@intenque/network-sdk 0.0.0-stage → 2.2.0-beta.2

package/dist/cli/index.js

@@ -0,0 +1,1745 @@
+#!/usr/bin/env node
+
+// src/cli/index.ts
+import { webcrypto } from "crypto";
+
+// src/constants.ts
+var SDK_VERSION = "2.2.0-beta.2";
+var MANIFEST_SCHEMA_MAJOR = 2;
+var DEFAULT_CDN_BASE = "https://inr-network-public.nyc3.cdn.digitaloceanspaces.com/network/v1";
+var MANIFEST_MAX_BYTES = 24 * 1024;
+var SIGNER_GRACE_MS = 7 * 864e5;
+var REFERRAL_TTL_MS = 30 * 864e5;
+var FALLBACK_PATH = "src/data/network.fallback.json";
+var CONFIG_PATH = "src/network.config.js";
+function manifestUrlFor(cdnBase, siteKey, channel) {
+  return `${cdnBase.replace(/\/+$/, "")}/${channel === "preview" ? "preview/" : ""}sites/${siteKey}/manifest.json`;
+}
+
+// src/cli/doctor.ts
+import { randomUUID as randomUUID2 } from "crypto";
+import { existsSync as existsSync3, readdirSync, readFileSync as readFileSync3, statSync } from "fs";
+import { join as join3, relative, resolve as resolve2 } from "path";
+
+// src/cli/doctorBackend.ts
+import { existsSync as existsSync2, readFileSync as readFileSync2 } from "fs";
+import { createRequire } from "module";
+import { join as join2 } from "path";
+
+// src/server/outbox.ts
+var OUTBOX_DEFAULT_COLLECTION = "inrConversionOutbox";
+var OUTBOX_TTL_SECONDS = 14 * 86400;
+var OUTBOX_INDEXES = [
+  [{ createdAt: 1 }, { expireAfterSeconds: OUTBOX_TTL_SECONDS }],
+  [{ nextAttemptAt: 1 }, {}],
+  [{ eventType: 1, eventId: 1 }, { unique: true }]
+];
+
+// src/server/sign.ts
+import { createHash, createHmac, randomUUID, timingSafeEqual } from "crypto";
+function sha256Hex(data) {
+  return createHash("sha256").update(data).digest("hex");
+}
+function hmacBase(timestamp, nonce, siteKey, keyId, method, path, body) {
+  return `${timestamp}.${nonce}.${siteKey}.${keyId}.${method.toUpperCase()}.${path}.${sha256Hex(body)}`;
+}
+function signRequest(input) {
+  if (!input.secret) throw new Error("signRequest: secret is required");
+  const timestamp = input.timestamp ?? Math.floor(Date.now() / 1e3);
+  const nonce = input.nonce ?? randomUUID();
+  const mac = createHmac("sha256", input.secret).update(
+    hmacBase(timestamp, nonce, input.siteKey, input.keyId, input.method, input.path, input.body),
+    "utf8"
+  ).digest("hex");
+  const signature = `v1=${mac}`;
+  return {
+    headers: {
+      "Content-Type": "application/json",
+      "X-INR-Site": input.siteKey,
+      "X-INR-Key-Id": input.keyId,
+      "X-INR-Timestamp": String(timestamp),
+      "X-INR-Nonce": nonce,
+      "X-INR-Signature": signature
+    },
+    timestamp,
+    nonce,
+    signature
+  };
+}
+
+// src/server/wire.ts
+var REVERSAL_TARGETS = {
+  booking_cancelled: ["booking_created"],
+  booking_no_show: ["booking_created"],
+  booking_refunded: ["booking_paid"],
+  chargeback: ["booking_paid", "purchase"]
+};
+var LINK_TARGETS = {
+  ...REVERSAL_TARGETS,
+  fee_charged: ["booking_no_show", "booking_cancelled"]
+};
+var REVERSAL_TYPES = Object.freeze(
+  Object.keys(REVERSAL_TARGETS)
+);
+var SITE_SECRET_RE = /^inrs1_[A-Za-z0-9_-]{43}$/;
+var KEY_ID_RE = /^[0-9a-f]{8}$/;
+var SITE_KEY_RE = /^(?=.{1,48}$)[a-z0-9]+(-[a-z0-9]+)*$/;
+var SIGNED_PATHS = {
+  conversion: "/v1/conversions",
+  ping: "/v1/conversions/ping",
+  landing: "/v1/landings",
+  forget: "/v1/referrals/"
+};
+
+// src/server/delivery.ts
+var SEC = 1e3;
+var RETRY_DELAYS_MS = [2 * SEC, 8 * SEC, 30 * SEC];
+var IN_PROCESS_MAX_DELAY_MS = 30 * SEC;
+var RETRY_AFTER_CAP_MS = 3600 * SEC;
+var AFTER_RETRIES_MS = 60 * SEC;
+var UNAUTHORIZED_RETRY_MS = 10 * 60 * SEC;
+var UNAUTHORIZED_MAX_MS = 24 * 3600 * SEC;
+var LEASE_MS = 150 * SEC;
+var SKEW_MAX_OFFSET_MS = 24 * 3600 * SEC;
+function hubOrigin(raw) {
+  if (!raw) return null;
+  const s = raw.endsWith("/") ? raw.slice(0, -1) : raw;
+  if (!/^[a-z][a-z0-9+.-]*:\/\/[^/?#]+$/i.test(s)) return null;
+  let u;
+  try {
+    u = new URL(s);
+  } catch {
+    return null;
+  }
+  if (u.pathname !== "/" || u.username || u.password) return null;
+  if (u.protocol === "https:") return u.origin;
+  if (u.protocol === "http:" && ["localhost", "127.0.0.1", "[::1]"].includes(u.hostname))
+    return u.origin;
+  return null;
+}
+function estimateOffsetMs(dateHeader, tSend, tRecv) {
+  const hub = dateHeader ? Date.parse(dateHeader) : NaN;
+  if (Number.isNaN(hub)) return null;
+  const offset = Math.round(hub + 500 - (tSend + tRecv) / 2);
+  return Math.abs(offset) <= SKEW_MAX_OFFSET_MS ? offset : null;
+}
+
+// src/cli/shared.ts
+import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "fs";
+import { dirname, join, resolve } from "path";
+
+// src/rootPublicKeys.ts
+var rootPublicKeys = [];
+
+// src/verify/schema.ts
+var SLUG_RE = /^[a-z0-9]+(-[a-z0-9]+)*$/;
+var SLUG_MAX = 48;
+var MAX_ITEMS_CEILING = 24;
+var KID_RE = /^[a-z0-9][a-z0-9-]{1,63}$/;
+var P1363_RE = /^[A-Za-z0-9_-]{85}[AQgw]$/;
+var COORD_RE = /^[A-Za-z0-9_-]{42}[AEIMQUYcgkosw048]$/;
+var ISO_DATE_RE = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(\.\d{3})?Z$/;
+var TOKEN_RE = /^[a-z0-9-]+\.\d+\.\d{8}\.[0-9a-f]{12}$/;
+var HOST_RE = /^[a-z0-9.-]+$/;
+var URL_TAIL_RE = /^([\w.~!$&'()*+,;=:@/?-]|%[\da-f]{2})*(#([\w.~!$&'()*+,;=:@/?-]|%[\da-f]{2})*)?$/i;
+var Invalid = class extends Error {
+};
+var fail = () => {
+  throw new Invalid();
+};
+function obj(v, keys) {
+  if (v === null || typeof v !== "object" || Array.isArray(v)) fail();
+  const o = v;
+  for (const k of Object.keys(o)) if (!keys.includes(k)) fail();
+  for (const k of keys) if (!(k in o)) fail();
+  return o;
+}
+function codePoints(s) {
+  let n = 0;
+  for (const _ of s) n++;
+  return n;
+}
+function str(v, min, max) {
+  if (typeof v !== "string") fail();
+  const n = codePoints(v);
+  if (n < min || n > max) fail();
+  return v;
+}
+function re(v, r, max = 1024) {
+  const s = str(v, 0, max);
+  if (!r.test(s)) fail();
+  return s;
+}
+function int(v, min, max) {
+  if (typeof v !== "number" || !Number.isInteger(v) || v < min || v > max) fail();
+  return v;
+}
+function bool(v) {
+  if (typeof v !== "boolean") fail();
+  return v;
+}
+function nullable(v, f) {
+  return v === null ? null : f(v);
+}
+function literal(v, lit) {
+  if (v !== lit) fail();
+  return lit;
+}
+function oneOf(v, list) {
+  if (typeof v !== "string" || !list.includes(v)) fail();
+  return v;
+}
+function baseUrlProblem(v) {
+  let u;
+  try {
+    u = new URL(v);
+  } catch {
+    return "must be an absolute URL";
+  }
+  const local = u.hostname === "localhost" || u.hostname === "127.0.0.1";
+  if (u.protocol !== "https:" && !(u.protocol === "http:" && local)) return "must be https";
+  if (u.username || u.password || u.search || u.hash) return "no userinfo, query or fragment";
+  return null;
+}
+function baseUrl(v) {
+  const s = str(v, 1, 1024);
+  if (baseUrlProblem(s) !== null) fail();
+  return s;
+}
+function destinationUrlProblem(v) {
+  if (v.length > 200) return "must be at most 200 characters";
+  let u;
+  try {
+    u = new URL(v);
+  } catch {
+    return "must be an absolute URL";
+  }
+  if (u.protocol !== "https:") return "must use https";
+  if (u.username || u.password) return "must not contain credentials";
+  if (u.port !== "" && u.port !== "443") return "port must be 443";
+  const host = u.hostname;
+  if (host.startsWith("[") || /^\d+(\.\d+){3}$/.test(host)) return "IP addresses are not allowed";
+  if (!HOST_RE.test(host) || !host.includes(".") || host.startsWith(".") || host.endsWith("."))
