloading and Preregistering section of the balena CLI's advance
 masterclass document:
 https://www.balena.io/docs/learn/more/masterclasses/advanced-cli/#5-preloading-and-preregistering
 
-Fleets may be specified by fleet name, slug, or numeric ID. Fleet slugs are
+Fleets may be specified by fleet name or slug. Fleet slugs are
 the recommended option, as they are unique and unambiguous. Slugs can be
 listed with the `balena fleets` command. Note that slugs may change if the
 fleet is renamed. Fleet names are not unique and may result in  "Fleet is
@@ -2523,9 +2548,7 @@ ambiguous" errors at any time (even if it "used to work in the past"), for
 example if the name clashes with a newly created public fleet, or with fleets
 from other balena accounts that you may be invited to join under any role.
 For this reason, fleet names are especially discouraged in scripts (e.g. CI
-environments). Numeric fleet IDs are deprecated because they consist of an
-implementation detail of the balena backend. We intend to remove support for
-numeric IDs at some point in the future.
+environments).
 
 Note that the this command requires Docker to be installed, as further detailed
 in the balena CLI's installation instructions:
@@ -2551,7 +2574,7 @@ the image file path
 
 #### -f, --fleet FLEET
 
-fleet name, slug (preferred), or numeric ID (deprecated)
+fleet name or slug (preferred)
 
 #### -c, --commit COMMIT
 
@@ -2715,6 +2738,7 @@ Examples:
 	$ balena push myFleet
 	$ balena push myFleet --source <source directory>
 	$ balena push myFleet -s <source directory>
+	$ balena push myFleet --source <source directory> --note "this is the note for this release"
 	$ balena push myFleet --release-tag key1 "" key2 "value2 with spaces"
 	$ balena push myorg/myfleet
 	
@@ -2779,7 +2803,7 @@ used (usually $HOME/.balena/secrets.yml|.json)
 
 Don't run a live session on this push. The filesystem will not be monitored,
 and changes will not be synchronized to any running containers. Note that both
-this flag and --detached and required to cause the process to end once the
+this flag and --detached are required to cause the process to end once the
 initial build has completed.
 
 #### -d, --detached
@@ -2831,6 +2855,10 @@ by the 'track latest' release policy but can be used through release pinning.
 Draft releases can be marked as final through the API. Releases are created
 as final by default unless this option is given.
 
+#### --note NOTE
+
+The notes for this release
+
 # Settings
 
 ## settings
@@ -3010,7 +3038,7 @@ the type of device this build is for
 
 #### -f, --fleet FLEET
 
-fleet name, slug (preferred), or numeric ID (deprecated)
+fleet name or slug (preferred)
 
 #### -e, --emulated
 
@@ -3020,10 +3048,6 @@ Use QEMU for ARM architecture emulation during the image build
 
 Alternative Dockerfile name/path, relative to the source folder
 
-#### --logs
-
-No-op and deprecated since balena CLI v12.0.0. Build logs are now shown by default.
-
 #### --nologs
 
 Hide the image build log output (produce less verbose output)
@@ -3196,6 +3220,7 @@ Examples:
 
 	$ balena deploy myFleet
 	$ balena deploy myorg/myfleet --build --source myBuildDir/
+	$ balena deploy myorg/myfleet --build --source myBuildDir/ --note "this is the note for this release"
 	$ balena deploy myorg/myfleet myRepo/myImage
 	$ balena deploy myFleet myRepo/myImage --release-tag key1 "" key2 "value2 with spaces"
 
@@ -3203,7 +3228,7 @@ Examples:
 
 #### FLEET
 
-fleet name, slug (preferred), or numeric ID (deprecated)
+fleet name or slug (preferred)
 
 #### IMAGE
 
@@ -3236,6 +3261,10 @@ by the 'track latest' release policy but can be used through release pinning.
 Draft releases can be marked as final through the API. Releases are created
 as final by default unless this option is given.
 
+#### --note NOTE
+
+The notes for this release
+
 #### -e, --emulated
 
 Use QEMU for ARM architecture emulation during the image build
@@ -3244,10 +3273,6 @@ Use QEMU for ARM architecture emulation during the image build
 
 Alternative Dockerfile name/path, relative to the source folder
 
-#### --logs
-
-No-op and deprecated since balena CLI v12.0.0. Build logs are now shown by default.
-
 #### --nologs
 
 Hide the image build log output (produce less verbose output)
@@ -3341,7 +3366,7 @@ scan the local network for balenaOS devices and prompt you to select one
 from an interactive picker. This may require administrator/root privileges.
 Likewise, if the fleet option is not provided then a picker will be shown.
 
-Fleets may be specified by fleet name, slug, or numeric ID. Fleet slugs are
+Fleets may be specified by fleet name or slug. Fleet slugs are
 the recommended option, as they are unique and unambiguous. Slugs can be
 listed with the `balena fleets` command. Note that slugs may change if the
 fleet is renamed. Fleet names are not unique and may result in  "Fleet is
@@ -3349,9 +3374,7 @@ ambiguous" errors at any time (even if it "used to work in the past"), for
 example if the name clashes with a newly created public fleet, or with fleets
 from other balena accounts that you may be invited to join under any role.
 For this reason, fleet names are especially discouraged in scripts (e.g. CI
-environments). Numeric fleet IDs are deprecated because they consist of an
-implementation detail of the balena backend. We intend to remove support for
-numeric IDs at some point in the future.
+environments).
 
 Examples:
 
@@ -3372,7 +3395,7 @@ the IP or hostname of device
 
 #### -f, --fleet FLEET
 
-fleet name, slug (preferred), or numeric ID (deprecated)
+fleet name or slug (preferred)
 
 #### -i, --pollInterval POLLINTERVAL
 
@@ -3428,7 +3451,7 @@ or hours, e.g. '12h', '2d'.
 Both --device and --fleet flags accept multiple values, specified as
 a comma-separated list (with no spaces).
 
-Fleets may be specified by fleet name, slug, or numeric ID. Fleet slugs are
+Fleets may be specified by fleet name or slug. Fleet slugs are
 the recommended option, as they are unique and unambiguous. Slugs can be
 listed with the `balena fleets` command. Note that slugs may change if the
 fleet is renamed. Fleet names are not unique and may result in  "Fleet is
@@ -3436,9 +3459,7 @@ ambiguous" errors at any time (even if it "used to work in the past"), for
 example if the name clashes with a newly created public fleet, or with fleets
 from other balena accounts that you may be invited to join under any role.
 For this reason, fleet names are especially discouraged in scripts (e.g. CI
-environments). Numeric fleet IDs are deprecated because they consist of an
-implementation detail of the balena backend. We intend to remove support for
-numeric IDs at some point in the future.
+environments).
 
 Examples:
 

gulpfile.js

@@ -1,15 +0,0 @@
-const gulp = require('gulp');
-const inlinesource = require('gulp-inline-source');
-
-const OPTIONS = {
-	files: {
-		pages: 'lib/auth/pages/*.ejs',
-	},
-};
-
-gulp.task('pages', () =>
-	gulp
-		.src(OPTIONS.files.pages)
-		.pipe(inlinesource())
-		.pipe(gulp.dest('build/auth/pages')),
-);

lib/auth/utils.ts

@@ -14,57 +14,44 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-import * as _ from 'lodash';
-import * as url from 'url';
 import { getBalenaSdk } from '../utils/lazy';
 
 /**
- * @summary Get dashboard CLI login URL
- * @function
- * @protected
+ * Get dashboard CLI login URL
  *
- * @param {String} callbackUrl - callback url
- * @fulfil {String} - dashboard login url
- * @returns {Promise}
- *
- * @example
- * utils.getDashboardLoginURL('http://127.0.0.1:3000').then (url) ->
- * 	console.log(url)
+ * @param callbackUrl - Callback url, e.g. 'http://127.0.0.1:3000'
+ * @returns Dashboard login URL, e.g.:
+ * 'https://dashboard.balena-cloud.com/login/cli/http%253A%252F%252F127.0.0.1%253A59581%252Fauth'
  */
-export const getDashboardLoginURL = (callbackUrl: string) => {
+export async function getDashboardLoginURL(
+	callbackUrl: string,
+): Promise<string> {
 	// Encode percentages signs from the escaped url
 	// characters to avoid angular getting confused.
 	callbackUrl = encodeURIComponent(callbackUrl).replace(/%/g, '%25');
 
-	return getBalenaSdk()
-		.settings.get('dashboardUrl')
-		.then((dashboardUrl) =>
-			url.resolve(dashboardUrl, `/login/cli/${callbackUrl}`),
-		);
-};
+	const [{ URL }, dashboardUrl] = await Promise.all([
+		import('url'),
+		getBalenaSdk().settings.get('dashboardUrl'),
+	]);
+	return new URL(`/login/cli/${callbackUrl}`, dashboardUrl).href;
+}
 
 /**
- * @summary Log in using a token, but only if the token is valid
- * @function
- * @protected
+ * Log in using a token, but only if the token is valid.
  *
- * @description
  * This function checks that the token is not only well-structured
  * but that it also authenticates with the server successfully.
  *
  * If authenticated, the token is persisted, if not then the previous
  * login state is restored.
  *
- * @param {String} token - session token or api key
- * @fulfil {Boolean} - whether the login was successful or not
- * @returns {Promise}
- *
- * utils.loginIfTokenValid('...').then (loggedIn) ->
- *   if loggedIn
- *     console.log('Token is valid!')
+ * @param token - session token or api key
+ * @returns whether the login was successful or not
  */
-export const loginIfTokenValid = async (token: string): Promise<boolean> => {
-	if (_.isEmpty(token?.trim())) {
+export async function loginIfTokenValid(token?: string): Promise<boolean> {
+	token = (token || '').trim();
+	if (!token) {
 		return false;
 	}
 	const balena = getBalenaSdk();
@@ -86,4 +73,4 @@ export const loginIfTokenValid = async (token: string): Promise<boolean> => {
 		}
 	}
 	return isLoggedIn;
-};
+}

lib/commands/api-key/revoke.ts

@@ -0,0 +1,80 @@
+/**
+ * @license
+ * Copyright 2016-2020 Balena Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import { flags } from '@oclif/command';
+import Command from '../../command';
+import * as cf from '../../utils/common-flags';
+import { getBalenaSdk, stripIndent } from '../../utils/lazy';
+
+interface FlagsDef {
+	help: void;
+}
+
+interface ArgsDef {
+	ids: string;
+}
+
+export default class RevokeCmd extends Command {
+	public static description = stripIndent`
+		Revoke balenaCloud API keys.
+
+		Revoke balenaCloud API keys with the given
+		comma-separated list of ids.
+
+		The given balenaCloud API keys will no longer be usable.
+`;
+	public static examples = [
+		'$ balena api-key revoke 123',
+		'$ balena api-key revoke 123,124,456',
+	];
+
+	public static args = [
+		{
+			name: 'ids',
+			description: 'the API key ids',
+			required: true,
+		},
+	];
+
+	public static usage = 'api-key revoke <ids>';
+
+	public static flags: flags.Input<FlagsDef> = {
+		help: cf.help,
+	};
+
+	public static authenticated = true;
+
+	public async run() {
+		const { args: params } = this.parse<FlagsDef, ArgsDef>(RevokeCmd);
+
+		try {
+			const apiKeyIds = params.ids.split(',');
+			if (apiKeyIds.filter((apiKeyId) => !apiKeyId.match(/^\d+$/)).length > 0) {
+				console.log('API key ids must be positive integers');
+				return;
+			}
+			await Promise.all(
+				apiKeyIds.map(
+					async (id) => await getBalenaSdk().models.apiKey.revoke(Number(id)),
+				),
+			);
+			console.log('Successfully revoked the given API keys');
+		} catch (e) {
+			throw e;
+		}
+	}
+}

lib/commands/api-keys/index.ts

@@ -0,0 +1,95 @@
+/**
+ * @license
+ * Copyright 2016-2020 Balena Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import { flags } from '@oclif/command';
+import Command from '../../command';
+import * as cf from '../../utils/common-flags';
+import { getBalenaSdk, getVisuals, stripIndent } from '../../utils/lazy';
+
+interface FlagsDef {
+	help: void;
+	user?: void;
+	fleet?: string;
+}
+
+export default class ApiKeysCmd extends Command {
+	public static description = stripIndent`
+		Print a list of balenaCloud API keys.
+
+		Print a list of balenaCloud API keys.
+
+		Print a list of balenaCloud API keys for the current user or for a specific fleet with the \`--fleet\` option.
+`;
+	public static examples = ['$ balena api-keys'];
+
+	public static args = [];
+
+	public static usage = 'api-keys';
+
+	public static flags: flags.Input<FlagsDef> = {
+		help: cf.help,
+		user: flags.boolean({
+			char: 'u',
+			description: 'show API keys for your user',
+		}),
+		fleet: cf.fleet,
+	};
+
+	public static authenticated = true;
+
+	public async run() {
+		const { flags: options } = this.parse<FlagsDef, {}>(ApiKeysCmd);
+
+		try {
+			const { getApplication } = await import('../../utils/sdk');
+			const actorId = options.fleet
+				? (
+						await getApplication(getBalenaSdk(), options.fleet, {
+							$select: 'actor',
+						})
+				  ).actor
+				: await getBalenaSdk().auth.getUserActorId();
+			const keys = await getBalenaSdk().pine.get({
+				resource: 'api_key',
+				options: {
+					$select: ['id', 'created_at', 'name', 'description', 'expiry_date'],
+					$filter: {
+						is_of__actor: actorId,
+						...(options.user
+							? {
+									name: {
+										$ne: null,
+									},
+							  }
+							: {}),
+					},
+					$orderby: 'name asc',
+				},
+			});
+			const fields = ['id', 'name', 'created_at', 'description', 'expiry_date'];
+			const _ = await import('lodash');
+			console.log(
+				getVisuals().table.horizontal(
+					keys.map((key) => _.mapValues(key, (val) => val ?? 'N/a')),
+					fields,
+				),
+			);
+		} catch (e) {
+			throw e;
+		}
+	}
+}

lib/commands/app/create.ts

@@ -0,0 +1,150 @@
+/**
+ * @license
+ * Copyright 2016-2021 Balena Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import { flags } from '@oclif/command';
+
+import Command from '../../command';
+import { ExpectedError } from '../../errors';
+import * as cf from '../../utils/common-flags';
+import { getBalenaSdk, stripIndent } from '../../utils/lazy';
+
+interface FlagsDef {
+	organization?: string;
+	type?: string; // application device type
+	help: void;
+}
+
+interface ArgsDef {
+	name: string;
+}
+
+export default class AppCreateCmd extends Command {
+	public static description = stripIndent`
+		Create an app.
+
+		Create a new balena app.
+
+		You can specify the organization the app should belong to using
+		the \`--organization\` option. The organization's handle, not its name,
+		should be provided. Organization handles can be listed with the
+		\`balena orgs\` command.
+
+		The app's default device type is specified with the \`--type\` option.
+		The \`balena devices supported\` command can be used to list the available
+		device types.
+
+		Interactive dropdowns will be shown for selection if no device type or
+		organization is specified and there are multiple options to choose from.
+		If there is a single option to choose from, it will be chosen automatically.
+		This interactive behavior can be disabled by explicitly specifying a device
+		type and organization.
+	`;
+
+	public static examples = [
+		'$ balena app create MyApp',
+		'$ balena app create MyApp --organization mmyorg',
+		'$ balena app create MyApp -o myorg --type raspberry-pi',
+	];
+
+	public static args = [
+		{
+			name: 'name',
+			description: 'app name',
+			required: true,
+		},
+	];
+
+	public static usage = 'app create <name>';
+
+	public static flags: flags.Input<FlagsDef> = {
+		organization: flags.string({
+			char: 'o',
+			description: 'handle of the organization the app should belong to',
+		}),
+		type: flags.string({
+			char: 't',
+			description:
+				'app device type (Check available types with `balena devices supported`)',
+		}),
+		help: cf.help,
+	};
+
+	public static authenticated = true;
+
+	public async run() {
+		const { args: params, flags: options } = this.parse<FlagsDef, ArgsDef>(
+			AppCreateCmd,
+		);
+
+		// Ascertain device type
+		const deviceType =
+			options.type ||
+			(await (await import('../../utils/patterns')).selectDeviceType());
+
+		// Ascertain organization
+		const organization =
+			options.organization?.toLowerCase() || (await this.getOrganization());
+
+		// Create application
+		try {
+			const application = await getBalenaSdk().models.application.create({
+				name: params.name,
+				deviceType,
+				organization,
+				applicationClass: 'app',
+			});
+
+			// Output
+			console.log(
+				`App created: slug "${application.slug}", device type "${deviceType}"`,
+			);
+		} catch (err) {
+			if ((err.message || '').toLowerCase().includes('unique')) {
+				// BalenaRequestError: Request error: "organization" and "app_name" must be unique.
+				throw new ExpectedError(
+					`Error: An app or block or fleet with the name "${params.name}" already exists in organization "${organization}".`,
+				);
+			} else if ((err.message || '').toLowerCase().includes('unauthorized')) {
+				// BalenaRequestError: Request error: Unauthorized
+				throw new ExpectedError(
+					`Error: You are not authorized to create apps in organization "${organization}".`,
+				);
+			}
+
+			throw err;
+		}
+	}
+
+	async getOrganization() {
+		const { getOwnOrganizations } = await import('../../utils/sdk');
+		const organizations = await getOwnOrganizations(getBalenaSdk(), {
+			$select: ['name', 'handle'],
+		});
+
+		if (organizations.length === 0) {
+			// User is not a member of any organizations (should not happen).
+			throw new Error('This account is not a member of any organizations');
+		} else if (organizations.length === 1) {
+			// User is a member of only one organization - use this.
+			return organizations[0].handle;
+		} else {
+			// User is a member of multiple organizations -
+			const { selectOrganization } = await import('../../utils/patterns');
+			return selectOrganization(organizations);
+		}
+	}
+}

lib/commands/block/create.ts

@@ -0,0 +1,150 @@
+/**
+ * @license
+ * Copyright 2016-2021 Balena Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import { flags } from '@oclif/command';
+
+import Command from '../../command';
+import { ExpectedError } from '../../errors';
+import * as cf from '../../utils/common-flags';
+import { getBalenaSdk, stripIndent } from '../../utils/lazy';
+
+interface FlagsDef {
+	organization?: string;
+	type?: string; // application device type
+	help: void;
+}
+
+interface ArgsDef {
+	name: string;
+}
+
+export default class BlockCreateCmd extends Command {
+	public static description = stripIndent`
+		Create an block.
+
+		Create a new balena block.
+
+		You can specify the organization the block should belong to using
+		the \`--organization\` option. The organization's handle, not its name,
+		should be provided. Organization handles can be listed with the
+		\`balena orgs\` command.
+
+		The block's default device type is specified with the \`--type\` option.
+		The \`balena devices supported\` command can be used to list the available
+		device types.
+
+		Interactive dropdowns will be shown for selection if no device type or
+		organization is specified and there are multiple options to choose from.
+		If there is a single option to choose from, it will be chosen automatically.
+		This interactive behavior can be disabled by explicitly specifying a device
+		type and organization.
+	`;
+
+	public static examples = [
+		'$ balena block create MyBlock',
+		'$ balena block create MyBlock --organization mmyorg',
+		'$ balena block create MyBlock -o myorg --type raspberry-pi',
+	];
+
+	public static args = [
+		{
+			name: 'name',
+			description: 'block name',
+			required: true,
+		},
+	];
+
+	public static usage = 'block create <name>';
+
+	public static flags: flags.Input<FlagsDef> = {
+		organization: flags.string({
+			char: 'o',
+			description: 'handle of the organization the block should belong to',
+		}),
+		type: flags.string({
+			char: 't',
+			description:
+				'block device type (Check available types with `balena devices supported`)',
+		}),
+		help: cf.help,
+	};
+
+	public static authenticated = true;
+
+	public async run() {
+		const { args: params, flags: options } = this.parse<FlagsDef, ArgsDef>(
+			BlockCreateCmd,
+		);
+
+		// Ascertain device type
+		const deviceType =
+			options.type ||
+			(await (await import('../../utils/patterns')).selectDeviceType());
+
+		// Ascertain organization
+		const organization =
+			options.organization?.toLowerCase() || (await this.getOrganization());
+
+		// Create application
+		try {
+			const application = await getBalenaSdk().models.application.create({
+				name: params.name,
+				deviceType,
+				organization,
+				applicationClass: 'block',
+			});
+
+			// Output
+			console.log(
+				`Block created: slug "${application.slug}", device type "${deviceType}"`,
+			);
+		} catch (err) {
+			if ((err.message || '').toLowerCase().includes('unique')) {
+				// BalenaRequestError: Request error: "organization" and "app_name" must be unique.
+				throw new ExpectedError(
+					`Error: An app or block or fleet with the name "${params.name}" already exists in organization "${organization}".`,
+				);
+			} else if ((err.message || '').toLowerCase().includes('unauthorized')) {
+				// BalenaRequestError: Request error: Unauthorized
+				throw new ExpectedError(
+					`Error: You are not authorized to create blocks in organization "${organization}".`,
+				);
+			}
+
+			throw err;
+		}
+	}
+
+	async getOrganization() {
+		const { getOwnOrganizations } = await import('../../utils/sdk');
+		const organizations = await getOwnOrganizations(getBalenaSdk(), {
+			$select: ['name', 'handle'],
+		});
+
+		if (organizations.length === 0) {
+			// User is not a member of any organizations (should not happen).
+			throw new Error('This account is not a member of any organizations');
+		} else if (organizations.length === 1) {
+			// User is a member of only one organization - use this.
+			return organizations[0].handle;
+		} else {
+			// User is a member of multiple organizations -
+			const { selectOrganization } = await import('../../utils/patterns');
+			return selectOrganization(organizations);
+		}
+	}
+}

lib/commands/build.ts

@@ -20,7 +20,7 @@ import Command from '../command';
 import { getBalenaSdk } from '../utils/lazy';
 import * as cf from '../utils/common-flags';
 import * as compose from '../utils/compose';
-import type { Application, ApplicationType, BalenaSDK } from 'balena-sdk';
+import type { ApplicationType, BalenaSDK } from 'balena-sdk';
 import {
 	buildArgDeprecation,
 	dockerignoreHelp,
@@ -208,7 +208,7 @@ ${dockerignoreHelp}
 	 *   buildEmulated
 	 *   buildOpts: arguments to forward to docker build command
 	 *
-	 * @param {DockerToolbelt} docker
+	 * @param {Dockerode} docker
 	 * @param {Logger} logger
 	 * @param {ComposeOpts} composeOpts
 	 * @param opts
@@ -218,7 +218,9 @@ ${dockerignoreHelp}
 		logger: import('../utils/logger'),
 		composeOpts: ComposeOpts,
 		opts: {
-			app?: Application;
+			app?: {
+				application_type: [Pick<ApplicationType, 'supports_multicontainer'>];
+			};
 			arch: string;
 			deviceType: string;
 			buildEmulated: boolean;
@@ -234,7 +236,7 @@ ${dockerignoreHelp}
 			opts.buildOpts.t,
 		);
 
-		const appType = (opts.app?.application_type as ApplicationType[])?.[0];
+		const appType = opts.app?.application_type?.[0];
 		if (
 			appType != null &&
 			project.descriptors.length > 1 &&

lib/commands/config/generate.ts

@@ -19,13 +19,18 @@ import { flags } from '@oclif/command';
 import Command from '../../command';
 import * as cf from '../../utils/common-flags';
 import { getBalenaSdk, getCliForm, stripIndent } from '../../utils/lazy';
-import { applicationIdInfo, devModeInfo } from '../../utils/messages';
-import type { PineDeferred } from 'balena-sdk';
+import {
+	applicationIdInfo,
+	devModeInfo,
+	secureBootInfo,
+} from '../../utils/messages';
+import type { BalenaSDK, PineDeferred } from 'balena-sdk';
 
 interface FlagsDef {
 	version: string; // OS version
 	fleet?: string;
 	dev?: boolean; // balenaOS development variant
+	secureBoot?: boolean;
 	device?: string;
 	deviceApiKey?: string;
 	deviceType?: string;
@@ -37,6 +42,7 @@ interface FlagsDef {
 	wifiKey?: string;
 	appUpdatePollInterval?: string;
 	'provisioning-key-name'?: string;
+	'provisioning-key-expiry-date'?: string;
 	help: void;
 }
 
@@ -50,6 +56,8 @@ export default class ConfigGenerateCmd extends Command {
 
 		${devModeInfo.split('\n').join('\n\t\t')}
 
+		${secureBootInfo.split('\n').join('\n\t\t')}
+
 		To configure an image for a fleet of mixed device types, use the --fleet option
 		alongside the --deviceType option to specify the target device type.
 
