merge with upstream

Reviewed by: Brian Bennett <brian.bennett@joyent.com>
Approved by: Brian Bennett <brian.bennett@joyent.com>

.gitignore

@@ -3,3 +3,6 @@
 /test/*.json
 /npm-debug.log
 /triton-*.tgz
+.DS_Store
+.git
+*.swp

CHANGES.md

@@ -4,9 +4,216 @@ Known issues:
 
 - `triton ssh ...` disables ssh ControlMaster to avoid issue #52.
 
-
 ## not yet released
 
+(nothing)
+
+## 7.0.0
+
+- [Backward incompatible.] `triton image get NAME|SHORTID` will now *exclude*
+  inactive images by default. Before this change inactive images (e.g. those
+  with a state of "creating" or "unactivated" or "disabled") would be
+  included. Use the new `-a,--all` option to include inactive images. This
+  matches the behavior of `triton image list [-a,--all] ...`.
+
+- [joyent/node-triton#258] `triton instance create IMAGE ...` will now exclude
+  inactive images when looking for an image with the given name.
+
+## 6.3.0
+
+- [joyent/node-triton#259] Added basic support for use of SSH bastion hosts
+  to access zones on private fabrics.  If the `tritoncli.ssh.proxy` tag is set
+  on an instance, `triton ssh` will look up the name or UUID of the proxy
+  instance and use `ssh -o ProxyJump` to tunnel the connection to the target.
+  If the `tritoncli.ssh.ip` tag is set on an instance, `triton ssh` will use
+  that IP address instead of the `primaryIp` when making its connection.
+
+## 6.2.0
+
+- [joyent/node-triton#255, joyent/node-triton#257] Improved the interface
+  and documentation of `triton network create` and `triton vlan create`.  In
+  particular, it is now possible to specify static routes and DNS resolvers.
+
+## 6.1.2
+
+- [joyent/node-triton#249] Error when creating or deleting profiles when
+  using node v10.
+
+## 6.1.1
+
+- [TRITON-598] Fix error handling for `triton network get-default` when
+  no default network is set on the account.
+
+## 6.1.0
+
+- [joyent/node-triton#250] Avoid an error from `triton profile list` if
+  only *some* of the minimal `TRITON_` or `SDC_` envvars are defined.
+- [TRITON-401] Add `triton network` and `triton vlan` commands, for
+  creating/changing/removing network fabrics and VLANs.
+- [TRITON-524] Add `triton inst get --credentials ...` option to match
+  `triton inst list --credentials ...` for including generated credentials
+  in instance metadata.
+- [joyent/node-triton#245] `triton profile` now generates fresh new keys during
+  Docker setup and signs them with an account key, rather than copying (and
+  decrypting) the account key itself. This makes using Docker simpler with keys
+  in an SSH Agent.
+- [TRITON-53] x-account image clone. A user can make a copy of a shared image
+  using the `triton image clone` command.
+- [TRITON-53] A shared image (i.e. when the user is on the image.acl) is no
+  longer provisionable by default - you will need to explicitly add the
+  --allow-shared-images cli option when calling `triton create` command to
+  provision from a shared image (or clone the image then provision from the
+  clone).
+- [TRITON-52] x-DC image copy. A user can copy an image that they own into
+  another datacenter within the same cloud using the `triton image copy` cli
+  command. Example:
+
+  ```
+  triton -p us-east-1 image cp my-custom-image us-sw-1
+  ```
+
+## 6.0.0
+
+This release containes some breaking changes with the --affinity flag to
+`triton instance create`. It also does not work with cloudapi endpoints older
+than 8.0.0 (mid 2016); for an older cloudapi endpoint, use node-triton 5.9.0.
+
+- [TRITON-167, TRITON-168] update support for
+  `triton instance create --affinity=...`. It now fully supports regular
+  expressions, tags and globs, and works across a wider variety of situations.
+  Examples:
+
+  ```
+  # regular expressions
+  triton instance create --affinity='instance!=/^production-db/' ...
+
+  # globs
+  triton instance create --affinity='instance!=production-db*' ...
+
+  # tags
+  triton instance create --affinity='role!=db'
+  ```
+
+  See <https://apidocs.joyent.com/cloudapi/#affinity-rules> for more details
+  how affinities work.
+
+  However:
+  - Use of regular expressions requires a cloudapi version of 8.8.0 or later.
+  - 'inst' as a affinity shorthand no longer works. Use 'instance' instead.
+    E.g.: --affinity='instance==db1' instead of --affinity='inst==db1'
+  - The shorthand --affinity=<INST> no longer works. Use
+    --affinity='instance===<INST>' instead.
+
+## 5.10.0
+
+- [TRITON-19] add support for deletion protection on instances. An instance with
+  the deletion protection flag set true cannot be destroyed until the flag is
+  set false. It is exposed through
+  `triton instance create --deletion-protection ...`,
+  `triton instance enable-deletion-protection ...`, and
+  `triton instance disable-deletion-protection ...`. This flag is only supported
+  on cloudapi versions 8.7.0 or above.
+- [TRITON-59] node-triton should support nic operations
+  `triton instance nic get ...`
+  `triton instance nic create ...`
+  `triton instance nic list ...`
+  `triton instance nic delete ...`
+- [TRITON-42] node-triton should support nics when creating an instance, e.g.
+  `triton instance create --nic <Network Object> IMAGE PACKAGE`
+
+## 5.9.0
+
+- [TRITON-190] remove support for `triton instance create --brand=bhyve ...`.
+  The rest of bhyve support will remain, but selection of bhyve brand will
+  happen via images or packages that are bhyve-specific.
+
+## 5.8.0
+
+- [TRITON-124] add node-triton support for bhyve. This adds a `triton instance
+  create --brand=bhyve ...` option that can be used for zvol images that support
+  it. Note that bhyve support is alpha in TritonDC -- most datacenters won't yet
+  support this option.
+
+## 5.7.0
+
+- [TRITON-116] node-triton image sharing. Adds `triton image share` and
+  `triton image unshare` commands.
+
+## 5.6.1
+
+- [PUBAPI-1470] volume objects should expose their creation timestamp in a
+  property named "created" instead of "create_timestamp".
+
+## 5.6.0
+
+- [TRITON-30] Add UpdateNetworkIP to node-triton, e.g.
+  `triton network ip update`
+- [TRITON-24] node-triton ListNetworkIPs has unordered results, e.g.
+  `triton network ip list NETWORK`
+- [TRITON-88] node-triton "env" doesn't call its callback
+
+## 5.5.0
+
+- [PUBAPI-1452] Add ip subcommand to network, e.g.
+  `triton network ip`.
+
+## 5.4.0
+
+- [joyent/node-triton#74, TOOLS-1872] Filter instance list by tag, e.g.
+  `triton instance list tag.foo=bar`.
+
+## 5.3.2
+
+- [joyent/node-triton#187] DTraceProviderBindings errors on FreeBSD.
+- [joyent/node-triton#226] added new `triton volume sizes` subcommand.
+- [PUBAPI-1420] added support for mounting volumes in LX and SmartOS instances.
+  E.g., `triton instance create --volume VOLUME ...`.
+
+## 5.3.1
+
+- [joyent/node-triton#222] Fix the matching environment variable for the
+  `triton -r,--role ROLE ...` option to be `TRITON_ROLE` instead of
+  `MANTA_ROLE`.
+- [joyent/node-triton#201] Fix `triton -r,--role ROLE ...` option for taking up
+  an RBAC role. This was introduced in v4.12.0 and was accidentally broken
+  in v5.0.0.
+- [joyent/node-triton#217] `triton volume ls -l` should output a `RESOURCE`
+  column.
+
+## 5.3.0
+
+- [joyent/node-triton#173], [joyent/node-triton#174] and
+  [joyent/node-triton#175] Add support for creating and managing NFS shared
+  volumes. New `triton volume` commands are available:
+
+  * `triton volume create` to create NFS shared volumes
+  * `triton volume list` to list existing volumes
+  * `triton volume get` to get information about a given volume
+  * `triton volume delete` to delete one or more volumes
+
+  Use `triton volume --help` to get help on all of these commands.
+
+  Note that these commands are hidden for now. They will be made visible by
+  default once the server-side support for volumes is shipped in Triton.
+
+## 5.2.1
+
+- [joyent/node-triton#193] Fix possible CLI crash with `triton ssh ...` if the
+  instance's image doesn't have any tags.
+- [joyent/node-triton#213] commands fail unhelpfully when `cliSetupTritonApi`
+  returns error (this includes e.g. supplying an incorrect key fingerprint,
+  which no longer results in a cryptic stack trace and crash)
+
+## 5.2.0
+
+- [joyent/node-triton#197] Create triton image export command
+
+## 5.1.1
+
+- [joyent/node-triton#190] Fix `triton profile create|docker-setup` breakage
+  with latest "17.03.\*" versions of `docker` installed.
+- [joyent/node-triton#148] Fix `triton profile edit ...` to work with an
+  "EDITOR" environment variable with quotes and spaces.
 - [joyent/node-triton#183] `triton profile create` will no longer use ANSI
   codes for styling if stdout isn't a TTY.
 

Makefile

@@ -37,8 +37,9 @@ test-integration:
 
 .PHONY: test-in-parallel
 test-in-parallel:
-	NODE_NDEBUG= prove -j15 -e ./node_modules/.bin/tape \
+	ls test/unit/*.test.js test/integration/*.test.js \
-		test/unit/*.test.js test/integration/*.test.js
+	    | parallel ./node_modules/.bin/tape \
+	    | ./node_modules/.bin/tap-summary --no-ansi --no-progress
 
 .PHONY: clean
 clean::

README.md

@@ -1,427 +1,38 @@
-![logo](./tools/triton-text.png)
+![logo](https://code.spearhead.cloud/Spearhead/node-spearhead/raw/branch/master/tools/sphsp.png)
 
-# node-triton
+# node-spearhead
 
-This repository is part of the Joyent Triton project. See the [contribution
+This repository holds the node-spearhead CLI tool to work with the Spearhead 
-guidelines](https://github.com/joyent/triton/blob/master/CONTRIBUTING.md) --
+Cloud. It is a fork of [node-triton](https://github.com/joyent/node-triton).
-*Triton does not use GitHub PRs* -- and general documentation at the main
-[Triton project](https://github.com/joyent/triton) page.
 
-`triton` is a CLI tool for working with the CloudAPI for Joyent's Triton [Public Cloud]
+## Installation and configuration
-(https://docs.joyent.com/public-cloud) and [Private Cloud] (https://docs.joyent.com/private-cloud).
-CloudAPI is a RESTful API for end users of the cloud to manage their accounts, instances,
-networks, images, and to inquire other relevant details. CloudAPI provides a single view of
-docker containers, infrastructure containers and hardware virtual machines available in the
-Triton solution.
 
-There is currently another CLI tool known as [node-smartdc](https://github.com/joyent/node-smartdc)
+### Get a Spearhead Cloud account
-for CloudAPI. `node-smartdc` CLI works off the 32-character object UUID to uniquely
-identify object instances in API requests, and returns response payload in JSON format.
-The CLI covers both basic and advanced usage of [CloudAPI](https://apidocs.joyent.com/cloudapi/).
 
-**The `triton` CLI is currently in beta (effectively because it does not yet
+Create an account on the Spearhead Cloud and upload your SSH key. You can create an account 
-have *complete* coverage of all commands from node-smartdc) and will be
+[here](https://spearhead.cloud/).
-expanded over time to support all CloudAPI commands, eventually replacing
-`node-smartdc` as both the API client library for Triton cloud and the command
-line tool.**
-
-## Setup
-
-### User accounts, authentication, and security
-
-Before you can use the CLI you'll need an account on the cloud to which you are connecting and
-an SSH key uploaded. The SSH key is used to identify and secure SSH access to containers and
-other resources in Triton.
-
-If you do not already have an account on Joyent Public Cloud, sign up [here](https://www.joyent.com/public-cloud).
 
 
-### API endpoint
+### Data-centers
 
-Each data center has a single CloudAPI endpoint. For Joyent Public Cloud, you can find the
+The list of available Spearhead Cloud data-centers is available 
-list of data centers [here](https://docs.joyent.com/public-cloud/data-centers).
+[here](https://spearhead.cloud/datacenters).
-For private cloud implementations, please consult the private cloud operator for the correct URL.
-Have the URL handy as you'll need it in the next step.
 
 
 ### Installation
 
 Install [node.js](http://nodejs.org/), then:
 
-    npm install -g triton
+    npm install -g spearhead
 
 Verify that it is installed and on your PATH:
+    $ spearhead --version
+    Spearhead CLI 6.1.4
+    https://code.spearhead.cloud/Spearhead/node-spearhead
     
-    $ triton --version
+Now you ca use `spearhead` to interact with our Public Cloud. More details 
-    Triton CLI 4.15.0
+about installation and configuration are available 
-    https://github.com/joyent/node-triton
+[here](https://docs.spearhead.cloud).
-
-To use `triton`, you'll need to configure it to talk to a Triton DataCenter
-API endpoint (called CloudAPI). Commonly that is done using a Triton profile:
-
-    $ triton profile create
-    A profile name. A short string to identify a CloudAPI endpoint to the
-    `triton` CLI.
-    name: sw1
-
-    The CloudAPI endpoint URL.
-    url: https://us-sw-1.api.joyent.com
-
-    Your account login name.
-    account: bob
-
-    Available SSH keys:
-     1. 2048-bit RSA key with fingerprint 4e:e7:56:9a:b0:91:31:3e:23:8d:f8:62:12:58:a2:ec
-      * [in homedir] bob-20160704 id_rsa
-
-    The fingerprint of the SSH key you want to use, or its index in the list
-    above. If the key you want to use is not listed, make sure it is either saved
-    in your SSH keys directory or loaded into the SSH agent.
-    keyId: 1
-
-    Saved profile "sw1".
-
-    WARNING: Docker uses TLS-based authentication with a different security model
-    from SSH keys. As a result, the Docker client cannot currently support
-    encrypted (password protected) keys or SSH agents. If you continue, the
-    Triton CLI will attempt to format a copy of your SSH *private* key as an
-    unencrypted TLS cert and place the copy in ~/.triton/docker for use by the
-    Docker client.
-    Continue? [y/n] y
-    Setting up profile "sw1" to use Docker.
-    Setup profile "sw1" to use Docker (v1.12.3). Try this:
-        eval "$(triton env --docker sw1)"
-        docker info
-
-    Set "sw1" as current profile (because it is your only profile).
-
-Or instead of using profiles, you can set the required environment variables
-(`triton` defaults to an "env" profile that uses these environment variables if
-no profile is set). For example:
-
-    TRITON_URL=https://us-sw-1.api.joyent.com
-    TRITON_ACCOUNT=bob
-    TRITON_KEY_ID=SHA256:j2WoSeOWhFy69BQ0uCR3FAySp9qCZTSCEyT2vRKcL+s
-
-For compatibility with the older [sdc-* tools from
-node-smartdc](https://github.com/joyent/node-smartdc), `triton` also supports
-`SDC_URL`, `SDC_ACCOUNT`, etc. environment variables.
-
-
-### Bash completion
-
-Install Bash completion with
-
-```bash
-triton completion > /usr/local/etc/bash_completion.d/triton     # Mac
-triton completion > /etc/bash_completion.d/triton               # Linux
-```
-
-Alternatively, if you don't have or don't want to use a "bash\_completion.d"
-dir, then something like this would work:
-
-```bash
-triton completion > ~/.triton.completion
-echo "source ~/.triton.completion" >> ~/.bashrc
-```
-
-Then open a new shell or manually `source FILE` that completion file, and
-play with the bash completions:
-
-    triton <TAB>
-
-
-## `triton` CLI Usage
-
-### Create and view instances
-
-    $ triton instance list
-    SHORTID  NAME  IMG  STATE  PRIMARYIP  AGO
-
-We have no instances created yet, so let's create some.  In order to create
-an instance we need to specify two things: an image and a package.  An image
-represents what will be used as the root of the instances filesystem, and the
-package represents the size of the instance, eg. ram, disk size, cpu shares,
-etc.  More information on images and packages below - for now we'll just use
-SmartOS 64bit and a small 128M ram package which is a combo available on the
-Joyent Public Cloud.
-
-    $ triton instance create base-64 t4-standard-128M
-
-Without a name specified, the container created will have a generated ID. Now
-to create a container-native Ubuntu 14.04 container with 2GB of ram with the
-name "server-1"
-
-    $ triton instance create --name=server-1 ubuntu-14.04 t4-standard-2G
-
-Now list your instances again
-
-    $ triton instance list
-    SHORTID   NAME      IMG                     STATE         PRIMARYIP        AGO
-    7db6c907  b851ba9   base-64@15.2.0          running       165.225.169.63   9m
-    9cf1f427  server-1  ubuntu-14.04@20150819   provisioning  -                0s
-
-
-Get a quick overview of your account
-
-    $ triton info
-    login: dave.eddy@joyent.com
-    name: Dave Eddy
-    email: dave.eddy@joyent.com
-    url: https://us-east-3b.api.joyent.com
-    totalDisk: 50.5 GiB
-    totalMemory: 2.0 MiB
-    instances: 2
-        running: 1
-        provisioning: 1
-
-To obtain more detailed information of your instance
-
-    $ triton instance get server-1
-    {
-        "id": "9cf1f427-9a40-c188-ce87-fd0c4a5a2c2c",
-        "name": "251d4fd",
-        "type": "smartmachine",
-        "state": "running",
-        "image": "c8d68a9e-4682-11e5-9450-4f4fadd0936d",
-        "ips": [
-            "165.225.169.54",
-            "192.168.128.16"
-        ],
-        "memory": 2048,
-        "disk": 51200,
-        "metadata": {
-            "root_authorized_keys": "(...ssh keys...)"
-        },
-        "tags": {},
-        "created": "2015-09-08T04:56:27.734Z",
-        "updated": "2015-09-08T04:56:43.000Z",
-        "networks": [
-            "feb7b2c5-0063-42f0-a4e6-b812917397f7",
-            "726379ac-358b-4fb4-bb7c-8bc4548bac1e"
-        ],
-        "dataset": "c8d68a9e-4682-11e5-9450-4f4fadd0936d",
-        "primaryIp": "165.225.169.54",
-        "firewall_enabled": false,
-        "compute_node": "44454c4c-5400-1034-8053-b5c04f383432",
-        "package": "t4-standard-2G"
-    }
-
-
-### SSH to an instance
-
-Connect to an instance over SSH
-
-    $ triton ssh b851ba9
-    Last login: Wed Aug 26 17:59:35 2015 from 208.184.5.170
-       __        .                   .
-     _|  |_      | .-. .  . .-. :--. |-
-    |_    _|     ;|   ||  |(.-' |  | |
-      |__|   `--'  `-' `;-| `-' '  ' `-'
-                       /  ; Instance (base-64 15.2.0)
-                       `-'  https://docs.joyent.com/images/smartos/base
-
-    [root@7db6c907-2693-42bc-ea9b-f38678f2554b ~]# uptime
-     20:08pm  up   2:27,  0 users,  load average: 0.00, 0.00, 0.01
-    [root@7db6c907-2693-42bc-ea9b-f38678f2554b ~]# logout
-    Connection to 165.225.169.63 closed.
-
-Or non-interactively
-
-    $ triton ssh b851ba9 uname -v
-    joyent_20150826T120743Z
-
-
-### Manage an instance
-
-Commonly used container operations are supported in the Triton CLI:
-
-    $ triton help instance
-    ...
-        list (ls)           List instances.
-        get                 Get an instance.
-        create              Create a new instance.
-        delete (rm)         Delete one or more instances.
-
-        start               Start one or more instances.
-        stop                Stop one or more instances.
-        reboot              Reboot one or more instances.
-
-        ssh                 SSH to the primary IP of an instance
-        wait                Wait on instances changing state.
-        audit               List instance actions.
-
-### View packages and images
-
-Package definitions and images available vary between different data centers
-and different Triton cloud implementations.
-
-To see all the packages offered in the data center and specific package
-information, use
-
-    $ triton package list
-    $ triton package get ID|NAME
-
-Similarly, to find out the available images and their details, do
-
-    $ triton image list
-    $ triton images ID|NAME
-
-Note that docker images are not shown in `triton images` as they are
-maintained in Docker Hub and other third-party registries configured to be
-used with Joyent's Triton clouds. **In general, docker containers should be
-provisioned and managed with the regular
-[`docker` CLI](https://docs.docker.com/installation/#installation)**
-(Triton provides an endpoint that represents the _entire datacenter_
-as a single `DOCKER_HOST`. See the [Triton Docker
-documentation](https://apidocs.joyent.com/docker) for more information.)
-
-
-## `TritonApi` Module Usage
-
-Node-triton can also be used as a node module for your own node.js tooling.
-A basic example appropriate for a command-line tool is:
-
-```javascript
-var mod_bunyan = require('bunyan');
-var mod_triton = require('triton');
-
-var log = mod_bunyan.createLogger({name: 'my-tool'});
-
-// See the `createClient` block comment for full usage details:
-//      https://github.com/joyent/node-triton/blob/master/lib/index.js
-mod_triton.createClient({
-    log: log,
-    // Use 'env' to pick up 'TRITON_/SDC_' env vars. Or manually specify a
-    // `profile` object.
-    profileName: 'env',
-    unlockKeyFn: mod_triton.promptPassphraseUnlockKey
-}, function (err, client) {
-    if (err) {
-        // handle err
-    }
-
-    client.listImages(function (err, images) {
-        client.close();   // Remember to close the client to close TCP conn.
-        if (err) {
-            console.error('listImages err:', err);
-        } else {
-            console.log(JSON.stringify(images, null, 4));
-        }
-    });
-});
-```
-
-See the following for more details:
-- The block-comment for `createClient` in [lib/index.js](lib/index.js).
-- Some module-usage examples in [examples/](examples/).
-- The lower-level details in the top-comment in
-  [lib/tritonapi.js](lib/tritonapi.js).
-
-
-## Configuration
-
-This section defines all the vars in a TritonApi config. The baked in defaults
-are in "etc/defaults.json" and can be overriden for the CLI in
-"~/.triton/config.json" (on Windows: "%APPDATA%/Joyent/Triton/config.json").
-
-| Name | Description |
-| ---- | ----------- |
-| profile | The name of the triton profile to use. The default with the CLI is "env", i.e. take config from `SDC_*` envvars. |
-| cacheDir | The path (relative to the config dir, "~/.triton") where cache data is stored. The default is "cache", i.e. the `triton` CLI caches at "~/.triton/cache". |
-
-
-## node-triton differences with node-smartdc
-
-- There is a single `triton` command instead of a number of `sdc-*` commands.
-- `TRITON_*` environment variables are preferred to the `SDC_*` environment
-  variables. However the `SDC_*` envvars are still supported.
-- Node-smartdc still has more complete coverage of the Triton
-  [CloudAPI](https://apidocs.joyent.com/cloudapi/). However, `triton` is
-  catching up and is much more friendly to use.
-
-
-## Development Hooks
-
-Before commiting be sure to, at least:
-
-    make check      # lint and style checks
-    make test-unit  # run unit tests
-
-A good way to do that is to install the stock pre-commit hook in your
-clone via:
-
-    make git-hooks
-
-Also please run the full (longer) test suite (`make test`). See the next
-section.
-
-
-## Test suite
-
-node-triton has both unit tests (`make test-unit`) and integration tests (`make
-test-integration`). Integration tests require a config file, by default at
-"test/config.json". For example:
-
-    $ cat test/config.json
-    {
-        "profileName": "east3b",
-        "allowWriteActions": true,
-        "image": "minimal-64",
-        "package": "g4-highcpu-128M",
-        "resizePackage": "g4-highcpu-256M"
-    }
-
-See "test/config.json.sample" for a description of all config vars. Minimally
-just a "profileName" or "profile" is required.
-
-*Warning:* Running the *integration* tests will create resources and could
-incur costs if running against a public cloud.
-
-Run all tests:
-
-    make test
-
-You can use `TRITON_TEST_CONFIG` to override the test file, e.g.:
-
-    $ cat test/coal.json
-    {
-        "profileName": "coal",
-        "allowWriteActions": true
-    }
-    $ TRITON_TEST_CONFIG=test/coal.json make test
-
-where "coal" here refers to a development Triton (a.k.a SDC) ["Cloud On A
-Laptop"](https://github.com/joyent/sdc#getting-started) standup.
-
-
-## Release process
-
-Here is how to cut a release:
-
-1. Make a commit to set the intended version in "package.json#version" and changing `## not yet released` at the top of "CHANGES.md" to:
-
-    ```
-    ## not yet released
-
-
-    ## $version
-    ```
-
-2. Get that commit approved and merged via <https://cr.joyent.us>, as with all
-   commits to this repo. See the discussion of contribution at the top of this
-   readme.
-
-3. Once that is merged and you've updated your local copy, run:
-
-    ```
-    make cutarelease
-    ```
-
-   This will run a couple checks (clean working copy, versions in package.json
-   and CHANGES.md match), then will git tag and npm publish.
-
 
 ## License
-
 MPL 2.0

etc/triton-bash-completion-types.sh

@@ -133,6 +133,12 @@ function complete_tritonnetwork {
     compgen $compgen_opts -W "$candidates" -- "$word"
 }
 
+function complete_tritonvolume {
+    local word="$1"
+    candidates=$(_complete_tritondata volumes)
+    compgen $compgen_opts -W "$candidates" -- "$word"
+}
+
 function complete_tritonfwrule {
     local word="$1"
     candidates=$(_complete_tritondata fwrules)

examples/example-get-account.js

@@ -1,45 +0,0 @@
-#!/usr/bin/env node
-/**
- * Example creating a Triton API client and using it to get account info.
- *
- * Usage:
- *      ./example-get-account.js
- *
- *      # With trace-level logging
- *      LOG_LEVEL=trace ./example-get-account.js 2>&1 | bunyan
- */
-
-var bunyan = require('bunyan');
-var path = require('path');
-var triton = require('../'); // typically `require('triton');`
-
-var log = bunyan.createLogger({
-    name: path.basename(__filename),
-    level: process.env.LOG_LEVEL || 'info',
-    stream: process.stderr
-});
-
-triton.createClient({
-    log: log,
-    // Use 'env' to pick up 'TRITON_/SDC_' env vars. Or manually specify a
-    // `profile` object.
-    profileName: 'env',
-    unlockKeyFn: triton.promptPassphraseUnlockKey
-}, function createdClient(err, client) {
-    if (err) {
-        console.error('error creating Triton client: %s\n%s', err, err.stack);
-        process.exitStatus = 1;
-        return;
-    }
-
-    // TODO: Eventually the top-level TritonApi will have `.getAccount()`.
-    client.cloudapi.getAccount(function (err, account) {
-        client.close(); // Remember to close the client to close TCP conn.
-        if (err) {
-            console.error('getAccount error: %s\n%s', err, err.stack);
-            process.exitStatus = 1;
-        } else {
-            console.log(JSON.stringify(account, null, 4));
-        }
-    });
-});

examples/example-list-instances.js

@@ -1,46 +0,0 @@
-#!/usr/bin/env node
-/**
- * Example creating a Triton API client and using it to list instances.
- *
- * Usage:
- *      ./example-list-instances.js
- *
- *      # With trace-level logging
- *      LOG_LEVEL=trace ./example-list-instances.js 2>&1 | bunyan
- */
-
-var bunyan = require('bunyan');
-var path = require('path');
-var triton = require('../'); // typically `require('triton');`
-
-var log = bunyan.createLogger({
-    name: path.basename(__filename),
-    level: process.env.LOG_LEVEL || 'info',
-    stream: process.stderr
-});
-
-triton.createClient({
-    log: log,
-    // Use 'env' to pick up 'TRITON_/SDC_' env vars. Or manually specify a
-    // `profile` object.
-    profileName: 'env',
-    unlockKeyFn: triton.promptPassphraseUnlockKey
-}, function createdClient(err, client) {
-    if (err) {
-        console.error('error creating Triton client: %s\n%s', err, err.stack);
-        process.exitStatus = 1;
-        return;
-    }
-
-    // TODO: Eventually the top-level TritonApi will have `.listInstances()`.
-    client.cloudapi.listMachines(function (err, insts) {
-        client.close(); // Remember to close the client to close TCP conn.
-
-        if (err) {
-            console.error('listInstances error: %s\n%s', err, err.stack);
-            process.exitStatus = 1;
-        } else {
-            console.log(JSON.stringify(insts, null, 4));
-        }
-    });
-});

examples/rbac-simple/README.md

@@ -1,27 +0,0 @@
-*Caveat*: All `triton rbac ...` support is experimental.
-
-This directly holds a super simple example Triton RBAC Profile for a mythical
-"Simple Corp.", with `triton` CLI examples showing how to use it for RBAC.
-
-Our Simple corporation will create an "rbactestsimple" Triton account and
-use RBAC to manage its users, roles, etc. It has two users:
-
-- emma: Should have full access, to everything.
-- bert: Should only have read access, again to everything.
-
-We want an RBAC config that allows appropriate access for all the employees
-and tooling.  Roughly we'll break that into roles as follows:
-
-- Role `admin`. Complete access to the API. Only used by "emma" when, e.g.,
-  updating RBAC configuration itself.
-- Role `ops`. Full access, except to RBAC configuration updates.
-- Role `read`. Read-only access to compute resources.
-
-See "rbac.json" where we encode all this.
-
-The `triton rbac apply` command can work with a JSON config file (and
-optionally separate user public ssh key files) to create and maintain a
-Triton RBAC configuration. In our example this will be:
-
-    triton rbac apply   # defaults to looking at "./rbac.json"
-

examples/rbac-simple/rbac.json

@@ -1,43 +0,0 @@
-{
-    "users": [
-        { "login": "emma", "email": "emma@simple.example.com" },
-        { "login": "bert", "email": "bert@simple.example.com" }
-    ],
-    "roles": [
-        {
-            "name": "admin",
-            "default_members": [],
-            "members": ["emma"],
-            "policies": ["policy-admin"]
-        },
-        {
-            "name": "ops",
-            "default_members": ["emma"],
-            "members": ["emma"],
-            "policies": ["policy-full"]
-        },
-        {
-            "name": "read",
-            "default_members": ["bert", "emma"],
-            "members": ["bert", "emma"],
-            "policies": ["policy-readonly"]
-        }
-    ],
-    "policies": [
-        {
-            "name": "policy-admin",
-            "description": "full access",
-            "rules": ["CAN *"]
-        },
-        {
-            "name": "policy-full",
-            "description": "full access, except rbac",
-            "rules": ["CAN compute:*"]
-        },
-        {
-            "name": "policy-readonly",
-            "description": "read-only access",
-            "rules": ["CAN compute:Get*"]
-        }
-    ]
-}

lib/cli.js

@@ -5,7 +5,7 @@
  */
 
 /*
- * Copyright 2016 Joyent, Inc.
+ * Copyright (c) 2017, Joyent, Inc.
  *
  * The `triton` CLI class.
  */
@@ -58,9 +58,9 @@ var OPTIONS = [
         names: ['profile', 'p'],
         type: 'string',
         completionType: 'tritonprofile',
-        env: 'TRITON_PROFILE',
+        env: 'SC_PROFILE',
         helpArg: 'NAME',
-        help: 'Triton client profile to use.'
+        help: 'Spearhead Cloud client profile to use.'
     },
 
