@cobinar/dalus 0.1.10 → 0.1.12

package/src/forgers/{workers.js → workers.mjs}

@@ -1,85 +1,85 @@
-'use strict';
-const fs = require('fs');
-const readline = require('readline');
-
-function prompt(question) {
-  const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
-  return new Promise((resolve) => rl.question(question, (answer) => { rl.close(); resolve(answer); }));
-}
-
-/** Resolves { name, type: 'storage'|'database', resource } bindings from
- * config into the { resourceId } shape the API wants, by name-matching
- * against the owner's existing buckets/collections — bindings reference
- * resources by NAME in dalus config (portable across accounts/environments),
- * but the API itself keys them by id. */
-async function resolveBindingResourceId(api, binding) {
-  const listPath = binding.type === 'storage' ? '/storage/buckets' : '/database/collections';
-  const kindLabel = binding.type === 'storage' ? 'storage bucket' : 'Document DB collection';
-  const found = await api.findByName(listPath, binding.resource);
-  if (!found) {
-    throw new Error(`Binding "${binding.name}" references ${kindLabel} "${binding.resource}", which doesn't exist yet — forge that resource first (dalus forge --storage or --database).`);
-  }
-  return found.id;
-}
-
-async function syncBindings(api, log, serviceId, bindingsConfig) {
-  if (!bindingsConfig || bindingsConfig.length === 0) return;
-  const existing = await api.get(`/services/${serviceId}/bindings`);
-  for (const binding of bindingsConfig) {
-    if (existing.some((e) => e.bindingName === binding.name)) {
-      log(`    binding ${binding.name} already exists, skipping`);
-      continue;
-    }
-    const resourceId = await resolveBindingResourceId(api, binding);
-    await api.post(`/services/${serviceId}/bindings`, {
-      bindingName: binding.name,
-      resourceType: binding.type,
-      resourceId,
-      canWrite: !!binding.canWrite,
-    });
-    log(`    bound env.${binding.name} -> ${binding.type}:${binding.resource}${binding.canWrite ? ' (read/write)' : ''}`);
-  }
-}
-
-async function syncSecrets(api, log, serviceId, secretNames, { yes }) {
-  if (!secretNames || secretNames.length === 0) return;
-  for (const name of secretNames) {
-    let value = process.env[name];
-    if (!value) {
-      if (yes) {
-        log(`    skipping secret ${name} (no ${name} env var set, and --yes disables prompting)`);
-        continue;
-      }
-      value = await prompt(`    Enter value for secret ${name} (or press Enter to skip): `);
-      if (!value) { log(`    skipped ${name}`); continue; }
-    }
-    await api.post(`/services/${serviceId}/secrets`, { name, value });
-    log(`    set secret env.${name}`);
-  }
-}
-
-/** Deploys one Edge Compute service: find-or-create by name, upload its
- * code, then sync bindings and secrets. Bindings/secrets are synced
- * every run (idempotent — see syncBindings/syncSecrets above); the code
- * upload always overwrites, same as `wrangler deploy` always overwriting
- * a Worker's script. */
-async function forgeWorker(api, log, entry, opts) {
-  log(`Edge Compute: ${entry.name}`);
-  if (!fs.existsSync(entry.main)) throw new Error(`main file not found: ${entry.main}`);
-  const code = fs.readFileSync(entry.main, 'utf8');
-
-  let svc = await api.findByName('/services', entry.name);
-  if (!svc) {
-    log(`  creating service...`);
-    svc = await api.post('/services', { name: entry.name });
-  }
-  await api.put(`/services/${svc.id}/code`, { code });
-  log(`  code uploaded (${code.length} bytes)`);
-
-  await syncBindings(api, log, svc.id, entry.bindings);
-  await syncSecrets(api, log, svc.id, entry.secrets, opts);
-
-  log(`  done -> test at ${api.apiBase}/run/${entry.name}`);
-}
-
-module.exports = { forgeWorker };
+'use strict';
+import fs from 'fs';
+import readline from 'readline';
+
+function prompt(question) {
+  const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+  return new Promise((resolve) => rl.question(question, (answer) => { rl.close(); resolve(answer); }));
