@monster-orange/den 0.0.0 → 0.2.0

package/src/shared/ui-marker.ts

@@ -0,0 +1,19 @@
+/**
+ * A fixed marker the web server adds to every HTML page it serves, so the CLI
+ * can tell its own UI is up without matching any product or brand text
+ * (a brand may differ from the product title, even in case).
+ */
+export const DEN_UI_MARKER = '<meta name="den-ui" content="1">';
+
+/** Insert the marker right after <head> (or at the start when there is none). */
+export function addDenUiMarker(html: string): string {
+  if (html.includes(DEN_UI_MARKER)) return html;
+  const head = /<head(\s[^>]*)?>/i.exec(html);
+  if (!head) return DEN_UI_MARKER + html;
+  const at = head.index + head[0].length;
+  return html.slice(0, at) + DEN_UI_MARKER + html.slice(at);
+}
+
+export function hasDenUiMarker(html: string): boolean {
+  return html.includes(DEN_UI_MARKER);
+}

package/src/ui/cli/applications-command.ts

@@ -0,0 +1,148 @@
+/**
+ * `den apps` (alias `applications`): Org > Application > Repo > Services
+ * for the focused workspace, and the `-A/--app <name>` flag for up/down/
+ * restart/status.
+ */
+import chalk from "chalk";
+import {
+  loadApplications,
+  loadApplicationTree,
+} from "../../shared/environment-manager/load-applications.js";
+import type {
+  Application,
+  ApplicationContributor,
+} from "../../shared/applications.js";
+
+import { product } from "../../shared/product.js";
+import type {
+  Placement,
+  RollupPlacement,
+} from "../../shared/manifest/placement.js";
+
+/** An application's placement line: "⇄ hybrid: <summary>", "☁ remote", or "". */
+export function describeAppPlacement(a: {
+  placement: RollupPlacement;
+  summary: string;
+}): string {
+  if (a.placement === "hybrid") return `⇄ hybrid: ${a.summary}`;
+  if (a.placement === "remote") return "☁ remote";
+  return "";
+}
+
+/** A repo's suffix over its services: "☁ remote (dev)", "⇄ hybrid", or "". */
+export function describeRepoPlacement(services: Placement[]): string {
+  const runs = new Set(services.map((s) => s.runs).filter((r) => r !== "none"));
+  if (runs.size > 1) return "⇄ hybrid";
+  if (!runs.has("remote")) return "";
+  const envs = [
+    ...new Set(services.flatMap((s) => (s.target ? [s.target.env] : []))),
+  ].sort();
+  return `☁ remote (${envs.join(", ")})`;
+}
+/** "feature-items (module) → ships in core-api" */
+export function describeContributor(c: ApplicationContributor): string {
+  return `${c.repo} (${c.kind}) → ${c.contributesTo.length ? `ships in ${c.contributesTo.join(", ")}` : "no consumer known"}`;
+}
+
+/** Pull `-A <name>` / `--app <name>` / `--app=<name>` out of args. */
+export function takeAppFlag(args: string[]): {
+  app?: string;
+  rest: string[];
+} {
+  const rest: string[] = [];
+  let app: string | undefined;
+  for (let i = 0; i < args.length; i++) {
+    const a = args[i];
+    if (a === "-A" || a === "--app") {
+      app = args[++i];
+      if (!app || app.startsWith("-"))
+        throw new Error(
+          `${a} needs an application name (see \`${product().cli} apps\`)`,
+        );
+    } else if (a.startsWith("--app=")) app = a.slice("--app=".length);
+    else rest.push(a);
+  }
+  return { app, rest };
+}
+
