@cobinar/dalus 0.1.3 → 0.1.6

package/src/forgers/storage.js

@@ -1,39 +1,72 @@
-'use strict';
-const fs = require('fs');
-const path = require('path');
-const { walkFiles, guessContentType } = require('../fs-utils');
+// src/storage.js
+import { generateId } from './utils.js';
 
-/** Deploys one Object Storage bucket: find-or-create by name, flips
- * public access if configured, then PUTs every file under `dir` as an
- * object keyed by its relative path — same "re-upload everything every
- * run" behavior as the Pages forger, for the same reason (matching a
- * deploy tool's usual "this directory IS the desired state" model). */
-async function forgeStorage(api, log, entry) {
-  log(`Object Storage: ${entry.name}`);
+const FOLDER_COLLECTIONS = new Set(['posts', 'products', 'projects']);
+const FLAT_COLLECTIONS = new Set(['images', 'files']);
+export const ALL_COLLECTIONS = new Set([...FOLDER_COLLECTIONS, ...FLAT_COLLECTIONS]);
+export { FOLDER_COLLECTIONS, FLAT_COLLECTIONS };
 
-  let bucket = await api.findByName('/storage/buckets', entry.name);
-  if (!bucket) {
-    log(`  creating bucket...`);
-    bucket = await api.post('/storage/buckets', { name: entry.name });
+export function generateUploadPath(collection, entityId, ext, slot) {
+  const uid = generateId();
+  if (FLAT_COLLECTIONS.has(collection)) {
+    return `cobinar/${collection}/${uid}.${ext.toLowerCase()}`;
   }
+  const prefix = slot ? `${slot}-${uid}` : uid;
+  return `cobinar/${collection}/${entityId}/${prefix}.${ext.toLowerCase()}`;
+}
 
-  if (typeof entry.public === 'boolean' && entry.public !== bucket.publicEnabled) {
-    bucket = await api.patch(`/storage/buckets/${bucket.id}/public`, { enabled: entry.public });
-    log(`  public access -> ${entry.public}`);
-  }
+export async function uploadFile(bucket, key, body, contentType, metadata = {}) {
+  await bucket.put(key, body, {
+    httpMetadata: {
+      contentType,
+      cacheControl: 'public, max-age=31536000, immutable',
+    },
+    customMetadata: {
+      uploadedAt: new Date().toISOString(),
+      ...sanitizeMetadata(metadata),
+    },
+  });
+  return { key };
+}
 
-  if (entry.dir) {
-    const files = walkFiles(entry.dir);
-    for (const relPath of files) {
-      const fullPath = path.join(entry.dir, relPath);
-      const contentType = guessContentType(relPath);
-      const body = fs.readFileSync(fullPath);
-      const result = await api.putRaw(`/storage/buckets/${bucket.id}/objects/${relPath}`, body, contentType);
-      log(`  uploaded ${relPath}${result && result.url ? ` -> ${result.url}` : ''}`);
-    }
+export async function deleteFiles(bucket, keys) {
+  if (!keys || keys.length === 0) return;
+  await bucket.delete(keys);
+}
+
+export async function streamFile(bucket, key, extraHeaders = {}) {
+  const object = await bucket.get(key);
+  if (!object) {
+    return new Response(JSON.stringify({ ok: false, error: 'File not found' }), {
+      status: 404,
+      headers: { 'Content-Type': 'application/json' },
+    });
   }
+  const headers = new Headers({
+    'Content-Type': object.httpMetadata?.contentType || 'application/octet-stream',
+    'Cache-Control': 'public, max-age=31536000, immutable',
+    ETag: object.etag,
+    'Last-Modified': object.uploaded?.toUTCString() || '',
+    'X-Served-By': 'cobinar-r2',
+    ...extraHeaders,
+  });
+  return new Response(object.body, { headers });
+}
 
-  log(`  done`);
+export function getPublicUrl(key, env) {
+  if (env.R2_PUBLIC_DOMAIN) {
+    return `https://${env.R2_PUBLIC_DOMAIN}/${key}`;
+  }
+  const domain = env.WORKER_DOMAIN || 'cobinar-r2.workers.dev';
+  return `https://${domain}/assets/${key}`;
 }
 
