Crate nixfleet_cli 

Shared CLI logic - table rendering, age math, status classification. Library form so binaries compose against it and unit tests exercise formatting without spinning up a real CP.

Re-exports

pub use config::ConfigError;

pub use config::FileConfig;

pub use config::Overrides;

pub use operator_cert::MintOperatorCertArgs;

pub use operator_cert::MintOutcome;

pub use operator_cert::mint_operator_cert;

Modules

color

Tiny ANSI helper. No colored/owo-colors dep - these are 4 codes.

commands

Operator subcommands of the nixfleet umbrella binary. Each module exposes a pub struct Args (derived from clap::Args, not Parser) and a pub fn run(args: Args) -> Result<()> handler.

config

Operator-side config: layered resolution + TOML round-trip.

operator_cert

Operator-cert mint. Offline crypto only - never opens a socket. Generates an ECDSA-P-256 keypair, signs a clientAuth-EKU child with the fleet root cert + key, atomic-writes both PEMs.

Structs

ResolvedClientConfig

Resolved operator-side config. Every field is required by the time we reach a network call; layered loader (flag > env > file) populates this.

StatusInputs

Functions

base_status_label 🔒

build_client

compliance_label 🔒

current_column 🔒

CURRENT-column rendering with a context-aware fallback chain. The agent’s post-activation closure observation (current_closure_hash) is the canonical value, but it’s None between rollout-open and ActivationCompleted (the switch-in-progress window). During that window the host is demonstrably executing pending_closure_hash — the closure the agent reported running when it acked the dispatch — and the operator wants to see it.

display_hash 🔒

format_age 🔒

layout_styled 🔒

paint_status 🔒

Map a STATUS label to its colored variant. FOOTGUN: \u{2026} also marks hash-column truncation in display_hash - only call this on STATUS labels emitted by status_label, never on hash columns.

render_events_summary

Compact summary table for --no-json mode. One line per event: seq ts kind host. The full payload is only available via the default JSON output.

render_hosts_table

Render nixfleet rollout hosts: wave-major listing of per-host dispatch state. Open dispatches show <open> in TERMINAL.

render_status_table

render_status_table_with_color

run_config_init

Write ~/.config/nixfleet/config.toml (or --path). Returns the absolute path so the bin can report it.

run_events

GET /v1/rollouts/{id}/events — chronological event_log stream. CLI subcommand: nixfleet rollout events <id>. Default output is JSON because payload shapes vary by kind — a single rendered table would mislead. json = false falls back to a compact summary (seq / ts / kind / host).

run_hosts

GET /v1/rollouts/{id}/hosts — per-host summary. CLI subcommand: nixfleet rollout hosts <id>.

run_status

short_ts 🔒

“2026-05-05T12:34:56.789Z” -> “2026-05-05 12:34:56” (denser column). Falls back to the original on parse fail so malformed rows surface.

status_label 🔒