@writerslogic/facet-cli 0.5.2

package/dist/index.js

@@ -0,0 +1,2153 @@
+#!/usr/bin/env node
+
+// src/commands/config.ts
+import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import { parseArgs } from "node:util";
+
+// src/util.ts
+import pc from "picocolors";
+function printError(msg) {
+  process.stderr.write(`${pc.red(msg)}
+`);
+}
+async function fetchJson(url, init) {
+  const res = await fetch(url, init);
+  if (!res.ok) {
+    let code = String(res.status);
+    try {
+      const body = await res.json();
+      if (body.error) code = body.error;
+    } catch {
+    }
+    throw new Error(code);
+  }
+  return res.json();
+}
+
+// src/commands/config.ts
+var PLACEHOLDER = "PLACEHOLDER_D1_DATABASE_ID";
+var DEFAULT_CONFIGS = ["./wrangler.jsonc", "apps/server/wrangler.jsonc"];
+var DB_ID_RE = /("database_id"\s*:\s*")([^"]*)(")/;
+function resolveConfigPath(flag) {
+  if (flag) return existsSync(flag) ? flag : null;
+  for (const candidate of DEFAULT_CONFIGS) {
+    if (existsSync(candidate)) return candidate;
+  }
+  return null;
+}
+function runConfig(args) {
+  const [sub, ...rest] = args;
+  if (sub === "set-db-id") return setDbId(rest);
+  if (sub === "check") return check(rest);
+  printError("Usage: facet config <set-db-id|check> [options]");
+  return 1;
+}
+function setDbId(args) {
+  const { values } = parseArgs({
+    args,
+    options: {
+      id: { type: "string" },
+      config: { type: "string" },
+      force: { type: "boolean" }
+    },
+    allowPositionals: false
+  });
+  if (!values.id) {
+    printError("Missing required option: --id <database_id>.");
+    return 1;
+  }
+  const path = resolveConfigPath(values.config);
+  if (!path) {
+    printError(
+      values.config ? `Config not found: ${values.config}` : `No wrangler.jsonc found (looked in ${DEFAULT_CONFIGS.join(", ")}). Pass --config <path>.`
+    );
+    return 1;
+  }
+  const source = readFileSync(path, "utf8");
+  const match = source.match(DB_ID_RE);
+  if (!match) {
+    printError(`No "database_id" field found in ${path}.`);
+    return 1;
+  }
+  const current = match[2];
+  if (current && current !== PLACEHOLDER && current !== values.id && !values.force) {
+    printError(
+      `Refusing to overwrite existing database_id "${current}" in ${path}. Pass --force to override.`
+    );
+    return 1;
+  }
+  const updated = source.replace(DB_ID_RE, `$1${values.id}$3`);
+  writeFileSync(path, updated);
+  process.stdout.write(`Set database_id in ${path}.
+`);
+  return 0;
+}
+function check(args) {
+  const { values } = parseArgs({
+    args,
+    options: { config: { type: "string" } },
+    allowPositionals: false
+  });
+  const path = resolveConfigPath(values.config);
+  if (!path) {
+    printError(
+      values.config ? `Config not found: ${values.config}` : `No wrangler.jsonc found (looked in ${DEFAULT_CONFIGS.join(", ")}). Pass --config <path>.`
+    );
+    return 1;
+  }
+  const source = readFileSync(path, "utf8");
+  const match = source.match(DB_ID_RE);
+  if (!match || !match[2]) {
+    printError(`database_id is missing or empty in ${path}.`);
+    return 1;
+  }
+  if (match[2] === PLACEHOLDER) {
+    printError(
+      `database_id in ${path} is still the placeholder. Run \`facet config set-db-id --id <id>\` first.`
+    );
+    return 1;
+  }
+  process.stdout.write(`database_id in ${path} is set.
+`);
+  return 0;
+}
+
+// src/commands/init.ts
+import { randomBytes } from "node:crypto";
+import { mkdirSync, writeFileSync as writeFileSync2 } from "node:fs";
+import { join } from "node:path";
+import { parseArgs as parseArgs2 } from "node:util";
+import * as p from "@clack/prompts";
+function wranglerJsonc(name, db) {
+  return `{
+	"$schema": "node_modules/wrangler/config-schema.json",
+	"name": "${name}",
+	"main": "src/index.ts",
+	"compatibility_date": "2026-07-01",
+	"compatibility_flags": ["nodejs_compat"],
+	"observability": { "enabled": true },
+	"triggers": { "crons": ["0 * * * *"] },
+	"assets": { "directory": "../dashboard/dist", "binding": "ASSETS" },
+	"d1_databases": [
+		{
+			"binding": "DB",
+			"database_name": "${db}",
+			"database_id": "PLACEHOLDER_D1_DATABASE_ID",
+			"migrations_dir": "migrations"
+		}
+	],
+	"unsafe": {
+		"bindings": [
+			{
+				"name": "RATE_LIMITER",
+				"type": "ratelimit",
+				"namespace_id": "1001",
+				"simple": { "limit": 100, "period": 60 }
+			}
+		]
+	},
+	"vars": { "RAW_RETENTION_DAYS": "90" }
+}
+`;
+}
+async function runInit(args) {
+  const { values } = parseArgs2({
+    args,
+    options: {
+      name: { type: "string" },
+      db: { type: "string" },
+      dir: { type: "string" },
+      "dry-run": { type: "boolean" }
+    },
+    allowPositionals: false
+  });
+  const dryRun = Boolean(values["dry-run"]);
+  const dir = values.dir ?? ".";
+  const db = values.db ?? "facet";
+  let name = values.name;
+  if (!name) {
+    if (dryRun) {
+      name = "facet";
+    } else {
+      const answer = await p.text({
+        message: "Worker name",
+        placeholder: "facet",
+        defaultValue: "facet"
+      });
+      if (p.isCancel(answer)) {
+        return 1;
+      }
+      name = String(answer);
+    }
+  }
+  mkdirSync(dir, { recursive: true });
+  const adminToken = randomBytes(32).toString("hex");
+  writeFileSync2(join(dir, "wrangler.jsonc"), wranglerJsonc(name, db));
+  writeFileSync2(join(dir, ".dev.vars"), `ADMIN_TOKEN=${adminToken}
+`);
+  process.stdout.write(
+    `Wrote wrangler.jsonc and .dev.vars to ${dir}.
+Next: run \`wrangler d1 create ${db}\` and put the id into wrangler.jsonc.
+`
+  );
+  return 0;
+}
+
+// src/commands/keyattest.ts
+import { X509Certificate, createPublicKey } from "node:crypto";
+import { readFile } from "node:fs/promises";
+import { parseArgs as parseArgs3 } from "node:util";
+import pc2 from "picocolors";
+var USAGE = `Usage: facet keyattest verify <leaf.pem> --root <root.pem> --key <file> [flags]
+
+Verify an X.509 hardware key-attestation chain (the form real HSMs / YubiKeys / TPMs emit) and confirm
+the leaf certifies the deployment signing key.
+
+  verify <leaf.pem>            The attestation leaf certificate (the hardware-resident key's cert).
+    --root <root.pem>          The CONFIGURED trust anchor (attestor/vendor root, self-signed CA). Required.
+    --key <file>               The deployment signing key to bind to: a PEM public key, or a cert/PEM
+                               whose SPKI is compared to the leaf's. Required.
+    --intermediate <pem>       An intermediate CA PEM (repeatable) between leaf and root.
+    --now <iso8601>            Verification time (default: now). Each cert must be valid at this instant.
+
+hardware:true requires BOTH: the chain reaches the configured root AND the leaf SPKI == the deployment key.
