@crvouga/dev-fleet 0.1.0 → 0.2.0

package/src/cli/managed-health.ts

@@ -6,7 +6,7 @@ import { enrolledRoster } from '../definition';
 import type { Tailnet } from '../tailscale';
 import type { FleetNode } from '../types';
 import {
-  PUBLIC_HUB_URL,
+  publicHubUrl,
   verifyBeszel,
   type BeszelRequest,
 } from '../monitoring/beszel';
@@ -122,7 +122,7 @@ async function hubReachable(
  */
 async function publicEndpoint(fetcher: typeof fetch): Promise<Check> {
   try {
-    const response = await fetcher(`${PUBLIC_HUB_URL}/api/health`, {
+    const response = await fetcher(`${publicHubUrl()}/api/health`, {
       redirect: 'error',
       signal: AbortSignal.timeout(10_000),
     });
@@ -130,7 +130,7 @@ async function publicEndpoint(fetcher: typeof fetch): Promise<Check> {
       return {
         id: 'beszel:public-endpoint',
         status: 'pass',
-        summary: `Dashboard answers publicly at ${PUBLIC_HUB_URL}.`,
+        summary: `Dashboard answers publicly at ${publicHubUrl()}.`,
       };
   } catch {
     /* Connection details are not evidence; fall through. */
@@ -140,7 +140,7 @@ async function publicEndpoint(fetcher: typeof fetch): Promise<Check> {
     status: 'warn',
     summary: 'BESZEL_PUBLIC_ENDPOINT_OFFLINE',
     remedy: {
-      action: `${PUBLIC_HUB_URL} did not answer. Create the Cloudflare tunnel and store its token in the fleet's secrets, then run fleet-sync on the manager so the hub starts its Cloudflare connector. The private dashboard is unaffected.`,
+      action: `${publicHubUrl()} did not answer. Create the Cloudflare tunnel and store its token in the fleet's secrets, then run fleet-sync on the manager so the hub starts its Cloudflare connector. The private dashboard is unaffected.`,
     },
   };
 }

package/src/cli/node-sync.ts

@@ -2,6 +2,7 @@ import { join } from 'node:path';
 import { configureWorkspace } from '../configure';
 import { runCommand } from '../runner';
 import { FleetUsageError } from '../errors';
+import { packageInfo } from '../package-info';
 import type { Runner } from '../types';
 import type { Settings } from './settings';
 import type { CommandOutcome } from './contracts';
@@ -24,6 +25,12 @@ export async function syncNode(
       'Codex proxy node sync requires macOS/Linux/WSL. Use dev-fleet commands for native Windows configuration.'
     );
   const node = nodeId(options.id);
+  // An installed package is not a checkout, and the Git repository around it
+  // is the operator's own project: its HEAD is not a dev-fleet revision.
+  if (packageInfo().revision)
+    throw new FleetUsageError(
+      'fleet-node-sync works on a checkout of dev-fleet. Run fleet-sync instead: it converges this machine from a checkout it owns.'
+    );
   const head = await run(['git', 'rev-parse', '--verify', 'HEAD'], {
     cwd: settings.workspace,
   });

package/src/cli/program.ts

@@ -13,6 +13,14 @@ export interface Release {
   version: string;
   /** ISO timestamp recorded when this distribution was built; null for source runs. */
   releasedAt: string | null;
+  /** The commit a published package was built from: what fleet-sync run from
+   * it converges every machine to. Absent for source runs.
+   */
+  revision?: string | null;
+  /** The issue tracker of the package: where its users report a defect or
+   * ask for a feature.
+   */
+  issues?: string | null;
 }
 
 export const GLOBAL_OPTIONS = [
@@ -23,7 +31,8 @@ export const GLOBAL_OPTIONS = [
   { flag: '--non-interactive', description: 'Never open interactive prompts' },
   {
     flag: '--workspace <path>',
-    description: 'Existing manager checkout; does not clone or change it',
+    description:
+      'A dev-fleet checkout to run from instead of this package (development); does not clone or change it',
   },
   { flag: '--config <path>', description: 'Local, secret-free fleet roster' },
 ];
@@ -34,8 +43,10 @@ export const SOURCE_VERSION = '0.0.0-development';
 export function releaseLabel(release: Release): string {
   if (release.releasedAt)
     return `${release.version} (released ${release.releasedAt})`;
-  return release.version === SOURCE_VERSION
-    ? `${release.version} (unreleased source build)`
+  if (release.version === SOURCE_VERSION)
+    return `${release.version} (unreleased source build)`;
+  return release.revision
+    ? `${release.version} (commit ${release.revision})`
     : release.version;
 }
 
