@dooer/dooer-test-env 1.0.0

package/lib/bankid.js

@@ -0,0 +1,130 @@
+// BankID config for the local env — pulled from staging, stored in the macOS keychain, injected into the
+// service-accounts container at `up` time.
+//
+// Why: service-accounts runs @dooer/config, where `bankIdIsProduction` defaults to true but is forced
+// FALSE for the `local` environment — so with DOOER_ENVIRONMENT_NAME=local the bankid library falls back to
+// its built-in TEST cert + https://appapi2.test.bankid.com. Staging (s-e032, no override) runs PRODUCTION
+// BankID with the real client PFX from the `s-e032-service-accounts` k8s secret. To log in on the local HQ
+// exactly like staging we need that PFX/passphrase AND the env override DOOER_BANK_ID_IS_PRODUCTION=true
+// (a @dooer/config env override wins over the per-environment value).
+//
+// Storage: the secrets live in the macOS keychain (never in the generated compose file or a plaintext env
+// file). At `up` the values are read from the keychain into the docker-compose child env and interpolated
+// into service-accounts' `${SECRET_DOOER_BANK_ID_*}` / `${DOOER_BANK_ID_IS_PRODUCTION}` references only.
+
+const { spawnSync } = require('child_process')
+
+// keychain coordinates
+const KEYCHAIN_ACCOUNT = 'dooer-test-env'
+// the three secret keys service-accounts reads (names = @dooer/config's derived env vars, matching the
+// staging manifest). CA cert is unused by the current login code path but pulled for parity with staging.
+const SECRET_KEYS = [
+  'SECRET_DOOER_BANK_ID_PFX',
+  'SECRET_DOOER_BANK_ID_PFX_PASSPHRASE',
+  'SECRET_DOOER_BANK_ID_CA_CERTIFICATE',
+]
+const DEFAULT_NAMESPACE = 'dooer-staging'
+const DEFAULT_SECRET = 's-e032-service-accounts'
+
+function sh(cmd, args, input) {
+  const r = spawnSync(cmd, args, { encoding: 'utf8', input })
+  return { status: r.status, stdout: (r.stdout || '').trim(), stderr: (r.stderr || '').trim() }
+}
+
+function keychainService(key) {
+  return `dooer-test-env-bankid:${key}`
+}
+
+// Read one secret from the keychain (null if absent). `security -w` prints the password as a lowercase hex
+// string for longer values (observed for the multi-KB PFX + CA cert) and verbatim for short ones (the
+// passphrase). Our real values are base64/PEM/text — none are pure lowercase hex — so when the output IS
+// pure even-length lowercase hex we decode it back. (Missing this returned the hex text as the PFX →
+// createSecureContext "header too long".)
+function keychainGet(key) {
+  const r = sh('security', ['find-generic-password', '-a', KEYCHAIN_ACCOUNT, '-s', keychainService(key), '-w'])
+  if (r.status !== 0) return null
+  const out = r.stdout
+  if (out && out.length % 2 === 0 && /^[0-9a-f]+$/.test(out)) return Buffer.from(out, 'hex').toString('utf8')
+  return out
+}
+
+// Store one secret (upsert: -U replaces an existing item). Value passed via -w (argv) — acceptable for a
+// dev tool on a single-user machine; the keychain is the durable store.
+function keychainSet(key, value) {
+  const r = sh('security', [
+    'add-generic-password',
+    '-U',
+    '-a',
+    KEYCHAIN_ACCOUNT,
+    '-s',
+    keychainService(key),
+    '-w',
+    value,
+  ])
+  if (r.status !== 0) throw new Error(`keychain store failed for ${key}: ${r.stderr}`)
+}
+
+function keychainDelete(key) {
+  return sh('security', ['delete-generic-password', '-a', KEYCHAIN_ACCOUNT, '-s', keychainService(key)]).status === 0
+}
+
+// Pull the bankid secrets out of the staging k8s secret via kubectl. k8s stores each value base64-encoded
+// in `.data`; we decode to the raw value the staging container would receive (for the PFX that raw value is
+// itself the base64 PFX string, exactly what @dooer/config's `Buffer.from(pfx,'base64')` expects).