+`;
+function ok(msg) {
+  process.stdout.write(`${pc2.green("\u2713")} ${msg}
+`);
+}
+async function readCert(path) {
+  try {
+    return new X509Certificate(await readFile(path));
+  } catch (err) {
+    printError(
+      `could not read certificate ${path}: ${err instanceof Error ? err.message : String(err)}`
+    );
+    return null;
+  }
+}
+async function readSpki(path) {
+  let raw;
+  try {
+    raw = await readFile(path);
+  } catch (err) {
+    printError(
+      `could not read key ${path}: ${err instanceof Error ? err.message : String(err)}`
+    );
+    return null;
+  }
+  try {
+    return Buffer.from(
+      new X509Certificate(raw).publicKey.export({
+        type: "spki",
+        format: "der"
+      })
+    );
+  } catch {
+    try {
+      return Buffer.from(createPublicKey(raw).export({ type: "spki", format: "der" }));
+    } catch (err) {
+      printError(
+        `--key is neither a certificate nor a public key: ${err instanceof Error ? err.message : String(err)}`
+      );
+      return null;
+    }
+  }
+}
+function validAt(cert, at) {
+  return at >= cert.validFromDate && at <= cert.validToDate;
+}
+function verifyChain(chain, root, at) {
+  for (const cert of [...chain, root]) {
+    if (!validAt(cert, at))
+      return `certificate "${cert.subject}" is not valid at ${at.toISOString()}`;
+  }
+  const ordered = [...chain, root];
+  for (let i = 0; i < ordered.length - 1; i++) {
+    const cert = ordered[i];
+    const issuer = ordered[i + 1];
+    if (!cert.checkIssued(issuer))
+      return `"${cert.subject}" was not issued by "${issuer.subject}"`;
+    if (!cert.verify(issuer.publicKey))
+      return `signature on "${cert.subject}" does not verify against "${issuer.subject}"`;
+  }
+  if (!root.checkIssued(root) || !root.verify(root.publicKey)) {
+    return `configured root "${root.subject}" is not a self-signed trust anchor`;
+  }
+  return null;
+}
+async function runVerify(args) {
+  const { values, positionals } = parseArgs3({
+    args,
+    options: {
+      root: { type: "string" },
+      key: { type: "string" },
+      intermediate: { type: "string", multiple: true },
+      now: { type: "string" }
+    },
+    allowPositionals: true
+  });
+  const leafPath = positionals[0];
+  if (!leafPath) {
+    printError("missing <leaf.pem> argument");
+    return 1;
+  }
+  if (!values.root) {
+    printError("provide the configured trust anchor with --root <root.pem>");
+    return 1;
+  }
+  if (!values.key) {
+    printError("provide the deployment signing key with --key <file>");
+    return 1;
+  }
+  const at = values.now ? new Date(values.now) : /* @__PURE__ */ new Date();
+  if (Number.isNaN(at.getTime())) {
+    printError(`--now is not a valid ISO-8601 date: ${values.now}`);
+    return 1;
+  }
+  const leaf = await readCert(leafPath);
+  const root = await readCert(values.root);
+  if (!leaf || !root) return 1;
+  const intermediates = [];
+  for (const path of values.intermediate ?? []) {
+    const cert = await readCert(path);
+    if (!cert) return 1;
+    intermediates.push(cert);
+  }
+  const deploySpki = await readSpki(values.key);
+  if (!deploySpki) return 1;
+  const chainReason = verifyChain([leaf, ...intermediates], root, at);
+  if (chainReason !== null) {
+    printError(`\u2717 attestation chain does not verify: ${chainReason}`);
+    return 1;
+  }
+  const leafSpki = Buffer.from(leaf.publicKey.export({ type: "spki", format: "der" }));
+  if (!leafSpki.equals(deploySpki)) {
+    printError(
+      "\u2717 leaf certificate does not certify the deployment signing key (SPKI mismatch)"
+    );
+    return 1;
+  }
+  ok(
+    `hardware key-attestation verified (leaf="${leaf.subject}", anchored to root="${root.subject}")`
+  );
+  process.stdout.write(
+    `  ${pc2.dim("leaf SPKI == deployment signing key; chain reaches the configured trust anchor.")}
+`
+  );
+  return 0;
+}
+async function runKeyattest(args) {
+  const [op] = args;
+  if (op === void 0 || op === "--help" || op === "-h") {
+    process.stdout.write(USAGE);
+    return op === void 0 ? 1 : 0;
+  }
+  switch (op) {
+    case "verify":
+      return runVerify(args.slice(1));
+    default:
+      printError(`unknown keyattest op: ${op}`);
+      process.stderr.write(USAGE);
+      return 1;
+  }
+}
+
+// src/commands/keys.ts
+import { writeFile } from "node:fs/promises";
+import { parseArgs as parseArgs4 } from "node:util";
+
+// ../trust/src/bytes.ts
+var enc = new TextEncoder();
+function concatBytes(...parts) {
+  let total = 0;
+  for (const p2 of parts) total += p2.length;
+  const buf = new Uint8Array(total);
+  let off = 0;
+  for (const p2 of parts) {
+    buf.set(p2, off);
+    off += p2.length;
+  }
+  return buf;
+}
+async function sha256(...parts) {
+  return new Uint8Array(await crypto.subtle.digest("SHA-256", concatBytes(...parts)));
+}
+function toHex(bytes) {
+  let s = "";
+  for (const b of bytes) s += b.toString(16).padStart(2, "0");
+  return s;
+}
+function fromHex(hex) {
+  const out = new Uint8Array(hex.length / 2);
+  for (let k = 0; k < out.length; k++) out[k] = Number.parseInt(hex.slice(k * 2, k * 2 + 2), 16);
+  return out;
+}
+function bytesEqual(a, b) {
+  if (a.length !== b.length) return false;
+  for (let k = 0; k < a.length; k++) if (a[k] !== b[k]) return false;
+  return true;
+}
+function toBinaryString(bytes) {
+  let s = "";
+  for (const b of bytes) s += String.fromCharCode(b);
+  return s;
+}
+function bytesToBase64(bytes) {
+  return btoa(toBinaryString(bytes));
+}
+function base64ToBytes(b64) {
+  const bin = atob(b64);
+  const out = new Uint8Array(bin.length);
+  for (let i = 0; i < bin.length; i++) out[i] = bin.charCodeAt(i);
+  return out;
+}
+function bytesToBase64url(bytes) {
+  return bytesToBase64(bytes).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function base64urlToBytes(b64u) {
+  const b64 = b64u.replace(/-/g, "+").replace(/_/g, "/");
+  return base64ToBytes(b64.padEnd(Math.ceil(b64.length / 4) * 4, "="));
+}
+
+// ../trust/src/keys.ts
+import {
+  calculateJwkThumbprint,
+  exportJWK,
+  generateKeyPair,
+  importJWK
+} from "jose";
+function algForJwk(jwk) {
+  if (jwk.kty === "OKP" && jwk.crv === "Ed25519") return "EdDSA";
+  if (jwk.kty === "EC" && jwk.crv === "P-256") return "ES256";
+  throw new Error(`unsupported key type for signing: kty=${jwk.kty} crv=${jwk.crv}`);
+}
+async function toPublicJwk(privateJwk, alg) {
+  const { d: D, ...pub } = privateJwk;
+  const kid = await calculateJwkThumbprint(pub);
+  return { ...pub, alg, use: "sig", kid };
+}
+async function generateSigningJwk(alg = "EdDSA") {
+  const { publicKey, privateKey } = await generateKeyPair(alg, {
+    extractable: true
+  });
+  const privateJwk = await exportJWK(privateKey);
+  const publicJwk = await toPublicJwk(await exportJWK(publicKey), alg);
+  privateJwk.alg = alg;
+  privateJwk.kid = publicJwk.kid;
+  return { privateJwk, publicJwk };
+}
+async function importPublicJwk(jwk) {
+  const alg = jwk.alg === "ES256" || jwk.alg === "EdDSA" ? jwk.alg : algForJwk(jwk);
+  const key = await importJWK(jwk, alg);
+  if (key instanceof Uint8Array) throw new Error("public JWK imported as a symmetric key");
+  return { key, alg };
+}
+
+// ../trust/src/jws.ts
+import { CompactSign, base64url, compactVerify } from "jose";
+
+// ../trust/src/canonicalize.ts
+function canonicalizeJson(value) {
+  if (value === null) return "null";
+  if (typeof value === "number") {
+    if (!Number.isFinite(value)) throw new Error("cannot canonicalize a non-finite number");
+    return JSON.stringify(value);
+  }
+  if (typeof value === "boolean" || typeof value === "string") return JSON.stringify(value);
+  if (Array.isArray(value)) {
+    return `[${value.map((v) => canonicalizeJson(v)).join(",")}]`;
+  }
+  if (typeof value === "object") {
+    const obj = value;
+    const keys2 = Object.keys(obj).filter((k) => obj[k] !== void 0).sort();
+    const members = keys2.map((k) => `${JSON.stringify(k)}:${canonicalizeJson(obj[k])}`);
+    return `{${members.join(",")}}`;
+  }
+  throw new Error(`cannot canonicalize value of type ${typeof value}`);
+}
+function canonicalizeBytes(value) {
+  return new TextEncoder().encode(canonicalizeJson(value));
+}
+
+// ../trust/src/jws.ts
+async function verifyDetachedJws(detached, payload, publicJwk) {
+  const parts = detached.split(".");
+  if (parts.length !== 3 || parts[1] !== "") {
+    throw new Error("malformed detached JWS (expected `<protected>..<signature>`)");
+  }
+  const reattached = `${parts[0]}.${base64url.encode(payload)}.${parts[2]}`;
+  const { key, alg } = await importPublicJwk(publicJwk);
