@cobinar/dalus 0.1.11 → 0.1.12

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cobinar/dalus",
-  "version": "0.1.11",
+  "version": "0.1.12",
   "description": "Deploy Cobinar projects (Edge Compute, Static Hosting, Object Storage, Document DB, Vault) from the command line.",
   "bin": {
     "dalus": "./bin/dalus.mjs"

package/src/handlers/services.mjs

@@ -24,7 +24,7 @@
 // ═══════════════════════════════════════════════════════════════════════════
 
 const FALLBACK = {
-  dalus: 'https://8bnk.dalus.cobinar.com',
+  dalus: 'https://dalus.cobinar.com',
 };
 
 export async function handleServices(request, env) {

package/worker/index.js

@@ -0,0 +1,658 @@
+var __defProp = Object.defineProperty;
+var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
+
+// src/commands/cors.js
+function getAllowedOrigins(env) {
+  return (env.ALLOWED_ORIGINS || "").split(/[,\n\r]+/).map((o) => o.trim()).map((o) => o.replace(/[\r\n\t\x00-\x1F\x7F]/g, "")).filter((o) => /^https?:\/\/[a-zA-Z0-9.-]+(:\d+)?$/.test(o));
+}
+__name(getAllowedOrigins, "getAllowedOrigins");
+function corsHeaders(env, requestOrigin = "") {
+  const allowed = getAllowedOrigins(env);
+  const origin = allowed.includes(requestOrigin) ? requestOrigin : allowed[0] || "";
+  const headers = {
+    "Access-Control-Allow-Methods": "GET, POST, DELETE, OPTIONS",
+    "Access-Control-Allow-Headers": "Content-Type, Authorization, X-Requested-With",
+    "Access-Control-Expose-Headers": "X-Upload-Key, X-Served-By",
+    Vary: "Origin"
+  };
+  if (origin) {
+    headers["Access-Control-Allow-Origin"] = origin;
+    headers["Access-Control-Allow-Credentials"] = "true";
+    headers["Access-Control-Max-Age"] = "86400";
+  }
+  return headers;
+}
+__name(corsHeaders, "corsHeaders");
+function handleCors(request, env) {
+  const origin = request.headers.get("Origin") || "";
+  return new Response(null, {
+    status: 204,
+    headers: corsHeaders(env, origin)
+  });
+}
+__name(handleCors, "handleCors");
+
+// src/commands/auth.js
+var GOOGLE_JWK_URL = "https://www.googleapis.com/service_accounts/v1/jwk/securetoken@system.gserviceaccount.com";
+var _keyCache = null;
+var _cacheExpires = 0;
+async function getVerificationKeys() {
+  const now = Date.now();
+  if (_keyCache && now < _cacheExpires) return _keyCache;
+  const res = await fetch(GOOGLE_JWK_URL);
+  if (!res.ok) throw new Error("Failed to fetch Firebase JWKs");
+  const jwks = await res.json();
+  const cc = res.headers.get("Cache-Control") || "";
+  const maxAge = parseInt((cc.match(/max-age=(\d+)/) || [, "3600"])[1], 10);
+  _cacheExpires = now + maxAge * 1e3;
+  _keyCache = /* @__PURE__ */ new Map();
+  await Promise.all(
+    (jwks.keys || []).map(async (jwk) => {
+      const key = await crypto.subtle.importKey(
+        "jwk",
+        jwk,
+        { name: "RSASSA-PKCS1-v1_5", hash: "SHA-256" },
+        false,
+        ["verify"]
+      );
+      _keyCache.set(jwk.kid, key);
+    })
+  );
+  return _keyCache;
+}
+__name(getVerificationKeys, "getVerificationKeys");
+function base64urlDecode(str) {
+  const b64 = str.replace(/-/g, "+").replace(/_/g, "/");
+  const padded = b64 + "=".repeat((4 - b64.length % 4) % 4);
+  return Uint8Array.from(atob(padded), (c) => c.charCodeAt(0));
+}
+__name(base64urlDecode, "base64urlDecode");
+function b64DecodeJson(b64url) {
+  return JSON.parse(new TextDecoder().decode(base64urlDecode(b64url)));
+}
+__name(b64DecodeJson, "b64DecodeJson");
+async function verifyFirebaseToken(idToken, projectId) {
+  const parts = idToken.split(".");
+  if (parts.length !== 3) throw new Error("Malformed JWT: expected 3 segments");
+  const [headerB64, payloadB64, sigB64] = parts;