+    return "invalid hostname";
+  if (u.toString() !== v || !URL_TAIL_RE.test(v.slice(u.origin.length))) return "must be normalised";
+  return null;
+}
+function destinationUrl(v) {
+  const s = str(v, 1, 200);
+  if (destinationUrlProblem(s) !== null) fail();
+  return s;
+}
+function parsePublicJwk(v) {
+  const o = obj(v, ["kty", "crv", "x", "y"]);
+  return {
+    kty: literal(o["kty"], "EC"),
+    crv: literal(o["crv"], "P-256"),
+    x: re(o["x"], COORD_RE),
+    y: re(o["y"], COORD_RE)
+  };
+}
+function image(v) {
+  const o = obj(v, ["src", "src2x", "alt", "width", "height"]);
+  return {
+    src: baseUrl(o["src"]),
+    src2x: baseUrl(o["src2x"]),
+    alt: str(o["alt"], 1, 120),
+    width: literal(o["width"], 640),
+    height: literal(o["height"], 360)
+  };
+}
+var BUSINESS_KEYS = [
+  "id",
+  "idx",
+  "name",
+  "description",
+  "url",
+  "domain",
+  "image",
+  "category",
+  "location",
+  "region",
+  "tags",
+  "pinned",
+  "position",
+  "instrumentation"
+];
+function business(v) {
+  const o = obj(v, BUSINESS_KEYS);
+  const name = str(o["name"], 2, 60);
+  if (/^[=+@]/.test(name)) fail();
+  const domain = re(o["domain"], HOST_RE, 253);
+  if (domain.length < 1 || domain.startsWith("www.")) fail();
+  const tags = o["tags"];
+  if (!Array.isArray(tags) || tags.length > 10) fail();
+  return {
+    id: re(o["id"], SLUG_RE, SLUG_MAX),
+    idx: int(o["idx"], 1, 65535),
+    name,
+    description: str(o["description"], 1, 140),
+    url: destinationUrl(o["url"]),
+    domain,
+    image: image(o["image"]),
+    category: nullable(o["category"], (x) => str(x, 0, 40)),
+    location: nullable(o["location"], (x) => str(x, 0, 60)),
+    region: nullable(o["region"], (x) => str(x, 0, 40)),
+    tags: tags.map((t) => str(t, 0, 24)),
+    pinned: bool(o["pinned"]),
+    position: int(o["position"], 0, MAX_ITEMS_CEILING - 1),
+    instrumentation: oneOf(o["instrumentation"], ["none", "landings", "conversions"])
+  };
+}
+function signer(v) {
+  const o = obj(v, ["kid", "jwk", "notBefore", "notAfter", "rootKid", "rootSig", "revokedKids"]);
+  const revoked = o["revokedKids"];
+  if (!Array.isArray(revoked)) fail();
+  return {
+    kid: re(o["kid"], KID_RE),
+    jwk: parsePublicJwk(o["jwk"]),
+    notBefore: re(o["notBefore"], ISO_DATE_RE),
+    notAfter: re(o["notAfter"], ISO_DATE_RE),
+    rootKid: re(o["rootKid"], KID_RE),
+    rootSig: re(o["rootSig"], P1363_RE),
+    revokedKids: revoked.map((k) => re(k, KID_RE))
+  };
+}
+var MANIFEST_KEYS = [
+  "schema",
+  "revision",
+  "publishedAt",
+  "site",
+  "siteIndex",
+  "channel",
+  "cdnBase",
+  "minSdkVersion",
+  "analytics",
+  "links",
+  "section",
+  "businesses",
+  "signer",
+  "sig"
+];
+function parseManifest(input) {
+  try {
+    const o = obj(input, MANIFEST_KEYS);
+    const a = obj(o["analytics"], [
+      "enabled",
+      "endpoint",
+      "impressions",
+      "clicks",
+      "landings",
+      "samplePermille",
+      "token"
+    ]);
+    const l = obj(o["links"], ["utmMedium", "utmCampaign", "utmSource", "refParam", "nofollow"]);
+    const sec = obj(o["section"], ["title", "subtitle"]);
+    const sig = obj(o["sig"], ["alg", "kid", "value"]);
+    const list = o["businesses"];
+    if (!Array.isArray(list) || list.length > MAX_ITEMS_CEILING) fail();
+    return {
+      schema: literal(o["schema"], MANIFEST_SCHEMA_MAJOR),
+      revision: int(o["revision"], 1, Number.MAX_SAFE_INTEGER),
+      publishedAt: re(o["publishedAt"], ISO_DATE_RE),
+      site: re(o["site"], SLUG_RE, SLUG_MAX),
+      siteIndex: int(o["siteIndex"], 1, 65535),
+      channel: oneOf(o["channel"], ["production", "preview"]),
+      cdnBase: baseUrl(o["cdnBase"]),
+      minSdkVersion: re(o["minSdkVersion"], /^\d+\.\d+\.\d+$/),
+      analytics: {
+        enabled: bool(a["enabled"]),
+        endpoint: baseUrl(a["endpoint"]),
+        impressions: bool(a["impressions"]),
+        clicks: bool(a["clicks"]),
+        landings: bool(a["landings"]),
+        samplePermille: int(a["samplePermille"], 0, 1e3),
+        token: re(a["token"], TOKEN_RE)
+      },
+      links: {
+        utmMedium: str(l["utmMedium"], 1, 40),
+        utmCampaign: str(l["utmCampaign"], 1, 40),
+        utmSource: re(l["utmSource"], SLUG_RE, SLUG_MAX),
+        refParam: re(l["refParam"], /^[a-z]{1,8}$/),
+        nofollow: bool(l["nofollow"])
+      },
+      section: {
+        title: str(sec["title"], 1, 60),
+        subtitle: nullable(sec["subtitle"], (x) => str(x, 0, 120))
+      },
+      businesses: list.map(business),
+      signer: signer(o["signer"]),
+      sig: {
+        alg: literal(sig["alg"], "ES256"),
+        kid: re(sig["kid"], KID_RE),
+        value: re(sig["value"], P1363_RE)
+      }
+    };
+  } catch {
+    return null;
+  }
+}
+
+// src/canonicalJson.ts
+var CanonicalJsonError = class extends Error {
+  constructor(message, path) {
+    super(`${message} at ${path || "$"}`);
+    this.path = path;
+    this.name = "CanonicalJsonError";
+  }
+  path;
+};
+function canonicalJson(value) {
+  return serialise(value, "$");
+}
+function serialise(v, path) {
+  if (v === null) return "null";
+  switch (typeof v) {
+    case "boolean":
+      return v ? "true" : "false";
+    case "string":
+      return JSON.stringify(v);
+    case "number":
+      if (!Number.isSafeInteger(v))
+        throw new CanonicalJsonError(`non-integer or unsafe number ${String(v)}`, path);
+      return String(v);
+    case "object": {
+      if (Array.isArray(v)) return `[${v.map((x, i) => serialise(x, `${path}[${i}]`)).join(",")}]`;
+      const proto = Object.getPrototypeOf(v);
+      if (proto !== Object.prototype && proto !== null)
+        throw new CanonicalJsonError("unsupported object type", path);
+      const obj2 = v;
+      return `{${Object.keys(obj2).sort().map((k) => {
+        const child = obj2[k];
+        if (child === void 0)
+          throw new CanonicalJsonError(`undefined value for key "${k}" (use null)`, path);
+        return `${JSON.stringify(k)}:${serialise(child, `${path}.${k}`)}`;
+      }).join(",")}}`;
+    }
+    default:
+      throw new CanonicalJsonError(`unsupported type ${typeof v}`, path);
+  }
+}
+
+// src/verify/base64url.ts
+var ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_";
+var LOOKUP = {};
+for (let i = 0; i < 64; i++) LOOKUP[ALPHABET[i]] = i;
+function isBase64urlAlphabet(s) {
+  return /^[A-Za-z0-9_-]*$/.test(s);
+}
+function decodeCanonicalBase64url(s, bytes) {
+  if (typeof s !== "string" || !isBase64urlAlphabet(s)) return null;
+  if (s.length !== Math.ceil(bytes * 4 / 3)) return null;
+  const out = new Uint8Array(bytes);
+  let acc = 0;
+  let bits = 0;
+  let o = 0;
+  for (let i = 0; i < s.length; i++) {
+    acc = (acc << 6 | LOOKUP[s[i]]) & 65535;
+    bits += 6;
+    if (bits >= 8) {
+      bits -= 8;
+      if (o >= bytes) return null;
+      out[o++] = acc >> bits & 255;
+    }
+  }
+  if (o !== bytes) return null;
+  if (bits > 0 && (acc & (1 << bits) - 1) !== 0) return null;
+  return out;
+}
+function bytesToHex(b) {
+  let h = "";
+  for (const x of b) h += x.toString(16).padStart(2, "0");
+  return h;
+}
+
+// src/verify/p1363.ts
+var P256_N = BigInt("0xffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632551");
+var HALF_N = P256_N >> 1n;
+function subtle() {
+  const c = globalThis.crypto;
+  return c && c.subtle ? c.subtle : null;
+}
+function p1363Problem(signature) {
+  const sig = decodeCanonicalBase64url(signature, 64);
+  if (!sig) return "encoding";
+  const r = BigInt(`0x${bytesToHex(sig.subarray(0, 32))}`);
+  const s = BigInt(`0x${bytesToHex(sig.subarray(32))}`);
+  if (r === 0n || r >= P256_N || s === 0n || s > HALF_N) return "range";
+  return null;
+}
+var keyCache = /* @__PURE__ */ new WeakMap();
+async function importKey(jwk, api) {
+  const hit = keyCache.get(jwk);
+  if (hit) return hit;
+  const { kty, crv, x, y } = jwk;
+  const p = api.importKey(
+    "jwk",
+    { ...parsePublicJwk({ kty, crv, x, y }), ext: true },
+    { name: "ECDSA", namedCurve: "P-256" },
+    false,
+    ["verify"]
+  );
+  keyCache.set(jwk, p);
+  return p;
+}
+async function verifyP1363(jwk, data, signature) {
+  try {
+    const api = subtle();
+    if (!api) return false;
+    if (p1363Problem(signature) !== null) return false;
+    const sig = decodeCanonicalBase64url(signature, 64);
+    const key = await importKey(jwk, api);
+    return await api.verify(
+      { name: "ECDSA", hash: "SHA-256" },