@@ -65,6 +73,7 @@ export default class ConfigGenerateCmd extends Command {
 		'$ balena config generate --device 7cf02a6 --version 2.12.7 --deviceApiKey <existingDeviceKey>',
 		'$ balena config generate --device 7cf02a6 --version 2.12.7 --output config.json',
 		'$ balena config generate --fleet myorg/fleet --version 2.12.7 --dev',
+		'$ balena config generate --fleet myorg/fleet --version 2.12.7 --secureBoot',
 		'$ balena config generate --fleet myorg/fleet --version 2.12.7 --deviceType fincm3',
 		'$ balena config generate --fleet myorg/fleet --version 2.12.7 --output config.json',
 		'$ balena config generate --fleet myorg/fleet --version 2.12.7 --network wifi --wifiSsid mySsid --wifiKey abcdefgh --appUpdatePollInterval 15',
@@ -79,9 +88,14 @@ export default class ConfigGenerateCmd extends Command {
 		}),
 		fleet: { ...cf.fleet, exclusive: ['device'] },
 		dev: cf.dev,
+		secureBoot: cf.secureBoot,
 		device: {
 			...cf.device,
-			exclusive: ['fleet', 'provisioning-key-name'],
+			exclusive: [
+				'fleet',
+				'provisioning-key-name',
+				'provisioning-key-expiry-date',
+			],
 		},
 		deviceApiKey: flags.string({
 			description:
@@ -120,31 +134,42 @@ export default class ConfigGenerateCmd extends Command {
 			description: 'custom key name assigned to generated provisioning api key',
 			exclusive: ['device'],
 		}),
+		'provisioning-key-expiry-date': flags.string({
+			description:
+				'expiry date assigned to generated provisioning api key (format: YYYY-MM-DD)',
+			exclusive: ['device'],
+		}),
 		help: cf.help,
 	};
 
 	public static authenticated = true;
 
+	public async getApplication(balena: BalenaSDK, fleet: string) {
+		const { getApplication } = await import('../../utils/sdk');
+		return await getApplication(balena, fleet, {
+			$select: 'slug',
+			$expand: {
+				is_for__device_type: { $select: 'slug' },
+			},
+		});
+	}
+
 	public async run() {
 		const { flags: options } = this.parse<FlagsDef, {}>(ConfigGenerateCmd);
-
-		const { getApplication } = await import('../../utils/sdk');
-
 		const balena = getBalenaSdk();
 
 		await this.validateOptions(options);
 
 		let resourceDeviceType: string;
-		let application: ApplicationWithDeviceType | null = null;
+		let application: Awaited<ReturnType<typeof this.getApplication>> | null =
+			null;
 		let device:
 			| (DeviceWithDeviceType & { belongs_to__application: PineDeferred })
 			| null = null;
 		if (options.device != null) {
-			const { tryAsInteger } = await import('../../utils/validation');
-			const rawDevice = await balena.models.device.get(
-				tryAsInteger(options.device),
-				{ $expand: { is_of__device_type: { $select: 'slug' } } },
-			);
+			const rawDevice = await balena.models.device.get(options.device, {
+				$expand: { is_of__device_type: { $select: 'slug' } },
+			});
 			if (!rawDevice.belongs_to__application) {
 				const { ExpectedError } = await import('../../errors');
 				throw new ExpectedError(stripIndent`
@@ -157,36 +182,40 @@ export default class ConfigGenerateCmd extends Command {
 			resourceDeviceType = device.is_of__device_type[0].slug;
 		} else {
 			// Disambiguate application (if is a number, it could either be an ID or a numerical name)
-			application = (await getApplication(balena, options.fleet!, {
-				$expand: {
-					is_for__device_type: { $select: 'slug' },
-				},
-			})) as ApplicationWithDeviceType;
+			application = await this.getApplication(balena, options.fleet!);
 			resourceDeviceType = application.is_for__device_type[0].slug;
 		}
 
 		const deviceType = options.deviceType || resourceDeviceType;
 
-		const deviceManifest = await balena.models.device.getManifestBySlug(
-			deviceType,
-		);
-
 		// Check compatibility if application and deviceType provided
 		if (options.fleet && options.deviceType) {
-			const appDeviceManifest = await balena.models.device.getManifestBySlug(
-				resourceDeviceType,
-			);
-
 			const helpers = await import('../../utils/helpers');
 			if (
-				!helpers.areDeviceTypesCompatible(appDeviceManifest, deviceManifest)
+				!(await helpers.areDeviceTypesCompatible(
+					resourceDeviceType,
+					deviceType,
+				))
 			) {
-				throw new balena.errors.BalenaInvalidDeviceType(
+				const { ExpectedError } = await import('../../errors');
+				throw new ExpectedError(
 					`Device type ${options.deviceType} is incompatible with fleet ${options.fleet}`,
 				);
 			}
 		}
 
+		const deviceManifest =
+			await balena.models.config.getDeviceTypeManifestBySlug(deviceType);
+
+		const { validateSecureBootOptionAndWarn } = await import(
+			'../../utils/config'
+		);
+		await validateSecureBootOptionAndWarn(
+			options.secureBoot,
+			deviceType,
+			options.version,
+		);
+
 		// Prompt for values
 		// Pass params as an override: if there is any param with exactly the same name as a
 		// required option, that value is used (and the corresponding question is not asked)
@@ -195,7 +224,9 @@ export default class ConfigGenerateCmd extends Command {
 		});
 		answers.version = options.version;
 		answers.developmentMode = options.dev;
+		answers.secureBoot = options.secureBoot;
 		answers.provisioningKeyName = options['provisioning-key-name'];
+		answers.provisioningKeyExpiryDate = options['provisioning-key-expiry-date'];
 
 		// Generate config
 		const { generateDeviceConfig, generateApplicationConfig } = await import(

lib/commands/config/inject.ts

@@ -57,7 +57,6 @@ export default class ConfigInjectCmd extends Command {
 	public static usage = 'config inject <file>';
 
 	public static flags: flags.Input<FlagsDef> = {
-		type: cf.deviceTypeIgnored,
 		drive: cf.driveOrImg,
 		help: cf.help,
 	};

lib/commands/config/read.ts

@@ -47,7 +47,6 @@ export default class ConfigReadCmd extends Command {
 	public static usage = 'config read';
 
 	public static flags: flags.Input<FlagsDef> = {
-		type: cf.deviceTypeIgnored,
 		drive: cf.driveOrImg,
 		help: cf.help,
 		json: cf.json,

lib/commands/config/reconfigure.ts

@@ -50,7 +50,6 @@ export default class ConfigReconfigureCmd extends Command {
 	public static usage = 'config reconfigure';
 
 	public static flags: flags.Input<FlagsDef> = {
-		type: cf.deviceTypeIgnored,
 		drive: cf.driveOrImg,
 		advanced: flags.boolean({
 			description: 'show advanced commands',

lib/commands/config/write.ts

@@ -64,7 +64,6 @@ export default class ConfigWriteCmd extends Command {
 	public static usage = 'config write <key> <value>';
 
 	public static flags: flags.Input<FlagsDef> = {
-		type: cf.deviceTypeIgnored,
 		drive: cf.driveOrImg,
 		help: cf.help,
 	};

lib/commands/deploy.ts

@@ -16,7 +16,7 @@
  */
 
 import { flags } from '@oclif/command';
-import type { ImageDescriptor } from 'resin-compose-parse';
+import type { ImageDescriptor } from '@balena/compose/dist/parse';
 
 import Command from '../command';
 import { ExpectedError } from '../errors';
@@ -43,15 +43,13 @@ import {
 	parseReleaseTagKeysAndValues,
 } from '../utils/compose_ts';
 import { dockerCliFlags } from '../utils/docker';
-import type {
-	Application,
-	ApplicationType,
-	DeviceType,
-	Release,
-} from 'balena-sdk';
+import type { ApplicationType, DeviceType, Release } from 'balena-sdk';
 
-interface ApplicationWithArch extends Application {
+interface ApplicationWithArch {
+	id: number;
 	arch: string;
+	is_for__device_type: [Pick<DeviceType, 'slug'>];
+	application_type: [Pick<ApplicationType, 'slug' | 'supports_multicontainer'>];
 }
 
 interface FlagsDef extends ComposeCliFlags, DockerCliFlags {
@@ -60,6 +58,7 @@ interface FlagsDef extends ComposeCliFlags, DockerCliFlags {
 	nologupload: boolean;
 	'release-tag'?: string[];
 	draft: boolean;
+	note?: string;
 	help: void;
 }
 
@@ -101,6 +100,7 @@ ${dockerignoreHelp}
 	public static examples = [
 		'$ balena deploy myFleet',
 		'$ balena deploy myorg/myfleet --build --source myBuildDir/',
+		'$ balena deploy myorg/myfleet --build --source myBuildDir/ --note "this is the note for this release"',
 		'$ balena deploy myorg/myfleet myRepo/myImage',
 		'$ balena deploy myFleet myRepo/myImage --release-tag key1 "" key2 "value2 with spaces"',
 	];
@@ -145,6 +145,7 @@ ${dockerignoreHelp}
 				as final by default unless this option is given.`,
 			default: false,
 		}),
+		note: flags.string({ description: 'The notes for this release' }),
 		...composeCliFlags,
 		...dockerCliFlags,
 		// NOTE: Not supporting -h for help, because of clash with -h in DockerCliFlags
@@ -231,6 +232,9 @@ ${dockerignoreHelp}
 			releaseTagKeys,
 			releaseTagValues,
 		);
+		if (options.note) {
+			await sdk.models.release.setNote(release.id, options.note);
+		}
 	}
 
 	async deployProject(
@@ -256,7 +260,7 @@ ${dockerignoreHelp}
 			'../utils/compose_ts'
 		);
 
-		const appType = (opts.app?.application_type as ApplicationType[])?.[0];
+		const appType = opts.app.application_type[0];
 
 		try {
 			const project = await loadProject(
@@ -313,7 +317,7 @@ ${dockerignoreHelp}
 					projectName: project.name,
 					composition: compositionToBuild,
 					arch: opts.app.arch,
-					deviceType: (opts.app?.is_for__device_type as DeviceType[])?.[0].slug,
+					deviceType: opts.app.is_for__device_type[0].slug,
 					emulated: opts.buildEmulated,
 					buildOpts: opts.buildOpts,
 					inlineLogs: composeOpts.inlineLogs,
@@ -334,7 +338,7 @@ ${dockerignoreHelp}
 			);
 
 			let release: Release | ComposeReleaseInfo['release'];
-			if (appType?.is_legacy) {
+			if (appType.slug === 'legacy-v1' || appType.slug === 'legacy-v2') {
 				const { deployLegacy } = require('../utils/deploy-legacy');
 
 				const msg = getChalk().yellow(

lib/commands/device/identify.ts

@@ -20,7 +20,6 @@ import type { IArg } from '@oclif/parser/lib/args';
 import Command from '../../command';
 import * as cf from '../../utils/common-flags';
 import { getBalenaSdk, stripIndent } from '../../utils/lazy';
-import { tryAsInteger } from '../../utils/validation';
 import { ExpectedError } from '../../errors';
 
 interface FlagsDef {
@@ -43,7 +42,6 @@ export default class DeviceIdentifyCmd extends Command {
 		{
 			name: 'uuid',
 			description: 'the uuid of the device to identify',
-			parse: (dev) => tryAsInteger(dev),
 			required: true,
 		},
 	];

lib/commands/device/index.ts

@@ -21,7 +21,6 @@ import Command from '../../command';
 import * as cf from '../../utils/common-flags';
 import { expandForAppName } from '../../utils/helpers';
 import { getBalenaSdk, getVisuals, stripIndent } from '../../utils/lazy';
-import { tryAsInteger } from '../../utils/validation';
 
 import type { Application, Release } from 'balena-sdk';
 
@@ -44,6 +43,7 @@ interface ExtendedDevice extends DeviceWithDeviceType {
 
 interface FlagsDef {
 	help: void;
+	view: boolean;
 }
 
 interface ArgsDef {
@@ -56,13 +56,15 @@ export default class DeviceCmd extends Command {
 
 		Show information about a single device.
 		`;
-	public static examples = ['$ balena device 7cf02a6'];
+	public static examples = [
+		'$ balena device 7cf02a6',
+		'$ balena device 7cf02a6 --view',
+	];
 
 	public static args: Array<IArg<any>> = [
 		{
 			name: 'uuid',
 			description: 'the device uuid',
-			parse: (dev) => tryAsInteger(dev),
 			required: true,
 		},
 	];
@@ -71,13 +73,19 @@ export default class DeviceCmd extends Command {
 
 	public static flags: flags.Input<FlagsDef> = {
 		help: cf.help,
+		view: flags.boolean({
+			default: false,
+			description: 'open device dashboard page',
+		}),
 	};
 
 	public static authenticated = true;
 	public static primary = true;
 
 	public async run() {
-		const { args: params } = this.parse<FlagsDef, ArgsDef>(DeviceCmd);
+		const { args: params, flags: options } = this.parse<FlagsDef, ArgsDef>(
+			DeviceCmd,
+		);
 
 		const balena = getBalenaSdk();
 
@@ -108,6 +116,14 @@ export default class DeviceCmd extends Command {
 			],
 			...expandForAppName,
 		})) as ExtendedDevice;
+
+		if (options.view) {
+			const open = await import('open');
+			const dashboardUrl = balena.models.device.getDashboardUrl(device.uuid);
+			await open(dashboardUrl, { wait: false });
+			return;
+		}
+
 		device.status = device.overall_status;
 
 		device.dashboard_url = balena.models.device.getDashboardUrl(device.uuid);

lib/commands/device/init.ts

@@ -31,6 +31,7 @@ interface FlagsDef {
 	config?: string;
 	help: void;
 	'provisioning-key-name'?: string;
+	'provisioning-key-expiry-date'?: string;
 }
 
 export default class DeviceInitCmd extends Command {
@@ -69,6 +70,7 @@ export default class DeviceInitCmd extends Command {
 	public static examples = [
 		'$ balena device init',
 		'$ balena device init -f myorg/myfleet',
+		'$ balena device init --fleet myFleet --os-version 2.101.7 --drive /dev/disk5 --config config.json --yes',
 		'$ balena device init --fleet myFleet --os-version 2.83.21+rev1.prod --drive /dev/disk5 --config config.json --yes',
 	];
 
@@ -97,6 +99,10 @@ export default class DeviceInitCmd extends Command {
 		'provisioning-key-name': flags.string({
 			description: 'custom key name assigned to generated provisioning api key',
 		}),
+		'provisioning-key-expiry-date': flags.string({
+			description:
+				'expiry date assigned to generated provisioning api key (format: YYYY-MM-DD)',
+		}),
 		help: cf.help,
 	};
 
@@ -118,20 +124,16 @@ export default class DeviceInitCmd extends Command {
 		const balena = getBalenaSdk();
 
 		// Get application and
-		const application = (await getApplication(
-			balena,
-			options.fleet ||
-				(
-					await (await import('../../utils/patterns')).selectApplication()
-				).id,
-			{
-				$expand: {
-					is_for__device_type: {
-						$select: 'slug',
+		const application = options.fleet
+			? await getApplication(balena, options.fleet, {
+					$select: ['id', 'slug'],
+					$expand: {
+						is_for__device_type: {
+							$select: 'slug',
+						},
 					},
-				},
-			},
-		)) as ApplicationWithDeviceType;
+			  })
+			: await (await import('../../utils/patterns')).selectApplication();
 
 		// Register new device
 		const deviceUuid = balena.models.device.generateUniqueKey();
@@ -185,6 +187,14 @@ export default class DeviceInitCmd extends Command {
 				options['provisioning-key-name'],
 			);
 		}
+
+		if (options['provisioning-key-expiry-date']) {
+			configureCommand.push(
+				'--provisioning-key-expiry-date',
+				options['provisioning-key-expiry-date'],
+			);
+		}
+
 		await runCommand(configureCommand);
 	}
 

lib/commands/device/local-mode.ts

@@ -20,7 +20,6 @@ import type { IArg } from '@oclif/parser/lib/args';
 import Command from '../../command';
 import * as cf from '../../utils/common-flags';
 import { getBalenaSdk, stripIndent } from '../../utils/lazy';
-import { tryAsInteger } from '../../utils/validation';
 
 interface FlagsDef {
 	enable: boolean;
@@ -52,7 +51,6 @@ export default class DeviceLocalModeCmd extends Command {
 		{
 			name: 'uuid',
 			description: 'the uuid of the device to manage',
-			parse: (dev) => tryAsInteger(dev),
 			required: true,
 		},
 	];

lib/commands/device/move.ts

@@ -21,6 +21,7 @@ import type {
 	BalenaSDK,
 	Device,
 	DeviceType,
+	PineOptions,
 	PineTypedResult,
 } from 'balena-sdk';
 import Command from '../../command';
@@ -29,13 +30,6 @@ import { ExpectedError } from '../../errors';
 import { getBalenaSdk, stripIndent } from '../../utils/lazy';
 import { applicationIdInfo } from '../../utils/messages';
 
-type ExtendedDevice = PineTypedResult<
-	Device,
-	typeof import('../../utils/helpers').expandForAppNameAndCpuArch
-> & {
-	application_name?: string;
-};
-
 interface FlagsDef {
 	fleet?: string;
 	help: void;
@@ -81,6 +75,33 @@ export default class DeviceMoveCmd extends Command {
 
 	public static authenticated = true;
 
+	private async getDevices(balena: BalenaSDK, deviceUuids: string[]) {
+		const deviceOptions = {
+			$select: 'belongs_to__application',
+			$expand: {
+				is_of__device_type: {
+					$select: 'is_of__cpu_architecture',
+					$expand: {
+						is_of__cpu_architecture: {
+							$select: 'slug',
+						},
+					},
+				},
+			},
+		} satisfies PineOptions<Device>;
+
+		// TODO: Refacor once `device.get()` accepts an array of uuids`
+		const devices = await Promise.all(
+			deviceUuids.map(
+				(uuid) =>
+					balena.models.device.get(uuid, deviceOptions) as Promise<
+						PineTypedResult<Device, typeof deviceOptions>
+					>,
+			),
+		);
+		return devices;
+	}
+
 	public async run() {
 		const { args: params, flags: options } = this.parse<FlagsDef, ArgsDef>(
 			DeviceMoveCmd,
@@ -88,43 +109,21 @@ export default class DeviceMoveCmd extends Command {
 
 		const balena = getBalenaSdk();
 
-		const { tryAsInteger } = await import('../../utils/validation');
-		const { expandForAppNameAndCpuArch } = await import('../../utils/helpers');
+		// Split uuids string into array of uuids
+		const deviceUuids = params.uuid.split(',');
 
-		// Parse ids string into array of correct types
-		const deviceIds: Array<string | number> = params.uuid
-			.split(',')
-			.map((id) => tryAsInteger(id));
+		const devices = await this.getDevices(balena, deviceUuids);
 
-		// Get devices
-		const devices = await Promise.all(
-			deviceIds.map(
-				(uuid) =>
-					balena.models.device.get(
-						uuid,
-						expandForAppNameAndCpuArch,
-					) as Promise<ExtendedDevice>,
-			),
-		);
-
-		// Map application name for each device
-		for (const device of devices) {
-			const belongsToApplication = device.belongs_to__application;
-			device.application_name = belongsToApplication?.[0]
-				? belongsToApplication[0].app_name
-				: 'N/a';
-		}
-
-		// Disambiguate application (if is a number, it could either be an ID or a numerical name)
+		// Disambiguate application
 		const { getApplication } = await import('../../utils/sdk');
 
 		// Get destination application
 		const application = options.fleet
-			? await getApplication(balena, options.fleet)
+			? await getApplication(balena, options.fleet, { $select: ['id', 'slug'] })
 			: await this.interactivelySelectApplication(balena, devices);
 
 		// Move each device
-		for (const uuid of deviceIds) {
+		for (const uuid of deviceUuids) {
 			try {
 				await balena.models.device.move(uuid, application.id);
 				console.info(`Device ${uuid} was moved to fleet ${application.slug}`);
@@ -137,7 +136,7 @@ export default class DeviceMoveCmd extends Command {
 
 	async interactivelySelectApplication(
 		balena: BalenaSDK,
-		devices: ExtendedDevice[],
+		devices: Awaited<ReturnType<typeof this.getDevices>>,
 	) {
 		const { getExpandedProp } = await import('../../utils/pine');
 		// deduplicate the slugs
@@ -156,7 +155,7 @@ export default class DeviceMoveCmd extends Command {
 					$select: 'slug',
 				},
 			},
-		} as const;
+		} satisfies PineOptions<DeviceType>;
 		const deviceTypes = (await balena.models.deviceType.getAllSupported(
 			deviceTypeOptions,
 		)) as Array<PineTypedResult<DeviceType, typeof deviceTypeOptions>>;
@@ -183,7 +182,9 @@ export default class DeviceMoveCmd extends Command {
 			const application = await patterns.selectApplication(
 				(app) =>
 					compatibleDeviceTypeSlugs.has(app.is_for__device_type[0].slug) &&
-					devices.some((device) => device.application_name !== app.app_name),
+					devices.some(
+						(device) => device.belongs_to__application.__id !== app.id,
+					),
 				true,
 			);
 			return application;

lib/commands/device/os-update.ts

@@ -20,7 +20,6 @@ import type { IArg } from '@oclif/parser/lib/args';
 import Command from '../../command';
 import * as cf from '../../utils/common-flags';
 import { getBalenaSdk, stripIndent, getCliForm } from '../../utils/lazy';
-import { tryAsInteger } from '../../utils/validation';
 import type { Device } from 'balena-sdk';
 import { ExpectedError } from '../../errors';
 
@@ -47,6 +46,7 @@ export default class DeviceOsUpdateCmd extends Command {
 		`;
 	public static examples = [
 		'$ balena device os-update 23c73a1',
+		'$ balena device os-update 23c73a1 --version 2.101.7',
 		'$ balena device os-update 23c73a1 --version 2.31.0+rev1.prod',
 	];
 
@@ -54,7 +54,6 @@ export default class DeviceOsUpdateCmd extends Command {
 		{
 			name: 'uuid',
 			description: 'the uuid of the device to update',
-			parse: (dev) => tryAsInteger(dev),
 			required: true,
 		},
 	];

lib/commands/device/pin.ts

@@ -0,0 +1,103 @@
+/**
+ * @license
+ * Copyright 2016-2020 Balena Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import { flags } from '@oclif/command';
+import type { IArg } from '@oclif/parser/lib/args';
+import Command from '../../command';
+import * as cf from '../../utils/common-flags';
+import { getBalenaSdk, stripIndent } from '../../utils/lazy';
+import { getExpandedProp } from '../../utils/pine';
+
+interface FlagsDef {
+	help: void;
+}
+
+interface ArgsDef {
+	uuid: string;
+	releaseToPinTo?: string;
+}
+
+export default class DevicePinCmd extends Command {
+	public static description = stripIndent`
+		Pin a device to a release.
+
+		Pin a device to a release.
+
+		Note, if the commit is omitted, the currently pinned release will be printed, with instructions for how to see a list of releases
+		`;
+	public static examples = [
+		'$ balena device pin 7cf02a6',
+		'$ balena device pin 7cf02a6 91165e5',
+	];
+
+	public static args: Array<IArg<any>> = [
+		{
+			name: 'uuid',
+			description: 'the uuid of the device to pin to a release',
+			required: true,
+		},
+		{
+			name: 'releaseToPinTo',
+			description: 'the commit of the release for the device to get pinned to',
+		},
+	];
+
+	public static usage = 'device pin <uuid> [releaseToPinTo]';
+
+	public static flags: flags.Input<FlagsDef> = {
+		help: cf.help,
+	};
+
+	public static authenticated = true;
+
+	public async run() {
+		const { args: params } = this.parse<FlagsDef, ArgsDef>(DevicePinCmd);
+
+		const balena = getBalenaSdk();
+
+		const device = await balena.models.device.get(params.uuid, {
+			$expand: {
+				should_be_running__release: {
+					$select: 'commit',
+				},
+				belongs_to__application: {
+					$select: 'slug',
+				},
+			},
+		});
+
+		const pinnedRelease = getExpandedProp(
+			device.should_be_running__release,
+			'commit',
+		);
+		const appSlug = getExpandedProp(device.belongs_to__application, 'slug');
+
+		const releaseToPinTo = params.releaseToPinTo;
+
+		if (!releaseToPinTo) {
+			console.log(
+				`${
+					pinnedRelease
+						? `This device is currently pinned to ${pinnedRelease}.`
+						: 'This device is not currently pinned to any release.'
+				} \n\nTo see a list of all releases this device can be pinned to, run \`balena releases ${appSlug}\`.`,
+			);
+		} else {
+			await balena.models.device.pinToRelease(params.uuid, releaseToPinTo);
+		}
+	}
+}

lib/commands/device/public-url.ts

@@ -21,7 +21,6 @@ import Command from '../../command';
 import { ExpectedError } from '../../errors';
 import * as cf from '../../utils/common-flags';
 import { getBalenaSdk, stripIndent } from '../../utils/lazy';
-import { tryAsInteger } from '../../utils/validation';
 
 interface FlagsDef {
 	enable: boolean;
@@ -32,8 +31,6 @@ interface FlagsDef {
 
 interface ArgsDef {
 	uuid: string;
-	// Optional hidden arg to support old command format
-	legacyUuid?: string;
 }
 
 export default class DevicePublicUrlCmd extends Command {
@@ -43,9 +40,6 @@ export default class DevicePublicUrlCmd extends Command {
 		This command will output the current public URL for the
 		specified device.  It can also enable or disable the URL,
 		or output the enabled status, using the respective options.
-
-		The old command style 'balena device public-url enable <uuid>'
-		is deprecated, but still supported.
 	`;
 
 	public static examples = [
@@ -59,15 +53,8 @@ export default class DevicePublicUrlCmd extends Command {
 		{
 			name: 'uuid',
 			description: 'the uuid of the device to manage',
-			parse: (dev) => tryAsInteger(dev),
 			required: true,
 		},
-		{
-			// Optional hidden arg to support old command format
-			name: 'legacyUuid',
-			parse: (dev) => tryAsInteger(dev),
-			hidden: true,
-		},
 	];
 
 	public static usage = 'device public-url <uuid>';
@@ -95,25 +82,6 @@ export default class DevicePublicUrlCmd extends Command {
 			DevicePublicUrlCmd,
 		);
 
-		// Legacy command format support.
-		// Previously this command used the following format
-		// (changed due to oclif technicalities):
-		//   `balena device public-url enable|disable|status <uuid>`
-		if (params.legacyUuid) {
-			const action = params.uuid;
-			if (!['enable', 'disable', 'status'].includes(action)) {
-				throw new ExpectedError(
-					`Unexpected arguments: ${params.uuid} ${params.legacyUuid}`,
-				);
-			}
-
-			options.enable = action === 'enable';
-			options.disable = action === 'disable';
-			options.status = action === 'status';
-			params.uuid = params.legacyUuid;
-			delete params.legacyUuid;
-		}
-
 		const balena = getBalenaSdk();
 
 		if (options.enable) {

lib/commands/device/purge.ts

@@ -63,17 +63,14 @@ export default class DevicePurgeCmd extends Command {
 	public async run() {
 		const { args: params } = this.parse<FlagsDef, ArgsDef>(DevicePurgeCmd);
 