+/** The runtime repos of application `name`; throws if unknown or empty. */
+export function appRepos(apps: Application[], name: string): Set<string> {
+  const a = apps.find((x) => x.name === name);
+  if (!a)
+    throw new Error(
+      `No application "${name}". Applications here: ${apps.map((x) => x.name).join(", ") || "none"}`,
+    );
+  if (a.repos.length === 0)
+    throw new Error(
+      a.contributors.length
+        ? `Application "${name}" has no runtime here, only modules/libraries: ${a.contributors.map((c) => c.repo).join(", ")}`
+        : `Application "${name}" has no repos in this workspace`,
+    );
+  return new Set(a.repos);
+}
+
+/** appRepos over the focused workspace. */
+export function focusedAppRepos(name: string): Set<string> {
+  return appRepos(loadApplications(), name);
+}
+
+export function cmdApps(args: string[]): void {
+  if (args.includes("-h") || args.includes("--help")) {
+    console.log(
+      `\n  ${product().cli} apps [--json]        (alias: applications)\n\n` +
+        "  Org > Application > Repo > Services for the focused workspace.\n" +
+        `  Applications come from \`applications:\` in ${product().configFile} and\n` +
+        `  \`application:\` in a repo's ${product().manifestYml} (the repo wins). Any other\n` +
+        "  repo is its own application, named after the repo.\n" +
+        `  Act on one with -A: ${product().cli} up -A <app>.\n`,
+    );
+    return;
+  }
+  const tree = loadApplicationTree();
+  if (args.includes("--json")) {
+    console.log(JSON.stringify(tree, null, 2));
+    return;
+  }
+  console.log();
+  console.log(
+    `  ${chalk.bold(tree.org?.title ?? "Org")}${tree.org && tree.org.id !== tree.org.title ? chalk.gray(`  (${tree.org.id})`) : ""}`,
+  );
+  if (tree.applications.length === 0) {
+    console.log(chalk.yellow("    No repos in this workspace.\n"));
+    return;
+  }
+  for (const a of tree.applications) {
+    console.log();
+    const title = a.title !== a.name ? `  ${a.title}` : "";
+    const owner = a.owner ? chalk.gray(`  · ${a.owner}`) : "";
+    const kind =
+      a.source === "repo" ? chalk.gray("  (repo is the application)") : "";
+    const placed = describeAppPlacement(a);
+    console.log(
+      `    ${chalk.bold.cyan(a.name)}${title}${owner}${kind}${placed ? chalk.cyan(`  ${placed}`) : ""}`,
+    );
+    if (a.description) console.log(chalk.gray(`      ${a.description}`));
+    const width = Math.max(0, ...a.repos.map((r) => r.length));
+    for (const repo of a.repos) {
+      const subs = a.services[repo]
+        .map((addr) => (addr.includes("/") ? addr.split("/")[1] : addr))
+        .filter((s) => s !== repo);
+      const where = describeRepoPlacement(
+        a.services[repo].flatMap((addr) => a.placements[addr] ?? []),
+      );
+      const suffix = where ? chalk.cyan(`  ${where}`) : "";
+      console.log(
+        `      ${subs.length ? `${repo.padEnd(width)}${chalk.gray(`  ${subs.join(", ")}`)}` : repo}${suffix}`,
+      );
+    }
+    for (const c of a.contributors)
+      console.log(chalk.gray(`      ${describeContributor(c)}`));
+    if (a.absent.length)
+      console.log(
+        chalk.gray(`      not in this workspace: ${a.absent.join(", ")}`),
+      );
