@cobinar/dalus 0.1.3 → 0.1.6

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cobinar/dalus",
-  "version": "0.1.3",
+  "version": "0.1.6",
   "description": "Deploy Cobinar projects (Edge Compute, Static Hosting, Object Storage, Document DB, Vault) from the command line.",
   "bin": {
     "dalus": "./bin/dalus.js"

package/publish-dalus.bat

@@ -0,0 +1,32 @@
+@echo off
+echo 🚀 Preparing to publish new @cobinar/dalus version...
+
+:: Navigate to your exact project directory
+cd /d "D:\Downloads\Cobinar-Lobby + Dashboard  + Da;us CLI\dalus"
+
+echo.
+echo 🔐 Checking npm authentication...
+call npm whoami >nul 2>&1
+if %ERRORLEVEL% neq 0 (
+    echo ⚠️ Your npm session expired. 
+    echo Please log in to your npm account - press ENTER to open browser.
+    call npm login
+) else (
+    echo ✅ Authenticated successfully.
+)
+
+echo.
+echo 📦 Bumping version...
+call npm version patch
+
+echo.
+echo ☁️ Publishing to npm - waiting for auth token if 2FA is required...
+call npm publish --access public
+
+echo.
+echo 🔄 Downloading and forcing install of the latest version...
+call npm install -g @cobinar/dalus@latest --force
+
+echo.
+echo ✅ Deployment complete!
+pause

package/src/auth.js

@@ -0,0 +1,78 @@
+// src/auth.js
+
+const GOOGLE_JWK_URL = 'https://www.googleapis.com/service_accounts/v1/jwk/securetoken@system.gserviceaccount.com';
+
+let _keyCache = null;
+let _cacheExpires = 0;
+
+async function getVerificationKeys() {
+  const now = Date.now();
+  if (_keyCache && now < _cacheExpires) return _keyCache;
+
+  const res = await fetch(GOOGLE_JWK_URL);
+  if (!res.ok) throw new Error('Failed to fetch Firebase JWKs');
+  const jwks = await res.json();
+
+  const cc = res.headers.get('Cache-Control') || '';
+  const maxAge = parseInt((cc.match(/max-age=(\d+)/) || [, '3600'])[1], 10);
+  _cacheExpires = now + maxAge * 1000;
+
+  _keyCache = new Map();
+  await Promise.all(
+    (jwks.keys || []).map(async (jwk) => {
+      const key = await crypto.subtle.importKey(
+        'jwk',
+        jwk,
+        { name: 'RSASSA-PKCS1-v1_5', hash: 'SHA-256' },
+        false,
+        ['verify'],
+      );
+      _keyCache.set(jwk.kid, key);
+    }),
+  );
+  return _keyCache;
+}
+
+function base64urlDecode(str) {
+  const b64 = str.replace(/-/g, '+').replace(/_/g, '/');
+  const padded = b64 + '='.repeat((4 - (b64.length % 4)) % 4);
+  return Uint8Array.from(atob(padded), (c) => c.charCodeAt(0));
+}
+
+function b64DecodeJson(b64url) {
+  return JSON.parse(new TextDecoder().decode(base64urlDecode(b64url)));
+}
+
+export async function verifyFirebaseToken(idToken, projectId) {
+  const parts = idToken.split('.');
+  if (parts.length !== 3) throw new Error('Malformed JWT: expected 3 segments');
+  const [headerB64, payloadB64, sigB64] = parts;
+
+  let header, payload;
+  try {
+    header = b64DecodeJson(headerB64);
+    payload = b64DecodeJson(payloadB64);
+  } catch {
+    throw new Error('Could not decode JWT segments');
+  }
+
+  const now = Math.floor(Date.now() / 1000);
+  if (header.alg !== 'RS256') throw new Error(`Unexpected algorithm: ${header.alg}`);
+  if (payload.aud !== projectId) throw new Error(`Invalid audience: expected "${projectId}", got "${payload.aud}"`);
+  if (payload.iss !== `https://securetoken.google.com/${projectId}`) throw new Error('Invalid issuer');
+  if (payload.exp < now) throw new Error('Token expired');
+  if (payload.iat > now + 60) throw new Error('Token issued in the future — clock skew too large');
+  if (!payload.sub) throw new Error('Missing subject claim');
+
+  const keys = await getVerificationKeys();
+  const key = keys.get(header.kid);
+  if (!key) throw new Error(`Unknown key ID: ${header.kid}`);
+
+  const signingInput = new TextEncoder().encode(`${headerB64}.${payloadB64}`);
+  const signature = base64urlDecode(sigB64);
+  const valid = await crypto.subtle.verify('RSASSA-PKCS1-v1_5', key, signature, signingInput);
+  if (!valid) throw new Error('Signature verification failed');
+
+  payload.uid = payload.sub || payload.user_id;
+  return payload;
+}