-		const { tryAsInteger } = await import('../../utils/validation');
 		const balena = getBalenaSdk();
 		const ux = getCliUx();
 
-		const deviceIds = params.uuid.split(',').map((id) => {
-			return tryAsInteger(id);
-		});
+		const deviceUuids = params.uuid.split(',');
 
-		for (const deviceId of deviceIds) {
-			ux.action.start(`Purging data from device ${deviceId}`);
-			await balena.models.device.purge(deviceId);
+		for (const uuid of deviceUuids) {
+			ux.action.start(`Purging data from device ${uuid}`);
+			await balena.models.device.purge(uuid);
 			ux.action.stop();
 		}
 	}

lib/commands/device/reboot.ts

@@ -20,7 +20,6 @@ import type { IArg } from '@oclif/parser/lib/args';
 import Command from '../../command';
 import * as cf from '../../utils/common-flags';
 import { getBalenaSdk, stripIndent } from '../../utils/lazy';
-import { tryAsInteger } from '../../utils/validation';
 
 interface FlagsDef {
 	force: boolean;
@@ -43,7 +42,6 @@ export default class DeviceRebootCmd extends Command {
 		{
 			name: 'uuid',
 			description: 'the uuid of the device to reboot',
-			parse: (dev) => tryAsInteger(dev),
 			required: true,
 		},
 	];

lib/commands/device/register.ts

@@ -25,6 +25,7 @@ import { applicationIdInfo } from '../../utils/messages';
 
 interface FlagsDef {
 	uuid?: string;
+	deviceType?: string;
 	help: void;
 }
 
@@ -47,6 +48,7 @@ export default class DeviceRegisterCmd extends Command {
 		'$ balena device register MyFleet',
 		'$ balena device register MyFleet --uuid <uuid>',
 		'$ balena device register myorg/myfleet --uuid <uuid>',
+		'$ balena device register myorg/myfleet --uuid <uuid> --deviceType <deviceTypeSlug>',
 	];
 
 	public static args: Array<IArg<any>> = [ca.fleetRequired];
@@ -58,6 +60,10 @@ export default class DeviceRegisterCmd extends Command {
 			description: 'custom uuid',
 			char: 'u',
 		}),
+		deviceType: flags.string({
+			description:
+				"device type slug (run 'balena devices supported' for possible values)",
+		}),
 		help: cf.help,
 	};
 
@@ -72,12 +78,18 @@ export default class DeviceRegisterCmd extends Command {
 
 		const balena = getBalenaSdk();
 
-		const application = await getApplication(balena, params.fleet);
+		const application = await getApplication(balena, params.fleet, {
+			$select: ['id', 'slug'],
+		});
 		const uuid = options.uuid ?? balena.models.device.generateUniqueKey();
 
 		console.info(`Registering to ${application.slug}: ${uuid}`);
 
-		const result = await balena.models.device.register(application.id, uuid);
+		const result = await balena.models.device.register(
+			application.id,
+			uuid,
+			options.deviceType,
+		);
 
 		return result && result.uuid;
 	}

lib/commands/device/rename.ts

@@ -20,7 +20,6 @@ import type { IArg } from '@oclif/parser/lib/args';
 import Command from '../../command';
 import * as cf from '../../utils/common-flags';
 import { getBalenaSdk, stripIndent, getCliForm } from '../../utils/lazy';
-import { tryAsInteger } from '../../utils/validation';
 
 interface FlagsDef {
 	help: void;
@@ -48,7 +47,6 @@ export default class DeviceRenameCmd extends Command {
 		{
 			name: 'uuid',
 			description: 'the uuid of the device to rename',
-			parse: (dev) => tryAsInteger(dev),
 			required: true,
 		},
 		{

lib/commands/device/restart.ts

@@ -82,24 +82,21 @@ export default class DeviceRestartCmd extends Command {
 			DeviceRestartCmd,
 		);
 
-		const { tryAsInteger } = await import('../../utils/validation');
 		const balena = getBalenaSdk();
 		const ux = getCliUx();
 
-		const deviceIds = params.uuid.split(',').map((id) => {
-			return tryAsInteger(id);
-		});
+		const deviceUuids = params.uuid.split(',');
 		const serviceNames = options.service?.split(',');
 
-		// Iterate sequentially through deviceIds.
+		// Iterate sequentially through deviceUuids.
 		// We may later want to add a batching feature,
 		// so that n devices are processed in parallel
-		for (const deviceId of deviceIds) {
-			ux.action.start(`Restarting services on device ${deviceId}`);
+		for (const uuid of deviceUuids) {
+			ux.action.start(`Restarting services on device ${uuid}`);
 			if (serviceNames) {
-				await this.restartServices(balena, deviceId, serviceNames);
+				await this.restartServices(balena, uuid, serviceNames);
 			} else {
-				await this.restartAllServices(balena, deviceId);
+				await this.restartAllServices(balena, uuid);
 			}
 			ux.action.stop();
 		}
@@ -107,7 +104,7 @@ export default class DeviceRestartCmd extends Command {
 
 	async restartServices(
 		balena: BalenaSDK,
-		deviceId: number | string,
+		deviceUuid: string,
 		serviceNames: string[],
 	) {
 		const { ExpectedError, instanceOf } = await import('../../errors');
@@ -116,7 +113,7 @@ export default class DeviceRestartCmd extends Command {
 		// Get device
 		let device: DeviceWithServiceDetails<CurrentServiceWithCommit>;
 		try {
-			device = await balena.models.device.getWithServiceDetails(deviceId, {
+			device = await balena.models.device.getWithServiceDetails(deviceUuid, {
 				$expand: {
 					is_running__release: { $select: 'commit' },
 				},
@@ -124,7 +121,7 @@ export default class DeviceRestartCmd extends Command {
 		} catch (e) {
 			const { BalenaDeviceNotFound } = await import('balena-errors');
 			if (instanceOf(e, BalenaDeviceNotFound)) {
-				throw new ExpectedError(`Device ${deviceId} not found.`);
+				throw new ExpectedError(`Device ${deviceUuid} not found.`);
 			} else {
 				throw e;
 			}
@@ -136,7 +133,7 @@ export default class DeviceRestartCmd extends Command {
 		serviceNames.forEach((service) => {
 			if (!device.current_services[service]) {
 				throw new ExpectedError(
-					`Service ${service} not found on device ${deviceId}.`,
+					`Service ${service} not found on device ${deviceUuid}.`,
 				);
 			}
 		});
@@ -155,7 +152,7 @@ export default class DeviceRestartCmd extends Command {
 			if (serviceContainer) {
 				restartPromises.push(
 					balena.models.device.restartService(
-						deviceId,
+						deviceUuid,
 						serviceContainer.image_id,
 					),
 				);
@@ -166,32 +163,32 @@ export default class DeviceRestartCmd extends Command {
 			await Promise.all(restartPromises);
 		} catch (e) {
 			if (e.message.toLowerCase().includes('no online device')) {
-				throw new ExpectedError(`Device ${deviceId} is not online.`);
+				throw new ExpectedError(`Device ${deviceUuid} is not online.`);
 			} else {
 				throw e;
 			}
 		}
 	}
 
-	async restartAllServices(balena: BalenaSDK, deviceId: number | string) {
+	async restartAllServices(balena: BalenaSDK, deviceUuid: string) {
 		// Note: device.restartApplication throws `BalenaDeviceNotFound: Device not found` if device not online.
 		// Need to use device.get first to distinguish between non-existant and offline devices.
 		// Remove this workaround when SDK issue resolved: https://github.com/balena-io/balena-sdk/issues/649
 		const { instanceOf, ExpectedError } = await import('../../errors');
 		try {
-			const device = await balena.models.device.get(deviceId);
+			const device = await balena.models.device.get(deviceUuid);
 			if (!device.is_online) {
-				throw new ExpectedError(`Device ${deviceId} is not online.`);
+				throw new ExpectedError(`Device ${deviceUuid} is not online.`);
 			}
 		} catch (e) {
 			const { BalenaDeviceNotFound } = await import('balena-errors');
 			if (instanceOf(e, BalenaDeviceNotFound)) {
-				throw new ExpectedError(`Device ${deviceId} not found.`);
+				throw new ExpectedError(`Device ${deviceUuid} not found.`);
 			} else {
 				throw e;
 			}
 		}
 
-		await balena.models.device.restartApplication(deviceId);
+		await balena.models.device.restartApplication(deviceUuid);
 	}
 }

lib/commands/device/rm.ts

@@ -20,7 +20,6 @@ import type { IArg } from '@oclif/parser/lib/args';
 import Command from '../../command';
 import * as cf from '../../utils/common-flags';
 import { getBalenaSdk, stripIndent } from '../../utils/lazy';
-import { tryAsInteger } from '../../utils/validation';
 
 interface FlagsDef {
 	yes: boolean;
@@ -84,7 +83,7 @@ export default class DeviceRmCmd extends Command {
 		// Remove
 		for (const uuid of uuids) {
 			try {
-				await balena.models.device.remove(tryAsInteger(uuid));
+				await balena.models.device.remove(uuid);
 			} catch (err) {
 				console.info(`${err.message}, uuid: ${uuid}`);
 				process.exitCode = 1;

lib/commands/device/shutdown.ts

@@ -20,7 +20,6 @@ import type { IArg } from '@oclif/parser/lib/args';
 import Command from '../../command';
 import * as cf from '../../utils/common-flags';
 import { getBalenaSdk, stripIndent } from '../../utils/lazy';
-import { tryAsInteger } from '../../utils/validation';
 import { ExpectedError } from '../../errors';
 
 interface FlagsDef {
@@ -44,7 +43,6 @@ export default class DeviceShutdownCmd extends Command {
 		{
 			name: 'uuid',
 			description: 'the uuid of the device to shutdown',
-			parse: (dev) => tryAsInteger(dev),
 			required: true,
 		},
 	];

lib/commands/device/track-fleet.ts

@@ -0,0 +1,63 @@
+/**
+ * @license
+ * Copyright 2016-2020 Balena Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import { flags } from '@oclif/command';
+import type { IArg } from '@oclif/parser/lib/args';
+import Command from '../../command';
+import * as cf from '../../utils/common-flags';
+import { getBalenaSdk, stripIndent } from '../../utils/lazy';
+
+interface FlagsDef {
+	help: void;
+}
+
+interface ArgsDef {
+	uuid: string;
+}
+
+export default class DeviceTrackFleetCmd extends Command {
+	public static description = stripIndent`
+		Make a device track the fleet's pinned release.
+
+		Make a device track the fleet's pinned release.
+		`;
+	public static examples = ['$ balena device track-fleet 7cf02a6'];
+
+	public static args: Array<IArg<any>> = [
+		{
+			name: 'uuid',
+			description: "the uuid of the device to make track the fleet's release",
+			required: true,
+		},
+	];
+
+	public static usage = 'device track-fleet <uuid>';
+
+	public static flags: flags.Input<FlagsDef> = {
+		help: cf.help,
+	};
+
+	public static authenticated = true;
+
+	public async run() {
+		const { args: params } = this.parse<FlagsDef, ArgsDef>(DeviceTrackFleetCmd);
+
+		const balena = getBalenaSdk();
+
+		await balena.models.device.trackApplicationRelease(params.uuid);
+	}
+}

lib/commands/devices/index.ts

@@ -22,13 +22,7 @@ import { expandForAppName } from '../../utils/helpers';
 import { getBalenaSdk, getVisuals, stripIndent } from '../../utils/lazy';
 import { applicationIdInfo, jsonInfo } from '../../utils/messages';
 
-import type { Application } from 'balena-sdk';
-
-interface ExtendedDevice extends DeviceWithDeviceType {
-	dashboard_url?: string;
-	fleet?: string | null; // 'org/name' slug
-	device_type?: string | null;
-}
+import type { Device, PineOptions } from 'balena-sdk';
 
 interface FlagsDef {
 	fleet?: string;
@@ -36,6 +30,18 @@ interface FlagsDef {
 	json: boolean;
 }
 
+const devicesSelectFields = {
+	$select: [
+		'id',
+		'uuid',
+		'device_name',
+		'status',
+		'is_online',
+		'supervisor_version',
+		'os_version',
+	],
+} satisfies PineOptions<Device>;
+
 export default class DevicesCmd extends Command {
 	public static description = stripIndent`
 		List all devices.
@@ -70,36 +76,39 @@ export default class DevicesCmd extends Command {
 		const { flags: options } = this.parse<FlagsDef, {}>(DevicesCmd);
 
 		const balena = getBalenaSdk();
+		const devicesOptions = {
+			...devicesSelectFields,
+			...expandForAppName,
+			$orderby: { device_name: 'asc' },
+		} satisfies PineOptions<Device>;
 
-		let devices;
+		const devices = (
+			await (async () => {
+				if (options.fleet != null) {
+					const { getApplication } = await import('../../utils/sdk');
+					const application = await getApplication(balena, options.fleet, {
+						$select: 'slug',
+						$expand: {
+							owns__device: devicesOptions,
+						},
+					});
+					return application.owns__device;
+				}
 
-		if (options.fleet != null) {
-			const { getApplication } = await import('../../utils/sdk');
-			const application = await getApplication(balena, options.fleet);
-			devices = (await balena.models.device.getAllByApplication(
-				application.id,
-				expandForAppName,
-			)) as ExtendedDevice[];
-		} else {
-			devices = (await balena.models.device.getAll(
-				expandForAppName,
-			)) as ExtendedDevice[];
-		}
+				return await balena.pine.get({
+					resource: 'device',
+					options: devicesOptions,
+				});
+			})()
+		).map((device) => ({
+			...device,
+			dashboard_url: balena.models.device.getDashboardUrl(device.uuid),
+			fleet: device.belongs_to__application?.[0]?.slug || null,
+			uuid: options.json ? device.uuid : device.uuid.slice(0, 7),
+			device_type: device.is_of__device_type?.[0]?.slug || null,
+		}));
 
-		devices = devices.map(function (device) {
-			device.dashboard_url = balena.models.device.getDashboardUrl(device.uuid);
-
-			const belongsToApplication =
-				device.belongs_to__application as Application[];
-			device.fleet = belongsToApplication?.[0]?.slug || null;
-
-			device.uuid = options.json ? device.uuid : device.uuid.slice(0, 7);
-
-			device.device_type = device.is_of__device_type?.[0]?.slug || null;
-			return device;
-		});
-
-		const fields = [
+		const fields: Array<keyof (typeof devices)[number]> = [
 			'id',
 			'uuid',
 			'device_name',

lib/commands/devices/supported.ts

@@ -15,6 +15,7 @@
  * limitations under the License.
  */
 import { flags } from '@oclif/command';
+import type * as BalenaSdk from 'balena-sdk';
 import * as _ from 'lodash';
 import Command from '../../command';
 
@@ -59,36 +60,38 @@ export default class DevicesSupportedCmd extends Command {
 
 	public async run() {
 		const { flags: options } = this.parse<FlagsDef, {}>(DevicesSupportedCmd);
-		const [dts, configDTs] = await Promise.all([
-			getBalenaSdk().models.deviceType.getAllSupported({
-				$expand: { is_of__cpu_architecture: { $select: 'slug' } },
-				$select: ['slug', 'name'],
-			}),
-			getBalenaSdk().models.config.getDeviceTypes(),
-		]);
-		const dtsBySlug = _.keyBy(dts, (dt) => dt.slug);
-		const configDTsBySlug = _.keyBy(configDTs, (dt) => dt.slug);
+		const pineOptions = {
+			$select: ['slug', 'name'],
+			$expand: {
+				is_of__cpu_architecture: { $select: 'slug' },
+				device_type_alias: {
+					$select: 'is_referenced_by__alias',
+					$orderby: { is_referenced_by__alias: 'asc' },
+				},
+			},
+		} satisfies BalenaSdk.PineOptions<BalenaSdk.DeviceType>;
+		const dts = (await getBalenaSdk().models.deviceType.getAllSupported(
+			pineOptions,
+		)) as Array<
+			BalenaSdk.PineTypedResult<BalenaSdk.DeviceType, typeof pineOptions>
+		>;
 		interface DT {
 			slug: string;
 			aliases: string[];
 			arch: string;
 			name: string;
 		}
-		let deviceTypes: DT[] = [];
-		for (const slug of Object.keys(dtsBySlug)) {
-			const configDT: Partial<typeof configDTs[0]> =
-				configDTsBySlug[slug] || {};
-			const aliases = (configDT.aliases || []).filter(
-				(alias) => alias !== slug,
-			);
-			const dt: Partial<typeof dts[0]> = dtsBySlug[slug] || {};
-			deviceTypes.push({
-				slug,
+		let deviceTypes = dts.map((dt): DT => {
+			const aliases = dt.device_type_alias
+				.map((dta) => dta.is_referenced_by__alias)
+				.filter((alias) => alias !== dt.slug);
+			return {
+				slug: dt.slug,
 				aliases: options.json ? aliases : [aliases.join(', ')],
-				arch: (dt.is_of__cpu_architecture as any)?.[0]?.slug || 'n/a',
+				arch: dt.is_of__cpu_architecture[0]?.slug || 'n/a',
 				name: dt.name || 'N/A',
-			});
-		}
+			};
+		});
 		const fields = ['slug', 'aliases', 'arch', 'name'];
 		deviceTypes = _.sortBy(deviceTypes, fields);
 		if (options.json) {

lib/commands/env/add.ts

@@ -151,16 +151,15 @@ export default class EnvAddCmd extends Command {
 
 		const varType = isConfigVar ? 'configVar' : 'envVar';
 		if (options.fleet) {
-			const { getFleetSlug } = await import('../../utils/sdk');
-			for (const app of options.fleet.split(',')) {
+			for (const appSlug of await resolveFleetSlugs(balena, options.fleet)) {
 				try {
 					await balena.models.application[varType].set(
-						await getFleetSlug(balena, app),
+						appSlug,
 						params.name,
 						params.value,
 					);
 				} catch (err) {
-					console.error(`${err.message}, fleet: ${app}`);
+					console.error(`${err.message}, fleet: ${appSlug}`);
 					process.exitCode = 1;
 				}
 			}
@@ -181,6 +180,25 @@ export default class EnvAddCmd extends Command {
 	}
 }
 
+// TODO: Stop accepting application names in the next major
+// and just drop this in favor of doing the .split(',') directly.
+async function resolveFleetSlugs(
+	balena: BalenaSdk.BalenaSDK,
+	fleetOption: string,
+) {
+	const fleetSlugs: string[] = [];
+	const { getFleetSlug } = await import('../../utils/sdk');
+	for (const appNameOrSlug of fleetOption.split(',')) {
+		try {
+			fleetSlugs.push(await getFleetSlug(balena, appNameOrSlug));
+		} catch (err) {
+			console.error(`${err.message}, fleet: ${appNameOrSlug}`);
+			process.exitCode = 1;
+		}
+	}
+	return fleetSlugs;
+}
+
 /**
  * Add service variables for a device or fleet.
  */
@@ -190,17 +208,17 @@ async function setServiceVars(
 	options: FlagsDef,
 ) {
 	if (options.fleet) {
-		for (const app of options.fleet.split(',')) {
+		for (const appSlug of await resolveFleetSlugs(sdk, options.fleet)) {
 			for (const service of options.service!.split(',')) {
 				try {
-					const serviceId = await getServiceIdForApp(sdk, app, service);
+					const serviceId = await getServiceIdForApp(sdk, appSlug, service);
 					await sdk.models.service.var.set(
 						serviceId,
 						params.name,
 						params.value!,
 					);
 				} catch (err) {
-					console.error(`${err.message}, fleet: ${app}`);
+					console.error(`${err.message}, fleet: ${appSlug}`);
 					process.exitCode = 1;
 				}
 			}
@@ -245,11 +263,11 @@ async function setServiceVars(
  */
 async function getServiceIdForApp(
 	sdk: BalenaSdk.BalenaSDK,
-	appName: string,
+	appSlug: string,
 	serviceName: string,
 ): Promise<number> {
 	let serviceId: number | undefined;
-	const services = await sdk.models.service.getAllByApplication(appName, {
+	const services = await sdk.models.service.getAllByApplication(appSlug, {
 		$filter: { service_name: serviceName },
 	});
 	if (services.length > 0) {
@@ -257,7 +275,7 @@ async function getServiceIdForApp(
 	}
 	if (serviceId === undefined) {
 		throw new ExpectedError(
-			`Cannot find service ${serviceName} for fleet ${appName}`,
+			`Cannot find service ${serviceName} for fleet ${appSlug}`,
 		);
 	}
 	return serviceId;

lib/commands/fleet/create.ts

@@ -16,7 +16,6 @@
  */
 
 import { flags } from '@oclif/command';
-import type { Application } from 'balena-sdk';
 
 import Command from '../../command';
 import { ExpectedError } from '../../errors';
@@ -101,18 +100,22 @@ export default class FleetCreateCmd extends Command {
 			options.organization?.toLowerCase() || (await this.getOrganization());
 
 		// Create application
-		let application: Application;
 		try {
-			application = await getBalenaSdk().models.application.create({
+			const application = await getBalenaSdk().models.application.create({
 				name: params.name,
 				deviceType,
 				organization,
 			});
+
+			// Output
+			console.log(
+				`Fleet created: slug "${application.slug}", device type "${deviceType}"`,
+			);
 		} catch (err) {
 			if ((err.message || '').toLowerCase().includes('unique')) {
 				// BalenaRequestError: Request error: "organization" and "app_name" must be unique.
 				throw new ExpectedError(
-					`Error: fleet "${params.name}" already exists in organization "${organization}".`,
+					`Error: An app or block or fleet with the name "${params.name}" already exists in organization "${organization}".`,
 				);
 			} else if ((err.message || '').toLowerCase().includes('unauthorized')) {
 				// BalenaRequestError: Request error: Unauthorized
@@ -123,16 +126,13 @@ export default class FleetCreateCmd extends Command {
 
 			throw err;
 		}
-
-		// Output
-		console.log(
-			`Fleet created: slug "${application.slug}", device type "${deviceType}"`,
-		);
 	}
 
 	async getOrganization() {
 		const { getOwnOrganizations } = await import('../../utils/sdk');
-		const organizations = await getOwnOrganizations(getBalenaSdk());
+		const organizations = await getOwnOrganizations(getBalenaSdk(), {
+			$select: ['name', 'handle'],
+		});
 
 		if (organizations.length === 0) {
 			// User is not a member of any organizations (should not happen).

lib/commands/fleet/index.ts

@@ -15,19 +15,19 @@
  * limitations under the License.
  */
 
-import type { flags } from '@oclif/command';
-import type { Release } from 'balena-sdk';
+import type { flags as flagsType } from '@oclif/command';
+import { flags } from '@oclif/command';
 
 import Command from '../../command';
 import * as cf from '../../utils/common-flags';
 import * as ca from '../../utils/common-args';
-import { getBalenaSdk, getVisuals, stripIndent } from '../../utils/lazy';
+import { getBalenaSdk, stripIndent } from '../../utils/lazy';
 import { applicationIdInfo } from '../../utils/messages';
-import { isV14 } from '../../utils/version';
 import type { DataOutputOptions } from '../../framework';
 
 interface FlagsDef extends DataOutputOptions {
 	help: void;
+	view: boolean;
 }
 
 interface ArgsDef {
@@ -45,15 +45,20 @@ export default class FleetCmd extends Command {
 	public static examples = [
 		'$ balena fleet MyFleet',
 		'$ balena fleet myorg/myfleet',
+		'$ balena fleet myorg/myfleet --view',
 	];
 
 	public static args = [ca.fleetRequired];
 
 	public static usage = 'fleet <fleet>';
 
-	public static flags: flags.Input<FlagsDef> = {
+	public static flags: flagsType.Input<FlagsDef> = {
 		help: cf.help,
-		...(isV14() ? cf.dataOutputFlags : {}),
+		view: flags.boolean({
+			default: false,
+			description: 'open fleet dashboard page',
+		}),
+		...cf.dataOutputFlags,
 	};
 
 	public static authenticated = true;
@@ -66,38 +71,34 @@ export default class FleetCmd extends Command {
 
 		const { getApplication } = await import('../../utils/sdk');
 
-		const application = (await getApplication(getBalenaSdk(), params.fleet, {
+		const balena = getBalenaSdk();
+
+		const application = await getApplication(balena, params.fleet, {
 			$expand: {
 				is_for__device_type: { $select: 'slug' },
 				should_be_running__release: { $select: 'commit' },
 			},
-		})) as ApplicationWithDeviceType & {
-			should_be_running__release: [Release?];
-			// For display purposes:
-			device_type: string;
-			commit?: string;
+		});
+
+		if (options.view) {
+			const open = await import('open');
+			const dashboardUrl = balena.models.application.getDashboardUrl(
+				application.id,
+			);
+			await open(dashboardUrl, { wait: false });
+			return;
+		}
+
+		const outputApplication = {
+			...application,
+			device_type: application.is_for__device_type[0].slug,
+			commit: application.should_be_running__release[0]?.commit,
 		};
 