+function pullFromStaging({ namespace = DEFAULT_NAMESPACE, secret = DEFAULT_SECRET } = {}) {
+  const r = sh('kubectl', ['-n', namespace, 'get', 'secret', secret, '-o', 'json'])
+  if (r.status !== 0) throw new Error(`kubectl get secret ${namespace}/${secret} failed: ${r.stderr || r.stdout}`)
+  const data = JSON.parse(r.stdout).data || {}
+  const out = {}
+  SECRET_KEYS.forEach((key) => {
+    if (data[key] == null) return // CA cert may be absent in some envs — skip quietly
+    out[key] = Buffer.from(data[key], 'base64').toString('utf8')
+  })
+  if (!out.SECRET_DOOER_BANK_ID_PFX) {
+    throw new Error(`secret ${namespace}/${secret} has no SECRET_DOOER_BANK_ID_PFX — wrong secret?`)
+  }
+  return out
+}
+
+// Pull + store in the keychain. Returns the list of keys stored (never the values).
+function pullAndStore(opts = {}) {
+  const values = pullFromStaging(opts)
+  const stored = []
+  Object.entries(values).forEach(([key, value]) => {
+    keychainSet(key, value)
+    stored.push(key)
+  })
+  return stored
+}
+
+// Which secrets are present in the keychain.
+function status() {
+  return SECRET_KEYS.map((key) => ({ key, present: keychainGet(key) != null }))
+}
+
+function clear() {
+  return SECRET_KEYS.filter((key) => keychainDelete(key))
+}
+
+// The env map to inject into the service-accounts container at `up`. Empty (→ test-mode fallback) when the
+// PFX isn't in the keychain; otherwise the certs + DOOER_BANK_ID_IS_PRODUCTION=true (matching staging).
+function loadEnv() {
+  const env = {}
+  SECRET_KEYS.forEach((key) => {
+    const v = keychainGet(key)
+    if (v != null) env[key] = v
+  })
+  if (env.SECRET_DOOER_BANK_ID_PFX) env.DOOER_BANK_ID_IS_PRODUCTION = 'true'
+  return env
+}
+
+module.exports = {
+  SECRET_KEYS,
+  DEFAULT_NAMESPACE,
+  DEFAULT_SECRET,
+  pullFromStaging,
+  pullAndStore,
+  status,
+  clear,
+  loadEnv,
+}

package/lib/cli.js

@@ -0,0 +1,27 @@
+const yargs = require('yargs')
+const { hideBin } = require('yargs/helpers')
+const pkg = require('../package.json')
+
+// One CLI for the local test environment: bring up the full backend locally (staging DB minus
+// customers), copy/purge customers between environments, and shred — see ENVIRONMENT-PLAN.md.
+// Command groups are wired as modules under ./command.
+module.exports = async function cli() {
+  return yargs(hideBin(process.argv))
+    .scriptName('dooer-test-env')
+    .usage('$0 <group> <command> [options]')
+    .version(pkg.version)
+    .command(require('./command/setup')) // prerequisites + registry login + compose generation
+    .command(require('./command/env')) // up / down / start / stop / status
+    .command(require('./command/service')) // service start|stop|restart|deploy|local|unlocal|version
+    .command(require('./command/db')) // db build|pull|snapshot|rollback
+    .command(require('./command/customer')) // customer copy|purge
+    .command(require('./command/shred')) // shred (localhost only)
+    .command(require('./command/bankid')) // bankid pull|status|clear (staging certs → keychain)
+    .command(require('./command/logs')) // search logs across all local services (transactionId, errors, …)
+    .command(require('./command/measure')) // resource-usage report for the running env
+    .demandCommand(1, 'Pick a command group. Try --help.')