-module.exports = { forgeStorage };
+function sanitizeMetadata(obj) {
+  const out = {};
+  for (const [k, v] of Object.entries(obj)) {
+    if (v !== null && v !== undefined) {
+      out[k] = String(v);
+    }
+  }
+  return out;
+}

package/src/forgers/utils.js

@@ -0,0 +1,7 @@
+// src/utils.js
+
+export function generateId() {
+  const buf = new Uint8Array(8);
+  crypto.getRandomValues(buf);
+  return Array.from(buf, (b) => b.toString(16).padStart(2, '0')).join('').slice(0, 12);
+}

package/src/forgers/validators.js

@@ -0,0 +1,101 @@
+// src/validators.js
+
+export const ALLOWED_TYPES = {
+  image: {
+    mimes: ['image/jpeg', 'image/png', 'image/webp', 'image/gif', 'image/avif', 'image/svg+xml'],
+    extensions: ['jpg', 'jpeg', 'png', 'webp', 'gif', 'avif', 'svg'],
+    maxBytes: 25 * 1024 * 1024,
+    label: 'Image',
+  },
+  projectImage: {
+    mimes: ['image/jpeg', 'image/png', 'image/webp', 'image/avif'],
+    extensions: ['jpg', 'jpeg', 'png', 'webp', 'avif'],
+    maxBytes: 10 * 1024 * 1024,
+    label: 'Project image',
+  },
+  productImage: {
+    mimes: ['image/jpeg', 'image/png', 'image/webp', 'image/avif'],
+    extensions: ['jpg', 'jpeg', 'png', 'webp', 'avif'],
+    maxBytes: 10 * 1024 * 1024,
+    label: 'Product image',
+  },
+  postMedia: {
+    mimes: [
+      'image/jpeg', 'image/png', 'image/webp', 'image/gif', 'image/avif',
+      'video/mp4', 'video/webm', 'video/quicktime', 'application/pdf',
+    ],
+    extensions: ['jpg', 'jpeg', 'png', 'webp', 'gif', 'avif', 'mp4', 'webm', 'mov', 'pdf'],
+    maxBytes: 50 * 1024 * 1024,
+    label: 'Post media',
+  },
+  file: {
+    mimes: [
+      'application/pdf', 'application/zip', 'application/x-zip-compressed',
+      'application/octet-stream', 'text/plain', 'text/csv',
+      'application/vnd.ms-excel',
+      'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet',
+      'application/msword',
+      'application/vnd.openxmlformats-officedocument.wordprocessingml.document',
+      'application/json',
+    ],
+    extensions: ['pdf', 'zip', 'txt', 'csv', 'xls', 'xlsx', 'doc', 'docx', 'json', 'bin'],
+    maxBytes: 100 * 1024 * 1024,
+    label: 'File',
+  },
+};
+
+export const DEFAULT_RULE = {
+  posts: 'postMedia',
+  products: 'productImage',
+  projects: 'projectImage',
+  images: 'image',
+  files: 'file',
+};
+
+export function validateFile(mimeType, sizeBytes, filename, ruleName) {
+  const rule = ALLOWED_TYPES[ruleName];
+  if (!rule) return { valid: false, error: `Unknown validation rule: "${ruleName}"` };
+
+  const baseMime = mimeType.split(';')[0].trim().toLowerCase();
+  if (!rule.mimes.includes(baseMime)) {
+    return { valid: false, error: `${rule.label} must be one of: ${rule.mimes.join(', ')}. Got: ${baseMime}` };
+  }
+
+  const rawExt = (filename.split('.').pop() || '').toLowerCase();
+  if (!rule.extensions.includes(rawExt)) {
+    return { valid: false, error: `${rule.label} extension must be .${rule.extensions.join(', .')}. Got: .${rawExt}` };
+  }
+
+  if (sizeBytes > rule.maxBytes) {
+    const maxMb = (rule.maxBytes / 1024 / 1024).toFixed(0);
+    const gotMb = (sizeBytes / 1024 / 1024).toFixed(1);
+    return { valid: false, error: `${rule.label} must be under ${maxMb} MB. Got: ${gotMb} MB` };
+  }
+
+  return { valid: true, ext: rawExt };
+}
+
+export function extFromMime(mimeType) {
+  const map = {
+    'image/jpeg': 'jpg',
+    'image/png': 'png',
+    'image/webp': 'webp',
+    'image/gif': 'gif',
+    'image/avif': 'avif',
+    'image/svg+xml': 'svg',
+    'video/mp4': 'mp4',
+    'video/webm': 'webm',
+    'video/quicktime': 'mov',
+    'application/pdf': 'pdf',
+    'application/zip': 'zip',
+    'application/x-zip-compressed': 'zip',
+    'text/plain': 'txt',
+    'text/csv': 'csv',
+    'application/vnd.ms-excel': 'xls',
+    'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet': 'xlsx',
+    'application/msword': 'doc',
+    'application/vnd.openxmlformats-officedocument.wordprocessingml.document': 'docx',
+    'application/json': 'json',
+  };
+  return map[mimeType.split(';')[0].trim().toLowerCase()] || 'bin';
+}