-		application.device_type = application.is_for__device_type[0].slug;
-		application.commit = application.should_be_running__release[0]?.commit;
-
-		if (isV14()) {
-			await this.outputData(
-				application,
-				['app_name', 'id', 'device_type', 'slug', 'commit'],
-				options,
-			);
-		} else {
-			// Emulate table.vertical title output, but avoid uppercasing and inserting spaces
-			console.log(`== ${application.slug}`);
-			console.log(
-				getVisuals().table.vertical(application, [
-					'id',
-					'device_type',
-					'slug',
-					'commit',
-				]),
-			);
-		}
+		await this.outputData(
+			outputApplication,
+			['app_name', 'id', 'device_type', 'slug', 'commit'],
+			options,
+		);
 	}
 }

lib/commands/fleet/pin.ts

@@ -0,0 +1,100 @@
+/**
+ * @license
+ * Copyright 2016-2020 Balena Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import { flags } from '@oclif/command';
+import type { IArg } from '@oclif/parser/lib/args';
+import Command from '../../command';
+import * as cf from '../../utils/common-flags';
+import { getBalenaSdk, stripIndent } from '../../utils/lazy';
+import { getExpandedProp } from '../../utils/pine';
+
+interface FlagsDef {
+	help: void;
+}
+
+interface ArgsDef {
+	slug: string;
+	releaseToPinTo?: string;
+}
+
+export default class FleetPinCmd extends Command {
+	public static description = stripIndent`
+		Pin a fleet to a release.
+
+		Pin a fleet to a release.
+
+		Note, if the commit is omitted, the currently pinned release will be printed, with instructions for how to see a list of releases
+		`;
+	public static examples = [
+		'$ balena fleet pin myfleet',
+		'$ balena fleet pin myorg/myfleet 91165e5',
+	];
+
+	public static args: Array<IArg<any>> = [
+		{
+			name: 'slug',
+			description: 'the slug of the fleet to pin to a release',
+			required: true,
+		},
+		{
+			name: 'releaseToPinTo',
+			description: 'the commit of the release for the fleet to get pinned to',
+		},
+	];
+
+	public static usage = 'fleet pin <slug> [releaseToPinTo]';
+
+	public static flags: flags.Input<FlagsDef> = {
+		help: cf.help,
+	};
+
+	public static authenticated = true;
+
+	public async run() {
+		const { args: params } = this.parse<FlagsDef, ArgsDef>(FleetPinCmd);
+
+		const balena = getBalenaSdk();
+
+		const fleet = await balena.models.application.get(params.slug, {
+			$expand: {
+				should_be_running__release: {
+					$select: 'commit',
+				},
+			},
+		});
+
+		const pinnedRelease = getExpandedProp(
+			fleet.should_be_running__release,
+			'commit',
+		);
+
+		const releaseToPinTo = params.releaseToPinTo;
+		const slug = params.slug;
+
+		if (!releaseToPinTo) {
+			console.log(
+				`${
+					pinnedRelease
+						? `This fleet is currently pinned to ${pinnedRelease}.`
+						: 'This fleet is not currently pinned to any release.'
+				} \n\nTo see a list of all releases this fleet can be pinned to, run \`balena releases ${slug}\`.`,
+			);
+		} else {
+			await balena.models.application.pinToRelease(slug, releaseToPinTo);
+		}
+	}
+}

lib/commands/fleet/purge.ts

@@ -65,7 +65,9 @@ export default class FleetPurgeCmd extends Command {
 
 		// balena.models.application.purge only accepts a numeric id
 		// so we must first fetch the app to get it's id,
-		const application = await getApplication(balena, params.fleet);
+		const application = await getApplication(balena, params.fleet, {
+			$select: 'id',
+		});
 
 		try {
 			await balena.models.application.purge(application.id);

lib/commands/fleet/rename.ts

@@ -16,7 +16,6 @@
  */
 
 import type { flags } from '@oclif/command';
-import type { ApplicationType } from 'balena-sdk';
 
 import Command from '../../command';
 import * as cf from '../../utils/common-flags';
@@ -78,9 +77,10 @@ export default class FleetRenameCmd extends Command {
 		// Disambiguate target application (if params.params is a number, it could either be an ID or a numerical name)
 		const { getApplication } = await import('../../utils/sdk');
 		const application = await getApplication(balena, params.fleet, {
+			$select: ['id', 'app_name', 'slug'],
 			$expand: {
 				application_type: {
-					$select: ['is_legacy'],
+					$select: 'slug',
 				},
 			},
 		});
@@ -91,8 +91,8 @@ export default class FleetRenameCmd extends Command {
 		}
 
 		// Check app supports renaming
-		const appType = (application.application_type as ApplicationType[])?.[0];
-		if (appType.is_legacy) {
+		const appType = application.application_type[0];
+		if (appType.slug === 'legacy-v1' || appType.slug === 'legacy-v2') {
 			throw new ExpectedError(
 				`Fleet ${params.fleet} is of 'legacy' type, and cannot be renamed.`,
 			);
@@ -133,9 +133,9 @@ export default class FleetRenameCmd extends Command {
 		}
 
 		// Get application again, to be sure of results
-		const renamedApplication = await balena.models.application.get(
-			application.id,
-		);
+		const renamedApplication = await getApplication(balena, application.id, {
+			$select: ['app_name', 'slug'],
+		});
 
 		// Output result
 		console.log(`Fleet renamed`);

lib/commands/fleet/restart.ts

@@ -62,9 +62,11 @@ export default class FleetRestartCmd extends Command {
 
 		const balena = getBalenaSdk();
 
-		// Disambiguate application (if is a number, it could either be an ID or a numerical name)
-		const application = await getApplication(balena, params.fleet);
+		// Disambiguate application
+		const application = await getApplication(balena, params.fleet, {
+			$select: 'slug',
+		});
 
-		await balena.models.application.restart(application.id);
+		await balena.models.application.restart(application.slug);
 	}
 }

lib/commands/fleet/rm.ts

@@ -76,9 +76,11 @@ export default class FleetRmCmd extends Command {
 		);
 
 		// Disambiguate application (if is a number, it could either be an ID or a numerical name)
-		const application = await getApplication(balena, params.fleet);
+		const application = await getApplication(balena, params.fleet, {
+			$select: 'slug',
+		});
 
 		// Remove
-		await balena.models.application.remove(application.id);
+		await balena.models.application.remove(application.slug);
 	}
 }

lib/commands/fleet/track-latest.ts

@@ -0,0 +1,66 @@
+/**
+ * @license
+ * Copyright 2016-2020 Balena Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import { flags } from '@oclif/command';
+import type { IArg } from '@oclif/parser/lib/args';
+import Command from '../../command';
+import * as cf from '../../utils/common-flags';
+import { getBalenaSdk, stripIndent } from '../../utils/lazy';
+
+interface FlagsDef {
+	help: void;
+}
+
+interface ArgsDef {
+	slug: string;
+}
+
+export default class FleetTrackLatestCmd extends Command {
+	public static description = stripIndent`
+		Make this fleet track the latest release.
+
+		Make this fleet track the latest release.
+		`;
+	public static examples = [
+		'$ balena fleet track-latest myorg/myfleet',
+		'$ balena fleet track-latest myfleet',
+	];
+
+	public static args: Array<IArg<any>> = [
+		{
+			name: 'slug',
+			description: 'the slug of the fleet to make track the latest release',
+			required: true,
+		},
+	];
+
+	public static usage = 'fleet track-latest <slug>';
+
+	public static flags: flags.Input<FlagsDef> = {
+		help: cf.help,
+	};
+
+	public static authenticated = true;
+
+	public async run() {
+		const { args: params } = this.parse<FlagsDef, ArgsDef>(FleetTrackLatestCmd);
+
+		const balena = getBalenaSdk();
+
+		await balena.models.application.trackLatestRelease(params.slug);
+	}
+}

lib/commands/fleets.ts

@@ -19,8 +19,7 @@ import { flags } from '@oclif/command';
 
 import Command from '../command';
 import * as cf from '../utils/common-flags';
-import { getBalenaSdk, getVisuals, stripIndent } from '../utils/lazy';
-import { isV14 } from '../utils/version';
+import { getBalenaSdk, stripIndent } from '../utils/lazy';
 import type { DataSetOutputOptions } from '../framework';
 
 interface ExtendedApplication extends ApplicationWithDeviceType {
@@ -49,7 +48,7 @@ export default class FleetsCmd extends Command {
 	public static usage = 'fleets';
 
 	public static flags: flags.Input<FlagsDef> = {
-		...(isV14() ? cf.dataSetOutputFlags : {}),
+		...cf.dataSetOutputFlags,
 		help: cf.help,
 	};
 
@@ -79,30 +78,17 @@ export default class FleetsCmd extends Command {
 			application.device_type = application.is_for__device_type[0].slug;
 		});
 
-		if (isV14()) {
-			await this.outputData(
-				applications,
-				[
-					'id',
-					'app_name',
-					'slug',
-					'device_type',
-					'device_count',
-					'online_devices',
-				],
-				options,
-			);
-		} else {
-			console.log(
-				getVisuals().table.horizontal(applications, [
-					'id',
-					'app_name => NAME',
-					'slug',
-					'device_type',
-					'online_devices',
-					'device_count',
-				]),
-			);
-		}
+		await this.outputData(
+			applications,
+			[
+				'id',
+				'app_name',
+				'slug',
+				'device_type',
+				'device_count',
+				'online_devices',
+			],
+			options,
+		);
 	}
 }

lib/commands/note.ts

@@ -88,6 +88,6 @@ export default class NoteCmd extends Command {
 
 		const balena = getBalenaSdk();
 
-		return balena.models.device.note(options.device!, params.note);
+		return balena.models.device.setNote(options.device, params.note);
 	}
 }

lib/commands/orgs.ts

@@ -46,7 +46,9 @@ export default class OrgsCmd extends Command {
 		const { getOwnOrganizations } = await import('../utils/sdk');
 
 		// Get organizations
-		const organizations = await getOwnOrganizations(getBalenaSdk());
+		const organizations = await getOwnOrganizations(getBalenaSdk(), {
+			$select: ['name', 'handle'],
+		});
 
 		// Display
 		console.log(

lib/commands/os/configure.ts

@@ -23,7 +23,11 @@ import Command from '../../command';
 import { ExpectedError } from '../../errors';
 import * as cf from '../../utils/common-flags';
 import { getBalenaSdk, stripIndent, getCliForm } from '../../utils/lazy';
-import { applicationIdInfo, devModeInfo } from '../../utils/messages';
+import {
+	applicationIdInfo,
+	devModeInfo,
+	secureBootInfo,
+} from '../../utils/messages';
 
 const CONNECTIONS_FOLDER = '/system-connections';
 
@@ -36,6 +40,7 @@ interface FlagsDef {
 	'config-wifi-key'?: string;
 	'config-wifi-ssid'?: string;
 	dev?: boolean; // balenaOS development variant
+	secureBoot?: boolean;
 	device?: string; // device UUID
 	'device-type'?: string;
 	help?: void;
@@ -43,6 +48,7 @@ interface FlagsDef {
 	'system-connection': string[];
 	'initial-device-name'?: string;
 	'provisioning-key-name'?: string;
+	'provisioning-key-expiry-date'?: string;
 }
 
 interface ArgsDef {
@@ -52,12 +58,14 @@ interface ArgsDef {
 interface Answers {
 	appUpdatePollInterval: number; // in minutes
 	developmentMode?: boolean; // balenaOS development variant
+	secureBoot?: boolean;
 	deviceType: string; // e.g. "raspberrypi3"
 	network: 'ethernet' | 'wifi';
 	version: string; // e.g. "2.32.0+rev1"
 	wifiSsid?: string;
 	wifiKey?: string;
 	provisioningKeyName?: string;
+	provisioningKeyExpiryDate?: string;
 }
 
 export default class OsConfigureCmd extends Command {
@@ -78,6 +86,8 @@ export default class OsConfigureCmd extends Command {
 
 		${devModeInfo.split('\n').join('\n\t\t')}
 
+		${secureBootInfo.split('\n').join('\n\t\t')}
+
 		The --system-connection (-c) option is used to inject NetworkManager connection
 		profiles for additional network interfaces, such as cellular/GSM or additional
 		WiFi or ethernet connections. This option may be passed multiple times in case there
@@ -121,7 +131,7 @@ export default class OsConfigureCmd extends Command {
 		config: flags.string({
 			description:
 				'path to a pre-generated config.json file to be injected in the OS image',
-			exclusive: ['provisioning-key-name'],
+			exclusive: ['provisioning-key-name', 'provisioning-key-expiry-date'],
 		}),
 		'config-app-update-poll-interval': flags.integer({
 			description:
@@ -138,7 +148,15 @@ export default class OsConfigureCmd extends Command {
 			description: 'WiFi SSID (network name) (non-interactive configuration)',
 		}),
 		dev: cf.dev,
-		device: { ...cf.device, exclusive: ['fleet', 'provisioning-key-name'] },
+		secureBoot: cf.secureBoot,
+		device: {
+			...cf.device,
+			exclusive: [
+				'fleet',
+				'provisioning-key-name',
+				'provisioning-key-expiry-date',
+			],
+		},
 		'device-type': flags.string({
 			description:
 				'device type slug (e.g. "raspberrypi3") to override the fleet device type',
@@ -161,6 +179,11 @@ export default class OsConfigureCmd extends Command {
 			description: 'custom key name assigned to generated provisioning api key',
 			exclusive: ['config', 'device'],
 		}),
+		'provisioning-key-expiry-date': flags.string({
+			description:
+				'expiry date assigned to generated provisioning api key (format: YYYY-MM-DD)',
+			exclusive: ['config', 'device'],
+		}),
 		help: cf.help,
 	};
 
@@ -201,7 +224,7 @@ export default class OsConfigureCmd extends Command {
 					is_for__device_type: { $select: 'slug' },
 				},
 			})) as ApplicationWithDeviceType;
-			await checkDeviceTypeCompatibility(balena, options, app);
+			await checkDeviceTypeCompatibility(options, app);
 			deviceTypeSlug =
 				options['device-type'] || app.is_for__device_type[0].slug;
 		}
@@ -224,6 +247,15 @@ export default class OsConfigureCmd extends Command {
 		const { validateDevOptionAndWarn } = await import('../../utils/config');
 		await validateDevOptionAndWarn(options.dev, osVersion);
 
+		const { validateSecureBootOptionAndWarn } = await import(
+			'../../utils/config'
+		);
+		await validateSecureBootOptionAndWarn(
+			options.secureBoot,
+			deviceTypeSlug,
+			osVersion,
+		);
+
 		const answers: Answers = await askQuestionsForDeviceType(
 			deviceTypeManifest,
 			options,
@@ -234,7 +266,9 @@ export default class OsConfigureCmd extends Command {
 		}
 		answers.version = osVersion;
 		answers.developmentMode = options.dev;
+		answers.secureBoot = options.secureBoot;
 		answers.provisioningKeyName = options['provisioning-key-name'];
+		answers.provisioningKeyExpiryDate = options['provisioning-key-expiry-date'];
 
 		if (_.isEmpty(configJson)) {
 			if (device) {
@@ -346,17 +380,19 @@ async function getOsVersionFromImage(
  * @param app Balena SDK Application model object
  */
 async function checkDeviceTypeCompatibility(
-	sdk: BalenaSdk.BalenaSDK,
 	options: FlagsDef,
-	app: ApplicationWithDeviceType,
+	app: {
+		is_for__device_type: [Pick<BalenaSdk.DeviceType, 'slug'>];
+	},
 ) {
 	if (options['device-type']) {
-		const [appDeviceType, optionDeviceType] = await Promise.all([
-			sdk.models.device.getManifestBySlug(app.is_for__device_type[0].slug),
-			sdk.models.device.getManifestBySlug(options['device-type']),
-		]);
 		const helpers = await import('../../utils/helpers');
-		if (!helpers.areDeviceTypesCompatible(appDeviceType, optionDeviceType)) {
+		if (
+			!(await helpers.areDeviceTypesCompatible(
+				app.is_for__device_type[0].slug,
+				options['device-type'],
+			))
+		) {
 			throw new ExpectedError(
 				`Device type ${options['device-type']} is incompatible with fleet ${options.fleet}`,
 			);

lib/commands/os/download.ts

@@ -53,9 +53,11 @@ export default class OsDownloadCmd extends Command {
 `;
 	public static examples = [
 		'$ balena os download raspberrypi3 -o ../foo/bar/raspberry-pi.img',
+		'$ balena os download raspberrypi3 -o ../foo/bar/raspberry-pi.img --version 2.101.7',
+		'$ balena os download raspberrypi3 -o ../foo/bar/raspberry-pi.img --version 2022.7.0',
+		'$ balena os download raspberrypi3 -o ../foo/bar/raspberry-pi.img --version ^2.90.0',
 		'$ balena os download raspberrypi3 -o ../foo/bar/raspberry-pi.img --version 2.60.1+rev1',
 		'$ balena os download raspberrypi3 -o ../foo/bar/raspberry-pi.img --version 2.60.1+rev1.dev',
-		'$ balena os download raspberrypi3 -o ../foo/bar/raspberry-pi.img --version ^2.60.0',
 		'$ balena os download raspberrypi3 -o ../foo/bar/raspberry-pi.img --version 2021.10.2.prod',
 		'$ balena os download raspberrypi3 -o ../foo/bar/raspberry-pi.img --version latest',
 		'$ balena os download raspberrypi3 -o ../foo/bar/raspberry-pi.img --version default',

lib/commands/os/initialize.ts

@@ -42,7 +42,9 @@ export default class OsInitializeCmd extends Command {
 		Initialize an os image for a device.
 
 		Initialize an os image for a device with a previously
-		configured operating system image.
+		configured operating system image and flash the
+		an external storage drive or the device's storage
+		medium depending on the device type.
 		${INIT_WARNING_MESSAGE}
 	`;
 

lib/commands/preload.ts

@@ -31,7 +31,14 @@ import { parseAsInteger } from '../utils/validation';
 
 import { flags } from '@oclif/command';
 import * as _ from 'lodash';
-import type { Application, BalenaSDK, PineExpand, Release } from 'balena-sdk';
+import type {
+	Application,
+	BalenaSDK,
+	PineExpand,
+	PineOptions,
+	PineTypedResult,
+	Release,
+} from 'balena-sdk';
 import type { Preloader } from 'balena-preload';
 
 interface FlagsDef extends DockerConnectionCliFlags {
@@ -187,7 +194,7 @@ Can be repeated to add multiple certificates.\
 			: undefined;
 
 		const progressBars: {
-			[key: string]: ReturnType<typeof getVisuals>['Progress'];
+			[key: string]: InstanceType<ReturnType<typeof getVisuals>['Progress']>;
 		} = {};
 
 		const progressHandler = function (event: {
@@ -201,7 +208,7 @@ Can be repeated to add multiple certificates.\
 		};
 
 		const spinners: {
-			[key: string]: ReturnType<typeof getVisuals>['Spinner'];
+			[key: string]: InstanceType<ReturnType<typeof getVisuals>['Spinner']>;
 		} = {};
 
 		const spinnerHandler = function (event: { name: string; action: string }) {
@@ -242,7 +249,7 @@ Can be repeated to add multiple certificates.\
 		const dockerUtils = await import('../utils/docker');
 		const docker = await dockerUtils.getDocker(options);
 		const preloader = new balenaPreload.Preloader(
-			null,
+			undefined,
 			docker,
 			fleetSlug,
 			commit,
@@ -288,7 +295,7 @@ Can be repeated to add multiple certificates.\
 				preloader.on('error', reject);
 				resolve(
 					this.prepareAndPreload(preloader, balena, {
-						appId: fleetSlug,
+						slug: fleetSlug,
 						commit,
 						pinDevice,
 					}),
@@ -308,7 +315,7 @@ Can be repeated to add multiple certificates.\
 		}
 	}
 
-	readonly applicationExpandOptions: PineExpand<Application> = {
+	readonly applicationExpandOptions = {
 		owns__release: {
 			$select: ['id', 'commit', 'end_timestamp', 'composition'],
 			$expand: {
@@ -329,7 +336,7 @@ Can be repeated to add multiple certificates.\
 		should_be_running__release: {
 			$select: 'commit',
 		},
-	};
+	} satisfies PineExpand<Application>;
 
 	isCurrentCommit(commit: string) {
 		return commit === 'latest' || commit === 'current';
@@ -343,7 +350,7 @@ Can be repeated to add multiple certificates.\
 		} catch {
 			throw new Error(`Device type "${deviceTypeSlug}" not found in API query`);
 		}
-		return (await balena.models.application.getAllDirectlyAccessible({
+		const options = {
 			$select: ['id', 'slug', 'should_track_latest_release'],
 			$expand: this.applicationExpandOptions,
 			$filter: {
@@ -388,11 +395,10 @@ Can be repeated to add multiple certificates.\
 				},
 			},
 			$orderby: 'slug asc',
-		})) as Array<
-			ApplicationWithDeviceType & {
-				should_be_running__release: [Release?];
-			}
-		>;
+		} satisfies PineOptions<Application>;
+		return (await balena.models.application.getAllDirectlyAccessible(
+			options,
+		)) as Array<PineTypedResult<Application, typeof options>>;
 	}
 
 	async selectApplication(deviceTypeSlug: string) {
@@ -442,7 +448,7 @@ Can be repeated to add multiple certificates.\
 	}
 
 	async offerToDisableAutomaticUpdates(
-		application: Application,
+		application: Pick<Application, 'id' | 'should_track_latest_release'>,
 		commit: string,
 		pinDevice: boolean,
 	) {
@@ -491,28 +497,28 @@ Would you like to disable automatic updates for this fleet now?\
 		});
 	}
 
-	async getAppWithReleases(balenaSdk: BalenaSDK, appId: string) {
+	async getAppWithReleases(balenaSdk: BalenaSDK, slug: string) {
 		const { getApplication } = await import('../utils/sdk');
 
-		return (await getApplication(balenaSdk, appId, {
+		return await getApplication(balenaSdk, slug, {
 			$expand: this.applicationExpandOptions,
-		})) as Application & { should_be_running__release: [Release?] };
+		});
 	}
 
 	async prepareAndPreload(
 		preloader: Preloader,
 		balenaSdk: BalenaSDK,
 		options: {
-			appId?: string;
+			slug?: string;
 			commit?: string;
 			pinDevice: boolean;
 		},
 	) {
 		await preloader.prepare();
 
-		const application = options.appId
-			? await this.getAppWithReleases(balenaSdk, options.appId)
-			: await this.selectApplication(preloader.config.deviceType);
+		const application = options.slug
+			? await this.getAppWithReleases(balenaSdk, options.slug)
+			: await this.selectApplication(preloader.config!.deviceType);
 
 		let commit: string; // commit hash or the strings 'latest' or 'current'
 
@@ -523,7 +529,7 @@ Would you like to disable automatic updates for this fleet now?\
 			if (this.isCurrentCommit(options.commit)) {
 				if (!appCommit) {
 					throw new Error(
-						`Unexpected empty commit hash for fleet ID "${application.id}"`,
+						`Unexpected empty commit hash for fleet slug "${application.slug}"`,
 					);
 				}
 				// handle `--commit current` (and its `--commit latest` synonym)

lib/commands/push.ts

@@ -22,7 +22,7 @@ import { getBalenaSdk, stripIndent } from '../utils/lazy';
 import { dockerignoreHelp, registrySecretsHelp } from '../utils/messages';
 import type { BalenaSDK } from 'balena-sdk';
 import { ExpectedError, instanceOf } from '../errors';
-import { RegistrySecrets } from 'resin-multibuild';
+import { RegistrySecrets } from '@balena/compose/dist/multibuild';
 import { lowercaseIfSlug } from '../utils/normalization';
 import {
 	applyReleaseTagKeysAndValues,
@@ -55,6 +55,7 @@ interface FlagsDef {
 	'multi-dockerignore': boolean;
 	'release-tag'?: string[];
 	draft: boolean;
+	note?: string;
 	help: void;
 }
 
@@ -97,6 +98,7 @@ export default class PushCmd extends Command {
 		'$ balena push myFleet',
 		'$ balena push myFleet --source <source directory>',
 		'$ balena push myFleet -s <source directory>',
+		'$ balena push myFleet --source <source directory> --note "this is the note for this release"',
 		'$ balena push myFleet --release-tag key1 "" key2 "value2 with spaces"',
 		'$ balena push myorg/myfleet',
 		'',
@@ -176,7 +178,7 @@ export default class PushCmd extends Command {
 			description: stripIndent`
 				Don't run a live session on this push. The filesystem will not be monitored,
 				and changes will not be synchronized to any running containers. Note that both
-				this flag and --detached and required to cause the process to end once the
+				this flag and --detached are required to cause the process to end once the
 				initial build has completed.`,
 			default: false,
 		}),
@@ -241,6 +243,7 @@ export default class PushCmd extends Command {
 				as final by default unless this option is given.`,
 			default: false,
 		}),
+		note: flags.string({ description: 'The notes for this release' }),
 		help: cf.help,
 	};
 
@@ -325,7 +328,7 @@ export default class PushCmd extends Command {
 		]);
 
 		const application = await getApplication(sdk, appNameOrSlug, {
-			$select: ['app_name', 'slug'],
+			$select: 'slug',
 		});
 
 		const opts = {
@@ -354,6 +357,9 @@ export default class PushCmd extends Command {
 				releaseTagKeys,
 				releaseTagValues,
 			);
+			if (options.note) {
+				await sdk.models.release.setNote(releaseId, options.note);
+			}
 		} else if (releaseTagKeys.length > 0) {
 			throw new Error(stripIndent`
 				A release ID could not be parsed out of the builder's output.

