4ward 0.1.0

package/crates/4ward-cli/src/commands/deploy.rs

@@ -0,0 +1,267 @@
+use super::{load_config, TEMPLATE};
+use clap::Args;
+use comfy_table::Table;
+
+#[derive(Args)]
+pub struct DeployArgs {
+    #[arg(long, default_value = "4ward.json")]
+    pub config: String,
+    #[arg(long)]
+    pub yes: bool,
+    /// Skip pushing built Lambda code (infra only)
+    #[arg(long)]
+    pub no_code: bool,
+}
+
+#[derive(Args)]
+pub struct DestroyArgs {
+    #[arg(long, default_value = "4ward.json")]
+    pub config: String,
+    #[arg(long)]
+    pub yes: bool,
+}
+
+fn slug(domain: &str) -> String {
+    domain.replace('.', "-")
+}
+
+fn stack_for(cfg: &fourward_core::FourwardConfig, domain: &str) -> String {
+    if cfg.domains.len() == 1 {
+        cfg.aws.stack_name.clone()
+    } else {
+        format!("{}-{}", cfg.aws.stack_name, slug(domain))
+    }
+}
+
+fn alias_map_json(cfg: &fourward_core::FourwardConfig, domain: &str) -> String {
+    let mut m = std::collections::HashMap::new();
+    for d in &cfg.domains {
+        if d.domain.eq_ignore_ascii_case(domain) {
+            for (a, dests) in &d.routes {
+                m.insert(format!("{a}@{}", d.domain), dests.clone());
+            }
+        }
+    }
+    serde_json::to_string(&m).unwrap_or("{}".into())
+}
+
+pub async fn run(args: DeployArgs) -> anyhow::Result<()> {
+    let cfg = load_config(&args.config)?;
+    let aws_cfg = aws_config::load_defaults(aws_config::BehaviorVersion::latest()).await;
+    // 1. Validate session.
+    let sts = aws_sdk_sts::Client::new(&aws_cfg);
+    let id = sts.get_caller_identity().send().await?;
+    println!("aws account: {}", id.account().unwrap_or("?"));
+
+    // 2. Build lambdas once (best-effort); zips reused for every domain stack.
+    let zips = if args.no_code { Vec::new() } else { try_build_lambdas() };
+
+    let cf = aws_sdk_cloudformation::Client::new(&aws_cfg);
+    for d in &cfg.domains {
+        deploy_one(&cf, &aws_cfg, &cfg, d, &zips).await?;
+    }
+    // 3. DNS: Route53 note or ASCII table for external.
+    sync_dns(&aws_cfg, &cfg).await;
+    Ok(())
+}
+
+#[allow(clippy::too_many_lines)]
+async fn deploy_one(
+    cf: &aws_sdk_cloudformation::Client,
+    aws_cfg: &aws_config::SdkConfig,
+    cfg: &fourward_core::FourwardConfig,
+    d: &fourward_core::DomainConfig,
+    zips: &[(String, Vec<u8>)],
+) -> anyhow::Result<()> {
+    let stack = stack_for(cfg, &d.domain);
+    let (arc_selector, arc_key) = detect_arc(aws_cfg, &d.domain).await;
+    let params = vec![
+        ("ProjectName", stack.clone()),
+        ("DomainName", d.domain.clone()),
+        ("RelayDomain", d.domain.clone()),
+        ("AliasMapJson", alias_map_json(cfg, &d.domain)),
+        ("CatchAll", d.catch_all.clone().unwrap_or_default()),
+        ("BannerEnabled", cfg.settings.banner_enabled.to_string()),
+        ("ApiEnabled", cfg.api.enabled.to_string()),
+        ("AllowedDomains", cfg.domains.iter().map(|d| d.domain.clone()).collect::<Vec<_>>().join(",")),
+        ("RetentionDays", cfg.settings.retention_days.to_string()),
+        ("RateLimit", cfg.api.rate_limit.requests_per_second.to_string()),
+        ("Burst", cfg.api.rate_limit.burst.to_string()),
+        ("ArcSelector", arc_selector),
+        ("ArcKeySsm", arc_key),
+    ];
+    let parameters: Vec<aws_sdk_cloudformation::types::Parameter> = params
+        .into_iter()
+        .map(|(k, v)| {
+            aws_sdk_cloudformation::types::Parameter::builder()
+                .parameter_key(k)
+                .parameter_value(v)
+                .build()
+        })
+        .collect();
+
+    let exists = cf.describe_stacks().stack_name(&stack).send().await.is_ok();
+    if exists {
+        println!("updating stack {stack}…");
+        let r = cf.update_stack()
+            .stack_name(&stack)
+            .template_body(TEMPLATE)
+            .set_parameters(Some(parameters))
+            .capabilities(aws_sdk_cloudformation::types::Capability::CapabilityIam)
+            .send()
+            .await;
+        match r {
+            Ok(_) => println!("update initiated"),
+            Err(e) => {
+                let s = format!("{e:?}");
+                if s.contains("No updates") {
+                    println!("no updates to perform");
+                } else {
+                    return Err(e.into());
+                }
+            }
+        }
+    } else {
+        println!("creating stack {stack}…");
+        cf.create_stack()
+            .stack_name(&stack)
+            .template_body(TEMPLATE)
+            .set_parameters(Some(parameters))
+            .capabilities(aws_sdk_cloudformation::types::Capability::CapabilityIam)
+            .send()
+            .await?;
+    }
+    println!("waiting for {stack}…");
+    // Simple poll loop instead of waiters (fewer deps).
+    for _ in 0..60 {
+        tokio::time::sleep(std::time::Duration::from_secs(10)).await;
+        if let Ok(o) = cf.describe_stacks().stack_name(&stack).send().await {
+            if let Some(s) = o.stacks().first() {
+                let st = format!("{:?}", s.stack_status());
+                println!("  status: {st}");
+                if st.contains("COMPLETE") && !st.contains("PROGRESS") {
+                    break;
+                }
+                if st.contains("FAILED") || st.contains("ROLLBACK_COMPLETE") {