package/src/index.js

@@ -0,0 +1,115 @@
+// ═══════════════════════════════════════════════════════════════════════════
+//  src/index.js — Cobinar R2 Worker · Entry Point
+//  Created by Marc-Arthur Samuel Dalus · Cobinar Systems
+//
+//  Routes:
+//    GET    /health              — Uptime check (no auth)
+//    GET    /assets/:key         — Stream public R2 asset (CDN fallback)
+//    POST   /api/auth/callback   — Cobinar Auth (OAuth) code exchange (public —
+//                                  this is how a visitor becomes authenticated)
+//    GET    /api/services         — where Cobinar's other workers currently
+//                                  live (public, read-only; see that
+//                                  handler for why this is KV-backed)
+//    POST   /api/upload          — Upload file to R2 (Firebase auth + admin only)
+//    DELETE /api/delete          — Delete R2 object (Firebase auth + admin only)
+//    (anything else)             — Delegated to env.ASSETS (the site in ./public)
+//
+//  assets.run_worker_first is set to `true` (unconditional) rather than a
+//  glob-pattern array scoped to /api/* — Cloudflare's asset-vs-worker
+//  precedence for that project turned out to return 405 for every method
+//  other than GET regardless of pattern, so this Worker now runs for every
+//  request and explicitly hands off anything it doesn't recognize to
+//  env.ASSETS.fetch(request) itself, rather than depending on that layer.
+//
+//  Bindings (wrangler.toml):
+//    COBINAR_R2          R2Bucket  — cobinar bucket
+//    FIREBASE_PROJECT_ID           — cobinar-prod
+//    ALLOWED_ORIGINS               — CORS allowlist
+//    WORKER_DOMAIN                 — worker.cobinar.com
+//    R2_PUBLIC_DOMAIN              — cdn.cobinar.com
+//    ADMIN_EMAIL                   — cobinar@cobinar.com
+//    MAX_UPLOAD_SIZE               — 104857600 (100 MB)
+//    COBINAR_AUTH_CLIENT_ID        — Cobinar Auth OAuth client id (public)
+//    COBINAR_AUTH_CLIENT_SECRET    — SECRET — set via `wrangler secret put`, never in this repo
+//    COBINAR_AUTH_BASE             — https://auth.cobinar.com
+//
+//  Folder layout in bucket:
+//    cobinar/posts/{postId}/{slot}-{uuid}.{ext}       ← post media
+//    cobinar/products/{productId}/{slot}-{uuid}.{ext} ← product images
+//    cobinar/projects/{projectId}/{slot}-{uuid}.{ext} ← project assets
+//    cobinar/images/{uuid}.{ext}                      ← flat image store
+//    cobinar/files/{uuid}.{ext}                       ← flat file store
+//
+//  CDN delivery (once cdn.cobinar.com R2 custom domain is configured):
+//    https://cdn.cobinar.com/{key}  →  direct R2 edge (zero Worker cost)
+// ═══════════════════════════════════════════════════════════════════════════
+
+import { handleCors, corsHeaders } from './cors.js';
+import { verifyFirebaseToken }     from './auth.js';
+import { handleUpload }            from './handlers/upload.js';