lib/commands/release/invalidate.ts

@@ -0,0 +1,83 @@
+/**
+ * @license
+ * Copyright 2016-2020 Balena Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import { flags } from '@oclif/command';
+import Command from '../../command';
+import * as cf from '../../utils/common-flags';
+import { getBalenaSdk, stripIndent } from '../../utils/lazy';
+import { tryAsInteger } from '../../utils/validation';
+
+interface FlagsDef {
+	help: void;
+}
+
+interface ArgsDef {
+	commitOrId: string | number;
+}
+
+export default class ReleaseInvalidateCmd extends Command {
+	public static description = stripIndent`
+		Invalidate a release.
+
+		Invalidate a release.
+
+		Invalid releases are not automatically deployed to devices tracking the latest
+		release. For an invalid release to be deployed to a device, the device should be
+		explicity pinned to that release.
+`;
+	public static examples = [
+		'$ balena release invalidate a777f7345fe3d655c1c981aa642e5555',
+		'$ balena release invalidate 1234567',
+	];
+
+	public static usage = 'release invalidate <commitOrId>';
+
+	public static flags: flags.Input<FlagsDef> = {
+		help: cf.help,
+	};
+
+	public static args = [
+		{
+			name: 'commitOrId',
+			description: 'the commit or ID of the release to invalidate',
+			required: true,
+			parse: (commitOrId: string) => tryAsInteger(commitOrId),
+		},
+	];
+
+	public static authenticated = true;
+
+	public async run() {
+		const { args: params } = this.parse<FlagsDef, ArgsDef>(
+			ReleaseInvalidateCmd,
+		);
+
+		const balena = getBalenaSdk();
+
+		const release = await balena.models.release.get(params.commitOrId, {
+			$select: ['id', 'is_invalidated'],
+		});
+
+		if (release.is_invalidated) {
+			console.log(`Release ${params.commitOrId} is already invalidated!`);
+			return;
+		}
+
+		await balena.models.release.setIsInvalidated(release.id, true);
+		console.log(`Release ${params.commitOrId} invalidated`);
+	}
+}

lib/commands/release/validate.ts

@@ -0,0 +1,80 @@
+/**
+ * @license
+ * Copyright 2016-2020 Balena Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import { flags } from '@oclif/command';
+import Command from '../../command';
+import * as cf from '../../utils/common-flags';
+import { getBalenaSdk, stripIndent } from '../../utils/lazy';
+import { tryAsInteger } from '../../utils/validation';
+
+interface FlagsDef {
+	help: void;
+}
+
+interface ArgsDef {
+	commitOrId: string | number;
+}
+
+export default class ReleaseValidateCmd extends Command {
+	public static description = stripIndent`
+		Validate a release.
+
+		Validate a release.
+
+		Valid releases are automatically deployed to devices tracking the latest
+		release if they are finalized.
+`;
+	public static examples = [
+		'$ balena release validate a777f7345fe3d655c1c981aa642e5555',
+		'$ balena release validate 1234567',
+	];
+
+	public static usage = 'release validate <commitOrId>';
+
+	public static flags: flags.Input<FlagsDef> = {
+		help: cf.help,
+	};
+
+	public static args = [
+		{
+			name: 'commitOrId',
+			description: 'the commit or ID of the release to validate',
+			required: true,
+			parse: (commitOrId: string) => tryAsInteger(commitOrId),
+		},
+	];
+
+	public static authenticated = true;
+
+	public async run() {
+		const { args: params } = this.parse<FlagsDef, ArgsDef>(ReleaseValidateCmd);
+
+		const balena = getBalenaSdk();
+
+		const release = await balena.models.release.get(params.commitOrId, {
+			$select: ['id', 'is_invalidated'],
+		});
+
+		if (!release.is_invalidated) {
+			console.log(`Release ${params.commitOrId} is already validated!`);
+			return;
+		}
+
+		await balena.models.release.setIsInvalidated(release.id, false);
+		console.log(`Release ${params.commitOrId} validated`);
+	}
+}

lib/commands/scan.ts

@@ -16,7 +16,6 @@
  */
 
 import { flags } from '@oclif/command';
-import type { LocalBalenaOsDevice } from 'balena-sync';
 import Command from '../command';
 import * as cf from '../utils/common-flags';
 import { getCliUx, stripIndent } from '../utils/lazy';
@@ -72,7 +71,7 @@ export default class ScanCmd extends Command {
 
 	public async run() {
 		const _ = await import('lodash');
-		const { discover } = await import('balena-sync');
+		const { discoverLocalBalenaOsDevices } = await import('../utils/discover');
 		const prettyjson = await import('prettyjson');
 		const dockerUtils = await import('../utils/docker');
 
@@ -88,8 +87,7 @@ export default class ScanCmd extends Command {
 		const ux = getCliUx();
 		ux.action.start('Scanning for local balenaOS devices');
 
-		const localDevices: LocalBalenaOsDevice[] =
-			await discover.discoverLocalBalenaOsDevices(discoverTimeout);
+		const localDevices = await discoverLocalBalenaOsDevices(discoverTimeout);
 		const engineReachableDevices: boolean[] = await Promise.all(
 			localDevices.map(async ({ address }: { address: string }) => {
 				const docker = await dockerUtils.createClient({
@@ -106,7 +104,7 @@ export default class ScanCmd extends Command {
 			}),
 		);
 
-		const developmentDevices: LocalBalenaOsDevice[] = localDevices.filter(
+		const developmentDevices = localDevices.filter(
 			(_localDevice, index) => engineReachableDevices[index],
 		);
 
@@ -116,18 +114,15 @@ export default class ScanCmd extends Command {
 			_.isEqual,
 		);
 
-		const productionDevicesInfo = _.map(
-			productionDevices,
-			(device: LocalBalenaOsDevice) => {
-				return {
-					host: device.host,
-					address: device.address,
-					osVariant: 'production',
-					dockerInfo: undefined,
-					dockerVersion: undefined,
-				};
-			},
-		);
+		const productionDevicesInfo = productionDevices.map((device) => {
+			return {
+				host: device.host,
+				address: device.address,
+				osVariant: 'production',
+				dockerInfo: undefined,
+				dockerVersion: undefined,
+			};
+		});
 
 		// Query devices for info
 		const devicesInfo = await Promise.all(

lib/commands/ssh.ts

@@ -20,7 +20,6 @@ import Command from '../command';
 import * as cf from '../utils/common-flags';
 import { getBalenaSdk, stripIndent } from '../utils/lazy';
 import { parseAsInteger, validateLocalHostnameOrIp } from '../utils/validation';
-import * as BalenaSdk from 'balena-sdk';
 
 interface FlagsDef {
 	port?: number;
@@ -77,8 +76,7 @@ export default class SshCmd extends Command {
 	public static args = [
 		{
 			name: 'fleetOrDevice',
-			description:
-				'fleet name/slug/id, device uuid, or address of local device',
+			description: 'fleet name/slug, device uuid, or address of local device',
 			required: true,
 		},
 		{
@@ -128,8 +126,8 @@ export default class SshCmd extends Command {
 		if (validateLocalHostnameOrIp(params.fleetOrDevice)) {
 			const { performLocalDeviceSSH } = await import('../utils/device/ssh');
 			return await performLocalDeviceSSH({
-				address: params.fleetOrDevice,
-				port: options.port,
+				hostname: params.fleetOrDevice,
+				port: options.port || 'local',
 				forceTTY: options.tty,
 				verbose: options.verbose,
 				service: params.service,
@@ -152,12 +150,6 @@ export default class SshCmd extends Command {
 			params.fleetOrDevice,
 		);
 
-		const device = await sdk.models.device.get(deviceUuid, {
-			$select: ['id', 'supervisor_version', 'is_online'],
-		});
-
-		const deviceId = device.id;
-		const supervisorVersion = device.supervisor_version;
 		const { which } = await import('../utils/which');
 
 		const [whichProxytunnel, username, proxyUrl] = await Promise.all([
@@ -209,19 +201,15 @@ export default class SshCmd extends Command {
 		// that we know exists and is accessible
 		let containerId: string | undefined;
 		if (params.service != null) {
-			containerId = await this.getContainerId(
-				sdk,
+			const { getContainerIdForService } = await import('../utils/device/ssh');
+			containerId = await getContainerIdForService({
 				deviceUuid,
-				params.service,
-				{
-					port: options.port,
-					proxyCommand,
-					proxyUrl: proxyUrl || '',
-					username: username!,
-				},
-				supervisorVersion,
-				deviceId,
-			);
+				hostname: `ssh.${proxyUrl}`,
+				port: options.port || 'cloud',
+				proxyCommand,
+				service: params.service,
+				username: username!,
+			});
 		}
 
 		let accessCommand: string;
@@ -230,158 +218,14 @@ export default class SshCmd extends Command {
 		} else {
 			accessCommand = `host ${deviceUuid}`;
 		}
-
-		const command = this.generateVpnSshCommand({
-			uuid: deviceUuid,
-			command: accessCommand,
-			verbose: options.verbose,
-			port: options.port,
+		const { runRemoteCommand } = await import('../utils/ssh');
+		await runRemoteCommand({
+			cmd: accessCommand,
+			hostname: `ssh.${proxyUrl}`,
+			port: options.port || 'cloud',
 			proxyCommand,
-			proxyUrl: proxyUrl || '',
-			username: username!,
+			username,
+			verbose: options.verbose,
 		});
-
-		const { spawnSshAndThrowOnError } = await import('../utils/ssh');
-		return spawnSshAndThrowOnError(command);
-	}
-
-	async getContainerId(
-		sdk: BalenaSdk.BalenaSDK,
-		uuid: string,
-		serviceName: string,
-		sshOpts: {
-			port?: number;
-			proxyCommand?: string[];
-			proxyUrl: string;
-			username: string;
-		},
-		version?: string,
-		id?: number,
-	): Promise<string> {
-		const semver = await import('balena-semver');
-
-		if (version == null || id == null) {
-			const device = await sdk.models.device.get(uuid, {
-				$select: ['id', 'supervisor_version'],
-			});
-			version = device.supervisor_version;
-			id = device.id;
-		}
-
-		let containerId: string | undefined;
-		if (semver.gte(version, '8.6.0')) {
-			const apiUrl = await sdk.settings.get('apiUrl');
-			// TODO: Move this into the SDKs device model
-			const request = await sdk.request.send({
-				method: 'POST',
-				url: '/supervisor/v2/containerId',
-				baseUrl: apiUrl,
-				body: {
-					method: 'GET',
-					deviceId: id,
-				},
-			});
-			if (request.status !== 200) {
-				throw new Error(
-					`There was an error connecting to device ${uuid}, HTTP response code: ${request.status}.`,
-				);
-			}
-			const body = request.body;
-			if (body.status !== 'success') {
-				throw new Error(
-					`There was an error communicating with device ${uuid}.\n\tError: ${body.message}`,
-				);
-			}
-			containerId = body.services[serviceName];
-		} else {
-			console.error(stripIndent`
-			Using legacy method to detect container ID. This will be slow.
-			To speed up this process, please update your device to an OS
-			which has a supervisor version of at least v8.6.0.
-		`);
-			// We need to execute a balena ps command on the device,
-			// and parse the output, looking for a specific
-			// container
-			const childProcess = await import('child_process');
-			const { escapeRegExp } = await import('lodash');
-			const { which } = await import('../utils/which');
-			const { deviceContainerEngineBinary } = await import(
-				'../utils/device/ssh'
-			);
-
-			const sshBinary = await which('ssh');
-			const sshArgs = this.generateVpnSshCommand({
-				uuid,
-				verbose: false,
-				port: sshOpts.port,
-				command: `host ${uuid} "${deviceContainerEngineBinary}" ps --format "{{.ID}} {{.Names}}"`,
-				proxyCommand: sshOpts.proxyCommand,
-				proxyUrl: sshOpts.proxyUrl,
-				username: sshOpts.username,
-			});
-
-			if (process.env.DEBUG) {
-				console.error(`[debug] [${sshBinary}, ${sshArgs.join(', ')}]`);
-			}
-			const subProcess = childProcess.spawn(sshBinary, sshArgs, {
-				stdio: [null, 'pipe', null],
-			});
-			const containers = await new Promise<string>((resolve, reject) => {
-				const output: string[] = [];
-				subProcess.stdout.on('data', (chunk) => output.push(chunk.toString()));
-				subProcess.on('close', (code: number) => {
-					if (code !== 0) {
-						reject(
-							new Error(
-								`Non-zero error code when looking for service container: ${code}`,
-							),
-						);
-					} else {
-						resolve(output.join(''));
-					}
-				});
-			});
-
-			const lines = containers.split('\n');
-			const regex = new RegExp(`\\/?${escapeRegExp(serviceName)}_\\d+_\\d+`);
-			for (const container of lines) {
-				const [cId, name] = container.split(' ');
-				if (regex.test(name)) {
-					containerId = cId;
-					break;
-				}
-			}
-		}
-
-		if (containerId == null) {
-			throw new Error(
-				`Could not find a service ${serviceName} on device ${uuid}.`,
-			);
-		}
-		return containerId;
-	}
-
-	generateVpnSshCommand(opts: {
-		uuid: string;
-		command: string;
-		verbose: boolean;
-		port?: number;
-		username: string;
-		proxyUrl: string;
-		proxyCommand?: string[];
-	}) {
-		return [
-			...(opts.verbose ? ['-vvv'] : []),
-			'-t',
-			...['-o', 'LogLevel=ERROR'],
-			...['-o', 'StrictHostKeyChecking=no'],
-			...['-o', 'UserKnownHostsFile=/dev/null'],
-			...(opts.proxyCommand && opts.proxyCommand.length
-				? ['-o', `ProxyCommand=${opts.proxyCommand.join(' ')}`]
-				: []),
-			...(opts.port ? ['-p', opts.port.toString()] : []),
-			`${opts.username}@ssh.${opts.proxyUrl}`,
-			opts.command,
-		];
 	}
 }

lib/commands/support.ts

@@ -149,7 +149,7 @@ export default class SupportCmd extends Command {
 			console.log(
 				`Access has been granted for ${duration}, expiring ${new Date(
 					expiryTs,
-				).toLocaleString()}`,
+				).toISOString()}`,
 			);
 		}
 	}

lib/commands/tag/rm.ts

@@ -90,8 +90,6 @@ export default class TagRmCmd extends Command {
 			throw new ExpectedError(TagRmCmd.missingResourceMessage);
 		}
 
-		const { tryAsInteger } = await import('../../utils/validation');
-
 		if (options.fleet) {
 			const { getFleetSlug } = await import('../../utils/sdk');
 			return balena.models.application.tags.remove(
@@ -100,10 +98,7 @@ export default class TagRmCmd extends Command {
 			);
 		}
 		if (options.device) {
-			return balena.models.device.tags.remove(
-				tryAsInteger(options.device),
-				params.tagKey,
-			);
+			return balena.models.device.tags.remove(options.device, params.tagKey);
 		}
 		if (options.release) {
 			const { disambiguateReleaseParam } = await import(

lib/commands/tag/set.ts

@@ -105,8 +105,6 @@ export default class TagSetCmd extends Command {
 
 		params.value ??= '';
 
-		const { tryAsInteger } = await import('../../utils/validation');
-
 		if (options.fleet) {
 			const { getFleetSlug } = await import('../../utils/sdk');
 			return balena.models.application.tags.set(
@@ -117,7 +115,7 @@ export default class TagSetCmd extends Command {
 		}
 		if (options.device) {
 			return balena.models.device.tags.set(
-				tryAsInteger(options.device),
+				options.device,
 				params.tagKey,
 				params.value,
 			);

lib/commands/tags.ts

@@ -76,8 +76,6 @@ export default class TagsCmd extends Command {
 			throw new ExpectedError(this.missingResourceMessage);
 		}
 
-		const { tryAsInteger } = await import('../utils/validation');
-
 		let tags;
 
 		if (options.fleet) {
@@ -87,9 +85,7 @@ export default class TagsCmd extends Command {
 			);
 		}
 		if (options.device) {
-			tags = await balena.models.device.tags.getAllByDevice(
-				tryAsInteger(options.device),
-			);
+			tags = await balena.models.device.tags.getAllByDevice(options.device);
 		}
 		if (options.release) {
 			const { disambiguateReleaseParam } = await import(

lib/commands/tunnel.ts

@@ -82,7 +82,7 @@ export default class TunnelCmd extends Command {
 	public static args = [
 		{
 			name: 'deviceOrFleet',
-			description: 'device UUID or fleet name/slug/ID',
+			description: 'device UUID or fleet name/slug',
 			required: true,
 			parse: lowercaseIfSlug,
 		},
@@ -136,8 +136,7 @@ export default class TunnelCmd extends Command {
 		// Ascertain device uuid
 		const { getOnlineTargetDeviceUuid } = await import('../utils/patterns');
 		const uuid = await getOnlineTargetDeviceUuid(sdk, params.deviceOrFleet);
-		const device = await sdk.models.device.get(uuid);
-		logger.logInfo(`Opening a tunnel to ${device.uuid}...`);
+		logger.logInfo(`Opening a tunnel to ${uuid}...`);
 
 		const _ = await import('lodash');
 		const localListeners = _.chain(options.port)
@@ -147,31 +146,27 @@ export default class TunnelCmd extends Command {
 			.map(async ({ localPort, localAddress, remotePort }) => {
 				try {
 					const { tunnelConnectionToDevice } = await import('../utils/tunnel');
-					const handler = await tunnelConnectionToDevice(
-						device.uuid,
-						remotePort,
-						sdk,
-					);
+					const handler = await tunnelConnectionToDevice(uuid, remotePort, sdk);
 
 					const { createServer } = await import('net');
 					const server = createServer(async (client: Socket) => {
 						try {
 							await handler(client);
 							logConnection(
-								client.remoteAddress || '',
-								client.remotePort || 0,
-								client.localAddress,
-								client.localPort,
-								device.vpn_address || '',
+								client.remoteAddress ?? '',
+								client.remotePort ?? 0,
+								client.localAddress ?? '',
+								client.localPort ?? 0,
+								uuid,
 								remotePort,
 							);
 						} catch (err) {
 							logConnection(
-								client.remoteAddress || '',
-								client.remotePort || 0,
-								client.localAddress,
-								client.localPort,
-								device.vpn_address || '',
+								client.remoteAddress ?? '',
+								client.remotePort ?? 0,
+								client.localAddress ?? '',
+								client.localPort ?? 0,
+								uuid,
 								remotePort,
 								err,
 							);
@@ -186,15 +181,15 @@ export default class TunnelCmd extends Command {
 					});
 
 					logger.logInfo(
-						` - tunnelling ${localAddress}:${localPort} to ${device.uuid}:${remotePort}`,
+						` - tunnelling ${localAddress}:${localPort} to ${uuid}:${remotePort}`,
 					);
 
 					return true;
 				} catch (err) {
 					logger.logWarn(
-						` - not tunnelling ${localAddress}:${localPort} to ${
-							device.uuid
-						}:${remotePort}, failed ${JSON.stringify(err.message)}`,
+						` - not tunnelling ${localAddress}:${localPort} to ${uuid}:${remotePort}, failed ${JSON.stringify(
+							err.message,
+						)}`,
 					);
 
 					return false;

lib/deprecation.ts

@@ -86,7 +86,7 @@ export class DeprecationChecker {
 	 * @param version Semver without 'v' prefix, e.g. '12.0.0.'
 	 */
 	protected getNpmUrl(version: string) {
-		return `http://registry.npmjs.org/balena-cli/${version}`;
+		return `https://registry.npmjs.org/balena-cli/${version}`;
 	}
 
 	/**

lib/errors.ts

@@ -177,7 +177,16 @@ const messages: {
 		Looks like the session token has expired.
 		Try logging in again with the "balena login" command.`,
 
-	BalenaInvalidDeviceType: (error: Error & { deviceTypeSlug?: string }) => {
+	BalenaInvalidDeviceType: (
+		error: Error & { deviceTypeSlug?: string; type?: string },
+	) => {
+		// TODO: The SDK should be throwing a different Error for this case.
+		if (
+			typeof error.type === 'string' &&
+			error.type.startsWith('Incompatible ')
+		) {
+			return error.type;
+		}
 		const slug = error.deviceTypeSlug ? `"${error.deviceTypeSlug}"` : 'slug';
 		return stripIndent`
 			Device type ${slug} not recognized. Perhaps misspelled?

lib/events.ts

@@ -16,12 +16,7 @@
  */
 
 import * as packageJSON from '../package.json';
-import { getBalenaSdk, stripIndent } from './utils/lazy';
-
-interface CachedUsername {
-	token: string;
-	username: string;
-}
+import { stripIndent } from './utils/lazy';
 
 /**
  * Track balena CLI usage events (product improvement analytics).
@@ -29,7 +24,7 @@ interface CachedUsername {
  * @param commandSignature A string like, for example:
  *      "push <fleetOrDevice>"
  * That's literally so: "fleetOrDevice" is NOT replaced with the actual
- * fleet ID or device ID. The purpose is to find out the most / least
+ * fleet slug or device uuid. The purpose is to find out the most / least
  * used command verbs, so we can focus our development effort where it is most
  * beneficial to end users.
  *
@@ -49,40 +44,13 @@ export async function trackCommand(commandSignature: string) {
 				scope.setExtra('command', commandSignature);
 			});
 		}
-		const settings = await import('balena-settings-client');
-
-		const username = await (async () => {
-			const getStorage = await import('balena-settings-storage');
-			const dataDirectory = settings.get<string>('dataDirectory');
-			const storage = getStorage({ dataDirectory });
-			let token;
-			try {
-				token = await storage.get('token');
-			} catch {
-				// If we can't get a token then we can't get a username
-				return;
-			}
-			try {
-				const result = (await storage.get('cachedUsername')) as CachedUsername;
-				if (result.token === token) {
-					return result.username;
-				}
-			} catch {
-				// ignore
-			}
-			try {
-				const balena = getBalenaSdk();
-				const $username = await balena.auth.whoami();
-				await storage.set('cachedUsername', {
-					token,
-					username: $username,
-				} as CachedUsername);
-				return $username;
-			} catch {
-				return;
-			}
-		})();
-
+		const { getCachedUsername } = await import('./utils/bootstrap');
+		let username: string | undefined;
+		try {
+			username = (await getCachedUsername())?.username;
+		} catch {
+			// ignore
+		}
 		if (!process.env.BALENARC_NO_SENTRY) {
 			Sentry!.configureScope((scope) => {
 				scope.setUser({
@@ -96,6 +64,7 @@ export async function trackCommand(commandSignature: string) {
 			!process.env.BALENA_CLI_TEST_TYPE &&
 			!process.env.BALENARC_NO_ANALYTICS
 		) {
+			const settings = await import('balena-settings-client');
 			const balenaUrl = settings.get<string>('balenaUrl');
 			await sendEvent(balenaUrl, `[CLI] ${commandSignature}`, username);
 		}
@@ -104,38 +73,52 @@ export async function trackCommand(commandSignature: string) {
 	}
 }
 
+const TIMEOUT = 4000;
+
 /**
  * Make the event tracking HTTPS request to balenaCloud's '/mixpanel' endpoint.
  */
 async function sendEvent(balenaUrl: string, event: string, username?: string) {
 	const { default: got } = await import('got');
 	const trackData = {
-		event,
-		properties: {
-			arch: process.arch,
-			balenaUrl, // e.g. 'balena-cloud.com' or 'balena-staging.com'
-			distinct_id: username,
-			mp_lib: 'node',
-			node: process.version,
-			platform: process.platform,
-			token: 'balena-main',
-			version: packageJSON.version,
-		},
-	};
-	const url = `https://api.${balenaUrl}/mixpanel/track`;
-	const searchParams = {
-		ip: 0,
-		verbose: 0,
-		data: Buffer.from(JSON.stringify(trackData)).toString('base64'),
+		api_key: 'balena-main',
+		events: [
+			{
+				event_type: event,
+				user_id: username,
+				version_name: packageJSON.version,
+				event_properties: {
+					balenaUrl, // e.g. 'balena-cloud.com' or 'balena-staging.com'
+					arch: process.arch,
+					platform: process.platform,
+					node: process.version,
+				},
+			},
+		],
 	};
+	const url = `https://data.${balenaUrl}/amplitude/2/httpapi`;
+
 	try {
-		await got(url, { searchParams, retry: 0, timeout: 4000 });
+		await got.post(url, {
+			json: trackData,
+			retry: 0,
+			timeout: {
+				// Starts when the request is initiated.
+				request: TIMEOUT,
+				// Starts when request has been flushed.
+				// Exits the request as soon as it's sent.
+				response: 0,
+			},
+		});
 	} catch (e) {
 		if (process.env.DEBUG) {
 			console.error(`[debug] Event tracking error: ${e.message || e}`);
 		}
 
-		if (e instanceof got.TimeoutError) {
+		if (
+			e instanceof got.TimeoutError &&
+			TIMEOUT < (e.timings.phases.total ?? 0)
+		) {
 			console.error(stripIndent`
 				Timeout submitting analytics event to balenaCloud/openBalena.
 				If you are using the balena CLI in an air-gapped environment with a filtered

lib/fast-boot.ts

@@ -27,14 +27,7 @@ import * as fs from 'fs';
 import * as os from 'os';
 import * as path from 'path';
 
-// `@types/node` does not know about `options: { bigint?: boolean }`
-type statT = (
-	fPath: string,
-	options: { bigint?: boolean },
-) => fs.Stats | Promise<fs.Stats>;
-
-// async stat does not work with pkg's internal `/snapshot` filesystem
-const stat: statT = process.pkg ? fs.statSync : fs.promises.stat;
+const stat = process.pkg ? fs.statSync : fs.promises.stat;
 
 let fastBootStarted = false;
 

lib/help.ts

@@ -14,10 +14,10 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-import Help from '@oclif/plugin-help';
+import { Help } from '@oclif/core';
+import { HelpFormatter } from '@oclif/core/lib/help/formatter';
 import * as indent from 'indent-string';
 import { getChalk } from './utils/lazy';
-import { renderList } from '@oclif/plugin-help/lib/list';
 import { ExpectedError } from './errors';
 
 // Partially overrides standard implementation of help plugin
@@ -39,9 +39,11 @@ function getHelpSubject(args: string[]): string | undefined {
 }
 
 export default class BalenaHelp extends Help {
+	public helpFormatter = new HelpFormatter(this.config);
+
 	public static usage: 'help [command]';
 
-	public showHelp(argv: string[]) {
+	public async showHelp(argv: string[]) {
 		const chalk = getChalk();
 		const subject = getHelpSubject(argv);
 		if (!subject) {
@@ -52,7 +54,7 @@ export default class BalenaHelp extends Help {
 
 		const command = this.config.findCommand(subject);
 		if (command) {
-			this.showCommandHelp(command);
+			await this.showCommandHelp(command);
 			return;
 		}
 