     {
@@ -81,8 +81,7 @@ var OPTIONS = [
     {
         names: ['account', 'a'],
         type: 'string',
-        help: 'Account (login name). Environment: TRITON_ACCOUNT=ACCOUNT ' +
+        help: 'Account (login name). Environment: SC_ACCOUNT=ACCOUNT ',
-            'or SDC_ACCOUNT=ACCOUNT.',
         helpArg: 'ACCOUNT'
     },
     {
@@ -90,51 +89,48 @@ var OPTIONS = [
         type: 'string',
         help: 'Masquerade as the given account login name. This can only ' +
             'succeed for operator accounts. Note that accesses like these ' +
-            'audited on the CloudAPI server side.',
+            'are audited on the CloudAPI server side.',
         helpArg: 'ACCOUNT',
         hidden: true
     },
     {
         names: ['user', 'u'],
         type: 'string',
-        help: 'RBAC user (login name). Environment: TRITON_USER=USER ' +
+        help: 'RBAC user (login name). Environment: SC_USER=USER',
-            'or SDC_USER=USER.',
         helpArg: 'USER'
     },
     {
         names: ['role', 'r'],
         type: 'arrayOfCommaSepString',
-        env: 'MANTA_ROLE',
+        env: 'SC_ROLE',
         help: 'Assume an RBAC role. Use multiple times or once with a list',
-        helpArg: 'ROLE,ROLE,...'
+        helpArg: 'ROLE,...'
     },
     {
         names: ['keyId', 'k'],
         type: 'string',
-        help: 'SSH key fingerprint. Environment: TRITON_KEY_ID=FINGERPRINT ' +
+        help: 'SSH key fingerprint. Environment: SC_KEY_ID=FINGERPRINT.',
-            'or SDC_KEY_ID=FINGERPRINT.',
         helpArg: 'FP'
     },
     {
         names: ['url', 'U'],
         type: 'string',
-        help: 'CloudAPI URL. Environment: TRITON_URL=URL or SDC_URL=URL.',
+        help: 'Spearhead Cloud Datacenter URL. Environment: SC_URL=URL.',
         helpArg: 'URL'
     },
     {
         names: ['J'],
         type: 'string',
         hidden: true,
-        help: 'Joyent Public Cloud (JPC) datacenter name. This is ' +
+        help: 'Spearhead Cloud (SC) datacenter name. This is ' +
-            'a shortcut to the "https://$dc.api.joyent.com" ' +
+            'a shortcut to the "https://$dc.api.spearhead.cloud" ' +
             'cloudapi URL.'
     },
     {
         names: ['insecure', 'i'],
         type: 'bool',
-        help: 'Do not validate the CloudAPI SSL certificate. Environment: ' +
+        help: 'Do not validate the SSL certificate. Environment: ' +
-            'TRITON_TLS_INSECURE=1, SDC_TLS_INSECURE=1 (or the deprecated ' +
+            'SC_TLS_INSECURE=1 (or the deprecated SC_TESTING=1).',
-            'SDC_TESTING=1).',
         'default': false
     },
     {
@@ -143,10 +139,10 @@ var OPTIONS = [
         helpArg: 'VER',
         help: 'A cloudapi API version, or semver range, to attempt to use. ' +
             'This is passed in the "Accept-Version" header. ' +
-            'See `triton cloudapi /--ping` to list supported versions. ' +
+            'See `spearhead cloudapi /--ping` to list supported versions. ' +
             'The default is "' + lib_tritonapi.CLOUDAPI_ACCEPT_VERSION + '". ' +
             '*This is intended for development use only. It could cause ' +
-            '`triton` processing of responses to break.*',
+            '`spearhead` processing of responses to break.*',
         hidden: true
     }
 ];
@@ -183,7 +179,7 @@ cmdln.dashdash.addOptionType({
 
 function CLI() {
     Cmdln.call(this, {
-        name: 'triton',
+        name: 'spearhead',
         desc: packageJson.description,
         options: OPTIONS,
         helpOpts: {
@@ -210,6 +206,7 @@ function CLI() {
             'package',
             'network',
             'fwrule',
+            'vlan',
             { group: 'Other Commands' },
             'info',
             'account',
@@ -248,7 +245,7 @@ CLI.prototype.init = function (opts, args, callback) {
     }
 
     if (opts.version) {
-        console.log('Triton CLI', packageJson.version);
+        console.log('Spearhead CLI', packageJson.version);
         console.log(packageJson.homepage);
         callback(false);
         return;
@@ -258,7 +255,7 @@ CLI.prototype.init = function (opts, args, callback) {
         callback(new errors.UsageError(
             'cannot use both "--url" and "-J" options'));
     } else if (opts.J) {
-        opts.url = format('https://%s.api.joyent.com', opts.J);
+        opts.url = format('https://%s.api.spearhead.cloud', opts.J);
     }
 
     this.configDir = constants.CLI_CONFIG_DIR;
@@ -298,9 +295,8 @@ CLI.prototype.init = function (opts, args, callback) {
                     /* BEGIN JSSTYLED */
                     pErr.message += '\n'
                         + '    No profile information could be loaded.\n'
-                        + '    Use "triton profile create" to create a profile or provide\n'
+                        + '    Use "spearhead profile create" to create a profile or provide\n'
-                        + '    the required "CloudAPI options" described in "triton --help".\n'
+                        + '    the required "CloudAPI options" described in "spearhead --help".';
-                        + '    See https://github.com/joyent/node-triton#setup for more help.';
                     /* END JSSTYLED */
                 }
                 throw pErr;
@@ -322,9 +318,9 @@ CLI.prototype.init = function (opts, args, callback) {
         return self._tritonapi;
     });
 
-    if (process.env.TRITON_COMPLETE) {
+    if (process.env.SC_COMPLETE) {
         /*
-         * If `TRITON_COMPLETE=<type>` is set (typically only in the
+         * If `SC_COMPLETE=<type>` is set (typically only in the
          * Triton CLI bash completion driver, see
          * "etc/triton-bash-completion-types.sh"), then Bash completions are
          * fetched and printed, instead of the usual subcommand handling.
@@ -333,9 +329,9 @@ CLI.prototype.init = function (opts, args, callback) {
          * to avoid hitting the server for data everytime.
          *
          * Example usage:
-         *      TRITON_COMPLETE=images triton -p my-profile create
+         *      SC_COMPLETE=images triton -p my-profile create
          */
-        self._emitCompletions(process.env.TRITON_COMPLETE, function (err) {
+        self._emitCompletions(process.env.SC_COMPLETE, function (err) {
             callback(err || false);
         });
     } else {
@@ -463,6 +459,21 @@ CLI.prototype._emitCompletions = function _emitCompletions(type, cb) {
                     next();
                 });
                 break;
+            case 'volumes':
+                tritonapi.cloudapi.listVolumes({}, function (err, vols) {
+                    if (err) {
+                        next(err);
+                        return;
+                    }
+                    completions = [];
+                    vols.forEach(function (vol) {
+                        completions.push(vol.name);
+                        completions.push(vol.id);
+                    });
+                    arg.completions = completions.join('\n') + '\n';
+                    next();
+                });
+                break;
             case 'affinityrules':
                 /*
                  * We exclude ids, in favour of just inst names here. The only
@@ -544,7 +555,7 @@ CLI.prototype._emitCompletions = function _emitCompletions(type, cb) {
                 });
                 break;
             default:
-                process.stderr.write('warning: unknown triton completion type: '
+                process.stderr.write('warning: unknown spearhead completion type: '
                     + type + '\n');
                 next();
                 break;
@@ -690,11 +701,17 @@ CLI.prototype.do_package = require('./do_package');
 CLI.prototype.do_networks = require('./do_networks');
 CLI.prototype.do_network = require('./do_network');
 
+// VLANs
+CLI.prototype.do_vlan = require('./do_vlan');
+
 // Hidden commands
 CLI.prototype.do_cloudapi = require('./do_cloudapi');
 CLI.prototype.do_badger = require('./do_badger');
 CLI.prototype.do_rbac = require('./do_rbac');
 
+// Volumes
+CLI.prototype.do_volumes = require('./do_volumes');
+CLI.prototype.do_volume = require('./do_volume');
 
 
 //---- mainline

lib/cloudapi2.js

@@ -5,7 +5,7 @@
  */
 
 /*
- * Copyright 2015 Joyent, Inc.
+ * Copyright (c) 2018, Joyent, Inc.
  *
  * Client library for the SmartDataCenter Cloud API (cloudapi).
  * http://apidocs.joyent.com/cloudapi/
@@ -154,7 +154,6 @@ function CloudApi(options) {
     this.client = new SaferJsonClient(options);
 }
 
-
 CloudApi.prototype.close = function close(callback) {
     this.log.trace({host: this.client.url && this.client.url.host},
         'close cloudapi http client');
@@ -358,6 +357,48 @@ CloudApi.prototype.ping = function ping(opts, cb) {
 };
 
 
+// ---- config
+
+/**
+ * Get config object for the current user.
+ *
+ * @param {Object} opts
+ * @param {Function} cb of the form `function (err, config, res)`
+ */
+CloudApi.prototype.getConfig = function getConfig(opts, cb) {
+    assert.object(opts, 'opts');
+    assert.func(cb, 'cb');
+
+    var endpoint = this._path(format('/%s/config', this.account));
+    this._request(endpoint, function (err, req, res, body) {
+        cb(err, body, res);
+    });
+};
+
+
+/**
+ * Set config object for the current user.
+ *
+ * @param {Object} opts
+ *      - {String} default_network: network fabric docker containers are
+ *          provisioned on. Optional.
+ * @param {Function} cb of the form `function (err, config, res)`
+ */
+CloudApi.prototype.updateConfig = function updateConfig(opts, cb) {
+    assert.object(opts, 'opts');
+    assert.optionalUuid(opts.default_network, 'opts.default_network');
+    assert.func(cb, 'cb');
+
+    this._request({
+        method: 'PUT',
+        path: format('/%s/config', this.account),
+        data: opts
+    }, function (err, req, res, body) {
+        cb(err, body, res);
+    });
+};
+
+
 // ---- networks
 
 /**
@@ -386,6 +427,300 @@ CloudApi.prototype.getNetwork = function getNetwork(id, cb) {
     });
 };
 
+/**
+ * <http://apidocs.joyent.com/cloudapi/#ListNetworkIPs>
+ *
+ * @param {String} id - The network UUID. Required.
+ * @param {Function} callback of the form `function (err, ips, res)`
+ */
+CloudApi.prototype.listNetworkIps = function listNetworkIps(id, cb) {
+    assert.uuid(id, 'id');
+    assert.func(cb, 'cb');
+
+    var endpoint = this._path(format('/%s/networks/%s/ips', this.account, id));
+    this._request(endpoint, function (err, req, res, body) {
+        cb(err, body, res);
+    });
+};
+
+/**
+ * <http://apidocs.joyent.com/cloudapi/#GetNetworkIP>
+ *
+ * @param {Object} opts
+ *      - {String} id - The network UUID. Required.
+ *      - {String} ip - The IP. Required.
+ * @param {Function} callback of the form `function (err, ip, res)`
+ */
+CloudApi.prototype.getNetworkIp = function getNetworkIp(opts, cb) {
+    assert.object(opts, 'opts');
+    assert.uuid(opts.id, 'opts.id');
+    assert.string(opts.ip, 'opts.ip');
+    assert.func(cb, 'cb');
+
+    var endpoint = this._path(format('/%s/networks/%s/ips/%s',
+        this.account, opts.id, opts.ip));
+    this._request(endpoint, function (err, req, res, body) {
+        cb(err, body, res);
+    });
+};
+
+/**
+ * <http://apidocs.joyent.com/cloudapi/#UpdateNetworkIP>
+ *
+ * @param {Object} opts
+ *      - {String} id - The network UUID. Required.
+ *      - {String} ip - The IP. Required.
+ *      - {Boolean} reserved - Reserve the IP. Required.
+ * @param {Function} callback of the form `function (err, body, res)`
+ */
+CloudApi.prototype.updateNetworkIp = function updateNetworkIp(opts, cb) {
+    assert.object(opts, 'opts');
+    assert.uuid(opts.id, 'opts.id');
+    assert.string(opts.ip, 'opts.ip');
+    assert.bool(opts.reserved, 'opts.reserved');
+    assert.func(cb, 'cb');
+
+    var endpoint = this._path(format('/%s/networks/%s/ips/%s',
+        this.account, opts.id, opts.ip));
+    var data = {
+        reserved: opts.reserved
+    };
+
+    this._request({
+        method: 'PUT',
+        path: endpoint,
+        data: data
+    }, function (err, req, res, body) {
+        cb(err, body, res);
+    });
+};
+
+// <updatable network ip field> -> <expected typeof>
+CloudApi.prototype.UPDATE_NETWORK_IP_FIELDS = {
+    reserved: 'boolean'
+};
+
+
+// --- Fabric VLANs
+
+/**
+ * Creates a network on a fabric VLAN.
+ *
+ * @param {Object} options object containing:
+ *      - {Integer} vlan_id (required) VLAN's id, between 0-4095.
+ *      - {String} name (required) A name to identify the network.
+ *      - {String} subnet (required) CIDR description of the network.
+ *      - {String} provision_start_ip (required) First assignable IP addr.
+ *      - {String} provision_end_ip (required) Last assignable IP addr.
+ *      - {String} gateway (optional) Gateway IP address.
+ *      - {Array} resolvers (optional) DNS resolvers for hosts on network.
+ *      - {Object} routes (optional) Static routes for hosts on network.
+ *      - {String} description (optional)
+ *      - {Boolean} internet_nat (optional) Whether to provision an Internet
+ *          NAT on the gateway address (default: true).
+ * @param {Function} callback of the form f(err, vlan, res).
+ */
+CloudApi.prototype.createFabricNetwork =
+function createFabricNetwork(opts, cb) {
+    assert.object(opts, 'opts');
+    assert.number(opts.vlan_id, 'opts.vlan_id');
+    assert.string(opts.name, 'opts.name');
+    assert.string(opts.subnet, 'opts.subnet');
+    assert.string(opts.provision_start_ip, 'opts.provision_start_ip');
+    assert.string(opts.provision_end_ip, 'opts.provision_end_ip');
+    assert.optionalString(opts.gateway, 'opts.gateway');
+    assert.optionalArrayOfString(opts.resolvers, 'opts.resolvers');
+    assert.optionalObject(opts.routes, 'opts.routes');
+    assert.optionalBool(opts.internet_nat, 'opts.internet_nat');
+
+    var data = common.objCopy(opts);
+    var vlanId = data.vlan_id;
+    delete data.vlan_id;
+
+    this._request({
+        method: 'POST',
+        path: format('/%s/fabrics/default/vlans/%d/networks', this.account,
+                     vlanId),
+        data: data
+    }, function reqCb(err, req, res, body) {
+        cb(err, body, res);
+    });
+};
+
+/**
+ * Lists all networks on a VLAN.
+ *
+ * Returns an array of objects.
+ *
+ * @param {Object} options object containing:
+ *      - {Integer} vlan_id (required) VLAN's id, between 0-4095.
+ * @param {Function} callback of the form f(err, networks, res).
+ */
+CloudApi.prototype.listFabricNetworks =
+function listFabricNetworks(opts, cb) {
+    assert.object(opts, 'opts');
+    assert.number(opts.vlan_id, 'opts.vlan_id');
+    assert.func(cb, 'cb');
+
+    var endpoint = format('/%s/fabrics/default/vlans/%d/networks',
+                          this.account, opts.vlan_id);
+    this._passThrough(endpoint, opts, cb);
+};
+
+/**
+ * Remove a fabric network
+ *
+ * @param {Object} opts (object)
+ *      - {String} id: The network id. Required.
+ *      - {Integer} vlan_id: The VLAN id. Required.
+ * @param {Function} cb of the form `function (err, res)`
+ */
+CloudApi.prototype.deleteFabricNetwork =
+function deleteFabricNetwork(opts, cb) {
+    assert.object(opts, 'opts');
+    assert.uuid(opts.id, 'opts.id');
+    assert.number(opts.vlan_id, 'opts.vlan_id');
+    assert.func(cb, 'cb');
+
+    this._request({
+        method: 'DELETE',
+        path: format('/%s/fabrics/default/vlans/%d/networks/%s', this.account,
+                     opts.vlan_id, opts.id)
+    }, function (err, req, res) {
+        cb(err, res);
+    });
+};
+
+/**
+ * Creates a VLAN on a fabric.
+ *
+ * @param {Object} options object containing:
+ *      - {Integer} vlan_id (required) VLAN's id, between 0-4095.
+ *      - {String} name (required) A name to identify the VLAN.
+ *      - {String} description (optional)
+ * @param {Function} callback of the form f(err, vlan, res).
+ */
+CloudApi.prototype.createFabricVlan =
+function createFabricVlan(opts, cb) {
+    assert.object(opts, 'opts');
+    assert.number(opts.vlan_id, 'opts.vlan_id');
+    assert.string(opts.name, 'opts.name');
+    assert.optionalString(opts.description, 'opts.description');
+
+    var data = {
+        vlan_id: opts.vlan_id
+    };
+
+    Object.keys(this.UPDATE_VLAN_FIELDS).forEach(function (attr) {
+        if (opts[attr] !== undefined)
+            data[attr] = opts[attr];
+    });
+
+    this._request({
+        method: 'POST',
+        path: format('/%s/fabrics/default/vlans', this.account),
+        data: data
+    }, function reqCb(err, req, res, body) {
+        cb(err, body, res);
+    });
+};
+
+/**
+ * Lists all the VLANs.
+ *
+ * Returns an array of objects.
+ *
+ * @param opts {Object} Options
+ * @param {Function} callback of the form f(err, vlans, res).
+ */
+CloudApi.prototype.listFabricVlans =
+function listFabricVlans(opts, cb) {
+    assert.object(opts, 'opts');
+    assert.func(cb, 'cb');
+
+    var endpoint = format('/%s/fabrics/default/vlans', this.account);
+    this._passThrough(endpoint, opts, cb);
+};
+
+/**
+ * Retrieves a VLAN.
+ *
+ * @param {Integer} id: The VLAN id.
+ * @param {Function} callback of the form `function (err, vlan, res)`
+ */
+CloudApi.prototype.getFabricVlan =
+function getFabricVlan(opts, cb) {
+    assert.object(opts, 'opts');
+    assert.number(opts.vlan_id, 'opts.vlan_id');
+    assert.func(cb, 'cb');
+
+    var endpoint = format('/%s/fabrics/default/vlans/%d', this.account,
+        opts.vlan_id);
+    this._request(endpoint, function (err, req, res, body) {
+        cb(err, body, res);
+    });
+};
+
+// <updatable account field> -> <expected typeof>
+CloudApi.prototype.UPDATE_VLAN_FIELDS = {
+    name: 'string',
+    description: 'string'
+};
+
+/**
+ * Updates a VLAN.
+ *
+ * @param {Object} opts object containing:
+ *      - {Integer} id: The VLAN id. Required.
+ *      - {String} name: The VLAN name. Optional.
+ *      - {String} description: Description of the VLAN. Optional.
+ * @param {Function} callback of the form `function (err, vlan, res)`
+ */
+CloudApi.prototype.updateFabricVlan =
+function updateFabricVlan(opts, cb) {
+    assert.object(opts, 'opts');
+    assert.number(opts.vlan_id, 'opts.vlan_id');
+    assert.optionalString(opts.rule, 'opts.name');
+    assert.optionalString(opts.description, 'opts.description');
+    assert.func(cb, 'cb');
+
+    var data = {};
+    Object.keys(this.UPDATE_VLAN_FIELDS).forEach(function (attr) {
+        if (opts[attr] !== undefined)
+            data[attr] = opts[attr];
+    });
+
+    var vlanId = opts.vlan_id;
+
+    this._request({
+        method: 'POST',
+        path: format('/%s/fabrics/default/vlans/%d', this.account, vlanId),
+        data: data
+    }, function onReq(err, req, res, body) {
+        cb(err, body, res);
+    });
+};
+
+/**
+ * Remove a VLAN.
+ *
+ * @param {Object} opts (object)
+ *      - {Integer} vlan_id: The vlan id. Required.
+ * @param {Function} cb of the form `function (err, res)`
+ */
+CloudApi.prototype.deleteFabricVlan =
+function deleteFabricVlan(opts, cb) {
+    assert.object(opts, 'opts');
+    assert.number(opts.vlan_id, 'opts.vlan_id');
+    assert.func(cb, 'cb');
+
+    this._request({
+        method: 'DELETE',
+        path: format('/%s/fabrics/default/vlans/%d', this.account, opts.vlan_id)
+    }, function onReq(err, req, res) {
+        cb(err, res);
+    });
+};
 
 
 // ---- datacenters
@@ -669,7 +1004,118 @@ function createImageFromMachine(opts, cb) {
     });
 };
 
+/**
+ * Export an image to Manta.
+ * <http://apidocs.joyent.com/cloudapi/#ExportImage>
+ *
+ * @param {Object} opts
+ *      - {UUID} id  Required.  The id of the image to export.
+ *      - {String} manta_path  Required.  The path in Manta to write the image.
+ * @param {Function} cb of the form `function (err, exportInfo, res)`
+ */
+CloudApi.prototype.exportImage = function exportImage(opts, cb) {
+    assert.uuid(opts.id, 'id');
+    assert.string(opts.manta_path, 'manta_path');
+    assert.func(cb, 'cb');
+    var data = {
+        action: 'export',
+        manta_path: opts.manta_path
+    };
 
+    this._request({
+        method: 'POST',
+        path: format('/%s/images/%s', this.account, opts.id),
+        data: data
+    }, function (err, req, res, body) {
+        cb(err, body, res);
+    });
+};
+
+/**
+ * Update an image.
+ * <http://apidocs.joyent.com/cloudapi/#UpdateImage>
+ *
+ * @param {Object} opts
+ *      - {UUID} id  Required.  The id of the image to update.
+ *      - {Object} fields  Required.  The fields to update in the image.
+ * @param {Function} cb of the form `function (err, body, res)`
+ */
+CloudApi.prototype.updateImage = function updateImage(opts, cb) {
+    assert.uuid(opts.id, 'id');
+    assert.object(opts.fields, 'fields');
+    assert.func(cb, 'cb');
+
+    this._request({
+        method: 'POST',
+        path: format('/%s/images/%s?action=update', this.account, opts.id),
+        data: opts.fields
+    }, function (err, req, res, body) {
+        if (err) {
+            cb(err, null, res);
+            return;
+        }
+        cb(null, body, res);
+    });
+};
+
+/**
+ * Clone an image.
+ * <http://apidocs.joyent.com/cloudapi/#CloneImage>
+ *
+ * @param {Object} opts
+ *      - {UUID} id  Required.  The id of the image to update.
+ * @param {Function} cb of the form `function (err, body, res)`
+ */
+CloudApi.prototype.cloneImage = function cloneImage(opts, cb) {
+    assert.uuid(opts.id, 'id');
+    assert.func(cb, 'cb');
+
+    this._request({
+        method: 'POST',
+        path: format('/%s/images/%s?action=clone', this.account, opts.id),
+        data: {}
+    }, function (err, req, res, body) {
+        if (err) {
+            cb(err, null, res);
+            return;
+        }
+        cb(null, body, res);
+    });
+};
+
+/**
+ * Import image from another datacenter in the same cloud.
+ * <http://apidocs.joyent.com/cloudapi/#ImportImageFromDatacenter>
+ *
+ * @param {Object} opts
+ *      - {String} datacenter  Required.  The datacenter to import from.
+ *      - {UUID} id  Required.  The id of the image to update.
+ * @param {Function} cb of the form `function (err, body, res)`
+ */
+CloudApi.prototype.importImageFromDatacenter =
+function importImageFromDatacenter(opts, cb) {
+    assert.string(opts.datacenter, 'datacenter');
+    assert.uuid(opts.id, 'id');
+    assert.func(cb, 'cb');
+
+    var p = this._path(format('/%s/images', this.account), {
+        action: 'import-from-datacenter',
+        datacenter: opts.datacenter,
+        id: opts.id
+    });
+
+    this._request({
+        method: 'POST',
+        path: p,
+        data: {}
+    }, function (err, req, res, body) {
+        if (err) {
+            cb(err, null, res);
+            return;
+        }
+        cb(null, body, res);
+    });
+};
 
 /**
  * Wait for an image to go one of a set of specfic states.
@@ -750,13 +1196,12 @@ CloudApi.prototype.getPackage = function getPackage(opts, cb) {
 /**
  * Get a machine by id.
  *
- * XXX add getCredentials equivalent
- * XXX cloudapi docs don't doc the credentials=true option
- *
  * For backwards compat, calling with `getMachine(id, cb)` is allowed.
  *
  * @param {Object} opts
- *      - id {UUID} Required. The machine id.
+ *      - {UUID} id - Required. The machine id.
+ *      - {Boolean} credentials - Optional. Set to true to include generated
+ *        credentials for this machine in `machine.metadata.credentials`.
  * @param {Function} cb of the form `function (err, machine, res)`
  */
 CloudApi.prototype.getMachine = function getMachine(opts, cb) {
@@ -765,9 +1210,14 @@ CloudApi.prototype.getMachine = function getMachine(opts, cb) {
     }
     assert.object(opts, 'opts');
     assert.uuid(opts.id, 'opts.id');
+    assert.optionalBool(opts.credentials, 'opts.credentials');
 
-    var endpoint = format('/%s/machines/%s', this.account, opts.id);
+    var query = {};
-    this._request(endpoint, function (err, req, res, body) {
+    if (opts.credentials) {
+        query.credentials = 'true';
+    }
+    var p = this._path(format('/%s/machines/%s', this.account, opts.id), query);
+    this._request(p, function (err, req, res, body) {
         cb(err, body, res);
     });
 };
@@ -883,7 +1333,6 @@ function enableMachineFirewall(uuid, callback) {
     return this._doMachine('enable_firewall', uuid, callback);
 };
 
-
 /**
  * Disables machine firewall.
  *
@@ -895,6 +1344,28 @@ function disableMachineFirewall(uuid, callback) {
     return this._doMachine('disable_firewall', uuid, callback);
 };
 
+/**
+ * Enables machine deletion protection.
+ *
+ * @param {String} id (required) The machine id.
+ * @param {Function} callback of the form `function (err, null, res)`
+ */
+CloudApi.prototype.enableMachineDeletionProtection =
+function enableMachineDeletionProtection(uuid, callback) {
+    return this._doMachine('enable_deletion_protection', uuid, callback);
+};
+
+/**
+ * Disables machine deletion protection.
+ *
+ * @param {String} id (required) The machine id.
+ * @param {Function} callback of the form `function (err, null, res)`
+ */
+CloudApi.prototype.disableMachineDeletionProtection =
+function disableMachineDeletionProtection(uuid, callback) {
+    return this._doMachine('disable_deletion_protection', uuid, callback);
+};
+
 /**
  * internal function for start/stop/reboot/enable_firewall/disable_firewall
  */
@@ -1027,7 +1498,7 @@ CloudApi.prototype.createMachine = function createMachine(options, callback) {
     assert.optionalString(options.name, 'options.name');
     assert.uuid(options.image, 'options.image');
     assert.uuid(options.package, 'options.package');
-    assert.optionalArrayOfUuid(options.networks, 'options.networks');
+    assert.optionalArray(options.networks, 'options.networks');
     // TODO: assert the other fields
     assert.func(callback, 'callback');
 