+  let header, payload;
+  try {
+    header = b64DecodeJson(headerB64);
+    payload = b64DecodeJson(payloadB64);
+  } catch {
+    throw new Error("Could not decode JWT segments");
+  }
+  const now = Math.floor(Date.now() / 1e3);
+  if (header.alg !== "RS256") throw new Error(`Unexpected algorithm: ${header.alg}`);
+  if (payload.aud !== projectId) throw new Error(`Invalid audience: expected "${projectId}", got "${payload.aud}"`);
+  if (payload.iss !== `https://securetoken.google.com/${projectId}`) throw new Error("Invalid issuer");
+  if (payload.exp < now) throw new Error("Token expired");
+  if (payload.iat > now + 60) throw new Error("Token issued in the future \u2014 clock skew too large");
+  if (!payload.sub) throw new Error("Missing subject claim");
+  const keys = await getVerificationKeys();
+  const key = keys.get(header.kid);
+  if (!key) throw new Error(`Unknown key ID: ${header.kid}`);
+  const signingInput = new TextEncoder().encode(`${headerB64}.${payloadB64}`);
+  const signature = base64urlDecode(sigB64);
+  const valid = await crypto.subtle.verify("RSASSA-PKCS1-v1_5", key, signature, signingInput);
+  if (!valid) throw new Error("Signature verification failed");
+  payload.uid = payload.sub || payload.user_id;
+  return payload;
+}
+__name(verifyFirebaseToken, "verifyFirebaseToken");
+
+// src/commands/validators.js
+var ALLOWED_TYPES = {
+  image: {
+    mimes: ["image/jpeg", "image/png", "image/webp", "image/gif", "image/avif", "image/svg+xml"],
+    extensions: ["jpg", "jpeg", "png", "webp", "gif", "avif", "svg"],
+    maxBytes: 25 * 1024 * 1024,
+    label: "Image"
+  },
+  projectImage: {
+    mimes: ["image/jpeg", "image/png", "image/webp", "image/avif"],
+    extensions: ["jpg", "jpeg", "png", "webp", "avif"],
+    maxBytes: 10 * 1024 * 1024,
+    label: "Project image"
+  },
+  productImage: {
+    mimes: ["image/jpeg", "image/png", "image/webp", "image/avif"],
+    extensions: ["jpg", "jpeg", "png", "webp", "avif"],
+    maxBytes: 10 * 1024 * 1024,
+    label: "Product image"
+  },
+  postMedia: {
+    mimes: [
+      "image/jpeg",
+      "image/png",
+      "image/webp",
+      "image/gif",
+      "image/avif",
+      "video/mp4",
+      "video/webm",
+      "video/quicktime",
+      "application/pdf"
+    ],
+    extensions: ["jpg", "jpeg", "png", "webp", "gif", "avif", "mp4", "webm", "mov", "pdf"],
+    maxBytes: 50 * 1024 * 1024,
+    label: "Post media"
+  },
+  file: {
+    mimes: [
+      "application/pdf",
+      "application/zip",
+      "application/x-zip-compressed",
+      "application/octet-stream",
+      "text/plain",
+      "text/csv",
+      "application/vnd.ms-excel",
+      "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
+      "application/msword",
+      "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
+      "application/json"
+    ],
+    extensions: ["pdf", "zip", "txt", "csv", "xls", "xlsx", "doc", "docx", "json", "bin"],
+    maxBytes: 100 * 1024 * 1024,
+    label: "File"
+  }
+};
+var DEFAULT_RULE = {
+  posts: "postMedia",
+  products: "productImage",
+  projects: "projectImage",
+  images: "image",
+  files: "file"
+};
+function validateFile(mimeType, sizeBytes, filename, ruleName) {
+  const rule = ALLOWED_TYPES[ruleName];
+  if (!rule) return { valid: false, error: `Unknown validation rule: "${ruleName}"` };
+  const baseMime = mimeType.split(";")[0].trim().toLowerCase();
+  if (!rule.mimes.includes(baseMime)) {
+    return { valid: false, error: `${rule.label} must be one of: ${rule.mimes.join(", ")}. Got: ${baseMime}` };
+  }
+  const rawExt = (filename.split(".").pop() || "").toLowerCase();
+  if (!rule.extensions.includes(rawExt)) {