+import { handleDelete }            from './handlers/delete.js';
+import { handleServe }             from './handlers/serve.js';
+import { handleHealth }            from './handlers/health.js';
+import { handleAuthCallback }      from './handlers/auth-callback.js';
+import { handleServices }          from './handlers/services.js';
+
+export default {
+  async fetch(request, env, ctx) {
+    const url    = new URL(request.url);
+    const path   = url.pathname;
+    const method = request.method;
+
+    // ── CORS preflight ──────────────────────────────────────────────────────
+    if (method === 'OPTIONS') return handleCors(request, env);
+
+    // ── Health check (no auth) ──────────────────────────────────────────────
+    if (path === '/health' && method === 'GET') return handleHealth(request, env);
+
+    // ── Public asset serving — CDN fallback until cdn.cobinar.com is live ───
+    if (method === 'GET' && path.startsWith('/assets/')) {
+      return handleServe(request, env, path.slice('/assets/'.length));
+    }
+
+    // ── Cobinar Auth code exchange — public. A visitor has no session yet;
+    //    this is the one request that creates one, so it can't require one. ──
+    if (path === '/api/auth/callback' && method === 'POST') {
+      return handleAuthCallback(request, env);
+    }
+    if (path === '/api/services' && method === 'GET') {
+      return handleServices(request, env);
+    }
+
+    // ── Authenticated API routes ────────────────────────────────────────────
+    if (path.startsWith('/api/')) {
+      const token = (request.headers.get('Authorization') || '').replace(/^Bearer\s+/i, '').trim();
+      if (!token) return jsonError('Missing Authorization header', 401, env, request);
+
+      let claims;
+      try {
+        claims = await verifyFirebaseToken(token, env.FIREBASE_PROJECT_ID);
+      } catch (e) {
+        return jsonError('Invalid or expired token: ' + e.message, 401, env, request);
+      }
+
+      if (path === '/api/upload' && method === 'POST')   return handleUpload(request, env, claims);
+      if (path === '/api/delete' && method === 'DELETE') return handleDelete(request, env, claims);
+
+      return jsonError('Unknown API route', 404, env, request);
+    }
+
+    // ── Everything else: hand off to static assets (site pages, css, js, icons).
+    //    Explicit here rather than relying on Cloudflare's asset-vs-worker
+    //    precedence, since that's exactly the layer that's been unreliable. ──
+    return env.ASSETS.fetch(request);
+  },
+};
+
+function jsonError(message, status, env, request) {
+  const origin = request?.headers?.get('Origin') || '';
+  return new Response(JSON.stringify({ ok: false, error: message }), {
+    status,
+    headers: { 'Content-Type': 'application/json', ...corsHeaders(env, origin) },
+  });
+}
+//  Created by Marc-Arthur Samuel Dalus · Cobinar Systems
+//