+    if (!a.repos.length && !a.contributors.length && !a.absent.length)
+      console.log(chalk.gray("      (no repos in this workspace)"));
+  }
+  console.log();
+}

package/src/ui/cli/config-command.ts

@@ -0,0 +1,68 @@
+import chalk from "chalk";
+import * as yaml from "yaml";
+import {
+  mergeUserConfig,
+  readUserConfig,
+  type UserConfig,
+} from "../../shared/den-config.js";
+
+import { product } from "../../shared/product.js";
+type ConfigKey = keyof UserConfig;
+
+const KEY_ALIASES: Record<string, ConfigKey> = {
+  tabs: "cli_tabs",
+  cli_tabs: "cli_tabs",
+  "local-dev": "local_dev",
+  local_dev: "local_dev",
+  editor: "editor",
+  terminal: "terminal",
+  editor_overrides: "editor_overrides",
+  log_window_lines: "log_window_lines",
+  log_window: "log_window_lines",
+};
+
+function canonicalKey(input: string): ConfigKey {
+  const key = KEY_ALIASES[input];
+  if (!key) {
+    throw new Error(
+      `Unknown config key "${input}". Known keys: ${Object.keys(KEY_ALIASES).join(", ")}`,
+    );
+  }
+  return key;
+}
+
+function parseValue(raw: string): unknown {
+  const parsed = yaml.parse(raw);
+  return parsed === null ? "" : parsed;
+}
+
+export async function cmdConfig(args: string[]): Promise<void> {
+  if (args.length === 0) {
+    const current = readUserConfig();
+    const output = yaml.stringify(current).trim();
+    console.log(output || "{}");
+    return;
+  }
+
+  if (args[0] === "rm") {
+    const keyArg = args[1];
+    if (!keyArg) throw new Error(`Usage: ${product().cli} config rm <key>`);
+    const key = canonicalKey(keyArg);
+    mergeUserConfig({ [key]: undefined });
+    console.log(chalk.green(`  ✓ Removed ${key}`));
+    return;
+  }
+
+  const assignment = args[0];
+  const eq = assignment.indexOf("=");
+  if (eq <= 0) {
+    throw new Error(
+      `Usage: ${product().cli} config <key>=<value> or ${product().cli} config rm <key>`,
+    );
+  }
+
+  const key = canonicalKey(assignment.slice(0, eq));
+  const value = parseValue(assignment.slice(eq + 1));
+  mergeUserConfig({ [key]: value } as Partial<UserConfig>);
+  console.log(chalk.green(`  ✓ Set ${key}`));
+}

package/src/ui/cli/create-main.ts

@@ -0,0 +1,9 @@
+/**
+ * Entry point for `den create` (bin/den routes `create` here). Kept apart
+ * from the main CLI, which needs a distribution root at import time: create
+ * runs before one exists, e.g. `npx @monster-orange/den create acme`.
+ */
+import { runCreate } from "./create.js";
+
+const cwd = process.env.DEN_INVOKE_CWD?.trim() || process.cwd();
+process.exit(runCreate(process.argv.slice(2), cwd));

package/src/ui/cli/create.ts

@@ -0,0 +1,360 @@
+/**
+ * `den create <name> [dir]`: scaffold a new distribution.
+ *
+ * A distribution is a small repo that installs Den as a package and holds
+ * everything that makes it yours: den.yml (the product profile), config/
+ * (brand, secrets, edge), manifests/, tests/pillars/, a Makefile that
+ * includes Den's make fragment, and a bin/<cli> shim. See
+ * docs/distributions.md.
+ *
+ * This module imports nothing that needs a distribution root: it runs before
+ * one exists. examples/distribution/ is exactly `den create acme`; a unit
+ * test regenerates it, so the two cannot drift.
