Organize all ts CLI commands under commands/<name>/

Every subcommand's implementation now lives under commands/<name>/, matching
the dev command's layout: audit moves to commands/audit/mod.rs, config init to
commands/config/init.rs. AuditArgs moves from run.rs into the audit module
alongside run_audit, so run.rs only wires subcommands together. audit and config
are pub(crate) (crate-internal); dev stays pub for the proxy_e2e integration
suite.

Author: aram356

…trusted-server-cli/src/audit/analyzer.rs …erver-cli/src/commands/audit/analyzer.rscrates/trusted-server-cli/src/audit/analyzer.rs renamed to crates/trusted-server-cli/src/commands/audit/analyzer.rs crates/trusted-server-cli/src/audit/analyzer.rs renamed to crates/trusted-server-cli/src/commands/audit/analyzer.rs

@@ -5,8 +5,8 @@ use regex::Regex;
 use scraper::{Html, Selector};
 use url::Url;
 
-use crate::audit::collector::CollectedPage;
-use crate::audit::{AssetParty, AuditArtifact, AuditedAsset, DetectedIntegration};
+use crate::commands::audit::collector::CollectedPage;
+use crate::commands::audit::{AssetParty, AuditArtifact, AuditedAsset, DetectedIntegration};
 use crate::error::{CliResult, report_error};
 
 static GTM_REGEX: LazyLock<Regex> =
@@ -256,7 +256,7 @@ pub(crate) fn extract_gtm_container_id(artifact: &AuditArtifact) -> Option<Strin
 #[cfg(test)]
 mod tests {
     use super::*;
-    use crate::audit::collector::{CollectedRequest, CollectedScriptTag};
+    use crate::commands::audit::collector::{CollectedRequest, CollectedScriptTag};
 
     fn page_url() -> Url {
         Url::parse("https://publisher.example/page").expect("should parse URL")

…erver-cli/src/audit/browser_collector.rs …/src/commands/audit/browser_collector.rscrates/trusted-server-cli/src/audit/browser_collector.rs renamed to crates/trusted-server-cli/src/commands/audit/browser_collector.rs crates/trusted-server-cli/src/audit/browser_collector.rs renamed to crates/trusted-server-cli/src/commands/audit/browser_collector.rs

@@ -11,7 +11,7 @@ use tokio::time::{sleep, timeout};
 use url::Url;
 use which::which;
 
-use crate::audit::collector::{
+use crate::commands::audit::collector::{
     AuditCollector, CollectedPage, CollectedRequest, CollectedScriptTag,
 };
 use crate::error::{CliResult, report_error};

…rusted-server-cli/src/audit/collector.rs …rver-cli/src/commands/audit/collector.rscrates/trusted-server-cli/src/audit/collector.rs renamed to crates/trusted-server-cli/src/commands/audit/collector.rs crates/trusted-server-cli/src/audit/collector.rs renamed to crates/trusted-server-cli/src/commands/audit/collector.rs

@@ -10,13 +10,34 @@ use std::path::{Path, PathBuf};
 use serde::Serialize;
 use url::Url;
 
-use crate::audit::collector::AuditCollector;
-use crate::config_init::EXAMPLE_CONFIG;
+use crate::commands::audit::collector::AuditCollector;
+use crate::commands::config::init::EXAMPLE_CONFIG;
 use crate::error::{CliResult, cli_error, report_error};
-use crate::run::AuditArgs;
 
 use analyzer::{analyze_collected_page, extract_gtm_container_id};
 
+/// Arguments for the `ts audit` command.
+#[derive(Debug, clap::Args)]
+pub(crate) struct AuditArgs {
+    /// Public HTTP(S) URL to audit.
+    pub(crate) url: String,
+    /// JavaScript asset audit output path.
+    #[arg(long)]
+    pub(crate) js_assets: Option<std::path::PathBuf>,
+    /// Draft Trusted Server config output path.
+    #[arg(long)]
+    pub(crate) config: Option<std::path::PathBuf>,
+    /// Do not write the JavaScript asset audit file.
+    #[arg(long)]
+    pub(crate) no_js_assets: bool,
+    /// Do not write the draft Trusted Server config file.
+    #[arg(long)]
+    pub(crate) no_config: bool,
+    /// Overwrite existing output files.
+    #[arg(long)]
+    pub(crate) force: bool,
+}
+
 const DEFAULT_JS_ASSETS_PATH: &str = "js-assets.toml";
 const DEFAULT_CONFIG_PATH: &str = "trusted-server.toml";
 