package/src/login.js

@@ -0,0 +1,288 @@
+'use strict';
+const http = require('http');
+const crypto = require('crypto');
+const readline = require('readline');
+const { execFile } = require('child_process');
+const { saveCredentials, clearCredentials, loadCredentials, CREDENTIALS_PATH } = require('../config');
+
+// Where dalus's OWN worker (the login page this opens) currently lives is
+// looked up here, not hardcoded — see cobinar's src/handlers/services.js.
+// That's the one, deliberately-fixed anchor point everything else in this
+// file is relative to; if IT ever needs to move, that's a cobinar.com
+// redeploy, not a new npm release everyone has to go update.
+const SERVICES_ENDPOINT = 'https://cobinar.com/api/services';
+// Only used if the discovery call above fails outright (a network hiccup,
+// cobinar.com briefly unreachable) -- not the source of truth, just keeps
+// `dalus login` from being completely dead during a transient outage of
+// that one lookup. --web-base always wins over both.
+const FALLBACK_DALUS_BASE = 'https://8bnk.dalus.cobinar.com';
+// cobinar-developers-worker — mints the actual bearer token dashboard-worker
+// checks (a signed "workerToken"), from the one-time code dalus's own
+// worker hands us. Not the same thing as dalus.cobinar.com itself or as
+// auth.cobinar.com (Cobinar's general sign-in provider, which dalus's
+// worker is one client of) — those are three separate services. See the
+// comment on exchangeSsoCode below for the exact handoff.
+const DEFAULT_DEVELOPERS_BASE = 'https://worker.dashboard.cobinar.com';
+const LOGIN_TIMEOUT_MS = 5 * 60 * 1000;
+
+function ask(question) {
+  return new Promise((resolve) => {
+    const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+    rl.question(question, (answer) => { rl.close(); resolve(answer.trim()); });
+  });
+}
+
+function openBrowser(url) {
+  // execFile, not exec — no shell involved for the process WE spawn. That
+  // alone isn't quite enough on Windows: `cmd /c start` hands its arguments
+  // to cmd.exe's OWN re-parsing of the whole line as a new command, where an
+  // unescaped "&" means "run two commands", not "a literal character in a
+  // URL" — which is exactly what truncated a real sign-in URL at its first
+  // "&" here before. rundll32 is a normal Win32 program, not a shell, so it
+  // never re-interprets "&" (or anything else) in its argument at all.
+  const done = () => {}; // best-effort; the URL is always printed too
+  if (process.platform === 'darwin') execFile('open', [url], done);
+  else if (process.platform === 'win32') execFile('rundll32', ['url.dll,FileProtocolHandler', url], done);
+  else execFile('xdg-open', [url], done);
+}
+
+const REQUEST_TIMEOUT_MS = 8000;
+
+function getJson(urlString) {
+  return new Promise((resolve, reject) => {
+    const url = new URL(urlString);
+    const req = require(url.protocol === 'http:' ? 'http' : 'https')
+      .get(url, (res) => {
+        let out = '';
+        res.on('data', (c) => (out += c));
+        res.on('end', () => {
+          let parsed = null;
+          try { parsed = JSON.parse(out); } catch { /* leaves parsed null below */ }
+          resolve({ status: res.statusCode, json: parsed });
+        });
+      })
+      .on('error', reject);
+    req.setTimeout(REQUEST_TIMEOUT_MS, () => req.destroy(new Error('Request timed out')));
+  });
+}
+
+// The one lookup this whole file depends on: where does dalus's own worker
+// (the login page browserLogin below sends people to) currently live. See
+// SERVICES_ENDPOINT's comment above for why this is a runtime fetch and not
+// a constant.
+async function discoverDalusBase() {
+  try {
+    const { status, json } = await getJson(SERVICES_ENDPOINT);
+    if (status === 200 && json && typeof json.dalus === 'string' && json.dalus) {
+      return json.dalus;
+    }
+  } catch {
+    // Falls through to FALLBACK_DALUS_BASE below.
+  }
+  return FALLBACK_DALUS_BASE;
+}
+
+function postJson(urlString, body) {
+  return new Promise((resolve, reject) => {
+    const url = new URL(urlString);
+    const data = JSON.stringify(body);
+    const req = require(url.protocol === 'http:' ? 'http' : 'https').request(
+      {
+        hostname: url.hostname,
+        port: url.port || (url.protocol === 'http:' ? 80 : 443),
+        path: url.pathname + url.search,
