@cobinar/dalus 0.1.14 → 0.1.15

package/.mmtp

@@ -0,0 +1,19 @@
+{ls: "31c9bc3528793648bacd1a5678f0a062d2********532f9b4a",…}
+ls
+: 
+"31c9bc****793648bacd1a5*****a062d21d1070532f9*4a"
+user
+: 
+{uid: "vHzod3IL*IVvdpmT2SEZ****z0x2", email: "**************@cobinar.com",…}
+email
+: 
+"****************@cobinar.com"
+name
+: 
+"*********************"
+picture
+: 
+"*********************************"
+uid
+: 
+"vHzod3ILPIVvdpmT2SE*****tz0x2"

package/fix-dalus-login.bat

@@ -0,0 +1,13 @@
+@echo off
+setlocal
+
+echo Applying dalus login callback fixes...
+echo  - fixing the token exchange endpoint path
+echo  - fixing the ssoCode property extraction
+echo.
+
+powershell -NoProfile -ExecutionPolicy Bypass -File "%~dp0fix-dalus-login.ps1"
+
+echo.
+echo Done. Redeploy dalus-main whenever you're ready.
+pause

package/fix-dalus-login.ps1

@@ -0,0 +1,82 @@
+# fix-dalus-login.ps1
+#
+# Applies the two OAuth callback fixes to a local dalus-main checkout:
+#   1. Endpoint: https://8bnk.dalus.cobinar.com/api/auth/callback
+#              -> https://8bnk.dalus.cobinar.com/api/login/callback
+#      (the worker's router only defines POST /api/login/callback)
+#   2. Property: data.ssoCode || data.code || data.sso_code
+#              -> data.ssoCode
+#      (the worker's handler returns { ok, user, ssoCode } - never code/sso_code)
+#
+# Place this file (and fix-dalus-login.bat) inside, or one level above,
+# your dalus-main folder, then run the .bat. This script searches
+# recursively from its own location for login\callback.html and
+# auth\callback\index.html and patches whichever it finds.
+
+$root = $PSScriptRoot
+
+$oldEndpoint = "https://8bnk.dalus.cobinar.com/api/auth/callback"
+$newEndpoint = "https://8bnk.dalus.cobinar.com/api/login/callback"
+$oldProperty = "code: data.ssoCode || data.code || data.sso_code, user: data.user"
+$newProperty = "code: data.ssoCode, user: data.user"
+
+$targets = @(
+    @{ Relative = "login\callback.html";     FixProperty = $true },
+    @{ Relative = "auth\callback\index.html"; FixProperty = $false }
+)
+
+$totalFound = 0
+
+foreach ($target in $targets) {
+    $leaf = Split-Path $target.Relative -Leaf
+
+    $candidates = Get-ChildItem -Path $root -Recurse -File -Filter $leaf -ErrorAction SilentlyContinue |
+        Where-Object {
+            $_.FullName -notmatch '\\node_modules\\' -and
+            $_.FullName -notmatch '\\\.git\\' -and
+            $_.FullName -notmatch '\\\.wrangler\\' -and
+            $_.FullName.EndsWith($target.Relative)
+        }
+
+    foreach ($file in $candidates) {
+        $totalFound++
+        $text = [System.IO.File]::ReadAllText($file.FullName)
+        $changed = $false
+
+        if ($text.Contains($oldEndpoint)) {
+            $text = $text.Replace($oldEndpoint, $newEndpoint)
+            $changed = $true
+            Write-Host "  [fixed] endpoint path      $($file.FullName)"
+        } elseif ($text.Contains($newEndpoint)) {
+            Write-Host "  [ok]    endpoint already correct  $($file.FullName)"
+        } else {
+            Write-Host "  [skip]  endpoint line not found (file differs from expected)  $($file.FullName)"
+        }
+
+        if ($target.FixProperty) {
+            if ($text.Contains($oldProperty)) {
+                $text = $text.Replace($oldProperty, $newProperty)
+                $changed = $true
+                Write-Host "  [fixed] ssoCode property   $($file.FullName)"
+            } elseif ($text.Contains($newProperty)) {
+                Write-Host "  [ok]    property already correct  $($file.FullName)"
+            } else {
+                Write-Host "  [skip]  property line not found (file differs from expected)  $($file.FullName)"
+            }
+        }
+
+        if ($changed) {
+            $utf8NoBom = New-Object System.Text.UTF8Encoding($false)
+            [System.IO.File]::WriteAllText($file.FullName, $text, $utf8NoBom)
+        }
+    }
+}
+
+Write-Host ""
+if ($totalFound -eq 0) {
+    Write-Host "Didn't find login\callback.html or auth\callback\index.html under:"
+    Write-Host "  $root"
+    Write-Host "Move this script inside (or one level above) your dalus-main folder and run it again."
+} else {
+    Write-Host "Checked $totalFound file(s)."
+}

package/fix_requires.py

@@ -4,18 +4,17 @@ import re
 TARGET_DIR = r"D:\Downloads\daluss"
 IGNORE_DIRS = {'node_modules', '.git', 'dist', 'build'}
 