+  const { protectedHeader } = await compactVerify(reattached, key, {
+    algorithms: [alg]
+  });
+  return { protectedHeader };
+}
+async function verifyDetachedProof(proof, payload) {
+  if (proof?.type !== "DetachedJWS") return { ok: false, reason: "unsupported proof type" };
+  try {
+    const { protectedHeader } = await verifyDetachedJws(
+      proof.jws,
+      canonicalizeBytes(payload),
+      proof.publicJwk
+    );
+    if (protectedHeader.kid !== proof.kid) {
+      return {
+        ok: false,
+        reason: "protected-header kid does not match proof kid"
+      };
+    }
+    return { ok: true };
+  } catch (e) {
+    return {
+      ok: false,
+      reason: e instanceof Error ? e.message : "verification failed"
+    };
+  }
+}
+
+// ../trust/src/cose.ts
+import { decode as cborDecode, encode as cborEncode } from "cborg";
+var ALG_FOR_COSE = {
+  [-8]: "EdDSA",
+  [-7]: "ES256"
+};
+var HDR_ALG = 1;
+var HDR_KID = 4;
+var COSE_SIGN1_TAG = 18;
+var enc2 = new TextEncoder();
+function algParams(alg) {
+  return alg === "EdDSA" ? { name: "Ed25519" } : { name: "ECDSA", hash: "SHA-256" };
+}
+function sigStructure(protectedBytes, payload) {
+  return cborEncode(["Signature1", protectedBytes, new Uint8Array(0), payload]);
+}
+var DECODE_OPTS = (() => {
+  const tags = [];
+  tags[COSE_SIGN1_TAG] = (inner) => inner;
+  return { useMaps: true, tags };
+})();
+function decodeCoseSign1(message) {
+  const arr = cborDecode(message, DECODE_OPTS);
+  if (!Array.isArray(arr) || arr.length !== 4) {
+    throw new Error("malformed COSE_Sign1 (expected a 4-element array)");
+  }
+  const [protectedBytes, unprotected, payload, signature] = arr;
+  if (!(protectedBytes instanceof Uint8Array) || !(payload instanceof Uint8Array) || !(signature instanceof Uint8Array)) {
+    throw new Error("malformed COSE_Sign1 (protected/payload/signature must be bstr)");
+  }
+  return [protectedBytes, unprotected, payload, signature];
+}
+function parseProtected(protectedBytes) {
+  const map = cborDecode(protectedBytes, DECODE_OPTS);
+  if (!(map instanceof Map)) throw new Error("COSE protected header is not a map");
+  const alg = ALG_FOR_COSE[map.get(HDR_ALG)];
+  if (!alg) throw new Error(`unsupported COSE alg ${String(map.get(HDR_ALG))}`);
+  const kidRaw = map.get(HDR_KID);
+  const kid = kidRaw instanceof Uint8Array ? new TextDecoder().decode(kidRaw) : void 0;
+  return { alg, kid };
+}
+async function verifyCoseSign1(message, publicJwk) {
+  const [protectedBytes, , payload, signature] = decodeCoseSign1(message);
+  const header = parseProtected(protectedBytes);
+  const { key, alg } = await importPublicJwk(publicJwk);
+  if (alg !== header.alg) throw new Error("COSE alg does not match the verification key");
+  const toVerify = sigStructure(protectedBytes, payload);
+  const ok4 = await crypto.subtle.verify(algParams(alg), key, signature, toVerify);
+  if (!ok4) throw new Error("COSE_Sign1 signature did not verify");
+  return { protectedHeader: header, payload };
+}
+function coseFromBase64url(b64u) {
+  return base64urlToBytes(b64u);
+}
+
+// ../trust/src/signed-export.ts
+var SIGNED_EXPORT_TYPE = "facet-signed-export/1";
+async function verifySignedExport(env) {
+  const { proof, payload } = env;
+  const kid = proof?.kid ?? "";
+  const alg = proof?.alg ?? "EdDSA";
+  const jwksUrl = proof?.jwksUrl;
+  const fail = (reason) => ({
+    valid: false,
+    kid,
+    alg,
+    jwksUrl,
+    reason
+  });
+  if (env.facet !== SIGNED_EXPORT_TYPE) return fail("unrecognized envelope type");
+  const check2 = await verifyDetachedProof(proof, payload);
+  return check2.ok ? { valid: true, kid, alg, jwksUrl } : fail(check2.reason ?? "verification failed");
+}
+
+// ../trust/src/base58.ts
+var ALPHABET = "123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz";
+var BASE = 58n;
+var INDEX = {};
+for (let i = 0; i < ALPHABET.length; i++) INDEX[ALPHABET[i]] = i;
+function base58decode(str) {
+  let leading = 0;
+  while (leading < str.length && str[leading] === "1") leading++;
+  let num = 0n;
+  for (const ch of str) {
+    const v = INDEX[ch];
+    if (v === void 0) throw new Error(`invalid base58 character: ${ch}`);
+    num = num * BASE + BigInt(v);
+  }
+  const bytes = [];
+  while (num > 0n) {
+    bytes.unshift(Number(num % 256n));
+    num = num / 256n;
+  }
+  return new Uint8Array([...new Array(leading).fill(0), ...bytes]);
+}
+
+// ../trust/src/multikey.ts
+var ED25519_PREFIX = new Uint8Array([237, 1]);
+function ed25519RawFromJwk(jwk) {
+  if (jwk.kty !== "OKP" || jwk.crv !== "Ed25519" || !jwk.x) {
+    throw new Error("not an Ed25519 (OKP) public JWK");
+  }
+  const raw = base64urlToBytes(jwk.x);
+  if (raw.length !== 32) throw new Error("Ed25519 public key must be 32 bytes");
+  return raw;
+}
+function publicKeyMultibaseToRaw(multibase) {
+  if (!multibase.startsWith("z")) throw new Error("expected base58btc multibase (z-prefix)");
+  const decoded = base58decode(multibase.slice(1));
+  if (decoded[0] !== ED25519_PREFIX[0] || decoded[1] !== ED25519_PREFIX[1]) {
+    throw new Error("not an Ed25519 multikey (missing 0xed01 prefix)");
+  }
+  const raw = decoded.slice(2);
+  if (raw.length !== 32) throw new Error("Ed25519 public key must be 32 bytes");
+  return raw;
+}
+function rawToEd25519Jwk(raw) {
+  return { kty: "OKP", crv: "Ed25519", x: bytesToBase64url(raw) };
+}
+function publicKeyMultibaseToJwk(multibase) {
+  return rawToEd25519Jwk(publicKeyMultibaseToRaw(multibase));
+}
+
+// ../trust/src/vc.ts
+var CRYPTOSUITE = "eddsa-jcs-2022";
+async function hashData(unsecured, proofConfig) {
+  const proofConfigHash = await sha256(canonicalizeBytes(proofConfig));
+  const documentHash = await sha256(canonicalizeBytes(unsecured));
+  const out = new Uint8Array(64);
+  out.set(proofConfigHash, 0);
+  out.set(documentHash, 32);
+  return out;
+}
+async function importEd25519Verify(jwk) {
+  return crypto.subtle.importKey("jwk", jwk, { name: "Ed25519" }, false, ["verify"]);
+}
+async function verifyCredential(credential, opts) {
+  const proof = credential.proof;
+  const issuer = typeof credential.issuer === "string" ? credential.issuer : credential.issuer?.id;
+  const fail = (reason) => ({
+    valid: false,
+    issuer,
+    verificationMethod: proof?.verificationMethod,
+    reason
+  });
+  if (!proof) return fail("missing proof");
+  if (proof.type !== "DataIntegrityProof" || proof.cryptosuite !== CRYPTOSUITE) {
+    return fail(`unsupported proof (${proof.type}/${proof.cryptosuite})`);
+  }
+  if (!proof.proofValue?.startsWith("z")) return fail("proofValue is not base58btc multibase");
+  let jwk;
+  try {
+    if (opts.publicKeyMultibase) jwk = publicKeyMultibaseToJwk(opts.publicKeyMultibase);
+    else if (opts.publicJwk) jwk = rawToEd25519Jwk(ed25519RawFromJwk(opts.publicJwk));
+    else return fail("no verification key supplied");
+  } catch (e) {
+    return fail(e instanceof Error ? e.message : "invalid verification key");
+  }
+  const { proof: P, ...unsecured } = credential;
+  const config = {
+    "@context": credential["@context"],
+    type: proof.type,
+    cryptosuite: proof.cryptosuite,
+    created: proof.created,
+    verificationMethod: proof.verificationMethod,
+    proofPurpose: proof.proofPurpose
+  };
+  try {
+    const data = await hashData(unsecured, config);
+    const signature = base58decode(proof.proofValue.slice(1));
+    const key = await importEd25519Verify(jwk);
+    const ok4 = await crypto.subtle.verify({ name: "Ed25519" }, key, signature, data);
+    return ok4 ? {
+      valid: true,
+      issuer,
+      verificationMethod: proof.verificationMethod
+    } : fail("signature did not verify");
+  } catch (e) {
+    return fail(e instanceof Error ? e.message : "verification error");
+  }
+}
+
+// ../trust/src/did-web.ts
+function publicKeyMultibaseFor(doc, vmId) {
+  const vm = doc.verificationMethod.find((m) => m.id === vmId);
+  return vm?.publicKeyMultibase ?? null;
+}
+async function verifyDidConfiguration(config, didDoc, expectedOrigin) {
+  const did = didDoc.id;
+  const credential = config.linked_dids?.find((c) => {
+    const subject2 = c.credentialSubject;
+    return subject2?.id === did;
+  });
+  if (!credential)
+    return {
+      valid: false,
+      did,
+      reason: "no linked credential for this DID"
+    };
+  const subject = credential.credentialSubject;
+  if (subject.origin !== expectedOrigin) {
+    return {
+      valid: false,
+      did,
+      origin: subject.origin,
+      reason: "origin mismatch"
+    };
+  }
+  const vmId = credential.proof?.verificationMethod ?? "";