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(data) },
+      },
+      (res) => {
+        let out = '';
+        res.on('data', (c) => (out += c));
+        res.on('end', () => {
+          let parsed = null;
+          try { parsed = JSON.parse(out); } catch { /* leaves parsed null below */ }
+          resolve({ status: res.statusCode, json: parsed });
+        });
+      },
+    );
+    req.on('error', reject);
+    req.setTimeout(REQUEST_TIMEOUT_MS, () => req.destroy(new Error('Request timed out')));
+    req.write(data);
+    req.end();
+  });
+}
+
+// The other half of cobinar-developers-worker's POST /auth/redeem-code:
+// cobinar.com's callback page writes { uid, email, name, picture } to a KV
+// namespace it shares with cobinar-developers-worker, keyed by a one-time
+// code, and hands US that code (over the loopback server below, once the
+// browser gets there). Redeeming it here — not on cobinar.com's server, and
+// not in the browser — is what actually mints the workerToken dashboard-
+// worker will accept; nothing before this point has needed dashboard-worker
+// to trust anything, since a workerToken is the first credential in this
+// whole flow it actually checks.
+async function exchangeSsoCode(developersBase, code) {
+  const { status, json } = await postJson(`${developersBase}/auth/redeem-code`, { code });
+  if (status !== 200 || !json || typeof json.workerToken !== 'string') {
+    const detail = json && json.error ? json.error : `HTTP ${status}`;
+    throw new Error(`Could not finish signing in (${detail}). Run "dalus login" again.`);
+  }
+  return json;
+}
+
+// Starts a one-shot local server, opens dalus's own worker (wherever
+// discoverDalusBase() says it currently lives) to sign in, and waits for
+// its /login/callback page to POST a one-time SSO code back here once the
+// auth.cobinar.com round trip finishes. dalus's worker has its own
+// client_id/secret, registered independently of cobinar.com's — see that
+// worker's public/login/index.html and public/login/callback.html for the
+// other half of this handshake, and exchangeSsoCode above for what happens
+// to the code once it arrives here.
+function browserLogin(webBase, developersBase) {
+  // "ls" (local state): proves the browser tab that finishes is the one
+  // THIS process opened, not some other local process guessing the port
+  // and racing it — the port alone isn't a secret (any local process can
+  // see what's listening), this is.
+  const ls = crypto.randomBytes(24).toString('hex');
+  const allowedOrigin = new URL(webBase).origin;
+
+  return new Promise((resolve, reject) => {
+    let settled = false;
+
+    const server = http.createServer((req, res) => {
+      const url = new URL(req.url, 'http://127.0.0.1');
+      res.setHeader('Access-Control-Allow-Origin', allowedOrigin);
+      res.setHeader('Access-Control-Allow-Methods', 'POST, OPTIONS');
+      res.setHeader('Access-Control-Allow-Headers', 'Content-Type');
+
+      if (req.method === 'OPTIONS') { res.writeHead(204); res.end(); return; }
+      if (url.pathname !== '/complete' || req.method !== 'POST') { res.writeHead(404); res.end(); return; }
+
+      let body = '';
+      req.on('data', (chunk) => {
+        body += chunk;
+        if (body.length > 1e6) req.destroy(); // this payload is a short code + a small profile, never anywhere near this size
+      });
+      req.on('end', async () => {
+        let parsed = null;
+        try { parsed = JSON.parse(body); } catch { /* falls through to the ok:false below */ }
+
+        if (!parsed || parsed.ls !== ls || typeof parsed.code !== 'string' || !parsed.code) {
+          res.writeHead(400, { 'Content-Type': 'application/json' });
+          res.end(JSON.stringify({ ok: false }));
+          return; // deliberately not finish()/reject() here — a stray or malicious request to this port shouldn't cancel a login still in progress
+        }
+
+        try {
+          const redeemed = await exchangeSsoCode(developersBase, parsed.code);
+          res.writeHead(200, { 'Content-Type': 'application/json' });
+          res.end(JSON.stringify({ ok: true }));
+          finish(null, {
+            token: redeemed.workerToken,
+            user: parsed.user || { email: redeemed.cobinarEmail, name: redeemed.displayName, picture: redeemed.photoURL },
+          });
+        } catch (err) {