+ */
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { ENGINE_PACKAGE, getEngineRoot } from "../../shared/paths.js";
+import { profileFrom } from "../../shared/profile.js";
+
+export interface CreateOptions {
+  /** Product name: lower-case `[a-z][a-z0-9-]*`. */
+  name: string;
+  /** Display name for the brand; defaults to the name in Title Case. */
+  title?: string;
+  /** The command people type; defaults to the name. */
+  cli?: string;
+  /** Upper-case env-var prefix; defaults to the name upper-cased. */
+  envPrefix?: string;
+  /** The Den version the distribution pins (exact). */
+  denVersion: string;
+}
+
+const NAME = /^[a-z][a-z0-9-]*$/;
+
+/** "acme-dev" → "Acme Dev". */
+export function titleFromName(name: string): string {
+  return name
+    .split("-")
+    .filter(Boolean)
+    .map((w) => w.charAt(0).toUpperCase() + w.slice(1))
+    .join(" ");
+}
+
+/** Validate options; throws with a message a person can act on. */
+export function validateCreateOptions(opts: CreateOptions): void {
+  if (!NAME.test(opts.name))
+    throw new Error(
+      `name "${opts.name}" must start with a lower-case letter and use only a-z, 0-9 and "-"`,
+    );
+  if (opts.cli !== undefined && !NAME.test(opts.cli))
+    throw new Error(
+      `--cli "${opts.cli}" must start with a lower-case letter and use only a-z, 0-9 and "-"`,
+    );
+  if (opts.title !== undefined && !opts.title.trim())
+    throw new Error("--title must not be empty");
+  if (opts.title !== undefined && /[\n"\\]/.test(opts.title))
+    throw new Error("--title must be one line without quotes or backslashes");
+  // The profile validates the env prefix the same way den.yml would.
+  profileFrom({
+    name: opts.name,
+    cli: opts.cli,
+    env_prefix: opts.envPrefix,
+  });
+}
+
+function bannerLines(title: string): string[] {
+  const spelled = title.toUpperCase().split("").join(" ");
+  const bar = "─".repeat(spelled.length + 4);
+  return [`  ┌${bar}┐`, `  │  ${spelled}  │`, `  └${bar}┘`];
+}
+
+/** Every file `den create` writes, keyed by path relative to the new root. */
+export function renderDistribution(
+  opts: CreateOptions,
+): Record<string, string> {
+  validateCreateOptions(opts);
+  const { name, denVersion } = opts;
+  const title = opts.title?.trim() || titleFromName(name);
+  const profile = profileFrom({
+    name,
+    cli: opts.cli,
+    env_prefix: opts.envPrefix,
+  });
+  const cli = profile.cli;
+  const prefix = profile.envPrefix;
+  const overrides: string[] = [];
+  if (opts.cli !== undefined) overrides.push(`  cli: ${cli}`);
+  if (opts.envPrefix !== undefined) overrides.push(`  env_prefix: ${prefix}`);
+
+  const denYml = [
+    `# ${title}: a Den distribution. Every name below derives from product.name;`,
+    "# uncomment a line to override it. See docs/distributions.md in Den.",
+    "product:",
+    `  name: ${name}`,
+    ...overrides,
+    ...(opts.cli === undefined ? [`  # cli: ${cli}`] : []),
+    ...(opts.envPrefix === undefined ? [`  # env_prefix: ${prefix}`] : []),
+    `  # config: config/${name}.yml`,
+    `  # manifest: .${name}.yml`,
+    `  # state_dir: ~/.${name}`,
+    `  # services_dir: .${name}-services`,
+    `  # workspaces_dir: ${name}-workspaces`,
+    "",
+  ].join("\n");
+
+  const packageJson =
+    JSON.stringify(
+      {
+        name,
+        version: "0.0.0",
+        private: true,
+        description: `${title}: local dev and E2E harness, built on Den`,
+        type: "module",
+        bin: { [cli]: `./bin/${cli}` },
+        scripts: { [cli]: `./bin/${cli}` },
+        dependencies: { [ENGINE_PACKAGE]: denVersion },
+      },
+      null,
+      2,
+    ) + "\n";
+
+  const shim = [
+    "#!/bin/sh",
+    `# ${cli}: runs Den from node_modules as this distribution.`,
+    'DEN_ROOT="$(cd "$(dirname "$0")/.." && pwd)"',
+    `export DEN_ROOT; exec "$DEN_ROOT/node_modules/${ENGINE_PACKAGE}/bin/den" "$@"`,
+    "",
+  ].join("\n");
+
+  const makefile = [
+    `# ${title}: Den's make targets, run from this distribution's root.`,