@@ -63,9 +74,14 @@ function createProgram(
       '',
       `Release: ${releaseLabel(release)}`,
       'Groups: fleet-* developer computers · t3-* T3 provider instances · cliproxy the CLI proxy service.',
-      'Apply on invocation (--dry-run previews): fleet-node-sync, t3-apply, t3-cleanup. fleet-sync confirms interactively or with --apply --yes.',
+      'Apply on invocation (--dry-run previews): fleet-node-sync, t3-apply, t3-cleanup. fleet-sync applies on invocation too; --apply --yes is still accepted.',
       'Preview until --apply --yes: fleet-repair, fleet-node-add. --json does not make a command read-only.',
       'Agents: devfleet commands --json. Menu: devfleet --interactive.',
+      ...(release.issues
+        ? [
+            `Bugs and feature requests: ${release.issues}. Report them there; never patch the installed package.`,
+          ]
+        : []),
     ].join('\n')
   );
   return program;

package/src/cli/project.ts

@@ -0,0 +1,51 @@
+import { readFileSync } from 'node:fs';
+import { dirname, join, resolve } from 'node:path';
+import { record } from '../config';
+
+/** The file a project keeps its fleet configuration in. */
+export const PROJECT_CONFIG = 'fleet.json';
+
+/** Another tool's fleet.json is not this one: a fleet configuration is a JSON
+ * object that names a manager. Whether it is a valid one is said later, with
+ * the file's path, by whatever reads it.
+ */
+function fleetConfiguration(path: string): boolean {
+  try {
+    const value: unknown = JSON.parse(readFileSync(path, 'utf8'));
+    return record(value) && record(value['manager']);
+  } catch {
+    return false;
+  }
+}
+
+/** The fleet.json of the project a command is run from: the closest one in
+ * the working directory or above it, or null.
+ */
+export function projectConfig(cwd: string): string | null {
+  let current = resolve(cwd);
+  while (true) {
+    const candidate = join(current, PROJECT_CONFIG);
+    if (fleetConfiguration(candidate)) return candidate;
+    const parent = dirname(current);
+    if (parent === current) return null;
+    current = parent;
+  }
+}
+
+/** A fleet is a project of your own: a fleet.json in Git, and the devfleet
+ * CLI run from inside it. This names that file for the whole command, and
+ * for everything the command starts in another directory (fleet-sync re-runs
+ * itself from a checkout of the revision). `DEVFLEET_CONFIG` names a file
+ * elsewhere and wins. Only the CLI does this: launchers and scheduled jobs
+ * run in directories that belong to other projects and read the copy
+ * fleet-sync installed.
+ */
+export function useProjectConfig(
+  env: NodeJS.ProcessEnv = process.env,
+  cwd = process.cwd()
+): string | null {
+  const named = env['DEVFLEET_CONFIG'];
+  const path = named ? resolve(cwd, named) : projectConfig(cwd);
+  if (path) env['DEVFLEET_CONFIG'] = path;
+  return path;
+}

package/src/cli/register-fleet.ts

@@ -6,6 +6,7 @@ import { resolveSettings } from './settings';
 import { executeFleet } from './fleet';
 import { fleetSync, type FleetSyncOptions } from './fleet-sync';
 import { syncNode, type NodeSyncOptions } from './node-sync';
+import { fleetState, type FleetStateOptions } from './fleet-state';
 
 type Complete = (outcome: CommandOutcome) => void;
 
@@ -172,7 +173,7 @@ function registerSync({ program, defaults, complete }: Registration) {
     )
     .option(
       '--revision <sha>',
-      'Approve an exact source commit; defaults to published release or current canonical checkout'
+      'Converge to an exact source commit; defaults to the commit the dev-fleet package you run was published from'
     )
     .option(
       '--node <id>',
@@ -228,6 +229,54 @@ function registerSync({ program, defaults, complete }: Registration) {
     });
 }
 