+    return { valid: false, error: `${rule.label} extension must be .${rule.extensions.join(", .")}. Got: .${rawExt}` };
+  }
+  if (sizeBytes > rule.maxBytes) {
+    const maxMb = (rule.maxBytes / 1024 / 1024).toFixed(0);
+    const gotMb = (sizeBytes / 1024 / 1024).toFixed(1);
+    return { valid: false, error: `${rule.label} must be under ${maxMb} MB. Got: ${gotMb} MB` };
+  }
+  return { valid: true, ext: rawExt };
+}
+__name(validateFile, "validateFile");
+function extFromMime(mimeType) {
+  const map = {
+    "image/jpeg": "jpg",
+    "image/png": "png",
+    "image/webp": "webp",
+    "image/gif": "gif",
+    "image/avif": "avif",
+    "image/svg+xml": "svg",
+    "video/mp4": "mp4",
+    "video/webm": "webm",
+    "video/quicktime": "mov",
+    "application/pdf": "pdf",
+    "application/zip": "zip",
+    "application/x-zip-compressed": "zip",
+    "text/plain": "txt",
+    "text/csv": "csv",
+    "application/vnd.ms-excel": "xls",
+    "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet": "xlsx",
+    "application/msword": "doc",
+    "application/vnd.openxmlformats-officedocument.wordprocessingml.document": "docx",
+    "application/json": "json"
+  };
+  return map[mimeType.split(";")[0].trim().toLowerCase()] || "bin";
+}
+__name(extFromMime, "extFromMime");
+
+// src/commands/utils.js
+function generateId() {
+  const buf = new Uint8Array(8);
+  crypto.getRandomValues(buf);
+  return Array.from(buf, (b) => b.toString(16).padStart(2, "0")).join("").slice(0, 12);
+}
+__name(generateId, "generateId");
+
+// src/commands/storage.js
+var FOLDER_COLLECTIONS = /* @__PURE__ */ new Set(["posts", "products", "projects"]);
+var FLAT_COLLECTIONS = /* @__PURE__ */ new Set(["images", "files"]);
+var ALL_COLLECTIONS = /* @__PURE__ */ new Set([...FOLDER_COLLECTIONS, ...FLAT_COLLECTIONS]);
+function generateUploadPath(collection, entityId, ext, slot) {
+  const uid = generateId();
+  if (FLAT_COLLECTIONS.has(collection)) {
+    return `cobinar/${collection}/${uid}.${ext.toLowerCase()}`;
+  }
+  const prefix = slot ? `${slot}-${uid}` : uid;
+  return `cobinar/${collection}/${entityId}/${prefix}.${ext.toLowerCase()}`;
+}
+__name(generateUploadPath, "generateUploadPath");
+async function uploadFile(bucket, key, body, contentType, metadata = {}) {
+  await bucket.put(key, body, {
+    httpMetadata: {
+      contentType,
+      cacheControl: "public, max-age=31536000, immutable"
+    },
+    customMetadata: {
+      uploadedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      ...sanitizeMetadata(metadata)
+    }
+  });
+  return { key };
+}
+__name(uploadFile, "uploadFile");
+async function deleteFiles(bucket, keys) {
+  if (!keys || keys.length === 0) return;
+  await bucket.delete(keys);
+}
+__name(deleteFiles, "deleteFiles");
+async function streamFile(bucket, key, extraHeaders = {}) {
+  const object = await bucket.get(key);
+  if (!object) {
+    return new Response(JSON.stringify({ ok: false, error: "File not found" }), {
+      status: 404,
+      headers: { "Content-Type": "application/json" }
+    });
+  }
+  const headers = new Headers({
+    "Content-Type": object.httpMetadata?.contentType || "application/octet-stream",
+    "Cache-Control": "public, max-age=31536000, immutable",
+    ETag: object.etag,
+    "Last-Modified": object.uploaded?.toUTCString() || "",
+    "X-Served-By": "cobinar-r2",
+    ...extraHeaders
+  });
+  return new Response(object.body, { headers });
+}
+__name(streamFile, "streamFile");
+function getPublicUrl(key, env) {
+  if (env.R2_PUBLIC_DOMAIN) {
+    return `https://${env.R2_PUBLIC_DOMAIN}/${key}`;
+  }
+  const domain = env.WORKER_DOMAIN || "cobinar-r2.workers.dev";