@@ -91,7 +93,7 @@ export default class BalenaHelp extends Help {
 			.map((pc) => {
 				return commands.find((c) => c.id === pc.replace(' ', ':'));
 			})
-			.filter((c): c is typeof commands[0] => !!c);
+			.filter((c): c is (typeof commands)[0] => !!c);
 
 		let usageLength = 0;
 		for (const cmd of primaryCommands) {
@@ -187,14 +189,15 @@ See: https://git.io/JRHUW#deprecation-policy`,
 			return '';
 		}
 
-		const body = renderList(
+		const body = this.helpFormatter.renderList(
 			commands
 				.filter((c) => c.usage != null && c.usage !== '')
 				.map((c) => [c.usage, this.formatDescription(c.description)]),
 			{
 				spacer: '\n',
 				stripAnsi: this.opts.stripAnsi,
-				maxWidth: this.opts.maxWidth - 2,
+				indentation: 2,
+				multiline: true,
 			},
 		);
 

lib/utils/bootstrap.ts

@@ -119,3 +119,61 @@ export async function pkgExec(modFunc: string, args: string[]) {
 		console.error(err);
 	}
 }
+
+export interface CachedUsername {
+	token: string;
+	username: string;
+}
+
+let cachedUsername: CachedUsername | undefined;
+
+/**
+ * Return the parsed contents of the `~/.balena/cachedUsername` file. If the file
+ * does not exist, create it with the details from the cloud. If not connected
+ * to the internet, return undefined. This function is used by `lib/events.ts`
+ * (event tracking) and `lib/utils/device/ssh.ts` and needs to gracefully handle
+ * the scenario of not being connected to the internet.
+ */
+export async function getCachedUsername(): Promise<CachedUsername | undefined> {
+	if (cachedUsername) {
+		return cachedUsername;
+	}
+	const [{ getBalenaSdk }, getStorage, settings] = await Promise.all([
+		import('./lazy'),
+		import('balena-settings-storage'),
+		import('balena-settings-client'),
+	]);
+	const dataDirectory = settings.get<string>('dataDirectory');
+	const storage = getStorage({ dataDirectory });
+	let token: string | undefined;
+	try {
+		token = (await storage.get('token')) as string | undefined;
+	} catch {
+		// ignore
+	}
+	if (!token) {
+		// If we can't get a token then we can't get a username
+		return;
+	}
+	try {
+		const result = (await storage.get('cachedUsername')) as
+			| CachedUsername
+			| undefined;
+		if (result && result.token === token && result.username) {
+			cachedUsername = result;
+			return cachedUsername;
+		}
+	} catch {
+		// ignore
+	}
+	try {
+		const username = await getBalenaSdk().auth.whoami();
+		if (username) {
+			cachedUsername = { token, username };
+			await storage.set('cachedUsername', cachedUsername);
+		}
+	} catch {
+		// ignore (not connected to the internet?)
+	}
+	return cachedUsername;
+}

lib/utils/cloud.ts

@@ -107,16 +107,6 @@ export const getDeviceAndMaybeAppFromUUID = _.memoize(
 	(_sdk, deviceUUID) => deviceUUID,
 );
 
-/** Given a device type alias like 'nuc', return the actual slug like 'intel-nuc'. */
-export const unaliasDeviceType = _.memoize(async function (
-	sdk: SDK.BalenaSDK,
-	deviceType: string,
-): Promise<string> {
-	return (
-		(await sdk.models.device.getManifestBySlug(deviceType)).slug || deviceType
-	);
-});
-
 /**
  * Download balenaOS image for the specified `deviceType`.
  * `OSVersion` may be one of:
@@ -255,8 +245,8 @@ export async function getOsVersions(
 	);
 	// if slug is an alias, fetch the real slug
 	if (!versions.length) {
-		// unaliasDeviceType() produces a nice error msg if slug is invalid
-		slug = await unaliasDeviceType(sdk, slug);
+		// unalias device type slug
+		slug = (await sdk.models.deviceType.get(slug, { $select: 'slug' })).slug;
 		if (slug !== deviceType) {
 			versions = await sdk.models.os.getAvailableOsVersions(slug);
 		}

lib/utils/common-args.ts

@@ -18,7 +18,7 @@ import { lowercaseIfSlug } from './normalization';
 
 export const fleetRequired = {
 	name: 'fleet',
-	description: 'fleet name, slug (preferred), or numeric ID (deprecated)',
+	description: 'fleet name or slug (preferred)',
 	required: true,
 	parse: lowercaseIfSlug,
 };

lib/utils/common-flags.ts

@@ -19,13 +19,12 @@ import { flags } from '@oclif/command';
 import { stripIndent } from './lazy';
 import { lowercaseIfSlug } from './normalization';
 
-import { isV14 } from './version';
 import type { IBooleanFlag } from '@oclif/parser/lib/flags';
 import type { DataOutputOptions, DataSetOutputOptions } from '../framework';
 
 export const fleet = flags.string({
 	char: 'f',
-	description: 'fleet name, slug (preferred), or numeric ID (deprecated)',
+	description: 'fleet name or slug (preferred)',
 	parse: lowercaseIfSlug,
 });
 
@@ -75,6 +74,12 @@ export const dev: IBooleanFlag<boolean> = flags.boolean({
 	default: false,
 });
 
+export const secureBoot: IBooleanFlag<boolean> = flags.boolean({
+	description:
+		'Configure balenaOS installer to opt-in secure boot and disk encryption',
+	default: false,
+});
+
 export const drive = flags.string({
 	char: 'd',
 	description: stripIndent`
@@ -97,15 +102,6 @@ export const deviceType = flags.string({
 	required: true,
 });
 
-export const deviceTypeIgnored = isV14()
-	? undefined
-	: flags.string({
-			description: 'ignored - no longer required',
-			char: 't',
-			required: false,
-			hidden: true,
-	  });
-
 export const json: IBooleanFlag<boolean> = flags.boolean({
 	char: 'j',
 	description: 'produce JSON output instead of tabular output',

lib/utils/compose-types.d.ts

@@ -15,8 +15,11 @@
  * limitations under the License.
  */
 
-import type { ImageModel, ReleaseModel } from 'balena-release/build/models';
-import type { Composition, ImageDescriptor } from 'resin-compose-parse';
+import type {
+	ImageModel,
+	ReleaseModel,
+} from '@balena/compose/dist/release/models';
+import type { Composition, ImageDescriptor } from '@balena/compose/dist/parse';
 import type { Pack } from 'tar-stream';
 
 interface Image {
@@ -39,7 +42,7 @@ export interface BuiltImage {
 
 export interface TaggedImage {
 	localImage: import('dockerode').Image;
-	serviceImage: import('balena-release/build/models').ImageModel;
+	serviceImage: import('@balena/compose/dist/release/models').ImageModel;
 	serviceName: string;
 	logs: string;
 	props: BuiltImage.props;
@@ -61,7 +64,6 @@ export interface ComposeOpts {
 export interface ComposeCliFlags {
 	emulated: boolean;
 	dockerfile?: string;
-	logs: boolean;
 	nologs: boolean;
 	'multi-dockerignore': boolean;
 	'noparent-check': boolean;
@@ -78,7 +80,9 @@ export interface ComposeProject {
 }
 
 export interface Release {
-	client: ReturnType<typeof import('balena-release').createClient>;
+	client: ReturnType<
+		typeof import('@balena/compose/dist/release').createClient
+	>;
 	release: Pick<
 		ReleaseModel,
 		| 'id'

lib/utils/compose.ts

@@ -19,7 +19,7 @@ import type { Renderer } from './compose_ts';
 import type * as SDK from 'balena-sdk';
 import type Dockerode = require('dockerode');
 import * as path from 'path';
-import type { Composition, ImageDescriptor } from 'resin-compose-parse';
+import type { Composition, ImageDescriptor } from '@balena/compose/dist/parse';
 import type {
 	BuiltImage,
 	ComposeOpts,
@@ -64,7 +64,7 @@ export function createProject(
 ): ComposeProject {
 	const yml = require('js-yaml') as typeof import('js-yaml');
 	const compose =
-		require('resin-compose-parse') as typeof import('resin-compose-parse');
+		require('@balena/compose/dist/parse') as typeof import('@balena/compose/dist/parse');
 
 	// both methods below may throw.
 	const rawComposition = yml.load(composeStr);
@@ -107,7 +107,7 @@ export const createRelease = async function (
 	const _ = require('lodash') as typeof import('lodash');
 	const crypto = require('crypto') as typeof import('crypto');
 	const releaseMod =
-		require('balena-release') as typeof import('balena-release');
+		require('@balena/compose/dist/release') as typeof import('@balena/compose/dist/release');
 
 	const client = releaseMod.createClient({ apiEndpoint, auth });
 
@@ -214,7 +214,7 @@ export const getPreviousRepos = (
 					image: [SDK.Image];
 				}>;
 				const { getRegistryAndName } =
-					require('resin-multibuild') as typeof import('resin-multibuild');
+					require('@balena/compose/dist/multibuild') as typeof import('@balena/compose/dist/multibuild');
 				return Promise.all(
 					images.map(function (d) {
 						const imageName = d.image[0].is_stored_at__image_location || '';

lib/utils/compose_ts.ts

@@ -16,7 +16,7 @@
  */
 import { flags } from '@oclif/command';
 import { BalenaSDK } from 'balena-sdk';
-import type { TransposeOptions } from 'docker-qemu-transpose';
+import type { TransposeOptions } from '@balena/compose/dist/emulate';
 import type * as Dockerode from 'dockerode';
 import { promises as fs } from 'fs';
 import jsyaml = require('js-yaml');
@@ -26,8 +26,9 @@ import type {
 	BuildConfig,
 	Composition,
 	ImageDescriptor,
-} from 'resin-compose-parse';
-import type * as MultiBuild from 'resin-multibuild';
+} from '@balena/compose/dist/parse';
+import type * as MultiBuild from '@balena/compose/dist/multibuild';
+import * as semver from 'semver';
 import type { Duplex, Readable } from 'stream';
 import type { Pack } from 'tar-stream';
 
@@ -117,7 +118,7 @@ export async function loadProject(
 	image?: string,
 	imageTag?: string,
 ): Promise<ComposeProject> {
-	const compose = await import('resin-compose-parse');
+	const compose = await import('@balena/compose/dist/parse');
 	const { createProject } = await import('./compose');
 	let composeName: string;
 	let composeStr: string;
@@ -261,7 +262,7 @@ export async function buildProject(
 	opts: BuildProjectOpts,
 ): Promise<BuiltImage[]> {
 	await checkBuildSecretsRequirements(opts.docker, opts.projectPath);
-	const compose = await import('resin-compose-parse');
+	const compose = await import('@balena/compose/dist/parse');
 	const imageDescriptors = compose.parse(opts.composition);
 	const renderer = await startRenderer({ imageDescriptors, ...opts });
 	let buildSummaryByService: Dictionary<string> | undefined;
@@ -332,7 +333,7 @@ async function $buildProject(
 	logger.logDebug('Prepared tasks; building...');
 
 	const { BALENA_ENGINE_TMP_PATH } = await import('../config');
-	const builder = await import('resin-multibuild');
+	const builder = await import('@balena/compose/dist/multibuild');
 
 	const builtImages = await builder.performBuilds(
 		tasks,
@@ -480,8 +481,9 @@ async function qemuTransposeBuildStream({
 		throw new Error(`No buildStream for task '${task.tag}'`);
 	}
 
-	const transpose = await import('docker-qemu-transpose');
-	const { toPosixPath } = (await import('resin-multibuild')).PathUtils;
+	const transpose = await import('@balena/compose/dist/emulate');
+	const { toPosixPath } = (await import('@balena/compose/dist/multibuild'))
+		.PathUtils;
 
 	const transposeOptions: TransposeOptions = {
 		hostQemuPath: toPosixPath(binPath),
@@ -507,9 +509,9 @@ async function setTaskProgressHooks({
 	inlineLogs?: boolean;
 	renderer: Renderer;
 	task: BuildTaskPlus;
-	transposeOptions?: import('docker-qemu-transpose').TransposeOptions;
+	transposeOptions?: import('@balena/compose/dist/emulate').TransposeOptions;
 }) {
-	const transpose = await import('docker-qemu-transpose');
+	const transpose = await import('@balena/compose/dist/emulate');
 	// Get the service-specific log stream
 	const logStream = renderer.streams[task.serviceName];
 	task.logBuffer = [];
@@ -723,16 +725,16 @@ export async function getServiceDirsFromComposition(
  *
  * The `image` argument may therefore refer to either a `build` or `image` property
  * of a service in a docker-compose.yml file, which is a bit confusing but it matches
- * the `ImageDescriptor.image` property as defined by `resin-compose-parse`.
+ * the `ImageDescriptor.image` property as defined by `@balena/compose/parse`.
  *
- * Note that `resin-compose-parse` "normalizes" the docker-compose.yml file such
+ * Note that `@balena/compose/parse` "normalizes" the docker-compose.yml file such
  * that, if `services.service.build` is a string, it is converted to a BuildConfig
  * object with the string value assigned to `services.service.build.context`:
- * https://github.com/balena-io-modules/resin-compose-parse/blob/v2.1.3/src/compose.ts#L166-L167
+ * https://github.com/balena-io-modules/balena-compose/blob/v0.1.0/lib/parse/compose.ts#L166-L167
  * This is why this implementation works when `services.service.build` is defined
  * as a string in the docker-compose.yml file.
  *
- * @param image The `ImageDescriptor.image` attribute parsed with `resin-compose-parse`
+ * @param image The `ImageDescriptor.image` attribute parsed with `@balena/compose/parse`
  */
 export function isBuildConfig(
 	image: string | BuildConfig,
@@ -758,7 +760,8 @@ export async function tarDirectory(
 	}: TarDirectoryOptions,
 ): Promise<import('stream').Readable> {
 	const { filterFilesWithDockerignore } = await import('./ignore');
-	const { toPosixPath } = (await import('resin-multibuild')).PathUtils;
+	const { toPosixPath } = (await import('@balena/compose/dist/multibuild'))
+		.PathUtils;
 
 	let readFile: (file: string) => Promise<Buffer>;
 	if (process.platform === 'win32') {
@@ -940,7 +943,7 @@ async function parseRegistrySecrets(
 			throw new ExpectedError('Filename must end with .json, .yml or .yaml');
 		}
 		const raw = (await fs.readFile(secretsFilename)).toString();
-		const multiBuild = await import('resin-multibuild');
+		const multiBuild = await import('@balena/compose/dist/multibuild');
 		const registrySecrets =
 			new multiBuild.RegistrySecretValidator().validateRegistrySecrets(
 				isYaml ? require('js-yaml').load(raw) : JSON.parse(raw),
@@ -969,7 +972,7 @@ export async function makeBuildTasks(
 	releaseHash: string = 'unavailable',
 	preprocessHook?: (dockerfile: string) => string,
 ): Promise<MultiBuild.BuildTask[]> {
-	const multiBuild = await import('resin-multibuild');
+	const multiBuild = await import('@balena/compose/dist/multibuild');
 	const buildTasks = await multiBuild.splitBuildStream(composition, tarStream);
 
 	logger.logDebug('Found build tasks:');
@@ -1015,7 +1018,7 @@ async function performResolution(
 	releaseHash: string,
 	preprocessHook?: (dockerfile: string) => string,
 ): Promise<MultiBuild.BuildTask[]> {
-	const multiBuild = await import('resin-multibuild');
+	const multiBuild = await import('@balena/compose/dist/multibuild');
 	const resolveListeners: MultiBuild.ResolveListeners = {};
 	const resolvePromise = new Promise<never>((_resolve, reject) => {
 		resolveListeners.error = [reject];
@@ -1080,7 +1083,7 @@ async function validateSpecifiedDockerfile(
 	dockerfilePath: string,
 ): Promise<string> {
 	const { contains, toNativePath, toPosixPath } = (
-		await import('resin-multibuild')
+		await import('@balena/compose/dist/multibuild')
 	).PathUtils;
 
 	const nativeProjectPath = path.normalize(projectPath);
@@ -1240,7 +1243,7 @@ async function pushAndUpdateServiceImages(
 	token: string,
 	images: TaggedImage[],
 	afterEach: (
-		serviceImage: import('balena-release/build/models').ImageModel,
+		serviceImage: import('@balena/compose/dist/release/models').ImageModel,
 		props: object,
 	) => void,
 ) {
@@ -1325,12 +1328,14 @@ async function pushAndUpdateServiceImages(
 async function pushServiceImages(
 	docker: Dockerode,
 	logger: Logger,
-	pineClient: ReturnType<typeof import('balena-release').createClient>,
+	pineClient: ReturnType<
+		typeof import('@balena/compose/dist/release').createClient
+	>,
 	taggedImages: TaggedImage[],
 	token: string,
 	skipLogUpload: boolean,
 ): Promise<void> {
-	const releaseMod = await import('balena-release');
+	const releaseMod = await import('@balena/compose/dist/release');
 	logger.logInfo('Pushing images to registry...');
 	await pushAndUpdateServiceImages(
 		docker,
@@ -1348,9 +1353,6 @@ async function pushServiceImages(
 	);
 }
 
-// TODO: This should be shared between the CLI & the Builder
-const PLAIN_SEMVER_REGEX = /^([0-9]+)\.([0-9]+)\.([0-9]+)$/;
-
 export async function deployProject(
 	docker: Dockerode,
 	logger: Logger,
@@ -1363,8 +1365,8 @@ export async function deployProject(
 	skipLogUpload: boolean,
 	projectPath: string,
 	isDraft: boolean,
-): Promise<import('balena-release/build/models').ReleaseModel> {
-	const releaseMod = await import('balena-release');
+): Promise<import('@balena/compose/dist/release/models').ReleaseModel> {
+	const releaseMod = await import('@balena/compose/dist/release');
 	const { createRelease, tagServiceImages } = await import('./compose');
 	const tty = (await import('./tty'))(process.stdout);
 
@@ -1373,10 +1375,10 @@ export async function deployProject(
 
 	const contractPath = path.join(projectPath, 'balena.yml');
 	const contract = await getContractContent(contractPath);
-	if (contract?.version && !PLAIN_SEMVER_REGEX.test(contract?.version)) {
+	if (contract?.version && !semver.valid(contract.version)) {
 		throw new ExpectedError(stripIndent`\
-			Error: expected the version field in "${contractPath}"
-			to be a basic semver in the format '1.2.3'. Got '${contract.version}' instead`);
+			Error: the version field in "${contractPath}"
+			is not a valid semver`);
 	}
 
 	const $release = await runSpinner(
@@ -1651,10 +1653,6 @@ export const composeCliFlags: flags.Input<ComposeCliFlags> = {
 		description:
 			'Alternative Dockerfile name/path, relative to the source folder',
 	}),
-	logs: flags.boolean({
-		description:
-			'No-op and deprecated since balena CLI v12.0.0. Build logs are now shown by default.',
-	}),
 	nologs: flags.boolean({
 		description:
 			'Hide the image build log output (produce less verbose output)',

lib/utils/config.ts

@@ -52,10 +52,14 @@ export interface ImgConfig {
 	os?: {
 		sshKeys?: string[];
 	};
+
+	installer?: {
+		secureboot?: boolean;
+	};
 }
 
 export async function generateApplicationConfig(
-	application: BalenaSdk.Application,
+	application: Pick<BalenaSdk.Application, 'slug'>,
 	options: {
 		version: string;
 		appUpdatePollInterval?: number;
@@ -63,6 +67,7 @@ export async function generateApplicationConfig(
 		os?: {
 			sshKeys?: string[];
 		};
+		secureBoot?: boolean;
 	},
 ): Promise<ImgConfig> {
 	options = {
@@ -84,6 +89,12 @@ export async function generateApplicationConfig(
 			: options.os.sshKeys;
 	}
 
+	// configure installer secure boot opt-in if specified
+	if (options.secureBoot) {
+		config.installer ??= {};
+		config.installer.secureboot = options.secureBoot;
+	}
+
 	return config;
 }
 
@@ -165,3 +176,54 @@ export async function validateDevOptionAndWarn(
 		and exposes network ports such as 2375 that allows unencrypted access to balenaEngine.
 		Therefore, development mode should only be used in private, trusted local networks.`);
 }
+
+/**
+ * Chech whether the `--secureBoot` option of commands related to OS configuration
+ * such as `os configure` and `config generate` is compatible with a given
+ * OS release, and print a warning regarding the consequences of using that
+ * option.
+ */
+export async function validateSecureBootOptionAndWarn(
+	secureBoot?: boolean,
+	slug?: string,
+	version?: string,
+	logger?: import('./logger'),
+) {
+	if (!secureBoot) {
+		return;
+	}
+	const { ExpectedError } = await import('../errors');
+	if (!version) {
+		throw new ExpectedError(`Error: No version provided`);
+	}
+	if (!slug) {
+		throw new ExpectedError(`Error: No device type provided`);
+	}
+	const sdk = getBalenaSdk();
+	const [osRelease] = await sdk.models.os.getAllOsVersions(slug, {
+		$select: 'contract',
+		$filter: { raw_version: `${version.replace(/^v/, '')}` },
+	});
+	if (!osRelease) {
+		throw new ExpectedError(`Error: No ${version} release for ${slug}`);
+	}
+
+	const contract = osRelease.contract ? JSON.parse(osRelease.contract) : null;
+	if (
+		contract?.provides.some((entry: Dictionary<string>) => {
+			return entry.type === 'sw.feature' && entry.slug === 'secureboot';
+		})
+	) {
+		if (!logger) {
+			const Logger = await import('./logger');
+			logger = Logger.getLogger();
+		}
+		logger.logInfo(stripIndent`
+			The '--secureBoot' option is being used to configure a balenaOS installer image
+			into secure boot and full disk encryption.`);
+	} else {
+		throw new ExpectedError(
+			`Error: The '--secureBoot' option is not supported for ${slug} in ${version}`,
+		);
+	}
+}

lib/utils/device/deploy.ts

@@ -18,13 +18,13 @@
 import * as semver from 'balena-semver';
 import * as Docker from 'dockerode';
 import * as _ from 'lodash';
-import { Composition } from 'resin-compose-parse';
+import { Composition } from '@balena/compose/dist/parse';
 import {
 	BuildTask,
 	getAuthConfigObj,
 	LocalImage,
 	RegistrySecrets,
-} from 'resin-multibuild';
+} from '@balena/compose/dist/multibuild';
 import type { Readable } from 'stream';
 
 import { BALENA_ENGINE_TMP_PATH } from '../../config';
@@ -44,7 +44,7 @@ import { displayBuildLog } from './logs';
 import { stripIndent } from '../lazy';
 
 const LOCAL_APPNAME = 'localapp';
-const LOCAL_RELEASEHASH = 'localrelease';
+const LOCAL_RELEASEHASH = '10ca12e1ea5e';
 const LOCAL_PROJECT_NAME = 'local_image';
 
 // Define the logger here so the debug output
@@ -209,9 +209,9 @@ export async function deployToDevice(opts: DeviceDeployOptions): Promise<void> {
 	globalLogger.logDebug('Fetching device information...');
 	const deviceInfo = await api.getDeviceInformation();
 
-	let buildLogs: Dictionary<string> | undefined;
+	let imageIds: Dictionary<string[]> | undefined;
 	if (!opts.nolive) {
-		buildLogs = {};
+		imageIds = {};
 	}
 
 	const { awaitInterruptibleTask } = await import('../helpers');
@@ -223,7 +223,7 @@ export async function deployToDevice(opts: DeviceDeployOptions): Promise<void> {
 		deviceInfo,
 		globalLogger,
 		opts,
-		buildLogs,
+		imageIds,
 	);
 
 	globalLogger.outputDeferredMessages();
@@ -265,7 +265,7 @@ export async function deployToDevice(opts: DeviceDeployOptions): Promise<void> {
 			docker,
 			logger: globalLogger,
 			composition: project.composition,
-			buildLogs: buildLogs!,
+			imageIds: imageIds!,
 			deployOpts: opts,
 		});
 		promises.push(livepush.init());
@@ -312,6 +312,14 @@ function connectToDocker(host: string, port: number): Docker {
 	});
 }
 
+function extractDockerArrowMessage(outputLine: string): string | undefined {
+	const arrowTest = /^.*\s*-+>\s*(.+)/i;
+	const match = arrowTest.exec(outputLine);
+	if (match != null) {
+		return match[1];
+	}
+}
+
 async function performBuilds(
 	composition: Composition,
 	tarStream: Readable,
@@ -319,9 +327,9 @@ async function performBuilds(
 	deviceInfo: DeviceInfo,
 	logger: Logger,
 	opts: DeviceDeployOptions,
-	buildLogs?: Dictionary<string>,
+	imageIds?: Dictionary<string[]>,
 ): Promise<BuildTask[]> {
-	const multibuild = await import('resin-multibuild');
+	const multibuild = await import('@balena/compose/dist/multibuild');
 
 	const buildTasks = await makeBuildTasks(
 		composition,
@@ -345,14 +353,29 @@ async function performBuilds(
 	// If we're passed a build logs object make sure to set it
 	// up properly
 	let logHandlers: ((serviceName: string, line: string) => void) | undefined;
-	if (buildLogs != null) {
+
+	const lastArrowMessage: Dictionary<string> = {};
+
+	if (imageIds != null) {
 		for (const task of buildTasks) {
 			if (!task.external) {
-				buildLogs[task.serviceName] = '';
+				imageIds[task.serviceName] = [];
 			}
 		}
 		logHandlers = (serviceName: string, line: string) => {
-			buildLogs[serviceName] += `${line}\n`;
+			// If this was a from line, take the last found
+			// image id and save it
+			if (
+				/step \d+(?:\/\d+)?\s*:\s*FROM/i.test(line) &&
+				lastArrowMessage[serviceName] != null
+			) {
+				imageIds[serviceName].push(lastArrowMessage[serviceName]);
+			} else {
+				const msg = extractDockerArrowMessage(line);
+				if (msg != null) {
+					lastArrowMessage[serviceName] = msg;
+				}
+			}
 		};
 	}
 