+    "# `make help` lists them. Add your own targets below the include.",
+    `DEN_TARGET_PREFIX := ${cli}`,
+    `include node_modules/${ENGINE_PACKAGE}/make/den.mk`,
+    "",
+  ].join("\n");
+
+  const config = [
+    `# ${title}: org config. Den reads it from config/${name}.yml (den.yml product.config).`,
+    "",
+    "# Shown to people: CLI banner, help header and web page titles.",
+    "brand:",
+    `  name: ${title}`,
+    `  tagline: ${title} local dev and E2E harness`,
+    "  banner:",
+    ...bannerLines(title).map((l) => `    - "${l}"`),
+    "",
+    "# The GitHub org (or user) that owns the repos Den clones and lists.",
+    "github_org: your-github-org",
+    "",
+    "# Secrets backend: env reads plain environment variables; doppler and",
+    "# 1password are the others.",
+    "secrets:",
+    "  provider: env",
+    "",
+    "# This instance's HTTPS edge: https://<service>.<domain>.",
+    "edge:",
+    `  org: ${name}`,
+    `  domain: ${name}.localhost`,
+    "",
+    "environments: [local]",
+    "",
+  ].join("\n");
+
+  const localEnv =
+    JSON.stringify(
+      {
+        name: "local",
+        baseUrls: {
+          web: "http://localhost:3000",
+          api: "http://localhost:3001",
+          services: {},
+        },
+        timeouts: { api: 30000, pageLoad: 60000 },
+      },
+      null,
+      2,
+    ) + "\n";
+
+  const gitignore = [
+    "node_modules/",
+    "config/local/",
+    `.${name}-services/`,
+    `${name}-workspaces/`,
+    ".smoke-run/",
+    ".smoke-clones/",
+    ".synth-run/",
+    ".journeys-run/",
+    "reports/",
+    "results/",
+    "test-results/",
+    "playwright-report/",
+    ".env",
+    "",
+  ].join("\n");
+
+  const readme = [
+    `# ${title}`,
+    "",
+    `${title} is a Den distribution: Den (\`${ENGINE_PACKAGE}\`) is the engine,`,
+    "this repo holds what makes it yours.",
+    "",
+    "## Run",
+    "",
+    "```sh",
+    "npm install",
+    `./bin/${cli} --help`,
+    `./bin/${cli} status`,
+    `./bin/${cli} web          # the web UI`,
+    "make help",
+    "```",
+    "",
+    "## Layout",
+    "",
+    "| Path | What |",
+    "| --- | --- |",
+    "| `den.yml` | The product profile: name, CLI, env prefix, file and directory names |",
+    `| \`config/${name}.yml\` | Brand, GitHub org, secrets backend, edge |`,
+    "| `config/environments/` | One JSON file per environment (base URLs, auth, timeouts) |",
+    "| `manifests/` | Manifests for repos that do not carry their own |",
+    "| `tests/pillars/` | This distribution's own tests, by pillar |",
+    `| \`bin/${cli}\` | Runs Den from \`node_modules\` with this repo as its root |`,
+    "| `Makefile` | Includes Den's make targets (`make/den.mk`) |",
+    "",
+    `Environment variables use the \`${prefix}_\` prefix: for example`,
+    `\`${prefix}_HOME\` moves the state directory (default \`~/.${name}\`).`,
+    "",
+    "## Upgrade Den",
+    "",
+    `\`package.json\` pins an exact Den version. To upgrade, read the`,
+    "Migrations section of Den's CHANGELOG for each version in between, then:",
+    "",
+    "```sh",
+    `npm install ${ENGINE_PACKAGE}@<version> --save-exact`,
+    "```",
+    "",
+  ].join("\n");
+
+  return {
+    "den.yml": denYml,
+    "package.json": packageJson,
+    [`bin/${cli}`]: shim,
+    Makefile: makefile,
+    [`config/${name}.yml`]: config,
+    "config/environments/local.json": localEnv,
+    "manifests/.gitkeep": "",
+    "tests/pillars/.gitkeep": "",
+    ".gitignore": gitignore,
+    "README.md": readme,
+  };
+}
+
+/** The version of the Den that is running (its package.json). */
+export function runningDenVersion(
+  engineRoot: string = getEngineRoot(),
+): string {
+  const raw = fs.readFileSync(path.join(engineRoot, "package.json"), "utf-8");
+  return (JSON.parse(raw) as { version: string }).version;
+}
+
+/**
+ * Write a distribution into `dir`. Refuses a directory that exists and is not
+ * empty; never overwrites a file. Returns the files written (relative).