+  return `https://${domain}/assets/${key}`;
+}
+__name(getPublicUrl, "getPublicUrl");
+function sanitizeMetadata(obj) {
+  const out = {};
+  for (const [k, v] of Object.entries(obj)) {
+    if (v !== null && v !== void 0) {
+      out[k] = String(v);
+    }
+  }
+  return out;
+}
+__name(sanitizeMetadata, "sanitizeMetadata");
+
+// src/commands/handlers/upload.js
+async function handleUpload(request, env, claims) {
+  const origin = request.headers.get("Origin") || "";
+  const adminEmail = env.ADMIN_EMAIL || "cobinar@cobinar.com";
+  if (claims.email !== adminEmail) {
+    return err("Upload restricted to admin only.", 403, env, origin);
+  }
+  let formData;
+  try {
+    formData = await request.formData();
+  } catch {
+    return err("Could not parse multipart/form-data body.", 400, env, origin);
+  }
+  const file = formData.get("file");
+  const collection = (formData.get("collection") || "").trim().toLowerCase();
+  const entityId = (formData.get("entityId") || "").trim();
+  const slot = (formData.get("slot") || "").trim();
+  const ruleInput = (formData.get("rule") || "").trim();
+  if (!file || typeof file.arrayBuffer !== "function") {
+    return err('No file provided in form field "file".', 400, env, origin);
+  }
+  if (!ALL_COLLECTIONS.has(collection)) {
+    return err(`Invalid collection. Must be one of: ${[...ALL_COLLECTIONS].join(", ")}.`, 400, env, origin);
+  }
+  if (FOLDER_COLLECTIONS.has(collection)) {
+    if (!entityId || !/^[a-zA-Z0-9_-]{1,128}$/.test(entityId)) {
+      return err(`"entityId" is required for "${collection}" and must be 1\u2013128 alphanumeric characters.`, 400, env, origin);
+    }
+  }
+  if (slot && !/^[a-z][a-z0-9_-]{0,31}$/.test(slot)) {
+    return err(
+      "Invalid slot. Must start with a letter, contain only lowercase letters, numbers, hyphens, underscores, max 32 chars.",
+      400,
+      env,
+      origin
+    );
+  }
+  const mimeType = (file.type || "application/octet-stream").split(";")[0].trim();
+  const sizeBytes = file.size;
+  const filename = file.name || "upload";
+  const maxBytes = parseInt(env.MAX_UPLOAD_SIZE || "104857600", 10);
+  if (sizeBytes > maxBytes) {
+    const maxMb = (maxBytes / 1024 / 1024).toFixed(0);
+    const gotMb = (sizeBytes / 1024 / 1024).toFixed(1);
+    return err(`File too large. Max ${maxMb} MB allowed; received ${gotMb} MB.`, 413, env, origin);
+  }
+  const ruleName = ruleInput || DEFAULT_RULE[collection] || "file";
+  const validation = validateFile(mimeType, sizeBytes, filename, ruleName);
+  if (!validation.valid) {
+    return err(validation.error, 422, env, origin);
+  }
+  const ext = extFromMime(mimeType);
+  const key = generateUploadPath(collection, entityId || null, ext, slot || null);
+  const body = await file.arrayBuffer();
+  try {
+    await uploadFile(env.COBINAR_R2, key, body, mimeType, {
+      uploadedBy: claims.uid || claims.sub,
+      uploadedEmail: claims.email || "",
+      originalName: filename,
+      collection,
+      entityId: entityId || "",
+      slot: slot || ""
+    });
+  } catch (e) {
+    console.error("[cobinar-r2 upload] R2 put failed:", e.message);
+    return err("Storage write failed. Please retry.", 500, env, origin);
+  }
+  const publicUrl = getPublicUrl(key, env);
+  return new Response(
+    JSON.stringify({
+      ok: true,
+      key,
+      publicUrl,
+      mimeType,
+      sizeBytes,
+      collection,
+      entityId: entityId || null,
+      slot: slot || null
+    }),
+    {
+      status: 200,
+      headers: { "Content-Type": "application/json", "X-Upload-Key": key, ...corsHeaders(env, origin) }
+    }
+  );
+}