-def fix_exports(directory):
+def enhance_esm_compatibility(directory):
     if not os.path.exists(directory):
         print(f"Error: Directory '{directory}' does not exist.")
         return
 
-    # Matches: module.exports = { something };
+    # The bulletproof ESM polyfill for 'require'
+    REQUIRE_POLYFILL = "import { createRequire as _createRequire } from 'module';\nconst require = _createRequire(import.meta.url);\n\n"
+
+    # Regexes for handling module.exports
     exports_dict_regex = re.compile(r"module\.exports\s*=\s*\{([^}]+)\}\s*;?")
-    
-    # Matches: module.exports.foo = bar; or exports.foo = bar;
     named_exports_regex = re.compile(r"(?:module\.)?exports\.([a-zA-Z0-9_]+)\s*=\s*")
-    
-    # Matches: module.exports = myVariable; (for default exports)
     default_export_regex = re.compile(r"module\.exports\s*=\s*([a-zA-Z0-9_]+)\s*;?")
 
     changed_files_count = 0
@@ -24,27 +23,34 @@ def fix_exports(directory):
         dirs[:] = [d for d in dirs if d not in IGNORE_DIRS]
         
         for file in files:
-            if file.endswith('.mjs'):
+            # Target .js, .mjs, and extensionless files (like CLI binaries in bin/)
+            if file.endswith(('.js', '.mjs')) or ('.' not in file and 'bin' in root):
                 file_path = os.path.join(root, file)
+                
                 try:
                     with open(file_path, 'r', encoding='utf-8') as f:
                         content = f.read()
 
                     original_content = content
                     
-                    # Fix object exports: module.exports = { foo }; -> export { foo };
+                    # 1. Polyfill `require` if it's used but not defined
+                    if 'require(' in content and 'createRequire' not in content:
+                        # Safely insert polyfill after any hashbang (e.g., #!/usr/bin/env node)
+                        if content.startswith('#!'):
+                            lines = content.split('\n', 1)
+                            content = lines[0] + '\n' + REQUIRE_POLYFILL + (lines[1] if len(lines) > 1 else '')
+                        else:
+                            content = REQUIRE_POLYFILL + content
+
+                    # 2. Fix module.exports
                     content = exports_dict_regex.sub(r"export { \1 };", content)
-                    
-                    # Fix named exports: module.exports.foo = ... -> export const foo = ...
                     content = named_exports_regex.sub(r"export const \1 = ", content)
-                    
-                    # Fix default exports: module.exports = foo; -> export default foo;
                     content = default_export_regex.sub(r"export default \1;", content)
 
                     if content != original_content:
                         with open(file_path, 'w', encoding='utf-8') as f:
                             f.write(content)
-                        print(f"[FIXED EXPORTS] {file_path}")
+                        print(f"[FIXED] {file_path}")
                         changed_files_count += 1
 
                 except Exception as e:
@@ -53,5 +59,5 @@ def fix_exports(directory):
     print(f"\n✅ Conversion complete! Fixed {changed_files_count} files.")
 
 if __name__ == "__main__":
-    print("Scanning .mjs files to fix CommonJS exports (module.exports)...\n")
-    fix_exports(TARGET_DIR)
+    print("Scanning codebase to polyfill CJS/ESM conflicts...\n")
+    enhance_esm_compatibility(TARGET_DIR)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cobinar/dalus",
-  "version": "0.1.14",
+  "version": "0.1.15",
   "description": "Deploy Cobinar projects (Edge Compute, Static Hosting, Object Storage, Document DB, Vault) from the command line.",
   "bin": {
     "dalus": "./bin/dalus.mjs"