+      key,
+      sig,
+      new TextEncoder().encode(data)
+    );
+  } catch {
+    return false;
+  }
+}
+
+// src/verify/verifyManifest.ts
+function certificatePayload(s) {
+  return canonicalJson({
+    kid: s.kid,
+    jwk: { kty: s.jwk.kty, crv: s.jwk.crv, x: s.jwk.x, y: s.jwk.y },
+    notBefore: s.notBefore,
+    notAfter: s.notAfter,
+    rootKid: s.rootKid
+  });
+}
+function signedPayload(m) {
+  const { sig: _sig, ...payload } = m;
+  return canonicalJson(payload);
+}
+var isKidList = (v) => Array.isArray(v) && v.every((k) => typeof k === "string");
+function parseIso(s) {
+  const t = Date.parse(s);
+  if (!new Date(t).toISOString().startsWith(s.slice(0, 19))) fail();
+  return t;
+}
+async function verifyManifest(input, opts) {
+  try {
+    if (!opts || typeof opts !== "object") return { ok: false, reason: "malformed" };
+    const t = opts.now instanceof Date ? opts.now.getTime() : NaN;
+    if (!Number.isFinite(t)) return { ok: false, reason: "malformed" };
+    if (opts.source !== "live" && opts.source !== "fallback")
+      return { ok: false, reason: "malformed" };
+    if (!opts.expect || typeof opts.expect.site !== "string" || typeof opts.expect.channel !== "string")
+      return { ok: false, reason: "malformed" };
+    if (opts.source === "live" && !isKidList(opts.revokedKids))
+      return { ok: false, reason: "malformed" };
+    if (opts.revokedKids !== void 0 && !isKidList(opts.revokedKids))
+      return { ok: false, reason: "malformed" };
+    const m = parseManifest(input);
+    if (!m) return { ok: false, reason: "malformed" };
+    if (m.site !== opts.expect.site || m.channel !== opts.expect.channel || m.links.utmSource !== opts.expect.site)
+      return { ok: false, reason: "identity" };
+    const s = m.signer;
+    const roots = Array.isArray(opts.roots) ? opts.roots : [];
+    const root = roots.find((r) => r && r.kid === s.rootKid);
+    if (!root) return { ok: false, reason: "root_unknown" };
+    if (!await verifyP1363(root.jwk, certificatePayload(s), s.rootSig))
+      return { ok: false, reason: "root_sig" };
+    const notBefore = parseIso(s.notBefore);
+    const notAfter = parseIso(s.notAfter);
+    if (notAfter < notBefore) return { ok: false, reason: "malformed" };
+    if (opts.source === "live" && (t < notBefore || t > notAfter + SIGNER_GRACE_MS))
+      return { ok: false, reason: "window" };
+    if (m.sig.kid !== s.kid) return { ok: false, reason: "kid_mismatch" };
+    if (!await verifyP1363(s.jwk, signedPayload(m), m.sig.value))
+      return { ok: false, reason: "sig" };
+    if ((opts.revokedKids ?? []).includes(m.sig.kid) || s.revokedKids.includes(m.sig.kid))
+      return { ok: false, reason: "revoked" };
+    return { ok: true, manifest: m };
+  } catch {
+    return { ok: false, reason: "malformed" };
+  }
+}
+async function verifyManifestBytes(raw, opts) {
+  try {
+    let text;
+    if (typeof raw === "string") {
+      if (raw.length > MANIFEST_MAX_BYTES || new TextEncoder().encode(raw).length > MANIFEST_MAX_BYTES)
+        return { ok: false, reason: "malformed" };
+      text = raw;
+    } else {
+      if (!(raw instanceof Uint8Array) || raw.length > MANIFEST_MAX_BYTES)
+        return { ok: false, reason: "malformed" };
+      text = new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(raw);
+    }
+    const parsed = JSON.parse(text);
+    if (canonicalJson(parsed) !== text) return { ok: false, reason: "malformed" };
+    return await verifyManifest(parsed, opts);
+  } catch {
+    return { ok: false, reason: "malformed" };
+  }
+}
+
+// src/cli/shared.ts
+var CliError = class extends Error {
+  constructor(message, exitCode = 1) {
+    super(message);
+    this.exitCode = exitCode;
+  }
+  exitCode;
+};
+function requireWebCrypto() {
+  if (subtle() === null)
+    throw new CliError("WebCrypto unavailable (Node >= 18 with webcrypto required)");
+}
+function parseArgs(argv) {
+  const flags = {};
+  const positional = [];
+  for (let i = 0; i < argv.length; i++) {
+    const a = argv[i];
+    if (!a.startsWith("--")) {
+      positional.push(a);
+      continue;
+    }
+    const eq = a.indexOf("=");
+    if (eq > 0) {
+      flags[a.slice(2, eq)] = a.slice(eq + 1);
+      continue;
+    }
+    const key = a.slice(2);
+    const next = argv[i + 1];
+    if (next !== void 0 && !next.startsWith("--")) {
+      flags[key] = next;
+      i++;
+    } else flags[key] = true;
+  }
+  return { positional, flags };
+}
+var str2 = (v) => typeof v === "string" && v.length > 0 ? v : void 0;
+var log = {
+  info: (m) => console.log(`network-sdk: ${m}`),
+  ok: (m) => console.log(`network-sdk: \u2713 ${m}`),
+  warn: (m) => console.warn(`network-sdk: warning: ${m}`),
+  error: (m) => console.error(`network-sdk: error: ${m}`)
+};
+function projectRoot(flags) {
+  const root = resolve(str2(flags["root"]) ?? process.cwd());
+  if (!existsSync(join(root, "package.json")))
+    throw new CliError(
+      `no package.json in ${root} (run from the site's frontend directory or pass --root <dir>)`
+    );
+  return root;
+}
+function readJsonFile(path) {
+  try {
+    return JSON.parse(readFileSync(path, "utf8"));
+  } catch {
+    return null;
+  }
+}
+function writeFileAtomic(path, content) {
+  mkdirSync(dirname(path), { recursive: true });
+  const tmp = `${path}.tmp-${process.pid}`;
+  writeFileSync(tmp, content);
+  renameSync(tmp, path);
+}
+function resolveRootKeys(flags) {
+  const raw = str2(flags["root-keys"]);
+  if (!raw) {
+    if (rootPublicKeys.length === 0)
+      throw new CliError(
+        `no production root key is compiled into this SDK version; pass --root-keys '[{"kid":\u2026,"jwk":{\u2026}}]' (the hub's MANIFEST_ROOT_PUBLIC_KEYS value)`
+      );
+    return { roots: [...rootPublicKeys], explicit: false };
+  }
+  let json;
+  try {
+    json = JSON.parse(raw);
+  } catch {
+    throw new CliError("--root-keys must be a JSON array of { kid, jwk }");
+  }
+  if (!Array.isArray(json) || json.length === 0 || json.length > 8)
+    throw new CliError("--root-keys must be a non-empty JSON array of { kid, jwk }");
+  const roots = [];
+  for (const e of json) {
+    if (!e || typeof e !== "object")
+      throw new CliError("--root-keys: each entry must be { kid, jwk }");
+    const { kid, jwk } = e;
+    if (typeof kid !== "string" || !KID_RE.test(kid))
+      throw new CliError(`--root-keys: invalid kid ${String(kid)}`);
+    let parsed;
+    try {
+      parsed = parsePublicJwk(jwk);
+    } catch {
+      throw new CliError(`--root-keys: invalid jwk for ${kid}`);
+    }
+    if (roots.some((r) => r.kid === kid)) throw new CliError(`--root-keys: duplicate kid ${kid}`);
+    roots.push({ kid, jwk: parsed });
+  }
+  return { roots, explicit: true };
+}
+function readConfigLiterals(root) {
+  const path = join(root, CONFIG_PATH);
+  const out = {
+    path,
+    exists: existsSync(path),
+    siteKey: null,
+    channel: null,
+    cdnBase: null,
+    manifestUrl: null,
+    consentMode: null,
+    manifestRootKeys: null
+  };
+  if (!out.exists) return out;
+  const text = readFileSync(path, "utf8");
+  const lit = (key, re2) => {
+    const line = text.match(new RegExp(`\\b${key}\\s*:([^\\n]*)`));
+    if (!line) return null;
+    const m = line[1].match(re2);
+    return m ? m[1] : null;
+  };
+  out.siteKey = lit("siteKey", /['"]([a-z0-9]+(?:-[a-z0-9]+)*)['"]/);
+  const ch = lit("channel", /['"](production|preview)['"]/);
+  out.channel = ch === "preview" || ch === "production" ? ch : null;
+  out.cdnBase = lit("cdnBase", /['"](https?:\/\/[^'"]+)['"]/);
+  out.manifestUrl = lit("manifestUrl", /['"](https?:\/\/[^'"]+)['"]/);
+  out.consentMode = lit("consentMode", /['"]([a-z-]+)['"]/);
+  out.manifestRootKeys = lit("manifestRootKeys", /(\[.*\])/);
+  return out;
+}
+async function downloadManifest(url, cache = "no-cache") {
+  const ac = new AbortController();
+  const timer = setTimeout(() => ac.abort(), 1e4);
+  try {
+    const res = await fetch(url, {
+      cache,
+      signal: ac.signal,
+      headers: { "Cache-Control": "no-cache" }
+    });
+    if (!res.ok)
+      return { ok: false, kind: "http", status: res.status, detail: `HTTP ${res.status}`, url };
+    const buf = new Uint8Array(await res.arrayBuffer());
+    if (buf.length > MANIFEST_MAX_BYTES)
+      return { ok: false, kind: "size", detail: `${buf.length} bytes > ${MANIFEST_MAX_BYTES}`, url };
+    const text = new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(buf);