+__name(handleUpload, "handleUpload");
+function err(message, status, env, origin = "") {
+  return new Response(JSON.stringify({ ok: false, error: message }), {
+    status,
+    headers: { "Content-Type": "application/json", ...corsHeaders(env, origin) }
+  });
+}
+__name(err, "err");
+
+// src/commands/handlers/delete.js
+var SAFE_KEY_PATTERN = /^cobinar\/[a-z][a-z0-9_-]*\/[a-zA-Z0-9_-]{1,128}(\.[a-z0-9]{1,10}|\/[a-zA-Z0-9_.\-]{1,255})$/;
+async function handleDelete(request, env, claims) {
+  const origin = request.headers.get("Origin") || "";
+  const adminEmail = env.ADMIN_EMAIL || "cobinar@cobinar.com";
+  if (claims.email !== adminEmail) {
+    return err2("Delete restricted to admin only.", 403, env, origin);
+  }
+  let body;
+  try {
+    body = await request.json();
+  } catch {
+    return err2("Request body must be valid JSON.", 400, env, origin);
+  }
+  const rawKeys = body.keys ? Array.isArray(body.keys) ? body.keys : [body.keys] : body.key ? [body.key] : [];
+  if (rawKeys.length === 0) {
+    return err2('Provide at least one key to delete via "key" or "keys".', 400, env, origin);
+  }
+  if (rawKeys.length > 1e3) {
+    return err2("Cannot delete more than 1000 keys per request.", 400, env, origin);
+  }
+  const malformed = rawKeys.filter((k) => typeof k !== "string" || !SAFE_KEY_PATTERN.test(k));
+  if (malformed.length > 0) {
+    return err2(
+      `One or more keys have an invalid format. Keys must start with "cobinar/". Bad keys: ${malformed.slice(0, 3).join(", ")}`,
+      400,
+      env,
+      origin
+    );
+  }
+  try {
+    await deleteFiles(env.COBINAR_R2, rawKeys);
+  } catch (e) {
+    console.error("[cobinar-r2 delete] R2 delete failed:", e.message);
+    return err2("Storage delete failed. Please retry.", 500, env, origin);
+  }
+  return new Response(JSON.stringify({ ok: true, deleted: rawKeys }), {
+    status: 200,
+    headers: { "Content-Type": "application/json", ...corsHeaders(env, origin) }
+  });
+}
+__name(handleDelete, "handleDelete");
+function err2(message, status, env, origin) {
+  return new Response(JSON.stringify({ ok: false, error: message }), {
+    status,
+    headers: { "Content-Type": "application/json", ...corsHeaders(env, origin) }
+  });
+}
+__name(err2, "err");
+
+// src/commands/handlers/serve.js
+var PUBLIC_PREFIXES = [
+  "cobinar/posts/",
+  "cobinar/products/",
+  "cobinar/projects/",
+  "cobinar/images/",
+  "cobinar/files/"
+];
+async function handleServe(request, env, key) {
+  if (!key || key.includes("..") || key.startsWith("/") || key.includes("\0")) {
+    return new Response("Forbidden", { status: 403 });
+  }
+  const isPublic = PUBLIC_PREFIXES.some((prefix) => key.startsWith(prefix));
+  if (!isPublic) return new Response("Not found", { status: 404 });
+  const ifNoneMatch = request.headers.get("If-None-Match");
+  if (ifNoneMatch) {
+    const head = await env.COBINAR_R2.head(key);
+    if (head && head.etag === ifNoneMatch) {
+      return new Response(null, { status: 304 });
+    }
+  }
+  return streamFile(env.COBINAR_R2, key, { "X-Served-By": "cobinar-r2" });
+}
+__name(handleServe, "handleServe");
+
+// src/commands/handlers/health.js
+async function handleHealth(request, env) {
+  const start = Date.now();
+  let r2Status = "ok";
+  try {
+    await env.COBINAR_R2.head("__health");
+  } catch (e) {
+    r2Status = "error: " + e.message;
+  }
+  return new Response(
+    JSON.stringify({
+      ok: true,
+      service: "cobinar-r2",
+      version: "1.0.0",
+      timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+      latencyMs: Date.now() - start,
+      r2: r2Status,
+      bucket: "cobinar",