package/src/commands/auth.js

@@ -0,0 +1,78 @@
+// src/auth.js
+
+const GOOGLE_JWK_URL = 'https://www.googleapis.com/service_accounts/v1/jwk/securetoken@system.gserviceaccount.com';
+
+let _keyCache = null;
+let _cacheExpires = 0;
+
+async function getVerificationKeys() {
+  const now = Date.now();
+  if (_keyCache && now < _cacheExpires) return _keyCache;
+
+  const res = await fetch(GOOGLE_JWK_URL);
+  if (!res.ok) throw new Error('Failed to fetch Firebase JWKs');
+  const jwks = await res.json();
+
+  const cc = res.headers.get('Cache-Control') || '';
+  const maxAge = parseInt((cc.match(/max-age=(\d+)/) || [, '3600'])[1], 10);
+  _cacheExpires = now + maxAge * 1000;
+
+  _keyCache = new Map();
+  await Promise.all(
+    (jwks.keys || []).map(async (jwk) => {
+      const key = await crypto.subtle.importKey(
+        'jwk',
+        jwk,
+        { name: 'RSASSA-PKCS1-v1_5', hash: 'SHA-256' },
+        false,
+        ['verify'],
+      );
+      _keyCache.set(jwk.kid, key);
+    }),
+  );
+  return _keyCache;
+}
+
+function base64urlDecode(str) {
+  const b64 = str.replace(/-/g, '+').replace(/_/g, '/');
+  const padded = b64 + '='.repeat((4 - (b64.length % 4)) % 4);
+  return Uint8Array.from(atob(padded), (c) => c.charCodeAt(0));
+}
+
+function b64DecodeJson(b64url) {
+  return JSON.parse(new TextDecoder().decode(base64urlDecode(b64url)));
+}
+
+export async function verifyFirebaseToken(idToken, projectId) {
+  const parts = idToken.split('.');
+  if (parts.length !== 3) throw new Error('Malformed JWT: expected 3 segments');
+  const [headerB64, payloadB64, sigB64] = parts;
+
+  let header, payload;
+  try {
+    header = b64DecodeJson(headerB64);
+    payload = b64DecodeJson(payloadB64);
+  } catch {
+    throw new Error('Could not decode JWT segments');
+  }
+
+  const now = Math.floor(Date.now() / 1000);
+  if (header.alg !== 'RS256') throw new Error(`Unexpected algorithm: ${header.alg}`);
+  if (payload.aud !== projectId) throw new Error(`Invalid audience: expected "${projectId}", got "${payload.aud}"`);
+  if (payload.iss !== `https://securetoken.google.com/${projectId}`) throw new Error('Invalid issuer');
+  if (payload.exp < now) throw new Error('Token expired');
+  if (payload.iat > now + 60) throw new Error('Token issued in the future — clock skew too large');
+  if (!payload.sub) throw new Error('Missing subject claim');
+
+  const keys = await getVerificationKeys();
+  const key = keys.get(header.kid);
+  if (!key) throw new Error(`Unknown key ID: ${header.kid}`);
+
+  const signingInput = new TextEncoder().encode(`${headerB64}.${payloadB64}`);
+  const signature = base64urlDecode(sigB64);
+  const valid = await crypto.subtle.verify('RSASSA-PKCS1-v1_5', key, signature, signingInput);
+  if (!valid) throw new Error('Signature verification failed');
+
+  payload.uid = payload.sub || payload.user_id;
+  return payload;
+}