+    return { ok: true, text, bytes: buf.length, status: res.status, headers: res.headers, url };
+  } catch (err) {
+    return {
+      ok: false,
+      kind: "network",
+      detail: err instanceof Error ? err.message : String(err),
+      url
+    };
+  } finally {
+    clearTimeout(timer);
+  }
+}
+function verifyDownloaded(text, roots, expect, revokedKids) {
+  return verifyManifestBytes(text, { roots, now: /* @__PURE__ */ new Date(), expect, source: "live", revokedKids });
+}
+function verifyCommitted(fb, roots, expect) {
+  return verifyManifest(fb, { roots, now: /* @__PURE__ */ new Date(), expect, source: "fallback" });
+}
+function readFallback(root) {
+  const path = join(root, FALLBACK_PATH);
+  const exists = existsSync(path);
+  return { path, exists, json: exists ? readJsonFile(path) : null };
+}
+function aliasUrl(base, site, channel) {
+  return manifestUrlFor(base ?? DEFAULT_CDN_BASE, site, channel);
+}
+var NO_MANIFEST_MESSAGE = (siteKey) => `site ${siteKey} has no published manifest; Publish in the admin first`;
+function fallbackFileContent(parsed) {
+  return `${JSON.stringify(parsed, null, 2)}
+`;
+}
+function daysBetween(a, b) {
+  return Math.round((b.getTime() - a.getTime()) / 864e5);
+}
+
+// src/cli/doctorBackend.ts
+var BACKEND_ENV = ["INR_HUB_URL", "INR_SITE_KEY", "INR_KEY_ID", "INR_SITE_SECRET"];
+var BACKEND_EXT = /* @__PURE__ */ new Set([".js", ".mjs", ".cjs", ".ts", ".mts", ".cts"]);
+var PING_TIMEOUT_MS = 5e3;
+function readEnvFile(path) {
+  const out = {};
+  if (!existsSync2(path)) return out;
+  for (const line of readFileSync2(path, "utf8").split(/\r?\n/)) {
+    const m = line.match(/^\s*(?:export\s+)?([A-Za-z0-9_]+)\s*=\s*(.*)$/);
+    if (!m) continue;
+    const v = m[2].trim();
+    out[m[1]] = /^(['"]).*\1$/.test(v) ? v.slice(1, -1) : v;
+  }
+  return out;
+}
+function envValues(dir, names) {
+  const file = readEnvFile(join2(dir, ".env"));
+  return Object.fromEntries(names.map((n) => [n, process.env[n] || file[n] || ""]));
+}
+var VALID = {
+  INR_HUB_URL: (v) => hubOrigin(v) !== null,
+  INR_SITE_KEY: (v) => SITE_KEY_RE.test(v),
+  INR_KEY_ID: (v) => KEY_ID_RE.test(v),
+  INR_SITE_SECRET: (v) => SITE_SECRET_RE.test(v)
+};
+function backendEnvFinding(env, where) {
+  const state = BACKEND_ENV.map((n) => {
+    const v = env[n] ?? "";
+    return [n, !v ? "unset" : VALID[n](v) ? "set" : "set (invalid)"];
+  });
+  const complete = state.every(([, s]) => s === "set");
+  return {
+    complete,
+    finding: {
+      level: complete ? "ok" : "fail",
+      text: `backend env (${where}): ${state.map(([n, s]) => `${n}=${s}`).join(", ")}`
+    }
+  };
+}
+var transportCode = (err) => {
+  const e = err;
+  if (e?.name === "AbortError" || e?.name === "TimeoutError")
+    return `timeout (${PING_TIMEOUT_MS / 1e3} s)`;
+  return typeof e?.cause?.code === "string" ? e.cause.code : "connection failed";
+};
+async function signedPing(env) {
+  const label = `signed POST ${SIGNED_PATHS.ping}`;
+  const hub = hubOrigin(env.INR_HUB_URL);
+  const body = "{}";
+  const { headers } = signRequest({
+    secret: env.INR_SITE_SECRET,
+    siteKey: env.INR_SITE_KEY,
+    keyId: env.INR_KEY_ID,
+    method: "POST",
+    path: SIGNED_PATHS.ping,
+    body
+  });
+  const ac = new AbortController();
+  const timer = setTimeout(() => ac.abort(), PING_TIMEOUT_MS);
+  const tSend = Date.now();
+  try {
+    const res = await fetch(hub + SIGNED_PATHS.ping, {
+      method: "POST",
+      headers: { ...headers, "User-Agent": `network-sdk-doctor/${SDK_VERSION}` },
+      body,
+      redirect: "error",
+      signal: ac.signal
+    });
+    const tRecv = Date.now();
+    let code = null;
+    try {
+      const json = JSON.parse((await res.text()).slice(0, 8192));
+      const c = json?.error?.code ?? json?.code;
+      code = typeof c === "string" ? c : null;
+    } catch {
+      code = null;
+    }
+    const s = res.status;
+    if (s === 204) return { level: "ok", text: `${label}: 204 (key id and secret accepted)` };
+    if (s === 401) return { level: "fail", text: `${label}: 401, key id or secret rejected` };
+    if (s === 400 && code === "TIMESTAMP_SKEW") {
+      const offset = estimateOffsetMs(res.headers.get("date"), tSend, tRecv);
+      return {
+        level: "fail",
+        text: `${label}: TIMESTAMP_SKEW, this host's clock is ${offset === null ? "off by an unknown amount" : `${Math.abs(Math.round(offset / 1e3))} s ${offset > 0 ? "behind" : "ahead of"} the hub`} (fix NTP)`
+      };
+    }
+    if (s === 404) return { level: "fail", text: `${label}: 404, wrong INR_HUB_URL?` };
+    if (s === 429 || s === 503)
+      return { level: "warn", text: `${label}: ${s}${code ? ` ${code}` : ""}, retry later` };
+    return { level: "fail", text: `${label}: HTTP ${s}${code ? ` ${code}` : ""}` };
+  } catch (err) {
+    return { level: "fail", text: `${label}: network error (${transportCode(err)})` };
+  } finally {
+    clearTimeout(timer);
+  }
+}
+async function checkOutboxIndexes(root, uri, collection) {
+  const label = `outbox indexes (${collection})`;
+  let driver;
+  try {
+    driver = createRequire(join2(root, "package.json"))("mongodb");
+  } catch {
+    return { level: "fail", text: `${label}: the mongodb driver is not installed under --root` };
+  }
+  const client = new driver.MongoClient(uri, { serverSelectionTimeoutMS: 5e3 });
+  try {
+    await client.connect();
+    const found = await client.db().collection(collection).indexes();
+    const missing = OUTBOX_INDEXES.filter(([key, options]) => {
+      const ix = found.find((i) => JSON.stringify(i.key) === JSON.stringify(key));
+      return !ix || ix.expireAfterSeconds !== options["expireAfterSeconds"] || Boolean(ix.unique) !== Boolean(options["unique"]);
+    });
+    if (missing.length === 0)
+      return {
+        level: "ok",
+        text: `${label}: createdAt TTL 14 d, nextAttemptAt, unique (eventType, eventId)`
+      };
+    return {
+      level: "fail",
+      text: `${label}: missing or different: ${missing.map(([k]) => Object.keys(k).join("+")).join(", ")} (start the backend once with the reporter enabled; it creates them)`
+    };
+  } catch (err) {
+    const e = err;
+    const why = typeof e?.codeName === "string" ? e.codeName : String(e?.name ?? "error");
+    return { level: "fail", text: `${label}: ${why}` };
+  } finally {
+    await client.close().catch(() => void 0);
+  }
+}
+async function backendFindings(root, flags, scan) {
+  const out = [];
+  const add = (level, text) => out.push({ level, text });
+  const major = Number(process.versions.node.split(".")[0]);
+  add(major >= 18 ? "ok" : "fail", `Node ${process.versions.node}${major >= 18 ? "" : " (< 18)"}`);
+  const ids = scan.identifiers;
+  add(
+    ids.createConversionReporter.length > 0 ? "ok" : "fail",
+    `createConversionReporter() (server entry): ${ids.createConversionReporter.join(", ") || "missing"}`
+  );
+  const ref = [.../* @__PURE__ */ new Set([...ids.referralFromRequest, ...ids.referralMiddleware])];
+  add(
+    ref.length > 0 ? "ok" : "fail",
+    `referralFromRequest() / referralMiddleware(): ${ref.join(", ") || "missing"}`
+  );
+  add(
+    "ok",
+    `${scan.files} source file(s) scanned (node_modules, dist, build, coverage, .git skipped)`
+  );
+  const pkgPath = join2(root, "package.json");
+  if (!existsSync2(pkgPath)) add("skip", "package.json: none (optional for --backend)");
+  else {
+    let dep;
+    try {
+      const pkg = JSON.parse(readFileSync2(pkgPath, "utf8"));
+      dep = pkg.dependencies?.["@intenque/network-sdk"];
+    } catch {
+      add("warn", "package.json is not valid JSON");
+    }
+    if (!dep) add("warn", `@intenque/network-sdk is not a dependency (CLI ${SDK_VERSION})`);
+    else if (/^(file|link):/.test(dep))
+      add("warn", `@intenque/network-sdk ${dep}: a local path; a deploy build cannot install it`);
+    else add("ok", `@intenque/network-sdk ${dep} (CLI ${SDK_VERSION})`);
+  }
+  const env = envValues(root, [...BACKEND_ENV, "INR_OUTBOX_COLLECTION"]);
+  const { finding, complete } = backendEnvFinding(
+    env,
+    existsSync2(join2(root, ".env")) ? "process env, .env" : "process env"
+  );
+  out.push(finding);
+  if (complete) out.push(await signedPing(env));
+  else add("skip", `signed POST ${SIGNED_PATHS.ping}: needs all four INR_* values`);
+  const uri = str2(flags["mongo-uri"]);