+  const publicKeyMultibase = publicKeyMultibaseFor(didDoc, vmId);
+  if (!publicKeyMultibase) {
+    return {
+      valid: false,
+      did,
+      reason: "verification method not found in DID document"
+    };
+  }
+  const result = await verifyCredential(credential, { publicKeyMultibase });
+  if (!result.valid)
+    return {
+      valid: false,
+      did,
+      origin: subject.origin,
+      reason: result.reason
+    };
+  return { valid: true, did, origin: subject.origin };
+}
+
+// ../trust/src/mmr.ts
+function u64be(n) {
+  const out = new Uint8Array(8);
+  new DataView(out.buffer).setBigUint64(0, BigInt(n), false);
+  return out;
+}
+function hashPosPair(pos, left, right) {
+  return sha256(u64be(pos), left, right);
+}
+function allOnes(n) {
+  return (n & n + 1) === 0 && n !== 0;
+}
+function mostSigBit(n) {
+  return 1 << 31 - Math.clz32(n);
+}
+function indexHeight(i) {
+  let pos = i + 1;
+  while (!allOnes(pos)) {
+    pos = pos - mostSigBit(pos) + 1;
+  }
+  return 31 - Math.clz32(pos);
+}
+async function includedRoot(i, nodeHash, proof) {
+  let root = nodeHash;
+  let g = indexHeight(i);
+  let idx = i;
+  for (const sibling of proof) {
+    if (indexHeight(idx + 1) > g) {
+      idx += 1;
+      root = await hashPosPair(idx + 1, sibling, root);
+    } else {
+      idx += 2 << g;
+      root = await hashPosPair(idx + 1, root, sibling);
+    }
+    g += 1;
+  }
+  return root;
+}
+async function baggedRoot(count, peaks) {
+  return sha256(u64be(count), ...peaks);
+}
+async function verifyInclusion(proof, root) {
+  const peak = await includedRoot(proof.index, proof.leaf, proof.path);
+  if (!proof.peaks.some((p2) => bytesEqual(p2, peak))) return false;
+  return bytesEqual(await baggedRoot(proof.size, proof.peaks), root);
+}
+
+// ../trust/src/statement.ts
+async function verifyCoseProof(proof, payload) {
+  try {
+    const { protectedHeader, payload: signed } = await verifyCoseSign1(
+      coseFromBase64url(proof.cose),
+      proof.publicJwk
+    );
+    if (protectedHeader.kid !== proof.kid) {
+      return {
+        ok: false,
+        reason: "COSE protected-header kid does not match proof kid"
+      };
+    }
+    const expected = canonicalizeBytes(payload);
+    if (signed.length !== expected.length || !signed.every((b, i) => b === expected[i])) {
+      return {
+        ok: false,
+        reason: "COSE payload does not match the statement payload"
+      };
+    }
+    return { ok: true };
+  } catch (e) {
+    return {
+      ok: false,
+      reason: e instanceof Error ? e.message : "COSE verification failed"
+    };
+  }
+}
+async function verifyStatement(stmt, expectedType) {
+  const { proof, payload, statement } = stmt;
+  const base = { statement, kid: proof?.kid };
+  if (expectedType && statement !== expectedType) {
+    return {
+      valid: false,
+      ...base,
+      reason: `expected statement type ${expectedType}`
+    };
+  }
+  const check2 = proof?.type === "COSE_Sign1" ? await verifyCoseProof(proof, payload) : await verifyDetachedProof(proof, payload);
+  return check2.ok ? { valid: true, ...base } : { valid: false, ...base, reason: check2.reason };
+}
+
+// ../trust/src/receipt.ts
+function receiptToInclusion(r) {
+  return {
+    index: r.index,
+    leaf: fromHex(r.leaf),
+    path: r.path.map(fromHex),
+    size: r.size,
+    peaks: r.peaks.map(fromHex)
+  };
+}
+function verifyInclusionReceipt(r, rootHex) {
+  return verifyInclusion(receiptToInclusion(r), fromHex(rootHex));
+}
+
+// ../trust/src/scitt.ts
+var SCITT_RECEIPT = "scitt-receipt/1";
+async function verifyScittReceipt(receipt) {
+  const sig = await verifyStatement(receipt, SCITT_RECEIPT);
+  const p2 = receipt.payload;
+  if (!sig.valid)
+    return {
+      valid: false,
+      logId: p2?.logId,
+      entryId: p2?.entryId,
+      reason: sig.reason
+    };
+  const included = await verifyInclusionReceipt(p2.inclusion, p2.root);
+  if (!included) {
+    return {
+      valid: false,
+      logId: p2.logId,
+      entryId: p2.entryId,
+      reason: "inclusion proof failed"
+    };
+  }
+  return { valid: true, logId: p2.logId, entryId: p2.entryId };
+}
+
+// ../trust/src/rats.ts
+import { calculateJwkThumbprint as calculateJwkThumbprint3 } from "jose";
+
+// ../trust/src/keyattest.ts
+import { calculateJwkThumbprint as calculateJwkThumbprint2 } from "jose";
+var KEY_ATTESTATION_TYPE = "facet-key-attestation/1";
+async function verifyKeyAttestation(attestation, opts) {
+  const sig = await verifyStatement(attestation, KEY_ATTESTATION_TYPE);
+  if (!sig.valid) {
+    return {
+      valid: false,
+      hardware: false,
+      reason: sig.reason ?? "attestation signature invalid"
+    };
+  }
+  const claims = attestation.payload;
+  const recomputed = await calculateJwkThumbprint2(claims.subjectPublicJwk);
+  if (recomputed !== claims.subjectThumbprint) {
+    return {
+      valid: true,
+      hardware: false,
+      subjectThumbprint: claims.subjectThumbprint,
+      reason: "subject thumbprint does not match the attested subject key"
+    };
+  }
+  if (opts.expectedThumbprint !== void 0 && opts.expectedThumbprint !== claims.subjectThumbprint) {
+    return {
+      valid: true,
+      hardware: false,
+      subjectThumbprint: claims.subjectThumbprint,
+      vendor: claims.vendor,
+      reason: "attested subject thumbprint does not match the expected key"
+    };
+  }
+  const signerThumbprint = await signerThumbprintOf(attestation);
+  const anchorThumbprints = await Promise.all(
+    opts.trustAnchors.map((a) => calculateJwkThumbprint2(a))
+  );
+  const anchored = signerThumbprint !== void 0 && anchorThumbprints.includes(signerThumbprint);
+  if (!anchored) {
+    return {
+      valid: true,
+      hardware: false,
+      subjectThumbprint: claims.subjectThumbprint,
+      vendor: claims.vendor,
+      reason: "attestor is not a configured trust anchor"
+    };
+  }
+  return {
+    valid: true,
+    hardware: true,
+    deviceClass: claims.deviceClass,
+    ...claims.fipsLevel !== void 0 ? { fipsLevel: claims.fipsLevel } : {},
+    subjectThumbprint: claims.subjectThumbprint,
+    vendor: claims.vendor
+  };
+}
+async function signerThumbprintOf(attestation) {
+  const jwk = attestation.proof?.publicJwk;
+  if (!jwk) return void 0;
+  return calculateJwkThumbprint2(jwk);
+}
+
+// ../trust/src/rats.ts
+var PROCESS_EVIDENCE_TYPE = "rats-process-evidence/1";
+async function verifyEmbeddedHardwareRoot(claims, trustAnchors) {
+  const ref = claims["key-attestation"];
+  if (!ref || !trustAnchors || trustAnchors.length === 0) return false;
+  const cnfJwk = claims.cnf?.jwk;
+  if (!cnfJwk) return false;
+  const expectedThumbprint = await calculateJwkThumbprint3(cnfJwk);
+  const result = await verifyKeyAttestation(ref.attestation, {
+    trustAnchors,
+    now: Date.now(),
+    expectedThumbprint
+  });
+  return result.hardware;
+}
+async function verifyProcessEvidence(stmt, opts = {}) {
+  const sig = await verifyStatement(stmt, PROCESS_EVIDENCE_TYPE);
+  if (!sig.valid)
+    return {
+      valid: false,
+      keyBound: false,
+      hardwareRootOfTrust: false,
+      reason: sig.reason
+    };
+  const claims = stmt.payload;
+  const expectedDigest = toHex(await sha256(canonicalizeBytes(claims["process-evidence"])));
+  if (claims["content-ref"]?.digest !== expectedDigest) {
+    return {
+      valid: false,
+      keyBound: false,
+      hardwareRootOfTrust: false,
+      reason: "content-ref digest does not match evidence"
+    };
+  }
+  const cnfKid = claims.cnf?.jwk?.kid;
+  const keyBound = cnfKid !== void 0 && cnfKid === stmt.proof.kid;
+  if (!keyBound) {
+    return {
+      valid: false,
+      keyBound: false,
+      hardwareRootOfTrust: false,
+      reason: "cnf subject key is not bound to the signing key"
+    };
+  }
+  if (opts.nonce !== void 0 && claims.eat_nonce !== opts.nonce) {
+    return {
+      valid: false,
+      keyBound,
+      hardwareRootOfTrust: false,
+      reason: "eat_nonce does not match the expected nonce"
+    };
+  }
+  const hardwareRootOfTrust = await verifyEmbeddedHardwareRoot(claims, opts.trustAnchors);
+  return {
+    valid: true,
+    keyBound,
+    hardwareRootOfTrust,
+    evidence: claims["process-evidence"]
+  };
+}
+
+// src/commands/keys.ts
+import pc3 from "picocolors";
+var USAGE2 = `Usage: facet keys generate [flags]
+
+Generate a deployment signing keypair for signed attestations, credentials, and exports.
+
+  generate
+    --alg <EdDSA|ES256>   Signature algorithm (default: EdDSA \u2014 required for eddsa-jcs-2022 VCs).
+    --out <file>          Write the PRIVATE JWK to this file (default: print to stdout).
