edgeway 0.1.0

data/js/wasi-shim.js

@@ -0,0 +1,191 @@
+// A minimal WASI preview 1 shim: stdout/stderr, args, environment, clocks,
+// random. No filesystem (no preopened directories); stdin serves the bytes
+// given as the stdin option (a string or Uint8Array), then EOF.
+// stdout/stderr go to onStdout/onStderr as decoded text, or, when
+// onStdoutBytes/onStderrBytes is given, to it as raw bytes (binary output).
+// Any import not implemented here answers ENOSYS.
+
+const ESUCCESS = 0, EBADF = 8, ENOSYS = 52, ESPIPE = 70;
+
+export class WasiExit extends Error {
+  constructor(code) {
+    super(`exit ${code}`);
+    this.code = code;
+  }
+}
+
+export class WASI {
+  // onStdout / onStderr receive decoded text chunks; onStdoutBytes /
+  // onStderrBytes, when given, receive Uint8Array chunks (copies) instead.
+  constructor({ args = ["main"], env = {}, stdin = new Uint8Array(0), onStdout = () => {}, onStderr = () => {},
+                onStdoutBytes = null, onStderrBytes = null } = {}) {
+    this.args = args;
+    this.stdin = typeof stdin === "string" ? new TextEncoder().encode(stdin) : stdin;
+    this.stdinPos = 0;
+    this.env = Object.entries(env).map(([k, v]) => `${k}=${v}`);
+    this.out = { 1: onStdout, 2: onStderr };
+    this.outBytes = { 1: onStdoutBytes, 2: onStderrBytes };
+    this.decoders = { 1: new TextDecoder(), 2: new TextDecoder() };
+    this.memory = null;
+    this.wasiImport = this.#imports();
+  }
+
+  // For a reactor module (no _start): hands the shim the memory and runs
+  // _initialize, if the module has one. The caller then calls the exports
+  // it wants; a proc_exit inside them throws WasiExit.
+  initialize(instance) {
+    this.memory = instance.exports.memory;
+    instance.exports._initialize?.();
+  }
+
+  // Runs the module's _start; answers the exit status.
+  start(instance) {
+    this.memory = instance.exports.memory;
+    try {
+      instance.exports._start();
+      return 0;
+    } catch (e) {
+      if (e instanceof WasiExit) return e.code;
+      throw e;
+    } finally {
+      for (const fd of [1, 2]) {
+        const rest = this.decoders[fd].decode();
+        if (rest) this.out[fd](rest);
+      }
+    }
+  }
+
+  // start for a module whose imports may suspend (JSPI): _start is wrapped
+  // with WebAssembly.promising, so a WebAssembly.Suspending import can await.
+  async startAsync(instance) {
+    this.memory = instance.exports.memory;
+    try {
+      await WebAssembly.promising(instance.exports._start)();
+      return 0;
+    } catch (e) {
+      if (e instanceof WasiExit) return e.code;
+      throw e;
+    } finally {
+      for (const fd of [1, 2]) {
+        const rest = this.decoders[fd].decode();
+        if (rest) this.out[fd](rest);
+      }
+    }
+  }
+
+  // The memory can grow, so views are made per call.
+  get #view() { return new DataView(this.memory.buffer); }
+  get #bytes() { return new Uint8Array(this.memory.buffer); }
+
+  #putStrings(strings, ptrs, buf) {
+    const enc = new TextEncoder();
+    const view = this.#view, bytes = this.#bytes;
+    for (const s of strings) {
+      const b = enc.encode(s + "\0");
+      view.setUint32(ptrs, buf, true);
+      bytes.set(b, buf);
+      ptrs += 4;
+      buf += b.length;
+    }
+    return ESUCCESS;
+  }
+
+  #sizes(strings, countPtr, sizePtr) {
+    const enc = new TextEncoder();
+    const view = this.#view;
+    view.setUint32(countPtr, strings.length, true);
+    view.setUint32(sizePtr, strings.reduce((n, s) => n + enc.encode(s).length + 1, 0), true);
+    return ESUCCESS;
+  }
+
+  #imports() {
+    const impl = {
+      args_get: (argv, buf) => this.#putStrings(this.args, argv, buf),