+  if (!uri) add("skip", "outbox indexes: pass --mongo-uri <uri> to check them");
+  else
+    out.push(
+      await checkOutboxIndexes(
+        root,
+        uri,
+        env["INR_OUTBOX_COLLECTION"] || OUTBOX_DEFAULT_COLLECTION
+      )
+    );
+  return out;
+}
+
+// src/cli/doctor.ts
+function doctorImpressionBody(m, now = Date.now(), pv = randomUUID2()) {
+  const t = Math.round(now);
+  return {
+    v: 2,
+    k: m.site,
+    pv,
+    r: m.revision,
+    src: "doctor",
+    sdk: SDK_VERSION,
+    tok: m.analytics.token,
+    sp: m.analytics.samplePermille,
+    smp: m.analytics.samplePermille > 0 ? 1 : 0,
+    t,
+    hd: 0,
+    m: t,
+    items: [],
+    ss: false,
+    sm: 0,
+    vp: { w: 0, h: 0 },
+    why: "timer"
+  };
+}
+async function sendDoctorImpression(m, timeoutMs = 5e3) {
+  const url = `${m.analytics.endpoint.replace(/\/+$/, "")}/impression`;
+  const ac = new AbortController();
+  const timer = setTimeout(() => ac.abort(), timeoutMs);
+  try {
+    const res = await fetch(url, {
+      method: "POST",
+      headers: {
+        "content-type": "text/plain;charset=UTF-8",
+        "user-agent": `network-sdk-doctor/${SDK_VERSION}`
+      },
+      body: JSON.stringify(doctorImpressionBody(m)),
+      signal: ac.signal
+    });
+    return { url, status: res.status };
+  } catch (err) {
+    return { url, error: err instanceof Error ? err.message : String(err) };
+  } finally {
+    clearTimeout(timer);
+  }
+}
+var EXT = /* @__PURE__ */ new Set([".js", ".jsx", ".ts", ".tsx", ".mjs", ".cjs"]);
+var SKIP_DIRS = /* @__PURE__ */ new Set(["node_modules", "dist", "build", ".git", "coverage"]);
+function listSourceFiles(root, limit = 5e3, ext = EXT) {
+  const out = [];
+  const walk = (dir) => {
+    if (out.length >= limit) return;
+    let entries;
+    try {
+      entries = readdirSync(dir);
+    } catch {
+      return;
+    }
+    for (const name of entries) {
+      if (SKIP_DIRS.has(name)) continue;
+      const p = join3(dir, name);
+      let st;
+      try {
+        st = statSync(p);
+      } catch {
+        continue;
+      }
+      if (st.isDirectory()) walk(p);
+      else if (ext.has(name.slice(name.lastIndexOf("."))) && out.length < limit) out.push(p);
+    }
+  };
+  walk(root);
+  return out;
+}
+var IDENTIFIERS = [
+  "DiscoverBusinesses",
+  "NetworkProvider",
+  "captureReferral",
+  "setConsent",
+  "attachReferral",
+  "attachReferralHeader",
+  "createConversionReporter",
+  "referralFromRequest",
+  "referralMiddleware"
+];
+function scanSources(root, files) {
+  const scan = {
+    imports: { react: [], capture: [], server: [] },
+    identifiers: Object.fromEntries(IDENTIFIERS.map((i) => [i, []])),
+    headerMode: false
+  };
+  for (const f of files) {
+    let text;
+    try {
+      text = readFileSync3(f, "utf8");
+    } catch {
+      continue;
+    }
+    if (!text.includes("@intenque/network-sdk") && !IDENTIFIERS.some((i) => text.includes(i)))
+      continue;
+    const rel = relative(root, f);
+    for (const entry of ["react", "capture", "server"])
+      if (new RegExp(`['"]@intenque/network-sdk/${entry}['"]`).test(text))
+        scan.imports[entry].push(rel);
+    for (const id of IDENTIFIERS)
+      if (new RegExp(`\\b${id}\\b`).test(text)) scan.identifiers[id].push(rel);
+    if (/attachReferralHeader\s*\(/.test(text) || /mode\s*:\s*['"]header['"]/.test(text))
+      scan.headerMode = true;
+  }
+  return scan;
+}
+function gtagConfigsWithoutPageLocation(htmlPath) {
+  if (!existsSync3(htmlPath)) return null;
+  let text;
+  try {
+    text = readFileSync3(htmlPath, "utf8");
+  } catch {
+    return null;
+  }
+  const configs = [...text.matchAll(/gtag\(\s*['"]config['"]/g)];
+  if (configs.length === 0) return null;
+  let naked = 0;
+  for (const m of configs) {
+    const start = m.index ?? 0;
+    const end = text.indexOf(";", start);
+    const statement = text.slice(start, end === -1 ? void 0 : end);
+    if (!/\bpage_location\b/.test(statement)) naked++;
+  }
+  return naked;
+}
+function envPresence(dir, names) {
+  return Object.fromEntries(Object.entries(envValues(dir, names)).map(([k, v]) => [k, v !== ""]));
+}
+async function runBackendDoctor(flags) {
+  const root = resolve2(str2(flags["root"]) ?? process.cwd());
+  const files = listSourceFiles(root, 5e3, BACKEND_EXT);
+  const scan = scanSources(root, files);
+  const findings = await backendFindings(root, flags, {
+    files: files.length,
+    identifiers: {
+      createConversionReporter: scan.identifiers["createConversionReporter"],
+      referralFromRequest: scan.identifiers["referralFromRequest"],
+      referralMiddleware: scan.identifiers["referralMiddleware"]
+    }
+  });
+  return finish(findings);
+}
+async function runDoctor(flags) {
+  if (flags["backend"] === true) return runBackendDoctor(flags);
+  const root = projectRoot(flags);
+  const findings = [];
+  const add = (level, text) => findings.push({ level, text });
+  const backend = flags["frontend"] !== true;
+  const files = listSourceFiles(join3(root, existsSync3(join3(root, "src")) ? "src" : "."));
+  const scan = scanSources(root, files);
+  const report = (label, paths, required) => {
+    if (paths.length > 0) add("ok", `${label}: ${paths.join(", ")}`);
+    else add(required ? "fail" : "warn", `${label}: missing`);
+  };
+  report("<DiscoverBusinesses /> (react entry)", scan.identifiers["DiscoverBusinesses"], true);
+  report("captureReferral() (capture entry, main.jsx)", scan.identifiers["captureReferral"], true);
+  report("setConsent() in the consent banner", scan.identifiers["setConsent"], false);
+  report(
+    `attachReferral() on the API client (${scan.headerMode ? "HEADER mode" : "body mode"})`,
+    [...scan.identifiers["attachReferral"], ...scan.identifiers["attachReferralHeader"]],
+    false
+  );
+  const naked = gtagConfigsWithoutPageLocation(join3(root, "index.html"));
+  if (naked !== null)
+    add(
+      naked > 0 ? "warn" : "ok",
+      naked > 0 ? `index.html: gtag('config') without page_location (${naked}): GA reads location.href before captureReferral strips inr; pass page_location with the inr parameter removed (install guide, GA step)` : "index.html: gtag('config') passes page_location (inr stripped before GA reads the URL)"
+    );
+  if (backend) {
+    const found = scan.identifiers["createConversionReporter"];
+    if (found.length > 0)
+      add("ok", `createConversionReporter() (server entry): ${found.join(", ")}`);
+    else
+      add(
+        "skip",
+        "createConversionReporter(): not found (doctor --backend in a split backend; required for capabilities.conversions sites)"
+      );
+  }
+  const cfg = readConfigLiterals(root);
+  if (!cfg.exists) {
+    add("fail", `${relative(root, cfg.path)} missing: run network-sdk init --site-key <key>`);
+    return finish(findings);
+  }
+  const siteKey = str2(flags["site-key"]) ?? cfg.siteKey;
+  if (!siteKey) add("fail", `${relative(root, cfg.path)} has no literal siteKey`);
+  else add("ok", `siteKey ${siteKey} (${relative(root, cfg.path)})`);
+  const channel = flags["channel"] === "preview" ? "preview" : cfg.channel ?? "production";
+  const fe = envPresence(root, ["VITE_INR_SITE_KEY", "VITE_INR_CHANNEL", "VITE_INR_MANIFEST_URL"]);
+  add(
+    "ok",
+    `frontend env: ${Object.entries(fe).map(([k, v]) => `${k}=${v ? "set" : "unset"}`).join(", ")} (optional overrides)`
+  );
+  if (fe["VITE_INR_MANIFEST_URL"])
+    add("warn", "VITE_INR_MANIFEST_URL is set: staging-hub override; never for a production site");
+  let backendEnv = null;
+  if (backend) {
+    const dir = existsSync3(join3(root, "backend")) ? join3(root, "backend") : existsSync3(join3(root, "..", "backend")) ? join3(root, "..", "backend") : root;
+    const env = envValues(dir, BACKEND_ENV);
+    const where = relative(root, dir) || ".";
+    if (Object.values(env).every((v) => v === ""))
+      add("skip", `backend env not set in ${where} (run doctor --backend in the backend)`);
+    else {
+      const { finding, complete } = backendEnvFinding(env, where);
+      findings.push(finding);
+      if (complete) backendEnv = env;
+    }
+  }
+  let roots;
+  try {
+    const f = !str2(flags["root-keys"]) && cfg.manifestRootKeys ? { ...flags, "root-keys": cfg.manifestRootKeys } : flags;
+    roots = resolveRootKeys(f).roots;
+    add(
+      f === flags ? "ok" : "warn",
+      `root keys: ${roots.map((r) => r.kid).join(", ")}${f === flags ? "" : " (from manifestRootKeys in network.config.js: a development override, not the compiled production root)"}`