+    .strict()
+    .help()
+    .wrap(Math.min(120, yargs().terminalWidth()))
+    .parseAsync()
+}

package/lib/command/bankid.js

@@ -0,0 +1,45 @@
+const chalk = require('chalk')
+const bankid = require('../bankid')
+
+// BankID config for the local env. `pull` copies the client PFX/passphrase (+ CA cert) out of the staging
+// k8s secret into the macOS keychain; `up` then injects them into service-accounts so the local BankID flow
+// behaves like staging (production BankID) instead of the library's built-in test cert. See lib/bankid.js.
+module.exports = {
+  command: 'bankid <command>',
+  describe: 'BankID certs for local login: pull from staging → keychain (used by service-accounts)',
+  builder: (y) =>
+    y
+      .command({
+        command: 'pull',
+        describe: 'pull the BankID PFX/passphrase from the staging secret into the keychain',
+        builder: (y2) =>
+          y2
+            .option('namespace', { type: 'string', default: bankid.DEFAULT_NAMESPACE })
+            .option('secret', { type: 'string', default: bankid.DEFAULT_SECRET }),
+        handler: (argv) => {
+          const stored = bankid.pullAndStore({ namespace: argv.namespace, secret: argv.secret })
+          console.log(chalk.green(`bankid: stored ${stored.length} secret(s) in the keychain: ${stored.join(', ')}`))
+          console.log(chalk.gray('run `dooer-test-env up` (or restart service-accounts) to apply — production BankID.'))
+        },
+      })
+      .command({
+        command: 'status',
+        describe: 'show which BankID secrets are in the keychain',
+        handler: () => {
+          bankid.status().forEach((s) => {
+            console.log(`${s.present ? chalk.green('✓') : chalk.gray('·')} ${s.key}`)
+          })
+        },
+      })
+      .command({
+        command: 'clear',
+        describe: 'remove the BankID secrets from the keychain (reverts to test mode)',
+        handler: () => {
+          const removed = bankid.clear()
+          console.log(`bankid: removed ${removed.length} secret(s) from the keychain`)
+        },
+      })
+      .demandCommand(1)
+      .strict(),
+  handler: () => {},
+}

package/lib/command/customer.js

@@ -0,0 +1,108 @@
+const chalk = require('chalk')
+const engine = require('../engine/seed')
+const { purge } = require('../engine/purge')
+const { createAccount, SUBSCRIPTION_TYPES } = require('../account')
+
+// Map yargs values back to the engine's own flag argv, then let the engine's proven parser apply its
+// defaults + validation. Keeps ONE source of truth for option semantics (lib/engine/seed.js).
+function toEngineArgv(argv) {
+  const a = []
+  const flag = (name, val) => {
+    if (val !== undefined && val !== null && val !== false) a.push(`--${name}`, String(val))
+  }
+  flag('source', argv.source)
+  flag('target', argv.target)
+  flag('name', argv.name)
+  flag('owner-user', argv.ownerUser)
+  flag('source-namespace', argv.sourceNamespace)
+  flag('target-namespace', argv.targetNamespace)
+  flag('email', argv.email)
+  flag('if-target-nonempty', argv.ifTargetNonempty)
+  flag('salt', argv.salt)
+  if (argv.only) a.push('--only', [].concat(argv.only).join(','))
+  if (argv.skipTables) a.push('--skip-tables', [].concat(argv.skipTables).join(','))
+  if (argv.execute) a.push('--execute')
+  if (argv.skipFiles) a.push('--skip-files')
+  if (argv.skipUsers) a.push('--skip-users')
+  if (argv.confirmProduction) a.push('--confirm-production')
+  return a
+}
+
+const copyOptions = (y) =>
+  y
+    .option('source', { type: 'string', demandOption: true, describe: 'org (companies_pk) to copy FROM' })
+    .option('target', { type: 'string', describe: 'existing org to copy INTO' })
+    .option('name', { type: 'string', describe: 'create a NEW target org with this name (needs --owner-user)' })
+    .option('owner-user', { type: 'string', describe: 'existing user (users_pk) to own a newly-created org' })
+    .option('source-namespace', { type: 'string', default: 'dooer-staging', describe: 'k8s namespace to read from' })
+    .option('target-namespace', { type: 'string', describe: 'k8s namespace to write to (default = source)' })
+    .option('email', { type: 'string', describe: 'address to scrub emails to (default testcustomer@dooer.com)' })
+    .option('if-target-nonempty', {
+      choices: ['refuse', 'insert'],