+      args_sizes_get: (c, s) => this.#sizes(this.args, c, s),
+      environ_get: (envp, buf) => this.#putStrings(this.env, envp, buf),
+      environ_sizes_get: (c, s) => this.#sizes(this.env, c, s),
+
+      clock_res_get: (_id, out) => {
+        this.#view.setBigUint64(out, 1000n, true);
+        return ESUCCESS;
+      },
+      clock_time_get: (id, _precision, out) => {
+        const ns = id === 0
+          ? BigInt(Date.now()) * 1_000_000n                      // REALTIME
+          : BigInt(Math.round(performance.now() * 1e6));         // MONOTONIC etc.
+        this.#view.setBigUint64(out, ns, true);
+        return ESUCCESS;
+      },
+
+      random_get: (buf, len) => {
+        // getRandomValues takes at most 65536 bytes per call.
+        for (let off = 0; off < len; off += 65536) {
+          crypto.getRandomValues(new Uint8Array(this.memory.buffer, buf + off, Math.min(65536, len - off)));
+        }
+        return ESUCCESS;
+      },
+
+      fd_write: (fd, iovs, iovsLen, nwritten) => {
+        if (!(fd in this.out)) return EBADF;
+        const view = this.#view;
+        let total = 0;
+        for (let i = 0; i < iovsLen; i++) {
+          const ptr = view.getUint32(iovs + i * 8, true);
+          const len = view.getUint32(iovs + i * 8 + 4, true);
+          const bytes = new Uint8Array(this.memory.buffer, ptr, len);
+          if (this.outBytes[fd]) {
+            if (len) this.outBytes[fd](bytes.slice());  // the memory is reused
+          } else {
+            const text = this.decoders[fd].decode(bytes, { stream: true });
+            if (text) this.out[fd](text);
+          }
+          total += len;
+        }
+        view.setUint32(nwritten, total, true);
+        return ESUCCESS;
+      },
+      fd_read: (fd, iovs, iovsLen, nread) => {
+        if (fd !== 0) return EBADF;
+        const view = this.#view, bytes = this.#bytes;
+        let total = 0;
+        for (let i = 0; i < iovsLen && this.stdinPos < this.stdin.length; i++) {
+          const ptr = view.getUint32(iovs + i * 8, true);
+          const len = view.getUint32(iovs + i * 8 + 4, true);
+          const chunk = this.stdin.subarray(this.stdinPos, this.stdinPos + len);
+          bytes.set(chunk, ptr);
+          this.stdinPos += chunk.length;
+          total += chunk.length;
+        }
+        view.setUint32(nread, total, true);  // 0 = EOF
+        return ESUCCESS;
+      },
+      fd_fdstat_get: (fd, out) => {
+        if (fd > 2) return EBADF;
+        const view = this.#view;
+        view.setUint8(out, 2);                        // filetype: CHARACTER_DEVICE
+        view.setUint16(out + 2, 0, true);             // flags
+        view.setBigUint64(out + 8, ~0n & 0xffffffffffffffffn, true);   // rights_base
+        view.setBigUint64(out + 16, ~0n & 0xffffffffffffffffn, true);  // rights_inheriting
+        return ESUCCESS;
+      },
+      fd_fdstat_set_flags: (fd) => (fd > 2 ? EBADF : ESUCCESS),
+      fd_close: (fd) => (fd > 2 ? EBADF : ESUCCESS),
+      fd_seek: (fd) => (fd > 2 ? EBADF : ESPIPE),
+      fd_pread: (fd) => (fd > 2 ? EBADF : ESPIPE),
+      fd_pwrite: (fd) => (fd > 2 ? EBADF : ESPIPE),
+      // EBADF from fd 3 tells wasi-libc there are no preopened directories.
+      fd_prestat_get: () => EBADF,
+      fd_prestat_dir_name: () => EBADF,
+      path_open: () => EBADF,
+      path_filestat_get: () => EBADF,
+
+      poll_oneoff: () => ENOSYS,
+      sched_yield: () => ESUCCESS,
+      proc_raise: () => ENOSYS,
+      proc_exit: (code) => { throw new WasiExit(code); },
+    };
+    return new Proxy(impl, {
+      get: (target, name) => target[name] ?? ((..._) => ENOSYS),
+    });
+  }
+}