@@ -1105,6 +1576,53 @@ function waitForMachineFirewallEnabled(opts, cb) {
 };
 
 
+
+/**
+ * Wait for a machine's `deletion_protection` field to go true or
+ * false/undefined.
+ *
+ * @param {Object} options
+ *      - {String} id: Required. The machine UUID.
+ *      - {Boolean} state: Required. The desired `deletion_protection` state.
+ *      - {Number} interval: Optional. Time (in ms) to poll.
+ * @param {Function} callback of the form f(err, machine, res).
+ */
+CloudApi.prototype.waitForDeletionProtectionEnabled =
+function waitForDeletionProtectionEnabled(opts, cb) {
+    var self = this;
+
+    assert.object(opts, 'opts');
+    assert.uuid(opts.id, 'opts.id');
+    assert.bool(opts.state, 'opts.state');
+    assert.optionalNumber(opts.interval, 'opts.interval');
+    assert.func(cb, 'cb');
+
+    var interval = opts.interval || 1000;
+    assert.ok(interval > 0, 'interval must be a positive number');
+
+    poll();
+
+    function poll() {
+        self.getMachine({
+            id: opts.id
+        }, function getMachineCb(err, machine, res) {
+            if (err) {
+                cb(err, null, res);
+                return;
+            }
+
+            // !! converts an undefined to a false
+            if (opts.state === !!machine.deletion_protection) {
+                cb(null, machine, res);
+                return;
+            }
+
+            setTimeout(poll, interval);
+        });
+    }
+};
+
+
 // --- machine tags
 
 /**
@@ -1413,6 +1931,150 @@ function deleteMachineSnapshot(opts, cb) {
 };
 
 
+// --- NICs
+
+/**
+ * Adds a NIC on a network to an instance.
+ *
+ * @param {Object} options object containing:
+ *      - {String} id (required) the instance id.
+ *      - {String|Object} (required) network uuid or network object.
+ * @param {Function} callback of the form f(err, nic, res).
+ */
+CloudApi.prototype.addNic =
+function addNic(opts, cb) {
+    assert.object(opts, 'opts');
+    assert.uuid(opts.id, 'opts.id');
+    assert.ok(opts.network, 'opts.network');
+
+    var data = {
+        network: opts.network
+    };
+
+    this._request({
+        method: 'POST',
+        path: format('/%s/machines/%s/nics', this.account, opts.id),
+        data: data
+    }, function (err, req, res, body) {
+        cb(err, body, res);
+    });
+};
+
+/**
+ * Lists all NICs on an instance.
+ *
+ * Returns an array of objects.
+ *
+ * @param opts {Object} Options
+ *      - {String} id (required) the instance id.
+ * @param {Function} callback of the form f(err, nics, res).
+ */
+CloudApi.prototype.listNics =
+function listNics(opts, cb) {
+    assert.object(opts, 'opts');
+    assert.uuid(opts.id, 'opts.id');
+    assert.func(cb, 'cb');
+
+    var endpoint = format('/%s/machines/%s/nics', this.account, opts.id);
+    this._passThrough(endpoint, opts, cb);
+};
+
+
+/**
+ * Retrieves a NIC on an instance.
+ *
+ * @param {Object} options object containing:
+ *      - {UUID} id: The instance id. Required.
+ *      - {String} mac: The NIC's MAC. Required.
+ * @param {Function} callback of the form `function (err, nic, res)`
+ */
+CloudApi.prototype.getNic =
+function getNic(opts, cb) {
+    assert.object(opts, 'opts');
+    assert.uuid(opts.id, 'opts.id');
+    assert.string(opts.mac, 'opts.mac');
+    assert.func(cb, 'cb');
+
+    var mac = opts.mac.replace(/:/g, '');
+    var endpoint = format('/%s/machines/%s/nics/%s', this.account, opts.id,
+                          mac);
+    this._request(endpoint, function (err, req, res, body) {
+        cb(err, body, res);
+    });
+};
+
+
+/**
+ * Remove a NIC off an instance.
+ *
+ * @param {Object} opts (object)
+ *      - {UUID} id: The instance id. Required.
+ *      - {String} mac: The NIC's MAC. Required.
+ * @param {Function} cb of the form `function (err, res)`
+ */
+CloudApi.prototype.removeNic =
+function removeNic(opts, cb) {
+    assert.object(opts, 'opts');
+    assert.uuid(opts.id, 'opts.id');
+    assert.string(opts.mac, 'opts.mac');
+    assert.func(cb, 'cb');
+
+    var mac = opts.mac.replace(/:/g, '');
+
+    this._request({
+        method: 'DELETE',
+        path: format('/%s/machines/%s/nics/%s', this.account, opts.id, mac)
+    }, function (err, req, res) {
+        cb(err, res);
+    });
+};
+
+
+/**
+ * Wait for a machine's nic to go one of a set of specfic states.
+ *
+ * @param {Object} options
+ *      - {String} id {required} machine id
+ *      - {String} mac {required} mac for new nic
+ *      - {Array of String} states - desired state
+ *      - {Number} interval (optional) - time in ms to poll
+ * @param {Function} callback of the form f(err, nic, res).
+ */
+CloudApi.prototype.waitForNicStates =
+function waitForNicStates(opts, cb) {
+    var self = this;
+
+    assert.object(opts, 'opts');
+    assert.uuid(opts.id, 'opts.id');
+    assert.string(opts.mac, 'opts.mac');
+    assert.arrayOfString(opts.states, 'opts.states');
+    assert.optionalNumber(opts.interval, 'opts.interval');
+    assert.func(cb, 'cb');
+
+    var interval = opts.interval || 1000;
+    assert.ok(interval > 0, 'interval must be a positive number');
+
+    poll();
+
+    function poll() {
+        self.getNic({
+            id: opts.id,
+            mac: opts.mac
+        }, function onPoll(err, nic, res) {
+            if (err) {
+                cb(err, null, res);
+                return;
+            }
+            if (opts.states.indexOf(nic.state) !== -1) {
+                cb(null, nic, res);
+                return;
+            }
+            setTimeout(poll, interval);
+        });
+    }
+};
+
+
 // --- firewall rules
 
 /**
@@ -2275,7 +2937,165 @@ CloudApi.prototype.setRoleTags = function setRoleTags(opts, cb) {
     });
 };
 
+/**
+ * Get a volume by id.
+ *
+ * @param {Object} opts
+ *      - id {UUID} Required. The volume id.
+ * @param {Function} cb of the form `function (err, volume, res)`
+ */
+CloudApi.prototype.getVolume = function getVolume(opts, cb) {
+    assert.object(opts, 'opts');
+    assert.uuid(opts.id, 'opts.id');
 
+    var endpoint = format('/%s/volumes/%s', this.account, opts.id);
+    this._passThrough(endpoint, cb);
+};
+
+/**
+ * List the account's volumes.
+ *
+ * @param {Object} options
+ * @param {Function} callback - called like `function (err, volumes)`
+ */
+CloudApi.prototype.listVolumes = function listVolumes(options, cb) {
+    var endpoint = format('/%s/volumes', this.account);
+    this._passThrough(endpoint, options, cb);
+};
+
+/**
+ * List the account's volume sizes.
+ *
+ * @param {Object} options
+ * @param {Function} callback - called like `function (err, volumeSizes)`
+ */
+CloudApi.prototype.listVolumeSizes = function listVolumeSizes(options, cb) {
+    var endpoint = format('/%s/volumesizes', this.account);
+    this._passThrough(endpoint, options, cb);
+};
+
+/**
+ * Create a volume for the account.
+ *
+ * @param {Object} options
+ *      - name {String} Optional: the name of the volume to be created
+ *      - size {Number} Optional: a number representing the size of the volume
+ *        to be created in mebibytes.
+ *      - networks {Array} Optional: an array that contains the uuids of all the
+ *        networks that should be reachable from the newly created volume
+ *      - type {String}: the type of the volume. Currently, only "tritonnfs" is
+ *        supported.
+ * @param {Function} callback - called like `function (err, volume, res)`
+ */
+CloudApi.prototype.createVolume = function createVolume(options, cb) {
+    assert.object(options, 'options');
+    assert.optionalString(options.name, 'options.name');
+    assert.optionalNumber(options.size, 'options.size');
+    assert.optionalArrayOfUuid(options.networks, 'options.networks');
+    assert.string(options.type, 'options.type');
+    assert.func(cb, 'cb');
+
+    this._request({
+        method: 'POST',
+        path: format('/%s/volumes', this.account),
+        data: {
+            name: options.name,
+            size: options.size,
+            networks: (options.networks ? options.networks : undefined),
+            type: options.type
+        }
+    }, function (err, req, res, body) {
+        cb(err, body, res);
+    });
+};
+
+/**
+ * Delete an account's volume.
+ *
+ * @param {String} volumeUuid
+ * @param {Function} callback - called like `function (err, volume, res)`
+ */
+CloudApi.prototype.deleteVolume = function deleteVolume(volumeUuid, cb) {
+    assert.uuid(volumeUuid, 'volumeUuid');
+    assert.func(cb, 'cb');
+
+    this._request({
+        method: 'DELETE',
+        path: format('/%s/volumes/%s', this.account, volumeUuid)
+    }, function (err, req, res, body) {
+        cb(err, res);
+    });
+};
+
+
+/**
+ * Wait for a volume to go one of a set of specfic states.
+ *
+ * @param {Object} options
+ *      - {String} id - machine UUID
+ *      - {Array of String} states - desired state
+ *      - {Number} interval (optional) - time in ms to poll
+ *      - {Number} timeout (optional) - time in ms after which "callback" is
+ *        called with an error object if the volume hasn't yet transitioned to
+ *        one of the states in "opts.states".
+ * @param {Function} callback - called when state is reached or on error
+ */
+CloudApi.prototype.waitForVolumeStates =
+function waitForVolumeStates(opts, callback) {
+    var self = this;
+    assert.object(opts, 'opts');
+    assert.uuid(opts.id, 'opts.id');
+    assert.arrayOfString(opts.states, 'opts.states');
+    assert.optionalNumber(opts.interval, 'opts.interval');
+    assert.optionalNumber(opts.timeout, 'opts.timeout');
+    assert.func(callback, 'callback');
+
+    var interval = (opts.interval === undefined ? 1000 : opts.interval);
+    if (opts.timeout !== undefined) {
+        interval = Math.min(interval, opts.timeout);
+    }
+    assert.ok(interval > 0, 'interval must be a positive number');
+
+    var startTime = process.hrtime();
+    var timeout = opts.timeout;
+
+    poll();
+
+    function poll() {
+        self.getVolume({
+            id: opts.id
+        }, function (err, vol, res) {
+            var elapsedTime;
+            var timedOut = false;
+
+            if (err) {
+                callback(err, null, res);
+                return;
+            }
+            if (opts.states.indexOf(vol.state) !== -1) {
+                callback(null, vol, res);
+                return;
+            } else {
+                if (timeout !== undefined) {
+                    elapsedTime = common.monotonicTimeDiffMs(startTime);
+                    if (elapsedTime > timeout) {
+                        timedOut = true;
+                    }
+                }
+
+                if (timedOut) {
+                    callback(new errors.TimeoutError(format('timeout waiting '
+                        + 'for state changes on volume %s (elapsed %ds)',
+                        opts.id, Math.round(elapsedTime / 1000))));
+                    return;
+                } else {
+                    setTimeout(poll, interval);
+                    return;
+                }
+            }
+        });
+    }
+};
 
 // --- Exports
 

lib/common.js

@@ -5,7 +5,7 @@
  */
 
 /*
- * Copyright 2017 Joyent, Inc.
+ * Copyright (c) 2018, Joyent, Inc.
  */
 
 var assert = require('assert-plus');
@@ -24,7 +24,8 @@ var wordwrap = require('wordwrap');
 
 var errors = require('./errors'),
     InternalError = errors.InternalError;
-
+var NETWORK_OBJECT_FIELDS =
+    require('./constants').NETWORK_OBJECT_FIELDS;
 
 
 // ---- support stuff
@@ -126,34 +127,138 @@ function jsonStream(arr, stream) {
 }
 
 /**
- * given an array of key=value pairs, break them into an object
+ * Parses the string "kv" of the form 'key=value' and returns an object that
+ * represents it with the form {'key': value}. If "key"" in the "kv" string is
+ * not included in the list "validKeys", it throws an error. It also throws an
+ * error if the string "kv" is malformed.
+ *
+ * By default, converts the values as if they were JSON representations of JS
+ * types, e.g the string 'false' is converted to the boolean primitive "false".
+ *
+ * @param {String} kv
+ * @param {Array} validKeys: Optional array of strings or regexes matching
+ *      valid keys.
+ * @param {Object} options: Optional
+ *      - @param disableTypeConversions {Boolean} Optional. If true, then no
+ *        type conversion of values is performed, and all values are returned as
+ *        strings.
+ *      - @param typeHintFromKey {Object} Optional. Type hints for input keys.
+ *        E.g. if parsing 'foo=false' and `typeHintFromKey={foo: 'string'}`,
+ *        then we do NOT parse it to a boolean `false`.
+ *      - @param failOnEmptyValue {Boolean} Optional - If true, throws an error
+ *        if a given key's value is the empty string. Default is false.
+ */
+function _parseKeyValue(kv, validKeys, options) {
+    assert.string(kv, 'kv');
+    assert.optionalArray(validKeys, 'validKeys');
+    assert.optionalObject(options, 'options');
+    options = options || {};
+    assert.optionalBool(options.disableTypeConversions,
+        'options.disableTypeConversions');
+    assert.optionalObject(options.typeHintFromKey, 'options.typeHintFromKey');
+    assert.optionalBool(options.failOnEmptyValue, 'options.failOnEmptyValue');
+
+    var i;
+    var idx = kv.indexOf('=');
+    if (idx === -1) {
+        throw new errors.UsageError(format('invalid key=value: "%s"', kv));
+    }
+    var k = kv.slice(0, idx);
+    var typeHint;
+    var v = kv.slice(idx + 1);
+    var validKey;
+
+    if (validKeys) {
+        var foundMatch = false;
+        for (i = 0; i < validKeys.length; i++) {
+            validKey = validKeys[i];
+            if ((validKey instanceof RegExp && validKey.test(k)) ||
+                k === validKey) {
+                foundMatch = true;
+                break;
+            }
+        }
+        if (!foundMatch) {
+            throw new errors.UsageError(format(
+                'invalid key: "%s" (must match one of: %s)',
+                k, validKeys.join(', ')));
+        }
+    }
+
+    if (v === '' && options.failOnEmptyValue) {
+        throw new Error(format('key "%s" must have a value', k));
+    }
+
+    if (options.disableTypeConversions !== true) {
+        if (options.typeHintFromKey !== undefined) {
+            typeHint = options.typeHintFromKey[k];
+        }
+
+        if (typeHint === 'string') {
+            // Leave `v` a string.
+            /* jsl:pass */
+        } else if (v === '') {
+            v = null;
+        } else {
+            try {
+                v = JSON.parse(v);
+            } catch (e) {
+                /* pass */
+            }
+        }
+    }
+
+    return {
+        key: k,
+        value: v
+    };
+}
+
+
+/**
+ * given an array of key=value pairs, break them into a JSON predicate
  *
  * @param {Array} kvs - an array of key=value pairs
- * @param {Array} valid (optional) - an array to validate pairs
+ * @param {Array} validKeys: Optional array of strings or regexes matching
- *
+ *      valid keys.
- * TODO: merge this with objFromKeyValueArgs !
+ * @param {String} compositionType - the way each key/value pair will be
+ *  combined to form a JSON predicate. Valid values are 'or' and 'and'.
  */
-function kvToObj(kvs, valid) {
+function jsonPredFromKv(kvs, validKeys, compositionType) {
     assert.arrayOfString(kvs, 'kvs');
-    assert.optionalArrayOfString(valid, 'valid');
+    assert.string(compositionType, 'string');
+    assert.ok(compositionType === 'or' || compositionType === 'and',
+        'compositionType');
 
-    var o = {};
+    var keyName;
-    for (var i = 0; i < kvs.length; i++) {
+    var predicate = {};
-        var kv = kvs[i];
+    var parsedKeyValue;
-        var idx = kv.indexOf('=');
+    var parsedKeyValues;
-        if (idx === -1)
+    var parseOpts = {
-             throw new errors.UsageError(format(
+        disableDotted: true,
-                'invalid filter: "%s" (must be of the form "field=value")',
+        validKeys: validKeys,
-                kv));
+        failOnEmptyValue: true
-        var k = kv.slice(0, idx);
+    };
-        var v = kv.slice(idx + 1);
+
-        if (valid && valid.indexOf(k) === -1)
+    if (kvs.length === 0) {
-             throw new errors.UsageError(format(
+        return predicate;
-                'invalid filter name: "%s" (must be one of "%s")',
-                k, valid.join('", "')));
-        o[k] = v;
     }
-    return o;
+
+    if (kvs.length === 1) {
+        parsedKeyValue = _parseKeyValue(kvs[0], validKeys, parseOpts);
+        predicate.eq = [parsedKeyValue.key, parsedKeyValue.value];
+    } else {
+        predicate[compositionType] = [];
+        parsedKeyValues = objFromKeyValueArgs(kvs, parseOpts);
+
+        for (keyName in parsedKeyValues) {
+            predicate[compositionType].push({
+                eq: [keyName, parsedKeyValues[keyName]]
+            });
+        }
+    }
+
+    return predicate;
 }
 
 /**
@@ -513,9 +618,9 @@ function promptYesNo(opts_, cb) {
     stdin.on('data', onData);
 
     function postInput() {
+        stdout.write('\n');
         stdin.setRawMode(false);
         stdin.pause();
-        stdin.write('\n');
         stdin.removeListener('data', onData);
     }
 
@@ -796,18 +901,26 @@ function cliSetupTritonApi(opts, cb) {
 function editInEditor(opts, cb) {
     assert.string(opts.text, 'opts.text');
     assert.optionalString(opts.filename, 'opts.filename');
+    assert.optionalObject(opts.log, 'opts.log');
     assert.func(cb, 'cb');
 
     var tmpPath = path.resolve(os.tmpDir(),
         format('triton-%s-edit-%s', process.pid, opts.filename || 'text'));
     fs.writeFileSync(tmpPath, opts.text, 'utf8');
 
-    // TODO: want '-f' opt for vi? What about others?
     var editor = process.env.EDITOR || '/usr/bin/vi';
-    var kid = child_process.spawn(editor, [tmpPath], {stdio: 'inherit'});
+    var argv = argvFromLine(format('%s "%s"', editor, tmpPath));
-    kid.on('exit', function (code) {
+    if (opts.log) {
-        if (code) {
+        opts.log.trace({argv: argv}, 'editInEditor argv');
-            return (cb(code));
+    }
+
+    var kid = child_process.spawn(argv[0], argv.slice(1), {stdio: 'inherit'});
+    kid.on('exit', function (code, signal) {
+        if (code || signal) {
+            cb(new errors.TritonError(format(
+                'editor terminated abnormally: argv=%j, code=%j, signal=%j',
+                argv, code, signal)));
+            return;
         }
         var afterText = fs.readFileSync(tmpPath, 'utf8');
         fs.unlinkSync(tmpPath);
@@ -1026,6 +1139,10 @@ function tildeSync(s) {
  *      - @param typeHintFromKey {Object} Optional. Type hints for input keys.
  *        E.g. if parsing 'foo=false' and `typeHintFromKey={foo: 'string'}`,
  *        then we do NOT parse it to a boolean `false`.
+ *      - @param {Array} validKeys: Optional array of strings or regexes
+ *        matching valid keys. By default all keys are valid.
+ *      - @param failOnEmptyValue {Boolean} Optional. If true, then a key with a
+ *        value that is the empty string throws an error. Default is false.
  */
 function objFromKeyValueArgs(args, opts)
 {
@@ -1033,45 +1150,30 @@ function objFromKeyValueArgs(args, opts)
     assert.optionalObject(opts, 'opts');
     opts = opts || {};
     assert.optionalBool(opts.disableDotted, 'opts.disableDotted');
+    assert.optionalBool(opts.disableTypeConversions,
+        'opts.disableTypeConversions');
     assert.optionalObject(opts.typeHintFromKey, opts.typeHintFromKey);
-    var typeHintFromKey = opts.typeHintFromKey || {};
+    assert.optionalBool(opts.failOnEmptyValue, 'opts.failOnEmptyValue');
 
     var obj = {};
     args.forEach(function (arg) {
-        var kv = strsplit(arg, '=', 2);
+        var parsedKeyValue = _parseKeyValue(arg, opts.validKeys, {
-        if (kv.length < 2) {
+            typeHintFromKey: opts.typeHintFromKey,
-            throw new TypeError(format('invalid key=value argument: "%s"',
+            disableTypeConversions: opts.disableTypeConversions,
-                arg));
+            failOnEmptyValue: opts.failOnEmptyValue
-        }
+        });
-
-        var k = kv[0];
-        var t = typeHintFromKey[k];
-
-        var v = kv[1];
-        if (t === 'string') {
-            // Leave `v` a string.
-            /* jsl:pass */
-        } else if (v === '') {
-            v = null;
-        } else {
-            try {
-                v = JSON.parse(v);
-            } catch (e) {
-                /* pass */
-            }
-        }
 
         if (opts.disableDotted) {
-            obj[k] = v;
+            obj[parsedKeyValue.key] = parsedKeyValue.value;
         } else {
-            var dotted = strsplit(k, '.', 2);
+            var dotted = strsplit(parsedKeyValue.key, '.', 2);
             if (dotted.length > 1) {
                 if (!obj[dotted[0]]) {
                     obj[dotted[0]] = {};
                 }
-                obj[dotted[0]][dotted[1]] = v;
+                obj[dotted[0]][dotted[1]] = parsedKeyValue.value;
             } else {
-                obj[k] = v;
+                obj[parsedKeyValue.key] = parsedKeyValue.value;
             }
         }
     });
@@ -1079,6 +1181,298 @@ function objFromKeyValueArgs(args, opts)
     return obj;
 }
 
+/**
+ * Returns the time difference between the current time and the time
+ * represented by "relativeTo" in milliseconds. It doesn't use the built-in
+ * `Date` class internally, and instead uses a node facility that uses a
+ * monotonic clock. Thus, the time difference computed is not subject to time
+ * drifting due to e.g changes in the wall clock system time.
+ *
+ * @param {arrayOfNumber} relativeTo: an array representing the starting time as
+ *        returned by `process.hrtime()` from which to compute the
+ *        time difference.
+ */
+function monotonicTimeDiffMs(relativeTo) {
+    assert.arrayOfNumber(relativeTo, 'relativeTo');
+
+    var diff = process.hrtime(relativeTo);
+    var ms = (diff[0] * 1e3) + (diff[1] / 1e6); // in milliseconds
+    return ms;
+}
+
+
+/*
+ * Parse the given line into an argument vector, e.g. for use in sending to
+ * `child_process.spawn(argv[0], argv.slice(1), ...)`.
+ *
+ * Translated from the Python `line2argv` in https://github.com/trentm/cmdln
+ * See also the tests in "test/unit/argvFromLine.test.js".
+ *
+ * @throws {Error} if there are unbalanced quotes or some other parse failure.
+ */
+function argvFromLine(line) {
+    assert.string(line, 'line');
+
+    var trimmed = line.trim();
+    var argv = [];
+    var state = 'default';
+    var arg = null; // the current argument being parsed
+    var i = -1;
+    var WHITESPACE = {
+        ' ': true,
+        '\t': true,
+        '\n': true,
+        '\r': true
+        // Other whitespace chars?
+    };
+
+    while (true) {
+        i += 1;
+        if (i >= trimmed.length) {
+            break;
+        }
+        var ch = trimmed[i];
+
+        // An escaped char always added to the arg.
+        if (ch == '\\' && i+1 < trimmed.length) {
+            if (arg === null) { arg = ''; }
+            /*
+             * Include the escaping backslash, unless it is escaping a quote
+             * inside a quoted string. E.g.:
+             *      foo\Xbar    =>  foo\Xbar
+             *      'foo\'bar'  =>  foo'bar
+             *      "foo\"bar"  =>  foo"bar
+             *
+             * Note that cmdln.py's line2argv had a Windows-specific subtlety
+             * here (dating to cmdln commit 87430930160f) that we are skipping
+             * for now.
+             */
+            if ((state === 'double-quoted' && trimmed[i+1] !== '"') ||
+                (state === 'single-quoted' && trimmed[i+1] !== '\'')) {
+                arg += ch;
+            }
+            i += 1;
+            arg += trimmed[i];
+            continue;
+        }
+
+        if (state === 'single-quoted') {
+            if (ch === '\'') {
+                state = 'default';
+            } else {
+                arg += ch;
+            }
+        } else if (state === 'double-quoted') {
+            if (ch === '"') {
+                state = 'default';
+            } else {
+                arg += ch;
+            }
+        } else if (state === 'default') {
+            if (ch === '"') {
+                if (arg === null) { arg = ''; }
+                state = 'double-quoted';
+            } else if (ch === '\'') {
+                if (arg === null) { arg = ''; }
+                state = 'single-quoted';
+            } else if (WHITESPACE.hasOwnProperty(ch)) {
+                if (arg !== null) {
+                    argv.push(arg);
+                }
+                arg = null;
+            } else {
+                if (arg === null) { arg = ''; }
+                arg += ch;
+            }
+        }
+    }
+    if (arg !== null) {
+        argv.push(arg);
+    }
+
+    /*
+     * Note: cmdln.py's line2argv would not throw this error on Windows, i.e.
+     * allowing unclosed quoted-strings. This impl. is not following that lead.
+     */
+    if (state !== 'default') {
+        throw new Error(format('unfinished %s segment in line: %j',
+            state, line));
+    }
+
+    return argv;
+}
+
+/*
+ * Read stdin in and callback with it as a string
+ *
+ * @param {Function} cb - callback in the form `function (str) {}`
+ */
+function readStdin(cb) {
+    assert.func(cb, 'cb');
+
+    var stdin = '';
+    process.stdin.setEncoding('utf8');
+    process.stdin.resume();
+    process.stdin.on('data', function stdinOnData(chunk) {
+        stdin += chunk;
+    });
+    process.stdin.on('end', function stdinOnEnd() {
+        cb(stdin);
+    });
+}
+
+/*
+ * Validate an object of values against an object of types.
+ *
+ * Example:
+ * var input = {
+ *     foo: 'hello',
+ *     bar: 42,
+ *     baz: true
+ * };
+ * var valid = {
+ *     foo: 'string',
+ *     bar: 'number',
+ *     baz: 'boolean'
+ * }
+ * validateObject(input, valid);
+ * // no error is thrown
+ *
+ * All keys in `input` are check for their matching counterparts in `valid`.
+ * If the key is not found in `valid`, or the type specified for the key in
+ * `valid` doesn't match the type of the value in `input` an error is thrown.
+ * Also an error is thrown (optionally, enabled by default) if the input object
+ * is empty.  Note that any keys found in `valid` not found in `input` are not
+ * considered an error.
+ *
+ * @param {Object} input - Required. Input object of values.
+ * @param {Object} valid - Required. Validation object of types.
+ * @param {Object} opts: Optional
+ *               - @param {Boolean} allowEmptyInput - don't consider an empty
+ *               input object an error
+ * @throws {Error} if the input object contains a key not found in the
+ * validation object
+ */
+function validateObject(input, valid, opts) {
+    opts = opts || {};
+
+    assert.object(input, 'input');
+    assert.object(valid, 'valid');
+    assert.object(opts, 'opts');
+    assert.optionalBool(opts.allowEmptyInput, 'opts.allowEmptyInput');
+
+    var validFields = Object.keys(valid).sort().join(', ');
+    var i = 0;
+
+    Object.keys(input).forEach(function (key) {
+        var value = input[key];
+        var type = valid[key];
+
+        if (!type) {
+            throw new errors.UsageError(format('unknown or ' +
+                'unupdateable field: %s (updateable fields are: %s)',
+                key, validFields));
+        }
+        assert.string(type, 'type');
+
+        if (typeof (value) !== type) {
+            throw new errors.UsageError(format('field "%s" must be ' +
+                'of type "%s", but got a value of type "%s"',
+                key, type, typeof (value)));
+        }
+        i++;
+    });
+
+    if (i === 0 && !opts.allowEmptyInput) {
+        throw new errors.UsageError('Input object must not be empty');
+    }
+}
+
+/*
+ * Convert an IPv4 address (as a string) to a number
+ */
+function ipv4ToLong(ip) {
+    var l = 0;
+    var spl;
+
+    assert.string(ip, 'ip');
+    spl = ip.split('.');
+    assert.equal(spl.length, 4, 'ip octet length');
+
+    spl.forEach(function processIpOctet(octet) {
+        octet = parseInt(octet, 10);
+
+        assert.number(octet, 'octet');
+        assert(octet >= 0, 'octet >= 0');
+        assert(octet < 256, 'octet < 256');
+
+        l <<= 8;
+        l += octet;
+    });
+
+    return l;
+}
+
+/*
+ * Parse the input from the `--nics <nic>` CLI argument.
+ *
+ * @param a {Array} The array of strings formatted as key=value
+ *                   ex: ['ipv4_uuid=1234', 'ipv4_ips=1.2.3.4|5.6.7.8']
+ * @return {Object} A network object.  From the example above:
+ * {
+ *     "ipv4_uuid": 1234,
+ *     "ipv4_ips": [
+ *         "1.2.3.4",
+ *         "5.6.7.8"
+ *      ]
+ * }
+ * Note: "1234" is used as the UUID for this example, but would actually cause
+ * `parseNicStr` to throw as it is not a valid UUID.
+ */
+function parseNicStr(nic) {
+    assert.arrayOfString(nic);
+
+    var obj = objFromKeyValueArgs(nic, {
+        disableDotted: true,
+        typeHintFromKey: NETWORK_OBJECT_FIELDS,
+        validKeys: Object.keys(NETWORK_OBJECT_FIELDS)
+    });
+
+    if (!obj.ipv4_uuid) {
+        throw new errors.UsageError(
+            'ipv4_uuid must be specified in network object');
+    }
+
+    if (obj.ipv4_ips) {
+        obj.ipv4_ips = obj.ipv4_ips.split('|');
+    }
+
+    assert.uuid(obj.ipv4_uuid, 'obj.ipv4_uuid');
+    assert.optionalArrayOfString(obj.ipv4_ips, 'obj.ipv4_ips');
+
+    /*
+     * Only 1 IP address may be specified at this time.  In the future, this
+     * limitation should be removed.
+     */
+    if (obj.ipv4_ips && obj.ipv4_ips.length !== 1) {
+        throw new errors.UsageError('only 1 ipv4_ip may be specified');
+    }
+
+    return obj;
+}
+
+/*
+ * Return a short image string that represents the given image object.
+ *
+ * @param img {Object} The image object.
+ * @returns {String} A network object. E.g.
+ *   'a6cf222d-73f4-414c-a427-5c238ef8e1b7 (jillmin@1.0.0)'
+ */
+function imageRepr(img) {
+    assert.object(img);
+
+    return format('%s (%s@%s)', img.id, img.name, img.version);
+}
 