package/src/commands/cors.js

@@ -0,0 +1,34 @@
+// src/cors.js
+
+export function getAllowedOrigins(env) {
+  return (env.ALLOWED_ORIGINS || '')
+    .split(/[,\n\r]+/)
+    .map((o) => o.trim())
+    .map((o) => o.replace(/[\r\n\t\x00-\x1F\x7F]/g, ''))
+    .filter((o) => /^https?:\/\/[a-zA-Z0-9.-]+(:\d+)?$/.test(o));
+}
+
+export function corsHeaders(env, requestOrigin = '') {
+  const allowed = getAllowedOrigins(env);
+  const origin = allowed.includes(requestOrigin) ? requestOrigin : allowed[0] || '';
+  const headers = {
+    'Access-Control-Allow-Methods': 'GET, POST, DELETE, OPTIONS',
+    'Access-Control-Allow-Headers': 'Content-Type, Authorization, X-Requested-With',
+    'Access-Control-Expose-Headers': 'X-Upload-Key, X-Served-By',
+    Vary: 'Origin',
+  };
+  if (origin) {
+    headers['Access-Control-Allow-Origin'] = origin;
+    headers['Access-Control-Allow-Credentials'] = 'true';
+    headers['Access-Control-Max-Age'] = '86400';
+  }
+  return headers;
+}
+
+export function handleCors(request, env) {
+  const origin = request.headers.get('Origin') || '';
+  return new Response(null, {
+    status: 204,
+    headers: corsHeaders(env, origin),
+  });
+}