data/lib/edgeway/application.rb

@@ -0,0 +1,70 @@
+module Edgeway
+  # The app's entry point: Edgeway.application.call(request) -> response.
+  # How a request gets in and the response out (CGI, later a reactor) is the
+  # job of Edgeway::Server.
+  class Application
+    attr_reader :routes
+
+    def initialize
+      @routes = Routing::RouteSet.new
+    end
+
+    def call(request)
+      request.read_body
+      route, path_params = @routes.recognize(request.method, request.path)
+      # Path parameters last: they win over the body's and the query's.
+      request.add_path_params(path_params)
+      Controller::Dispatcher.dispatch(route, request)
+    rescue RecordInvalid => e
+      # The error's own list (errors) is the body.
+      Controller::Rendering.json_response(422, JSON.generate({ "errors" => e.errors }))
+    rescue => e
+      rescue_default(e)
+    end
+
+    # What a request answers when no controller handled the error.
+    def rescue_default(e)
+      if e.is_a?(BadRequest)
+        message(400, e.message)
+      elsif e.is_a?(InvalidToken)
+        # The reason (e.message) goes to the log only; the client gets a fixed
+        # body and challenge, so a probe learns nothing from the wording.
+        Edgeway.logger.info "401 #{e.message}"
+        unauthorized("invalid token", 'Bearer error="invalid_token"')
+      elsif e.is_a?(Unauthorized)
+        Edgeway.logger.info "401 #{e.message}"
+        unauthorized("authentication required", "Bearer")
+      elsif e.is_a?(RecordNotUnique)
+        # The message names the table and columns: the log only.
+        Edgeway.logger.info "409 #{e.message}"
+        message(409, "record not unique")
+      elsif e.is_a?(RoutingError) || e.is_a?(RecordNotFound)
+        # The message can hold the path or an id from the request: the log only.
+        Edgeway.logger.info "404 #{e.message}"
+        message(404, "not found")
+      else
+        # The details go to the log (stderr), never to the client.
+        Edgeway.logger.error "#{e.class}: #{e.message}"
+        message(500, "internal error")
+      end
+    end
+
+    private
+
+    def unauthorized(text, challenge)
+      response = message(401, text)
+      response.headers["WWW-Authenticate"] = challenge
+      response
+    end
+
+    def message(status, text)
+      # .dup: since matz/spinel 44119ab30 (Strings shared by reference),
+      # Spinel refuses this String as it is, or emits C that doesn't compile.
+      Controller::Rendering.json_response(status, JSON.generate({ "error" => text.dup }))
+    end
+  end
+
+  def self.application
+    @application ||= Application.new
+  end
+end

data/lib/edgeway/cli/app_config.rb

@@ -0,0 +1,35 @@
+# frozen_string_literal: true
+
+module Edgeway
+  module CLI
+    class AppConfig
+      # adapter: => the file build/main.rb requires for it.
+      ADAPTERS = {
+        "d1" => "edgeway/service/cloudflare/d1",
+        "memory" => "edgeway/db/memory"
+      }.freeze
+
+      attr_reader :env, :adapter, :binding_name
+
+      def self.load(root, env)
+        path = File.join(root, "config", "database.yml")
+        raise Error, "no config/database.yml in #{root} (is this an Edgeway app?)" unless File.exist?(path)
+
+        section = (YAML.safe_load_file(path) || {})[env]
+        raise Error, "config/database.yml has no #{env} section" unless section.is_a?(Hash)
+
+        new(env, section["adapter"].to_s, (section["binding"] || "DB").to_s)
+      end
+
+      def initialize(env, adapter, binding_name)
+        raise Error, "unknown database adapter #{adapter.inspect} (one of #{ADAPTERS.keys.join(", ")})" unless ADAPTERS.key?(adapter)
+
+        @env = env
+        @adapter = adapter
+        @binding_name = binding_name
+      end
+
+      def adapter_file = ADAPTERS.fetch(@adapter)
+    end
+  end
+end

data/lib/edgeway/cli/app_files.rb

@@ -0,0 +1,37 @@
+# frozen_string_literal: true
+
+module Edgeway
+  module CLI
+    class AppFiles
+      def initialize(root)
+        @root = root
+      end
+
+      def require_lines
+        lines = []
+        app = File.join(@root, "app")
+        dirs = Dir.exist?(app) ? Dir.children(app).sort.select { |d| File.directory?(File.join(app, d)) } : []
+        dirs.each do |d|
+          next if %w[models controllers].include?(d)
+
+          lines.concat(requires("app/#{d}"))
+        end
+        lines.concat(requires("app/models"))
+        lines.concat(requires("app/controllers"))
+        lines << 'require_relative "../config/routes"'
+        lines
+      end
+
+      # require_relative lines for the .rb files under dir, application_*.rb first.
+      def requires(dir)
+        full = File.join(@root, dir)
+        return [] unless Dir.exist?(full)
+
+        files = Dir.glob("**/*.rb", base: full).map { |f| File.join(dir, f) }
+        first, rest = files.partition { |f| File.basename(f).start_with?("application_") }
+        # String#dump quotes a path with spaces, quotes or "#{" safely.
+        (first.sort + rest.sort).map { |f| "require_relative #{"../#{f.delete_suffix(".rb")}".dump}" }
+      end
+    end
+  end
+end