 
 //---- exports
@@ -1090,7 +1484,6 @@ module.exports = {
     zeroPad: zeroPad,
     boolFromString: boolFromString,
     jsonStream: jsonStream,
-    kvToObj: kvToObj,
     longAgo: longAgo,
     isUUID: isUUID,
     humanDurationFromMs: humanDurationFromMs,
@@ -1115,6 +1508,14 @@ module.exports = {
     execPlus: execPlus,
     deepEqual: deepEqual,
     tildeSync: tildeSync,
-    objFromKeyValueArgs: objFromKeyValueArgs
+    objFromKeyValueArgs: objFromKeyValueArgs,
+    argvFromLine: argvFromLine,
+    jsonPredFromKv: jsonPredFromKv,
+    monotonicTimeDiffMs: monotonicTimeDiffMs,
+    readStdin: readStdin,
+    validateObject: validateObject,
+    ipv4ToLong: ipv4ToLong,
+    parseNicStr: parseNicStr,
+    imageRepr: imageRepr
 };
 // vim: set softtabstop=4 shiftwidth=4:

lib/config.js

@@ -62,6 +62,7 @@ var PROFILE_FIELDS = {
     keyId: true,
     insecure: true,
     user: true,
+    roles: true,
     actAsAccount: true
 };
 
@@ -220,20 +221,21 @@ function validateProfile(profile, profilePath) {
     try {
         assert.string(profile.name, 'profile.name');
         assert.string(profile.url,
-            profile.name === 'env' ? 'TRITON_URL or SDC_URL' : 'profile.url');
+            profile.name === 'env' ? 'SC_URL' : 'profile.url');
         assert.string(profile.account,
-            profile.name === 'env' ? 'TRITON_ACCOUNT or SDC_ACCOUNT'
+            profile.name === 'env' ? 'SC_ACCOUNT'
                 : 'profile.account');
         assert.string(profile.keyId,
-            profile.name === 'env' ? 'TRITON_KEY_ID or SDC_KEY_ID'
+            profile.name === 'env' ? 'SC_KEY_ID'
                 : 'profile.keyId');
         assert.optionalBool(profile.insecure,
-            profile.name === 'env' ? 'TRITON_INSECURE or SDC_INSECURE'
+            profile.name === 'env' ? 'SC_INSECURE'
                 : 'profile.insecure');
         assert.optionalString(profile.user,
-            profile.name === 'env' ? 'TRITON_USER or SDC_USER'
+            profile.name === 'env' ? 'SC_USER'
                 : 'profile.user');
         assert.optionalString(profile.actAsAccount, 'profile.actAsAccount');
+        assert.optionalArrayOfString(profile.roles, 'profile.roles');
     } catch (err) {
         var msg = format('invalid %sprofile%s: %s',
             profile.name ? '"' + profile.name + '" ' : '',
@@ -274,21 +276,18 @@ function _loadEnvProfile(profileOverrides) {
         name: 'env'
     };
 
-    envProfile.account = process.env.TRITON_ACCOUNT || process.env.SDC_ACCOUNT;
+    envProfile.account = process.env.SC_ACCOUNT;
-    var user = process.env.TRITON_USER || process.env.SDC_USER;
+    var user = process.env.SC_USER;
     if (user) {
         envProfile.user = user;
     }
-    envProfile.url = process.env.TRITON_URL || process.env.SDC_URL;
+    envProfile.url = process.env.SC_URL;
-    envProfile.keyId = process.env.TRITON_KEY_ID || process.env.SDC_KEY_ID;
+    envProfile.keyId = process.env.SC_KEY_ID;
 
-    if (process.env.TRITON_TLS_INSECURE) {
+    if (process.env.SC_TLS_INSECURE) {
         envProfile.insecure = common.boolFromString(
-            process.env.TRITON_TLS_INSECURE, undefined, 'TRITON_TLS_INSECURE');
+            process.env.SC_TLS_INSECURE, undefined, 'SC_TLS_INSECURE');
-    } else if (process.env.SDC_TLS_INSECURE) {
+    } else if (process.env.SC_TESTING) {
-        envProfile.insecure = common.boolFromString(
-            process.env.SDC_TLS_INSECURE, undefined, 'SDC_TLS_INSECURE');
-    } else if (process.env.SDC_TESTING) {
         // For compatibility with the legacy behavior of the smartdc
         // tools, *any* set value but the empty string is considered true.
         envProfile.insecure = true;
@@ -297,12 +296,11 @@ function _loadEnvProfile(profileOverrides) {
     for (var attr in profileOverrides) {
         envProfile[attr] = profileOverrides[attr];
     }
+
     /*
-     * If none of the above envvars are defined, then there is no env profile.
+     * If missing any of the required vars, then there is no env profile.
      */
-    if (!envProfile.account && !envProfile.user && !envProfile.url &&
+    if (!envProfile.account || !envProfile.url || !envProfile.keyId) {
-        !envProfile.keyId)
-    {
         return null;
     }
     validateProfile(envProfile, 'environment variables');
@@ -347,7 +345,7 @@ function loadProfile(opts) {
         var envProfile = _loadEnvProfile(opts.profileOverrides);
         if (!envProfile) {
             throw new errors.ConfigError('could not load "env" profile '
-                + '(missing TRITON_*, or SDC_*, environment variables)');
+                + '(missing SC_* environment variables)');
         }
         return envProfile;
     } else if (!opts.configDir) {
@@ -364,10 +362,11 @@ function loadProfile(opts) {
 function loadAllProfiles(opts) {
     assert.string(opts.configDir, 'opts.configDir');
     assert.object(opts.log, 'opts.log');
+    assert.optionalObject(opts.profileOverrides, 'opts.profileOverrides');
 
     var profiles = [];
 
-    var envProfile = _loadEnvProfile();
+    var envProfile = _loadEnvProfile(opts.profileOverrides);
     if (envProfile) {
         profiles.push(envProfile);
     }

lib/constants.js

@@ -30,8 +30,8 @@ var mod_path = require('path');
  * For *testing* only, we allow override of this dir.
  */
 var CLI_CONFIG_DIR;
-if (process.env.TRITONTEST_CLI_CONFIG_DIR) {
+if (process.env.SCTEST_CLI_CONFIG_DIR) {
-    CLI_CONFIG_DIR = process.env.TRITONTEST_CLI_CONFIG_DIR;
+    CLI_CONFIG_DIR = process.env.SCTEST_CLI_CONFIG_DIR;
 } else if (process.platform === 'win32') {
     /*
      * For better or worse we are using APPDATA (i.e. the *Roaming* AppData
@@ -41,16 +41,23 @@ if (process.env.TRITONTEST_CLI_CONFIG_DIR) {
      * TODO: We should likely separate out the *cache* subdir to
      * machine-specific data dir.
      */
-    CLI_CONFIG_DIR = mod_path.resolve(process.env.APPDATA, 'Joyent', 'Triton');
+    CLI_CONFIG_DIR = mod_path.resolve(process.env.APPDATA, 'Spearhead', 'sc');
 } else {
-    CLI_CONFIG_DIR = mod_path.resolve(process.env.HOME, '.triton');
+    CLI_CONFIG_DIR = mod_path.resolve(process.env.HOME, '.spearhead');
 }
 
+// <Network Object Key> -> <expected typeof>
+var NETWORK_OBJECT_FIELDS = {
+    ipv4_uuid: 'string',
+    ipv4_ips: 'string'
+};
+
 
 // ---- exports
 
 module.exports = {
-    CLI_CONFIG_DIR: CLI_CONFIG_DIR
+    CLI_CONFIG_DIR: CLI_CONFIG_DIR,
+    NETWORK_OBJECT_FIELDS: NETWORK_OBJECT_FIELDS
 };
 
 

lib/do_account/do_get.js

@@ -25,6 +25,7 @@ function do_get(subcmd, opts, args, callback) {
     common.cliSetupTritonApi({cli: this.top}, function onSetup(setupErr) {
         if (setupErr) {
             callback(setupErr);
+            return;
         }
         tritonapi.cloudapi.getAccount(function (err, account) {
             if (err) {

lib/do_account/do_update.js

@@ -72,12 +72,8 @@ function do_update(subcmd, opts, args, callback) {
                 next();
                 return;
             }
-            var stdin = '';
+
-            process.stdin.resume();
+            common.readStdin(function gotStdin(stdin) {
-            process.stdin.on('data', function (chunk) {
-                stdin += chunk;
-            });
-            process.stdin.on('end', function () {
                 try {
                     ctx.data = JSON.parse(stdin);
                 } catch (err) {
@@ -92,36 +88,18 @@ function do_update(subcmd, opts, args, callback) {
         },
 
         function validateIt(ctx, next) {
-            var keys = Object.keys(ctx.data);
+            try {
-            for (var i = 0; i < keys.length; i++) {
+                common.validateObject(ctx.data, UPDATE_ACCOUNT_FIELDS);
-                var key = keys[i];
+            } catch (e) {
-                var value = ctx.data[key];
+                next(e);
-                var type = UPDATE_ACCOUNT_FIELDS[key];
-                if (!type) {
-                    next(new errors.UsageError(format('unknown or ' +
-                        'unupdateable field: %s (updateable fields are: %s)',
-                        key,
-                        Object.keys(UPDATE_ACCOUNT_FIELDS).sort().join(', '))));
                 return;
             }
 
-                if (typeof (value) !== type) {
-                    next(new errors.UsageError(format('field "%s" must be ' +
-                        'of type "%s", but got a value of type "%s"', key,
-                        type, typeof (value))));
-                    return;
-                }
-            }
             next();
         },
 
         function updateAway(ctx, next) {
             var keys = Object.keys(ctx.data);
-            if (keys.length === 0) {
-                console.log('No fields given for account update');
-                next();
-                return;
-            }
 
             tritonapi.cloudapi.updateAccount(ctx.data, function (err) {
                 if (err) {

lib/do_account/index.js

@@ -23,7 +23,7 @@ function AccountCLI(top) {
         name: top.name + ' account',
         /* BEGIN JSSTYLED */
         desc: [
-            'Get and update your Triton account.'
+            'Get and update your Spearhead account.'
         ].join('\n'),
         /* END JSSTYLED */
         helpOpts: {

lib/do_create.js

@@ -20,7 +20,7 @@ function do_create(subcmd, opts, args, callback) {
     }, callback);
 }
 
-do_create.help = 'A shortcut for "triton instance create".\n' + targ.help;
+do_create.help = 'A shortcut for "spearhead instance create".\n' + targ.help;
 do_create.helpOpts = targ.helpOpts;
 do_create.synopses = targ.synopses;
 do_create.options = targ.options;

lib/do_datacenters.js

@@ -36,6 +36,7 @@ function do_datacenters(subcmd, opts, args, callback) {
     common.cliSetupTritonApi({cli: this}, function onSetup(setupErr) {
         if (setupErr) {
             callback(setupErr);
+            return;
         }
         tritonapi.cloudapi.listDatacenters(function (err, datacenters) {
             if (err) {

lib/do_delete.js

@@ -20,7 +20,7 @@ function do_delete(subcmd, opts, args, callback) {
     }, callback);
 }
 
-do_delete.help = 'A shortcut for "triton instance delete".\n' + targ.help;
+do_delete.help = 'A shortcut for "spearhead instance delete".\n' + targ.help;
 do_delete.synopses = targ.synopses;
 do_delete.options = targ.options;
 do_delete.completionArgtypes = targ.completionArgtypes;

lib/do_env.js

@@ -74,17 +74,17 @@ function do_env(subcmd, opts, args, cb) {
             p('# triton');
             if (opts.unset) {
                 [
-                    'TRITON_PROFILE',
+                    'SC_PROFILE',
-                    'TRITON_URL',
+                    'SC_URL',
-                    'TRITON_ACCOUNT',
+                    'SC_ACCOUNT',
-                    'TRITON_USER',
+                    'SC_USER',
-                    'TRITON_KEY_ID',
+                    'SC_KEY_ID',
-                    'TRITON_TLS_INSECURE'
+                    'SC_TLS_INSECURE'
                 ].forEach(function (key) {
                     p('unset %s', key);
                 });
             } else {
-                p('export TRITON_PROFILE="%s"', profile.name);
+                p('export SC_PROFILE="%s"', profile.name);
             }
             break;
         case 'docker':
@@ -160,10 +160,11 @@ function do_env(subcmd, opts, args, cb) {
     });
 
     p('# Run this command to configure your shell:');
-    p('#     eval "$(triton env%s%s)"',
+    p('#     eval "$(spearhead env%s%s)"',
         (shortOpts ? ' -'+shortOpts : ''),
         (profile.name === this.tritonapi.profile.name
             ? '' : ' ' + profile.name));
+    cb();
 }
 
 do_env.options = [
@@ -179,7 +180,7 @@ do_env.options = [
         names: ['triton', 't'],
         type: 'bool',
         help: 'Emit environment commands for node-triton itself (i.e. the ' +
-            '"TRITON_PROFILE" variable).'
+            '"SC_PROFILE" variable).'
     },
     {
         names: ['docker', 'd'],
@@ -209,8 +210,8 @@ do_env.help = [
     'Emit shell commands to setup environment.',
     '',
     'Supported "clients" here are: node-smartdc (i.e. the `sdc-*` tools),',
-    'and node-triton itself. By default this emits the environment for all',
+    'node-triton and spearhead-node. By default this emits the environment ',
-    'supported tools. Use options to be specific.',
+    'for all supported tools. Use options to be specific.',
     '',
     '{{usage}}',
     '',
@@ -219,7 +220,7 @@ do_env.help = [
     'clients. If PROFILE is not given, the current profile is used.',
     '',
     'The following Bash function can be added to one\'s "~/.bashrc" to quickly',
-    'change between Triton profiles:',
+    'change between Spearhead profiles:',
     '    triton-select () { eval "$(triton env $1)"; }',
     'for example:',
     '    $ triton-select west1',

lib/do_fwrule/do_create.js

@@ -49,6 +49,7 @@ function do_create(subcmd, opts, args, cb) {
     common.cliSetupTritonApi({cli: this.top}, function onSetup(setupErr) {
         if (setupErr) {
             cb(setupErr);
+            return;
         }
         tritonapi.cloudapi.createFirewallRule(
             createOpts, function (err, fwrule) {
@@ -79,7 +80,7 @@ do_create.options = [
         names: ['disabled', 'd'],
         type: 'bool',
         help: 'Disable the created firewall rule. By default a created '
-            + 'firewall rule is enabled. Use "triton fwrule enable" '
+            + 'firewall rule is enabled. Use "spearhead fwrule enable" '
             + 'to enable it later.'
     },
     {
@@ -101,10 +102,10 @@ do_create.help = [
     '{{options}}',
     'Examples:',
     '    # Allow SSH access from any IP to all instances in a datacenter.',
-    '    triton fwrule create -D "ssh" "FROM any TO all vms ALLOW tcp PORT 22"',
+    '    spearhead fwrule create -D "ssh" "FROM any TO all vms ALLOW tcp PORT 22"',
     '',
     '    # Allow SSH access to a specific instance.',
-    '    triton fwrule create \\',
+    '    spearhead fwrule create \\',
     '        "FROM any TO vm ba2c95e9-1cdf-4295-8253-3fee371374d9 ALLOW tcp PORT 22"'
     // TODO: link to
     // https://github.com/joyent/sdc-fwrule/blob/master/docs/examples.md

lib/do_fwrule/do_disable.js

@@ -34,6 +34,7 @@ function do_disable(subcmd, opts, args, cb) {
     common.cliSetupTritonApi({cli: this.top}, function onSetup(setupErr) {
         if (setupErr) {
             cb(setupErr);
+            return;
         }
         vasync.forEachParallel({
             inputs: args,

lib/do_fwrule/do_enable.js

@@ -34,6 +34,7 @@ function do_enable(subcmd, opts, args, cb) {
     common.cliSetupTritonApi({cli: this.top}, function onSetup(setupErr) {
         if (setupErr) {
             cb(setupErr);
+            return;
         }
         vasync.forEachParallel({
             inputs: args,

lib/do_fwrule/do_get.js

@@ -38,6 +38,7 @@ function do_get(subcmd, opts, args, cb) {
     common.cliSetupTritonApi({cli: this.top}, function onSetup(setupErr) {
         if (setupErr) {
             cb(setupErr);
+            return;
         }
         tritonapi.getFirewallRule(id, function onRule(err, fwrule) {
             if (err) {

lib/do_fwrule/do_instances.js

@@ -5,7 +5,7 @@
  */
 
 /*
- * Copyright 2016 Joyent, Inc.
+ * Copyright 2018 Joyent, Inc.
  *
  * `triton fwrule instances ...`
  */
@@ -57,6 +57,7 @@ function do_instances(subcmd, opts, args, cb) {
     common.cliSetupTritonApi({cli: this.top}, function onSetup(setupErr) {
         if (setupErr) {
             cb(setupErr);
+            return;
         }
         vasync.parallel({funcs: [
             function getTheImages(next) {
@@ -110,9 +111,11 @@ function do_instances(subcmd, opts, args, cb) {
                     common.uuidToShortId(inst.image);
                 inst.shortid = inst.id.split('-', 1)[0];
                 var flags = [];
+                if (inst.brand === 'bhyve') flags.push('B');
                 if (inst.docker) flags.push('D');
                 if (inst.firewall_enabled) flags.push('F');
                 if (inst.brand === 'kvm') flags.push('K');
+                if (inst.deletion_protection) flags.push('P');
                 inst.flags = flags.length ? flags.join('') : undefined;
             });
 
@@ -158,9 +161,11 @@ do_instances.help = [
     'for convenience):',
     '    shortid*           A short ID prefix.',
     '    flags*             Single letter flags summarizing some fields:',
+    '                           "B" the brand is "bhyve"',
     '                           "D" docker instance',
     '                           "F" firewall is enabled',
     '                           "K" the brand is "kvm"',
+    '                           "P" deletion protected',
     '    age*               Approximate time since created, e.g. 1y, 2w.',
     '    img*               The image "name@version", if available, else its',
     '                       "shortid".'

lib/do_fwrule/do_list.js

@@ -39,6 +39,7 @@ function do_list(subcmd, opts, args, cb) {
     common.cliSetupTritonApi({cli: this.top}, function onSetup(setupErr) {
         if (setupErr) {
             cb(setupErr);
+            return;
         }
         tritonapi.cloudapi.listFirewallRules({}, function onRules(err, rules) {
             if (err) {

lib/do_fwrule/do_update.js

@@ -84,14 +84,7 @@ function do_update(subcmd, opts, args, cb) {
                 return;
             }
 
-            var stdin = '';
+            common.readStdin(function gotStdin(stdin) {
-
-            process.stdin.resume();
-            process.stdin.on('data', function (chunk) {
-                stdin += chunk;
-            });
-
-            process.stdin.on('end', function () {
                 try {
                     ctx.data = JSON.parse(stdin);
                 } catch (err) {
@@ -107,33 +100,13 @@ function do_update(subcmd, opts, args, cb) {
         },
 
         function validateIt(ctx, next) {
-            var keys = Object.keys(ctx.data);
+            try {
-
+                common.validateObject(ctx.data, UPDATE_FWRULE_FIELDS);
-            if (keys.length === 0) {
+            } catch (e) {
-                console.log('No fields given for firewall rule update');
+                next(e);
-                next();
                 return;
             }
 
-            for (var i = 0; i < keys.length; i++) {
-                var key = keys[i];
-                var value = ctx.data[key];
-                var type = UPDATE_FWRULE_FIELDS[key];
-                if (!type) {
-                    next(new errors.UsageError(format('unknown or ' +
-                        'unupdateable field: %s (updateable fields are: %s)',
-                        key,
-                        Object.keys(UPDATE_FWRULE_FIELDS).sort().join(', '))));
-                    return;
-                }
-
-                if (typeof (value) !== type) {
-                    next(new errors.UsageError(format('field "%s" must be ' +
-                        'of type "%s", but got a value of type "%s"', key,
-                        type, typeof (value))));
-                    return;
-                }
-            }
             next();
         },
 

lib/do_fwrule/index.js

@@ -22,7 +22,7 @@ function FirewallRuleCLI(top) {
 
     Cmdln.call(this, {
         name: top.name + ' fwrule',
-        desc: 'List and manage Triton firewall rules.',
+        desc: 'List and manage Spearhead firewall rules.',
         helpSubcmds: [
             'help',
             'list',

lib/do_fwrules.js

@@ -20,7 +20,7 @@ function do_fwrules(subcmd, opts, args, callback) {
     }, callback);
 }
 
-do_fwrules.help = 'A shortcut for "triton fwrule list".\n' + targ.help;
+do_fwrules.help = 'A shortcut for "spearhead fwrule list".\n' + targ.help;
 do_fwrules.synopses = targ.synopses;
 do_fwrules.options = targ.options;
 do_fwrules.completionArgtypes = targ.completionArgtypes;

lib/do_image/do_clone.js

@@ -0,0 +1,107 @@
+/*
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ */
+
+/*
+ * Copyright (c) 2018, Joyent, Inc.
+ *
+ * `triton image clone ...`
+ */
+
+var vasync = require('vasync');
+
+var common = require('../common');
+var errors = require('../errors');
+
+// ---- the command
+
+function do_clone(subcmd, opts, args, cb) {
+    if (opts.help) {
+        this.do_help('help', {}, [subcmd], cb);
+        return;
+    } else if (args.length !== 1) {
+        cb(new errors.UsageError(
+            'incorrect number of args: expected 1, got ' + args.length));
+        return;
+    }
+
+    var log = this.top.log;
+    var tritonapi = this.top.tritonapi;
+
+    vasync.pipeline({arg: {cli: this.top}, funcs: [
+        common.cliSetupTritonApi,
+        function cloneImage(ctx, next) {
+            log.trace({dryRun: opts.dry_run, account: ctx.account},
+                'image clone account');
+
+            if (opts.dry_run) {
+                next();
+                return;
+            }
+
+            tritonapi.cloneImage({image: args[0]}, function _cloneCb(err, img) {
+                if (err) {
+                    next(new errors.TritonError(err, 'error cloning image'));
+                    return;
+                }
+
+                log.trace({img: img}, 'image clone result');
+
+                if (opts.json) {
+                    console.log(JSON.stringify(img));
+                } else {
+                    console.log('Cloned image %s to %s',
+                        args[0], common.imageRepr(img));
+                }
+
+                next();
+            });
+        }
+    ]}, cb);
+}
+
+do_clone.options = [
+    {
+        names: ['help', 'h'],
+        type: 'bool',
+        help: 'Show this help.'
+    },
+    {
+        group: 'Other options'
+    },
+    {
+        names: ['dry-run'],
+        type: 'bool',
+        help: 'Go through the motions without actually cloning.'
+    },
+    {
+        names: ['json', 'j'],
+        type: 'bool',
+        help: 'JSON stream output.'
+    }
+];
+
+do_clone.synopses = [
+    '{{name}} {{cmd}} [OPTIONS] IMAGE'
+];
+
+do_clone.help = [
+    /* BEGIN JSSTYLED */
+    'Clone a shared image.',
+    '',
+    '{{usage}}',
+    '',
+    '{{options}}',
+    'Where "IMAGE" is an image id (a full UUID), an image name (selects the',
+    'latest, by "published_at", image with that name), an image "name@version"',
+    '(selects latest match by "published_at"), or an image short ID (ID prefix).',
+    '',
+    'Note: Only shared images can be cloned.'
+    /* END JSSTYLED */
+].join('\n');
+
+do_clone.completionArgtypes = ['tritonimage', 'none'];
+
+module.exports = do_clone;

lib/do_image/do_copy.js

@@ -0,0 +1,119 @@
+/*
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ */
+
+/*
+ * Copyright (c) 2018, Joyent, Inc.
+ *
+ * `triton image copy ...`
+ */
+
+var vasync = require('vasync');
+
+var common = require('../common');
+var errors = require('../errors');
+
+// ---- the command
+
+function do_copy(subcmd, opts, args, cb) {
+    if (opts.help) {
+        this.do_help('help', {}, [subcmd], cb);
+        return;
+    } else if (args.length !== 2) {
+        cb(new errors.UsageError(
+            'incorrect number of args: expected 2, got ' + args.length));
+        return;
+    }
+
+    var log = this.top.log;
+    var tritonapi = this.top.tritonapi;
+
+    vasync.pipeline({arg: {cli: this.top}, funcs: [
+        common.cliSetupTritonApi,
+        function copyImage(ctx, next) {
+            log.trace({dryRun: opts.dry_run, account: ctx.account, args: args},
+                'image copy');
+
+            if (opts.dry_run) {
+                next();
+                return;
+            }
+
+            tritonapi.copyImageToDatacenter(
+                    {image: args[0], datacenter: args[1]},
+                    function (err, img) {
+                if (err) {
+                    next(new errors.TritonError(err, 'error copying image'));
+                    return;
+                }
+
+                log.trace({img: img}, 'image copy result');
+
+                if (opts.json) {
+                    console.log(JSON.stringify(img));
+                } else {
+                    console.log('Copied image %s to datacenter %s',
+                        common.imageRepr(img), args[1]);
+                }
+
+                next();
+            });
+        }
+    ]}, function (err) {
+        cb(err);
+    });
+}
+
+do_copy.options = [
+    {
+        names: ['help', 'h'],
+        type: 'bool',
+        help: 'Show this help.'
+    },
+    {
+        group: 'Other options'
+    },
+    {
+        names: ['dry-run'],
+        type: 'bool',
+        help: 'Go through the motions without actually copying.'
+    },
+    {
+        names: ['json', 'j'],
+        type: 'bool',
+        help: 'JSON stream output.'
+    }
+];
+
+do_copy.synopses = [
+    '{{name}} {{cmd}} [OPTIONS] IMAGE DATACENTER'
+];
+
+do_copy.help = [
+    /* BEGIN JSSTYLED */
+    'Copy image to another datacenter.',
+    '',
+    '{{usage}}',
+    '',
+    '{{options}}',
+    'Where "IMAGE" is an image id (a full UUID), an image name (selects the',
+    'latest, by "published_at", image with that name), an image "name@version"',
+    '(selects latest match by "published_at"), or an image short ID (ID prefix).',
+    'You must be the owner of the image to copy it. (You can use `triton image',
+    'clone` to get your own image clone of an image shared to you.)',
+    '',
+    '"DATACENTER" is the name of the datacenter to which to copy your image.',
+    'Use `triton datacenters` to show the available datacenter names.'
+    /* END JSSTYLED */
+].join('\n');
+
+do_copy.aliases = ['cp'];
+
+// TODO: tritonimage should really be 'tritonownedimage' or something to
+//  limit to images owned by this account
+// TODO: tritondatacenter bash completion
+do_copy.completionArgtypes = ['tritonimage', 'tritondatacenter', 'none'];
+
+module.exports = do_copy;

lib/do_image/do_export.js

@@ -0,0 +1,120 @@
+/*
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ */
+
+/*
+ * Copyright 2017 Joyent, Inc.
+ *
+ * `triton image export ...`
+ */
+
+var assert = require('assert-plus');
+var format = require('util').format;
+var vasync = require('vasync');
+
+var common = require('../common');
+var errors = require('../errors');
+
+// ---- the command
+
+function do_export(subcmd, opts, args, cb) {
+    if (opts.help) {
+        this.do_help('help', {}, [subcmd], cb);
+        return;
+    } else if (args.length !== 2) {
+        cb(new errors.UsageError(
+            'incorrect number of args: expect 2, got ' + args.length));
+        return;
+    }
+
+    var log = this.top.log;
+    var tritonapi = this.top.tritonapi;
+
+    vasync.pipeline({arg: {cli: this.top}, funcs: [
+        common.cliSetupTritonApi,
+        function exportImage(ctx, next) {
+            log.trace({dryRun: opts.dry_run, manta_path: ctx.manta_path},
+                'image export path');
+
+            console.log('Exporting image %s to %s', args[0], args[1]);
+
+            if (opts.dry_run) {
+                next();
+                return;
+            }
+
+            tritonapi.exportImage({
+                image: args[0],
+                manta_path: args[1]
+            }, function (err, exportInfo) {
+                if (err) {
+                    next(new errors.TritonError(err,
+                        'error exporting image to manta'));
+                    return;
+                }
+
+                log.trace({exportInfo: exportInfo}, 'image export: exportInfo');
+                ctx.exportInfo = exportInfo;
+                next();
+            });
+        },
+        function outputResults(ctx, next) {
+            if (opts.json) {
+                console.log(JSON.stringify(ctx.exportInfo));
+            } else {
+                console.log('    Manta URL: %s', ctx.exportInfo.manta_url);
+                console.log('Manifest path: %s', ctx.exportInfo.manifest_path);
+                console.log('   Image path: %s', ctx.exportInfo.image_path);
+            }
+            next();
+        }
+    ]}, function (err) {
+        cb(err);
+    });
+}
+
+do_export.options = [
+    {
+        names: ['help', 'h'],
+        type: 'bool',
+        help: 'Show this help.'
+    },
+    {
+        group: 'Other options'
+    },
+    {
+        names: ['dry-run'],
+        type: 'bool',
+        help: 'Go through the motions without actually exporting.'
+    },
+    {
+        names: ['json', 'j'],
+        type: 'bool',
+        help: 'JSON stream output.'
+    }
+];
+
+do_export.synopses = [
+    '{{name}} {{cmd}} [OPTIONS] IMAGE MANTA_PATH'
+];
+
+do_export.help = [
+    /* BEGIN JSSTYLED */
+    'Export an image.',
+    '',
+    '{{usage}}',
+    '',
+    '{{options}}',
+    'Where "IMAGE" is an image id (a full UUID), an image name (selects the',
+    'latest, by "published_at", image with that name), an image "name@version"',
+    '(selects latest match by "published_at"), or an image short ID (ID prefix).',
+    '',
+    'Note: Only images that are owned by the account can be exported.'
+    /* END JSSTYLED */
+].join('\n');
+
+do_export.completionArgtypes = ['tritonimage', 'none'];
+
+module.exports = do_export;

lib/do_image/do_get.js

@@ -29,8 +29,13 @@ function do_get(subcmd, opts, args, callback) {
     common.cliSetupTritonApi({cli: this.top}, function onSetup(setupErr) {
         if (setupErr) {
             callback(setupErr);
+            return;
         }
-        tritonapi.getImage(args[0], function onRes(err, img) {
+        var getOpts = {
+            name: args[0],
+            excludeInactive: !opts.all
+        };
+        tritonapi.getImage(getOpts, function onRes(err, img) {
             if (err) {
                 return callback(err);
             }
@@ -55,6 +60,15 @@ do_get.options = [
         names: ['json', 'j'],
         type: 'bool',
         help: 'JSON stream output.'
+    },
+    {
+        group: 'Filtering options'
+    },
+    {
+        names: ['all', 'a'],
+        type: 'bool',
+        help: 'Include all images when matching by name or short ID, not ' +
+            'just "active" ones. By default only active images are included.'
     }
 ];
 

lib/do_image/do_list.js

@@ -5,13 +5,15 @@
  */
 
 /*
- * Copyright 2016 Joyent, Inc.
+ * Copyright 2018 Joyent, Inc.
  *
  * `triton image list ...`
  */
 