+}
+
+/** Resolves { name, type: 'storage'|'database', resource } bindings from
+ * config into the { resourceId } shape the API wants, by name-matching
+ * against the owner's existing buckets/collections — bindings reference
+ * resources by NAME in dalus config (portable across accounts/environments),
+ * but the API itself keys them by id. */
+async function resolveBindingResourceId(api, binding) {
+  const listPath = binding.type === 'storage' ? '/storage/buckets' : '/database/collections';
+  const kindLabel = binding.type === 'storage' ? 'storage bucket' : 'Document DB collection';
+  const found = await api.findByName(listPath, binding.resource);
+  if (!found) {
+    throw new Error(`Binding "${binding.name}" references ${kindLabel} "${binding.resource}", which doesn't exist yet — forge that resource first (dalus forge --storage or --database).`);
+  }
+  return found.id;
+}
+
+async function syncBindings(api, log, serviceId, bindingsConfig) {
+  if (!bindingsConfig || bindingsConfig.length === 0) return;
+  const existing = await api.get(`/services/${serviceId}/bindings`);
+  for (const binding of bindingsConfig) {
+    if (existing.some((e) => e.bindingName === binding.name)) {
+      log(`    binding ${binding.name} already exists, skipping`);
+      continue;
+    }
+    const resourceId = await resolveBindingResourceId(api, binding);
+    await api.post(`/services/${serviceId}/bindings`, {
+      bindingName: binding.name,
+      resourceType: binding.type,
+      resourceId,
+      canWrite: !!binding.canWrite,
+    });
+    log(`    bound env.${binding.name} -> ${binding.type}:${binding.resource}${binding.canWrite ? ' (read/write)' : ''}`);
+  }
+}
+
+async function syncSecrets(api, log, serviceId, secretNames, { yes }) {
+  if (!secretNames || secretNames.length === 0) return;
+  for (const name of secretNames) {
+    let value = process.env[name];
+    if (!value) {
+      if (yes) {
+        log(`    skipping secret ${name} (no ${name} env var set, and --yes disables prompting)`);
+        continue;
+      }
+      value = await prompt(`    Enter value for secret ${name} (or press Enter to skip): `);
+      if (!value) { log(`    skipped ${name}`); continue; }
+    }
+    await api.post(`/services/${serviceId}/secrets`, { name, value });
+    log(`    set secret env.${name}`);
+  }
+}
+
+/** Deploys one Edge Compute service: find-or-create by name, upload its
+ * code, then sync bindings and secrets. Bindings/secrets are synced
+ * every run (idempotent — see syncBindings/syncSecrets above); the code
+ * upload always overwrites, same as `wrangler deploy` always overwriting
+ * a Worker's script. */
+async function forgeWorker(api, log, entry, opts) {
+  log(`Edge Compute: ${entry.name}`);
+  if (!fs.existsSync(entry.main)) throw new Error(`main file not found: ${entry.main}`);
+  const code = fs.readFileSync(entry.main, 'utf8');
+
+  let svc = await api.findByName('/services', entry.name);
+  if (!svc) {
+    log(`  creating service...`);
+    svc = await api.post('/services', { name: entry.name });
+  }
+  await api.put(`/services/${svc.id}/code`, { code });
+  log(`  code uploaded (${code.length} bytes)`);
+
+  await syncBindings(api, log, svc.id, entry.bindings);
+  await syncSecrets(api, log, svc.id, entry.secrets, opts);
+
+  log(`  done -> test at ${api.apiBase}/run/${entry.name}`);
+}
+
+export {  forgeWorker  };

package/src/{fs-utils.js → fs-utils.mjs}

@@ -1,36 +1,36 @@
-'use strict';
-const fs = require('fs');
-const path = require('path');
-
-/** Recursively lists every file under `dir`, returning paths relative to
- * `dir` with forward slashes (matching how the dashboard itself stores
- * Pages/Storage keys) — regardless of the host OS's own separator. */
-function walkFiles(dir) {
-  const out = [];
-  const walk = (current) => {
-    for (const entry of fs.readdirSync(current, { withFileTypes: true })) {
-      if (entry.name.startsWith('.')) continue; // .git, .DS_Store, etc.