data/lib/edgeway/cli/build.rb

@@ -0,0 +1,90 @@
+# frozen_string_literal: true
+
+require "optparse"
+require "json"
+
+module Edgeway
+  module CLI
+    # edgeway build: app/, config/ -> build/main.rb -> build/app.wasm, and the
+    # gem's js/ -> build/edgeway/.
+    #
+    # Spinel resolves require at compile time and has no autoloading, so
+    # build/main.rb requires every file, in an order where a class body finds
+    # what it names (a superclass, an extended module):
+    #   1. edgeway, the database adapter config/database.yml names, and the JWT
+    #      verifier
+    #   2. app/*/ other than models/ and controllers/ (services, ...)
+    #   3. app/models/
+    #   4. app/controllers/
+    #   5. config/routes.rb
+    # Within each, application_*.rb come first (the base classes), then the
+    # rest by path (byte order).
+    class Build
+      def self.run(args)
+        env = "development"
+        OptionParser.new do |o|
+          o.banner = "Usage: edgeway build [--env ENV]"
+          o.on("--env ENV", "environment (default: development)") { |v| env = v }
+        end.parse!(args)
+        new(Dir.pwd, env).run
+      end
+
+      def initialize(root, env)
+        @root = root
+        @env = env
+      end
+
+      def run
+        raise Error, "no config/routes.rb in #{@root}" unless File.exist?(File.join(@root, "config/routes.rb"))
+
+        config = AppConfig.load(@root, @env)
+        FileUtils.mkdir_p(File.join(@root, "build"))
+        write_main(config)
+        copy_js(config)
+        compile
+        puts "built build/app.wasm (#{@env})"
+      end
+
+      private
+
+      def write_main(config)
+        lines = ["# Generated by `edgeway build` from app/ and config/; do not edit.", 'require "edgeway"']
+        lines << "require #{config.adapter_file.dump}"
+        # Always: js/cloudflare.js supplies the edgeway_jwt import to every app,
+        # and the verifier is only called by an app that authenticates.
+        lines << 'require "edgeway/service/cloudflare/jwt"'
+        lines << ""
+        lines << connection_line(config)
+        lines << "Edgeway::Auth.verifier = Edgeway::Cloudflare::JWTVerifier.new"
+        lines << ""
+        lines.concat(AppFiles.new(@root).require_lines)
+        lines << ""
+        lines << "Edgeway::Server.run"
+        File.write(File.join(@root, "build/main.rb"), lines.join("\n") + "\n")
+      end
+
+      def connection_line(config)
+        case config.adapter
+        when "d1" then %(Edgeway::Model.connection = Edgeway::Cloudflare::D1Adapter.new(binding: #{config.binding_name.inspect}))
+        else "Edgeway::Model.connection = Edgeway::DB::MemoryAdapter.new"
+        end
+      end
+
+      def copy_js(config)
+        dest = File.join(@root, "build/edgeway")
+        FileUtils.mkdir_p(dest)
+        Dir.glob(File.join(CLI.gem_dir, "js/*.js")).each { |f| FileUtils.cp(f, dest) }
+        js = "// Generated by `edgeway build` from config/database.yml; do not edit.\n" \
+             "export default #{JSON.generate({ "env" => config.env, "d1Binding" => config.binding_name })};\n"
+        File.write(File.join(dest, "config.js"), js)
+      end
+
+      def compile
+        spinel = Toolchain.spinel || raise(Error, "no Spinel compiler found (install it with mise, or set SPINEL=/path/to/spinel)")
+        cmd = [spinel, "-I", File.join(CLI.gem_dir, "lib"), "--target=wasm32-wasi", "build/main.rb", "-o", "build/app.wasm"]
+        puts cmd.join(" ")
+        system(*cmd, chdir: @root) || raise(Error, "spinel failed")
+      end
+    end
+  end
+end