+function registerState({ program, complete }: Registration) {
+  program
+    .command('fleet-state')
+    .description(
+      'Show where the fleet state is kept and whether the bucket holds it; flags connect, upload and restore'
+    )
+    .option(
+      '--init',
+      'Connect the bucket: restore the fleet state from it, or seed it from this machine, and save its credentials for runs this machine starts by itself'
+    )
+    .option(
+      '--bucket <name>',
+      'With --init, when no fleet.json names the bucket: S3-compatible bucket name'
+    )
+    .option(
+      '--endpoint <url>',
+      'With --init: https origin of the S3 service; omit for AWS S3'
+    )
+    .option('--region <name>', 'With --init: bucket region, such as auto')
+    .option('--prefix <prefix>', 'With --init: key prefix; default dev-fleet')
+    .option(
+      '--directory <path>',
+      'With --init: replicate to a directory instead of a bucket'
+    )
+    .option(
+      '--import <path>',
+      'Store a fleet configuration without running fleet-sync'
+    )
+    .option(
+      '--export',
+      'Print the stored fleet configuration: the one fleet-sync last applied'
+    )
+    .option('--example', 'Print an example fleet.json to start a project from')
+    .option('--push', 'Upload this machine’s changes to the bucket')
+    .option(
+      '--restore',
+      'Replace this machine’s copy with the bucket’s version'
+    )
+    .option('--yes', 'With --restore: discard changes the bucket does not hold')
+    .addHelpText(
+      'after',
+      '\nRead-only without a flag. The bucket is the one named under "state" in fleet.json. Every command reads its credentials from DEVFLEET_BUCKET_ACCESS_KEY_ID and DEVFLEET_BUCKET_SECRET_ACCESS_KEY; --init also asks on the terminal. They are never taken from arguments.'
+    )
+    .action(async (_options, command: Command) => {
+      complete(await fleetState(command.optsWithGlobals<FleetStateOptions>()));
+    });
+}
+
 export function registerFleet(
   program: Command,
   defaults: Settings,
@@ -241,6 +290,7 @@ export function registerFleet(
     'List computers visible through Tailscale, including offline devices'
   );
   registerSync(registration);
+  registerState(registration);
   registerRepair(registration);
   registerNodes(registration);
 }

package/src/cli/registry.ts

@@ -59,10 +59,37 @@ export const COMMANDS: CommandSpec[] = [
     [
       'fleet-sync',
       'Synchronize the enrolled Ubuntu fleet',
-      'Manager push to all enrolled Ubuntu nodes at one approved revision over verified SSH; interactive confirmation or --apply --yes. Readiness is verified separately.',
+      'Manager push to all enrolled Ubuntu nodes at one approved revision over verified SSH: the commit the dev-fleet package was published from, with the fleet.json of the project it is run from. Interactive confirmation or --apply --yes. Readiness is verified separately.',
       ['ubuntu', 'enrollment', 'converge', 'sync'],
       true,
     ],
+    [
+      'fleet-state',
+      'Check the fleet state and its bucket',
+      'Read-only: where the fleet configuration, the roster and the approved revision are kept on this manager, and whether the bucket holds the same version. --example prints a fleet.json to start a project from; --export prints the configuration fleet-sync last applied; --import PATH stores one.',
+      ['state', 'bucket', 's3', 'backup', 'litestream', 'configuration'],
+    ],
+    [
+      'fleet-state --init',
+      'Connect the bucket and restore or seed the fleet state',
+      'Restore the fleet state from the bucket fleet.json names under "state" (or the one given with --bucket/--endpoint or --directory), or seed an empty bucket from this machine, and save the bucket and its credentials on this machine for runs it starts by itself. Credentials come from the environment or a terminal prompt.',
+      ['state', 'bucket', 's3', 'setup', 'restore', 'new manager'],
+      true,
+    ],
+    [
+      'fleet-state --push',
+      'Upload fleet state changes to the bucket',
+      'Upload changes this manager made while the bucket was unreachable. Refuses when the bucket has changed since.',
+      ['state', 'bucket', 'upload', 'replicate'],
+      true,
+    ],
+    [
+      'fleet-state --restore',
+      'Replace the local fleet state with the bucket’s',
+      'Discard this manager’s copy of the fleet state and download the bucket’s version. Needs --yes when this machine has changes the bucket does not hold.',
+      ['state', 'bucket', 'restore', 'recover', 'disposable'],
+      true,
+    ],
     [
       'fleet-node-sync',
       'Sync this node',