@@ -370,7 +393,7 @@ async function performBuilds(
 	const imagesToRemove: string[] = [];
 
 	// Now tag any external images with the correct name that they should be,
-	// as this won't be done by resin-multibuild
+	// as this won't be done by @balena/compose/multibuild
 	await Promise.all(
 		localImages.map(async (localImage) => {
 			if (localImage.external) {
@@ -413,12 +436,26 @@ export async function rebuildSingleTask(
 	// the logs, so any calller who wants to keep track of
 	// this should provide the following callback
 	containerIdCb?: (id: string) => void,
-): Promise<string> {
-	const multibuild = await import('resin-multibuild');
+): Promise<string[]> {
+	const multibuild = await import('@balena/compose/dist/multibuild');
 	// First we run the build task, to get the new image id
-	let buildLogs = '';
+	const stageIds = [] as string[];
+	let lastArrowMessage: string | undefined;
+
 	const logHandler = (_s: string, line: string) => {
-		buildLogs += `${line}\n`;
+		// If this was a FROM line, take the last found
+		// image id and save it as a stage id
+		if (
+			/step \d+(?:\/\d+)?\s*:\s*FROM/i.test(line) &&
+			lastArrowMessage != null
+		) {
+			stageIds.push(lastArrowMessage);
+		} else {
+			const msg = extractDockerArrowMessage(line);
+			if (msg != null) {
+				lastArrowMessage = msg;
+			}
+		}
 
 		if (containerIdCb != null) {
 			const match = line.match(/^\s*--->\s*Running\s*in\s*([a-f0-9]*)\s*$/i);
@@ -477,7 +514,7 @@ export async function rebuildSingleTask(
 		]);
 	}
 
-	return buildLogs;
+	return stageIds;
 }
 
 function assignOutputHandlers(
@@ -533,10 +570,17 @@ async function assignDockerBuildOpts(
 	await Promise.all(
 		buildTasks.map(async (task: BuildTask) => {
 			task.dockerOpts = {
-				cachefrom: images,
-				labels: {
-					'io.resin.local.image': '1',
-					'io.resin.local.service': task.serviceName,
+				...(task.dockerOpts || {}),
+				...{
+					cachefrom: images,
+					labels: {
+						'io.resin.local.image': '1',
+						'io.resin.local.service': task.serviceName,
+					},
+					t: getImageNameFromTask(task),
+					nocache: opts.nocache,
+					forcerm: true,
+					pull: opts.pull,
 				},
 				t: getImageNameFromTask(task),
 				nocache: opts.nocache,

lib/utils/device/live.ts

@@ -21,8 +21,8 @@ import * as fs from 'fs';
 import Livepush, { ContainerNotRunningError } from 'livepush';
 import * as _ from 'lodash';
 import * as path from 'path';
-import type { Composition } from 'resin-compose-parse';
-import type { BuildTask } from 'resin-multibuild';
+import type { Composition } from '@balena/compose/dist/parse';
+import type { BuildTask } from '@balena/compose/dist/multibuild';
 
 import { instanceOf } from '../../errors';
 import Logger = require('../logger');
@@ -52,7 +52,6 @@ interface MonitoredContainer {
 	containerId: string;
 }
 
-type BuildLogs = Dictionary<string>;
 type StageImageIDs = Dictionary<string[]>;
 
 export interface LivepushOpts {
@@ -62,7 +61,7 @@ export interface LivepushOpts {
 	docker: Dockerode;
 	api: DeviceAPI;
 	logger: Logger;
-	buildLogs: BuildLogs;
+	imageIds: StageImageIDs;
 	deployOpts: DeviceDeployOptions;
 }
 
@@ -97,7 +96,7 @@ export class LivepushManager {
 		this.api = opts.api;
 		this.logger = opts.logger;
 		this.deployOpts = opts.deployOpts;
-		this.imageIds = LivepushManager.getMultistageImageIDs(opts.buildLogs);
+		this.imageIds = opts.imageIds;
 	}
 
 	public async init(): Promise<void> {
@@ -250,7 +249,7 @@ export class LivepushManager {
 			cwd: serviceContext,
 			followSymlinks: true,
 			ignoreInitial: true,
-			ignored: (filePath: string, stats: fs.Stats | undefined) => {
+			ignored: (filePath: string, stats?: fs.Stats) => {
 				if (!stats) {
 					try {
 						// sync because chokidar defines a sync interface
@@ -297,33 +296,6 @@ export class LivepushManager {
 		return new Dockerfile(content).generateLiveDockerfile();
 	}
 
-	private static getMultistageImageIDs(buildLogs: BuildLogs): StageImageIDs {
-		const stageIds: StageImageIDs = {};
-		_.each(buildLogs, (log, serviceName) => {
-			stageIds[serviceName] = [];
-
-			const lines = log.split(/\r?\n/);
-			let lastArrowMessage: string | undefined;
-			for (const line of lines) {
-				// If this was a from line, take the last found
-				// image id and save it
-				if (
-					/step \d+(?:\/\d+)?\s*:\s*FROM/i.test(line) &&
-					lastArrowMessage != null
-				) {
-					stageIds[serviceName].push(lastArrowMessage);
-				} else {
-					const msg = LivepushManager.extractDockerArrowMessage(line);
-					if (msg != null) {
-						lastArrowMessage = msg;
-					}
-				}
-			}
-		});
-
-		return stageIds;
-	}
-
 	private async awaitDeviceStateSettle(): Promise<void> {
 		// Cache the state to avoid unnecessary calls
 		this.lastDeviceStatus = await this.api.getStatus();
@@ -405,9 +377,9 @@ export class LivepushManager {
 				);
 			}
 
-			let buildLog: string;
+			let stageImages: string[];
 			try {
-				buildLog = await rebuildSingleTask(
+				stageImages = await rebuildSingleTask(
 					serviceName,
 					this.docker,
 					this.logger,
@@ -466,17 +438,13 @@ export class LivepushManager {
 				);
 			}
 
-			const buildLogs: Dictionary<string> = {};
-			buildLogs[serviceName] = buildLog;
-			const stageImages = LivepushManager.getMultistageImageIDs(buildLogs);
-
 			const dockerfile = new Dockerfile(buildTask.dockerfile!);
 
 			instance.livepush = await Livepush.init({
 				dockerfile,
 				context: buildTask.context!,
 				containerId: container.containerId,
-				stageImages: stageImages[serviceName],
+				stageImages,
 				docker: this.docker,
 			});
 			this.assignLivepushOutputHandlers(serviceName, instance.livepush);
@@ -536,16 +504,6 @@ export class LivepushManager {
 		});
 	}
 
-	private static extractDockerArrowMessage(
-		outputLine: string,
-	): string | undefined {
-		const arrowTest = /^.*\s*-+>\s*(.+)/i;
-		const match = arrowTest.exec(outputLine);
-		if (match != null) {
-			return match[1];
-		}
-	}
-
 	private getDockerfilePathFromTask(task: BuildTask): string[] {
 		switch (task.projectType) {
 			case 'Standard Dockerfile':

lib/utils/device/logs.ts

@@ -155,12 +155,8 @@ export function displayLogObject<T extends Log>(
 	system: boolean,
 	filterServices?: string[],
 ): void {
-	let toPrint: string;
-	if (obj.timestamp != null) {
-		toPrint = `[${new Date(obj.timestamp).toLocaleString()}]`;
-	} else {
-		toPrint = `[${new Date().toLocaleString()}]`;
-	}
+	const d = obj.timestamp != null ? new Date(obj.timestamp) : new Date();
+	let toPrint = `[${d.toISOString()}]`;
 
 	if (obj.serviceName != null) {
 		if (filterServices) {

lib/utils/device/ssh.ts

@@ -13,89 +13,140 @@ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 See the License for the specific language governing permissions and
 limitations under the License.
 */
-import type { ContainerInfo } from 'dockerode';
+
+import { ExpectedError } from '../../errors';
 import { stripIndent } from '../lazy';
 
-export interface DeviceSSHOpts {
-	address: string;
-	port?: number;
+import {
+	findBestUsernameForDevice,
+	getRemoteCommandOutput,
+	runRemoteCommand,
+	SshRemoteCommandOpts,
+} from '../ssh';
+
+export interface DeviceSSHOpts extends SshRemoteCommandOpts {
 	forceTTY?: boolean;
-	verbose: boolean;
 	service?: string;
 }
 
-export const deviceContainerEngineBinary = `$(if [ -f /usr/bin/balena ]; then echo "balena"; else echo "docker"; fi)`;
+const deviceContainerEngineBinary = `$(if [ -f /usr/bin/balena ]; then echo "balena"; else echo "docker"; fi)`;
+
+/**
+ * List the running containers on the device over ssh, and return the full
+ * container name that matches the given service name.
+ *
+ * Note: In the past, two other approaches were implemented for this function:
+ *
+ *   - Obtaining container IDs through a supervisor API call:
+ *     '/supervisor/v2/containerId' endpoint, via cloud.
+ *   - Obtaining container IDs using 'dockerode' connected directly to
+ *     balenaEngine on a device, TCP port 2375.
+ *
+ * The problem with using the supervisor API is that it means that 'balena ssh'
+ * becomes dependent on the supervisor being up an running, but sometimes ssh
+ * is needed to investigate devices issues where the supervisor has got into
+ * trouble (e.g. supervisor in restart loop). This is the subject of CLI issue
+ * https://github.com/balena-io/balena-cli/issues/1560 .
+ *
+ * The problem with using dockerode to connect directly to port 2375 (balenaEngine)
+ * is that it only works with development variants of balenaOS. Production variants
+ * block access to port 2375 for security reasons. 'balena ssh' should support
+ * production variants as well, especially after balenaOS v2.44.0 that introduced
+ * support for using the cloud account username for ssh authentication.
+ *
+ * Overall, the most reliable approach is to run 'balena-engine ps' over ssh.
+ * It is OK to depend on balenaEngine because ssh to a container is implemented
+ * through 'balena-engine exec' anyway, and of course it is OK to depend on ssh
+ * itself.
+ */
+export async function getContainerIdForService(
+	opts: SshRemoteCommandOpts & { service: string; deviceUuid?: string },
+): Promise<string> {
+	opts.cmd = `"${deviceContainerEngineBinary}" ps --format "{{.ID}} {{.Names}}"`;
+	if (opts.deviceUuid) {
+		// If a device UUID is given, perform ssh via cloud proxy 'host' command
+		opts.cmd = `host ${opts.deviceUuid} ${opts.cmd}`;
+	}
+
+	const psLines: string[] = (
+		await getRemoteCommandOutput({ ...opts, stderr: 'inherit' })
+	).stdout
+		.toString()
+		.split('\n')
+		.filter((l) => l);
+
+	const { escapeRegExp } = await import('lodash');
+	const regex = new RegExp(`(?:^|\\/)${escapeRegExp(opts.service)}_\\d+_\\d+`);
+	// Old balenaOS container name pattern:
+	//    main_1234567_2345678
+	// New balenaOS container name patterns:
+	//    main_1234567_2345678_a000b111c222d333e444f555a666b777
+	//    main_1_1_localrelease
+	const nameRegex = /(?:^|\/)([a-zA-Z0-9_-]+)_\d+_\d+(?:_.+)?$/;
+
+	const serviceNames: string[] = [];
+	const containerNames: string[] = [];
+	let containerId: string | undefined;
+
+	// sample psLine: 'b603c74e951e bar_4587562_2078151_3261c9d4c22f2c53a5267be459c89990'
+	for (const psLine of psLines) {
+		const [cId, name] = psLine.split(' ');
+		if (cId && name) {
+			if (regex.test(name)) {
+				containerNames.push(name);
+				containerId = cId;
+			}
+			const match = name.match(nameRegex);
+			if (match) {
+				serviceNames.push(match[1]);
+			}
+		}
+	}
+
+	if (containerNames.length > 1) {
+		const [s, d] = [opts.service, opts.deviceUuid || opts.hostname];
+		throw new ExpectedError(stripIndent`
+			Found more than one container matching service name "${s}" on device "${d}":
+			${containerNames.join(', ')}
+			Use different service names to avoid ambiguity.
+		`);
+	}
+	if (!containerId) {
+		const [s, d] = [opts.service, opts.deviceUuid || opts.hostname];
+		throw new ExpectedError(
+			`Could not find a container matching service name "${s}" on device "${d}".${
+				serviceNames.length > 0
+					? `\nAvailable services:\n\t${serviceNames.join('\n\t')}`
+					: ''
+			}`,
+		);
+	}
+	return containerId;
+}
 
 export async function performLocalDeviceSSH(
 	opts: DeviceSSHOpts,
 ): Promise<void> {
-	const { escapeRegExp, reduce } = await import('lodash');
-	const { spawnSshAndThrowOnError } = await import('../ssh');
-	const { ExpectedError } = await import('../../errors');
+	// Before we started using `findBestUsernameForDevice`, we tried the approach
+	// of attempting ssh with the 'root' username first and, if that failed, then
+	// attempting ssh with a regular user (balenaCloud username). The problem with
+	// that approach was that it would print the following message to the console:
+	//     "root@192.168.1.36: Permission denied (publickey)"
+	// ... right before having success as a regular user, which looked broken or
+	// confusing from users' point of view.  Capturing stderr to prevent that
+	// message from being printed is tricky because the messages printed to stderr
+	// may include the stderr output of remote commands that are of interest to
+	// the user.
+	const username = await findBestUsernameForDevice(opts.hostname, opts.port);
+	let cmd = '';
 
-	let command = '';
-
-	if (opts.service != null) {
-		// Get the containers which are on-device. Currently we
-		// are single application, which means we can assume any
-		// container which fulfills the form of
-		// $serviceName_$appId_$releaseId is what we want. Once
-		// we have multi-app, we should show a dialog which
-		// allows the user to choose the correct container
-
-		const Docker = await import('dockerode');
-		const docker = new Docker({
-			host: opts.address,
-			port: 2375,
+	if (opts.service) {
+		const containerId = await getContainerIdForService({
+			...opts,
+			service: opts.service,
+			username,
 		});
 
-		const regex = new RegExp(`(^|\\/)${escapeRegExp(opts.service)}_\\d+_\\d+`);
-		const nameRegex = /\/?([a-zA-Z0-9_-]+)_\d+_\d+/;
-		let allContainers: ContainerInfo[];
-		try {
-			allContainers = await docker.listContainers();
-		} catch (_e) {
-			throw new ExpectedError(stripIndent`
-				Could not access docker daemon on device ${opts.address}.
-				Please ensure the device is in local mode.`);
-		}
-
-		const serviceNames: string[] = [];
-		const containers: Array<{ id: string; name: string }> = [];
-		for (const container of allContainers) {
-			for (const name of container.Names) {
-				if (regex.test(name)) {
-					containers.push({ id: container.Id, name });
-					break;
-				}
-				const match = name.match(nameRegex);
-				if (match) {
-					serviceNames.push(match[1]);
-				}
-			}
-		}
-		if (containers.length === 0) {
-			throw new ExpectedError(
-				`Could not find a service on device with name ${opts.service}. ${
-					serviceNames.length > 0
-						? `Available services:\n${reduce(
-								serviceNames,
-								(str, name) => `${str}\t${name}\n`,
-								'',
-						  )}`
-						: ''
-				}`,
-			);
-		}
-		if (containers.length > 1) {
-			throw new ExpectedError(stripIndent`
-				Found more than one container matching service name "${opts.service}":
-				${containers.map((container) => container.name).join(', ')}
-				Use different service names to avoid ambiguity.
-			`);
-		}
-
-		const containerId = containers[0].id;
 		const shellCmd = `/bin/sh -c "if [ -e /bin/bash ]; then exec /bin/bash; else exec /bin/sh; fi"`;
 		// stdin (fd=0) is not a tty when data is piped in, for example
 		// echo 'ls -la; exit;' | balena ssh 192.168.0.20 service1
@@ -103,17 +154,8 @@ export async function performLocalDeviceSSH(
 		//     https://assets.balena.io/newsletter/2020-01/pipe.png
 		const isTTY = !!opts.forceTTY || (await import('tty')).isatty(0);
 		const ttyFlag = isTTY ? '-t' : '';
-		command = `${deviceContainerEngineBinary} exec -i ${ttyFlag} ${containerId} ${shellCmd}`;
+		cmd = `${deviceContainerEngineBinary} exec -i ${ttyFlag} ${containerId} ${shellCmd}`;
 	}
 
-	return spawnSshAndThrowOnError([
-		...(opts.verbose ? ['-vvv'] : []),
-		'-t',
-		...['-p', opts.port ? opts.port.toString() : '22222'],
-		...['-o', 'LogLevel=ERROR'],
-		...['-o', 'StrictHostKeyChecking=no'],
-		...['-o', 'UserKnownHostsFile=/dev/null'],
-		`root@${opts.address}`,
-		...(command ? [command] : []),
-	]);
+	await runRemoteCommand({ ...opts, cmd, username });
 }

lib/utils/discover.ts

@@ -0,0 +1,40 @@
+import { enumerateServices, findServices } from 'resin-discoverable-services';
+
+interface LocalBalenaOsDevice {
+	address: string;
+	host: string;
+	osVariant?: string;
+	port: number;
+}
+
+// Although we only check for 'balena-ssh', we know, implicitly, that balenaOS
+// devices come with 'rsync' installed that can be used over SSH.
+const avahiBalenaSshTag = 'resin-ssh';
+
+export async function discoverLocalBalenaOsDevices(
+	timeout = 4000,
+): Promise<LocalBalenaOsDevice[]> {
+	const availableServices = await enumerateServices();
+	const serviceDefinitions = Array.from(availableServices)
+		.filter((s) => Array.from(s.tags).includes(avahiBalenaSshTag))
+		.map((s) => s.service);
+
+	if (serviceDefinitions.length === 0) {
+		throw new Error(
+			`Could not find any available '${avahiBalenaSshTag}' services`,
+		);
+	}
+
+	const services = await findServices(serviceDefinitions, timeout);
+	return services.map(function (service) {
+		// User referer address to get device IP. This will work fine assuming that
+		// a device only advertises own services.
+		const {
+			referer: { address },
+			host,
+			port,
+		} = service;
+
+		return { address, host, port };
+	});
+}

lib/utils/docker.ts

@@ -105,7 +105,7 @@ export interface BuildOpts {
 	cachefrom?: string[];
 	nocache?: boolean;
 	pull?: boolean;
-	registryconfig?: import('resin-multibuild').RegistrySecrets;
+	registryconfig?: import('@balena/compose/dist/multibuild').RegistrySecrets;
 	squash?: boolean;
 	t?: string; // only the tag portion of the image name, e.g. 'abc' in 'myimg:abc'
 }
@@ -132,7 +132,7 @@ export function generateBuildOpts(options: {
 	'cache-from'?: string;
 	nocache: boolean;
 	pull?: boolean;
-	'registry-secrets'?: import('resin-multibuild').RegistrySecrets;
+	'registry-secrets'?: import('@balena/compose/dist/multibuild').RegistrySecrets;
 	squash: boolean;
 	tag?: string;
 }): BuildOpts {
@@ -174,14 +174,8 @@ export async function isBalenaEngine(docker: dockerode): Promise<boolean> {
 	);
 }
 
-export interface ExtendedDockerOptions extends dockerode.DockerOptions {
-	docker?: string; // socket path, e.g. /var/run/docker.sock
-	dockerHost?: string; // host name or IP address
-	dockerPort?: number; // TCP port number, e.g. 2375
-}
-
 export async function getDocker(
-	options: ExtendedDockerOptions,
+	options: DockerConnectionCliFlags,
 ): Promise<dockerode> {
 	const connectOpts = await generateConnectOpts(options);
 	const client = await createClient(connectOpts);
@@ -196,14 +190,18 @@ export async function createClient(
 	return new Docker(opts);
 }
 
-async function generateConnectOpts(opts: ExtendedDockerOptions) {
-	let connectOpts: dockerode.DockerOptions = {};
-
-	// Start with docker-modem defaults which take several env vars into account,
-	// including DOCKER_HOST, DOCKER_TLS_VERIFY, DOCKER_CERT_PATH, SSH_AUTH_SOCK
-	// https://github.com/apocas/docker-modem/blob/v3.0.0/lib/modem.js#L15-L70
-	const Modem = require('docker-modem');
-	const defaultOpts = new Modem();
+/**
+ * Initialize Docker connection options with the default values from the
+ * 'docker-modem' package, which takes several env vars into account,
+ * including DOCKER_HOST, DOCKER_TLS_VERIFY, DOCKER_CERT_PATH, SSH_AUTH_SOCK
+ * https://github.com/apocas/docker-modem/blob/v3.0.0/lib/modem.js#L15-L70
+ *
+ * @param opts Command line options like --dockerHost and --dockerPort
+ */
+export function getDefaultDockerModemOpts(
+	opts: DockerConnectionCliFlags,
+): dockerode.DockerOptions {
+	const connectOpts: dockerode.DockerOptions = {};
 	const optsOfInterest: Array<keyof dockerode.DockerOptions> = [
 		'ca',
 		'cert',
@@ -215,9 +213,33 @@ async function generateConnectOpts(opts: ExtendedDockerOptions) {
 		'username',
 		'timeout',
 	];
-	for (const opt of optsOfInterest) {
-		connectOpts[opt] = defaultOpts[opt];
+	const Modem = require('docker-modem');
+	const originalDockerHost = process.env.DOCKER_HOST;
+	try {
+		if (opts.dockerHost) {
+			process.env.DOCKER_HOST ||= opts.dockerPort
+				? `${opts.dockerHost}:${opts.dockerPort}`
+				: opts.dockerHost;
+		}
+		const defaultOpts = new Modem();
+		for (const opt of optsOfInterest) {
+			connectOpts[opt] = defaultOpts[opt];
+		}
+	} finally {
+		// Did you know? Any value assigned to `process.env.XXX` becomes a string.
+		// For example, `process.env.DOCKER_HOST = undefined` results in
+		// value 'undefined' (a 9-character string) being assigned.
+		if (originalDockerHost) {
+			process.env.DOCKER_HOST = originalDockerHost;
+		} else {
+			delete process.env.DOCKER_HOST;
+		}
 	}
+	return connectOpts;
+}
+
+export async function generateConnectOpts(opts: DockerConnectionCliFlags) {
+	let connectOpts = getDefaultDockerModemOpts(opts);
 
 	// Now override the default options with any explicit command line options
 	if (opts.docker != null && opts.dockerHost == null) {
@@ -241,9 +263,9 @@ async function generateConnectOpts(opts: ExtendedDockerOptions) {
 	// These should be file paths (strings)
 	const tlsOpts = [opts.ca, opts.cert, opts.key];
 
-	// If any are set...
+	// If any tlsOpts are set...
 	if (tlsOpts.some((opt) => opt)) {
-		// but not all ()
+		// but not all
 		if (!tlsOpts.every((opt) => opt)) {
 			throw new ExpectedError(
 				'You must provide a CA, certificate and key in order to use TLS',
@@ -258,7 +280,11 @@ async function generateConnectOpts(opts: ExtendedDockerOptions) {
 		const [ca, cert, key] = await Promise.all(
 			tlsOpts.map((opt: string) => fs.readFile(opt, 'utf8')),
 		);
-		connectOpts = { ...connectOpts, ca, cert, key };
+		// Also ensure that the protocol is 'https' like 'docker-modem' does:
+		// https://github.com/apocas/docker-modem/blob/v3.0.0/lib/modem.js#L101-L103
+		// TODO: delete redundant logic from this function now that similar logic
+		// exists in the 'docker-modem' package.
+		connectOpts = { ...connectOpts, ca, cert, key, protocol: 'https' };
 	}
 
 	return connectOpts;

lib/utils/helpers.ts

@@ -107,21 +107,53 @@ export async function getManifest(
 	deviceType: string,
 ): Promise<BalenaSdk.DeviceTypeJson.DeviceType> {
 	const init = await import('balena-device-init');
+	const sdk = getBalenaSdk();
 	const manifest = await init.getImageManifest(image);
-	if (manifest != null) {
-		return manifest;
+	if (
+		manifest != null &&
+		manifest.slug !== deviceType &&
+		manifest.slug !== (await sdk.models.deviceType.get(deviceType)).slug
+	) {
+		const { ExpectedError } = await import('../errors');
+		throw new ExpectedError(
+			`The device type of the provided OS image ${manifest.slug}, does not match the expected device type ${deviceType}`,
+		);
 	}
-	return getBalenaSdk().models.device.getManifestBySlug(deviceType);
+	return (
+		manifest ??
+		(await sdk.models.config.getDeviceTypeManifestBySlug(deviceType))
+	);
 }
 
-export const areDeviceTypesCompatible = (
-	appDeviceType: BalenaSdk.DeviceTypeJson.DeviceType,
-	osDeviceType: BalenaSdk.DeviceTypeJson.DeviceType,
-) =>
-	getBalenaSdk().models.os.isArchitectureCompatibleWith(
-		osDeviceType.arch,
-		appDeviceType.arch,
-	) && !!appDeviceType.isDependent === !!osDeviceType.isDependent;
+export const areDeviceTypesCompatible = async (
+	appDeviceTypeSlug: string,
+	osDeviceTypeSlug: string,
+) => {
+	if (appDeviceTypeSlug === osDeviceTypeSlug) {
+		return true;
+	}
+	const sdk = getBalenaSdk();
+	const pineOptions = {
+		$select: 'is_of__cpu_architecture',
+		$expand: {
+			is_of__cpu_architecture: {
+				$select: 'slug',
+			},
+		},
+	} satisfies BalenaSdk.PineOptions<BalenaSdk.DeviceType>;
+	const [appDeviceType, osDeviceType] = await Promise.all(
+		[appDeviceTypeSlug, osDeviceTypeSlug].map(
+			(dtSlug) =>
+				sdk.models.deviceType.get(dtSlug, pineOptions) as Promise<
+					BalenaSdk.PineTypedResult<BalenaSdk.DeviceType, typeof pineOptions>
+				>,
+		),
+	);
+	return sdk.models.os.isArchitectureCompatibleWith(
+		osDeviceType.is_of__cpu_architecture[0].slug,
+		appDeviceType.is_of__cpu_architecture[0].slug,
+	);
+};
 
 export async function osProgressHandler(step: InitializeEmitter) {
 	step.on('stdout', process.stdout.write.bind(process.stdout));
@@ -148,14 +180,13 @@ export async function osProgressHandler(step: InitializeEmitter) {
 	});
 }
 