+                    anyhow::bail!("stack failed: {st}");
+                }
+            }
+        }
+    }
+    // 4. Push real Lambda code (template ships a placeholder otherwise).
+    if !zips.is_empty() {
+        push_code(aws_cfg, &stack).await;
+    }
+    Ok(())
+}
+
+/// ARC auto-detect: `keys arc` stores PEM at /4ward/arc/<domain> (+ selector).
+async fn detect_arc(aws_cfg: &aws_config::SdkConfig, domain: &str) -> (String, String) {
+    let ssm = aws_sdk_ssm::Client::new(aws_cfg);
+    let key = format!("/4ward/arc/{domain}");
+    if ssm.get_parameter().name(&key).with_decryption(true).send().await.is_err() {
+        return (String::new(), String::new());
+    }
+    let sel = ssm.get_parameter().name(format!("{key}/selector")).send().await.ok()
+        .and_then(|o| o.parameter().and_then(|p| p.value().map(|s| s.to_string())))
+        .unwrap_or_else(|| "fw1".to_string());
+    println!("ARC key found for {domain} (selector {sel})");
+    (sel, key)
+}
+
+/// Build both lambdas to bootstrap.zip; returns (func_suffix, zip_bytes).
+fn try_build_lambdas() -> Vec<(String, Vec<u8>)> {
+    let ok = std::process::Command::new("cargo").arg("lambda").arg("--version").output().map(|o| o.status.success()).unwrap_or(false);
+    if !ok {
+        println!("cargo-lambda not found — deploying with placeholder code; run `cargo install cargo-lambda` for real traffic");
+        return Vec::new();
+    }
+    let mut out = Vec::new();
+    for (pkg, func) in [("lambda-forwarder", "forwarder"), ("lambda-api", "api")] {
+        println!("building {pkg} (arm64)…");
+        let st = std::process::Command::new("cargo").args(["lambda", "build", "--arm64", "--release", "--package", pkg, "--output-format", "zip"]).status();
+        match st {
+            Ok(s) if s.success() => {
+                let zip = format!("target/lambda/{pkg}/bootstrap.zip");
+                match std::fs::read(&zip) {
+                    Ok(b) => {
+                        println!("{pkg} built ({} bytes)", b.len());
+                        out.push((func.to_string(), b));
+                    }
+                    Err(_) => println!("{pkg} built but {zip} missing — placeholder kept"),
+                }
+            }
+            _ => println!("{pkg} build failed — continuing with placeholder"),
+        }
+    }
+    out
+}
+
+async fn push_code(aws_cfg: &aws_config::SdkConfig, stack: &str) {
+    let lambda = aws_sdk_lambda::Client::new(aws_cfg);
+    // zips rebuilt per deploy; re-read from disk (single source of truth).
+    for (pkg, func) in [("lambda-forwarder", "forwarder"), ("lambda-api", "api")] {
+        let zip = format!("target/lambda/{pkg}/bootstrap.zip");
+        let bytes = match std::fs::read(&zip) {
+            Ok(b) => b,
+            Err(_) => continue,
+        };
+        let name = format!("{stack}-{func}");
+        println!("updating code for {name}…");
+        match lambda.update_function_code().function_name(&name).zip_file(aws_sdk_lambda::primitives::Blob::new(bytes)).send().await {
+            Ok(_) => println!("{name} updated"),
+            Err(e) => println!("{name} code update failed: {e:?} (infra is live with previous code)"),
+        }
+    }
+}
+
+async fn sync_dns(aws_cfg: &aws_config::SdkConfig, cfg: &fourward_core::FourwardConfig) {
+    let r53 = aws_sdk_route53::Client::new(aws_cfg);
+    for d in &cfg.domains {
+        let hosted = r53.list_hosted_zones_by_name().dns_name(&d.domain).send().await.ok()
+            .and_then(|o| o.hosted_zones().first().cloned());
+        let is_route53 = matches!(d.dns_provider, fourward_core::DnsProvider::Route53) && hosted.is_some();
+        if is_route53 {
+            println!("Route53 zone found for {} — add MX/SPF/DKIM via `4ward dns --format bind` or console", d.domain);
+        } else {
+            println!("external DNS for {} — add these records:", d.domain);
+            print_dns(cfg);
+        }
+    }
+}
+
+fn print_dns(cfg: &fourward_core::FourwardConfig) {
+    let mut t = Table::new();
+    t.set_header(vec!["Type", "Name", "Value"]);
+    let region = &cfg.aws.region;
+    for d in &cfg.domains {
+        for r in fourward_core::records_for_domain(&d.domain, region, &fourward_core::placeholder_dkim_tokens()) {
+            let val = if r.record_type == "CNAME" && r.value.starts_with("token") {
+                format!("{} (see SES console for real DKIM token)", r.value)
+            } else {
+                r.value.clone()
+            };
+            t.add_row(vec![r.record_type.clone(), r.name.clone(), val]);
+        }
+    }
+    println!("{t}");
+}
+
+pub async fn destroy(args: DestroyArgs) -> anyhow::Result<()> {
+    let cfg = load_config(&args.config)?;
+    let stacks: Vec<String> = cfg.domains.iter().map(|d| stack_for(&cfg, &d.domain)).collect();
+    if !args.yes {
+        let ok = inquire::Confirm::new(&format!("Delete stacks {}?", stacks.join(", "))).with_default(false).prompt()?;
+        if !ok {
+            println!("aborted");
+            return Ok(());
+        }
+    }
+    let aws_cfg = aws_config::load_defaults(aws_config::BehaviorVersion::latest()).await;
+    let cf = aws_sdk_cloudformation::Client::new(&aws_cfg);
+    for stack in &stacks {
+        cf.delete_stack().stack_name(stack).send().await?;
+        println!("delete initiated for {stack}");
+    }
+    Ok(())
+}