+      environment: env.WORKER_DOMAIN || "unknown"
+    }),
+    { status: 200, headers: { "Content-Type": "application/json" } }
+  );
+}
+__name(handleHealth, "handleHealth");
+
+// src/commands/handlers/auth-callback.js
+var DEFAULT_AUTH_BASE = "https://auth.cobinar.com";
+async function handleAuthCallback(request, env) {
+  const origin = request.headers.get("Origin") || "";
+  const headers = { "Content-Type": "application/json", ...corsHeaders(env, origin) };
+  const fail = /* @__PURE__ */ __name((message, status = 400) => new Response(JSON.stringify({ ok: false, error: message }), { status, headers }), "fail");
+  const authBase = env.COBINAR_AUTH_BASE || DEFAULT_AUTH_BASE;
+  const clientId = env.COBINAR_AUTH_CLIENT_ID;
+  const clientSecret = env.COBINAR_AUTH_CLIENT_SECRET;
+  if (!clientId || !clientSecret) {
+    return fail("Sign-in is not configured yet on the server.", 500);
+  }
+  let body;
+  try {
+    body = await request.json();
+  } catch {
+    return fail("Malformed request.");
+  }
+  const code = typeof body?.code === "string" ? body.code.trim() : "";
+  if (!code) return fail("Missing authorization code.");
+  const isCli = body?.cli === true;
+  const redirectUri = typeof body?.redirect_uri === "string" ? body.redirect_uri.trim() : "";
+  if (!/^https:\/\/[a-zA-Z0-9.-]+(\/[^\s]*)?$/.test(redirectUri)) {
+    return fail("Missing or invalid redirect_uri.");
+  }
+  let tokenJson;
+  try {
+    const tokenRes = await fetch(`${authBase}/oauth/token`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({
+        grant_type: "authorization_code",
+        code,
+        client_id: clientId,
+        client_secret: clientSecret,
+        redirect_uri: redirectUri
+      })
+    });
+    tokenJson = await safeJson(tokenRes);
+    if (!tokenRes.ok || !tokenJson?.access_token) {
+      console.error("[auth-callback] token exchange rejected:", tokenRes.status, JSON.stringify(tokenJson), "redirect_uri sent:", redirectUri);
+      return fail(friendlyOAuthError(tokenJson), tokenRes.status === 401 ? 401 : 400);
+    }
+  } catch (err3) {
+    console.error("[auth-callback] token fetch threw:", err3?.name, err3?.message, err3?.cause ? String(err3.cause) : "");
+    return fail("Could not reach the sign-in service. Please try again.", 502);
+  }
+  let userInfo;
+  try {
+    const userRes = await fetch(`${authBase}/oauth/userinfo`, {
+      headers: { Authorization: `Bearer ${tokenJson.access_token}` }
+    });
+    userInfo = await safeJson(userRes);
+    if (!userRes.ok || !userInfo) {
+      console.error("[auth-callback] userinfo rejected:", userRes.status, JSON.stringify(userInfo));
+      return fail("Signed in, but could not load your profile. Please try again.", 502);
+    }
+  } catch (err3) {
+    console.error("[auth-callback] userinfo fetch threw:", err3?.name, err3?.message, err3?.cause ? String(err3.cause) : "");
+    return fail("Signed in, but could not load your profile. Please try again.", 502);
+  }
+  const user = {
+    uid: userInfo.uid || userInfo.sub || null,
+    email: userInfo.email || userInfo.cobinarEmail || null,
+    name: userInfo.name || null,
+    picture: userInfo.picture || null
+  };
+  if (!user.uid || !user.email) {
+    return fail("Sign-in succeeded but the profile was incomplete.", 502);
+  }
+  if (env.SSO_KV) {
+    try {
+      const ssoCode = randomCode();
+      await env.SSO_KV.put(`sso:${ssoCode}`, JSON.stringify(user), { expirationTtl: 60 });
+      headers["Set-Cookie"] = `cobinar_sso=${ssoCode}; Domain=.cobinar.com; Path=/; Max-Age=60; Secure; SameSite=Lax`;
+    } catch (err3) {
+      console.error("[auth-callback] SSO handoff write failed:", err3?.message || err3);