+ */
+export function writeDistribution(dir: string, opts: CreateOptions): string[] {
+  const files = renderDistribution(opts);
+  const root = path.resolve(dir);
+  if (fs.existsSync(root)) {
+    if (!fs.statSync(root).isDirectory())
+      throw new Error(`${root} exists and is not a directory`);
+    if (fs.readdirSync(root).length > 0)
+      throw new Error(
+        `${root} is not empty: create needs a new or empty directory`,
+      );
+  }
+  const written: string[] = [];
+  for (const [rel, content] of Object.entries(files)) {
+    const file = path.join(root, rel);
+    fs.mkdirSync(path.dirname(file), { recursive: true });
+    // "wx": fail rather than overwrite, even if something appeared meanwhile.
+    fs.writeFileSync(file, content, { encoding: "utf-8", flag: "wx" });
+    if (rel.startsWith("bin/")) fs.chmodSync(file, 0o755);
+    written.push(rel);
+  }
+  return written;
+}
+
+export interface ParsedCreateArgs extends Omit<CreateOptions, "denVersion"> {
+  dir: string;
+}
+
+const CREATE_USAGE =
+  "usage: den create <name> [dir] [--title <title>] [--cli <cli>] [--env-prefix <PREFIX>]";
+
+/** Parse `create` argv (after the word `create`). `cwd` resolves the dir. */
+export function parseCreateArgs(argv: string[], cwd: string): ParsedCreateArgs {
+  const positional: string[] = [];
+  const flags: Record<string, string> = {};
+  for (let i = 0; i < argv.length; i++) {
+    const a = argv[i];
+    const m = /^--(title|cli|env-prefix)(?:=(.*))?$/.exec(a);
+    if (m) {
+      const value = m[2] ?? argv[++i];
+      if (value === undefined)
+        throw new Error(`--${m[1]} needs a value\n${CREATE_USAGE}`);
+      flags[m[1]] = value;
+    } else if (a.startsWith("-")) {
+      throw new Error(`unknown flag ${a}\n${CREATE_USAGE}`);
+    } else positional.push(a);
+  }
+  if (positional.length < 1 || positional.length > 2)
+    throw new Error(CREATE_USAGE);
+  const [name, dir] = positional;
+  return {
+    name,
+    dir: path.resolve(cwd, dir ?? name),
+    title: flags.title,
+    cli: flags.cli,
+    envPrefix: flags["env-prefix"],
+  };
+}
+
+export const CREATE_HELP = `${CREATE_USAGE}
+
+Scaffold a new Den distribution in [dir] (default ./<name>):
+den.yml, package.json (pinning this Den's exact version), bin/<cli>,
+a Makefile including Den's make targets, config/<name>.yml,
+config/environments/local.json, manifests/ and tests/pillars/.