package/crates/4ward-cli/src/commands/dns.rs

@@ -0,0 +1,60 @@
+use super::load_config;
+use clap::Args;
+use comfy_table::Table;
+
+#[derive(Args)]
+pub struct DnsArgs {
+    #[arg(long, default_value = "4ward.json")]
+    pub config: String,
+    #[arg(long, default_value = "table", value_parser = ["table", "json", "bind"])]
+    pub format: String,
+    #[arg(long, default_value = "us-east-1")]
+    pub region: String,
+}
+
+pub async fn run(args: DnsArgs) -> anyhow::Result<()> {
+    let cfg = load_config(&args.config).unwrap_or_else(|_| {
+        // Allow `4ward dns` with explicit domain-less fallback? Require config.
+        eprintln!("cannot load config, using empty");
+        std::process::exit(1);
+    });
+    let region = if cfg.aws.region.is_empty() { args.region } else { cfg.aws.region.clone() };
+    // Try live DKIM tokens via SES; fall back to placeholders (external DNS pre-deploy).
+    let tokens = fetch_dkim_tokens(&cfg.domains.first().map(|d| d.domain.clone()).unwrap_or_default(), &region).await
+        .unwrap_or_else(fourward_core::placeholder_dkim_tokens);
+
+    let mut all = Vec::new();
+    for d in &cfg.domains {
+        all.extend(fourward_core::records_for_domain(&d.domain, &region, &tokens));
+    }
+    match args.format.as_str() {
+        "json" => println!("{}", serde_json::to_string_pretty(&all)?),
+        "bind" => {
+            for r in &all {
+                println!("{}.\t{}\tIN\t{}\t{}", r.name, r.ttl, r.record_type, r.value);
+            }
+        }
+        _ => {
+            let mut t = Table::new();
+            t.set_header(vec!["Type", "Name", "Value", "Purpose"]);
+            for r in &all {
+                t.add_row(vec![r.record_type.clone(), r.name.clone(), r.value.clone(), r.purpose.clone()]);
+            }
+            println!("{t}");
+        }
+    }
+    Ok(())
+}
+
+async fn fetch_dkim_tokens(domain: &str, region: &str) -> Option<Vec<String>> {
+    if domain.is_empty() {
+        return None;
+    }
+    let config = aws_config::load_defaults(aws_config::BehaviorVersion::latest()).await;
+    let client = aws_sdk_sesv2::Client::new(&config);
+    let _ = region;
+    let out = client.get_email_identity().email_identity(domain).send().await.ok()?;
+    out.dkim_attributes()
+        .map(|d| d.tokens().to_vec())
+        .filter(|t| t.len() == 3)
+}