+var assert = require('assert-plus');
 var format = require('util').format;
 var tabula = require('tabula');
+var vasync = require('vasync');
 
 var common = require('../common');
 var errors = require('../errors');
@@ -54,7 +56,11 @@ function do_list(subcmd, opts, args, callback) {
 
     var listOpts;
     try {
-        listOpts = common.kvToObj(args, validFilters);
+        listOpts = common.objFromKeyValueArgs(args, {
+            disableDotted: true,
+            validKeys: validFilters,
+            disableTypeConversions: true
+        });
     } catch (e) {
         callback(e);
         return;
@@ -63,16 +69,45 @@ function do_list(subcmd, opts, args, callback) {
         listOpts.state = 'all';
     }
 
+    var self = this;
     var tritonapi = this.top.tritonapi;
-    common.cliSetupTritonApi({cli: this.top}, function onSetup(setupErr) {
+
-        if (setupErr) {
+    vasync.pipeline({ arg: {}, funcs: [
-            callback(setupErr);
+        function setupTritonApi(_, next) {
-        }
+            common.cliSetupTritonApi({cli: self.top}, next);
+        },
+        function getImages(ctx, next) {
             tritonapi.listImages(listOpts, function onRes(err, imgs, res) {
                 if (err) {
-                return callback(err);
+                    next(err);
+                    return;
                 }
-
+                ctx.imgs = imgs;
+                next();
+            });
+        },
+        function getUserAccount(ctx, next) {
+            // If using json output, or when there are no images that use an ACL
+            // - we don't need to fetch the account, as the account is only used
+            // to check if the image is shared (i.e. the account is in the image
+            // ACL) so it can output image flags in non-json mode.
+            if (opts.json || ctx.imgs.every(function _checkAcl(img) {
+                return !Array.isArray(img.acl) || img.acl.length === 0;
+            })) {
+                next();
+                return;
+            }
+            tritonapi.cloudapi.getAccount(function _accountCb(err, account) {
+                if (err) {
+                    next(err);
+                    return;
+                }
+                ctx.account = account;
+                next();
+            });
+        },
+        function formatImages(ctx, next) {
+            var imgs = ctx.imgs;
             if (opts.json) {
                 common.jsonStream(imgs);
             } else {
@@ -94,6 +129,20 @@ function do_list(subcmd, opts, args, callback) {
                     if (img.origin) flags.push('I');
                     if (img['public']) flags.push('P');
                     if (img.state !== 'active') flags.push('X');
+
+                    // Add image sharing flags.
+                    if (Array.isArray(img.acl) && img.acl.length > 0) {
+                        assert.string(ctx.account.id, 'ctx.account.id');
+                        if (img.owner === ctx.account.id) {
+                            // This image has been shared with other accounts.
+                            flags.push('+');
+                        }
+                        if (img.acl.indexOf(ctx.account.id) !== -1) {
+                            // This image has been shared with this account.
+                            flags.push('S');
+                        }
+                    }
+
                     img.flags = flags.length ? flags.join('') : undefined;
                 }
 
@@ -103,9 +152,9 @@ function do_list(subcmd, opts, args, callback) {
                     sort: sort
                 });
             }
-            callback();
+            next();
-        });
+        }
-    });
+    ]}, callback);
 }
 
 do_list.options = [
@@ -136,7 +185,6 @@ do_list.help = [
     '',
     'Note: Currently, *docker* images are not included in this endpoint\'s responses.',
     'You must use `docker images` against the Docker service for this data center.',
-    'See <https://apidocs.joyent.com/docker>.',
     '',
     '{{usage}}',
     '',
@@ -152,6 +200,8 @@ do_list.help = [
     '    shortid*           A short ID prefix.',
     '    flags*             Single letter flags summarizing some fields:',
     '                           "P" image is public',
+    '                           "+" you are sharing this image with others',
+    '                           "S" this image has been shared with you',
     '                           "I" an incremental image (i.e. has an origin)',
     '                           "X" has a state *other* than "active"',
     '    pubdate*           Short form of "published_at" with just the date',

lib/do_image/do_share.js

@@ -0,0 +1,115 @@
+/*
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ */
+
+/*
+ * Copyright (c) 2018, Joyent, Inc.
+ *
+ * `triton image share ...`
+ */
+
+var format = require('util').format;
+var vasync = require('vasync');
+
+var common = require('../common');
+var errors = require('../errors');
+
+// ---- the command
+
+function do_share(subcmd, opts, args, cb) {
+    if (opts.help) {
+        this.do_help('help', {}, [subcmd], cb);
+        return;
+    } else if (args.length !== 2) {
+        cb(new errors.UsageError(
+            'incorrect number of args: expect 2, got ' + args.length));
+        return;
+    }
+
+    var log = this.top.log;
+    var tritonapi = this.top.tritonapi;
+
+    vasync.pipeline({arg: {cli: this.top}, funcs: [
+        common.cliSetupTritonApi,
+        function shareImage(ctx, next) {
+            log.trace({dryRun: opts.dry_run, account: ctx.account},
+                'image share account');
+
+            if (opts.dry_run) {
+                next();
+                return;
+            }
+
+            tritonapi.shareImage({
+                image: args[0],
+                account: args[1]
+            }, function (err, img) {
+                if (err) {
+                    next(new errors.TritonError(err, 'error sharing image'));
+                    return;
+                }
+
+                log.trace({img: img}, 'image share result');
+
+                if (opts.json) {
+                    console.log(JSON.stringify(img));
+                } else {
+                    console.log('Shared image %s with account %s',
+                        args[0], args[1]);
+                }
+
+                next();
+            });
+        }
+    ]}, function (err) {
+        cb(err);
+    });
+}
+
+do_share.options = [
+    {
+        names: ['help', 'h'],
+        type: 'bool',
+        help: 'Show this help.'
+    },
+    {
+        group: 'Other options'
+    },
+    {
+        names: ['dry-run'],
+        type: 'bool',
+        help: 'Go through the motions without actually sharing.'
+    },
+    {
+        names: ['json', 'j'],
+        type: 'bool',
+        help: 'JSON stream output.'
+    }
+];
+
+do_share.synopses = [
+    '{{name}} {{cmd}} [OPTIONS] IMAGE ACCOUNT'
+];
+
+do_share.help = [
+    /* BEGIN JSSTYLED */
+    'Share an image with another account.',
+    '',
+    '{{usage}}',
+    '',
+    '{{options}}',
+    'Where "IMAGE" is an image id (a full UUID), an image name (selects the',
+    'latest, by "published_at", image with that name), an image "name@version"',
+    '(selects latest match by "published_at"), or an image short ID (ID prefix).',
+    '',
+    'Where "ACCOUNT" is the full account UUID.',
+    '',
+    'Note: Only images that are owned by the account can be shared.'
+    /* END JSSTYLED */
+].join('\n');
+
+do_share.completionArgtypes = ['tritonimage', 'none'];
+
+module.exports = do_share;

lib/do_image/do_unshare.js

@@ -0,0 +1,115 @@
+/*
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ */
+
+/*
+ * Copyright (c) 2018, Joyent, Inc.
+ *
+ * `triton image unshare ...`
+ */
+
+var format = require('util').format;
+var vasync = require('vasync');
+
+var common = require('../common');
+var errors = require('../errors');
+
+// ---- the command
+
+function do_unshare(subcmd, opts, args, cb) {
+    if (opts.help) {
+        this.do_help('help', {}, [subcmd], cb);
+        return;
+    } else if (args.length !== 2) {
+        cb(new errors.UsageError(
+            'incorrect number of args: expect 2, got ' + args.length));
+        return;
+    }
+
+    var log = this.top.log;
+    var tritonapi = this.top.tritonapi;
+
+    vasync.pipeline({arg: {cli: this.top}, funcs: [
+        common.cliSetupTritonApi,
+        function unshareImage(ctx, next) {
+            log.trace({dryRun: opts.dry_run, account: ctx.account},
+                'image unshare account');
+
+            if (opts.dry_run) {
+                next();
+                return;
+            }
+
+            tritonapi.unshareImage({
+                image: args[0],
+                account: args[1]
+            }, function (err, img) {
+                if (err) {
+                    next(new errors.TritonError(err, 'error unsharing image'));
+                    return;
+                }
+
+                log.trace({img: img}, 'image unshare result');
+
+                if (opts.json) {
+                    console.log(JSON.stringify(img));
+                } else {
+                    console.log('Unshared image %s with account %s',
+                        args[0], args[1]);
+                }
+
+                next();
+            });
+        }
+    ]}, function (err) {
+        cb(err);
+    });
+}
+
+do_unshare.options = [
+    {
+        names: ['help', 'h'],
+        type: 'bool',
+        help: 'Show this help.'
+    },
+    {
+        group: 'Other options'
+    },
+    {
+        names: ['dry-run'],
+        type: 'bool',
+        help: 'Go through the motions without actually sharing.'
+    },
+    {
+        names: ['json', 'j'],
+        type: 'bool',
+        help: 'JSON stream output.'
+    }
+];
+
+do_unshare.synopses = [
+    '{{name}} {{cmd}} [OPTIONS] IMAGE ACCOUNT'
+];
+
+do_unshare.help = [
+    /* BEGIN JSSTYLED */
+    'Unshare an image with another account.',
+    '',
+    '{{usage}}',
+    '',
+    '{{options}}',
+    'Where "IMAGE" is an image id (a full UUID), an image name (selects the',
+    'latest, by "published_at", image with that name), an image "name@version"',
+    '(selects latest match by "published_at"), or an image short ID (ID prefix).',
+    '',
+    'Where "ACCOUNT" is the full account UUID.',
+    '',
+    'Note: Only images that are owned by the account can be unshared.'
+    /* END JSSTYLED */
+].join('\n');
+
+do_unshare.completionArgtypes = ['tritonimage', 'none'];
+
+module.exports = do_unshare;

lib/do_image/do_wait.js

@@ -123,7 +123,7 @@ do_wait.help = [
     '',
     '{{options}}',
     'Where "states" is a comma-separated list of target instance states,',
-    'by default "active,failed". In other words, "triton img wait foo0" will',
+    'by default "active,failed". In other words, "spearhead img wait foo0" will',
     'wait for image "foo0" to complete creation.'
 ].join('\n');
 

lib/do_image/index.js

@@ -5,7 +5,7 @@
  */
 
 /*
- * Copyright 2015 Joyent, Inc.
+ * Copyright (c) 2018, Joyent, Inc.
  *
  * `triton image ...`
  */
@@ -23,7 +23,7 @@ function ImageCLI(top) {
         name: top.name + ' image',
         /* BEGIN JSSTYLED */
         desc: [
-            'List and manage Triton images.'
+            'List and manage Spearhead images.'
         ].join('\n'),
         /* END JSSTYLED */
         helpOpts: {
@@ -33,8 +33,13 @@ function ImageCLI(top) {
             'help',
             'list',
             'get',
+            'clone',
+            'copy',
             'create',
             'delete',
+            'export',
+            'share',
+            'unshare',
             'wait'
         ]
     });
@@ -48,8 +53,13 @@ ImageCLI.prototype.init = function init(opts, args, cb) {
 
 ImageCLI.prototype.do_list = require('./do_list');
 ImageCLI.prototype.do_get = require('./do_get');
+ImageCLI.prototype.do_clone = require('./do_clone');
+ImageCLI.prototype.do_copy = require('./do_copy');
 ImageCLI.prototype.do_create = require('./do_create');
 ImageCLI.prototype.do_delete = require('./do_delete');
+ImageCLI.prototype.do_export = require('./do_export');
+ImageCLI.prototype.do_share = require('./do_share');
+ImageCLI.prototype.do_unshare = require('./do_unshare');
 ImageCLI.prototype.do_wait = require('./do_wait');
 
 

lib/do_images.js

@@ -20,7 +20,7 @@ function do_images(subcmd, opts, args, callback) {
     }, callback);
 }
 
-do_images.help = 'A shortcut for "triton image list".\n' + targ.help;
+do_images.help = 'A shortcut for "spearhead image list".\n' + targ.help;
 do_images.synopses = targ.synopses;
 do_images.options = targ.options;
 do_images.completionArgtypes = targ.completionArgtypes;

lib/do_info.js

@@ -33,6 +33,7 @@ function do_info(subcmd, opts, args, callback) {
     common.cliSetupTritonApi({cli: this}, function onSetup(setupErr) {
         if (setupErr) {
             callback(setupErr);
+            return;
         }
         tritonapi.cloudapi.getAccount(cb.bind('account'));    i++;
         tritonapi.cloudapi.listMachines(cb.bind('machines')); i++;

lib/do_instance/do_audit.js

@@ -53,6 +53,10 @@ function do_audit(subcmd, opts, args, cb) {
     var tritonapi = this.top.tritonapi;
 
     common.cliSetupTritonApi({cli: this.top}, function onSetup(setupErr) {
+        if (setupErr) {
+            cb(setupErr);
+            return;
+        }
         if (common.isUUID(arg)) {
             uuid = arg;
             go1();

lib/do_instance/do_create.js

@@ -5,7 +5,7 @@
  */
 
 /*
- * Copyright 2016 Joyent, Inc.
+ * Copyright 2019 Joyent, Inc.
  *
  * `triton instance create ...`
  */
@@ -19,7 +19,65 @@ var common = require('../common');
 var distractions = require('../distractions');
 var errors = require('../errors');
 var mat = require('../metadataandtags');
+var NETWORK_OBJECT_FIELDS =
+    require('../constants').NETWORK_OBJECT_FIELDS;
 
+function parseVolMount(volume) {
+    var components;
+    var volMode;
+    var volMountpoint;
+    var volName;
+    var VALID_MODES = ['ro', 'rw'];
+    var VALID_VOLUME_NAME_REGEXP = /^[a-zA-Z0-9][a-zA-Z0-9_\.\-]+$/;
+
+    assert.string(volume, 'volume');
+
+    components = volume.split(':');
+    if (components.length !== 2 && components.length !== 3) {
+        return new errors.UsageError('invalid volume specified, must be in ' +
+            'the form "<volume name>:<mount path>[:<mode>]", got: "' + volume +
+            '"');
+    }
+
+    volName = components[0];
+    volMountpoint = components[1];
+    volMode = components[2];
+
+    // first component should be a volume name. We only check here that it
+    // syntactically looks like a volume name, we'll leave the upstream to
+    // determine if it's not actually a volume.
+    if (!VALID_VOLUME_NAME_REGEXP.test(volName)) {
+        return new errors.UsageError('invalid volume name, got: "' + volume +
+            '"');
+    }
+
+    // second component should be an absolute path
+    // NOTE: if we ever move past node 0.10, we could use path.isAbsolute(path)
+    if (volMountpoint.length === 0 || volMountpoint[0] !== '/') {
+        return new errors.UsageError('invalid volume mountpoint, must be ' +
+            'absolute path, got: "' + volume + '"');
+    }
+    if (volMountpoint.indexOf('\0') !== -1) {
+        return new errors.UsageError('invalid volume mountpoint, contains ' +
+            'invalid characters, got: "' + volume + '"');
+    }
+    if (volMountpoint.search(/[^\/]/) === -1) {
+        return new errors.UsageError('invalid volume mountpoint, must contain' +
+            ' at least one non-/ character, got: "' + volume + '"');
+    }
+
+    // third component is optional mode: 'ro' or 'rw'
+    if (components.length === 3 && VALID_MODES.indexOf(volMode) === -1) {
+        return new errors.UsageError('invalid volume mode, got: "' + volume +
+            '"');
+    }
+
+    return {
+        mode: volMode || 'rw',
+        mountpoint: volMountpoint,
+        name: volName
+    };
+}
 
 function do_create(subcmd, opts, args, cb) {
     if (opts.help) {
@@ -27,6 +85,9 @@ function do_create(subcmd, opts, args, cb) {
         return;
     } else if (args.length !== 2) {
         return cb(new errors.UsageError('incorrect number of args'));
+    } else if (opts.nic && opts.network) {
+        return cb(new errors.UsageError(
+            '--network and --nic cannot be specified together'));
     }
 
     var log = this.top.log;
@@ -34,160 +95,82 @@ function do_create(subcmd, opts, args, cb) {
 
     vasync.pipeline({arg: {cli: this.top}, funcs: [
         common.cliSetupTritonApi,
-        /* BEGIN JSSTYLED */
+
         /*
-         * Parse --affinity options for validity to `ctx.affinities`.
+         * Make sure if volumes were passed, they're in the correct form.
-         * Later (in `resolveLocality`) we'll translate this to locality hints
-         * that CloudAPI speaks.
-         *
-         * Some examples. Inspired by
-         * <https://docs.docker.com/swarm/scheduler/filter/#how-to-write-filter-expressions>
-         *
-         *      instance==vm1
-         *      container==vm1      # alternative to 'instance'
-         *      inst==vm1           # alternative to 'instance'
-         *      inst=vm1            # '=' is shortcut for '=='
-         *      inst!=vm1           # '!='
-         *      inst==~vm1          # '~' for soft/non-strict
-         *      inst!=~vm1
-         *
-         *      inst==vm*           # globbing (not yet supported)
-         *      inst!=/vm\d/        # regex (not yet supported)
-         *
-         *      some-tag!=db        # tags (not yet supported)
-         *
-         * Limitations:
-         * - no support for tags yet
-         * - no globbing or regex yet
-         * - we resolve name -> instance id *client-side* for now (until
-         *   CloudAPI supports that)
-         * - Triton doesn't support mixed strict and non-strict, so we error
-         *   out on that. We *could* just drop the non-strict, but that is
-         *   slightly different.
          */
-        /* END JSSTYLED */
+        function parseVolMounts(ctx, next) {
-        function parseAffinity(ctx, next) {
+            var idx;
-            if (!opts.affinity) {
+            var validationErrs = [];
+            var parsedObj;
+            var volMounts = [];
+
+            if (!opts.volume) {
                 next();
                 return;
             }
 
-            var affinities = [];
+            for (idx = 0; idx < opts.volume.length; idx++) {
+                parsedObj = parseVolMount(opts.volume[idx]);
+                if (parsedObj instanceof Error) {
+                    validationErrs.push(parsedObj);
+                } else {
+                    // if it's not an error, it's a volume
+                    volMounts.push(parsedObj);
+                }
+            }
 
-            // TODO: stricter rules on the value part
+            if (validationErrs.length > 0) {
-            // JSSTYLED
+                next(new errors.MultiError(validationErrs));
-            var affinityRe = /((instance|inst|container)(==~|!=~|==|!=|=~|=))?(.*?)$/;
-            for (var i = 0; i < opts.affinity.length; i++) {
-                var raw = opts.affinity[i];
-                var match = affinityRe.exec(raw);
-                if (!match) {
-                    next(new errors.UsageError(format('invalid affinity: "%s"',
-                        raw)));
                 return;
             }
 
-                var key = match[2];
+            if (volMounts.length > 0) {
-                if ([undefined, 'inst', 'container'].indexOf(key) !== -1) {
+                ctx.volMounts = volMounts;
-                    key = 'instance';
-                }
-                assert.equal(key, 'instance');
-                var op = match[3];
-                if ([undefined, '='].indexOf(op) !== -1) {
-                    op = '==';
-                }
-                var strict = true;
-                if (op[op.length - 1] === '~') {
-                    strict = false;
-                    op = op.slice(0, op.length - 1);
-                }
-                var val = match[4];
-
-                // Guard against mixed strictness (Triton can't handle those).
-                if (affinities.length > 0) {
-                    var lastAff = affinities[affinities.length - 1];
-                    if (strict !== lastAff.strict) {
-                        next(new errors.TritonError(format('mixed strict and '
-                            + 'non-strict affinities are not supported: '
-                            + '%j (%s) and %j (%s)',
-                            lastAff.raw,
-                            (lastAff.strict ? 'strict' : 'non-strict'),
-                            raw, (strict ? 'strict' : 'non-strict'))));
-                        return;
-                    }
             }
 
-                affinities.push({
-                    raw: raw,
-                    key: key,
-                    op: op,
-                    strict: strict,
-                    val: val
-                });
-            }
-
-            if (affinities.length) {
-                log.trace({affinities: affinities}, 'affinities');
-                ctx.affinities = affinities;
-            }
             next();
         },
 
         /*
-         * Determine `ctx.locality` according to what CloudAPI supports
+         * Parse any nics given via `--nic`
-         * based on `ctx.affinities` parsed earlier.
          */
-        function resolveLocality(ctx, next) {
+        function parseNics(ctx, next) {
-            if (!ctx.affinities) {
+            if (!opts.nic) {
                 next();
                 return;
             }
 
-            var strict;
+            ctx.nics = [];
-            var near = [];
+            var i;
-            var far = [];
+            var networksSeen = {};
+            var nic;
+            var nics = opts.nic;
 
-            vasync.forEachPipeline({
+            log.trace({nics: nics}, 'parsing nics');
-                inputs: ctx.affinities,
-                func: function resolveAffinity(aff, nextAff) {
-                    assert.ok(['==', '!='].indexOf(aff.op) !== -1,
-                        'unexpected op: ' + aff.op);
-                    var nearFar = (aff.op == '==' ? near : far);
 
-                    strict = aff.strict;
+            for (i = 0; i < nics.length; i++) {
-                    if (common.isUUID(aff.val)) {
+                nic = nics[i].split(',');
-                        nearFar.push(aff.val);
+
-                        nextAff();
+                try {
-                    } else {
+                    nic = common.parseNicStr(nic);
-                        tritonapi.getInstance({
+                    if (networksSeen[nic.ipv4_uuid]) {
-                            id: aff.val,
+                        throw new errors.UsageError(format(
-                            fields: ['id']
+                            'only 1 ip on a network allowed '
-                        }, function (err, inst) {
+                            + '(network %s specified multiple times)',
-                            if (err) {
+                            nic.ipv4_uuid));
-                                nextAff(err);
-                            } else {
-                                log.trace({val: aff.val, inst: inst.id},
-                                    'resolveAffinity');
-                                nearFar.push(inst.id);
-                                nextAff();
                     }
-                        });
+                    networksSeen[nic.ipv4_uuid] = true;
-                    }
+                    ctx.nics.push(nic);
-                }
+                } catch (err) {
-            }, function (err) {
-                if (err) {
                     next(err);
                     return;
                 }
+            }
 
-                ctx.locality = {
+            log.trace({nics: ctx.nics}, 'parsed nics');
-                    strict: strict
-                };
-                if (near.length > 0) ctx.locality.near = near;
-                if (far.length > 0) ctx.locality.far = far;
-                log.trace({locality: ctx.locality}, 'resolveLocality');
 
             next();
-            });
         },
 
         function loadMetadata(ctx, next) {
@@ -220,6 +203,7 @@ function do_create(subcmd, opts, args, cb) {
         function getImg(ctx, next) {
             var _opts = {
                 name: args[0],
+                excludeInactive: true,
                 useCache: true
             };
             tritonapi.getImage(_opts, function (err, img) {
@@ -274,15 +258,27 @@ function do_create(subcmd, opts, args, cb) {
         },
 
         function createInst(ctx, next) {
+            assert.optionalArrayOfObject(ctx.volMounts, 'ctx.volMounts');
+
             var createOpts = {
                 name: opts.name,
                 image: ctx.img.id,
-                'package': ctx.pkg && ctx.pkg.id,
+                'package': ctx.pkg && ctx.pkg.id
-                networks: ctx.nets && ctx.nets.map(
-                    function (net) { return net.id; })
             };
-            if (ctx.locality) {
+
-                createOpts.locality = ctx.locality;
+            if (ctx.nets) {
+                createOpts.networks = ctx.nets.map(function (net) {
+                    return net.id;
+                });
+            } else if (ctx.nics) {
+                createOpts.networks = ctx.nics;
+            }
+
+            if (ctx.volMounts) {
+                createOpts.volumes = ctx.volMounts;
+            }
+            if (opts.affinity) {
+                createOpts.affinity = opts.affinity;
             }
             if (ctx.metadata) {
                 Object.keys(ctx.metadata).forEach(function (key) {
@@ -294,11 +290,16 @@ function do_create(subcmd, opts, args, cb) {
                     createOpts['tag.'+key] = ctx.tags[key];
                 });
             }
+            if (opts.allow_shared_images) {
+                createOpts.allow_shared_images = true;
+            }
 
             for (var i = 0; i < opts._order.length; i++) {
                 var opt = opts._order[i];
                 if (opt.key === 'firewall') {
                     createOpts.firewall_enabled = opt.value;
+                } else if (opt.key === 'deletion_protection') {
+                    createOpts.deletion_protection = opt.value;
                 }
             }
 
@@ -422,9 +423,7 @@ do_create.options = [
             'INST), `instance==~INST` (*attempt* to place on the same server ' +
             'as INST), or `instance!=~INST` (*attempt* to place on a server ' +
             'other than INST\'s). `INST` is an existing instance name or ' +
-            'id. There are two shortcuts: `inst` may be used instead of ' +
+            'id. Use this option more than once for multiple rules.',
-            '`instance` and `instance==INST` can be shortened to just ' +
-            '`INST`. Use this option more than once for multiple rules.',
         completionType: 'tritonaffinityrule'
     },
 