+      describe: 'behaviour if a copy table already has target rows (default refuse)',
+    })
+    .option('only', { type: 'string', describe: 'copy ONLY these tables (comma-separated); pass-1 still scans all' })
+    .option('skip-tables', { type: 'string', describe: 'copy all tables EXCEPT these (comma-separated)' })
+    .option('salt', { type: 'string', describe: 'extra entropy for the deterministic remap salt (rarely needed)' })
+    .option('skip-files', { type: 'boolean', describe: 'skip the S3 file copy' })
+    .option('skip-users', { type: 'boolean', describe: 'skip copying referenced users missing from the target' })
+    .option('confirm-production', { type: 'boolean', describe: 'REQUIRED to write to dooer-production' })
+    .option('execute', { type: 'boolean', default: false, describe: 'actually write (default: dry-run)' })
+
+module.exports = {
+  command: 'customer <command>',
+  describe: 'copy or purge a customer organization between environments',
+  builder: (y) =>
+    y
+      .command({
+        command: 'copy',
+        describe: 'copy one org into another (dry-run by default; emails anonymized)',
+        builder: copyOptions,
+        handler: (argv) => engine.main(engine.parseArgs(toEngineArgv(argv))),
+      })
+      .command({
+        command: 'purge',
+        describe: 'delete a single org’s data (inverse of copy; files included). Dry-run by default.',
+        builder: (y2) =>
+          y2
+            .option('org', { type: 'string', demandOption: true, describe: 'org (companies_pk) to delete' })
+            .option('namespace', { type: 'string', default: 'dooer-staging', describe: 'k8s namespace' })
+            .option('skip-files', { type: 'boolean', describe: 'do not delete the org’s S3 objects' })
+            .option('confirm-production', { type: 'boolean', describe: 'REQUIRED to delete from dooer-production' })
+            .option('execute', { type: 'boolean', default: false, describe: 'actually delete (default: dry-run)' }),
+        handler: (argv) =>
+          purge({
+            org: argv.org,
+            namespace: argv.namespace,
+            skipFiles: argv.skipFiles,
+            confirmProduction: argv.confirmProduction,
+            execute: argv.execute,
+          }),
+      })
+      .command({
+        command: 'new <name>',
+        describe:
+          'create an empty functional test account (company + Owner + Ghost-Inspector subscriptions) in the LOCAL DB',
+        builder: (y2) =>
+          y2
+            .positional('name', { type: 'string', describe: 'company name for the new account' })
+            .option('owner', { type: 'string', demandOption: true, describe: 'user (users_pk) to set as Owner' })
+            .option('port', { type: 'number', default: 55432, describe: 'local Postgres port' })
+            .option('execute', { type: 'boolean', default: false, describe: 'actually create (default: dry-run)' }),
+        handler: async (argv) => {
+          const local = { host: 'localhost', port: argv.port, user: 'dooer', password: 'dooer', database: 'dooer' }
+          const res = await createAccount({ local, name: argv.name, ownerUserId: argv.owner, execute: argv.execute })
+          if (argv.execute) {
+            console.log(chalk.green(`\ncreated account "${res.name}"`))
+            console.log(`  org id:        ${res.orgId}`)
+            console.log(`  short name:    ${res.shortName}`)
+            console.log(`  owner:         ${argv.owner} (${res.owner}) — role Owner`)
+            console.log(`  partner:       ${res.partner}`)
+            console.log(`  subscriptions: ${SUBSCRIPTION_TYPES.join(', ')} (active)`)
+          }
+        },
+      })
+      .demandCommand(1, 'Use: customer copy | customer purge | customer new')
+      .strict(),
+  handler: () => {},
+}

package/lib/command/db.js

@@ -0,0 +1,156 @@
+const os = require('os')
+const path = require('path')
+const chalk = require('chalk')
+const dbbuild = require('../engine/dbbuild')
+const obc = require('../obc')
+const { shred } = require('../shred')
+const { auditPii } = require('../shred/audit')
+const { ensureRoles } = require('../db/roles')
+
+// Base DB: the customer-free, anonymized artifact and local restore points. `db build` runs ONLY as an
+// in-cluster k8s Job (devs never run it); devs `db pull`. See ENVIRONMENT-PLAN.md §5.