package/crates/4ward-cli/src/commands/init.rs

@@ -0,0 +1,38 @@
+use clap::Args;
+use fourward_core::{ApiConfig, AwsConfig, DomainConfig, DnsProvider, EngineSettings, FourwardConfig, RateLimitConfig};
+use std::collections::HashMap;
+
+#[derive(Args)]
+pub struct InitArgs {
+    #[arg(long, default_value = "4ward.json")]
+    pub output: String,
+}
+
+pub async fn run(args: InitArgs) -> anyhow::Result<()> {
+    let domain = inquire::Text::new("Primary domain (e.g. example.com)").prompt()?;
+    let region = inquire::Text::new("AWS region").with_default("us-east-1").prompt()?;
+    let stack = inquire::Text::new("Stack name").with_default(&format!("4ward-{}", domain.replace('.', "-"))).prompt()?;
+    let alias = inquire::Text::new("First alias (local part)").with_default("hello").prompt()?;
+    let dest = inquire::Text::new("Where should it forward to?").prompt()?;
+    let dns_provider = inquire::Select::new("DNS provider", vec!["route53", "external"]).prompt()?.to_string();
+
+    let mut routes = HashMap::new();
+    routes.insert(alias, vec![dest]);
+    let cfg = FourwardConfig {
+        version: "1".into(),
+        project: "4ward".into(),
+        aws: AwsConfig { region, profile: "default".into(), stack_name: stack },
+        api: ApiConfig { enabled: true, cors: vec!["*".into()], rate_limit: RateLimitConfig { requests_per_second: 100, burst: 200 } },
+        settings: EngineSettings { banner_enabled: true, retention_days: 1, sender_format: "{name} (via {alias}) <relay@{domain}>".into() },
+        domains: vec![DomainConfig {
+            domain,
+            dns_provider: if dns_provider == "route53" { DnsProvider::Route53 } else { DnsProvider::External },
+            catch_all: None,
+            routes,
+        }],
+    };
+    cfg.validate().map_err(|e| anyhow::anyhow!("{e}"))?;
+    std::fs::write(&args.output, serde_json::to_string_pretty(&cfg)?)?;
+    println!("wrote {}", args.output);
+    Ok(())
+}