@@ -439,12 +438,39 @@ do_create.options = [
             'This option can be used multiple times.',
         completionType: 'tritonnetwork'
     },
+    {
+        names: ['nic'],
+        type: 'arrayOfString',
+        helpArg: 'NICOPTS',
+        help: 'A network interface object containing comma separated ' +
+            'key=value pairs (Network object format). ' +
+            'This option can be used multiple times for multiple NICs. ' +
+            'Valid keys are: ' + Object.keys(NETWORK_OBJECT_FIELDS).join(', ')
+    },
     {
         // TODO: add boolNegationPrefix:'no-' when that cmdln pull is in
         names: ['firewall'],
         type: 'bool',
         help: 'Enable Cloud Firewall on this instance. See ' +
-            '<https://docs.joyent.com/public-cloud/network/firewall>'
+            '<https://docs.spearhead.cloud/network/firewall>'
+    },
+    {
+        names: ['deletion-protection'],
+        type: 'bool',
+        help: 'Enable Deletion Protection on this instance. Such an instance ' +
+            'cannot be deleted until the protection is disabled. See ' +
+            '<https://apidocs.joyent.com/cloudapi/#deletion-protection>'
+    },
+    {
+        names: ['volume', 'v'],
+        type: 'arrayOfString',
+        help: 'Mount a volume into the instance (non-KVM only). VOLMOUNT is ' +
+            '"<volume-name:/mount/point>[:access-mode]" where access mode is ' +
+            'one of "ro" for read-only or "rw" for read-write (default). For ' +
+            'example: "-v myvolume:/mnt:ro" to mount "myvolume" read-only on ' +
+            '/mnt in this instance.',
+        helpArg: 'VOLMOUNT',
+        hidden: true
     },
 
     {
@@ -476,6 +502,11 @@ do_create.options = [
             'Joyent-provided images, the user-script is run at every boot ' +
             'of the instance. This is a shortcut for `-M user-script=FILE`.'
     },
+    {
+        names: ['allow-shared-images'],
+        type: 'bool',
+        help: 'Allow instance creation to use a shared image.'
+    },
 
     {
         group: 'Other options'
@@ -508,8 +539,8 @@ do_create.help = [
     '',
     '{{options}}',
     'Where IMAGE is an image name, name@version, id, or short id (from ',
-    '`triton image list`) and PACKAGE is a package name, id, or short id',
+    '`spearhead image list`) and PACKAGE is a package name, id, or short id',
-    '(from `triton package list`).'
+    '(from `spearhead package list`).'
     /* END JSSTYLED */
 ].join('\n');
 

lib/do_instance/do_disable_deletion_protection.js

@@ -0,0 +1,125 @@
+/*
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ */
+
+/*
+ * Copyright 2018 Joyent, Inc.
+ *
+ * `triton instance disable-deletion-protection ...`
+ */
+
+var assert = require('assert-plus');
+var vasync = require('vasync');
+
+var common = require('../common');
+var errors = require('../errors');
+
+
+function do_disable_deletion_protection(subcmd, opts, args, cb) {
+    assert.object(opts, 'opts');
+    assert.arrayOfString(args, 'args');
+    assert.func(cb, 'cb');
+
+    if (opts.help) {
+        this.do_help('help', {}, [subcmd], cb);
+        return;
+    }
+
+    if (args.length === 0) {
+        cb(new errors.UsageError('missing INST argument(s)'));
+        return;
+    }
+
+    var cli = this.top;
+
+    function wait(name, id, next) {
+        assert.string(name, 'name');
+        assert.uuid(id, 'id');
+        assert.func(next, 'next');
+
+        cli.tritonapi.cloudapi.waitForDeletionProtectionEnabled({
+            id: id,
+            state: false
+        }, function (err, inst) {
+            if (err) {
+                next(err);
+                return;
+            }
+
+            assert.ok(!inst.deletion_protection, 'inst ' + id
+                + ' deletion_protection not in expected state after '
+                + 'waitForDeletionProtectionEnabled');
+
+            console.log('Disabled deletion protection for instance "%s"', name);
+            next();
+        });
+    }
+
+    function disableOne(name, next) {
+        assert.string(name, 'name');
+        assert.func(next, 'next');
+
+        cli.tritonapi.disableInstanceDeletionProtection({
+            id: name
+        }, function disableProtectionCb(err, fauxInst) {
+            if (err) {
+                next(err);
+                return;
+            }
+
+            console.log('Disabling deletion protection for instance "%s"',
+                name);
+
+            if (opts.wait) {
+                wait(name, fauxInst.id, next);
+            } else {
+                next();
+            }
+        });
+    }
+
+    common.cliSetupTritonApi({cli: cli}, function onSetup(setupErr) {
+        if (setupErr) {
+            cb(setupErr);
+            return;
+        }
+
+        vasync.forEachParallel({
+            inputs: args,
+            func: disableOne
+        }, function vasyncCb(err) {
+            cb(err);
+        });
+    });
+}
+
+
+do_disable_deletion_protection.options = [
+    {
+        names: ['help', 'h'],
+        type: 'bool',
+        help: 'Show this help.'
+    },
+    {
+        names: ['wait', 'w'],
+        type: 'bool',
+        help: 'Wait for deletion protection to be removed.'
+    }
+];
+do_disable_deletion_protection.synopses = [
+    '{{name}} disable-deletion-protection [OPTIONS] INST [INST ...]'
+];
+do_disable_deletion_protection.help = [
+    'Disable deletion protection on one or more instances.',
+    '',
+    '{{usage}}',
+    '',
+    '{{options}}',
+    'Where "INST" is an instance name, id, or short id.'
+].join('\n');
+
+do_disable_deletion_protection.completionArgtypes = ['tritoninstance'];
+
+module.exports = do_disable_deletion_protection;

lib/do_instance/do_disable_firewall.js

@@ -54,6 +54,7 @@ function do_disable_firewall(subcmd, opts, args, cb) {
     common.cliSetupTritonApi({cli: this.top}, function onSetup(setupErr) {
         if (setupErr) {
             cb(setupErr);
+            return;
         }
         vasync.forEachParallel({
             inputs: args,

lib/do_instance/do_enable_deletion_protection.js

@@ -0,0 +1,125 @@
+/*
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ */
+
+/*
+ * Copyright 2018 Joyent, Inc.
+ *
+ * `triton instance enable-deletion-protection ...`
+ */
+
+var assert = require('assert-plus');
+var vasync = require('vasync');
+
+var common = require('../common');
+var errors = require('../errors');
+
+
+function do_enable_deletion_protection(subcmd, opts, args, cb) {
+    assert.object(opts, 'opts');
+    assert.arrayOfString(args, 'args');
+    assert.func(cb, 'cb');
+
+    if (opts.help) {
+        this.do_help('help', {}, [subcmd], cb);
+        return;
+    }
+
+    if (args.length === 0) {
+        cb(new errors.UsageError('missing INST argument(s)'));
+        return;
+    }
+
+    var cli = this.top;
+
+    function wait(name, id, next) {
+        assert.string(name, 'name');
+        assert.uuid(id, 'id');
+        assert.func(next, 'next');
+
+       cli.tritonapi.cloudapi.waitForDeletionProtectionEnabled({
+            id: id,
+            state: true
+        }, function (err, inst) {
+            if (err) {
+                next(err);
+                return;
+            }
+
+            assert.ok(inst.deletion_protection, 'inst ' + id
+                + ' deletion_protection not in expected state after '
+                + 'waitForDeletionProtectionEnabled');
+
+            console.log('Enabled deletion protection for instance "%s"', name);
+            next();
+        });
+    }
+
+    function enableOne(name, next) {
+        assert.string(name, 'name');
+        assert.func(next, 'next');
+
+        cli.tritonapi.enableInstanceDeletionProtection({
+            id: name
+        }, function enableProtectionCb(err, fauxInst) {
+            if (err) {
+                next(err);
+                return;
+            }
+
+            console.log('Enabling deletion protection for instance "%s"',
+                name);
+
+            if (opts.wait) {
+                wait(name, fauxInst.id, next);
+            } else {
+                next();
+            }
+        });
+    }
+
+    common.cliSetupTritonApi({cli: cli}, function onSetup(setupErr) {
+        if (setupErr) {
+            cb(setupErr);
+            return;
+        }
+
+        vasync.forEachParallel({
+            inputs: args,
+            func: enableOne
+       }, function vasyncCb(err) {
+            cb(err);
+        });
+    });
+}
+
+
+do_enable_deletion_protection.options = [
+    {
+        names: ['help', 'h'],
+        type: 'bool',
+        help: 'Show this help.'
+    },
+    {
+        names: ['wait', 'w'],
+        type: 'bool',
+        help: 'Wait for deletion protection to be enabled.'
+    }
+];
+do_enable_deletion_protection.synopses = [
+    '{{name}} enable-deletion-protection [OPTIONS] INST [INST ...]'
+];
+do_enable_deletion_protection.help = [
+    'Enable deletion protection for one or more instances.',
+    '',
+    '{{usage}}',
+    '',
+    '{{options}}',
+    'Where "INST" is an instance name, id, or short id.'
+].join('\n');
+
+do_enable_deletion_protection.completionArgtypes = ['tritoninstance'];
+
+module.exports = do_enable_deletion_protection;

lib/do_instance/do_enable_firewall.js

@@ -54,6 +54,7 @@ function do_enable_firewall(subcmd, opts, args, cb) {
     common.cliSetupTritonApi({cli: this.top}, function onSetup(setupErr) {
         if (setupErr) {
             cb(setupErr);
+            return;
         }
         vasync.forEachParallel({
             inputs: args,

lib/do_instance/do_fwrule/do_list.js

@@ -44,6 +44,7 @@ function do_list(subcmd, opts, args, cb) {
     common.cliSetupTritonApi({cli: this.top}, function onSetup(setupErr) {
         if (setupErr) {
             cb(setupErr);
+            return;
         }
         tritonapi.listInstanceFirewallRules({
             id: id

lib/do_instance/do_fwrule/index.js

@@ -19,7 +19,7 @@ function InstanceFwruleCLI(parent) {
     Cmdln.call(this, {
         name: parent.name + ' fwrule',
         desc: [
-            'List fwrules on Triton instances.'
+            'List fwrules on Spearhead instances.'
         ].join('\n'),
         helpOpts: {
             minHelpCol: 24 /* line up with option help */

lib/do_instance/do_get.js

@@ -23,8 +23,12 @@ function do_get(subcmd, opts, args, cb) {
     common.cliSetupTritonApi({cli: this.top}, function onSetup(setupErr) {
         if (setupErr) {
             cb(setupErr);
+            return;
         }
-        tritonapi.getInstance(args[0], function (err, inst) {
+        tritonapi.getInstance({
+            id: args[0],
+            credentials: opts.credentials
+        }, function onInst(err, inst) {
             if (inst) {
                 if (opts.json) {
                     console.log(JSON.stringify(inst));
@@ -43,6 +47,13 @@ do_get.options = [
         type: 'bool',
         help: 'Show this help.'
     },
+    {
+        names: ['credentials'],
+        type: 'bool',
+        help: 'Include generated credentials, in the "metadata.credentials" ' +
+            'field, if any. Typically used with "-j", though one can show ' +
+            'values with "-o metadata.credentials".'
+    },
     {
         names: ['json', 'j'],
         type: 'bool',
@@ -57,7 +68,6 @@ do_get.help = [
     '{{usage}}',
     '',
     '{{options}}',
-    '',
     'Where "INST" is an instance name, id, or short id.',
     '',
     'A *deleted* instance may still respond with the instance object. In that',

lib/do_instance/do_ip.js

@@ -33,6 +33,7 @@ function do_ip(subcmd, opts, args, cb) {
     common.cliSetupTritonApi({cli: this.top}, function onSetup(setupErr) {
         if (setupErr) {
             cb(setupErr);
+            return;
         }
         cli.tritonapi.getInstance(args[0], function (err, inst) {
             if (err) {
@@ -70,7 +71,7 @@ do_ip.help = [
     '',
     '{{options}}',
     'Where "INST" is an instance name, id, or short id.',
-    'For example: ssh root@$(triton ip my-instance)'
+    'For example: ssh root@$(spearhead ip my-instance)'
 ].join('\n');
 
 

lib/do_instance/do_list.js

@@ -5,7 +5,7 @@
  */
 
 /*
- * Copyright 2016 Joyent, Inc.
+ * Copyright (c) 2018, Joyent, Inc.
  *
  * `triton instance list ...`
  */
@@ -22,13 +22,16 @@ var common = require('../common');
  * See <https://apidocs.joyent.com/cloudapi/#ListMachines>.
  */
 var validFilters = [
-    'type',
     'brand', // Added in CloudAPI 8.0.0
-    'name',
+    'docker', // Added in CloudAPI 8.0.0
     'image',
-    'state',
     'memory',
-    'docker'  // Added in CloudAPI 8.0.0
+    'name',
+    'state',
+    // jsl:ignore
+    /^tag\./,
+    // jsl:end
+    'type'
 ];
 
 // columns default without -o
@@ -61,7 +64,11 @@ function do_list(subcmd, opts, args, callback) {
 
     var listOpts;
     try {
-        listOpts = common.kvToObj(args, validFilters);
+        listOpts = common.objFromKeyValueArgs(args, {
+            disableDotted: true,
+            validKeys: validFilters,
+            disableTypeConversions: true
+        });
     } catch (e) {
         callback(e);
         return;
@@ -70,13 +77,13 @@ function do_list(subcmd, opts, args, callback) {
         listOpts.credentials = true;
     }
 
-
     var imgs = [];
     var insts;
 
     common.cliSetupTritonApi({cli: this.top}, function onSetup(setupErr) {
         if (setupErr) {
             callback(setupErr);
+            return;
         }
         vasync.parallel({funcs: [
             function getTheImages(next) {
@@ -143,9 +150,11 @@ function do_list(subcmd, opts, args, callback) {
                     common.uuidToShortId(inst.image);
                 inst.shortid = inst.id.split('-', 1)[0];
                 var flags = [];
+                if (inst.brand === 'bhyve') flags.push('B');
                 if (inst.docker) flags.push('D');
                 if (inst.firewall_enabled) flags.push('F');
                 if (inst.brand === 'kvm') flags.push('K');
+                if (inst.deletion_protection) flags.push('P');
                 inst.flags = flags.length ? flags.join('') : undefined;
             });
 
@@ -192,21 +201,27 @@ do_list.help = [
     '',
     '{{options}}',
     'Filters:',
-    '    FIELD=VALUE        Equality filter. Supported fields: type, brand, name,',
+    '    FIELD=VALUE        Equality filter. Supported fields: brand, image,',
-    '                       image, state, and memory',
+    '                       memory, name, state, tag.TAGNAME, and type.',
     '    FIELD=true|false   Boolean filter. Supported fields: docker (added in',
-    '                       CloudAPI 8.0.0)',
+    '                       CloudAPI 8.0.0).',
     '',
     'Fields (most are self explanatory, "*" indicates a field added client-side',
     'for convenience):',
     '    shortid*           A short ID prefix.',
     '    flags*             Single letter flags summarizing some fields:',
+    '                           "B" the brand is "bhyve"',
     '                           "D" docker instance',
     '                           "F" firewall is enabled',
     '                           "K" the brand is "kvm"',
+    '                           "P" deletion protected',
     '    age*               Approximate time since created, e.g. 1y, 2w.',
     '    img*               The image "name@version", if available, else its',
-    '                       "shortid".'
+    '                       "shortid".',
+    '',
+    'Examples:',
+    '    {{name}} ls -Ho id state=running     # IDs of running insts',
+    '    {{name}} ls docker=true tag.foo=bar  # Docker insts w/ "foo=bar" tag'
     /* END JSSTYLED */
 ].join('\n');
 

lib/do_instance/do_nic/do_create.js

@@ -0,0 +1,211 @@
+/*
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ */
+
+/*
+ * Copyright 2018 Joyent, Inc.
+ *
+ * `triton instance nic create ...`
+ */
+
+var assert = require('assert-plus');
+
+var common = require('../../common');
+var errors = require('../../errors');
+
+function do_create(subcmd, opts, args, cb) {
+    assert.optionalBool(opts.wait, 'opts.wait');
+    assert.optionalBool(opts.json, 'opts.json');
+    assert.optionalBool(opts.help, 'opts.help');
+    assert.func(cb, 'cb');
+
+    if (opts.help) {
+        this.do_help('help', {}, [subcmd], cb);
+        return;
+    }
+
+    if (args.length < 2) {
+        cb(new errors.UsageError('missing INST and NETWORK or INST and' +
+            ' NICOPT=VALUE arguments'));
+        return;
+    }
+
+    var cli = this.top;
+
+    var netObj;
+    var netObjArgs = [];
+    var regularArgs = [];
+    var createOpts = {};
+
+    args.forEach(function forEachArg(arg) {
+        if (arg.indexOf('=') !== -1) {
+            netObjArgs.push(arg);
+            return;
+        }
+        regularArgs.push(arg);
+    });
+
+    if (netObjArgs.length > 0) {
+        if (regularArgs.length > 1) {
+            cb(new errors.UsageError('cannot specify INST and NETWORK when'
+                + ' passing in ipv4 arguments'));
+            return;
+        }
+        if (regularArgs.length !== 1) {
+            cb(new errors.UsageError('missing INST argument'));
+            return;
+        }
+
+        try {
+            netObj = common.parseNicStr(netObjArgs);
+        } catch (err) {
+            cb(err);
+            return;
+        }
+    }
+
+    if (netObj) {
+        assert.array(regularArgs, 'regularArgs');
+        assert.equal(regularArgs.length, 1, 'instance uuid');
+
+        createOpts.id = regularArgs[0];
+        createOpts.network = netObj;
+    } else {
+        assert.array(args, 'args');
+        assert.equal(args.length, 2, 'INST and NETWORK');
+
+        createOpts.id = args[0];
+        createOpts.network = args[1];
+    }
+
+    function wait(instId, mac, next) {
+        assert.string(instId, 'instId');
+        assert.string(mac, 'mac');
+        assert.func(next, 'next');
+
+        var waiter = cli.tritonapi.waitForNicStates.bind(cli.tritonapi);
+
+        /*
+         * We request state running|stopped because net-agent is doing work to
+         * keep a NICs state in sync with the VMs state. If a user adds a NIC
+         * to a stopped instance the final state of the NIC should also be
+         * stopped.
+         */
+        waiter({
+            id: instId,
+            mac: mac,
+            states: ['running', 'stopped']
+        }, next);
+    }
+
+    // same signature as wait(), but is a nop
+    function waitNop(instId, mac, next) {
+        assert.string(instId, 'instId');
+        assert.string(mac, 'mac');
+        assert.func(next, 'next');
+
+        next();
+    }
+
+    common.cliSetupTritonApi({cli: cli}, function onSetup(setupErr) {
+        if (setupErr) {
+            cb(setupErr);
+            return;
+        }
+
+        cli.tritonapi.addNic(createOpts, function onAddNic(err, nic) {
+            if (err) {
+                cb(err);
+                return;
+            }
+
+            // If a NIC exists on the network already we will receive a 302
+            if (!nic) {
+                var errMsg = 'Instance already has a NIC on that network';
+                cb(new errors.TritonError(errMsg));
+                return;
+            }
+
+            // either wait or invoke a nop stub
+            var func = opts.wait ? wait : waitNop;
+
+            if (opts.wait && !opts.json) {
+                console.log('Creating NIC %s', nic.mac);
+            }
+
+            func(createOpts.id, nic.mac, function onWait(err2, createdNic) {
+                if (err2) {
+                    cb(err2);
+                    return;
+                }
+
+                var nicInfo = createdNic || nic;
+
+                if (opts.json) {
+                    console.log(JSON.stringify(nicInfo));
+                } else {
+                    console.log('Created NIC %s', nic.mac);
+                }
+
+                cb();
+            });
+        });
+    });
+}
+
+
+do_create.options = [
+    {
+        names: ['help', 'h'],
+        type: 'bool',
+        help: 'Show this help.'
+    },
+    {
+        names: ['json', 'j'],
+        type: 'bool',
+        help: 'JSON stream output.'
+    },
+    {
+        names: ['wait', 'w'],
+        type: 'bool',
+        help: 'Wait for the creation to complete.'
+    }
+];
+
+do_create.synopses = [
+    '{{name}} {{cmd}} [OPTIONS] INST NETWORK',
+    '{{name}} {{cmd}} [OPTIONS] INST NICOPT=VALUE [NICOPT=VALUE ...]'
+];
+
+do_create.help = [
+    'Create a NIC.',
+    '',
+    '{{usage}}',
+    '',
+    '{{options}}',
+    'INST is an instance id (full UUID), name, or short id,',
+    'and NETWORK is a network id (full UUID), name, or short id.',
+    '',
+    'NICOPTs are NIC options. The following NIC options are supported:',
+    'ipv4_uuid=<full network uuid> (required),' +
+        ' and ipv4_ips=<a single IP string>.',
+    '',
+    'Be aware that adding NICs to an instance  will cause that instance to',
+    'reboot.',
+    '',
+    'Example:',
+    '    triton instance nic create --wait 22b75576 ca8aefb9',
+    '    triton instance nic create 22b75576' +
+            ' ipv4_uuid=651446a8-dab0-439e-a2c4-2c841ab07c51' +
+            ' ipv4_ips=192.168.128.13'
+].join('\n');
+
+do_create.helpOpts = {
+    helpCol: 25
+};
+
+do_create.completionArgtypes = ['tritoninstance', 'tritonnic', 'none'];
+
+module.exports = do_create;

lib/do_instance/do_nic/do_delete.js

@@ -0,0 +1,126 @@
+/*
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ */
+
+/*
+ * Copyright 2018 Joyent, Inc.
+ *
+ * `triton instance nic delete ...`
+ */
+
+var assert = require('assert-plus');
+var vasync = require('vasync');
+
+var common = require('../../common');
+var errors = require('../../errors');
+
+
+function do_delete(subcmd, opts, args, cb) {
+    assert.object(opts, 'opts');
+    assert.optionalBool(opts.force, 'opts.force');
+    assert.func(cb, 'cb');
+
+    if (opts.help) {
+        this.do_help('help', {}, [subcmd], cb);
+        return;
+    }
+
+    if (args.length < 2) {
+        cb(new errors.UsageError('missing INST and MAC argument(s)'));
+        return;
+    } else if (args.length > 2) {
+        cb(new errors.UsageError('incorrect number of arguments'));
+        return;
+    }
+
+    var inst = args[0];
+    var mac  = args[1];
+    var cli  = this.top;
+
+    common.cliSetupTritonApi({cli: cli}, function onSetup(setupErr) {
+        if (setupErr) {
+            cb(setupErr);
+            return;
+        }
+
+        confirm({mac: mac, force: opts.force}, function onConfirm(confirmErr) {
+            if (confirmErr) {
+                console.error('Aborting');
+                cb();
+                return;
+            }
+
+            cli.tritonapi.removeNic({
+                id: inst,
+                mac: mac
+            }, function onRemove(err) {
+                if (err) {
+                    cb(err);
+                    return;
+                }
+
+                console.log('Deleted NIC %s', mac);
+                cb();
+            });
+        });
+    });
+}
+
+
+// Request confirmation before deleting, unless --force flag given.
+// If user declines, terminate early.
+function confirm(opts, cb) {
+    assert.object(opts, 'opts');
+    assert.func(cb, 'cb');
+
+    if (opts.force) {
+        cb();
+        return;
+    }
+
+    common.promptYesNo({
+        msg: 'Delete NIC "' + opts.mac + '"? [y/n] '
+    }, function (answer) {
+        if (answer !== 'y') {
+            cb(new Error('Aborted NIC deletion'));
+        } else {
+            cb();
+        }
+    });
+}
+
+
+do_delete.options = [
+    {
+        names: ['help', 'h'],
+        type: 'bool',
+        help: 'Show this help.'
+    },
+    {
+        names: ['force', 'f'],
+        type: 'bool',
+        help: 'Force removal.'
+    }
+];
+
+do_delete.synopses = ['{{name}} {{cmd}} INST MAC'];
+
+do_delete.help = [
+    'Remove a NIC from an instance.',
+    '',
+    '{{usage}}',
+    '',
+    '{{options}}',
+    'Where INST is an instance id (full UUID), name, or short id.',
+    '',
+    'Be aware that removing NICs from an instance will cause that instance to',
+    'reboot.'
+].join('\n');
+
+do_delete.aliases = ['rm'];
+
+do_delete.completionArgtypes = ['tritoninstance', 'none'];
+
+module.exports = do_delete;

lib/do_instance/do_nic/do_get.js

@@ -0,0 +1,89 @@
+/*
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ */
+
+/*
+ * Copyright 2018 Joyent, Inc.
+ *
+ * `triton instance nic get ...`
+ */
+
+var assert = require('assert-plus');
+
+var common = require('../../common');
+var errors = require('../../errors');
+
+
+function do_get(subcmd, opts, args, cb) {
+    assert.func(cb, 'cb');
+
+    if (opts.help) {
+        this.do_help('help', {}, [subcmd], cb);
+        return;
+    }
+
+    if (args.length < 2) {
+        cb(new errors.UsageError('missing INST and MAC arguments'));
+        return;
+    } else if (args.length > 2) {
+        cb(new errors.UsageError('incorrect number of arguments'));
+        return;
+    }
+
+    var inst = args[0];
+    var mac  = args[1];
+    var cli  = this.top;
+
+    common.cliSetupTritonApi({cli: cli}, function onSetup(setupErr) {
+        if (setupErr) {
+            cb(setupErr);
+            return;
+        }
+
+        cli.tritonapi.getNic({id: inst, mac: mac}, function onNic(err, nic) {
+            if (err) {
+                cb(err);
+                return;
+            }
+
+            if (opts.json) {
+                console.log(JSON.stringify(nic));
+            } else {
+                console.log(JSON.stringify(nic, null, 4));
+            }
+
+            cb();
+        });
+    });
+}
+
+
+do_get.options = [
+    {
+        names: ['help', 'h'],
+        type: 'bool',
+        help: 'Show this help.'
+    },
+    {
+        names: ['json', 'j'],
+        type: 'bool',
+        help: 'JSON stream output.'
+    }
+];
+
+do_get.synopses = ['{{name}} {{cmd}} INST MAC'];
+
+do_get.help = [
+    'Show a specific NIC.',
+    '',
+    '{{usage}}',
+    '',
+    '{{options}}',
+    'Where INST is an instance id (full UUID), name, or short id.'
+].join('\n');
+
+do_get.completionArgtypes = ['tritoninstance', 'none'];
+
+module.exports = do_get;

lib/do_instance/do_nic/do_list.js

@@ -0,0 +1,154 @@
+/*
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ */
+
+/*
+ * Copyright 2018 Joyent, Inc.
+ *
+ * `triton instance nic list ...`
+ */
+
+var assert = require('assert-plus');
+var tabula = require('tabula');
+
+var common = require('../../common');
+var errors = require('../../errors');
+
+
+var VALID_FILTERS = ['ip', 'mac', 'state', 'network', 'primary', 'gateway'];
+var COLUMNS_DEFAULT = 'ip,mac,state,network';
+var COLUMNS_DEFAULT_LONG = 'ip,mac,state,network,primary,gateway';
+var SORT_DEFAULT = 'ip';
+
+
+function do_list(subcmd, opts, args, cb) {
+    assert.array(args, 'args');
+    assert.func(cb, 'cb');
+
+    if (opts.help) {
+        this.do_help('help', {}, [subcmd], cb);
+        return;
+    }
+
+    if (args.length < 1) {
+        cb(new errors.UsageError('missing INST argument'));
+        return;
+    }
+
+    var inst = args.shift();
+
+    try {
+        var filters = common.objFromKeyValueArgs(args, {
+            validKeys: VALID_FILTERS,
+            disableDotted: true
+        });
+    } catch (e) {
+        cb(e);
+        return;
+    }
+
+    var cli = this.top;
+
+    common.cliSetupTritonApi({cli: cli}, function onSetup(setupErr) {
+        if (setupErr) {
+            cb(setupErr);
+            return;
+        }
+
+        cli.tritonapi.listNics({id: inst}, function onNics(err, nics) {
+            if (err) {
+                cb(err);
+                return;
+            }
+
+            // do filtering
+            Object.keys(filters).forEach(function filterByKey(key) {
+                var val = filters[key];
+                nics = nics.filter(function filterByNic(nic) {
+                    return nic[key] === val;
+                });
+            });
+
+            if (opts.json) {
+                common.jsonStream(nics);
+            } else {
+                nics.forEach(function onNic(nic) {
+                    nic.network = nic.network.split('-')[0];
+                    nic.ip = nic.ip + '/' + convertCidrSuffix(nic.netmask);
+                });
+
+                var columns = COLUMNS_DEFAULT;
+
+                if (opts.o) {
+                    columns = opts.o;
+                } else if (opts.long) {
+                    columns = COLUMNS_DEFAULT_LONG;
+                }
+
+                columns = columns.split(',');
+                var sort = opts.s.split(',');
+
+                tabula(nics, {
+                    skipHeader: opts.H,
+                    columns: columns,
+                    sort: sort
+                });
+            }
+
+            cb();
+        });
+    });
+}
+
+
+function convertCidrSuffix(netmask) {
+    var bitmask = netmask.split('.').map(function (octet) {
+        return (+octet).toString(2);
+    }).join('');
+
+    var i = 0;
+    for (i = 0; i < bitmask.length; i++) {
+        if (bitmask[i] === '0')
+            break;
+    }
+
+    return i;
+}
+
+
+do_list.options = [
+    {
+        names: ['help', 'h'],
+        type: 'bool',
+        help: 'Show this help.'
+    }
+].concat(common.getCliTableOptions({
+    includeLong: true,
+    sortDefault: SORT_DEFAULT
+}));
+
+do_list.synopses = ['{{name}} {{cmd}} [OPTIONS] [FILTERS]'];
+
+do_list.help = [
+    'Show all NICs on an instance.',
+    '',
+    '{{usage}}',
+    '',
+    '{{options}}',
+    '',
+    'Where INST is an instance id (full UUID), name, or short id.',
+    '',
+    'Filters:',
+    '    FIELD=<string>    String filter. Supported fields: ip, mac, state,',
+    '                      network, netmask',
+    '',
+    'Filters are applied client-side (i.e. done by the triton command itself).'
+].join('\n');
+
+do_list.completionArgtypes = ['tritoninstance', 'none'];
+
+do_list.aliases = ['ls'];
+
+module.exports = do_list;