+          res.writeHead(502, { 'Content-Type': 'application/json' });
+          res.end(JSON.stringify({ ok: false, error: err.message }));
+          finish(err);
+        }
+      });
+    });
+
+    function finish(err, result) {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      server.close();
+      if (err) reject(err); else resolve(result);
+    }
+
+    const timer = setTimeout(() => {
+      finish(new Error(`Timed out waiting for sign-in (${LOGIN_TIMEOUT_MS / 1000}s). Run "dalus login" again.`));
+    }, LOGIN_TIMEOUT_MS);
+
+    server.on('error', (err) => finish(err));
+
+    server.listen(0, '127.0.0.1', () => {
+      const port = server.address().port;
+      // port and ls travel together as one opaque value, not two params
+      // joined by "&" — see openBrowser's comment above for exactly why
+      // that character caused real trouble here. Neither value can ever
+      // contain a "." (port is digits, ls is hex), so joining/splitting on
+      // it is unambiguous. The trailing slash on /login/ is deliberate
+      // too: requesting the bare path and hoping a redirect adds the slash
+      // back is one more hop that could, in principle, drop the query
+      // string — this just starts at the real address.
+      const loginUrl = `${webBase}/login/?d=${port}.${ls}`;
+      console.log('Opening your browser to sign in with Cobinar...');
+      console.log(`If it doesn't open automatically, visit:\n  ${loginUrl}\n`);
+      openBrowser(loginUrl);
+    });
+  });
+}
+
+async function loginCommand(args) {
+  if (args.includes('--logout')) {
+    clearCredentials();
+    console.log('Logged out.');
+    return;
+  }
+  if (args.includes('--whoami')) {
+    const creds = loadCredentials();
+    if (!creds) { console.log('Not logged in.'); return; }
+    console.log(`API base: ${creds.apiBase}`);
+    if (creds.user && creds.user.email) console.log(`Signed in as: ${creds.user.email}`);
+    console.log(`Token:    ${creds.token.slice(0, 8)}...${creds.token.slice(-4)} (stored in ${CREDENTIALS_PATH})`);
+    console.log('Note: this token expires 2 hours after signing in — "dalus login" again once it does.');
+    return;
+  }
+
+  const tokenArgIdx = args.indexOf('--token');
+  const apiBaseArgIdx = args.indexOf('--api-base');
+
+  // --token stays as a manual escape hatch for CI/headless boxes that
+  // can't open a browser at all — not the default anymore, but not worth
+  // removing until there's a real headless flow (one-time code / email,
+  // planned later) to replace it with.
+  if (tokenArgIdx !== -1) {
+    const token = args[tokenArgIdx + 1];
+    const apiBase = apiBaseArgIdx !== -1 ? args[apiBaseArgIdx + 1] : await ask('Cobinar dashboard-worker URL: ');
+    if (!token || !apiBase) {
+      console.error('Both a worker URL and a token are required.');
+      process.exitCode = 1;
+      return;
+    }
+    saveCredentials({ apiBase: apiBase.replace(/\/$/, ''), token });
+    console.log(`Saved to ${CREDENTIALS_PATH}. Run "dalus forge" from a project directory to deploy.`);
+    return;
+  }
+
+  const webBaseArgIdx = args.indexOf('--web-base');
+  const webBase = (webBaseArgIdx !== -1 ? args[webBaseArgIdx + 1] : await discoverDalusBase()).replace(/\/$/, '');
+  const developersBaseArgIdx = args.indexOf('--developers-base');
+  const developersBase = (developersBaseArgIdx !== -1 ? args[developersBaseArgIdx + 1] : DEFAULT_DEVELOPERS_BASE).replace(/\/$/, '');
+
+  let result;
+  try {
+    result = await browserLogin(webBase, developersBase);
+  } catch (err) {
+    console.error(err.message);
+    process.exitCode = 1;
+    return;
+  }
+
+  const apiBase = apiBaseArgIdx !== -1
+    ? args[apiBaseArgIdx + 1]
+    : await ask('Cobinar dashboard-worker URL (e.g. https://worker.lobby.cobinar.com): ');
+  if (!apiBase) {
+    console.error('A dashboard-worker URL is required.');
+    process.exitCode = 1;
+    return;
+  }
+
+  saveCredentials({ apiBase: apiBase.replace(/\/$/, ''), token: result.token, user: result.user || null });
+  console.log(`Signed in${result.user && result.user.email ? ' as ' + result.user.email : ''}. Saved to ${CREDENTIALS_PATH}.`);
+  console.log('This session lasts 2 hours — "dalus login" again once it expires.');
+  console.log('Run "dalus forge" from a project directory to deploy.');
+}
+
+module.exports = { loginCommand, browserLogin, exchangeSsoCode, discoverDalusBase };