@@ -393,7 +414,7 @@ mod tests {
     use tempfile::TempDir;
 
     use super::*;
-    use crate::audit::collector::{CollectedPage, CollectedRequest, CollectedScriptTag};
+    use crate::commands::audit::collector::{CollectedPage, CollectedRequest, CollectedScriptTag};
 
     struct FakeCollector {
         collected: CollectedPage,

crates/trusted-server-cli/src/audit.rs …ted-server-cli/src/commands/audit/mod.rscrates/trusted-server-cli/src/audit.rs renamed to crates/trusted-server-cli/src/commands/audit/mod.rs crates/trusted-server-cli/src/audit.rs renamed to crates/trusted-server-cli/src/commands/audit/mod.rs

@@ -0,0 +1 @@
+pub mod init;

…es/trusted-server-cli/src/config_init.rs …d-server-cli/src/commands/config/init.rscrates/trusted-server-cli/src/config_init.rs renamed to crates/trusted-server-cli/src/commands/config/init.rs crates/trusted-server-cli/src/config_init.rs renamed to crates/trusted-server-cli/src/commands/config/init.rs

@@ -1 +1,5 @@
+pub(crate) mod audit;
+pub(crate) mod config;
+// `dev` is `pub` so the macOS-gated `tests/proxy_e2e.rs` suite can reach
+// `commands::dev::proxy`; the other command modules are crate-internal.
 pub mod dev;

crates/trusted-server-cli/src/commands/config/mod.rs

@@ -1,18 +1,15 @@
 #[cfg(not(target_arch = "wasm32"))]
-mod audit;
-#[cfg(not(target_arch = "wasm32"))]
-mod config_init;
-#[cfg(not(target_arch = "wasm32"))]
 mod error;
 #[cfg(not(target_arch = "wasm32"))]
 mod run;
 
 #[cfg(not(target_arch = "wasm32"))]
 pub use run::run_from_env;
 
-// The `ts dev` command group is available on every host target; its only
-// subcommand, `ts dev proxy`, is macOS-only (CA trust via the login keychain,
-// Safari automation via `networksetup`, a native TLS / networking stack) and its
+// Every `ts` subcommand's implementation lives under `commands/<name>`. The
+// `ts dev` group is available on every host target; its only subcommand,
+// `ts dev proxy`, is macOS-only (CA trust via the login keychain, Safari
+// automation via `networksetup`, a native TLS / networking stack) and its
 // dependencies are scoped to macOS in `Cargo.toml`. `commands` is `pub` so the
 // macOS-gated `tests/proxy_e2e.rs` integration suite can exercise the proxy
 // internals.

crates/trusted-server-cli/src/commands/mod.rs

@@ -7,8 +7,9 @@ use edgezero_cli::args::{
 };
 use trusted_server_core::config::TrustedServerAppConfig;
 
-use crate::audit::browser_collector::BrowserAuditCollector;
-use crate::config_init::{ConfigInitArgs, run_config_init};
+use crate::commands::audit::AuditArgs;
+use crate::commands::audit::browser_collector::BrowserAuditCollector;
+use crate::commands::config::init::{ConfigInitArgs, run_config_init};
 
 #[derive(Debug, Parser)]
 #[command(name = "ts", about = "Trusted Server CLI")]
@@ -39,27 +40,6 @@ enum Command {
     Dev(crate::commands::dev::DevCommand),
 }
 
-#[derive(Debug, clap::Args)]
-pub(crate) struct AuditArgs {
-    /// Public HTTP(S) URL to audit.
-    pub(crate) url: String,
-    /// JavaScript asset audit output path.
-    #[arg(long)]
-    pub(crate) js_assets: Option<std::path::PathBuf>,
-    /// Draft Trusted Server config output path.
-    #[arg(long)]
-    pub(crate) config: Option<std::path::PathBuf>,
-    /// Do not write the JavaScript asset audit file.
-    #[arg(long)]
-    pub(crate) no_js_assets: bool,
-    /// Do not write the draft Trusted Server config file.
-    #[arg(long)]
-    pub(crate) no_config: bool,
-    /// Overwrite existing output files.
-    #[arg(long)]
-    pub(crate) force: bool,
-}
-
 #[derive(Debug, Subcommand)]
 enum ConfigCommand {
     /// Initialize a Trusted Server config file from the example template.
@@ -88,7 +68,7 @@ fn dispatch(args: Args) -> Result<(), String> {
             let stdout = std::io::stdout();
             let mut out = stdout.lock();
             let collector = BrowserAuditCollector;
-            crate::audit::run_audit(&args, &collector, &mut out)
+            crate::commands::audit::run_audit(&args, &collector, &mut out)
         }
         Command::Auth(args) => edgezero_cli::run_auth(&args),
         Command::Build(args) => edgezero_cli::run_build(&args),