-      const full = path.join(current, entry.name);
-      if (entry.isDirectory()) walk(full);
-      else out.push(path.relative(dir, full).split(path.sep).join('/'));
-    }
-  };
-  if (!fs.existsSync(dir)) throw new Error(`Directory not found: ${dir}`);
-  walk(dir);
-  return out;
-}
-
-const EXT_TO_CONTENT_TYPE = {
-  html: 'text/html', htm: 'text/html', css: 'text/css', js: 'application/javascript',
-  mjs: 'application/javascript', json: 'application/json', svg: 'image/svg+xml',
-  png: 'image/png', jpg: 'image/jpeg', jpeg: 'image/jpeg', gif: 'image/gif',
-  webp: 'image/webp', ico: 'image/x-icon', txt: 'text/plain', md: 'text/markdown',
-  xml: 'application/xml', pdf: 'application/pdf', woff: 'font/woff', woff2: 'font/woff2',
-};
-
-function guessContentType(filePath) {
-  const ext = path.extname(filePath).slice(1).toLowerCase();
-  return EXT_TO_CONTENT_TYPE[ext] || 'application/octet-stream';
-}
-
-module.exports = { walkFiles, guessContentType };
+'use strict';
+import fs from 'fs';
+import path from 'path';
+
+/** Recursively lists every file under `dir`, returning paths relative to
+ * `dir` with forward slashes (matching how the dashboard itself stores
+ * Pages/Storage keys) — regardless of the host OS's own separator. */
+function walkFiles(dir) {
+  const out = [];
+  const walk = (current) => {
+    for (const entry of fs.readdirSync(current, { withFileTypes: true })) {
+      if (entry.name.startsWith('.')) continue; // .git, .DS_Store, etc.
+      const full = path.join(current, entry.name);
+      if (entry.isDirectory()) walk(full);
+      else out.push(path.relative(dir, full).split(path.sep).join('/'));
+    }
+  };
+  if (!fs.existsSync(dir)) throw new Error(`Directory not found: ${dir}`);
+  walk(dir);
+  return out;
+}
+
+const EXT_TO_CONTENT_TYPE = {
+  html: 'text/html', htm: 'text/html', css: 'text/css', js: 'application/javascript',
+  mjs: 'application/javascript', json: 'application/json', svg: 'image/svg+xml',
+  png: 'image/png', jpg: 'image/jpeg', jpeg: 'image/jpeg', gif: 'image/gif',
+  webp: 'image/webp', ico: 'image/x-icon', txt: 'text/plain', md: 'text/markdown',
+  xml: 'application/xml', pdf: 'application/pdf', woff: 'font/woff', woff2: 'font/woff2',
+};
+
+function guessContentType(filePath) {
+  const ext = path.extname(filePath).slice(1).toLowerCase();
+  return EXT_TO_CONTENT_TYPE[ext] || 'application/octet-stream';
+}
+
+export {  walkFiles, guessContentType  };

package/src/handlers/{login-callback.js → login-callback.mjs}

@@ -1,143 +1,143 @@
-// ═══════════════════════════════════════════════════════════════════════════
-//  src/handlers/login-callback.js — dalus.cobinar.com's OAuth code exchange
-//
-//  Fully self-contained: this worker's own client_id/secret, its own copy of
-//  the couple of small helpers it needs, nothing imported from cobinar-main's
-//  project. The only thing shared with the rest of Cobinar Systems is the
-//  identity provider itself (auth.cobinar.com — same one every Cobinar
-//  product is a client of) and the SSO-code-handoff CONTRACT: the KV key
-//  format cobinar-developers-worker's own /auth/redeem-code expects. That
-//  contract is about whose identity just signed in, not which worker or
-//  which OAuth client asked, so it needs no changes to work from here.