package/src/commands/login.mjs

@@ -1,3 +1,6 @@
+import { createRequire as _createRequire } from 'module';
+const require = _createRequire(import.meta.url);
+
 'use strict';
 import http from 'http';
 import crypto from 'crypto';
@@ -10,19 +13,12 @@ import { saveCredentials, clearCredentials, loadCredentials, CREDENTIALS_PATH }
 // That's the one, deliberately-fixed anchor point everything else in this
 // file is relative to; if IT ever needs to move, that's a cobinar.com
 // redeploy, not a new npm release everyone has to go update.
-const SERVICES_ENDPOINT = 'https://cobinar.com/api/services';
+const SERVICES_ENDPOINT = 'https://8bnk.dalus.cobinar.com/api/services';
 // Only used if the discovery call above fails outright (a network hiccup,
 // cobinar.com briefly unreachable) -- not the source of truth, just keeps
 // `dalus login` from being completely dead during a transient outage of
 // that one lookup. --web-base always wins over both.
 const FALLBACK_DALUS_BASE = 'https://dalus.cobinar.com';
-// cobinar-developers-worker — mints the actual bearer token dashboard-worker
-// checks (a signed "workerToken"), from the one-time code dalus's own
-// worker hands us. Not the same thing as dalus.cobinar.com itself or as
-// auth.cobinar.com (Cobinar's general sign-in provider, which dalus's
-// worker is one client of) — those are three separate services. See the
-// comment on exchangeSsoCode below for the exact handoff.
-const DEFAULT_DEVELOPERS_BASE = 'https://worker.dashboard.cobinar.com';
 const LOGIN_TIMEOUT_MS = 5 * 60 * 1000;
 
 function ask(question) {
@@ -33,14 +29,7 @@ function ask(question) {
 }
 
 function openBrowser(url) {
-  // execFile, not exec — no shell involved for the process WE spawn. That
-  // alone isn't quite enough on Windows: `cmd /c start` hands its arguments
-  // to cmd.exe's OWN re-parsing of the whole line as a new command, where an
-  // unescaped "&" means "run two commands", not "a literal character in a
-  // URL" — which is exactly what truncated a real sign-in URL at its first
-  // "&" here before. rundll32 is a normal Win32 program, not a shell, so it
-  // never re-interprets "&" (or anything else) in its argument at all.
-  const done = () => {}; // best-effort; the URL is always printed too
+  const done = () => {};
   if (process.platform === 'darwin') execFile('open', [url], done);
   else if (process.platform === 'win32') execFile('rundll32', ['url.dll,FileProtocolHandler', url], done);
   else execFile('xdg-open', [url], done);
@@ -66,10 +55,6 @@ function getJson(urlString) {
   });
 }
 
-// The one lookup this whole file depends on: where does dalus's own worker
-// (the login page browserLogin below sends people to) currently live. See
-// SERVICES_ENDPOINT's comment above for why this is a runtime fetch and not
-// a constant.
 async function discoverDalusBase() {
   try {
     const { status, json } = await getJson(SERVICES_ENDPOINT);
@@ -82,66 +67,7 @@ async function discoverDalusBase() {
   return FALLBACK_DALUS_BASE;
 }
 
-function postJson(urlString, body) {
-  return new Promise((resolve, reject) => {
-    const url = new URL(urlString);
-    const data = JSON.stringify(body);
-    const req = require(url.protocol === 'http:' ? 'http' : 'https').request(
-      {
-        hostname: url.hostname,
-        port: url.port || (url.protocol === 'http:' ? 80 : 443),
-        path: url.pathname + url.search,
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(data) },
-      },
-      (res) => {
-        let out = '';
-        res.on('data', (c) => (out += c));
-        res.on('end', () => {
-          let parsed = null;
-          try { parsed = JSON.parse(out); } catch { /* leaves parsed null below */ }
-          resolve({ status: res.statusCode, json: parsed });
-        });
-      },
-    );
-    req.on('error', reject);
-    req.setTimeout(REQUEST_TIMEOUT_MS, () => req.destroy(new Error('Request timed out')));
-    req.write(data);
-    req.end();
-  });
-}
-
-// The other half of cobinar-developers-worker's POST /auth/redeem-code:
-// cobinar.com's callback page writes { uid, email, name, picture } to a KV
-// namespace it shares with cobinar-developers-worker, keyed by a one-time
-// code, and hands US that code (over the loopback server below, once the
-// browser gets there). Redeeming it here — not on cobinar.com's server, and
-// not in the browser — is what actually mints the workerToken dashboard-
-// worker will accept; nothing before this point has needed dashboard-worker
-// to trust anything, since a workerToken is the first credential in this
-// whole flow it actually checks.
-async function exchangeSsoCode(developersBase, code) {
-  const { status, json } = await postJson(`${developersBase}/auth/redeem-code`, { code });
-  if (status !== 200 || !json || typeof json.workerToken !== 'string') {
-    const detail = json && json.error ? json.error : `HTTP ${status}`;
-    throw new Error(`Could not finish signing in (${detail}). Run "dalus login" again.`);
-  }
-  return json;
-}
-
-// Starts a one-shot local server, opens dalus's own worker (wherever
-// discoverDalusBase() says it currently lives) to sign in, and waits for
-// its /login/callback page to POST a one-time SSO code back here once the
-// auth.cobinar.com round trip finishes. dalus's worker has its own
-// client_id/secret, registered independently of cobinar.com's — see that
-// worker's public/login/index.html and public/login/callback.html for the
-// other half of this handshake, and exchangeSsoCode above for what happens
-// to the code once it arrives here.
-function browserLogin(webBase, developersBase) {
-  // "ls" (local state): proves the browser tab that finishes is the one
-  // THIS process opened, not some other local process guessing the port
-  // and racing it — the port alone isn't a secret (any local process can
-  // see what's listening), this is.
+function browserLogin(webBase) {
   const ls = crypto.randomBytes(24).toString('hex');
   const allowedOrigin = new URL(webBase).origin;
 