+    );
+  } catch (err) {
+    add("fail", err instanceof Error ? err.message : String(err));
+    return finish(findings);
+  }
+  if (!siteKey) return finish(findings);
+  const expect = { site: siteKey, channel };
+  const fb = readFallback(root);
+  let trusted = null;
+  if (!fb.exists) add("fail", `${FALLBACK_PATH} missing (run network-sdk sync-fallback)`);
+  else if (fb.json === null) add("fail", `${FALLBACK_PATH} is not valid JSON`);
+  else {
+    const r = await verifyCommitted(fb.json, roots, expect);
+    const site = fb.json.site;
+    if (site !== siteKey)
+      add(
+        "fail",
+        `${FALLBACK_PATH} site ${String(site)} \u2260 ${siteKey} (\xA74.6: sync-fallback overwrites it; commit the result)`
+      );
+    else if (!r.ok) add("fail", `${FALLBACK_PATH} fails the identity check: ${r.reason}`);
+    else {
+      trusted = r.manifest;
+      const age = daysBetween(new Date(trusted.publishedAt), /* @__PURE__ */ new Date());
+      const left = daysBetween(/* @__PURE__ */ new Date(), new Date(trusted.signer.notAfter));
+      add(
+        "ok",
+        `fallback: revision ${trusted.revision}, ${trusted.businesses.length} items, published ${trusted.publishedAt} (${age} d ago), signer ${trusted.sig.kid} valid until ${trusted.signer.notAfter}`
+      );
+      if (left < 60)
+        add(
+          "warn",
+          `fallback signer notAfter is in ${left} d (< 60 d): redeploy after the next publish so sync-fallback refreshes it`
+        );
+    }
+  }
+  const url = str2(flags["url"]) ? aliasUrl(str2(flags["url"]), siteKey, channel) : cfg.manifestUrl ?? aliasUrl(cfg.cdnBase ?? void 0, siteKey, channel);
+  let live = null;
+  const dl = await downloadManifest(url);
+  if (!dl.ok) add("fail", `manifest fetch failed: ${dl.detail} (${url})`);
+  else {
+    const h = (n) => dl.headers.get(n) ?? "\u2014";
+    add(
+      "ok",
+      `manifest ${url}: HTTP ${dl.status}, ${dl.bytes} bytes${dl.bytes > 10 * 1024 ? " (> 10 KB target)" : ""}`
+    );
+    add(
+      "ok",
+      `headers: content-type ${h("content-type")}; cache-control ${h("cache-control")}; x-amz-meta-revision ${h("x-amz-meta-revision")}; x-amz-meta-manifest-hash ${h("x-amz-meta-manifest-hash").slice(0, 16)}\u2026; age ${h("age")}`
+    );
+    const v = await verifyDownloaded(dl.text, roots, expect, trusted?.signer.revokedKids ?? []);
+    if (!v.ok) add("fail", `signature: ${v.reason}`);
+    else {
+      const m = v.manifest;
+      live = m;
+      add(
+        "ok",
+        `signature OK: revision ${m.revision}, ${m.businesses.length} items, publishedAt ${m.publishedAt}, signer ${m.sig.kid} (root ${m.signer.rootKid}), minSdkVersion ${m.minSdkVersion}, analytics.enabled ${m.analytics.enabled}`
+      );
+      if (trusted && trusted.revision < m.revision)
+        add(
+          "warn",
+          `fallback revision ${trusted.revision} is behind live ${m.revision}: the next build refreshes it (sync-fallback)`
+        );
+      if (trusted && trusted.revision > m.revision)
+        add(
+          "warn",
+          `fallback revision ${trusted.revision} is AHEAD of live ${m.revision}: stale CDN edge or rollback in flight (the SDK would render the fallback with rev_rollback)`
+        );
+    }
+  }
+  const pkg = JSON.parse(readFileSync3(join3(root, "package.json"), "utf8"));
+  const scripts = pkg.scripts ?? {};
+  const hasPrebuild = /network:sync|sync-fallback/.test(scripts["prebuild"] ?? "");
+  const inlined = /sync-fallback|network:sync/.test(scripts["build"] ?? "");
+  if (hasPrebuild || inlined)
+    add(
+      "ok",
+      `package.json: sync-fallback runs in ${[hasPrebuild && "prebuild", inlined && "build"].filter(Boolean).join(" and ")}`
+    );
+  else
+    add(
+      "warn",
+      "package.json lacks the prebuild hook / an inlined sync-fallback in build: the fallback will go stale"
+    );
+  add(
+    "ok",
+    "App Platform: the frontend component's Build Command must be `npm run build` (prebuild/inlined sync-fallback run only then)"
+  );
+  const dep = pkg.dependencies?.["@intenque/network-sdk"];
+  add(
+    dep ? "ok" : "warn",
+    `@intenque/network-sdk ${dep ?? "is not a dependency"} (CLI ${SDK_VERSION})`
+  );
+  if (scan.headerMode) {
+    const api = str2(flags["api-url"]);
+    if (!api)
+      add(
+        "warn",
+        "header mode detected: pass --api-url <backend origin> [--preflight-path /api/book] to check the CORS preflight"
+      );
+    else {
+      const target = new URL(str2(flags["preflight-path"]) ?? "/", api).href;
+      try {
+        const res = await fetch(target, {
+          method: "OPTIONS",
+          headers: {
+            Origin: "https://doctor.invalid",
+            "Access-Control-Request-Method": "POST",
+            "Access-Control-Request-Headers": "x-inr-ref, x-inr-ref-scope, x-inr-ref-first"
+          }
+        });
+        const allowed = (res.headers.get("access-control-allow-headers") ?? "").toLowerCase();
+        const ok = ["x-inr-ref", "x-inr-ref-scope", "x-inr-ref-first"].every((h) => allowed.includes(h)) || allowed === "*";
+        add(
+          ok ? "ok" : "fail",
+          `CORS preflight ${target}: ${res.status}, allow-headers "${allowed || "\u2014"}"${ok ? "" : " \u2014 append X-INR-Ref, X-INR-Ref-Scope, X-INR-Ref-First to allowedHeaders or use body mode"}`
+        );
+      } catch (err) {
+        add(
+          "fail",
+          `CORS preflight ${target} failed: ${err instanceof Error ? err.message : String(err)}`
+        );
+      }
+    }
+  } else add("ok", "body mode (default): no CORS change needed");
+  if (flags["no-impression"] === true) add("skip", "test impression (src: doctor): --no-impression");
+  else if (!live)
+    add("skip", "test impression (src: doctor): no verified live manifest to take the token from");
+  else {
+    const r = await sendDoctorImpression(live);
+    if ("error" in r) add("warn", `test impression (src: doctor) \u2192 ${r.url}: ${r.error}`);
+    else
+      add(
+        r.status === 204 ? "ok" : "warn",
+        `test impression (src: doctor) \u2192 ${r.url}: HTTP ${r.status}${r.status === 204 ? "" : " (expected 204)"}`
+      );
+  }
+  if (backendEnv) findings.push(await signedPing(backendEnv));
+  else add("skip", "signed POST /v1/conversions/ping: no backend env here (doctor --backend)");
+  return finish(findings);
+}
+function finish(findings) {
+  const icon = { ok: "\u2713", warn: "!", fail: "\u2717", skip: "\u2013" };
+  for (const f of findings) console.log(` ${icon[f.level]} ${f.text}`);
+  const fails = findings.filter((f) => f.level === "fail").length;
+  const warns = findings.filter((f) => f.level === "warn").length;
+  console.log(`network-sdk doctor: ${fails} failed, ${warns} warnings`);
+  if (fails > 0) throw new CliError(`${fails} check(s) failed`);
+  return 0;
+}
+
+// src/cli/init.ts
+import { existsSync as existsSync4, readFileSync as readFileSync4 } from "fs";
+import { join as join4 } from "path";
+function detectSite(root) {
+  const pkg = (() => {
+    try {
+      return JSON.parse(readFileSync4(join4(root, "package.json"), "utf8"));
+    } catch {
+      return {};
+    }
+  })();
+  const deps = {
+    ...pkg["dependencies"] ?? {},
+    ...pkg["devDependencies"] ?? {}
+  };
+  const twFile = [
+    "tailwind.config.js",
+    "tailwind.config.cjs",
+    "tailwind.config.mjs",
+    "tailwind.config.ts"
+  ].map((f) => join4(root, f)).find((p) => existsSync4(p));
+  const colours = {};
+  if (twFile) {
+    const text = readFileSync4(twFile, "utf8");
+    for (const m of text.matchAll(/\b([A-Za-z][\w-]*)\s*:\s*['"](#[0-9a-fA-F]{3,8})['"]/g))
+      colours[m[1]] = m[2];
+  }
+  const tracker = join4(root, "src/api/tracker.js");
+  const consentImport = existsSync4(tracker) && /export\s+function\s+getConsent\b/.test(readFileSync4(tracker, "utf8")) ? `import { getConsent } from './api/tracker'` : null;
+  return {
+    tailwind: !!twFile || "tailwindcss" in deps,
+    colours,
+    lucide: "lucide-react" in deps,
+    consentImport
+  };
+}
+function tailwindTheme(colours) {
+  const gold = "gold" in colours ? "gold" : "[#ffcb50]";
+  const white = "mycustomwhite" in colours ? "mycustomwhite" : "white";
+  return {
+    section: "py-16 px-4 bg-black",
+    container: "max-w-6xl mx-auto",
+    heading: `text-${white} text-3xl font-bold text-center`,