package/src/cli/roster.ts

@@ -1,22 +1,23 @@
-import { lstat, mkdir, open, readFile, rename, unlink } from 'node:fs/promises';
+import { mkdir, open, unlink } from 'node:fs/promises';
 import { dirname } from 'node:path';
-import { randomUUID } from 'node:crypto';
-import { parseConfig, record } from '../config';
+import { parseConfig } from '../config';
 import { FleetUsageError } from '../errors';
 import type { FleetConfig, FleetNode } from '../types';
 import { capabilities } from './options';
 import type { CliOptions } from './options';
+import { STATE_ROSTER, readRosterText, writeRosterText } from '../state/roster';
+import {
+  mutateState,
+  stateContext,
+  type Standing,
+  type StateContext,
+} from '../state/sync';
 
 export async function readRoster(path: string): Promise<FleetConfig | null> {
   try {
-    const info = await lstat(path);
-    if (!info.isFile() || info.size > 1024 * 1024)
-      throw new FleetUsageError(
-        'Roster must be a regular file smaller than 1 MiB; symlinks are not supported.'
-      );
-    return parseConfig(JSON.parse(await readFile(path, 'utf8')) as unknown);
+    const text = await readRosterText(path);
+    return text === null ? null : parseConfig(JSON.parse(text) as unknown);
   } catch (error) {
-    if (record(error) && error['code'] === 'ENOENT') return null;
     if (error instanceof FleetUsageError) throw error;
     throw new FleetUsageError(
       'Cannot read a valid roster. Use fleet-nodes --schema or choose --config PATH.'
@@ -24,6 +25,21 @@ export async function readRoster(path: string): Promise<FleetConfig | null> {
   }
 }
 
+/** The roster a fleet-sync needs: a missing one is an error, not an empty fleet. */
+export async function loadRoster(path: string): Promise<FleetConfig> {
+  let value: unknown;
+  try {
+    const text = await readRosterText(path);
+    if (text === null) throw new Error();
+    value = JSON.parse(text);
+  } catch {
+    throw new FleetUsageError(
+      'Cannot read fleet config. Run devfleet fleet-node-add or use --config PATH.'
+    );
+  }
+  return parseConfig(value);
+}
+
 export function nodeFromOptions(options: CliOptions): FleetNode {
   if (!options.id || !options.ssh || !options.path)
     throw new FleetUsageError(
@@ -46,18 +62,32 @@ function appendNode(
   return parseConfig({ version: 1, nodes: [...(existing?.nodes ?? []), node] });
 }
 
+export interface AddedNode {
+  roster: FleetConfig;
+  /** How the fleet state stands with the bucket; absent for a roster file. */
+  standing?: Standing;
+}
+
 export async function addNode(
   path: string,
   node: FleetNode,
-  apply: boolean
-): Promise<FleetConfig> {
-  if (!apply) return appendNode(await readRoster(path), node);
+  apply: boolean,
+  context: () => StateContext = stateContext
+): Promise<AddedNode> {
+  const save = async (): Promise<FleetConfig> => {
+    const roster = appendNode(await readRoster(path), node);
+    await writeRosterText(path, `${JSON.stringify(roster, null, 2)}\n`);
+    return roster;
+  };
+  if (!apply) return { roster: appendNode(await readRoster(path), node) };
+  if (path === STATE_ROSTER) {
+    const { value, standing } = await mutateState(context(), save);
+    return { roster: value, standing };
+  }
   await mkdir(dirname(path), { recursive: true, mode: 0o700 });
   const lock = await acquireLock(path);
   try {
-    const roster = appendNode(await readRoster(path), node);
-    await atomicWrite(path, roster);
-    return roster;
+    return { roster: await save() };
   } finally {
     await lock.close();
     await unlink(`${path}.lock`);
@@ -73,17 +103,3 @@ async function acquireLock(path: string) {
     );
   }
 }
-
-async function atomicWrite(path: string, roster: FleetConfig): Promise<void> {
-  const temporary = `${path}.${randomUUID()}.tmp`;
-  const handle = await open(temporary, 'wx', 0o600);
-  try {
-    await handle.writeFile(`${JSON.stringify(roster, null, 2)}\n`);
-    await handle.sync();
-    await handle.close();
-    await rename(temporary, path);
-  } finally {
-    await handle.close();
-    await unlink(temporary).catch(() => undefined);
-  }
-}

package/src/cli/settings.ts

@@ -1,10 +1,11 @@
 import { access } from 'node:fs/promises';
 import { dirname, join, resolve } from 'node:path';
-import { homedir } from 'node:os';
-import { fileURLToPath } from 'node:url';
+import { PACKAGE_ROOT, packageInfo } from '../package-info';
+import { STATE_ROSTER } from '../state/roster';
 
 export interface Settings {
   workspace: string;
+  /** A roster file, or `state:roster` for the roster in the fleet state. */
   config: string;
 }
 