package/src/commands/index.js

@@ -0,0 +1,115 @@
+// ═══════════════════════════════════════════════════════════════════════════
+//  src/index.js — Cobinar R2 Worker · Entry Point
+//  Created by Marc-Arthur Samuel Dalus · Cobinar Systems
+//
+//  Routes:
+//    GET    /health              — Uptime check (no auth)
+//    GET    /assets/:key         — Stream public R2 asset (CDN fallback)
+//    POST   /api/auth/callback   — Cobinar Auth (OAuth) code exchange (public —
+//                                  this is how a visitor becomes authenticated)
+//    GET    /api/services         — where Cobinar's other workers currently
+//                                  live (public, read-only; see that
+//                                  handler for why this is KV-backed)
+//    POST   /api/upload          — Upload file to R2 (Firebase auth + admin only)
+//    DELETE /api/delete          — Delete R2 object (Firebase auth + admin only)
+//    (anything else)             — Delegated to env.ASSETS (the site in ./public)
+//
+//  assets.run_worker_first is set to `true` (unconditional) rather than a
+//  glob-pattern array scoped to /api/* — Cloudflare's asset-vs-worker
+//  precedence for that project turned out to return 405 for every method
+//  other than GET regardless of pattern, so this Worker now runs for every
+//  request and explicitly hands off anything it doesn't recognize to
+//  env.ASSETS.fetch(request) itself, rather than depending on that layer.
+//
+//  Bindings (wrangler.toml):
+//    COBINAR_R2          R2Bucket  — cobinar bucket
+//    FIREBASE_PROJECT_ID           — cobinar-prod
+//    ALLOWED_ORIGINS               — CORS allowlist
+//    WORKER_DOMAIN                 — worker.cobinar.com
+//    R2_PUBLIC_DOMAIN              — cdn.cobinar.com
+//    ADMIN_EMAIL                   — cobinar@cobinar.com
+//    MAX_UPLOAD_SIZE               — 104857600 (100 MB)
+//    COBINAR_AUTH_CLIENT_ID        — Cobinar Auth OAuth client id (public)
+//    COBINAR_AUTH_CLIENT_SECRET    — SECRET — set via `wrangler secret put`, never in this repo
+//    COBINAR_AUTH_BASE             — https://auth.cobinar.com
+//
+//  Folder layout in bucket:
+//    cobinar/posts/{postId}/{slot}-{uuid}.{ext}       ← post media
+//    cobinar/products/{productId}/{slot}-{uuid}.{ext} ← product images
+//    cobinar/projects/{projectId}/{slot}-{uuid}.{ext} ← project assets
+//    cobinar/images/{uuid}.{ext}                      ← flat image store
+//    cobinar/files/{uuid}.{ext}                       ← flat file store
+//
+//  CDN delivery (once cdn.cobinar.com R2 custom domain is configured):
+//    https://cdn.cobinar.com/{key}  →  direct R2 edge (zero Worker cost)
+// ═══════════════════════════════════════════════════════════════════════════
+
+import { handleCors, corsHeaders } from './cors.js';
+import { verifyFirebaseToken }     from './auth.js';
+import { handleUpload }            from './handlers/upload.js';
+import { handleDelete }            from './handlers/delete.js';
+import { handleServe }             from './handlers/serve.js';
+import { handleHealth }            from './handlers/health.js';
+import { handleAuthCallback }      from './handlers/auth-callback.js';
+import { handleServices }          from './handlers/services.js';
+
+export default {
+  async fetch(request, env, ctx) {
+    const url    = new URL(request.url);
+    const path   = url.pathname;
+    const method = request.method;
+
+    // ── CORS preflight ──────────────────────────────────────────────────────
+    if (method === 'OPTIONS') return handleCors(request, env);
+
+    // ── Health check (no auth) ──────────────────────────────────────────────
+    if (path === '/health' && method === 'GET') return handleHealth(request, env);
+
+    // ── Public asset serving — CDN fallback until cdn.cobinar.com is live ───
+    if (method === 'GET' && path.startsWith('/assets/')) {
+      return handleServe(request, env, path.slice('/assets/'.length));
+    }
+
+    // ── Cobinar Auth code exchange — public. A visitor has no session yet;
+    //    this is the one request that creates one, so it can't require one. ──
+    if (path === '/api/auth/callback' && method === 'POST') {
+      return handleAuthCallback(request, env);
+    }
+    if (path === '/api/services' && method === 'GET') {
+      return handleServices(request, env);
+    }
+
+    // ── Authenticated API routes ────────────────────────────────────────────
+    if (path.startsWith('/api/')) {
+      const token = (request.headers.get('Authorization') || '').replace(/^Bearer\s+/i, '').trim();
+      if (!token) return jsonError('Missing Authorization header', 401, env, request);
+
+      let claims;
+      try {
+        claims = await verifyFirebaseToken(token, env.FIREBASE_PROJECT_ID);
+      } catch (e) {
+        return jsonError('Invalid or expired token: ' + e.message, 401, env, request);
+      }
+
+      if (path === '/api/upload' && method === 'POST')   return handleUpload(request, env, claims);
+      if (path === '/api/delete' && method === 'DELETE') return handleDelete(request, env, claims);
+
+      return jsonError('Unknown API route', 404, env, request);
+    }
+
+    // ── Everything else: hand off to static assets (site pages, css, js, icons).
+    //    Explicit here rather than relying on Cloudflare's asset-vs-worker
+    //    precedence, since that's exactly the layer that's been unreliable. ──
+    return env.ASSETS.fetch(request);
+  },
+};
+
+function jsonError(message, status, env, request) {
+  const origin = request?.headers?.get('Origin') || '';
+  return new Response(JSON.stringify({ ok: false, error: message }), {
+    status,
+    headers: { 'Content-Type': 'application/json', ...corsHeaders(env, origin) },
+  });
+}
+//  Created by Marc-Arthur Samuel Dalus · Cobinar Systems
+//

package/src/commands/login.js

@@ -5,13 +5,23 @@ const readline = require('readline');
 const { execFile } = require('child_process');
 const { saveCredentials, clearCredentials, loadCredentials, CREDENTIALS_PATH } = require('../config');
 