+
+  --title <title>        brand name shown to people (default: <Name>)
+  --cli <cli>            the command people type (default: <name>)
+  --env-prefix <PREFIX>  env-var prefix (default: <NAME>)`;
+
+/** Run `create` end to end; returns the process exit code. */
+export function runCreate(argv: string[], cwd: string): number {
+  if (argv.includes("-h") || argv.includes("--help")) {
+    console.log(CREATE_HELP);
+    return 0;
+  }
+  try {
+    const args = parseCreateArgs(argv, cwd);
+    const written = writeDistribution(args.dir, {
+      ...args,
+      denVersion: runningDenVersion(),
+    });
+    const cli = args.cli ?? args.name;
+    const rel = path.relative(cwd, args.dir) || ".";
+    console.log(
+      `Created ${args.name} in ${args.dir} (${written.length} files).`,
+    );
+    console.log("");
+    console.log("Next:");
+    console.log(`  cd ${rel}`);
+    console.log("  npm install");
+    console.log(`  ./bin/${cli} --help`);
+    return 0;
+  } catch (e) {
+    console.error(`create: ${(e as Error).message}`);
+    return 1;
+  }
+}

package/src/ui/cli/edge-command.ts

@@ -0,0 +1,81 @@
+/**
+ * `edge up | down | status | trust | untrust | routes`
+ *
+ * This org's HTTPS edge: own CA + cert, routes at `<name>.<edge.domain>`.
+ */
+import chalk from "chalk";
+import { readBrand } from "../../shared/brand.js";
+import { readEdgeConfig } from "../../shared/edge/config.js";
+import { edgeDomains, edgeNames, routeUrl } from "../../shared/edge/render.js";
+import {
+  caDir,
+  caTrusted,
+  edgeDown,
+  edgeUp,
+  trustCa,
+  untrustCa,
+} from "../../shared/edge/runtime.js";
+import { edgeStatus } from "../../shared/edge/status.js";
+
+export async function cmdEdge(args: string[]): Promise<void> {
+  const sub = args[0] ?? "status";
+  const cfg = readEdgeConfig();
+  const n = edgeNames(cfg.org);
+  const published = cfg.ports
+    ? `host :${cfg.ports.http} / :${cfg.ports.https}`
+    : `not published (reach it on Docker network ${n.network})`;
+  switch (sub) {
+    case "up": {
+      const { certs } = await edgeUp(cfg);
+      console.log(
+        chalk.green(
+          `✓ ${n.container} up — ${edgeDomains(cfg)
+            .map((d) => `*.${d}`)
+            .join(", ")}`,
+        ),
+      );
+      console.log(`  ports  ${published}`);
+      if (certs.issued)
+        console.log(`  cert   issued for ${certs.names.join(", ")}`);
+      if (caTrusted(cfg) === false)
+        console.log(
+          chalk.yellow(
+            "  CA not trusted yet — run `edge trust` (asks for your password once)",
+          ),
+        );
+      for (const name of ["edge", ...Object.keys(cfg.routes)])
+        console.log(`  ${routeUrl(name, cfg)}`);
+      return;
+    }
+    case "down":
+      edgeDown(cfg);
+      console.log(chalk.green(`✓ ${n.container} down`));
+      return;
+    case "trust":
+      process.exitCode = trustCa(cfg);
+      return;
+    case "untrust":
+      process.exitCode = untrustCa(cfg);
+      return;
+    case "routes":
+      for (const r of edgeStatus(cfg).routes)
+        console.log(`${r.url.padEnd(52)} → ${r.upstream}`);
+      return;
+    case "status": {
+      const st = edgeStatus(cfg);
+      console.log(chalk.bold(`${readBrand().name} edge — ${st.org}`));
+      console.log(`  container  ${st.container}: ${st.state}`);
+      console.log(`  ports      ${published}`);
+      console.log(`  domains    ${st.domains.join(", ")} (+ every subdomain)`);
+      console.log(
+        `  CA         ${caDir(cfg)} — ${st.caTrusted === null ? "unknown" : st.caTrusted ? "trusted" : "NOT trusted"}`,
+      );
+      if (st.certIssued) console.log(`  cert       ${st.certNames.join(", ")}`);
+      return;
+    }
+    default:
+      throw new Error(
+        `Unknown edge command "${sub}". Use: up | down | status | trust | untrust | routes`,
+      );
+  }
+}