-//
-//  Frontend contract:
-//    POST /api/login/callback
-//      { "code": "<authorization code from ?code=>",
-//        "redirect_uri": "<the exact redirect_uri used in /oauth/authorize>" }
-//    → 200 { ok:true, user:{ uid, email, name, picture }, ssoCode:"..." }
-//    → 4xx { ok:false, error:"human readable message" }
-//
-//  Required bindings (see wrangler.jsonc / .dev.vars.example):
-//    DALUS_AUTH_CLIENT_ID, DALUS_AUTH_CLIENT_SECRET, DALUS_AUTH_BASE, SSO_KV
-// ═══════════════════════════════════════════════════════════════════════════
-
-import { corsHeaders } from '../cors.js';
-
-const DEFAULT_AUTH_BASE = 'https://auth.cobinar.com';
-const SSO_CODE_TTL_SECONDS = 120;
-
-export async function handleLoginCallback(request, env) {
-  const headers = { 'Content-Type': 'application/json', ...corsHeaders(request) };
-  const fail = (message, status = 400) =>
-    new Response(JSON.stringify({ ok: false, error: message }), { status, headers });
-
-  const authBase = env.DALUS_AUTH_BASE || DEFAULT_AUTH_BASE;
-  const clientId = env.DALUS_AUTH_CLIENT_ID;
-  const clientSecret = env.DALUS_AUTH_CLIENT_SECRET;
-  if (!clientId || !clientSecret) {
-    return fail('Sign-in is not configured yet on the server.', 500);
-  }
-
-  let body;
-  try {
-    body = await request.json();
-  } catch {
-    return fail('Malformed request.');
-  }
-
-  const code = typeof body?.code === 'string' ? body.code.trim() : '';
-  if (!code) return fail('Missing authorization code.');
-
-  const redirectUri = typeof body?.redirect_uri === 'string' ? body.redirect_uri.trim() : '';
-  if (!/^https:\/\/[a-zA-Z0-9.-]+(\/[^\s]*)?$/.test(redirectUri)) {
-    return fail('Missing or invalid redirect_uri.');
-  }
-
-  // ── Step 1: exchange the code for tokens (server-side only) ───────────────
-  let tokenJson;
-  try {
-    const tokenRes = await fetch(`${authBase}/oauth/token`, {
-      method: 'POST',
-      headers: { 'Content-Type': 'application/json' },
-      body: JSON.stringify({
-        grant_type: 'authorization_code',
-        code,
-        client_id: clientId,
-        client_secret: clientSecret,
-        redirect_uri: redirectUri,
-      }),
-    });
-    tokenJson = await safeJson(tokenRes);
-    if (!tokenRes.ok || !tokenJson?.access_token) {
-      console.error('[login-callback] token exchange rejected:', tokenRes.status, JSON.stringify(tokenJson), 'redirect_uri sent:', redirectUri);
-      return fail(friendlyOAuthError(tokenJson), tokenRes.status === 401 ? 401 : 400);
-    }
-  } catch (err) {
-    console.error('[login-callback] token fetch threw:', err?.name, err?.message);
-    return fail('Could not reach the sign-in service. Please try again.', 502);
-  }
-
-  // ── Step 2: fetch the signed-in user's profile ─────────────────────────────
-  let userInfo;
-  try {
-    const userRes = await fetch(`${authBase}/oauth/userinfo`, {
-      headers: { Authorization: `Bearer ${tokenJson.access_token}` },
-    });