+
+// shredFn injected into build(): shred the scratch DB, then FAIL the build if the PII audit finds any
+// uncovered PII column (the drift backstop).
+async function shredAndAudit(client) {
+  await shred(client, { execute: true, verbose: true })
+  const a = await auditPii(client)
+  if (a.uncovered.length) {
+    a.uncovered.forEach((u) => console.error(`  UNCOVERED ${u.category}: ${u.schema}.${u.table}.${u.column}`))
+    throw new Error(
+      `PII audit failed: ${a.uncovered.length} uncovered column(s) — add rules before shipping a base artifact`
+    )
+  }
+  console.log(`PII audit clean (covered ${a.covered}, scanned ${a.scanned}).`)
+}
+
+module.exports = {
+  command: 'db <command>',
+  describe: 'base DB: build (in-cluster), pull, and local snapshots',
+  builder: (y) =>
+    y
+      .command({
+        command: 'build',
+        describe: 'in-cluster: copy → purge customers → shred → audit → publish base artifact (OBC)',
+        builder: (y2) =>
+          y2
+            .option('execute', { type: 'boolean', default: false })
+            .option('obc-namespace', {
+              type: 'string',
+              describe: 'namespace of the OBC (for upload); omit in-cluster (env-provided)',
+            })
+            .option('allow', { type: 'string', describe: 'comma-separated org uuids to spare from the purge' }),
+        handler: async (argv) => {
+          const src = {
+            host: process.env.DOOER_SQL_HOST,
+            port: Number(process.env.DOOER_SQL_PORT || 5432),
+            user: process.env.DOOER_SQL_MIGRATION_USER || process.env.DOOER_SQL_APPLICATION_USER || 'postgres',
+            password:
+              process.env.SECRET_DOOER_SQL_MIGRATION_PASSWORD ||
+              process.env.DOOER_SQL_MIGRATION_PASSWORD ||
+              process.env.DOOER_SQL_APPLICATION_PASSWORD,
+            database: 'dooer',
+          }
+          if (argv.execute && !src.host) {
+            throw new Error(
+              'db build runs in-cluster: DOOER_SQL_HOST (+ creds) must be set. Devs use `db pull`, not `db build`.'
+            )
+          }
+          // scratch = a SEPARATE postgres (the CronJob's sidecar at localhost), never dooer-database
+          const scratch = {
+            host: process.env.DOOER_SCRATCH_HOST || 'localhost',
+            port: Number(process.env.DOOER_SCRATCH_PORT || 5432),
+            user: process.env.DOOER_SCRATCH_USER || 'postgres',
+            password: process.env.DOOER_SCRATCH_PASSWORD || 'postgres',
+          }
+          const artifactOut = path.join(os.tmpdir(), `dooer-base-db-${new Date().toISOString().slice(0, 10)}.dump`)
+          await dbbuild.build({
+            source: src,
+            scratch,
+            artifactOut,
+            shredFn: shredAndAudit,
+            upload: async (file) => {
+              const cfg = obc.obcConfig({ namespace: argv.obcNamespace })
+              const key = await obc.upload(cfg, file)
+              console.log(`uploaded base artifact → ${cfg.bucket}/${key}`)
+            },
+            execute: argv.execute,
+          })
+        },
+      })
+      .command({
+        command: 'pull',
+        aliases: ['bootstrap'],
+        describe: 'fetch the newest base artifact and restore it into the LOCAL Postgres',
+        builder: (y2) =>
+          y2
+            .option('execute', { type: 'boolean', default: false })
+            .option('obc-namespace', {
+              type: 'string',
+              default: 'dooer-staging',
+              describe: 'namespace of the OBC to read the artifact from',
+            })
+            .option('port', { type: 'number', default: 55432 }),
+        handler: async (argv) => {
+          const local = { host: 'localhost', port: argv.port, user: 'dooer', password: 'dooer', database: 'dooer' }
+          await dbbuild.pull({
+            local,
+            download: async () => {
+              const cfg = obc.obcConfig({ namespace: argv.obcNamespace })
+              const out = path.join(os.tmpdir(), 'dooer-base-db.pulled.dump')
+              const { file, key } = await obc.download(cfg, out)
+              console.log(chalk.gray(`downloaded ${cfg.bucket}/${key}`))
+              return file
+            },
+            execute: argv.execute,
+          })
+          if (argv.execute) {
+            // Recreate the per-service schema grants + login roles + default search_path that staging has
+            // (the dump carries no cluster-global roles). Without them unqualified queries 42P01. See db/roles.js.