package/crates/4ward-cli/src/commands/keys.rs

@@ -0,0 +1,113 @@
+use clap::{Args, Subcommand};
+
+#[derive(Args)]
+pub struct KeysArgs {
+    #[command(subcommand)]
+    pub cmd: KeyCmd,
+}
+
+#[derive(Subcommand)]
+pub enum KeyCmd {
+    /// Generate Bearer token and store in SSM at /4ward/api-keys/<name>
+    Create {
+        name: String,
+        #[arg(long, default_value = "/4ward/api-keys/")]
+        prefix: String,
+    },
+    /// List key names under prefix (names only, never values)
+    List {
+        #[arg(long, default_value = "/4ward/api-keys/")]
+        prefix: String,
+    },
+    /// Delete a key
+    Revoke {
+        name: String,
+        #[arg(long, default_value = "/4ward/api-keys/")]
+        prefix: String,
+    },
+    /// Generate ARC seal RSA keypair for a domain (deploy auto-wires it)
+    Arc {
+        domain: String,
+        #[arg(long, default_value = "fw1")]
+        selector: String,
+    },
+}
+
+pub async fn run(args: KeysArgs) -> anyhow::Result<()> {
+    let config = aws_config::load_defaults(aws_config::BehaviorVersion::latest()).await;
+    let ssm = aws_sdk_ssm::Client::new(&config);
+    match args.cmd {
+        KeyCmd::Create { name, prefix } => {
+            let token = gen_token();
+            ssm.put_parameter()
+                .name(format!("{prefix}{name}"))
+                .value(&token)
+                .r#type(aws_sdk_ssm::types::ParameterType::SecureString)
+                .overwrite(true)
+                .send()
+                .await?;
+            println!("{token}");
+            eprintln!("stored at {prefix}{name} — copy it now, it won't be shown again");
+        }
+        KeyCmd::List { prefix } => {
+            let out = ssm.describe_parameters()
+                .parameter_filters(aws_sdk_ssm::types::ParameterStringFilter::builder().key("Name").option("BeginsWith").values(&prefix).build()?)
+                .send().await?;
+            for p in out.parameters() {
+                println!("{}", p.name().unwrap_or(""));
+            }
+        }
+        KeyCmd::Revoke { name, prefix } => {
+            ssm.delete_parameter().name(format!("{prefix}{name}")).send().await?;
+            println!("revoked {prefix}{name}");
+        }
+        KeyCmd::Arc { domain, selector } => {
+            let (pem, pub_b64) = gen_arc_keypair()?;
+            let key_param = format!("/4ward/arc/{domain}");
+            ssm.put_parameter().name(&key_param).value(&pem)
+                .r#type(aws_sdk_ssm::types::ParameterType::SecureString)
+                .overwrite(true).send().await?;
+            ssm.put_parameter().name(format!("{key_param}/selector")).value(&selector)
+                .r#type(aws_sdk_ssm::types::ParameterType::String)
+                .overwrite(true).send().await?;
+            let rec = fourward_core::arc_record(&selector, &domain, &pub_b64);
+            println!("private key → {key_param} (deploy wires it automatically)");
+            println!("add this DNS record:\n{} TXT {} \"{}\"", rec.name, rec.ttl, rec.value);
+        }
+    }
+    Ok(())
+}
+
+fn gen_token() -> String {
+    use rand::RngCore;
+    let mut b = [0u8; 16];
+    rand::thread_rng().fill_bytes(&mut b);
+    format!("4w_live_{}", hex::encode(b))
+}
+
+/// Generate RSA-2048 ARC seal keypair. Returns (private PEM, public DER base64).
+pub fn gen_arc_keypair() -> anyhow::Result<(String, String)> {
+    use base64::{engine::general_purpose::STANDARD as B64, Engine};
+    use rsa::pkcs1::{EncodeRsaPrivateKey, EncodeRsaPublicKey};
+    let key = rsa::RsaPrivateKey::new(&mut rand::thread_rng(), 2048)?;
+    let pem = key.to_pkcs1_pem(rsa::pkcs1::LineEnding::LF)?.to_string();
+    let der_b64 = B64.encode(key.to_public_key().to_pkcs1_der()?.as_bytes());
+    Ok((pem, der_b64))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    #[test]
+    fn token_shape() {
+        let t = gen_token();
+        assert!(t.starts_with("4w_live_"));
+        assert_eq!(t.len(), "4w_live_".len() + 32);
+    }
+    #[test]
+    fn arc_keypair_shape() {
+        let (pem, b64) = gen_arc_keypair().unwrap();
+        assert!(pem.contains("BEGIN RSA PRIVATE KEY"));
+        assert!(b64.len() > 200);
+    }
+}

package/crates/4ward-cli/src/commands/mod.rs

@@ -0,0 +1,14 @@
+pub mod alias;
+pub mod deploy;
+pub mod dns;
+pub mod init;
+pub mod keys;
+pub mod request_prod;
+pub mod status;
+
+pub const TEMPLATE: &str = include_str!("../../templates/template.yaml");
+
+pub fn load_config(path: &str) -> anyhow::Result<fourward_core::FourwardConfig> {
+    let s = std::fs::read_to_string(path).map_err(|_| anyhow::anyhow!("config not found: {path} (run `4ward init`)"))?;
+    fourward_core::FourwardConfig::from_json(&s).map_err(|e| anyhow::anyhow!("{e}"))
+}