-    userInfo = await safeJson(userRes);
-    if (!userRes.ok || !userInfo) {
-      console.error('[login-callback] userinfo rejected:', userRes.status, JSON.stringify(userInfo));
-      return fail('Signed in, but could not load your profile. Please try again.', 502);
-    }
-  } catch (err) {
-    console.error('[login-callback] userinfo fetch threw:', err?.name, err?.message);
-    return fail('Signed in, but could not load your profile. Please try again.', 502);
-  }
-
-  const user = {
-    uid: userInfo.uid || userInfo.sub || null,
-    email: userInfo.email || userInfo.cobinarEmail || null,
-    name: userInfo.name || null,
-    picture: userInfo.picture || null,
-  };
-  if (!user.uid || !user.email) {
-    return fail('Sign-in succeeded but the profile was incomplete.', 502);
-  }
-
-  // ── Step 3: hand off an SSO code — cobinar-developers-worker redeems this
-  //    for the workerToken dalus actually needs; this handler never mints
-  //    one itself. ─────────────────────────────────────────────────────────
-  const ssoCode = crypto.randomUUID().replace(/-/g, '');
-  try {
-    await env.SSO_KV.put(
-      `sso:${ssoCode}`,
-      JSON.stringify({ uid: user.uid, email: user.email, name: user.name, picture: user.picture }),
-      { expirationTtl: SSO_CODE_TTL_SECONDS },
-    );
-  } catch (err) {
-    console.error('[login-callback] SSO_KV write failed:', err?.name, err?.message);
-    return fail('Signed in, but could not finish preparing your credentials. Please try again.', 502);
-  }
-
-  return new Response(JSON.stringify({ ok: true, user, ssoCode }), { status: 200, headers });
-}
-
-async function safeJson(res) {
-  try {
-    return await res.json();
-  } catch {
-    return null;
-  }
-}
-
-function friendlyOAuthError(tokenJson) {
-  switch (tokenJson?.error || '') {
-    case 'invalid_grant':
-      return 'That sign-in link expired or was already used. Please sign in again.';
-    case 'invalid_client':
-      return 'Sign-in is misconfigured on our end. Please try again later.';
-    case 'access_denied':
-      return 'Sign-in was cancelled.';
-    default:
-      return 'Could not complete sign-in. Please try again.';
-  }
-}
+// ═══════════════════════════════════════════════════════════════════════════
+//  src/handlers/login-callback.js — dalus.cobinar.com's OAuth code exchange
+//
+//  Fully self-contained: this worker's own client_id/secret, its own copy of
+//  the couple of small helpers it needs, nothing imported from cobinar-main's
+//  project. The only thing shared with the rest of Cobinar Systems is the
+//  identity provider itself (auth.cobinar.com — same one every Cobinar
+//  product is a client of) and the SSO-code-handoff CONTRACT: the KV key
+//  format cobinar-developers-worker's own /auth/redeem-code expects. That
+//  contract is about whose identity just signed in, not which worker or
+//  which OAuth client asked, so it needs no changes to work from here.