-const DEFAULT_WEB_BASE = 'https://cobinar.com';
+// Where dalus's OWN worker (the login page this opens) currently lives is
+// looked up here, not hardcoded — see cobinar's src/handlers/services.js.
+// That's the one, deliberately-fixed anchor point everything else in this
+// file is relative to; if IT ever needs to move, that's a cobinar.com
+// redeploy, not a new npm release everyone has to go update.
+const SERVICES_ENDPOINT = 'https://8bnk.dalus.cobinar.com';
+// Only used if the discovery call above fails outright (a network hiccup,
+// cobinar.com briefly unreachable) -- not the source of truth, just keeps
+// `dalus login` from being completely dead during a transient outage of
+// that one lookup. --web-base always wins over both.
+const FALLBACK_DALUS_BASE = 'https://8bnk.dalus.cobinar.com';
 // cobinar-developers-worker — mints the actual bearer token dashboard-worker
-// checks (a signed "workerToken"), from the one-time code cobinar.com's
-// callback hands us. Not the same thing as cobinar.com itself or as
-// auth.cobinar.com (Cobinar's general sign-in provider, which cobinar.com
-// is a client of) — those are three separate services. See the comment on
-// exchangeSsoCode below for the exact handoff.
+// checks (a signed "workerToken"), from the one-time code dalus's own
+// worker hands us. Not the same thing as dalus.cobinar.com itself or as
+// auth.cobinar.com (Cobinar's general sign-in provider, which dalus's
+// worker is one client of) — those are three separate services. See the
+// comment on exchangeSsoCode below for the exact handoff.
 const DEFAULT_DEVELOPERS_BASE = 'https://worker.dashboard.cobinar.com';
 const LOGIN_TIMEOUT_MS = 5 * 60 * 1000;
 
@@ -23,14 +33,55 @@ function ask(question) {
 }
 
 function openBrowser(url) {
-  // execFile, not exec — no shell involved, so the URL can't be
-  // misinterpreted as shell syntax no matter what's in it.
+  // execFile, not exec — no shell involved for the process WE spawn. That
+  // alone isn't quite enough on Windows: `cmd /c start` hands its arguments
+  // to cmd.exe's OWN re-parsing of the whole line as a new command, where an
+  // unescaped "&" means "run two commands", not "a literal character in a
+  // URL" — which is exactly what truncated a real sign-in URL at its first
+  // "&" here before. rundll32 is a normal Win32 program, not a shell, so it
+  // never re-interprets "&" (or anything else) in its argument at all.
   const done = () => {}; // best-effort; the URL is always printed too
   if (process.platform === 'darwin') execFile('open', [url], done);
-  else if (process.platform === 'win32') execFile('cmd', ['/c', 'start', '""', url], done);
+  else if (process.platform === 'win32') execFile('rundll32', ['url.dll,FileProtocolHandler', url], done);
   else execFile('xdg-open', [url], done);
 }
 