+
+Store the PRIVATE JWK as the FACET_SIGNING_JWK Worker secret:
+  facet keys generate --out signing.jwk && wrangler secret put FACET_SIGNING_JWK < signing.jwk
+`;
+async function runGenerate(args) {
+  const { values } = parseArgs4({
+    args,
+    options: {
+      alg: { type: "string" },
+      out: { type: "string" }
+    },
+    allowPositionals: false
+  });
+  const alg = values.alg ?? "EdDSA";
+  if (alg !== "EdDSA" && alg !== "ES256") {
+    printError(`--alg must be EdDSA or ES256 (got: ${values.alg})`);
+    return 1;
+  }
+  const { privateJwk, publicJwk } = await generateSigningJwk(alg);
+  const privateJson = JSON.stringify(privateJwk);
+  if (values.out) {
+    await writeFile(values.out, `${privateJson}
+`, { mode: 384 });
+    process.stdout.write(`${pc3.green("\u2713")} wrote private signing JWK \u2192 ${values.out}
+`);
+    process.stdout.write(
+      `  ${pc3.dim(`kid ${publicJwk.kid} (${alg}). Store it as a secret: wrangler secret put FACET_SIGNING_JWK < ${values.out}`)}
+`
+    );
+    process.stdout.write(
+      `  ${pc3.yellow("Keep this file secret; delete it after uploading.")}
+`
+    );
+  } else {
+    process.stdout.write(`${privateJson}
+`);
+    process.stderr.write(
+      `${pc3.dim(`kid ${publicJwk.kid} (${alg}) \u2014 pipe stdout into: wrangler secret put FACET_SIGNING_JWK`)}
+`
+    );
+  }
+  return 0;
+}
+async function runKeys(args) {
+  const [op] = args;
+  if (op === void 0 || op === "--help" || op === "-h") {
+    process.stdout.write(USAGE2);
+    return op === void 0 ? 1 : 0;
+  }
+  switch (op) {
+    case "generate":
+      return runGenerate(args.slice(1));
+    default:
+      printError(`unknown keys op: ${op}`);
+      process.stderr.write(USAGE2);
+      return 1;
+  }
+}
+
+// src/commands/migrate.ts
+import { spawn } from "node:child_process";
+import { parseArgs as parseArgs5 } from "node:util";
+function runMigrate(args, spawnImpl = spawn) {
+  const { values } = parseArgs5({
+    args,
+    options: {
+      db: { type: "string" },
+      remote: { type: "boolean" }
+    },
+    allowPositionals: false
+  });
+  const db = values.db ?? "facet";
+  const argv = ["d1", "migrations", "apply", db, values.remote ? "--remote" : "--local"];
+  return new Promise((resolve) => {
+    const child = spawnImpl("wrangler", argv, { stdio: "inherit" });
+    child.on("close", (code) => resolve(code ?? 0));
+  });
+}
+
+// src/commands/resources.ts
+import { parseArgs as parseArgs6 } from "node:util";
+import pc4 from "picocolors";
+
+// src/admin.ts
+var UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+function isUuid(value) {
+  return UUID_RE.test(value);
+}
+var UsageError = class extends Error {
+};
+function resolveHost(flag) {
+  const host = flag ?? process.env.FACET_HOST;
+  if (!host) {
+    throw new UsageError("Missing deployment host: pass --host <url> or set FACET_HOST.");
+  }
+  return host.replace(/\/$/, "");
+}
+function resolveAdminToken(flag) {
+  const token = flag ?? process.env.FACET_ADMIN_TOKEN;
+  if (!token) {
+    throw new UsageError(
+      "Missing admin token: pass --admin-token <t> or set FACET_ADMIN_TOKEN."
+    );
+  }
+  return token;
+}
+function adminClient(host, token, fetchImpl = fetchJson) {
+  const authHeader = { Authorization: `Bearer ${token}` };
+  return {
+    get(path) {
+      return fetchImpl(`${host}${path}`, {
+        headers: { ...authHeader }
+      });
+    },
+    post(path, body) {
+      return fetchImpl(`${host}${path}`, {
+        method: "POST",
+        headers: { ...authHeader, "content-type": "application/json" },
+        body: JSON.stringify(body)
+      });
+    },
+    delete(path) {
+      return fetchImpl(`${host}${path}`, {
+        method: "DELETE",
+        headers: { ...authHeader }
+      });
+    }
+  };
+}
+function requireUuid(flag, value) {
+  if (!value) {
+    throw new UsageError(`Missing required option: --${flag} <uuid>.`);
+  }
+  if (!isUuid(value)) {
+    throw new UsageError(`Invalid --${flag}: "${value}" is not a valid UUID.`);
+  }
+  return value;
+}
+function requireString(flag, value) {
+  if (value === void 0 || value === "") {
+    throw new UsageError(`Missing required option: --${flag}.`);
+  }
+  return value;
+}
+function renderTable(headers, rows) {
+  const widths = headers.map(
+    (h, i) => Math.max(h.length, ...rows.map((r) => (r[i] ?? "").length))
+  );
+  const line = (cells) => cells.map((cell, i) => cell.padEnd(widths[i] ?? 0)).join("  ").trimEnd();
+  const out = [line(headers)];
+  for (const row of rows) out.push(line(row));
+  return `${out.join("\n")}
+`;
+}
+
+// src/commands/resources.ts
+var COMMON = {
+  host: { type: "string" },
+  "admin-token": { type: "string" },
+  json: { type: "boolean" }
+};
+function client(values, fetchImpl) {
+  const host = resolveHost(values.host);
+  const token = resolveAdminToken(values["admin-token"]);
+  return adminClient(host, token, fetchImpl);
+}
+function emitJson(value) {
+  process.stdout.write(`${JSON.stringify(value, null, 2)}
+`);
+  return 0;
+}
+function fmtTime(ms) {
+  return new Date(ms).toISOString();
+}
+async function sites(argv, fetchImpl) {
+  const [sub, ...rest] = argv;
+  if (sub === "list") {
+    const { values } = parseArgs6({
+      args: rest,
+      options: { ...COMMON },
+      allowPositionals: false
+    });
+    const api = client(values, fetchImpl);
+    const { sites: sites2 } = await api.get("/api/sites");
+    if (values.json) return emitJson(sites2);
+    process.stdout.write(
+      renderTable(
+        ["ID", "NAME", "DOMAIN", "CREATED"],
+        sites2.map((s) => [s.id, s.name, s.domain, fmtTime(s.created_at)])
+      )
+    );
+    return 0;
+  }
+  if (sub === "create") {
+    const { values } = parseArgs6({
+      args: rest,
+      options: {
+        ...COMMON,
+        name: { type: "string" },
+        domain: { type: "string" }
+      },
+      allowPositionals: false
+    });
+    const name = requireString("name", values.name);
+    const domain = requireString("domain", values.domain);
+    const api = client(values, fetchImpl);
+    const { site } = await api.post("/api/sites", {
+      name,
+      domain
+    });
+    if (values.json) return emitJson(site);
+    process.stdout.write(`Created site ${site.id} (${site.name} / ${site.domain}).
+`);
+    return 0;
+  }
+  throw new UsageError("Usage: facet sites <list|create> [options]");
+}
+async function keys(argv, fetchImpl) {
+  const [sub, ...rest] = argv;
+  if (sub === "list") {
+    const { values } = parseArgs6({
+      args: rest,
+      options: { ...COMMON, site: { type: "string" } },
+      allowPositionals: false
+    });
+    const site = requireUuid("site", values.site);
+    const api = client(values, fetchImpl);
+    const { keys: keys2 } = await api.get(`/api/keys?site_id=${site}`);
+    if (values.json) return emitJson(keys2);
+    process.stdout.write(
+      renderTable(
+        ["ID", "LABEL", "CREATED", "LAST USED"],
+        keys2.map((k) => [
+          k.id,
+          k.label ?? "",
+          fmtTime(k.created_at),
+          k.last_used ? fmtTime(k.last_used) : "never"
+        ])
+      )
+    );
+    return 0;
+  }
+  if (sub === "issue") {
+    const { values } = parseArgs6({
+      args: rest,
+      options: {
+        ...COMMON,
+        site: { type: "string" },
+        label: { type: "string" }
+      },
+      allowPositionals: false
+    });
+    const site = requireUuid("site", values.site);
+    const api = client(values, fetchImpl);
+    const body = { site_id: site };
+    if (values.label) body.label = values.label;
+    const issued = await api.post("/api/keys", body);
+    if (values.json) return emitJson(issued);
+    process.stdout.write(`Issued key ${issued.id}.
+`);
+    process.stdout.write(
+      `${pc4.yellow("This key is shown once and cannot be retrieved again:")}
+`
+    );
+    process.stdout.write(`  ${issued.key}
+`);
+    return 0;
+  }
+  if (sub === "revoke") {
+    const { values } = parseArgs6({
+      args: rest,
+      options: {
+        ...COMMON,
+        id: { type: "string" },
+        site: { type: "string" }
+      },
+      allowPositionals: false
+    });
+    const id = requireUuid("id", values.id);
+    const site = requireUuid("site", values.site);
+    const api = client(values, fetchImpl);
+    await api.delete(`/api/keys/${id}?site_id=${site}`);
+    if (values.json) return emitJson({ deleted: true, id });
+    process.stdout.write(`Revoked key ${id}.
+`);
+    return 0;
+  }
+  throw new UsageError("Usage: facet keys <list|issue|revoke> [options]");
+}
+async function goals(argv, fetchImpl) {
+  const [sub, ...rest] = argv;
+  if (sub === "list") {
+    const { values } = parseArgs6({
+      args: rest,
+      options: { ...COMMON, site: { type: "string" } },
+      allowPositionals: false
+    });
+    const site = requireUuid("site", values.site);
+    const api = client(values, fetchImpl);
+    const { goals: goals2 } = await api.get(`/api/goals?site_id=${site}`);
+    if (values.json) return emitJson(goals2);
+    process.stdout.write(
+      renderTable(
+        ["ID", "NAME", "TYPE", "MATCH"],
+        goals2.map((g) => [g.id, g.name, g.type, g.match_value])
+      )
+    );
+    return 0;
+  }
+  if (sub === "create") {
+    const { values } = parseArgs6({
+      args: rest,
+      options: {
+        ...COMMON,
+        site: { type: "string" },
+        name: { type: "string" },
+        type: { type: "string" },
+        match: { type: "string" }
+      },
+      allowPositionals: false
+    });
+    const site = requireUuid("site", values.site);
+    const name = requireString("name", values.name);
+    const type = requireString("type", values.type);
+    if (type !== "event" && type !== "path") {
+      throw new UsageError('Invalid --type: expected "event" or "path".');
+    }
+    const match = requireString("match", values.match);
+    const api = client(values, fetchImpl);
+    const { goal } = await api.post("/api/goals", {
+      site_id: site,
+      name,
+      type,
+      match_value: match
+    });
+    if (values.json) return emitJson(goal);
+    process.stdout.write(`Created goal ${goal.id} (${goal.name}).
+`);
+    return 0;
+  }
+  if (sub === "delete") {
+    const { values } = parseArgs6({
+      args: rest,
+      options: {
+        ...COMMON,
+        id: { type: "string" },
+        site: { type: "string" }
+      },
+      allowPositionals: false
+    });
+    const id = requireUuid("id", values.id);
+    const site = requireUuid("site", values.site);
+    const api = client(values, fetchImpl);
+    await api.delete(`/api/goals/${id}?site_id=${site}`);
+    if (values.json) return emitJson({ deleted: true, id });
+    process.stdout.write(`Deleted goal ${id}.