@@ -30,16 +31,17 @@ async function findUp(start: string, name: string): Promise<string | null> {
 /** A dev-fleet checkout, as opposed to any other project that has a mise.toml. */
 const CHECKOUT_MARKER = 'bootstrap/fleet-manager-run.sh';
 
-/** Where this CLI's own files live: the package root, also when run by npx. */
-const packageRoot = (): string =>
-  fileURLToPath(new URL('../..', import.meta.url));
-
+/** Where the CLI runs from. A published package is its own workspace, whatever
+ * project it is run in; code run from a checkout uses the dev-fleet checkout
+ * the command is started in (development).
+ */
 async function findCheckout(start: string): Promise<string> {
+  if (packageInfo().revision) return PACKAGE_ROOT;
   let current = resolve(start);
   while (true) {
     if (await exists(join(current, CHECKOUT_MARKER))) return current;
     const parent = dirname(current);
-    if (parent === current) return packageRoot();
+    if (parent === current) return PACKAGE_ROOT;
     current = parent;
   }
 }
@@ -54,11 +56,12 @@ export async function resolveSettings(
       env['PERSONAL_WORKSPACE'] ??
       (await findCheckout(cwd))
   );
-  const config = resolve(
+  // A roster file is named explicitly; otherwise it is kept in the fleet state.
+  const named =
     overrides.config ??
-      env['PERSONAL_FLEET_CONFIG'] ??
-      (await findUp(cwd, '.fleet.local.json')) ??
-      join(homedir(), '.config/personal/fleet.json')
-  );
+    env['PERSONAL_FLEET_CONFIG'] ??
+    (await findUp(cwd, '.fleet.local.json'));
+  const config =
+    !named || named === STATE_ROSTER ? STATE_ROSTER : resolve(named);
   return { workspace, config };
 }

package/src/cli/source-operations.ts

@@ -1,6 +1,8 @@
 import type { Command } from 'commander';
 import type { CommandOutcome } from './contracts';
 import { spawn } from 'node:child_process';
+import { existsSync } from 'node:fs';
+import { homedir } from 'node:os';
 import { join } from 'node:path';
 import type { Settings } from './settings';
 
@@ -30,23 +32,45 @@ export function sourceOperation(args: string[]): string | undefined {
     : undefined;
 }
 
+/** These owners install from Git (a service keeps the commit it runs), so
+ * they run from a checkout: the one this CLI is in, or, for an installed
+ * package, the fleet-owned checkout of the revision fleet-sync applied on
+ * this machine. Null before the first fleet-sync.
+ */
+export function ownerCheckout(
+  workspace: string,
+  home = homedir()
+): string | null {
+  if (existsSync(join(workspace, '.git'))) return workspace;
+  const applied = join(home, '.local/share/personal/fleet/current');
+  return existsSync(join(applied, '.git')) ? applied : null;
+}
+
+const CHECKOUT_REQUIRED =
+  'This command runs from the revision fleet-sync applied on this machine, and none is applied yet. Run devfleet fleet-sync first.\n';
+
 export async function forwardSourceOperation(
   args: string[],
   settings: Settings
 ): Promise<number> {
   const operation = SOURCE_OPERATIONS[args[0]!]!;
   const [runtime, ...ownerArgs] = operation.command;
+  const checkout = ownerCheckout(settings.workspace);
+  if (!checkout) {
+    process.stderr.write(CHECKOUT_REQUIRED);
+    return 1;
+  }
   const resolved = ownerArgs.map((arg) =>
-    arg.includes('/') ? join(settings.workspace, arg) : arg
+    arg.includes('/') ? join(checkout, arg) : arg
   );
   return new Promise((resolve) => {
     const child = spawn(runtime!, [...resolved, ...args.slice(1)], {
-      cwd: settings.workspace,
+      cwd: checkout,
       stdio: 'inherit',
     });
     child.on('error', () => {
       process.stderr.write(
-        'This command requires the dev-fleet checkout and its toolchain.\n'
+        'This command requires python3 and the toolchain fleet-sync installs.\n'
       );
       resolve(1);
     });

package/src/cli/tailnet.ts

@@ -9,7 +9,7 @@ import { discoverTailnet } from '../tailscale';
 import { tailnetHealth } from '../tailnet-health';
 import { makeReport, renderReport, reportExitCode } from '../report';
 import { readRoster } from './roster';
-import { PUBLIC_HUB_URL } from '../monitoring/beszel';
+import { publicHubUrl } from '../monitoring/beszel';
 import { stableUrls } from './fleet-sync-output';
 import { timeout } from './options';
 import type { FleetServices } from './fleet';
@@ -89,7 +89,7 @@ export async function executeTailnet(
 