+    accentWord: `text-${gold}`,
+    subheading: "text-gray-300 text-center mt-2",
+    grid: "grid grid-cols-1 sm:grid-cols-2 lg:grid-cols-3 gap-6 mt-10",
+    card: "bg-white rounded-2xl shadow-md hover:shadow-xl transition-all duration-300 overflow-hidden flex flex-col",
+    imageBox: "aspect-video bg-gray-100 overflow-hidden",
+    image: "w-full h-full object-cover",
+    placeholder: "w-full h-full flex items-center justify-center text-5xl font-bold text-gray-400 bg-gray-200",
+    body: "flex flex-col flex-grow gap-2 p-5",
+    name: "text-xl font-semibold text-black",
+    meta: "text-sm text-gray-500",
+    description: "text-gray-700 line-clamp-3 flex-grow",
+    button: `self-start mt-2 inline-flex items-center gap-2 bg-${gold} text-black font-semibold rounded-full px-5 py-2 hover:bg-black hover:text-${gold} transition-all`,
+    buttonIcon: "w-4 h-4"
+  };
+}
+function renderConfig(input) {
+  const { siteKey, channel, cdnBase, rootKeysJson, detected } = input;
+  const theme = detected.tailwind ? tailwindTheme(detected.colours) : null;
+  const lines = [
+    `// Written by \`network-sdk init\` (@intenque/network-sdk ${SDK_VERSION}) \u2014 the only per-site file (spec \xA76.2).`,
+    `// Everything else (title, items, UTM values, analytics on/off, images) comes from the signed manifest.`,
+    `import { defineNetworkConfig } from '@intenque/network-sdk/react'`,
+    `import fallback from './data/network.fallback.json'`
+  ];
+  if (detected.consentImport)
+    lines.push(`${detected.consentImport} // consent adapter: get() => 'granted' | 'denied' | null`);
+  lines.push(
+    ``,
+    `export default defineNetworkConfig({`,
+    `  siteKey: import.meta.env.VITE_INR_SITE_KEY || '${siteKey}', // the literal is what sync-fallback reads (\xA74.6)`,
+    `  channel: import.meta.env.VITE_INR_CHANNEL || '${channel}',`
+  );
+  if (cdnBase)
+    lines.push(
+      `  // Development CDN base written by \`init --url\`; remove when the production CDN is live (DEFAULT_CDN_BASE).`,
+      `  cdnBase: '${cdnBase}',`
+    );
+  lines.push(
+    `  manifestUrl: import.meta.env.VITE_INR_MANIFEST_URL, // separate staging hub only (with manifestRootKeys)`
+  );
+  if (rootKeysJson)
+    lines.push(
+      `  // Root public keys written by \`init --root-keys\` (dev root). Remove when the SDK ships the production root.`,
+      `  manifestRootKeys: ${rootKeysJson},`
+    );
+  lines.push(
+    `  fallback, // written by \`network-sdk sync-fallback\` in prebuild; also the rollback floor`,
+    detected.consentImport ? `  consent: { get: getConsent },` : `  consent: undefined, // TODO: { get: () => 'granted' | 'denied' | null }`,
+    `  consentMode: 'session-default', // 'require-consent' for sites with EU/UK visitors (\xA75.9)`,
+    `  dev: import.meta.env.DEV,`
+  );
+  if (theme) {
+    lines.push(
+      `  unstyled: true, // Tailwind classes below; drop this line and import '@intenque/network-sdk/styles.css' instead`
+    );
+    lines.push(`  theme: {`);
+    for (const [k, v] of Object.entries(theme)) lines.push(`    ${k}: '${v}',`);
+    lines.push(`  },`);
+  } else {
+    lines.push(
+      `  // No Tailwind detected: import '@intenque/network-sdk/styles.css' in main.jsx and tune the --inr-* variables.`
+    );
+  }
+  lines.push(`})`, ``);
+  return lines.join("\n");
+}
+function patchScripts(scripts, syncCommand) {
+  const out = { ...scripts };
+  const changes = [];
+  if (out["network:sync"] !== syncCommand) {
+    out["network:sync"] = syncCommand;
+    changes.push('"network:sync"');
+  }
+  if (!out["prebuild"]) {
+    out["prebuild"] = "npm run network:sync";
+    changes.push('"prebuild"');
+  } else if (!out["prebuild"].includes("network:sync") && !out["prebuild"].includes("sync-fallback")) {
+    out["prebuild"] = `npm run network:sync && ${out["prebuild"]}`;
+    changes.push('"prebuild" (prepended)');
+  }
+  const build = out["build"];
+  if (build && !build.includes("sync-fallback") && !build.includes("network:sync")) {
+    out["build"] = `${syncCommand} && ${build}`;
+    changes.push('"build" (sync-fallback inlined)');
+  }
+  return { scripts: out, changes };
+}
+async function runInit(flags) {
+  const siteKey = str2(flags["site-key"]);
+  if (!siteKey || !SLUG_RE.test(siteKey) || siteKey.length > 48)
+    throw new CliError(
+      "usage: network-sdk init --site-key <site-key> [--url <cdn-base>] [--root-keys <json>] [--channel production|preview]"
+    );
+  const root = projectRoot(flags);
+  const channel = flags["channel"] === "preview" ? "preview" : "production";
+  const base = str2(flags["url"]);
+  const { roots, explicit } = resolveRootKeys(flags);
+  const expect = { site: siteKey, channel };
+  const url = aliasUrl(base, siteKey, channel);
+  const detected = detectSite(root);
+  const committed = readFallback(root);
+  const committedOk = committed.exists && committed.json !== null ? (await verifyCommitted(committed.json, roots, expect)).ok : false;
+  log.info(`downloading ${url}`);
+  const dl = await downloadManifest(url);
+  if (!dl.ok) {
+    if (committedOk)
+      log.warn(`download failed (${dl.detail}); keeping the committed ${FALLBACK_PATH}`);
+    else throw new CliError(`${NO_MANIFEST_MESSAGE(siteKey)} (${dl.detail} at ${url})`);
+  } else {
+    const trustedRevoked = committedOk && committed.json ? committed.json.signer.revokedKids ?? [] : [];
+    const v = await verifyDownloaded(dl.text, roots, expect, trustedRevoked);
+    if (!v.ok)
+      throw new CliError(
+        `downloaded manifest failed verification (${v.reason}) at ${url}; not written`
+      );
+    writeFileAtomic(committed.path, fallbackFileContent(JSON.parse(dl.text)));
+    log.ok(
+      `wrote ${FALLBACK_PATH} (revision ${v.manifest.revision}, ${v.manifest.businesses.length} items, ${dl.bytes} bytes, signer ${v.manifest.sig.kid})`
+    );
+  }
+  const configPath = join4(root, CONFIG_PATH);
+  if (existsSync4(configPath) && flags["force"] !== true)
+    log.warn(`${CONFIG_PATH} exists; left unchanged (use --force to rewrite)`);
+  else {
+    writeFileAtomic(
+      configPath,
+      renderConfig({
+        siteKey,
+        channel,
+        cdnBase: base,
+        rootKeysJson: explicit ? JSON.stringify(roots) : void 0,
+        detected
+      })
+    );
+    log.ok(
+      `wrote ${CONFIG_PATH} (${detected.tailwind ? "Tailwind theme slots" : "styles.css"}${detected.consentImport ? ", consent from src/api/tracker.js" : ""}${detected.lucide ? ", lucide-react available" : ""})`
+    );
+  }
+  const pkgPath = join4(root, "package.json");
+  const pkg = JSON.parse(readFileSync4(pkgPath, "utf8"));
+  const syncFlags = [
+    base ? `--url ${base}` : "",
+    explicit ? `--root-keys '${JSON.stringify(roots)}'` : "",
+    channel === "preview" ? "--channel preview" : ""
+  ].filter(Boolean).join(" ");
+  const syncCommand = `network-sdk sync-fallback${syncFlags ? ` ${syncFlags}` : ""}`;
+  const { scripts, changes } = patchScripts(pkg["scripts"] ?? {}, syncCommand);
+  if (changes.length > 0) {
+    pkg["scripts"] = scripts;
+    writeFileAtomic(pkgPath, `${JSON.stringify(pkg, null, 2)}
+`);
+    log.ok(`package.json scripts updated: ${changes.join(", ")}`);
+  } else log.ok("package.json scripts already up to date");
+  if (base || explicit)
+    log.warn(
+      "dev flags (--url / --root-keys) are inlined into the sync scripts; re-run init without them once the production CDN and root are live"
+    );
+  console.log(`
+Next steps (spec \xA76.7):
+  main.jsx (before ReactDOM.createRoot, before any tracker or GA snippet):
+    import { captureReferral } from '@intenque/network-sdk/capture'
+    import { NetworkProvider } from '@intenque/network-sdk/react'
+    import networkConfig from './network.config'
+    captureReferral(networkConfig.capture)
+    \u2026render(<NetworkProvider config={networkConfig}><App /></NetworkProvider>)
+  Home page (after <ReviewCarousel />):
+    import { DiscoverBusinesses } from '@intenque/network-sdk/react'
+    <DiscoverBusinesses />
+  ConsentBanner (next to grantConsent() / denyConsent()):
+    import { setConsent } from '@intenque/network-sdk/capture'   \u2192  setConsent('granted') / setConsent('denied')
+  API client (api/axios.js):
+    import { attachReferral } from '@intenque/network-sdk/capture'  \u2192  attachReferral(api)
+  App Platform: the frontend component's Build Command must be \`npm run build\` (so sync-fallback runs on every deploy).