lib/do_instance/do_nic/index.js

@@ -0,0 +1,50 @@
+/*
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ */
+
+/*
+ * Copyright 2018 Joyent, Inc.
+ *
+ * `triton inst nic ...`
+ */
+
+var Cmdln = require('cmdln').Cmdln;
+var util = require('util');
+
+
+
+// ---- CLI class
+
+function NicCLI(top) {
+    this.top = top.top;
+
+    Cmdln.call(this, {
+        name: top.name + ' nic',
+        desc: 'List and manage instance NICs.',
+        helpSubcmds: [
+            'help',
+            'list',
+            'get',
+            'create',
+            'delete'
+        ],
+        helpOpts: {
+            minHelpCol: 23
+        }
+    });
+}
+util.inherits(NicCLI, Cmdln);
+
+NicCLI.prototype.init = function init(opts, args, cb) {
+    this.log = this.top.log;
+    Cmdln.prototype.init.apply(this, arguments);
+};
+
+NicCLI.prototype.do_list = require('./do_list');
+NicCLI.prototype.do_create = require('./do_create');
+NicCLI.prototype.do_get = require('./do_get');
+NicCLI.prototype.do_delete = require('./do_delete');
+
+module.exports = NicCLI;

lib/do_instance/do_reboot.js

@@ -30,6 +30,7 @@ function do_reboot(subcmd, opts, args, cb) {
     common.cliSetupTritonApi({cli: this.top}, function onSetup(setupErr) {
         if (setupErr) {
             cb(setupErr);
+            return;
         }
 
         var rebootErrs = [];

lib/do_instance/do_rename.js

@@ -27,6 +27,7 @@ function do_rename(subcmd, opts, args, callback) {
     common.cliSetupTritonApi({cli: this.top}, function onSetup(setupErr) {
         if (setupErr) {
             callback(setupErr);
+            return;
         }
 
         tritonapi.renameInstance({

lib/do_instance/do_resize.js

@@ -27,6 +27,7 @@ function do_resize(subcmd, opts, args, callback) {
     common.cliSetupTritonApi({cli: this.top}, function onSetup(setupErr) {
         if (setupErr) {
             callback(setupErr);
+            return;
         }
 
         tritonapi.resizeInstance({

lib/do_instance/do_snapshot/do_create.js

@@ -5,7 +5,7 @@
  */
 
 /*
- * Copyright 2016 Joyent, Inc.
+ * Copyright 2018 Joyent, Inc.
  *
  * `triton snapshot create ...`
  */
@@ -133,7 +133,7 @@ do_create.help = [
     '{{usage}}',
     '',
     '{{options}}',
-    'Snapshot do not work for instances of type "kvm".'
+    'Snapshots do not work for instances of type "bhyve" or "kvm".'
 ].join('\n');
 
 do_create.completionArgtypes = ['tritoninstance', 'none'];

lib/do_instance/do_snapshot/do_get.js

@@ -39,6 +39,7 @@ function do_get(subcmd, opts, args, cb) {
     common.cliSetupTritonApi({cli: this.top}, function onSetup(setupErr) {
         if (setupErr) {
             cb(setupErr);
+            return;
         }
         cli.tritonapi.getInstanceSnapshot({
             id: id,

lib/do_instance/do_snapshot/do_list.js

@@ -43,6 +43,7 @@ function do_list(subcmd, opts, args, cb) {
     common.cliSetupTritonApi({cli: this.top}, function onSetup(setupErr) {
         if (setupErr) {
             cb(setupErr);
+            return;
         }
         cli.tritonapi.listInstanceSnapshots({
             id: machineId

lib/do_instance/do_snapshot/index.js

@@ -22,7 +22,7 @@ function SnapshotCLI(top) {
 
     Cmdln.call(this, {
         name: top.name + ' snapshot',
-        desc: 'List, get, create and delete Triton instance snapshots.',
+        desc: 'List, get, create and delete Spearhead instance snapshots.',
         helpSubcmds: [
             'help',
             'create',
@@ -31,7 +31,7 @@ function SnapshotCLI(top) {
             'delete'
         ],
         helpBody: 'Instances can be rolled back to a snapshot using\n' +
-                  '`triton instance start --snapshot=SNAPNAME`.'
+                  '`spearhead instance start --snapshot=SNAPNAME`.'
     });
 }
 util.inherits(SnapshotCLI, Cmdln);

lib/do_instance/do_snapshots.js

@@ -21,7 +21,7 @@ function do_snapshots(subcmd, opts, args, callback) {
     }, callback);
 }
 
-do_snapshots.help = 'A shortcut for "triton instance snapshot list".\n' +
+do_snapshots.help = 'A shortcut for "spearhead instance snapshot list".\n' +
     targ.help;
 do_snapshots.synopses = targ.synopses;
 do_snapshots.options = targ.options;

lib/do_instance/do_ssh.js

@@ -5,11 +5,12 @@
  */
 
 /*
- * Copyright 2016 Joyent, Inc.
+ * Copyright (c) 2018, Joyent, Inc.
  *
  * `triton instance ssh ...`
  */
 
+var assert = require('assert-plus');
 var path = require('path');
 var spawn = require('child_process').spawn;
 var vasync = require('vasync');
@@ -17,6 +18,30 @@ var vasync = require('vasync');
 var common = require('../common');
 var errors = require('../errors');
 
+/*
+ * The tag "tritoncli.ssh.ip" may be set to an IP address that belongs to the
+ * instance but which is not the primary IP.  If set, we will use that IP
+ * address for the SSH connection instead of the primary IP.
+ */
+var TAG_SSH_IP = 'tritoncli.ssh.ip';
+
+/*
+ * The tag "tritoncli.ssh.proxy" may be set to either the name or the UUID of
+ * another instance in this account.  If set, we will use the "ProxyJump"
+ * feature of SSH to tunnel through the SSH server on that host.  This is
+ * useful when exposing a single zone to the Internet while keeping the rest of
+ * your infrastructure on a private fabric.
+ */
+var TAG_SSH_PROXY = 'tritoncli.ssh.proxy';
+
+/*
+ * The tag "tritoncli.ssh.proxyuser" may be set on the instance used as an SSH
+ * proxy.  If set, we will use this value when making the proxy connection
+ * (i.e., it will be passed via the "ProxyJump" option).  If not set, the
+ * default user selection behaviour applies.
+ */
+var TAG_SSH_PROXY_USER = 'tritoncli.ssh.proxyuser';
+
 
 function do_ssh(subcmd, opts, args, callback) {
     if (opts.help) {
@@ -30,10 +55,12 @@ function do_ssh(subcmd, opts, args, callback) {
     var id = args.shift();
 
     var user;
+    var overrideUser = false;
     var i = id.indexOf('@');
     if (i >= 0) {
         user = id.substr(0, i);
         id = id.substr(i + 1);
+        overrideUser = true;
     }
 
     vasync.pipeline({arg: {cli: this.top}, funcs: [
@@ -48,17 +75,112 @@ function do_ssh(subcmd, opts, args, callback) {
 
                 ctx.inst = inst;
 
+                if (inst.tags && inst.tags[TAG_SSH_IP]) {
+                    ctx.ip = inst.tags[TAG_SSH_IP];
+                    if (!inst.ips || inst.ips.indexOf(ctx.ip) === -1) {
+                        next(new Error('IP address ' + ctx.ip + ' not ' +
+                            'attached to the instance'));
+                        return;
+                    }
+                } else {
                     ctx.ip = inst.primaryIp;
+                }
+
                 if (!ctx.ip) {
-                    next(new Error('primaryIp not found for instance'));
+                    next(new Error('IP address not found for instance'));
                     return;
                 }
                 next();
             });
         },
 
+        function getInstanceBastionIp(ctx, next) {
+            if (opts.no_proxy) {
+                setImmediate(next);
+                return;
+            }
+
+            if (!ctx.inst.tags || !ctx.inst.tags[TAG_SSH_PROXY]) {
+                setImmediate(next);
+                return;
+            }
+
+            ctx.cli.tritonapi.getInstance(ctx.inst.tags[TAG_SSH_PROXY],
+                function (err, proxy) {
+
+                if (err) {
+                    next(err);
+                    return;
+                }
+
+                if (proxy.tags && proxy.tags[TAG_SSH_IP]) {
+                    ctx.proxyIp = proxy.tags[TAG_SSH_IP];
+                    if (!proxy.ips || proxy.ips.indexOf(ctx.proxyIp) === -1) {
+                        next(new Error('IP address ' + ctx.proxyIp + ' not ' +
+                            'attached to the instance'));
+                        return;
+                    }
+                } else {
+                    ctx.proxyIp = proxy.primaryIp;
+                }
+
+                ctx.proxyImage = proxy.image;
+
+                /*
+                 * Selecting the right user to use for the proxy connection is
+                 * somewhat nuanced, in order to allow for various useful
+                 * configurations.  We wish to enable the following cases:
+                 *
+                 * 1. The least sophisticated configuration; i.e., using two
+                 *    instances (the target instance and the proxy instnace)
+                 *    with the default "root" (or, e.g., "ubuntu") account
+                 *    and smartlogin or authorized_keys metadata for SSH key
+                 *    management.
+                 *
+                 * 2. The user has set up their own accounts (e.g., "roberta")
+                 *    in all of their instances and does their own SSH key
+                 *    management.  They connect with:
+                 *
+                 *        triton inst ssh roberta@instance
+                 *
+                 *    In this case we will use "roberta" for both the proxy
+                 *    and the target instance.  This means a user provided on
+                 *    the command line will override the per-image default
+                 *    user (e.g., "root" or "ubuntu") -- if the user wants to
+                 *    retain the default account for the proxy, they should
+                 *    use case 3 below.
+                 *
+                 * 3. The user has set up their own accounts in the target
+                 *    instance (e.g., "felicity"), but the proxy instance is
+                 *    using a single specific account that should be used by
+                 *    all users in the organisation (e.g., "partyline").  In
+                 *    this case, we want the user to be able to specify the
+                 *    global proxy account setting as a tag on the proxy
+                 *    instance, so that for:
+                 *
+                 *        triton inst ssh felicity@instance
+                 *
+                 *    ... we will use "-o ProxyJump partyline@proxy" but
+                 *    still use "felicity" for the target connection.  This
+                 *    last case requires the proxy user tag (if set) to
+                 *    override a user provided on the command line.
+                 */
+                if (proxy.tags && proxy.tags[TAG_SSH_PROXY_USER]) {
+                    ctx.proxyUser = proxy.tags[TAG_SSH_PROXY_USER];
+                }
+
+                if (!ctx.proxyIp) {
+                    next(new Error('IP address not found for proxy instance'));
+                    return;
+                }
+
+                next();
+            });
+        },
+
         function getUser(ctx, next) {
-            if (user) {
+            if (overrideUser) {
+                assert.string(user, 'user');
                 next();
                 return;
             }
@@ -73,10 +195,10 @@ function do_ssh(subcmd, opts, args, callback) {
                 }
 
                 /*
-                 * This is a convention as seen on Joyent's
+                 * This is a convention as seen on Joyent's "ubuntu-certified"
-                 * "ubuntu-certified" KVM images.
+                 * KVM images.
                  */
-                if (image.tags.default_user) {
+                if (image.tags && image.tags.default_user) {
                     user = image.tags.default_user;
                 } else {
                     user = 'root';
@@ -86,9 +208,64 @@ function do_ssh(subcmd, opts, args, callback) {
             });
         },
 
+        function getBastionUser(ctx, next) {
+            if (!ctx.proxyImage || ctx.proxyUser) {
+                /*
+                 * If there is no image for the proxy host, or an override user
+                 * was already provided in the tags of the proxy instance
+                 * itself, we don't need to look up the default user.
+                 */
+                next();
+                return;
+            }
+
+            if (overrideUser) {
+                /*
+                 * A user was provided on the command line, but no user
+                 * override tag was present on the proxy instance.  To enable
+                 * use case 2 (see comments above) we'll prefer this user over
+                 * the image default.
+                 */
+                assert.string(user, 'user');
+                ctx.proxyUser = user;
+                next();
+                return;
+            }
+
+            ctx.cli.tritonapi.getImage({
+                name: ctx.proxyImage,
+                useCache: true
+            }, function (getImageErr, image) {
+                if (getImageErr) {
+                    next(getImageErr);
+                    return;
+                }
+
+                /*
+                 * This is a convention as seen on Joyent's "ubuntu-certified"
+                 * KVM images.
+                 */
+                assert.ok(!ctx.proxyUser, 'proxy user set twice');
+                if (image.tags && image.tags.default_user) {
+                    ctx.proxyUser = image.tags.default_user;
+                } else {
+                    ctx.proxyUser = 'root';
+                }
+
+                next();
+            });
+        },
+
         function doSsh(ctx, next) {
             args = ['-l', user, ctx.ip].concat(args);
 
+            if (ctx.proxyIp) {
+                assert.string(ctx.proxyUser, 'ctx.proxyUser');
+                args = [
+                    '-o', 'ProxyJump=' + ctx.proxyUser + '@' + ctx.proxyIp
+                ].concat(args);
+            }
+
             /*
              * By default we disable ControlMaster (aka mux, aka SSH
              * connection multiplexing) because of
@@ -133,6 +310,11 @@ do_ssh.options = [
         names: ['help', 'h'],
         type: 'bool',
         help: 'Show this help.'
+    },
+    {
+        names: ['no-proxy'],
+        type: 'bool',
+        help: 'Disable SSH proxy support (ignore "tritoncli.ssh.proxy" tag)'
     }
 ];
 do_ssh.synopses = ['{{name}} ssh [-h] [USER@]INST [SSH-ARGUMENTS]'];
@@ -150,12 +332,32 @@ do_ssh.help = [
     'If USER is not specified and the default_user tag is not set, the user',
     'is assumed to be \"root\".',
     '',
+    'The "tritoncli.ssh.proxy" tag on the target instance may be set to',
+    'the name or the UUID of another instance through which to proxy this',
+    'SSH connection.  If set, the primary IP of the proxy instance will be',
+    'loaded and passed to SSH via the ProxyJump option.  The --no-proxy',
+    'flag can be used to ignore the tag and force a direct connection.',
+    '',
+    'For example, to proxy connections to zone "narnia" through "wardrobe":',
+    '    triton instance tag set narnia tritoncli.ssh.proxy=wardrobe',
+    '',
+    'The "tritoncli.ssh.ip" tag on the target instance may be set to the',
+    'IP address to use for SSH connections.  This may be useful if the',
+    'primary IP address is not available for SSH connections.  This address',
+    'must be set to one of the IP addresses attached to the instance.',
+    '',
+    'The "tritoncli.ssh.proxyuser" tag on the proxy instance may be set to',
+    'the user account that should be used for the proxy connection (i.e., via',
+    'the SSH ProxyJump option).  This is useful when all users of the proxy',
+    'instance should use a special common account, and will override the USER',
+    'value (if one is provided) for the SSH connection to the target instance.',
+    '',
     'There is a known issue with SSH connection multiplexing (a.k.a. ',
     'ControlMaster, mux) where stdout/stderr is lost. As a workaround, `ssh`',
     'is spawned with options disabling ControlMaster. See ',
     '<https://github.com/joyent/node-triton/issues/52> for details. If you ',
     'want to use ControlMaster, an alternative is:',
-    '    ssh root@$(triton ip INST)'
+    '    ssh root@$(spearhead ip INST)'
     /* END JSSTYLED */
 ].join('\n');
 

lib/do_instance/do_tag/do_delete.js

@@ -33,6 +33,7 @@ function do_delete(subcmd, opts, args, cb) {
     common.cliSetupTritonApi({cli: this.top}, function onSetup(setupErr) {
         if (setupErr) {
             cb(setupErr);
+            return;
         }
         if (opts.all) {
             self.top.tritonapi.deleteAllInstanceTags({

lib/do_instance/do_tag/do_get.js

@@ -27,6 +27,7 @@ function do_get(subcmd, opts, args, cb) {
     common.cliSetupTritonApi({cli: this.top}, function onSetup(setupErr) {
         if (setupErr) {
             cb(setupErr);
+            return;
         }
         self.top.tritonapi.getInstanceTag({
             id: args[0],

lib/do_instance/do_tag/do_list.js

@@ -26,6 +26,7 @@ function do_list(subcmd, opts, args, cb) {
     common.cliSetupTritonApi({cli: this.top}, function onSetup(setupErr) {
         if (setupErr) {
             cb(setupErr);
+            return;
         }
         self.top.tritonapi.listInstanceTags(
             {id: args[0]}, function (err, tags) {

lib/do_instance/do_tag/index.js

@@ -22,7 +22,7 @@ function InstanceTagCLI(parent) {
         name: parent.name + ' tag',
         /* BEGIN JSSTYLED */
         desc: [
-            'List, get, set and delete tags on Triton instances.'
+            'List, get, set and delete tags on Spearhead instances.'
         ].join('\n'),
         /* END JSSTYLED */
         helpOpts: {

lib/do_instance/do_tags.js

@@ -20,7 +20,7 @@ function do_tags(subcmd, opts, args, callback) {
     }, callback);
 }
 
-do_tags.help = 'A shortcut for "triton instance tag list".\n' + targ.help;
+do_tags.help = 'A shortcut for "spearhead instance tag list".\n' + targ.help;
 do_tags.synopses = targ.synopses;
 do_tags.options = targ.options;
 do_tags.completionArgtypes = targ.completionArgtypes;

lib/do_instance/do_wait.js

@@ -122,7 +122,7 @@ do_wait.help = [
     '{{options}}',
     'Where "INST" is an instance name, id, or short id; and "STATES" is a',
     'comma-separated list of target instance states, by default "running,failed".',
-    'In other words, "triton inst wait foo0" will wait for instance "foo0" to',
+    'In other words, "spearhead inst wait foo0" will wait for instance "foo0" to',
     'complete provisioning.'
     /* END JSSTYLED */
 ].join('\n');

lib/do_instance/gen_do_ACTION.js

@@ -112,6 +112,7 @@ function _doTheAction(action, subcmd, opts, args, callback) {
     common.cliSetupTritonApi({cli: this.top}, function onSetup(setupErr) {
         if (setupErr) {
             callback(setupErr);
+            return;
         }
         _doOnEachInstance(self, action, command, state, args, opts, callback);
     });

lib/do_instance/index.js

@@ -5,7 +5,7 @@
  */
 
 /*
- * Copyright 2015 Joyent, Inc.
+ * Copyright 2018 Joyent, Inc.
  *
  * `triton instance ...`
  */
@@ -22,7 +22,7 @@ function InstanceCLI(top) {
         name: top.name + ' instance',
         /* BEGIN JSSTYLED */
         desc: [
-            'List and manage Triton instances.'
+            'List and manage Spearhead instances.'
         ].join('\n'),
         /* END JSSTYLED */
         helpOpts: {
@@ -45,10 +45,14 @@ function InstanceCLI(top) {
             'enable-firewall',
             'disable-firewall',
             { group: '' },
+            'enable-deletion-protection',
+            'disable-deletion-protection',
+            { group: '' },
             'ssh',
             'ip',
             'wait',
             'audit',
+            'nic',
             'snapshot',
             'tag'
         ]
@@ -77,10 +81,16 @@ InstanceCLI.prototype.do_fwrules = require('./do_fwrules');
 InstanceCLI.prototype.do_enable_firewall = require('./do_enable_firewall');
 InstanceCLI.prototype.do_disable_firewall = require('./do_disable_firewall');
 
+InstanceCLI.prototype.do_enable_deletion_protection =
+    require('./do_enable_deletion_protection');
+InstanceCLI.prototype.do_disable_deletion_protection =
+    require('./do_disable_deletion_protection');
+
 InstanceCLI.prototype.do_ssh = require('./do_ssh');
 InstanceCLI.prototype.do_ip = require('./do_ip');
 InstanceCLI.prototype.do_wait = require('./do_wait');
 InstanceCLI.prototype.do_audit = require('./do_audit');
+InstanceCLI.prototype.do_nic = require('./do_nic');
 InstanceCLI.prototype.do_snapshot = require('./do_snapshot');
 InstanceCLI.prototype.do_snapshots = require('./do_snapshots');
 InstanceCLI.prototype.do_tag = require('./do_tag');

lib/do_instances.js

@@ -20,7 +20,7 @@ function do_instances(subcmd, opts, args, callback) {
     }, callback);
 }
 
-do_instances.help = 'A shortcut for "triton instance list".\n' + targ.help;
+do_instances.help = 'A shortcut for "spearhead instance list".\n' + targ.help;
 do_instances.synopses = targ.synopses;
 do_instances.options = targ.options;
 do_instances.completionArgtypes = targ.completionArgtypes;

lib/do_ip.js

@@ -20,7 +20,7 @@ function do_ip(subcmd, opts, args, callback) {
     }, callback);
 }
 
-do_ip.help = 'A shortcut for "triton instance ip".\n' + targ.help;
+do_ip.help = 'A shortcut for "spearhead instance ip".\n' + targ.help;
 do_ip.synopses = targ.synopses;
 do_ip.options = targ.options;
 do_ip.completionArgtypes = targ.completionArgtypes;

lib/do_key/do_add.js

@@ -47,13 +47,7 @@ function do_add(subcmd, opts, args, cb) {
                 return next();
             }
 
-            var stdin = '';
+            common.readStdin(function gotStdin(stdin) {
-            process.stdin.resume();
-            process.stdin.on('data', function (chunk) {
-                stdin += chunk;
-            });
-
-            process.stdin.on('end', function () {
                 ctx.data = stdin;
                 ctx.from = '<stdin>';
                 next();

lib/do_key/do_get.js

@@ -38,6 +38,7 @@ function do_get(subcmd, opts, args, cb) {
     common.cliSetupTritonApi({cli: this.top}, function onSetup(setupErr) {
         if (setupErr) {
             cb(setupErr);
+            return;
         }
         cli.tritonapi.cloudapi.getKey({
             // Currently `cloudapi.getUserKey` isn't picky about the

lib/do_key/do_list.js

@@ -40,6 +40,7 @@ function do_list(subcmd, opts, args, cb) {
     common.cliSetupTritonApi({cli: this.top}, function onSetup(setupErr) {
         if (setupErr) {
             cb(setupErr);
+            return;
         }
         cli.tritonapi.cloudapi.listKeys({}, function onKeys(err, keys) {
             if (err) {

lib/do_keys.js

@@ -20,7 +20,7 @@ function do_keys(subcmd, opts, args, callback) {
     }, callback);
 }
 
-do_keys.help = 'A shortcut for "triton key list".\n' + targ.help;
+do_keys.help = 'A shortcut for "spearhead key list".\n' + targ.help;
 do_keys.synopses = targ.synopses;
 do_keys.options = targ.options;
 do_keys.completionArgtypes = targ.completionArgtypes;

lib/do_network/do_create.js

@@ -0,0 +1,273 @@
+/*
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ */
+
+/*
+ * Copyright 2018 Joyent, Inc.
+ *
+ * `triton network create ...`
+ */
+
+var assert = require('assert-plus');
+var format = require('util').format;
+var jsprim = require('jsprim');
+
+var common = require('../common');
+var errors = require('../errors');
+
+
+
+function do_create(subcmd, opts, args, cb) {
+    assert.optionalString(opts.name, 'opts.name');
+    assert.optionalString(opts.subnet, 'opts.subnet');
+    assert.optionalString(opts.start_ip, 'opts.start_ip');
+    assert.optionalString(opts.end_ip, 'opts.end_ip');
+    assert.optionalString(opts.description, 'opts.description');
+    assert.optionalString(opts.gateway, 'opts.gateway');
+    assert.optionalArrayOfString(opts.resolver, 'opts.resolver');
+    assert.optionalArrayOfString(opts.route, 'opts.route');
+    assert.optionalBool(opts.no_nat, 'opts.no_nat');
+    assert.optionalBool(opts.json, 'opts.json');
+    assert.optionalBool(opts.help, 'opts.help');
+    assert.func(cb, 'cb');
+
+    var i;
+
+    if (opts.help) {
+        this.do_help('help', {}, [subcmd], cb);
+        return;
+    }
+    if (args.length === 0) {
+        cb(new errors.UsageError('missing VLAN argument'));
+        return;
+    } else if (args.length > 1) {
+        cb(new errors.UsageError('incorrect number of arguments'));
+        return;
+    }
+
+    var vlanId = jsprim.parseInteger(args[0], { allowSign: false });
+    if (typeof (vlanId) !== 'number') {
+        cb(new errors.UsageError('VLAN must be an integer'));
+        return;
+    }
+
+    if (!opts.subnet) {
+        cb(new errors.UsageError('must specify --subnet (-s) option'));
+        return;
+    }
+
+    if (!opts.name) {
+        cb(new errors.UsageError('must specify --name (-n) option'));
+        return;
+    }
+
+    if (!opts.start_ip) {
+        cb(new errors.UsageError('must specify --start-ip (-S) option'));
+        return;
+    }
+
+    if (!opts.end_ip) {
+        cb(new errors.UsageError('must specify --end-ip (-E) option'));
+        return;
+    }
+
+    var createOpts = {
+        vlan_id: vlanId,
+        name: opts.name,
+        subnet: opts.subnet,
+        provision_start_ip: opts.start_ip,
+        provision_end_ip: opts.end_ip,
+        resolvers: [],
+        routes: {}
+    };
+
+    if (opts.resolver) {
+        for (i = 0; i < opts.resolver.length; i++) {
+            if (createOpts.resolvers.indexOf(opts.resolver[i]) === -1) {
+                createOpts.resolvers.push(opts.resolver[i]);
+            }
+        }
+    }
+
+    if (opts.route) {
+        for (i = 0; i < opts.route.length; i++) {
+            var m = opts.route[i].match(new RegExp('^([^=]+)=([^=]+)$'));
+
+            if (m === null) {
+                cb(new errors.UsageError('invalid route: ' + opts.route[i]));
+                return;
+            }
+
+            createOpts.routes[m[1]] = m[2];
+        }
+    }
+
+    if (opts.no_nat) {
+        createOpts.internet_nat = false;
+    }
+
+    if (opts.gateway) {
+        createOpts.gateway = opts.gateway;
+    } else {
+        if (!opts.no_nat) {
+            cb(new errors.UsageError('without a --gateway (-g), you must ' +
+              'specify --no-nat (-x)'));
+            return;
+        }
+    }
+
+    if (opts.description) {
+        createOpts.description = opts.description;
+    }
+
+    var cli = this.top;
+
+    common.cliSetupTritonApi({cli: cli}, function onSetup(setupErr) {
+        if (setupErr) {
+            cb(setupErr);
+            return;
+        }
+
+        var cloudapi = cli.tritonapi.cloudapi;
+
+        cloudapi.createFabricNetwork(createOpts, function onCreate(err, net) {
+            if (err) {
+                cb(err);
+                return;
+            }
+
+            if (opts.json) {
+                console.log(JSON.stringify(net));
+            } else {
+                console.log('Created network %s (%s)', net.name, net.id);
+            }
+
+            cb();
+        });
+    });
+}
+
+
+do_create.options = [
+    {
+        names: ['help', 'h'],
+        type: 'bool',
+        help: 'Show this help.'
+    },
+    {
+        group: 'Create options'
+    },
+    {
+        names: ['name', 'n'],
+        type: 'string',
+        helpArg: 'NAME',
+        help: 'Name of the NETWORK.'
+    },
+    {
+        names: ['description', 'D'],
+        type: 'string',
+        helpArg: 'DESC',
+        help: 'Description of the NETWORK.'
+    },
+    {
+        group: ''
+    },
+    {
+        names: ['subnet', 's'],
+        type: 'string',
+        helpArg: 'SUBNET',
+        help: 'A CIDR string describing the NETWORK.'
+    },
+    {
+        names: ['start-ip', 'S', 'start_ip'],
+        type: 'string',
+        helpArg: 'START_IP',
+        help: 'First assignable IP address on NETWORK.'
+    },
+    {
+        names: ['end-ip', 'E', 'end_ip'],
+        type: 'string',
+        helpArg: 'END_IP',
+        help: 'Last assignable IP address on NETWORK.'
+    },
+    {
+        group: ''
+    },
+    {
+        names: ['gateway', 'g'],
+        type: 'string',
+        helpArg: 'IP',
+        help: 'Default gateway IP address.'
+    },
+    {
+        names: ['resolver', 'r'],
+        type: 'arrayOfString',
+        helpArg: 'RESOLVER',
+        help: 'DNS resolver IP address.  Specify multiple -r options for ' +
+            'multiple resolvers.'
+    },
+    {
+        names: ['route', 'R'],
+        type: 'arrayOfString',
+        helpArg: 'SUBNET=IP',
+        help: [ 'Static route for network.  Each route must include the',
+            'subnet (IP address with CIDR prefix length) and the router',
+            'address.  Specify multiple -R options for multiple static',
+            'routes.' ].join(' ')
+    },
+    {
+        group: ''
+    },
+    {
+        names: ['no-nat', 'x', 'no_nat'],
+        type: 'bool',
+        helpArg: 'NO_NAT',
+        help: 'Disable creation of an Internet NAT zone on GATEWAY.'
+    },
+    {
+        group: 'Other options'
+    },
+    {
+        names: ['json', 'j'],
+        type: 'bool',
+        help: 'JSON stream output.'
+    }
+];
+
+do_create.synopses = ['{{name}} {{cmd}} [OPTIONS] VLAN'];
+
+do_create.help = [
+    'Create a network on a VLAN.',
+    '',
+    '{{usage}}',
+    '',
+    '{{options}}',
+    '',
+    'Examples:',
+    '    Create the "accounting" network on VLAN 1000:',
+    '        triton network create -n accounting --subnet 192.168.0.0/24 \\',
+    '            --start-ip 192.168.0.1 --end-ip 192.168.0.254 --no-nat \\',
+    '            1000',
+    '',
+    '    Create the "eng" network on VLAN 1001 with a pair of static routes:',
+    '        triton network create -n eng -s 192.168.1.0/24 \\',
+    '            -S 192.168.1.1 -E 192.168.1.249 --no-nat \\',
+    '            --route 10.1.1.0/24=192.168.1.50 \\',
+    '            --route 10.1.2.0/24=192.168.1.100 \\',
+    '            1001',
+    '',
+    '    Create the "ops" network on VLAN 1002 with DNS resolvers and NAT:',
+    '        triton network create -n ops -s 192.168.2.0/24 \\',
+    '            -S 192.168.2.10 -E 192.168.2.249 \\',
+    '            --resolver 8.8.8.8 --resolver 8.4.4.4 \\',
+    '            --gateway 192.168.2.1 \\',
+    '            1002'
+].join('\n');
+
+do_create.helpOpts = {
+    helpCol: 16
+};
+
+module.exports = do_create;