 /** Shown to people: the stable public name, never the tailnet address. */
 function publicDashboard(privateHub: string | null): string | null {
-  return privateHub ? PUBLIC_HUB_URL : null;
+  return privateHub ? publicHubUrl() : null;
 }
 
 async function healthContext(

package/src/definition.ts

@@ -4,6 +4,7 @@ import { FleetUsageError } from './errors';
 import { parseConfig, record } from './config';
 import type { FleetConfig } from './types';
 import { parseSecretsConfig, type SecretsConfig } from './secrets';
+import { parseLocation, type BucketLocation } from './state/bucket';
 
 export interface MachineDefinition {
   id: string;
@@ -26,10 +27,14 @@ export interface ManagerDefinition {
 }
 export interface FleetDefinition {
   version: 3;
-  /** The Git repository that holds this fleet's configuration and pins. */
+  /** The Git repository machines take dev-fleet's code from. */
   source: { repository: string };
   /** Where this fleet keeps its secrets. */
   secrets: SecretsConfig;
+  /** The bucket that holds the fleet state. Its credentials are never part
+   * of the configuration: they come from the environment of the command.
+   */
+  state?: BucketLocation;
   manager: ManagerDefinition;
   /** Stateless, replaceable Linux boxes; clients of the manager's services. */
   workers: MachineDefinition[];
@@ -137,6 +142,7 @@ export function parseDefinition(value: unknown): FleetDefinition {
       'version',
       'source',
       'secrets',
+      'state',
       'manager',
       'workers',
       'services',
@@ -155,6 +161,7 @@ export function parseDefinition(value: unknown): FleetDefinition {
     version: 3,
     source: source(value['source']),
     secrets: secrets(value['secrets']),
+    ...(value['state'] === undefined ? {} : { state: state(value['state']) }),
     manager: lead,
     workers,
     services: services(value['services']),
@@ -198,6 +205,18 @@ const account = (value: unknown): value is string =>
 function secrets(value: unknown): SecretsConfig {
   return parseSecretsConfig(value) ?? fail();
 }
+/** Says what is wrong with the block itself: a bucket has several settings. */
+function state(value: unknown): BucketLocation {
+  const bucket = parseLocation(value);
+  if (bucket.kind === 'directory') return { directory: bucket.path };
+  const { bucket: name, endpoint, region } = bucket;
+  return {
+    bucket: name,
+    ...(endpoint ? { endpoint } : {}),
+    ...(region ? { region } : {}),
+    prefix: bucket.prefix,
+  };
+}
 function source(value: unknown): FleetDefinition['source'] {
   if (
     !record(value) ||
@@ -221,6 +240,17 @@ function baseline(ubuntu: unknown): FleetDefinition['ubuntu'] {
   return ubuntu as FleetDefinition['ubuntu'];
 }
 
+/** The configuration as every machine keeps it at
+ * ~/.config/dev-fleet/fleet.json: without the bucket. Only the devfleet CLI
+ * on the manager reaches the bucket, and a launcher that still runs the
+ * revision from before the block existed must go on accepting the file while
+ * a sync is under way.
+ */
+export function installedDefinition(definition: FleetDefinition): string {
+  const { state: _bucket, ...machine } = definition;
+  return JSON.stringify(machine, null, 2) + '\n';
+}
+
 export function loadDefinition(path: string): FleetDefinition {
   try {
     return parseDefinition(JSON.parse(readFileSync(path, 'utf8')));

package/src/diagnostics.ts

@@ -71,7 +71,7 @@ export function diagnostic(node: string, check: Check): Diagnostic {
 }
 function scope(id: string): Diagnostic['scope'] {
   if (
-    /^(t3:manager-endpoint|ssh:|manager:|rollout:|source:|tailscale:(reachability|identity|enrolled-identity))/.test(
+    /^(t3:manager-(endpoint|origin)|ssh:|manager:|rollout:|source:|tailscale:(reachability|identity|enrolled-identity))/.test(
       id
     )
   )