+`);
+    return 0;
+  }
+  throw new UsageError("Usage: facet goals <list|create|delete> [options]");
+}
+function parseJsonFlag(flag, raw) {
+  try {
+    return JSON.parse(raw);
+  } catch {
+    throw new UsageError(`Invalid --${flag}: not valid JSON.`);
+  }
+}
+async function funnels(argv, fetchImpl) {
+  const [sub, ...rest] = argv;
+  if (sub === "list") {
+    const { values } = parseArgs6({
+      args: rest,
+      options: { ...COMMON, site: { type: "string" } },
+      allowPositionals: false
+    });
+    const site = requireUuid("site", values.site);
+    const api = client(values, fetchImpl);
+    const { funnels: funnels2 } = await api.get(`/api/funnels?site_id=${site}`);
+    if (values.json) return emitJson(funnels2);
+    process.stdout.write(
+      renderTable(
+        ["ID", "NAME", "STEPS"],
+        funnels2.map((f) => [f.id, f.name, String(f.steps.length)])
+      )
+    );
+    return 0;
+  }
+  if (sub === "create") {
+    const { values } = parseArgs6({
+      args: rest,
+      options: {
+        ...COMMON,
+        site: { type: "string" },
+        name: { type: "string" },
+        steps: { type: "string" }
+      },
+      allowPositionals: false
+    });
+    const site = requireUuid("site", values.site);
+    const name = requireString("name", values.name);
+    const stepsRaw = requireString("steps", values.steps);
+    const steps = parseJsonFlag("steps", stepsRaw);
+    if (!Array.isArray(steps) || steps.length < 2) {
+      throw new UsageError("Invalid --steps: expected a JSON array of at least 2 steps.");
+    }
+    const api = client(values, fetchImpl);
+    const { funnel } = await api.post("/api/funnels", {
+      site_id: site,
+      name,
+      steps
+    });
+    if (values.json) return emitJson(funnel);
+    process.stdout.write(`Created funnel ${funnel.id} (${funnel.name}).
+`);
+    return 0;
+  }
+  if (sub === "delete") {
+    const { values } = parseArgs6({
+      args: rest,
+      options: {
+        ...COMMON,
+        id: { type: "string" },
+        site: { type: "string" }
+      },
+      allowPositionals: false
+    });
+    const id = requireUuid("id", values.id);
+    const site = requireUuid("site", values.site);
+    const api = client(values, fetchImpl);
+    await api.delete(`/api/funnels/${id}?site_id=${site}`);
+    if (values.json) return emitJson({ deleted: true, id });
+    process.stdout.write(`Deleted funnel ${id}.
+`);
+    return 0;
+  }
+  throw new UsageError("Usage: facet funnels <list|create|delete> [options]");
+}
+async function experiments(argv, fetchImpl) {
+  const [sub, ...rest] = argv;
+  if (sub === "list") {
+    const { values } = parseArgs6({
+      args: rest,
+      options: { ...COMMON, site: { type: "string" } },
+      allowPositionals: false
+    });
+    const site = requireUuid("site", values.site);
+    const api = client(values, fetchImpl);
+    const { experiments: experiments2 } = await api.get(
+      `/api/experiments?site_id=${site}`
+    );
+    if (values.json) return emitJson(experiments2);
+    process.stdout.write(
+      renderTable(
+        ["ID", "NAME", "FLAG", "VARIANTS", "ACTIVE"],
+        experiments2.map((e) => [
+          e.id,
+          e.name,
+          e.flag_key,
+          e.variants.map((v) => v.key).join(","),
+          e.active ? "yes" : "no"
+        ])
+      )
+    );
+    return 0;
+  }
+  if (sub === "create") {
+    const { values } = parseArgs6({
+      args: rest,
+      options: {
+        ...COMMON,
+        site: { type: "string" },
+        name: { type: "string" },
+        flag: { type: "string" },
+        variants: { type: "string" }
+      },
+      allowPositionals: false
+    });
+    const site = requireUuid("site", values.site);
+    const name = requireString("name", values.name);
+    const flag = requireString("flag", values.flag);
+    const variantsRaw = requireString("variants", values.variants);
+    const variants = parseJsonFlag("variants", variantsRaw);
+    if (!Array.isArray(variants) || variants.length < 2) {
+      throw new UsageError(
+        "Invalid --variants: expected a JSON array of at least 2 variants."
+      );
+    }
+    const api = client(values, fetchImpl);
+    const { experiment } = await api.post("/api/experiments", {
+      site_id: site,
+      name,
+      flag_key: flag,
+      variants
+    });
+    if (values.json) return emitJson(experiment);
+    process.stdout.write(`Created experiment ${experiment.id} (${experiment.name}).
+`);
+    return 0;
+  }
+  if (sub === "delete") {
+    const { values } = parseArgs6({
+      args: rest,
+      options: {
+        ...COMMON,
+        id: { type: "string" },
+        site: { type: "string" }
+      },
+      allowPositionals: false
+    });
+    const id = requireUuid("id", values.id);
+    const site = requireUuid("site", values.site);
+    const api = client(values, fetchImpl);
+    await api.delete(`/api/experiments/${id}?site_id=${site}`);
+    if (values.json) return emitJson({ deleted: true, id });
+    process.stdout.write(`Deleted experiment ${id}.
+`);
+    return 0;
+  }
+  throw new UsageError("Usage: facet experiments <list|create|delete> [options]");
+}
+var GROUPS = {
+  sites,
+  keys,
+  goals,
+  funnels,
+  experiments
+};
+function isResourceCommand(command) {
+  return command in GROUPS;
+}
+async function runResource(command, argv, fetchImpl = fetchJson) {
+  const handler = GROUPS[command];
+  if (!handler) {
+    printError(`Unknown resource command: ${command}`);
+    return 1;
+  }
+  try {
+    return await handler(argv, fetchImpl);
+  } catch (err) {
+    if (err instanceof UsageError) {
+      printError(err.message);
+      return 1;
+    }
+    printError(
+      `${command} request failed: ${err instanceof Error ? err.message : String(err)}`
+    );
+    return 1;
+  }
+}
+
+// src/commands/sd.ts
+import { readFile as readFile2, writeFile as writeFile2 } from "node:fs/promises";
+import { parseArgs as parseArgs7 } from "node:util";
+import pc5 from "picocolors";
+
+// src/lib/cryptosuites.ts
+import * as bbs2023 from "@digitalbazaar/bbs-2023-cryptosuite";
+import * as Bls12381Multikey from "@digitalbazaar/bls12-381-multikey";
+import * as credentialsContext from "@digitalbazaar/credentials-context";
+import { DataIntegrityProof } from "@digitalbazaar/data-integrity";
+import * as dataIntegrityContext from "@digitalbazaar/data-integrity-context";
+import * as EcdsaMultikey from "@digitalbazaar/ecdsa-multikey";
+import * as ecdsaSd2023 from "@digitalbazaar/ecdsa-sd-2023-cryptosuite";
+import * as multikeyContext from "@digitalbazaar/multikey-context";
+import { JsonLdDocumentLoader } from "jsonld-document-loader";
+import jsigs from "jsonld-signatures";
+var { purposes } = jsigs;
+var DID_V1_URL = "https://www.w3.org/ns/did/v1";
+var DID_V1_CONTEXT = {
+  "@context": {
+    "@version": 1.1,
+    id: "@id",
+    type: "@type",
+    assertionMethod: {
+      "@id": "https://w3id.org/security#assertionMethod",
+      "@type": "@id",
+      "@container": "@set"
+    },
+    verificationMethod: {
+      "@id": "https://w3id.org/security#verificationMethod",
+      "@type": "@id"
+    }
+  }
+};
+function baseLoader() {
+  const jdl = new JsonLdDocumentLoader();
+  for (const [url, ctx] of credentialsContext.contexts) jdl.addStatic(url, ctx);
+  jdl.addStatic(dataIntegrityContext.CONTEXT_URL, dataIntegrityContext.CONTEXT);
+  jdl.addStatic(multikeyContext.CONTEXT_URL, multikeyContext.CONTEXT);
+  jdl.addStatic(DID_V1_URL, DID_V1_CONTEXT);
+  return jdl.build();
+}
+function loaderWithController(base, controller, vmId, publicKeyDoc) {
+  const controllerDoc = {
+    "@context": [DID_V1_URL, multikeyContext.CONTEXT_URL],
+    id: controller,
+    assertionMethod: [publicKeyDoc]
+  };
+  return async (url) => {
+    if (url === controller)
+      return {
+        contextUrl: null,
+        documentUrl: url,
+        document: controllerDoc
+      };
+    if (url === vmId)
+      return {
+        contextUrl: null,
+        documentUrl: url,
+        document: publicKeyDoc
+      };
+    return base(url);
+  };
+}
+async function generateIssuerKey(suite, controller = "did:key:facet-issuer") {
+  const verificationMethod = `${controller}#${suite === "bbs-2023" ? "bbs" : "k1"}`;
+  const keyPair = suite === "bbs-2023" ? await Bls12381Multikey.generateBbsKeyPair({
+    algorithm: "BBS-BLS12-381-SHA-256",
+    id: verificationMethod,
+    controller
+  }) : await EcdsaMultikey.generate({
+    curve: "P-256",
+    id: verificationMethod,
+    controller
+  });
+  const publicKeyDoc = await keyPair.export({
+    publicKey: true,
+    includeContext: true
+  });
+  return { suite, controller, verificationMethod, keyPair, publicKeyDoc };
+}
+async function exportIssuerKey(key) {
+  const secret = await key.keyPair.export({
+    secretKey: true,
+    publicKey: true,
+    includeContext: true
+  });
+  return { suite: key.suite, controller: key.controller, secretKey: secret };
+}
+async function importIssuerKey(doc) {
+  const suite = doc.suite;