+//
+//  Frontend contract:
+//    POST /api/login/callback
+//      { "code": "<authorization code from ?code=>",
+//        "redirect_uri": "<the exact redirect_uri used in /oauth/authorize>" }
+//    → 200 { ok:true, user:{ uid, email, name, picture }, ssoCode:"..." }
+//    → 4xx { ok:false, error:"human readable message" }
+//
+//  Required bindings (see wrangler.jsonc / .dev.vars.example):
+//    DALUS_AUTH_CLIENT_ID, DALUS_AUTH_CLIENT_SECRET, DALUS_AUTH_BASE, SSO_KV
+// ═══════════════════════════════════════════════════════════════════════════
+
+import { corsHeaders } from '../cors.mjs';
+
+const DEFAULT_AUTH_BASE = 'https://auth.cobinar.com';
+const SSO_CODE_TTL_SECONDS = 120;
+
+export async function handleLoginCallback(request, env) {
+  const headers = { 'Content-Type': 'application/json', ...corsHeaders(request) };
+  const fail = (message, status = 400) =>
+    new Response(JSON.stringify({ ok: false, error: message }), { status, headers });
+
+  const authBase = env.DALUS_AUTH_BASE || DEFAULT_AUTH_BASE;
+  const clientId = env.DALUS_AUTH_CLIENT_ID;
+  const clientSecret = env.DALUS_AUTH_CLIENT_SECRET;
+  if (!clientId || !clientSecret) {
+    return fail('Sign-in is not configured yet on the server.', 500);
+  }
+
+  let body;
+  try {
+    body = await request.json();
+  } catch {
+    return fail('Malformed request.');
+  }
+
+  const code = typeof body?.code === 'string' ? body.code.trim() : '';
+  if (!code) return fail('Missing authorization code.');
+
+  const redirectUri = typeof body?.redirect_uri === 'string' ? body.redirect_uri.trim() : '';
+  if (!/^https:\/\/[a-zA-Z0-9.-]+(\/[^\s]*)?$/.test(redirectUri)) {
+    return fail('Missing or invalid redirect_uri.');
+  }
+
+  // ── Step 1: exchange the code for tokens (server-side only) ───────────────
+  let tokenJson;
+  try {
+    const tokenRes = await fetch(`${authBase}/oauth/token`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({
+        grant_type: 'authorization_code',
+        code,
+        client_id: clientId,
+        client_secret: clientSecret,
+        redirect_uri: redirectUri,
+      }),
+    });
+    tokenJson = await safeJson(tokenRes);
+    if (!tokenRes.ok || !tokenJson?.access_token) {
+      console.error('[login-callback] token exchange rejected:', tokenRes.status, JSON.stringify(tokenJson), 'redirect_uri sent:', redirectUri);
+      return fail(friendlyOAuthError(tokenJson), tokenRes.status === 401 ? 401 : 400);
+    }
+  } catch (err) {
+    console.error('[login-callback] token fetch threw:', err?.name, err?.message);
+    return fail('Could not reach the sign-in service. Please try again.', 502);
+  }
+
+  // ── Step 2: fetch the signed-in user's profile ─────────────────────────────
+  let userInfo;
+  try {
+    const userRes = await fetch(`${authBase}/oauth/userinfo`, {
+      headers: { Authorization: `Bearer ${tokenJson.access_token}` },
+    });
+    userInfo = await safeJson(userRes);
+    if (!userRes.ok || !userInfo) {
+      console.error('[login-callback] userinfo rejected:', userRes.status, JSON.stringify(userInfo));
+      return fail('Signed in, but could not load your profile. Please try again.', 502);
+    }
+  } catch (err) {
+    console.error('[login-callback] userinfo fetch threw:', err?.name, err?.message);
+    return fail('Signed in, but could not load your profile. Please try again.', 502);
+  }
+
+  const user = {
+    uid: userInfo.uid || userInfo.sub || null,
+    email: userInfo.email || userInfo.cobinarEmail || null,
+    name: userInfo.name || null,
+    picture: userInfo.picture || null,
+  };
+  if (!user.uid || !user.email) {
+    return fail('Sign-in succeeded but the profile was incomplete.', 502);
+  }
+
+  // ── Step 3: hand off an SSO code — cobinar-developers-worker redeems this
+  //    for the workerToken dalus actually needs; this handler never mints
+  //    one itself. ─────────────────────────────────────────────────────────
+  const ssoCode = crypto.randomUUID().replace(/-/g, '');
+  try {
+    await env.SSO_KV.put(
+      `sso:${ssoCode}`,
+      JSON.stringify({ uid: user.uid, email: user.email, name: user.name, picture: user.picture }),
+      { expirationTtl: SSO_CODE_TTL_SECONDS },
+    );
+  } catch (err) {