+  Then: npx network-sdk doctor
+`);
+  return 0;
+}
+
+// src/cli/printConfig.ts
+import { relative as relative2 } from "path";
+function runPrintConfig(flags) {
+  const root = projectRoot(flags);
+  const cfg = readConfigLiterals(root);
+  const fb = readFallback(root);
+  const j = fb.json;
+  const channel = cfg.channel ?? "production";
+  const out = {
+    sdkVersion: SDK_VERSION,
+    configFile: cfg.exists ? relative2(root, cfg.path) : null,
+    siteKey: cfg.siteKey,
+    channel,
+    cdnBase: cfg.cdnBase ?? (j && typeof j["cdnBase"] === "string" ? j["cdnBase"] : DEFAULT_CDN_BASE),
+    manifestUrl: cfg.manifestUrl ?? (cfg.siteKey ? aliasUrl(cfg.cdnBase ?? j?.["cdnBase"], cfg.siteKey, channel) : null),
+    consentMode: cfg.consentMode ?? "session-default",
+    fallback: fb.exists ? {
+      file: relative2(root, fb.path),
+      revision: j?.["revision"] ?? null,
+      publishedAt: j?.["publishedAt"] ?? null,
+      site: j?.["site"] ?? null,
+      channel: j?.["channel"] ?? null,
+      items: Array.isArray(j?.["businesses"]) ? j["businesses"].length : null,
+      signer: j?.["sig"]?.kid ?? null,
+      analyticsEnabled: j?.["analytics"]?.enabled ?? null
+    } : null
+  };
+  if (!cfg.exists) log.warn("src/network.config.js not found");
+  console.log(JSON.stringify(out, null, 2));
+  return 0;
+}
+
+// src/cli/syncFallback.ts
+function emptyPlaceholder(site, channel) {
+  return {
+    schema: 2,
+    revision: 0,
+    site,
+    channel,
+    businesses: [],
+    placeholder: "written by network-sdk sync-fallback --allow-empty"
+  };
+}
+async function runSyncFallback(flags) {
+  const root = projectRoot(flags);
+  const cfg = readConfigLiterals(root);
+  if (!cfg.exists)
+    throw new CliError(`${cfg.path} not found; run \`network-sdk init --site-key <key>\` first`);
+  const siteKey = str2(flags["site-key"]) ?? cfg.siteKey;
+  if (!siteKey)
+    throw new CliError(
+      `cannot resolve the site key: ${cfg.path} has no literal siteKey (e.g. siteKey: 'jcm-detailing')`
+    );
+  const { roots } = resolveRootKeys(flags);
+  const base = str2(flags["url"]);
+  if (!base && (process.env["VITE_INR_MANIFEST_URL"] || process.env["INR_MANIFEST_URL"]))
+    log.info(
+      "VITE_INR_MANIFEST_URL is set but ignored: sync-fallback reads the production CDN unless --url is explicit (\xA74.6)"
+    );
+  const committed = readFallback(root);
+  const committedJson = committed.json;
+  const committedChannel = committedJson && (committedJson["channel"] === "preview" || committedJson["channel"] === "production") ? committedJson["channel"] : null;
+  const explicitChannel = flags["channel"] === "preview" ? "preview" : flags["channel"] === "production" ? "production" : null;
+  const channels = explicitChannel ? [explicitChannel] : committedChannel ? [committedChannel] : ["production", "preview"];
+  let trusted = null;
+  if (committed.exists) {
+    if (committedJson === null)
+      log.warn(`${FALLBACK_PATH} is not valid JSON; it will be overwritten`);
+    else {
+      const r = await verifyCommitted(committedJson, roots, {
+        site: siteKey,
+        channel: channels[0]
+      });
+      if (r.ok) trusted = r.manifest;
+      else if (isPlaceholder(committedJson))
+        log.info(`${FALLBACK_PATH} is the --allow-empty placeholder`);
+      else
+        log.warn(
+          `${FALLBACK_PATH} fails the identity check (${r.reason}: site ${String(committedJson["site"])}, channel ${String(committedJson["channel"])}); it will be overwritten`
+        );
+    }
+  }
+  let dl = null;
+  let channel = channels[0];
+  for (const ch of channels) {
+    channel = ch;
+    dl = await downloadManifest(aliasUrl(base, siteKey, ch));
+    if (dl.ok || dl.kind !== "http") break;
+  }
+  if (!dl) throw new CliError("internal: no download attempted");
+  if (!dl.ok) {
+    const allowEmpty = flags["allow-empty"] === true;
+    if (trusted) {
+      log.warn(
+        `${dl.detail} at ${dl.url}; keeping the committed ${FALLBACK_PATH} (revision ${trusted.revision})${allowEmpty ? "; --allow-empty does not replace a trusted fallback" : ""}`
+      );
+      return 0;
+    }
+    if (committed.exists && committedJson && isPlaceholder(committedJson)) {
+      log.warn(`${dl.detail} at ${dl.url}; keeping the committed empty placeholder`);
+      return 0;
+    }
+    if (allowEmpty) {
+      writeFileAtomic(committed.path, fallbackFileContent(emptyPlaceholder(siteKey, channel)));
+      log.warn(
+        `${dl.detail} at ${dl.url}; wrote an EMPTY placeholder (--allow-empty): the section renders nothing`
+      );
+      return 0;
+    }
+    throw new CliError(
+      `${NO_MANIFEST_MESSAGE(siteKey)} (${dl.detail} at ${dl.url}; no committed ${FALLBACK_PATH} passes the identity check)`
+    );
+  }
+  const v = await verifyDownloaded(
+    dl.text,
+    roots,
+    { site: siteKey, channel },
+    trusted?.signer.revokedKids ?? []
+  );
+  if (!v.ok) {
+    if (trusted) {
+      log.warn(
+        `downloaded manifest failed verification (${v.reason}) at ${dl.url}; keeping the committed file`
+      );
+      return 0;
+    }
+    throw new CliError(
+      `downloaded manifest failed verification (${v.reason}) at ${dl.url} and no trusted committed ${FALLBACK_PATH} exists`
+    );
+  }
+  const live = v.manifest;
+  if (trusted && live.revision < trusted.revision) {
+    log.warn(
+      `live revision ${live.revision} is lower than the committed revision ${trusted.revision}; refusing to downgrade (a stale CDN edge or a rollback in flight)`
+    );
+    return 0;
+  }
+  if (trusted && live.revision === trusted.revision) {
+    log.ok(`${FALLBACK_PATH} already at revision ${live.revision}`);
+    return 0;
+  }
+  writeFileAtomic(committed.path, fallbackFileContent(JSON.parse(dl.text)));
+  const check = readJsonFile(committed.path);
+  if (!check || check.site !== siteKey)
+    throw new CliError(`${FALLBACK_PATH} site ${String(check?.site)} \u2260 ${siteKey} after the write`);
+  log.ok(
+    `wrote ${FALLBACK_PATH}: revision ${live.revision} (${trusted ? `was ${trusted.revision}` : "new"}), ${live.businesses.length} items, ${dl.bytes} bytes, ${channel} channel, signer ${live.sig.kid}`
+  );
+  return 0;
+}
+function isPlaceholder(o) {
+  return o["revision"] === 0 && Array.isArray(o["businesses"]) && o["businesses"].length === 0 && !("sig" in o);
+}
+
+// src/cli/main.ts
+var HELP = `network-sdk ${SDK_VERSION} \u2014 @intenque/network-sdk CLI (spec \xA76.6)
+
+  network-sdk init --site-key <key> [--url <cdn-base>] [--root-keys <json>] [--channel production|preview] [--root <dir>] [--force]
+  network-sdk sync-fallback [--url <cdn-base>] [--root-keys <json>] [--channel \u2026] [--allow-empty] [--root <dir>]
+  network-sdk doctor [--frontend] [--url <cdn-base>] [--root-keys <json>] [--api-url <origin>] [--preflight-path <path>] [--no-impression] [--root <dir>]
+  network-sdk doctor --backend [--mongo-uri <uri>] [--root <dir>]
+  network-sdk print-config [--root <dir>]
+
+  --url        development / staging CDN base (sync-fallback otherwise reads the production CDN only, \xA74.6)
+  --root-keys  inline JSON [{ kid, jwk }] (the hub's MANIFEST_ROOT_PUBLIC_KEYS value); otherwise the compiled production roots
+  --mongo-uri  checks the outbox indexes with the site's own mongodb driver (never printed)
+`;
+async function main(argv) {
+  const { positional, flags } = parseArgs(argv);
+  const cmd = positional[0];
+  if (!cmd || cmd === "help" || flags["help"] === true) {
+    console.log(HELP);
+    return cmd ? 0 : 2;
+  }
+  if (flags["version"] === true || cmd === "--version") {
+    console.log(SDK_VERSION);
+    return 0;
+  }
+  try {
+    if (cmd === "init" || cmd === "sync-fallback" || cmd === "doctor") requireWebCrypto();
+    switch (cmd) {
+      case "init":
+        return await runInit(flags);
+      case "sync-fallback":
+        return await runSyncFallback(flags);
+      case "doctor":
+        return await runDoctor(flags);
+      case "print-config":
+        return runPrintConfig(flags);
+      default:
+        log.error(`unknown command "${cmd}"`);
+        console.log(HELP);
+        return 2;
+    }
+  } catch (err) {
+    if (err instanceof CliError) {
+      log.error(err.message);
+      return err.exitCode;
+    }
+    log.error(err instanceof Error ? err.message : String(err));
+    return 1;
+  }
+}
+
+// src/cli/index.ts
+globalThis.crypto ??= webcrypto;
+main(process.argv.slice(2)).then(
+  (code) => process.exit(code),
+  (err) => {
+    log.error(err instanceof Error ? err.message : String(err));
+    process.exit(1);
+  }
+);
+//# sourceMappingURL=index.js.map