+  const secret = doc.secretKey;
+  const keyPair = suite === "bbs-2023" ? await Bls12381Multikey.from(secret) : await EcdsaMultikey.from(secret);
+  const publicKeyDoc = await keyPair.export({
+    publicKey: true,
+    includeContext: true
+  });
+  return {
+    suite,
+    controller: secret.controller,
+    verificationMethod: secret.id,
+    keyPair,
+    publicKeyDoc
+  };
+}
+function signSuiteFor(suite, key, mandatoryPointers) {
+  const factory = suite === "bbs-2023" ? bbs2023 : ecdsaSd2023;
+  return new DataIntegrityProof({
+    signer: key.keyPair.signer(),
+    cryptosuite: factory.createSignCryptosuite({ mandatoryPointers })
+  });
+}
+async function issueSelective(suite, credential, key, mandatoryPointers = ["/issuer"]) {
+  const documentLoader = loaderWithController(
+    baseLoader(),
+    key.controller,
+    key.verificationMethod,
+    key.publicKeyDoc
+  );
+  return jsigs.sign(credential, {
+    suite: signSuiteFor(suite, key, mandatoryPointers),
+    purpose: new purposes.AssertionProofPurpose(),
+    documentLoader
+  });
+}
+async function deriveSelective(suite, signedCredential, key, selectivePointers) {
+  const factory = suite === "bbs-2023" ? bbs2023 : ecdsaSd2023;
+  const documentLoader = loaderWithController(
+    baseLoader(),
+    key.controller,
+    key.verificationMethod,
+    key.publicKeyDoc
+  );
+  return jsigs.derive(signedCredential, {
+    suite: new DataIntegrityProof({
+      cryptosuite: factory.createDiscloseCryptosuite({
+        selectivePointers
+      })
+    }),
+    purpose: new purposes.AssertionProofPurpose(),
+    documentLoader
+  });
+}
+async function verifySelective(suite, presentation, key) {
+  const factory = suite === "bbs-2023" ? bbs2023 : ecdsaSd2023;
+  const documentLoader = loaderWithController(
+    baseLoader(),
+    key.controller,
+    key.verificationMethod,
+    key.publicKeyDoc
+  );
+  const result = await jsigs.verify(presentation, {
+    suite: new DataIntegrityProof({
+      cryptosuite: factory.createVerifyCryptosuite()
+    }),
+    purpose: new purposes.AssertionProofPurpose(),
+    documentLoader
+  });
+  if (result.verified) return { verified: true };
+  const err = result.error;
+  const reason = err?.errors?.map((e) => e.message).join("; ") ?? err?.message ?? "verification failed";
+  return { verified: false, reason };
+}
+
+// src/commands/sd.ts
+var USAGE3 = `Usage: facet sd <op> [flags]   (Node-only W3C selective disclosure)
+
+Suites: ecdsa-sd-2023 | bbs-2023
+
+Operations:
+  keygen  --suite <s> --out <keyfile>
+  issue   --suite <s> --credential <file> --key <keyfile> [--mandatory </a,/b>] --out <file>
+  derive  --suite <s> --credential <signed> --key <keyfile> --reveal </a,/b> --out <file>
+  verify  --suite <s> --presentation <file> --key <keyfile>
+`;
+function ok2(msg) {
+  process.stdout.write(`${pc5.green("\u2713")} ${msg}
+`);
+}
+async function readJson(path) {
+  try {
+    return JSON.parse(await readFile2(path, "utf8"));
+  } catch (err) {
+    printError(`could not read ${path}: ${err instanceof Error ? err.message : String(err)}`);
+    return null;
+  }
+}
+function requireSuite(flags) {
+  const s = flags.suite;
+  if (s === "ecdsa-sd-2023" || s === "bbs-2023") return s;
+  printError("provide --suite ecdsa-sd-2023 | bbs-2023");
+  return null;
+}
+function pointers(v) {
+  return v ? v.split(",").map((p2) => p2.trim()).filter(Boolean) : [];
+}
+async function runSd(args) {
+  const [op] = args;
+  if (op === void 0 || op === "--help" || op === "-h") {
+    process.stdout.write(USAGE3);
+    return op === void 0 ? 1 : 0;
+  }
+  const { values } = parseArgs7({
+    args: args.slice(1),
+    options: {
+      suite: { type: "string" },
+      credential: { type: "string" },
+      presentation: { type: "string" },
+      key: { type: "string" },
+      out: { type: "string" },
+      mandatory: { type: "string" },
+      reveal: { type: "string" }
+    },
+    allowPositionals: true
+  });
+  const flags = values;
+  switch (op) {
+    case "keygen": {
+      const suite = requireSuite(flags);
+      if (!suite || !flags.out) {
+        if (suite) printError("provide --out <keyfile>");
+        return 1;
+      }
+      const key = await generateIssuerKey(suite);
+      await writeFile2(flags.out, JSON.stringify(await exportIssuerKey(key), null, 2));
+      ok2(`generated ${suite} issuer key \u2192 ${flags.out} (controller ${key.controller})`);
+      return 0;
+    }
+    case "issue": {
+      const suite = requireSuite(flags);
+      if (!suite || !flags.credential || !flags.key || !flags.out) {
+        if (suite) printError("provide --credential <file> --key <keyfile> --out <file>");
+        return 1;
+      }
+      const cred = await readJson(flags.credential);
+      const keyDoc = await readJson(flags.key);
+      if (cred === null || keyDoc === null) return 1;
+      const key = await importIssuerKey(keyDoc);
+      const signed = await issueSelective(
+        suite,
+        cred,
+        key,
+        pointers(flags.mandatory).length ? pointers(flags.mandatory) : ["/issuer"]
+      );
+      await writeFile2(flags.out, JSON.stringify(signed, null, 2));
+      ok2(`issued ${suite} credential \u2192 ${flags.out}`);
+      return 0;
+    }
+    case "derive": {
+      const suite = requireSuite(flags);
+      if (!suite || !flags.credential || !flags.key || !flags.reveal || !flags.out) {
+        if (suite)
+          printError(
+            "provide --credential <signed> --key <keyfile> --reveal <ptrs> --out <file>"
+          );
+        return 1;
+      }
+      const signed = await readJson(flags.credential);
+      const keyDoc = await readJson(flags.key);
+      if (signed === null || keyDoc === null) return 1;
+      const key = await importIssuerKey(keyDoc);
+      const derived = await deriveSelective(
+        suite,
+        signed,
+        key,
+        pointers(flags.reveal)
+      );
+      await writeFile2(flags.out, JSON.stringify(derived, null, 2));
+      ok2(`derived ${suite} presentation \u2192 ${flags.out}`);
+      return 0;
+    }
+    case "verify": {
+      const suite = requireSuite(flags);
+      if (!suite || !flags.presentation || !flags.key) {
+        if (suite) printError("provide --presentation <file> --key <keyfile>");
+        return 1;
+      }
+      const pres = await readJson(flags.presentation);
+      const keyDoc = await readJson(flags.key);
+      if (pres === null || keyDoc === null) return 1;
+      const key = await importIssuerKey(keyDoc);
+      const result = await verifySelective(suite, pres, key);
+      if (result.verified) {
+        ok2(`valid ${suite} selective-disclosure proof`);
+        return 0;
+      }
+      printError(`\u2717 invalid ${suite} proof: ${result.reason ?? "verification failed"}`);
+      return 1;
+    }
+    default:
+      printError(`unknown sd op: ${op}`);
+      process.stderr.write(USAGE3);
+      return 1;
+  }
+}
+
+// src/commands/stats.ts
+import { parseArgs as parseArgs8 } from "node:util";
+import pc6 from "picocolors";
+var RANGE_DAYS = {
+  "24h": 1,
+  "7d": 7,
+  "30d": 30,
+  "90d": 90
+};
+var DAY_MS = 864e5;
+async function runStats(args, fetchImpl = fetchJson) {
+  const { values } = parseArgs8({
+    args,
+    options: {
+      host: { type: "string" },
+      key: { type: "string" },
+      site: { type: "string" },
+      range: { type: "string" }
+    },
+    allowPositionals: false
+  });
+  const host = values.host;
+  const key = values.key;
+  const site = values.site;
+  if (!host || !key || !site) {
+    printError("Missing required option: --host, --key, and --site are all required.");
+    return 1;
+  }
+  const range = values.range ?? "7d";
+  const days = RANGE_DAYS[range] ?? 7;
+  const end = Date.now();
+  const start = end - days * DAY_MS;
+  const url = `${host.replace(/\/$/, "")}/api/stats?site_id=${site}&start=${start}&end=${end}`;
+  try {
+    const data = await fetchImpl(url, {
+      headers: { Authorization: `Bearer ${key}` }
+    });
+    const { pageviews, visitors, events } = data.summary;
+    process.stdout.write(`${pc6.bold("Facet stats")} (${range})
+`);
+    process.stdout.write(`  Pageviews: ${pageviews}
+`);
+    process.stdout.write(`  Visitors:  ${visitors}
+`);
+    process.stdout.write(`  Events:    ${events}
+`);
+    if (data.top_paths.length > 0) {
+      process.stdout.write(`
+${pc6.bold("Top paths")}
+`);
+      for (const row of data.top_paths.slice(0, 5)) {
+        process.stdout.write(`  ${row.count}	${row.key}
+`);
+      }
+    }
+    return 0;
+  } catch (err) {
+    printError(`stats request failed: ${err instanceof Error ? err.message : String(err)}`);
+    return 1;
+  }
+}
+
+// src/commands/verify.ts
+import { readFile as readFile3 } from "node:fs/promises";
+import { parseArgs as parseArgs9 } from "node:util";
+import pc7 from "picocolors";
+var USAGE4 = `Usage: facet verify <target> [file] [flags]
+
+Targets:
+  export <file>                                  Verify a signed stats export envelope (offline).