+            const { total, applied } = await ensureRoles({ local })
+            console.log(chalk.gray(`db roles: ${applied.length}/${total} service roles provisioned`))
+          }
+        },
+      })
+      .command({
+        command: 'roles',
+        describe: 'create/repair per-service schema grants + login roles + search_path (re-runnable)',
+        builder: (y2) => y2.option('port', { type: 'number', default: 55432 }),
+        handler: async (argv) => {
+          const local = { host: 'localhost', port: argv.port, user: 'dooer', password: 'dooer', database: 'dooer' }
+          const { total, applied } = await ensureRoles({ local })
+          console.log(`db roles: ${applied.length}/${total} service roles provisioned`)
+        },
+      })
+      .command({
+        command: 'snapshot <name>',
+        describe: 'save a local restore point (pg_dump of the local DB)',
+        handler: (argv) => {
+          const { spawnSync } = require('child_process')
+          const file = path.join(os.homedir(), '.dooer-test-env', `snap-${argv.name}.dump`)
+          require('fs').mkdirSync(path.dirname(file), { recursive: true })
+          const r = spawnSync('pg_dump', ['-Fc', '-d', 'postgresql://dooer:dooer@localhost:55432/dooer', '-f', file], {
+            stdio: 'inherit',
+          })
+          process.exitCode = r.status || 0
+          if (!r.status) console.log(`saved ${file}`)
+        },
+      })
+      .command({
+        command: 'rollback <name>',
+        describe: 'restore a local snapshot (or the base) into the local DB',
+        handler: (argv) => {
+          const { spawnSync } = require('child_process')
+          const file = path.join(os.homedir(), '.dooer-test-env', `snap-${argv.name}.dump`)
+          const r = spawnSync(
+            'pg_restore',
+            ['--no-owner', '--clean', '--if-exists', '-d', 'postgresql://dooer:dooer@localhost:55432/dooer', file],
+            { stdio: 'inherit' }
+          )
+          process.exitCode = r.status || 0
+        },
+      })
+      .demandCommand(1)
+      .strict(),
+  handler: () => {},
+}

package/lib/command/env.js

@@ -0,0 +1,114 @@
+const fs = require('fs')
+const chalk = require('chalk')
+const rt = require('../runtime')
+const registry = require('../registry')
+const bankid = require('../bankid')
+const { generateCompose } = require('../compose/generate')
+const discovery = require('../discovery/client')
+
+// Environment lifecycle for the whole local stack. The compose file is generated from the s-e032 k8s
+// manifests (lib/compose) on first `up`; the discovery-router wires services together. Default profile is
+// `full` (everything staging runs) — compose profiles are additive, so we must name it explicitly.
+// See ENVIRONMENT-PLAN.md §6.