data/lib/edgeway/cli/generate.rb

@@ -0,0 +1,160 @@
+# frozen_string_literal: true
+
+require_relative "../inflector"
+require_relative "package_manager"
+
+module Edgeway
+  module CLI
+    class Generate
+      USAGE = <<~TEXT
+        Usage: edgeway generate model NAME [field:type ...]
+               edgeway generate controller NAME [action ...]
+
+        Types: #{%w[string text integer float boolean datetime].join(", ")} (default string)
+      TEXT
+
+      # field type => [the column's SQL type, its attribute type]
+      # D1 is SQLite, which has no datetime/boolean type (only NULL, INTEGER,
+      # REAL, TEXT and BLOB): a datetime is TEXT (ISO 8601, as Model.now
+      # writes it) and a boolean is an INTEGER 0/1. It is SQLite's, not a
+      # Cloudflare, limit.
+      TYPES = {
+        "string" => ["TEXT", ":string"],
+        "text" => ["TEXT", ":string"],
+        "integer" => ["INTEGER", ":integer"],
+        "float" => ["REAL", ":float"],
+        "boolean" => ["INTEGER NOT NULL DEFAULT 0", ":boolean"],
+        "datetime" => ["TEXT", ":datetime"]
+      }.freeze
+
+      RESOURCE_ACTIONS = %w[index show create update destroy].freeze
+
+      def self.run(args)
+        kind, name, *rest = args
+        raise Error, USAGE unless %w[model controller].include?(kind) && name && !name.start_with?("-")
+
+        generator = new(Dir.pwd)
+        kind == "model" ? generator.model(name, rest) : generator.controller(name, rest)
+      end
+
+      def initialize(root)
+        @root = root
+        return if File.exist?(File.join(root, "config/routes.rb"))
+
+        raise Error, "no config/routes.rb in #{root}; run this inside an app made by `edgeway new`"
+      end
+
+      def model(name, fields)
+        base = underscore(name)
+        table = Inflector.pluralize(base)
+        columns = fields.map { |f| parse_field(f) }
+        write("app/models/#{base}.rb", model_source(camelize(base), columns))
+        write("db/migrations/#{next_migration_number}_create_#{table}.sql", migration_source(table, columns))
+        write("test/models/#{base}_test.rb", model_test_source(camelize(base)))
+        puts "\nApply the migration locally: #{PackageManager.exec} wrangler d1 migrations apply DB_NAME --local"
+      end
+
+      def controller(name, actions)
+        base = underscore(name).delete_suffix("_controller")
+        actions.each { |a| raise Error, "invalid action name: #{a}" unless a.match?(/\A[a-z_][a-z0-9_]*\z/) }
+        write("app/controllers/#{base}_controller.rb", controller_source(camelize(base), actions))
+        write("test/controllers/#{base}_test.rb", controller_test_source(camelize(base)))
+        puts "\nAdd to config/routes.rb:"
+        route_hints(base, actions).each { |l| puts "  #{l}" }
+      end
+
+      private
+
+      def underscore(name)
+        raise Error, "invalid name: #{name}" unless name.match?(/\A[A-Za-z][A-Za-z0-9_]*\z/)
+
+        name.gsub(/([A-Z]+)([A-Z][a-z])/, '\1_\2').gsub(/([a-z\d])([A-Z])/, '\1_\2').downcase
+      end
+
+      def camelize(name) = name.split("_").map(&:capitalize).join
+
+      # "title:string" => ["title", "TEXT", ":string"]
+      def parse_field(spec)
+        name, type = spec.split(":", 2)
+        type ||= "string"
+        raise Error, "invalid field name: #{spec}" unless name.match?(/\A[a-z_][a-z0-9_]*\z/)
+        raise Error, "unknown field type #{type} (#{TYPES.keys.join(", ")})" unless TYPES.key?(type)
+
+        [name, *TYPES[type]]
+      end
+
+      def model_source(klass, columns)
+        lines = columns.map do |name, _sql, attr|
+          attr == ":boolean" ? "  attribute :#{name}, :boolean, default: false" : "  attribute :#{name}, #{attr}"
+        end
+        lines << "  timestamps"
+        "class #{klass} < ApplicationModel\n#{lines.join("\n")}\nend\n"
+      end
+
+      def migration_source(table, columns)
+        lines = ["  id INTEGER PRIMARY KEY AUTOINCREMENT"]
+        columns.each { |name, sql, _attr| lines << "  #{name} #{sql}" }
+        lines << "  created_at TEXT" << "  updated_at TEXT"
+        "CREATE TABLE #{table} (\n#{lines.join(",\n")}\n);\n"
+      end
+
+      def model_test_source(klass)
+        <<~RUBY
+          require "edgeway/test"
+          require "test_helper"
+
+          class #{klass}Test < Edgeway::UnitTest
+            def test_starts_empty
+              assert_equal 0, #{klass}.count
+            end
+          end
+        RUBY
+      end
+
+      def controller_source(klass, actions)
+        defs = actions.map { |a| "  def #{a} = render json: {}\n" }
+        "class #{klass}Controller < ApplicationController\n#{defs.join("\n")}end\n"
+      end
+
+      def controller_test_source(klass)
+        <<~RUBY
+          require "edgeway/test"
+          require "test_helper"
+
+          class #{klass}Test < Edgeway::IntegrationTest
+            # def test_index
+            #   get "/#{underscore(klass)}"
+            #   assert_response 200
+            # end
+          end
+        RUBY
+      end
+
+      def route_hints(base, actions)
+        return ["r.resources :#{base}"] if actions.empty?
+
+        standard = actions & RESOURCE_ACTIONS
+        # Before the resources: "/todos/archive" would match "/todos/:id" first.
+        hints = (actions - standard).map { |a| "r.get \"/#{base}/#{a}\", to: \"#{base}##{a}\"" }
+        hints << "r.resources :#{base}, only: [#{standard.map { |a| ":#{a}" }.join(", ")}]" unless standard.empty?
+        hints
+      end
+
+      # NNNN, one above the highest numbered file in db/migrations (0001 for none).
+      def next_migration_number
+        dir = File.join(@root, "db/migrations")
+        last = Dir.exist?(dir) ? Dir.children(dir).filter_map { |f| f[/\A\d+/]&.to_i }.max.to_i : 0
+        format("%04d", last + 1)
+      end
+
+      def write(rel, text)
+        dest = File.join(@root, rel)
+        raise Error, "#{rel} already exists" if File.exist?(dest)
+
+        FileUtils.mkdir_p(File.dirname(dest))
+        File.write(dest, text)
+        puts "  create  #{rel}"
+      end
+    end
+  end
+end