+    console.error('[login-callback] SSO_KV write failed:', err?.name, err?.message);
+    return fail('Signed in, but could not finish preparing your credentials. Please try again.', 502);
+  }
+
+  return new Response(JSON.stringify({ ok: true, user, ssoCode }), { status: 200, headers });
+}
+
+async function safeJson(res) {
+  try {
+    return await res.json();
+  } catch {
+    return null;
+  }
+}
+
+function friendlyOAuthError(tokenJson) {
+  switch (tokenJson?.error || '') {
+    case 'invalid_grant':
+      return 'That sign-in link expired or was already used. Please sign in again.';
+    case 'invalid_client':
+      return 'Sign-in is misconfigured on our end. Please try again later.';
+    case 'access_denied':
+      return 'Sign-in was cancelled.';
+    default:
+      return 'Could not complete sign-in. Please try again.';
+  }
+}

package/src/handlers/{services.js → services.mjs}

@@ -24,7 +24,7 @@
 // ═══════════════════════════════════════════════════════════════════════════
 
 const FALLBACK = {
-  dalus: 'https://8bnk.dalus.cobinar.com',
+  dalus: 'https://dalus.cobinar.com',
 };
 
 export async function handleServices(request, env) {

package/src/{index.js → index.mjs}

@@ -1,36 +1,36 @@
-// ═══════════════════════════════════════════════════════════════════════════
-//  src/index.js — dalus.cobinar.com · Entry Point
-//
-//  Everything about the dalus CLI that lives on the web: the landing page,
-//  docs, and the browser-based sign-in flow it opens (see public/login/).
-//  A standalone Worker, independent of cobinar-main — the only thing it
-//  shares with the rest of Cobinar Systems is auth.cobinar.com (the identity
-//  provider every product is a client of) and the SSO_KV binding used to
-//  hand a signed-in identity off to cobinar-developers-worker.
-//
-//  Routes:
-//    POST   /api/login/callback   — OAuth code exchange (public — a visitor
-//                                    has no session yet, this is what
-//                                    creates the SSO code for one)
-//    (anything else)              — env.ASSETS (index.html, docs, login
-//                                    pages, css)
-// ═══════════════════════════════════════════════════════════════════════════
-
-import { handleCors } from './cors.js';
-import { handleLoginCallback } from './handlers/login-callback.js';
-
-export default {
-  async fetch(request, env) {
-    const url = new URL(request.url);
-    const { pathname } = url;
-    const { method } = request;
-
-    if (method === 'OPTIONS') return handleCors(request);
-
-    if (pathname === '/api/login/callback' && method === 'POST') {
-      return handleLoginCallback(request, env);
-    }
-
-    return env.ASSETS.fetch(request);
-  },
-};
+// ═══════════════════════════════════════════════════════════════════════════
+//  src/index.js — dalus.cobinar.com · Entry Point
+//
+//  Everything about the dalus CLI that lives on the web: the landing page,
+//  docs, and the browser-based sign-in flow it opens (see public/login/).
+//  A standalone Worker, independent of cobinar-main — the only thing it
+//  shares with the rest of Cobinar Systems is auth.cobinar.com (the identity
+//  provider every product is a client of) and the SSO_KV binding used to
+//  hand a signed-in identity off to cobinar-developers-worker.
+//
+//  Routes:
+//    POST   /api/login/callback   — OAuth code exchange (public — a visitor
+//                                    has no session yet, this is what
+//                                    creates the SSO code for one)
+//    (anything else)              — env.ASSETS (index.html, docs, login
+//                                    pages, css)
+// ═══════════════════════════════════════════════════════════════════════════
+
+import { handleCors } from './cors.mjs';
+import { handleLoginCallback } from './handlers/login-callback.mjs';
+
+export default {
+  async fetch(request, env) {
+    const url = new URL(request.url);
+    const { pathname } = url;
+    const { method } = request;
+
+    if (method === 'OPTIONS') return handleCors(request);
+
+    if (pathname === '/api/login/callback' && method === 'POST') {
+      return handleLoginCallback(request, env);
+    }
+
+    return env.ASSETS.fetch(request);
+  },
+};