+  credential <file> (--key <z\u2026> | --jwk <file>)  Verify a VC's eddsa-jcs-2022 proof.
+  did-configuration <file> --did-doc <file> [--origin <origin>]
+                                                 Verify a DIF domain-linkage against a DID document.
+  receipt <file>                                 Verify a SCITT receipt (signature + MMR inclusion).
+  attestation <file> [--nonce <n>]               Verify a RATS process-evidence EAT (software only).
+`;
+async function readJson2(path) {
+  try {
+    return JSON.parse(await readFile3(path, "utf8"));
+  } catch (err) {
+    printError(`could not read ${path}: ${err instanceof Error ? err.message : String(err)}`);
+    return null;
+  }
+}
+function ok3(msg) {
+  process.stdout.write(`${pc7.green("\u2713")} ${msg}
+`);
+}
+async function verifyExport(path) {
+  const doc = await readJson2(path);
+  if (doc === null) return 1;
+  const result = await verifySignedExport(doc);
+  if (result.valid) {
+    ok3(`valid signed export (alg=${result.alg}, kid=${result.kid})`);
+    if (result.jwksUrl) {
+      process.stdout.write(`  key: ${result.jwksUrl}
+`);
+      process.stdout.write(
+        `  ${pc7.dim("note: for full trust, confirm this kid appears in the deployment JWKS above.")}
+`
+      );
+    }
+    return 0;
+  }
+  printError(`\u2717 invalid signed export: ${result.reason ?? "signature did not verify"}`);
+  return 1;
+}
+async function verifyCredentialCmd(file, flags) {
+  const doc = await readJson2(file);
+  if (doc === null) return 1;
+  const publicKeyMultibase = flags.key;
+  if (!publicKeyMultibase && flags.jwk) {
+    const jwk = await readJson2(flags.jwk);
+    if (jwk === null) return 1;
+    const result2 = await verifyCredential(doc, {
+      publicJwk: jwk
+    });
+    return report(result2);
+  }
+  if (!publicKeyMultibase) {
+    printError("provide the verification key with --key <publicKeyMultibase> or --jwk <file>");
+    return 1;
+  }
+  const result = await verifyCredential(doc, {
+    publicKeyMultibase
+  });
+  return report(result);
+}
+function report(result) {
+  if (result.valid) {
+    ok3(`valid credential (issuer=${result.issuer ?? "unknown"})`);
+    return 0;
+  }
+  printError(`\u2717 invalid credential: ${result.reason ?? "signature did not verify"}`);
+  return 1;
+}
+async function verifyDidConfigurationCmd(file, flags) {
+  if (!flags["did-doc"]) {
+    printError("provide the DID document with --did-doc <file>");
+    return 1;
+  }
+  const config = await readJson2(file);
+  const didDoc = await readJson2(flags["did-doc"]);
+  if (config === null || didDoc === null) return 1;
+  const doc = didDoc;
+  const origin = flags.origin ?? new URL(doc.id.replace(/^did:web:/, "https://")).origin;
+  const result = await verifyDidConfiguration(config, doc, origin);
+  if (result.valid) {
+    ok3(`valid domain linkage (did=${result.did}, origin=${result.origin})`);
+    return 0;
+  }
+  printError(`\u2717 invalid domain linkage: ${result.reason ?? "verification failed"}`);
+  return 1;
+}
+async function verifyReceiptCmd(file) {
+  const doc = await readJson2(file);
+  if (doc === null) return 1;
+  const result = await verifyScittReceipt(doc);
+  if (result.valid) {
+    ok3(`valid SCITT receipt (log=${result.logId}, entry=${result.entryId})`);
+    return 0;
+  }
+  printError(`\u2717 invalid SCITT receipt: ${result.reason ?? "verification failed"}`);
+  return 1;
+}
+async function verifyAttestationCmd(file, flags) {
+  const doc = await readJson2(file);
+  if (doc === null) return 1;
+  const result = await verifyProcessEvidence(doc, {
+    nonce: flags.nonce
+  });
+  if (result.valid) {
+    ok3(`valid RATS process evidence (key-bound, build=${result.evidence?.buildId})`);
+    process.stdout.write(
+      `  ${pc7.dim("software attestation only \u2014 no hardware root of trust")}
+`
+    );
+    return 0;
+  }
+  printError(`\u2717 invalid attestation: ${result.reason ?? "verification failed"}`);
+  return 1;
+}
+async function runVerify2(args) {
+  const [what] = args;
+  if (what === "--help" || what === "-h" || what === void 0) {
+    process.stdout.write(USAGE4);
+    return what === void 0 ? 1 : 0;
+  }
+  const { values, positionals } = parseArgs9({
+    args: args.slice(1),
+    options: {
+      key: { type: "string" },
+      jwk: { type: "string" },
+      "did-doc": { type: "string" },
+      origin: { type: "string" },
+      nonce: { type: "string" }
+    },
+    allowPositionals: true
+  });
+  const file = positionals[0];
+  const flags = values;
+  if (!file) {
+    printError("missing <file> argument");
+    return 1;
+  }
+  switch (what) {
+    case "export":
+      return verifyExport(file);
+    case "credential":
+      return verifyCredentialCmd(file, flags);
+    case "did-configuration":
+      return verifyDidConfigurationCmd(file, flags);
+    case "receipt":
+      return verifyReceiptCmd(file);
+    case "attestation":
+      return verifyAttestationCmd(file, flags);
+    default:
+      printError(`unknown verify target: ${what}`);
+      process.stderr.write(USAGE4);
+      return 1;
+  }
+}
+
+// src/index.ts
+var USAGE5 = `Usage: facet <command> [options]
+
+Setup:
+  init                         Scaffold wrangler.jsonc + .dev.vars
+  migrate [--remote]           Apply D1 migrations via wrangler
+  config set-db-id --id <id>   Write the D1 database_id into wrangler.jsonc
+  config check                 Verify the D1 database_id is set (not the placeholder)
+  keys generate [--alg <a>]    Generate a deployment signing keypair (FACET_SIGNING_JWK)
+
+Reporting:
+  stats --host <url> --key <k> --site <uuid>   Print summary stats
+
+Verify (offline):
+  verify export <file>                          Verify a signed stats export envelope
+  verify credential <file> --key <z\u2026>|--jwk <f> Verify a VC (eddsa-jcs-2022)
+  verify did-configuration <file> --did-doc <f> Verify a DIF domain linkage
+
+Selective disclosure (Node-only W3C cryptosuites):
+  sd keygen --suite <ecdsa-sd-2023|bbs-2023> --out <keyfile>
+  sd issue  --suite <s> --credential <f> --key <keyfile> [--mandatory </a,/b>] --out <f>
+  sd derive --suite <s> --credential <signed> --key <keyfile> --reveal </a,/b> --out <f>
+  sd verify --suite <s> --presentation <f> --key <keyfile>
+
+Hardware key-attestation (Node-only X.509 chain via node:crypto):
+  keyattest verify <leaf.pem> --root <root.pem> --key <deploy-pub|.crt> [--intermediate <pem>] [--now <iso>]
+
+Resources (admin API \u2014 needs --host + --admin-token, or FACET_HOST/FACET_ADMIN_TOKEN):
+  sites list | create --name <n> --domain <d>
+  keys list --site <uuid> | issue --site <uuid> [--label <l>] | revoke --id <uuid> --site <uuid>
+  goals list --site <uuid> | create --site <uuid> --name <n> --type <event|path> --match <v>
+       | delete --id <uuid> --site <uuid>
+  funnels list --site <uuid> | create --site <uuid> --name <n> --steps <json>
+       | delete --id <uuid> --site <uuid>
+  experiments list --site <uuid> | create --site <uuid> --name <n> --flag <key> --variants <json>
+       | delete --id <uuid> --site <uuid>
+
+All resource commands support --json for machine-readable output.
+
+Examples:
+  facet config set-db-id --id 1a2b3c4d-... --config apps/server/wrangler.jsonc
+  facet sites create --host https://a.example.com --admin-token $TOKEN --name Blog --domain blog.dev
+  FACET_HOST=https://a.example.com FACET_ADMIN_TOKEN=$TOKEN facet keys issue --site <uuid> --label ci
+  facet funnels create --site <uuid> --name Signup \\
+    --steps '[{"type":"path","match_value":"/"},{"type":"path","match_value":"/done"}]'
+`;
+async function main(argv) {
+  const [command] = argv;
+  switch (command) {
+    case "init":
+      return runInit(argv.slice(1));
+    case "migrate":
+      return runMigrate(argv.slice(1));
+    case "stats":
+      return runStats(argv.slice(1));
+    case "config":
+      return runConfig(argv.slice(1));
+    case "keys":
+      return runKeys(argv.slice(1));
+    case "verify":
+      return runVerify2(argv.slice(1));
+    case "sd":
+      return runSd(argv.slice(1));
+    case "keyattest":
+      return runKeyattest(argv.slice(1));
+    case "--help":
+    case "-h":
+      process.stdout.write(USAGE5);
+      return 0;
+    case void 0:
+      process.stdout.write(USAGE5);
+      return 0;
+    default:
+      if (isResourceCommand(command)) {
+        return runResource(command, argv.slice(1));
+      }
+      process.stderr.write(USAGE5);
+      return 1;
+  }
+}
+var isMain = typeof process.argv[1] === "string" && import.meta.url === new URL(process.argv[1], "file://").href;
+if (isMain) {
+  void main(process.argv.slice(2)).then((code) => process.exit(code));
+}
+export {
+  main
+};