data/lib/edgeway/cli/new.rb

@@ -0,0 +1,43 @@
+# frozen_string_literal: true
+
+require "erb"
+
+module Edgeway
+  module CLI
+    class New
+      TEMPLATES = File.expand_path("../generators/app/templates", __dir__)
+
+      def self.run(args)
+        name = args.first
+        raise Error, "Usage: edgeway new APP" if name.nil? || name.start_with?("-")
+        raise Error, "#{name} already exists" if File.exist?(name)
+
+        new(name).run
+      end
+
+      def initialize(dir)
+        @dir = dir
+        @name = File.basename(File.expand_path(dir)).gsub(/[^A-Za-z0-9_-]/, "-")
+        @version = Edgeway::VERSION
+      end
+
+      def run
+        Dir.glob("**/*", File::FNM_DOTMATCH, base: TEMPLATES).sort.each do |rel|
+          src = File.join(TEMPLATES, rel)
+          next if File.directory?(src) || File.basename(rel) == "."
+
+          dest = File.join(@dir, rel.delete_suffix(".tt"))
+          FileUtils.mkdir_p(File.dirname(dest))
+          if rel.end_with?(".tt")
+            File.write(dest, ERB.new(File.read(src), trim_mode: "-").result(binding))
+          else
+            FileUtils.cp(src, dest)
+          end
+          FileUtils.chmod(0o755, dest) if File.executable?(src)
+          puts "  create  #{dest}"
+        end
+        puts "\nNext: cd #{@dir} && bin/setup && bundle exec edgeway test && bin/build"
+      end
+    end
+  end
+end

data/lib/edgeway/cli/package_manager.rb

@@ -0,0 +1,21 @@
+# frozen_string_literal: true
+
+module Edgeway
+  module CLI
+    # The JavaScript package manager of an app made by `edgeway new`: the one
+    # place that names it. The templates (bin/*, README, mise.toml,
+    # wrangler.toml) ask it for the commands, so supporting another is a
+    # change here (and a way to choose it in New).
+    module PackageManager
+      NAME = "pnpm"
+
+      def self.name = NAME
+
+      # Installs package.json's dependencies (wrangler).
+      def self.install = "#{NAME} install"
+
+      # Runs a binary of the app's node_modules: `#{exec} wrangler dev`.
+      def self.exec = "#{NAME} exec"
+    end
+  end
+end