+
+function ensureCompose() {
+  rt.ensureRunDir()
+  if (!fs.existsSync(rt.COMPOSE_FILE)) {
+    const r = generateCompose({ servicesDir: rt.SERVICES_DIR, out: rt.COMPOSE_FILE })
+    console.log(chalk.gray(`generated ${rt.COMPOSE_FILE} (${(r && r.serviceCount) || 'n'} services)`))
+  }
+  return rt.COMPOSE_FILE
+}
+
+module.exports = [
+  {
+    command: 'up',
+    describe: 'create + start the local stack (Postgres, Redis, Kafka, MinIO, discovery router, services)',
+    builder: (y) =>
+      y
+        .option('profile', {
+          type: 'string',
+          default: 'full',
+          describe: 'compose profile (default: full = all staging services; e.g. booking)',
+        })
+        .option('namespace', {
+          type: 'string',
+          default: 'dooer-staging',
+          describe: 'namespace to read registry pull secrets from',
+        })
+        .option('regenerate', { type: 'boolean', describe: 'regenerate the compose file from the current manifests' }),
+    handler: async (argv) => {
+      if (argv.regenerate && fs.existsSync(rt.COMPOSE_FILE)) fs.rmSync(rt.COMPOSE_FILE)
+      ensureCompose()
+      // ensure docker can pull the private images (no manual login needed); non-fatal so an already
+      // logged-in / offline-images run still proceeds.
+      try {
+        const logins = await registry.loginAll({ namespace: argv.namespace, interactive: false })
+        if (logins.some((l) => !l.ok))
+          console.log(chalk.yellow('warning: a registry login failed; `dooer-test-env setup` can fix it'))
+      } catch (e) {
+        console.log(
+          chalk.yellow(
+            `warning: registry login skipped (${e.message}). Run \`dooer-test-env setup\` if image pulls fail.`
+          )
+        )
+      }
+      // Inject BankID certs from the keychain (if pulled) so service-accounts runs production BankID like
+      // staging; absent → service-accounts falls back to the library's test cert. Never written to disk.
+      const bankidEnv = bankid.loadEnv()
+      if (bankidEnv.SECRET_DOOER_BANK_ID_PFX)
+        console.log(chalk.gray('bankid: injecting production certs from keychain'))
+      const code = rt.dc(['up', '-d'], { profile: argv.profile, env: bankidEnv })
+      if (code === 0) {
+        console.log(chalk.green(`\nenv up (profile: ${argv.profile}).`))
+        console.log('Next: `dooer-test-env db pull` to load the customer-free base DB, then `dooer-test-env status`.')
+      }
+      process.exitCode = code
+    },
+  },
+  {
+    command: 'stop',
+    describe: 'stop the running env (preserve containers/volumes)',
+    handler: () => {
+      process.exitCode = rt.dc(['stop'])
+    },
+  },
+  {
+    command: 'start',
+    describe: 'start a previously-stopped env (not recreate)',
+    handler: () => {
+      process.exitCode = rt.dc(['start'])
+    },
+  },
+  {
+    command: 'down',
+    describe: 'stop and remove the env',
+    builder: (y) => y.option('volumes', { type: 'boolean', describe: 'also remove volumes (wipes the local DB)' }),
+    handler: (argv) => {
+      process.exitCode = rt.dc(['down', ...(argv.volumes ? ['-v'] : [])])
+    },
+  },
+  {
+    command: 'status',
+    aliases: ['ps'],
+    describe: 'list services: running/stopped, and published-image vs local checked-out code',
+    handler: async () => {
+      rt.dc(['ps'])
+      // annotate which services are currently served from local checked-out code (router overrides)
+      const state = rt.readState()
+      const locals = Object.keys(state.local || {}).filter((n) => rt.isAlive(state.local[n].pid))
+      if (locals.length) {
+        console.log(chalk.yellow('\nRunning from LOCAL checked-out code (via discovery router):'))
+        for (const n of locals)
+          console.log(`  ${n}  → host.docker.internal:${state.local[n].port}  (pid ${state.local[n].pid})`)
+      }
+      try {
+        const reg = await discovery.list(rt.ROUTER_URL)
+        const overrides = Object.keys((reg && reg.overrides) || {})
+        if (overrides.length) console.log(chalk.gray(`\nrouter overrides: ${overrides.join(', ')}`))
+      } catch (_) {
+        /* router not up */
+      }
+    },
+  },
+]