-export async function getAppWithArch(
-	applicationName: string,
-): Promise<ApplicationWithDeviceType & { arch: string }> {
+export async function getAppWithArch(applicationName: string) {
 	const { getApplication } = await import('./sdk');
-	const options: BalenaSdk.PineOptions<BalenaSdk.Application> = {
+	const balena = getBalenaSdk();
+	const app = await getApplication(balena, applicationName, {
 		$expand: {
 			application_type: {
-				$select: ['name', 'slug', 'supports_multicontainer', 'is_legacy'],
+				$select: ['name', 'slug', 'supports_multicontainer'],
 			},
 			is_for__device_type: {
 				$select: 'slug',
@@ -166,20 +197,10 @@ export async function getAppWithArch(
 				},
 			},
 		},
-	};
-	const balena = getBalenaSdk();
-	const app = (await getApplication(
-		balena,
-		applicationName,
-		options,
-	)) as ApplicationWithDeviceType;
-	const { getExpanded } = await import('./pine');
-
+	});
 	return {
 		...app,
-		arch: getExpanded(
-			getExpanded(app.is_for__device_type)!.is_of__cpu_architecture,
-		)!.slug,
+		arch: app.is_for__device_type[0].is_of__cpu_architecture[0].slug,
 	};
 }
 
@@ -410,25 +431,11 @@ export function getProxyConfig(): ProxyConfig | undefined {
 
 export const expandForAppName = {
 	$expand: {
-		belongs_to__application: { $select: ['app_name', 'slug'] as any },
+		belongs_to__application: { $select: ['app_name', 'slug'] },
 		is_of__device_type: { $select: 'slug' },
 		is_running__release: { $select: 'commit' },
 	},
-} as const;
-
-export const expandForAppNameAndCpuArch = {
-	$expand: {
-		...expandForAppName.$expand,
-		is_of__device_type: {
-			$select: 'slug',
-			$expand: {
-				is_of__cpu_architecture: {
-					$select: 'slug',
-				},
-			},
-		},
-	},
-} as const;
+} satisfies BalenaSdk.PineOptions<BalenaSdk.Device>;
 
 /**
  * Use the `readline` library on Windows to install SIGINT handlers.

lib/utils/lazy.ts

@@ -20,8 +20,7 @@ import type * as BalenaSdk from 'balena-sdk';
 import type { Chalk } from 'chalk';
 import type * as visuals from 'resin-cli-visuals';
 import type * as CliForm from 'resin-cli-form';
-import type { ux } from 'cli-ux';
-import type { stripIndent as StripIndent } from 'common-tags';
+import type { ux } from '@oclif/core';
 
 // Equivalent of _.once but avoiding the need to import lodash for lazy deps
 const once = <T>(fn: () => T) => {
@@ -58,9 +57,11 @@ export const getCliForm = once(
 	() => require('resin-cli-form') as typeof CliForm,
 );
 
-export const getCliUx = once(() => require('cli-ux').ux as typeof ux);
+export const getCliUx = once(
+	() => require('@oclif/core/lib/cli-ux') as typeof ux,
+);
 
 // Directly export stripIndent as we always use it immediately, but importing just `stripIndent` reduces startup time
 export const stripIndent =
 	// tslint:disable-next-line:no-var-requires
-	require('common-tags/lib/stripIndent') as typeof StripIndent;
+	require('common-tags/lib/stripIndent') as typeof import('common-tags/lib/stripIndent');

lib/utils/messages.ts

@@ -137,7 +137,7 @@ adding exception patterns to the applicable .dockerignore file(s), for example
 - https://www.npmjs.com/package/@balena/dockerignore`;
 
 export const applicationIdInfo = `\
-Fleets may be specified by fleet name, slug, or numeric ID. Fleet slugs are
+Fleets may be specified by fleet name or slug. Fleet slugs are
 the recommended option, as they are unique and unambiguous. Slugs can be
 listed with the \`balena fleets\` command. Note that slugs may change if the
 fleet is renamed. Fleet names are not unique and may result in  "Fleet is
@@ -145,9 +145,7 @@ ambiguous" errors at any time (even if it "used to work in the past"), for
 example if the name clashes with a newly created public fleet, or with fleets
 from other balena accounts that you may be invited to join under any role.
 For this reason, fleet names are especially discouraged in scripts (e.g. CI
-environments). Numeric fleet IDs are deprecated because they consist of an
-implementation detail of the balena backend. We intend to remove support for
-numeric IDs at some point in the future.`;
+environments).`;
 
 export const applicationNameNote = `\
 Fleets may be specified by fleet name or slug. Slugs are recommended because
@@ -171,6 +169,10 @@ confuse the balenaOS "development mode" with a device's "local mode", the latter
 being a supervisor feature that allows the "balena push" command to push a user's
 application directly to a device in the local network.`;
 
+export const secureBootInfo = `\
+The '--secureBoot' option is used to configure a balenaOS installer image to opt-in
+secure boot and disk encryption.`;
+
 export const jsonInfo = `\
 The --json option is recommended when scripting the output of this command,
 because field names are less likely to change in JSON format and because it

lib/utils/patterns.ts

@@ -14,7 +14,14 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-import type { Application, BalenaSDK, Device, Organization } from 'balena-sdk';
+import type {
+	Application,
+	BalenaSDK,
+	Device,
+	Organization,
+	PineOptions,
+	PineTypedResult,
+} from 'balena-sdk';
 import _ = require('lodash');
 
 import { instanceOf, NotLoggedInError, ExpectedError } from '../errors';
@@ -157,46 +164,55 @@ export async function confirm(
 	}
 }
 
-export function selectApplication(
-	filter?: (app: ApplicationWithDeviceType) => boolean,
+const selectApplicationPineOptions = {
+	$select: ['id', 'slug', 'app_name'],
+	$expand: {
+		is_for__device_type: {
+			$select: 'slug',
+		},
+	},
+} satisfies PineOptions<Application>;
+
+type SelectApplicationResult = PineTypedResult<
+	Application,
+	typeof selectApplicationPineOptions
+>;
+
+export async function selectApplication(
+	filter?: (app: SelectApplicationResult) => boolean,
 	errorOnEmptySelection = false,
 ) {
 	const balena = getBalenaSdk();
-	return balena.models.application
-		.hasAny()
-		.then(async (hasAnyApplications) => {
-			if (!hasAnyApplications) {
-				throw new ExpectedError('No fleets found');
-			}
+	const apps = (await balena.models.application.getAllDirectlyAccessible(
+		selectApplicationPineOptions,
+	)) as SelectApplicationResult[];
 
-			const apps = (await balena.models.application.getAllDirectlyAccessible({
-				$expand: {
-					is_for__device_type: {
-						$select: 'slug',
-					},
-				},
-			})) as ApplicationWithDeviceType[];
-			return apps.filter(filter || _.constant(true));
-		})
-		.then((applications) => {
-			if (errorOnEmptySelection && applications.length === 0) {
-				throw new ExpectedError('No suitable fleets found for selection');
-			}
-			return getCliForm().ask({
-				message: 'Select an application',
-				type: 'list',
-				choices: _.map(applications, (application) => ({
-					name: `${application.app_name} (${application.slug}) [${application.is_for__device_type[0].slug}]`,
-					value: application,
-				})),
-			});
-		});
+	if (!apps.length) {
+		throw new ExpectedError('No fleets found');
+	}
+
+	const applications = filter ? apps.filter(filter) : apps;
+
+	if (errorOnEmptySelection && applications.length === 0) {
+		throw new ExpectedError('No suitable fleets found for selection');
+	}
+	return getCliForm().ask({
+		message: 'Select an application',
+		type: 'list',
+		choices: _.map(applications, (application) => ({
+			name: `${application.app_name} (${application.slug}) [${application.is_for__device_type[0].slug}]`,
+			value: application,
+		})),
+	});
 }
 
-export async function selectOrganization(organizations?: Organization[]) {
+export async function selectOrganization(
+	organizations?: Array<Pick<Organization, 'handle' | 'name'>>,
+) {
 	// Use either provided orgs (if e.g. already loaded) or load from cloud
-	organizations =
-		organizations || (await getBalenaSdk().models.organization.getAll());
+	organizations ??= await getBalenaSdk().models.organization.getAll({
+		$select: ['name', 'handle'],
+	});
 	return getCliForm().ask({
 		message: 'Select an organization',
 		type: 'list',
@@ -207,35 +223,6 @@ export async function selectOrganization(organizations?: Organization[]) {
 	});
 }
 
-export async function awaitDevice(uuid: string) {
-	const balena = getBalenaSdk();
-	const deviceName = await balena.models.device.getName(uuid);
-	const visuals = getVisuals();
-	const spinner = new visuals.Spinner(
-		`Waiting for ${deviceName} to come online`,
-	);
-
-	const poll = async (): Promise<void> => {
-		const isOnline = await balena.models.device.isOnline(uuid);
-		if (isOnline) {
-			spinner.stop();
-			console.info(`The device **${deviceName}** is online!`);
-			return;
-		} else {
-			// Spinner implementation is smart enough to
-			// not start again if it was already started
-			spinner.start();
-
-			await delay(3000);
-			await poll();
-		}
-	};
-
-	console.info(`Waiting for ${deviceName} to connect to balena...`);
-	await poll();
-	return uuid;
-}
-
 export async function awaitDeviceOsUpdate(
 	uuid: string,
 	targetOsVersion: string,
@@ -281,113 +268,85 @@ export async function awaitDeviceOsUpdate(
 	return uuid;
 }
 
-export function inferOrSelectDevice(preferredUuid: string) {
-	const balena = getBalenaSdk();
-	return balena.models.device.getAll().then((devices) => {
-		const onlineDevices = devices.filter((device) => device.is_online);
-		if (_.isEmpty(onlineDevices)) {
-			throw new ExpectedError("You don't have any devices online");
-		}
-
-		const defaultUuid = _(onlineDevices).map('uuid').includes(preferredUuid)
-			? preferredUuid
-			: onlineDevices[0].uuid;
-
-		return getCliForm().ask({
-			message: 'Select a device',
-			type: 'list',
-			default: defaultUuid,
-			choices: _.map(onlineDevices, (device) => ({
-				name: `${device.device_name || 'Untitled'} (${device.uuid.slice(
-					0,
-					7,
-				)})`,
-				value: device.uuid,
-			})),
-		});
-	});
-}
-
 /*
- * Given applicationOrDevice, which may be
- *  - an application name
- *  - an application slug
- *  - an application id (integer)
+ * Given fleetOrDevice, which may be
+ *  - a fleet name
+ *  - a fleet slug
  *  - a device uuid
  * Either:
  *  - in case of device uuid, return uuid of device after verifying that it exists and is online.
- *  - in case of application, return uuid of device user selects from list of online devices.
- *
- * 	TODO: Modify this when app IDs dropped.
+ *  - in case of fleet, return uuid of device user selects from list of online devices.
  */
 export async function getOnlineTargetDeviceUuid(
 	sdk: BalenaSDK,
-	applicationOrDevice: string,
+	fleetOrDevice: string,
 ) {
 	const logger = (await import('../utils/logger')).getLogger();
 
 	// If looks like UUID, probably device
-	if (validation.validateUuid(applicationOrDevice)) {
+	if (validation.validateUuid(fleetOrDevice)) {
 		let device: Device;
 		try {
 			logger.logDebug(
-				`Trying to fetch device by UUID ${applicationOrDevice} (${typeof applicationOrDevice})`,
+				`Trying to fetch device by UUID ${fleetOrDevice} (${typeof fleetOrDevice})`,
 			);
-			device = await sdk.models.device.get(applicationOrDevice, {
+			device = await sdk.models.device.get(fleetOrDevice, {
 				$select: ['uuid', 'is_online'],
 			});
 
 			if (!device.is_online) {
-				throw new ExpectedError(
-					`Device with UUID ${applicationOrDevice} is offline`,
-				);
+				throw new ExpectedError(`Device with UUID ${fleetOrDevice} is offline`);
 			}
 
 			return device.uuid;
 		} catch (err) {
 			const { BalenaDeviceNotFound } = await import('balena-errors');
 			if (instanceOf(err, BalenaDeviceNotFound)) {
-				logger.logDebug(`Device with UUID ${applicationOrDevice} not found`);
-				// Now try app
+				logger.logDebug(`Device with UUID ${fleetOrDevice} not found`);
+				// Now try application
 			} else {
 				throw err;
 			}
 		}
 	}
 
-	// Not a device UUID, try app
-	let app: Application;
-	try {
-		logger.logDebug(`Fetching fleet ${applicationOrDevice}`);
-		const { getApplication } = await import('./sdk');
-		app = await getApplication(sdk, applicationOrDevice);
-	} catch (err) {
-		const { BalenaApplicationNotFound } = await import('balena-errors');
-		if (instanceOf(err, BalenaApplicationNotFound)) {
-			throw new ExpectedError(
-				`Fleet or Device not found: ${applicationOrDevice}`,
-			);
-		} else {
-			throw err;
+	// Not a device UUID, try application
+	const application = await (async () => {
+		try {
+			logger.logDebug(`Fetching fleet ${fleetOrDevice}`);
+			const { getApplication } = await import('./sdk');
+			return await getApplication(sdk, fleetOrDevice, {
+				$select: ['id', 'slug'],
+				$expand: {
+					owns__device: {
+						$select: ['device_name', 'uuid'],
+						$filter: { is_online: true },
+					},
+				},
+			});
+		} catch (err) {
+			const { BalenaApplicationNotFound } = await import('balena-errors');
+			if (instanceOf(err, BalenaApplicationNotFound)) {
+				throw new ExpectedError(`Fleet or Device not found: ${fleetOrDevice}`);
+			} else {
+				throw err;
+			}
 		}
-	}
+	})();
 
 	// App found, load its devices
-	const devices = await sdk.models.device.getAllByApplication(app.id, {
-		$select: ['device_name', 'uuid'],
-		$filter: { is_online: true },
-	});
+	const devices = application.owns__device;
 
 	// Throw if no devices online
 	if (_.isEmpty(devices)) {
 		throw new ExpectedError(
-			`Fleet ${app.slug} found, but has no devices online.`,
+			`Fleet ${application.slug} found, but has no devices online.`,
 		);
 	}
 
-	// Ask user to select from online devices for application
+	// Ask user to select from online devices for fleet
 	return getCliForm().ask({
-		message: `Select a device on fleet ${app.slug}`,
+		message: `Select a device on fleet ${application.slug}`,
 		type: 'list',
 		default: devices[0].uuid,
 		choices: _.map(devices, (device) => ({

lib/utils/pine.ts

@@ -16,10 +16,10 @@ limitations under the License.
 
 import type { OptionalNavigationResource } from 'balena-sdk';
 
-export const getExpanded = <T>(obj: OptionalNavigationResource<T>) =>
+export const getExpanded = <T extends {}>(obj: OptionalNavigationResource<T>) =>
 	(Array.isArray(obj) && obj[0]) || undefined;
 
-export const getExpandedProp = <T, K extends keyof T>(
+export const getExpandedProp = <T extends {}, K extends keyof T>(
 	obj: OptionalNavigationResource<T>,
 	key: K,
 ) => (Array.isArray(obj) && obj[0] && obj[0][key]) || undefined;

lib/utils/promote.ts

@@ -20,7 +20,7 @@ import { ExpectedError, printErrorMessage } from '../errors';
 import { getVisuals, stripIndent, getCliForm } from './lazy';
 import Logger = require('./logger');
 import { confirm } from './patterns';
-import { exec, execBuffered, getDeviceOsRelease } from './ssh';
+import { getLocalDeviceCmdStdout, getDeviceOsRelease } from './ssh';
 
 const MIN_BALENAOS_VERSION = 'v2.14.0';
 
@@ -80,7 +80,12 @@ export async function leave(
 	logger.logDebug('Deconfiguring...');
 	await deconfigure(deviceHostnameOrIp);
 
-	logger.logSuccess('Device successfully left the platform.');
+	logger.logSuccess(stripIndent`
+		Device successfully left the platform. The device will still be listed as part
+		of the fleet, but changes to the fleet will no longer affect the device and its
+		status will eventually be reported as 'Offline'. To irrecoverably delete the
+		device from the fleet, use the 'balena device rm' command or delete it through
+		the balenaCloud web dashboard.`);
 }
 
 async function execCommand(
@@ -88,20 +93,25 @@ async function execCommand(
 	cmd: string,
 	msg: string,
 ): Promise<void> {
-	const through = await import('through2');
+	const { Writable } = await import('stream');
 	const visuals = getVisuals();
 
 	const spinner = new visuals.Spinner(`[${deviceIp}] Connecting...`);
 	const innerSpinner = spinner.spinner;
 
-	const stream = through(function (data, _enc, cb) {
-		innerSpinner.setSpinnerTitle(`%s [${deviceIp}] ${msg}`);
-		cb(null, data);
+	const stream = new Writable({
+		write(_chunk: Buffer, _enc, callback) {
+			innerSpinner.setSpinnerTitle(`%s [${deviceIp}] ${msg}`);
+			callback();
+		},
 	});
 
 	spinner.start();
-	await exec(deviceIp, cmd, stream);
-	spinner.stop();
+	try {
+		await getLocalDeviceCmdStdout(deviceIp, cmd, stream);
+	} finally {
+		spinner.stop();
+	}
 }
 
 async function configure(deviceIp: string, config: any): Promise<void> {
@@ -121,7 +131,7 @@ async function deconfigure(deviceIp: string): Promise<void> {
 async function assertDeviceIsCompatible(deviceIp: string): Promise<void> {
 	const cmd = 'os-config --version';
 	try {
-		await execBuffered(deviceIp, cmd);
+		await getLocalDeviceCmdStdout(deviceIp, cmd);
 	} catch (err) {
 		if (err instanceof ExpectedError) {
 			throw err;
@@ -153,12 +163,61 @@ async function getOsVersion(deviceIp: string): Promise<string> {
 	return match[1];
 }
 
+const dockerPort = 2375;
+const dockerTimeout = 2000;
+
+async function selectLocalBalenaOsDevice(timeout = 4000): Promise<string> {
+	const { discoverLocalBalenaOsDevices } = await import('../utils/discover');
+	const { SpinnerPromise } = getVisuals();
+	const devices = await new SpinnerPromise({
+		promise: discoverLocalBalenaOsDevices(timeout),
+		startMessage: 'Discovering local balenaOS devices..',
+		stopMessage: 'Reporting discovered devices',
+	});
+
+	const responsiveDevices: typeof devices = [];
+	const Docker = await import('dockerode');
+	await Promise.all(
+		devices.map(async function (device) {
+			const address = device?.address;
+			if (!address) {
+				return;
+			}
+
+			try {
+				const docker = new Docker({
+					host: address,
+					port: dockerPort,
+					timeout: dockerTimeout,
+				});
+				await docker.ping();
+				responsiveDevices.push(device);
+			} catch {
+				return;
+			}
+		}),
+	);
+
+	if (!responsiveDevices.length) {
+		throw new Error('Could not find any local balenaOS devices');
+	}
+
+	return getCliForm().ask({
+		message: 'select a device',
+		type: 'list',
+		default: devices[0].address,
+		choices: responsiveDevices.map((device) => ({
+			name: `${device.host || 'untitled'} (${device.address})`,
+			value: device.address,
+		})),
+	});
+}
+
 async function selectLocalDevice(): Promise<string> {
-	const { forms } = await import('balena-sync');
-	let hostnameOrIp;
 	try {
-		hostnameOrIp = await forms.selectLocalBalenaOsDevice();
+		const hostnameOrIp = await selectLocalBalenaOsDevice();
 		console.error(`==> Selected device: ${hostnameOrIp}`);
+		return hostnameOrIp;
 	} catch (e) {
 		if (e.message.toLowerCase().includes('could not find any')) {
 			throw new ExpectedError(e);
@@ -166,8 +225,6 @@ async function selectLocalDevice(): Promise<string> {
 			throw e;
 		}
 	}
-
-	return hostnameOrIp;
 }
 
 async function selectAppFromList(
@@ -188,31 +245,37 @@ async function selectAppFromList(
 
 async function getOrSelectApplication(
 	sdk: BalenaSdk.BalenaSDK,
-	deviceType: string,
+	deviceTypeSlug: string,
 	appName?: string,
 ): Promise<ApplicationWithDeviceType> {
-	const _ = await import('lodash');
+	const pineOptions = {
+		$select: 'slug',
+		$expand: {
+			is_of__cpu_architecture: {
+				$select: 'slug',
+			},
+		},
+	} satisfies BalenaSdk.PineOptions<BalenaSdk.DeviceType>;
+	const [deviceType, allDeviceTypes] = await Promise.all([
+		sdk.models.deviceType.get(deviceTypeSlug, pineOptions) as Promise<
+			BalenaSdk.PineTypedResult<BalenaSdk.DeviceType, typeof pineOptions>
+		>,
+		sdk.models.deviceType.getAllSupported(pineOptions) as Promise<
+			Array<BalenaSdk.PineTypedResult<BalenaSdk.DeviceType, typeof pineOptions>>
+		>,
+	]);
 
-	const allDeviceTypes = await sdk.models.config.getDeviceTypes();
-	const deviceTypeManifest = _.find(allDeviceTypes, { slug: deviceType });
-	if (!deviceTypeManifest) {
-		throw new ExpectedError(`"${deviceType}" is not a valid device type`);
-	}
-	const compatibleDeviceTypes = _(allDeviceTypes)
-		.filter(
-			(dt) =>
-				sdk.models.os.isArchitectureCompatibleWith(
-					deviceTypeManifest.arch,
-					dt.arch,
-				) &&
-				!!dt.isDependent === !!deviceTypeManifest.isDependent &&
-				dt.state !== 'DISCONTINUED',
+	const compatibleDeviceTypes = allDeviceTypes
+		.filter((dt) =>
+			sdk.models.os.isArchitectureCompatibleWith(
+				deviceType.is_of__cpu_architecture[0].slug,
+				dt.is_of__cpu_architecture[0].slug,
+			),
 		)
-		.map((type) => type.slug)
-		.value();
+		.map((type) => type.slug);
 
 	if (!appName) {
-		return createOrSelectApp(sdk, compatibleDeviceTypes, deviceType);
+		return createOrSelectApp(sdk, compatibleDeviceTypes, deviceTypeSlug);
 	}
 
 	const options: BalenaSdk.PineOptions<BalenaSdk.Application> = {
@@ -247,13 +310,13 @@ async function getOrSelectApplication(
 			undefined,
 			true,
 		);
-		return await createApplication(sdk, deviceType, name);
+		return await createApplication(sdk, deviceTypeSlug, name);
 	}
 
 	// We've found at least one fleet with the given name.
 	// Filter out fleets for non-matching device types and see what we're left with.
 	const validApplications = applications.filter((app) =>
-		_.includes(compatibleDeviceTypes, app.is_for__device_type[0].slug),
+		compatibleDeviceTypes.includes(app.is_for__device_type[0].slug),
 	);
 
 	if (validApplications.length === 0) {
@@ -324,13 +387,7 @@ async function createApplication(
 				try {
 					await sdk.models.application.getDirectlyAccessible(appName, {
 						$filter: {
-							$or: [
-								{ slug: { $startswith: `${username!.toLowerCase()}/` } },
-								// TODO: do we still need the following filter? Is it for
-								// old openBalena instances where slugs were equal to the
-								// app name and did not contain the slash character?
-								{ $not: { slug: { $contains: '/' } } },
-							],
+							slug: { $startswith: `${username!.toLowerCase()}/` },
 						},
 					});
 					// TODO: This is the only example in the codebase where `printErrorMessage()`
@@ -370,7 +427,7 @@ async function generateApplicationConfig(
 ) {
 	const { generateApplicationConfig: configGen } = await import('./config');
 
-	const manifest = await sdk.models.device.getManifestBySlug(
+	const manifest = await sdk.models.config.getDeviceTypeManifestBySlug(
 		app.is_for__device_type[0].slug,
 	);
 	const opts =

lib/utils/qemu.ts

@@ -21,7 +21,7 @@ import { ExpectedError } from '../errors';
 import { getBalenaSdk, stripIndent } from './lazy';
 import Logger = require('./logger');
 
-export const QEMU_VERSION = 'v6.0.0+balena1';
+export const QEMU_VERSION = 'v7.0.0+balena1';
 export const QEMU_BIN_NAME = 'qemu-execve';
 
 export function qemuPathInContext(context: string) {

lib/utils/remote-build.ts

@@ -17,7 +17,7 @@ import type { BalenaSDK } from 'balena-sdk';
 import * as JSONStream from 'JSONStream';
 import * as readline from 'readline';
 import * as request from 'request';
-import { RegistrySecrets } from 'resin-multibuild';
+import { RegistrySecrets } from '@balena/compose/dist/multibuild';
 import type * as Stream from 'stream';
 import streamToPromise = require('stream-to-promise');
 import type { Pack } from 'tar-stream';
@@ -212,7 +212,7 @@ function handleBuilderMetadata(obj: BuilderMessage, build: RemoteBuild) {
 			}
 
 			const value = match[1];
-			const amount = match[2] || 1;
+			const amount = Number(match[2]) || 1;
 
 			switch (value) {
 				case 'erase':