+const REQUEST_TIMEOUT_MS = 8000;
+
+function getJson(urlString) {
+  return new Promise((resolve, reject) => {
+    const url = new URL(urlString);
+    const req = require(url.protocol === 'http:' ? 'http' : 'https')
+      .get(url, (res) => {
+        let out = '';
+        res.on('data', (c) => (out += c));
+        res.on('end', () => {
+          let parsed = null;
+          try { parsed = JSON.parse(out); } catch { /* leaves parsed null below */ }
+          resolve({ status: res.statusCode, json: parsed });
+        });
+      })
+      .on('error', reject);
+    req.setTimeout(REQUEST_TIMEOUT_MS, () => req.destroy(new Error('Request timed out')));
+  });
+}
+
+// The one lookup this whole file depends on: where does dalus's own worker
+// (the login page browserLogin below sends people to) currently live. See
+// SERVICES_ENDPOINT's comment above for why this is a runtime fetch and not
+// a constant.
+async function discoverDalusBase() {
+  try {
+    const { status, json } = await getJson(SERVICES_ENDPOINT);
+    if (status === 200 && json && typeof json.dalus === 'string' && json.dalus) {
+      return json.dalus;
+    }
+  } catch {
+    // Falls through to FALLBACK_DALUS_BASE below.
+  }
+  return FALLBACK_DALUS_BASE;
+}
+
 function postJson(urlString, body) {
   return new Promise((resolve, reject) => {
     const url = new URL(urlString);
@@ -54,6 +105,7 @@ function postJson(urlString, body) {
       },
     );
     req.on('error', reject);
+    req.setTimeout(REQUEST_TIMEOUT_MS, () => req.destroy(new Error('Request timed out')));
     req.write(data);
     req.end();
   });
@@ -77,15 +129,14 @@ async function exchangeSsoCode(developersBase, code) {
   return json;
 }
 
-// Starts a one-shot local server, opens the browser to Cobinar's own web
-// login (cobinar-main's public/cli-login/ page), and waits for that page to
-// POST a one-time SSO code back here once the normal auth.cobinar.com round
-// trip finishes. dalus never talks to auth.cobinar.com directly and never
-// gets its own client_id/secret — it rides along on cobinar.com's existing
-// one, same as any other visitor signing in there. See cobinar-main's
-// public/cli-login/index.html and public/auth/callback.html for the other
-// half of this handshake, and exchangeSsoCode above for what happens to the
-// code once it arrives.
+// Starts a one-shot local server, opens dalus's own worker (wherever
+// discoverDalusBase() says it currently lives) to sign in, and waits for
+// its /login/callback page to POST a one-time SSO code back here once the
+// auth.cobinar.com round trip finishes. dalus's worker has its own
+// client_id/secret, registered independently of cobinar.com's — see that
+// worker's public/login/index.html and public/login/callback.html for the
+// other half of this handshake, and exchangeSsoCode above for what happens
+// to the code once it arrives here.
 function browserLogin(webBase, developersBase) {
   // "ls" (local state): proves the browser tab that finishes is the one
   // THIS process opened, not some other local process guessing the port
@@ -153,7 +204,15 @@ function browserLogin(webBase, developersBase) {
 
     server.listen(0, '127.0.0.1', () => {
       const port = server.address().port;
-      const loginUrl = `${webBase}/cli-login?port=${port}&ls=${ls}`;
+      // port and ls travel together as one opaque value, not two params
+      // joined by "&" — see openBrowser's comment above for exactly why
+      // that character caused real trouble here. Neither value can ever
+      // contain a "." (port is digits, ls is hex), so joining/splitting on
+      // it is unambiguous. The trailing slash on /login/ is deliberate
+      // too: requesting the bare path and hoping a redirect adds the slash
+      // back is one more hop that could, in principle, drop the query
+      // string — this just starts at the real address.
+      const loginUrl = `${webBase}/login/?d=${port}.${ls}`;
       console.log('Opening your browser to sign in with Cobinar...');
       console.log(`If it doesn't open automatically, visit:\n  ${loginUrl}\n`);
       openBrowser(loginUrl);
@@ -198,7 +257,7 @@ async function loginCommand(args) {
   }
 
   const webBaseArgIdx = args.indexOf('--web-base');
-  const webBase = (webBaseArgIdx !== -1 ? args[webBaseArgIdx + 1] : DEFAULT_WEB_BASE).replace(/\/$/, '');
+  const webBase = (webBaseArgIdx !== -1 ? args[webBaseArgIdx + 1] : await discoverDalusBase()).replace(/\/$/, '');
   const developersBaseArgIdx = args.indexOf('--developers-base');
   const developersBase = (developersBaseArgIdx !== -1 ? args[developersBaseArgIdx + 1] : DEFAULT_DEVELOPERS_BASE).replace(/\/$/, '');
 