lib/do_network/do_delete.js

@@ -0,0 +1,85 @@
+/*
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ */
+
+/*
+ * Copyright 2017 Joyent, Inc.
+ *
+ * `triton network delete ...`
+ */
+
+var assert = require('assert-plus');
+var format = require('util').format;
+var vasync = require('vasync');
+
+var common = require('../common');
+var errors = require('../errors');
+
+
+function do_delete(subcmd, opts, args, cb) {
+    assert.func(cb, 'cb');
+
+    if (opts.help) {
+        this.do_help('help', {}, [subcmd], cb);
+        return;
+    }
+
+    if (args.length < 1) {
+        cb(new errors.UsageError('missing NETWORK argument(s)'));
+        return;
+    }
+
+    var cli = this.top;
+    var networks = args;
+
+    common.cliSetupTritonApi({cli: cli}, function onSetup(setupErr) {
+        if (setupErr) {
+            cb(setupErr);
+            return;
+        }
+
+        vasync.forEachParallel({
+            inputs: networks,
+            func: function deleteOne(id, next) {
+                cli.tritonapi.deleteFabricNetwork({ id: id },
+                         function onDelete(err) {
+                    if (err) {
+                        next(err);
+                        return;
+                    }
+
+                    console.log('Deleted network %s', id);
+                    next();
+                });
+            }
+        }, cb);
+    });
+}
+
+
+do_delete.options = [
+    {
+        names: ['help', 'h'],
+        type: 'bool',
+        help: 'Show this help.'
+    }
+];
+
+do_delete.synopses = ['{{name}} {{cmd}} NETWORK [NETWORK ...]'];
+
+do_delete.help = [
+    'Remove a fabric network.',
+    '',
+    '{{usage}}',
+    '',
+    '{{options}}',
+    'Where NETWORK is a network id (full UUID), name, or short id.'
+].join('\n');
+
+do_delete.aliases = ['rm'];
+
+do_delete.completionArgtypes = ['tritonnetwork'];
+
+module.exports = do_delete;

lib/do_network/do_get.js

@@ -30,6 +30,7 @@ function do_get(subcmd, opts, args, cb) {
     common.cliSetupTritonApi({cli: this.top}, function onSetup(setupErr) {
         if (setupErr) {
             cb(setupErr);
+            return;
         }
         tritonapi.getNetwork(args[0], function (err, net) {
             if (err) {

lib/do_network/do_get_default.js

@@ -0,0 +1,78 @@
+/*
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ */
+
+/*
+ * Copyright (c) 2018, Joyent, Inc.
+ *
+ * `triton network get-default ...`
+ */
+
+var assert = require('assert-plus');
+var vasync = require('vasync');
+
+var common = require('../common');
+var errors = require('../errors');
+
+
+function do_get_default(subcmd, opts, args, cb) {
+    assert.func(cb, 'cb');
+
+    if (opts.help) {
+        this.do_help('help', {}, [subcmd], cb);
+        return;
+    }
+
+    if (args.length > 0) {
+        cb(new errors.UsageError('incorrect number of arguments'));
+        return;
+    }
+
+    var cli = this.top;
+
+    common.cliSetupTritonApi({cli: cli}, function onSetup(setupErr) {
+        if (setupErr) {
+            cb(setupErr);
+            return;
+        }
+
+        cli.tritonapi.cloudapi.getConfig({}, function getConf(err, conf) {
+            if (err) {
+                cb(err);
+                return;
+            }
+
+            var defaultNetwork = conf.default_network;
+
+            if (!defaultNetwork) {
+                cb(new Error('account has no default network configured'));
+                return;
+            }
+
+            cli.handlerFromSubcmd('network').dispatch({
+                subcmd: 'get',
+                opts: opts,
+                args: [defaultNetwork]
+            }, cb);
+        });
+    });
+}
+
+
+do_get_default.options = require('./do_get').options;
+
+do_get_default.synopses = ['{{name}} {{cmd}}'];
+
+do_get_default.help = [
+    'Get default network.',
+    '',
+    '{{usage}}',
+    '',
+    '{{options}}'
+].join('\n');
+
+do_get_default.completionArgtypes = ['tritonnetwork'];
+
+module.exports = do_get_default;

lib/do_network/do_ip/do_get.js

@@ -0,0 +1,81 @@
+/*
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ */
+
+/*
+ * Copyright 2017 Joyent, Inc.
+ *
+ * `triton network ip get ...`
+ */
+
+var format = require('util').format;
+
+var common = require('../../common');
+var errors = require('../../errors');
+
+function do_get(subcmd, opts, args, cb) {
+    if (opts.help) {
+        this.do_help('help', {}, [subcmd], cb);
+        return;
+    } else if (args.length !== 2) {
+        return cb(new errors.UsageError(format(
+            'incorrect number of args (%d)', args.length)));
+    }
+
+    var tritonapi = this.top.tritonapi;
+
+    common.cliSetupTritonApi({cli: this.top}, function onSetup(setupErr) {
+        if (setupErr) {
+            cb(setupErr);
+            return;
+        }
+
+        var getIpOpts = {
+            id: args[0],
+            ip: args[1]
+        };
+
+        tritonapi.getNetworkIp(getIpOpts, function (err, ip, res) {
+            if (err) {
+                return cb(err);
+            }
+
+            if (opts.json) {
+                console.log(JSON.stringify(ip));
+            } else {
+                console.log(JSON.stringify(ip, null, 4));
+            }
+            cb();
+        });
+    });
+}
+
+do_get.options = [
+    {
+        names: ['help', 'h'],
+        type: 'bool',
+        help: 'Show this help.'
+    },
+    {
+        names: ['json', 'j'],
+        type: 'bool',
+        help: 'JSON output.'
+    }
+];
+
+do_get.synopses = ['{{name}} {{cmd}} NETWORK IP'];
+
+do_get.help = [
+    'Show a network ip.',
+    '',
+    '{{usage}}',
+    '',
+    '{{options}}',
+    'Where NETWORK is a network id, and IP is the ip address you want to get.'
+].join('\n');
+
+do_get.completionArgtypes = ['tritonnetwork', 'tritonnetworkip', 'none'];
+
+module.exports = do_get;

lib/do_network/do_ip/do_list.js

@@ -0,0 +1,129 @@
+/*
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ */
+
+/*
+ * Copyright 2017 Joyent, Inc.
+ *
+ * `triton network ip list ...`
+ */
+
+var format = require('util').format;
+
+var assert = require('assert-plus');
+var tabula = require('tabula');
+var vasync = require('vasync');
+
+var common = require('../../common');
+var errors = require('../../errors');
+
+
+// columns default without -o
+var columnsDefault = 'ip,managed,reserved,owner_uuid,belongs_to_uuid';
+
+// sort default with -s
+var sortDefault = 'ip';
+
+function do_list(subcmd, opts, args, callback) {
+    var self = this;
+    if (opts.help) {
+        this.do_help('help', {}, [subcmd], callback);
+        return;
+    } else if (args.length !== 1) {
+        return callback(new errors.UsageError(format(
+            'incorrect number of args (%d)', args.length)));
+    }
+
+    var columns = columnsDefault;
+    if (opts.o) {
+        columns = opts.o;
+    }
+    columns = columns.split(',');
+
+    var sort = opts.s.split(',').map(function mapSort(field) {
+        var so = {};
+
+        field = field.trim();
+        assert.ok(field, 'non-empty field');
+
+        if (field[0] === '-') {
+            so.field = field.slice(1);
+            so.reverse = true;
+        } else {
+            so.field = field;
+        }
+
+        switch (so.field) {
+        case 'ip':
+            so.keyFunc = common.ipv4ToLong;
+            break;
+        default:
+            break;
+        }
+
+        return so;
+    });
+
+    vasync.pipeline({arg: {cli: this.top}, funcs: [
+        common.cliSetupTritonApi,
+
+        function listIps(arg, next) {
+            self.top.tritonapi.listNetworkIps(args[0],
+                function (err, ips, res) {
+                 if (err) {
+                     next(err);
+                     return;
+                 }
+                 arg.ips = ips;
+                 next();
+            });
+        },
+
+       function doneIps(arg, next) {
+            var ips = arg.ips;
+            if (opts.json) {
+                common.jsonStream(ips);
+            } else {
+                tabula(ips, {
+                    skipHeader: opts.H,
+                    columns: columns,
+                    sort: sort
+                });
+            }
+            next();
+        }
+    ]}, callback);
+}
+
+do_list.options = [
+    {
+        names: ['help', 'h'],
+        type: 'bool',
+        help: 'Show this help.'
+    }
+].concat(common.getCliTableOptions({
+    includeLong: true,
+    sortDefault: sortDefault
+}));
+
+do_list.synopses = ['{{name}} {{cmd}} NETWORK'];
+
+do_list.help = [
+    'List network IPs.',
+    '',
+    '{{usage}}',
+    '',
+    '{{options}}',
+    'Fields (most are self explanatory, the significant ones are as follows):',
+    '    managed      IP is manged by Spearhead and cannot be modified directly.',
+    '',
+    'See https://apidocs.joyent.com/cloudapi/#ListNetworkIPs for a full' +
+        ' listing.'
+].join('\n');
+
+do_list.aliases = ['ls'];
+do_list.completionArgtypes = ['tritonnetwork', 'none'];
+
+module.exports = do_list;

lib/do_network/do_ip/do_update.js

@@ -0,0 +1,193 @@
+/*
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ */
+
+/*
+ * Copyright 2017 Joyent, Inc.
+ *
+ * `triton network ip update ...`
+ */
+
+var format = require('util').format;
+var fs = require('fs');
+
+var vasync = require('vasync');
+
+var common = require('../../common');
+var errors = require('../../errors');
+var UPDATE_NETWORK_IP_FIELDS
+    = require('../../cloudapi2').CloudApi.prototype.UPDATE_NETWORK_IP_FIELDS;
+
+function do_update(subcmd, opts, args, callback) {
+    if (opts.help) {
+        this.do_help('help', {}, [subcmd], callback);
+        return;
+    } else if (args.length < 2) {
+        callback(new errors.UsageError(format(
+            'incorrect number of args (%d)', args.length)));
+        return;
+    }
+
+    var log = this.log;
+    var tritonapi = this.top.tritonapi;
+    var updateIpOpts = {
+        id: args.shift(),
+        ip: args.shift()
+    };
+
+    if (args.length === 0 && !opts.file) {
+        callback(new errors.UsageError(
+            'FIELD=VALUE arguments or "-f FILE" must be specified'));
+        return;
+    }
+
+    vasync.pipeline({arg: {cli: this.top}, funcs: [
+        common.cliSetupTritonApi,
+
+        function gatherDataArgs(ctx, next) {
+            if (opts.file) {
+                next();
+                return;
+            }
+
+            try {
+                ctx.data = common.objFromKeyValueArgs(args, {
+                    disableDotted: true,
+                    typeHintFromKey: UPDATE_NETWORK_IP_FIELDS
+                });
+            } catch (err) {
+                next(err);
+                return;
+            }
+
+            next();
+        },
+
+        function gatherDataFile(ctx, next) {
+            if (!opts.file || opts.file === '-') {
+                next();
+                return;
+            }
+
+            var input = fs.readFileSync(opts.file, 'utf8');
+            try {
+                ctx.data = JSON.parse(input);
+            } catch (err) {
+                next(new errors.TritonError(format(
+                    'invalid JSON for network IP update in "%s": %s',
+                    opts.file, err)));
+                return;
+            }
+            next();
+        },
+
+        function gatherDataStdin(ctx, next) {
+            if (opts.file !== '-') {
+                next();
+                return;
+            }
+
+            common.readStdin(function gotStdin(stdin) {
+                try {
+                    ctx.data = JSON.parse(stdin);
+                } catch (err) {
+                    log.trace({stdin: stdin},
+                        'invalid network IP update JSON on stdin');
+                    next(new errors.TritonError(format(
+                        'invalid JSON for network IP update on stdin: %s',
+                        err)));
+                    return;
+                }
+                next();
+            });
+        },
+
+        function validateIt(ctx, next) {
+            try {
+                common.validateObject(ctx.data, UPDATE_NETWORK_IP_FIELDS);
+            } catch (e) {
+                next(e);
+                return;
+            }
+
+            next();
+        },
+
+        function updateNetworkIP(ctx, next) {
+            Object.keys(ctx.data).forEach(function (key) {
+                updateIpOpts[key] = ctx.data[key];
+            });
+
+            tritonapi.updateNetworkIp(updateIpOpts, function (err, body, res) {
+                if (err) {
+                    next(err);
+                    return;
+                }
+
+                if (opts.json) {
+                    console.log(JSON.stringify(body));
+                    next();
+                    return;
+                }
+
+                console.log('Updated network %s IP %s (fields: %s)',
+                    updateIpOpts.id, updateIpOpts.ip,
+                    Object.keys(ctx.data).join(', '));
+                next();
+            });
+        }
+    ]}, callback);
+}
+
+do_update.options = [
+    {
+        names: ['help', 'h'],
+        type: 'bool',
+        help: 'Show this help.'
+    },
+    {
+        names: ['file', 'f'],
+        type: 'string',
+        helpArg: 'FILE',
+        help: 'A file holding a JSON file of updates, or "-" to read ' +
+            'JSON from stdin.'
+    },
+    {
+        names: ['json', 'j'],
+        type: 'bool',
+        help: 'JSON output.'
+    }
+];
+
+do_update.synopses = [
+    '{{name}} {{cmd}} NETWORK IP [FIELD=VALUE ...]',
+    '{{name}} {{cmd}} NETWORK IP -f JSON-FILE'
+];
+
+do_update.help = [
+    /* BEGIN JSSTYLED */
+    'Update a network ip.',
+    '',
+    '{{usage}}',
+    '',
+    '{{options}}',
+    'Where NETWORK is a network id, and IP is the ip address you want to update.',
+    '',
+    'Updateable fields:',
+    '    ' + Object.keys(UPDATE_NETWORK_IP_FIELDS).sort().map(function (field) {
+        return field + ' (' + UPDATE_NETWORK_IP_FIELDS[field] + ')';
+    }).join('\n    '),
+
+    ''
+    /* END JSSTYLED */
+].join('\n');
+
+do_update.completionArgtypes = [
+    'tritonnetwork',
+    'tritonnetworkip',
+    'tritonupdatenetworkipfield'
+];
+
+module.exports = do_update;

lib/do_network/do_ip/index.js

@@ -0,0 +1,51 @@
+/*
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ */
+
+/*
+ * Copyright 2017 Joyent, Inc.
+ *
+ * `triton network ip...`
+ */
+
+var Cmdln = require('cmdln').Cmdln;
+var util = require('util');
+
+
+
+// ---- CLI class
+
+function IpCLI(top) {
+    this.top = top.top;
+    Cmdln.call(this, {
+        name: top.name + ' ip',
+        /* BEGIN JSSTYLED */
+        desc: [
+            'List and manage Spearhead network IPs.'
+        ].join('\n'),
+        /* END JSSTYLED */
+        helpOpts: {
+            minHelpCol: 24 /* line up with option help */
+        },
+        helpSubcmds: [
+            'help',
+            'list',
+            'get',
+            'update'
+        ]
+    });
+}
+util.inherits(IpCLI, Cmdln);
+
+IpCLI.prototype.init = function init(opts, args, cb) {
+    this.log = this.top.log;
+    Cmdln.prototype.init.apply(this, arguments);
+};
+
+IpCLI.prototype.do_list = require('./do_list');
+IpCLI.prototype.do_get = require('./do_get');
+IpCLI.prototype.do_update = require('./do_update');
+
+module.exports = IpCLI;

lib/do_network/do_list.js

@@ -48,7 +48,11 @@ function do_list(subcmd, opts, args, callback) {
     var sort = opts.s.split(',');
     var filters;
     try {
-        filters = common.kvToObj(args, validFilters);
+        filters = common.objFromKeyValueArgs(args, {
+            disableDotted: true,
+            validKeys: validFilters,
+            disableTypeConversions: true
+        });
     } catch (e) {
         callback(e);
         return;
@@ -62,14 +66,23 @@ function do_list(subcmd, opts, args, callback) {
         common.cliSetupTritonApi,
 
         function searchNetworks(arg, next) {
-            self.top.tritonapi.cloudapi.listNetworks(function (err, networks) {
+            // since this command is also used by do_vlan/do_networks.js
+            if (opts.vlan_id) {
+                self.top.tritonapi.listFabricNetworks({
+                    vlan_id: opts.vlan_id
+                }, listedNetworks);
+            } else {
+                self.top.tritonapi.cloudapi.listNetworks({}, listedNetworks);
+            }
+
+            function listedNetworks(err, networks) {
                  if (err) {
                      next(err);
                      return;
                  }
                  arg.networks = networks;
                  next();
-            });
+            }
         },
 
         function filterNetworks(arg, next) {

lib/do_network/do_set_default.js

@@ -0,0 +1,92 @@
+/*
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ */
+
+/*
+ * Copyright 2017 Joyent, Inc.
+ *
+ * `triton network set-default ...`
+ */
+
+var assert = require('assert-plus');
+var vasync = require('vasync');
+
+var common = require('../common');
+var errors = require('../errors');
+
+
+function do_set_default(subcmd, opts, args, cb) {
+    assert.func(cb, 'cb');
+
+    if (opts.help) {
+        this.do_help('help', {}, [subcmd], cb);
+        return;
+    }
+
+    if (args.length === 0) {
+        cb(new errors.UsageError('missing NETWORK argument'));
+        return;
+    } else if (args.length > 1) {
+        cb(new errors.UsageError('incorrect number of arguments'));
+        return;
+    }
+
+    var cli = this.top;
+
+    common.cliSetupTritonApi({cli: cli}, function onSetup(setupErr) {
+        if (setupErr) {
+            cb(setupErr);
+            return;
+        }
+
+        cli.tritonapi.getNetwork(args[0], function onNetwork(err, net) {
+            if (err) {
+                cb(err);
+                return;
+            }
+
+            var params = {
+                default_network: net.id
+            };
+
+            var cloudapi = cli.tritonapi.cloudapi;
+
+            cloudapi.updateConfig(params, function onUpdate(err2) {
+                if (err2) {
+                    cb(err2);
+                    return;
+                }
+
+                console.log('Set network %s (%s) as default.', net.name,
+                            net.id);
+                cb();
+            });
+        });
+    });
+}
+
+
+do_set_default.options = [
+    {
+        names: ['help', 'h'],
+        type: 'bool',
+        help: 'Show this help.'
+    }
+];
+
+do_set_default.synopses = ['{{name}} {{cmd}} NETWORK'];
+
+do_set_default.help = [
+    'Set default network.',
+    '',
+    '{{usage}}',
+    '',
+    '{{options}}',
+    'Where NETWORK is a network id (full UUID), name, or short id.'
+].join('\n');
+
+do_set_default.completionArgtypes = ['tritonnetwork'];
+
+module.exports = do_set_default;

lib/do_network/index.js

@@ -23,7 +23,7 @@ function NetworkCLI(top) {
         name: top.name + ' network',
         /* BEGIN JSSTYLED */
         desc: [
-            'List and manage Triton networks.'
+            'List and manage Spearhead networks.'
         ].join('\n'),
         /* END JSSTYLED */
         helpOpts: {
@@ -32,7 +32,12 @@ function NetworkCLI(top) {
         helpSubcmds: [
             'help',
             'list',
-            'get'
+            'get',
+            'ip',
+            'create',
+            'delete',
+            'get-default',
+            'set-default'
         ]
     });
 }
@@ -45,6 +50,11 @@ NetworkCLI.prototype.init = function init(opts, args, cb) {
 
 NetworkCLI.prototype.do_list = require('./do_list');
 NetworkCLI.prototype.do_get = require('./do_get');
+NetworkCLI.prototype.do_ip = require('./do_ip');
+NetworkCLI.prototype.do_create = require('./do_create');
+NetworkCLI.prototype.do_delete = require('./do_delete');
+NetworkCLI.prototype.do_get_default = require('./do_get_default');
+NetworkCLI.prototype.do_set_default = require('./do_set_default');
 
 
 module.exports = NetworkCLI;

lib/do_networks.js

@@ -20,7 +20,7 @@ function do_networks(subcmd, opts, args, callback) {
     }, callback);
 }
 
-do_networks.help = 'A shortcut for "triton network list".\n' + targ.help;
+do_networks.help = 'A shortcut for "spearhead network list".\n' + targ.help;
 do_networks.synopses = targ.synopses;
 do_networks.options = targ.options;
 do_networks.completionArgtypes = targ.completionArgtypes;

lib/do_package/do_get.js

@@ -29,6 +29,7 @@ function do_get(subcmd, opts, args, callback) {
     common.cliSetupTritonApi({cli: this.top}, function onSetup(setupErr) {
         if (setupErr) {
             callback(setupErr);
+            return;
         }
         tritonapi.getPackage(args[0], function onRes(err, pkg) {
             if (err) {

lib/do_package/do_list.js

@@ -63,7 +63,11 @@ function do_list(subcmd, opts, args, callback) {
 
     var listOpts;
     try {
-        listOpts = common.kvToObj(args, validFilters);
+        listOpts = common.objFromKeyValueArgs(args, {
+            disableDotted: true,
+            validKeys: validFilters,
+            disableTypeConversions: true
+        });
     } catch (e) {
         callback(e);
         return;

lib/do_package/index.js

@@ -23,7 +23,7 @@ function PackageCLI(top) {
         name: top.name + ' package',
         /* BEGIN JSSTYLED */
         desc: [
-            'List and get Triton packages.',
+            'List and get Spearhead packages.',
             '',
             'A package is a collection of attributes -- for example disk quota,',
             'amount of RAM -- used when creating an instance. They have a name',

lib/do_packages.js

@@ -20,7 +20,7 @@ function do_packages(subcmd, opts, args, callback) {
     }, callback);
 }
 
-do_packages.help = 'A shortcut for "triton package list".\n' + targ.help;
+do_packages.help = 'A shortcut for "spearhead package list".\n' + targ.help;
 do_packages.synopses = targ.synopses;
 do_packages.options = targ.options;
 do_packages.completionArgtypes = targ.completionArgtypes;

lib/do_profile/do_create.js

@@ -93,12 +93,8 @@ function _createProfile(opts, cb) {
                 next();
                 return;
             }
-            var stdin = '';
+
-            process.stdin.resume();
+            common.readStdin(function gotStdin(stdin) {
-            process.stdin.on('data', function (chunk) {
-                stdin += chunk;
-            });
-            process.stdin.on('end', function () {
                 try {
                     data = JSON.parse(stdin);
                 } catch (err) {
@@ -171,7 +167,7 @@ function _createProfile(opts, cb) {
                 defaults = ctx.copy;
                 delete defaults.name; // we don't copy a profile name
             } else {
-                defaults.url = 'https://us-sw-1.api.joyent.com';
+                defaults.url = 'https://eu-ro-1.api.spearhead.cloud';
             }
 
             /*
@@ -220,7 +216,7 @@ function _createProfile(opts, cb) {
 
             var fields = [ {
                 desc: 'A profile name. A short string to identify this ' +
-                    'profile to the `triton` command.',
+                    'profile to the `spearhead` command.',
                 key: 'name',
                 default: defaults.name,
                 validate: function validateName(value, valCb) {
@@ -359,7 +355,7 @@ function _createProfile(opts, cb) {
 
             console.log(common.ansiStylizeTty('\n\n# Docker setup\n', 'bold'));
             console.log(wrap80('This section will setup authentication to ' +
-                'Triton DataCenter\'s Docker endpoint using your account ' +
+                'Spearhead Datacenter\'s Docker endpoint using your account ' +
                 'and key information specified above. This is only required ' +
                 'if you intend to use `docker` with this profile.\n'));
 
@@ -428,7 +424,7 @@ do_create.options = [
         names: ['file', 'f'],
         type: 'string',
         helpArg: 'FILE',
-        help: 'A JSON file (of the same form as "triton profile get -j") ' +
+        help: 'A JSON file (of the same form as "spearhead profile get -j") ' +
             'with the profile, or "-" to read JSON from stdin.'
     },
     {
@@ -441,7 +437,7 @@ do_create.options = [
     {
         names: ['no-docker'],
         type: 'bool',
-        help: 'As of Triton CLI 4.9, creating a profile will attempt (on '
+        help: 'As of Spearhead CLI 4.9, creating a profile will attempt (on '
             + 'non-Windows) to also setup for running Docker. This is '
             + 'experimental and might fail. Use this option to disable '
             + 'the attempt.'
@@ -456,19 +452,19 @@ do_create.options = [
 
 do_create.synopses = ['{{name}} {{cmd}} [OPTIONS]'];
 do_create.help = [
-    'Create a Triton CLI profile.',
+    'Create a Spearhead CLI profile.',
     '',
     '{{usage}}',
     '',
     '{{options}}',
     '',
     'Examples:',
-    '    triton profile create              # interactively create a profile',
+    '    spearhead profile create              # interactively create a profile',
-    '    triton profile create --copy env   # ... copying from "env" profile',
+    '    spearhead profile create --copy env   # ... copying from "env" profile',
     '',
     '    # Or non-interactively create from stdin or a file:',
-    '    cat a-profile.json | triton profile create -f -',
+    '    cat a-profile.json | spearhead profile create -f -',
-    '    triton profile create -f another-profile.json'
+    '    spearhead profile create -f another-profile.json'
 ].join('\n');
 
 

lib/do_profile/do_delete.js

@@ -122,7 +122,7 @@ do_delete.options = [
 
 do_delete.synopses = ['{{name}} {{cmd}} PROFILE'];
 do_delete.help = [
-    'Delete a Triton CLI profile.',
+    'Delete a Spearhead CLI profile.',
     '',
     '{{usage}}',
     '',

lib/do_profile/do_docker_setup.js

@@ -23,7 +23,8 @@ function do_docker_setup(subcmd, opts, args, cb) {
         cli: this.top,
         name: profileName,
         implicit: false,
-        yes: opts.yes
+        yes: opts.yes,
+        lifetime: opts.lifetime
     }, cb);
 }
 
@@ -33,6 +34,11 @@ do_docker_setup.options = [
         type: 'bool',
         help: 'Show this help.'
     },
+    {
+        names: ['lifetime', 't'],
+        type: 'number',
+        help: 'Lifetime of the generated docker certificate, in days'
+    },
     {
         names: ['yes', 'y'],
         type: 'bool',
@@ -43,21 +49,21 @@ do_docker_setup.options = [
 do_docker_setup.synopses = ['{{name}} {{cmd}} [PROFILE]'];
 do_docker_setup.help = [
     /* BEGIN JSSTYLED */
-    'Setup for using Docker with the current Triton CLI profile.',
+    'Setup for using Docker with the current Spearhead CLI profile.',
     '',
     '{{usage}}',
     '',
     '{{options}}',
-    'A Triton datacenter can act as a virtual Docker Engine, where the entire',
+    'A Spearhead datacenter can act as a virtual Docker Engine, where the entire',
-    'datacenter is available on for running containers. The datacenter provides',
+    'datacenter is available for running containers. The datacenter provides',
     'an endpoint against which you can run the regular `docker` client. This',
     'requires a one time setup to (a) generate a client TLS certificate to enable',
-    'secure authentication with the Triton Docker Engine, and (b) to determine',
+    'secure authentication with the Spearhead Docker Engine, and (b) to determine',
     'the DOCKER_HOST and related environment variables.',
     '',
     'After running this, you can setup your shell environment for `docker` via:',
-    '    eval "$(triton env --docker)"',
+    '    eval "$(spearhead env --docker)"',
-    'or the equivalent. See `triton env --help` for details.'
+    'or the equivalent. See `spearhead env --help` for details.'
     /* END JSSTYLED */
 ].join('\n');