@@ -160,7 +86,7 @@ function browserLogin(webBase, developersBase) {
       let body = '';
       req.on('data', (chunk) => {
         body += chunk;
-        if (body.length > 1e6) req.destroy(); // this payload is a short code + a small profile, never anywhere near this size
+        if (body.length > 1e6) req.destroy();
       });
       req.on('end', async () => {
         let parsed = null;
@@ -169,17 +95,21 @@ function browserLogin(webBase, developersBase) {
         if (!parsed || parsed.ls !== ls || typeof parsed.code !== 'string' || !parsed.code) {
           res.writeHead(400, { 'Content-Type': 'application/json' });
           res.end(JSON.stringify({ ok: false }));
-          return; // deliberately not finish()/reject() here — a stray or malicious request to this port shouldn't cancel a login still in progress
+          return;
         }
 
         try {
-          const redeemed = await exchangeSsoCode(developersBase, parsed.code);
+          // 1. Acknowledge successful hand-off immediately
           res.writeHead(200, { 'Content-Type': 'application/json' });
           res.end(JSON.stringify({ ok: true }));
-          finish(null, {
-            token: redeemed.workerToken,
-            user: parsed.user || { email: redeemed.cobinarEmail, name: redeemed.displayName, picture: redeemed.photoURL },
-          });
+
+          // 2. Allow proxy time to flush the HTTP response back to the browser before closing server
+          setTimeout(() => {
+            finish(null, {
+              token: parsed.code,
+              user: parsed.user
+            });
+          }, 500);
         } catch (err) {
           res.writeHead(502, { 'Content-Type': 'application/json' });
           res.end(JSON.stringify({ ok: false, error: err.message }));
@@ -204,14 +134,6 @@ function browserLogin(webBase, developersBase) {
 
     server.listen(0, '127.0.0.1', () => {
       const port = server.address().port;
-      // port and ls travel together as one opaque value, not two params
-      // joined by "&" — see openBrowser's comment above for exactly why
-      // that character caused real trouble here. Neither value can ever
-      // contain a "." (port is digits, ls is hex), so joining/splitting on
-      // it is unambiguous. The trailing slash on /login/ is deliberate
-      // too: requesting the bare path and hoping a redirect adds the slash
-      // back is one more hop that could, in principle, drop the query
-      // string — this just starts at the real address.
       const loginUrl = `${webBase}/login/?d=${port}.${ls}`;
       console.log('Opening your browser to sign in with Cobinar...');
       console.log(`If it doesn't open automatically, visit:\n  ${loginUrl}\n`);
@@ -239,10 +161,6 @@ async function loginCommand(args) {
   const tokenArgIdx = args.indexOf('--token');
   const apiBaseArgIdx = args.indexOf('--api-base');
 
-  // --token stays as a manual escape hatch for CI/headless boxes that
-  // can't open a browser at all — not the default anymore, but not worth
-  // removing until there's a real headless flow (one-time code / email,
-  // planned later) to replace it with.
   if (tokenArgIdx !== -1) {
     const token = args[tokenArgIdx + 1];
     const apiBase = apiBaseArgIdx !== -1 ? args[apiBaseArgIdx + 1] : await ask('Cobinar dashboard-worker URL: ');
@@ -258,12 +176,10 @@ async function loginCommand(args) {
 
   const webBaseArgIdx = args.indexOf('--web-base');
   const webBase = (webBaseArgIdx !== -1 ? args[webBaseArgIdx + 1] : await discoverDalusBase()).replace(/\/$/, '');
-  const developersBaseArgIdx = args.indexOf('--developers-base');
-  const developersBase = (developersBaseArgIdx !== -1 ? args[developersBaseArgIdx + 1] : DEFAULT_DEVELOPERS_BASE).replace(/\/$/, '');
 
   let result;
   try {
-    result = await browserLogin(webBase, developersBase);
+    result = await browserLogin(webBase);
   } catch (err) {
     console.error(err.message);
     process.exitCode = 1;
@@ -285,4 +201,4 @@ async function loginCommand(args) {
   console.log('Run "dalus forge" from a project directory to deploy.');
 }
 
-export {  loginCommand, browserLogin, exchangeSsoCode, discoverDalusBase  };
+export {  loginCommand, browserLogin, discoverDalusBase  };