+    }
+  }
+  const payload = isCli ? { ok: true, user, token: tokenJson.access_token } : { ok: true, user };
+  return new Response(JSON.stringify(payload), { status: 200, headers });
+}
+__name(handleAuthCallback, "handleAuthCallback");
+function randomCode() {
+  const bytes = crypto.getRandomValues(new Uint8Array(24));
+  return Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("");
+}
+__name(randomCode, "randomCode");
+async function safeJson(res) {
+  try {
+    return await res.json();
+  } catch {
+    return null;
+  }
+}
+__name(safeJson, "safeJson");
+function friendlyOAuthError(tokenJson) {
+  const code = tokenJson?.error || "";
+  switch (code) {
+    case "invalid_grant":
+      return "That sign-in link expired or was already used. Please sign in again.";
+    case "invalid_client":
+      return "Sign-in is misconfigured on our end. Please try again later.";
+    case "access_denied":
+      return "Sign-in was cancelled.";
+    default:
+      return "Could not complete sign-in. Please try again.";
+  }
+}
+__name(friendlyOAuthError, "friendlyOAuthError");
+
+// src/commands/handlers/services.js
+var FALLBACK = {
+  dalus: "https://8bnk.dalus.cobinar.com"
+};
+async function handleServices(request, env) {
+  const headers = { "Content-Type": "application/json", "Cache-Control": "public, max-age=300" };
+  const result = {};
+  for (const name of Object.keys(FALLBACK)) {
+    let value = null;
+    try {
+      value = await env.SSO_KV.get(`service:${name}`);
+    } catch (err3) {
+      console.error("[services] KV read failed for", name, ":", err3?.message);
+    }
+    result[name] = value || FALLBACK[name];
+  }
+  return new Response(JSON.stringify(result), { status: 200, headers });
+}
+__name(handleServices, "handleServices");
+
+// src/commands/index.js
+var index_default = {
+  async fetch(request, env, ctx) {
+    const url = new URL(request.url);
+    const path = url.pathname;
+    const method = request.method;
+    if (method === "OPTIONS") return handleCors(request, env);
+    if (path === "/health" && method === "GET") return handleHealth(request, env);
+    if (method === "GET" && path.startsWith("/assets/")) {
+      return handleServe(request, env, path.slice("/assets/".length));
+    }
+    if (path === "/api/auth/callback" && method === "POST") {
+      return handleAuthCallback(request, env);
+    }
+    if (path === "/api/services" && method === "GET") {
+      return handleServices(request, env);
+    }
+    if (path.startsWith("/api/")) {
+      const token = (request.headers.get("Authorization") || "").replace(/^Bearer\s+/i, "").trim();
+      if (!token) return jsonError("Missing Authorization header", 401, env, request);
+      let claims;
+      try {
+        claims = await verifyFirebaseToken(token, env.FIREBASE_PROJECT_ID);
+      } catch (e) {
+        return jsonError("Invalid or expired token: " + e.message, 401, env, request);
+      }
+      if (path === "/api/upload" && method === "POST") return handleUpload(request, env, claims);
+      if (path === "/api/delete" && method === "DELETE") return handleDelete(request, env, claims);
+      return jsonError("Unknown API route", 404, env, request);
+    }
+    return env.ASSETS.fetch(request);
+  }
+};
+function jsonError(message, status, env, request) {
+  const origin = request?.headers?.get("Origin") || "";
+  return new Response(JSON.stringify({ ok: false, error: message }), {
+    status,
+    headers: { "Content-Type": "application/json", ...corsHeaders(env, origin) }
+  });
+}
+__name(jsonError, "jsonError");
+export {
+  index_default as default
+};
+//# sourceMappingURL=index.js.map