@@ -226,4 +285,4 @@ async function loginCommand(args) {
   console.log('Run "dalus forge" from a project directory to deploy.');
 }
 
-module.exports = { loginCommand, browserLogin, exchangeSsoCode };
+module.exports = { loginCommand, browserLogin, exchangeSsoCode, discoverDalusBase };

package/src/commands/storage.js

@@ -0,0 +1,72 @@
+// src/storage.js
+import { generateId } from './utils.js';
+
+const FOLDER_COLLECTIONS = new Set(['posts', 'products', 'projects']);
+const FLAT_COLLECTIONS = new Set(['images', 'files']);
+export const ALL_COLLECTIONS = new Set([...FOLDER_COLLECTIONS, ...FLAT_COLLECTIONS]);
+export { FOLDER_COLLECTIONS, FLAT_COLLECTIONS };
+
+export function generateUploadPath(collection, entityId, ext, slot) {
+  const uid = generateId();
+  if (FLAT_COLLECTIONS.has(collection)) {
+    return `cobinar/${collection}/${uid}.${ext.toLowerCase()}`;
+  }
+  const prefix = slot ? `${slot}-${uid}` : uid;
+  return `cobinar/${collection}/${entityId}/${prefix}.${ext.toLowerCase()}`;
+}
+
+export async function uploadFile(bucket, key, body, contentType, metadata = {}) {
+  await bucket.put(key, body, {
+    httpMetadata: {
+      contentType,
+      cacheControl: 'public, max-age=31536000, immutable',
+    },
+    customMetadata: {
+      uploadedAt: new Date().toISOString(),
+      ...sanitizeMetadata(metadata),
+    },
+  });
+  return { key };
+}
+
+export async function deleteFiles(bucket, keys) {
+  if (!keys || keys.length === 0) return;
+  await bucket.delete(keys);
+}
+
+export async function streamFile(bucket, key, extraHeaders = {}) {
+  const object = await bucket.get(key);
+  if (!object) {
+    return new Response(JSON.stringify({ ok: false, error: 'File not found' }), {
+      status: 404,
+      headers: { 'Content-Type': 'application/json' },
+    });
+  }
+  const headers = new Headers({
+    'Content-Type': object.httpMetadata?.contentType || 'application/octet-stream',
+    'Cache-Control': 'public, max-age=31536000, immutable',
+    ETag: object.etag,
+    'Last-Modified': object.uploaded?.toUTCString() || '',
+    'X-Served-By': 'cobinar-r2',
+    ...extraHeaders,
+  });
+  return new Response(object.body, { headers });
+}
+
+export function getPublicUrl(key, env) {
+  if (env.R2_PUBLIC_DOMAIN) {
+    return `https://${env.R2_PUBLIC_DOMAIN}/${key}`;
+  }
+  const domain = env.WORKER_DOMAIN || 'cobinar-r2.workers.dev';
+  return `https://${domain}/assets/${key}`;
+}
+
+function sanitizeMetadata(obj) {
+  const out = {};
+  for (const [k, v] of Object.entries(obj)) {
+    if (v !== null && v !== undefined) {
+      out[k] = String(v);
+    }
+  }
+  return out;
+}

package/src/commands/utils.js

@@ -0,0 +1,7 @@
+// src/utils.js
+
+export function generateId() {
+  const buf = new Uint8Array(8);
+  crypto.getRandomValues(buf);
+  return Array.from(buf, (b) => b.toString(16).padStart(2, '0')).join('').slice(0, 12);
+}