package/crates/4ward-cli/src/commands/request_prod.rs

@@ -0,0 +1,38 @@
+use clap::Args;
+
+#[derive(Args)]
+pub struct RequestProdArgs {
+    #[arg(long)]
+    pub website: Option<String>,
+    #[arg(long)]
+    pub contact: Option<String>,
+}
+
+pub async fn run(args: RequestProdArgs) -> anyhow::Result<()> {
+    let website = match args.website {
+        Some(w) => w,
+        None => inquire::Text::new("Project website URL").prompt()?,
+    };
+    let contact = match args.contact {
+        Some(c) => c,
+        None => inquire::Text::new("Operations contact email").prompt()?,
+    };
+    let description = format!(
+        "Transactional email for {website}. Automated bounce/complaint handling via SES reputation alarms, \
+         transactional account events only (verification codes, receipts, alerts), double opt-in for any marketing. \
+         Contact: {contact}."
+    );
+    let config = aws_config::load_defaults(aws_config::BehaviorVersion::latest()).await;
+    let ses = aws_sdk_sesv2::Client::new(&config);
+    ses.put_account_details()
+        .mail_type(aws_sdk_sesv2::types::MailType::Transactional)
+        .website_url(&website)
+        .contact_language("EN".into())
+        .use_case_description(&description)
+        .additional_contact_email_addresses(&contact)
+        .production_access_enabled(true)
+        .send()
+        .await?;
+    println!("production access request submitted for {website}");
+    Ok(())
+}

package/crates/4ward-cli/src/commands/status.rs

@@ -0,0 +1,21 @@
+use clap::Args;
+
+#[derive(Args)]
+pub struct StatusArgs {
+    #[arg(long, default_value = "4ward.json")]
+    pub config: String,
+}
+
+pub async fn run(_args: StatusArgs) -> anyhow::Result<()> {
+    let config = aws_config::load_defaults(aws_config::BehaviorVersion::latest()).await;
+    let ses = aws_sdk_sesv2::Client::new(&config);
+    let acct = ses.get_account().send().await?;
+    let sandbox = !acct.production_access_enabled();
+    println!("Sandbox mode: {}", if sandbox { "YES (request-production to lift)" } else { "NO (production)" });
+    match acct.send_quota() {
+        Some(q) => println!("24h quota: {q:?}"),
+        None => println!("24h quota: n/a"),
+    }
+    println!("Enforcement: {:?}", acct.enforcement_status().map(|s| format!("{s:?}")));
+    Ok(())
+}

package/crates/4ward-cli/src/main.rs

@@ -0,0 +1,45 @@
+mod commands;
+
+use clap::{Parser, Subcommand};
+
+#[derive(Parser)]
+#[command(name = "4ward", version, about = "Serverless email infrastructure for AWS in Rust")]
+struct Cli {
+    #[command(subcommand)]
+    cmd: Commands,
+}
+
+#[derive(Subcommand)]
+enum Commands {
+    /// Interactive questionnaire — writes validated 4ward.json
+    Init(commands::init::InitArgs),
+    /// Compile lambdas (if cargo-lambda present) + deploy CloudFormation stack
+    Deploy(commands::deploy::DeployArgs),
+    /// SES sandbox, quota & bounce inspector
+    Status(commands::status::StatusArgs),
+    /// Automated SES production access request (sesv2:PutAccountDetails)
+    RequestProduction(commands::request_prod::RequestProdArgs),
+    /// DNS export (table, json, bind)
+    Dns(commands::dns::DnsArgs),
+    /// Bearer token manager (SSM /4ward/api-keys/*)
+    Keys(commands::keys::KeysArgs),
+    /// Hot alias routing editor (edits 4ward.json routes)
+    Alias(commands::alias::AliasArgs),
+    /// Tear down the CloudFormation stack
+    Destroy(commands::deploy::DestroyArgs),
+}
+
+#[tokio::main]
+async fn main() -> anyhow::Result<()> {
+    let cli = Cli::parse();
+    match cli.cmd {
+        Commands::Init(a) => commands::init::run(a).await,
+        Commands::Deploy(a) => commands::deploy::run(a).await,
+        Commands::Status(a) => commands::status::run(a).await,
+        Commands::RequestProduction(a) => commands::request_prod::run(a).await,
+        Commands::Dns(a) => commands::dns::run(a).await,
+        Commands::Keys(a) => commands::keys::run(a).await,
+        Commands::Alias(a) => commands::alias::run(a).await,
+        Commands::Destroy(a) => commands::deploy::destroy(a).await,
+    }
+}