@cobinar/dalus 0.1.8 → 0.1.10

package/README.md

@@ -18,53 +18,27 @@ relying on this day to day.
 
 ## Install
 
-```
-npm install -g @cobinar/dalus
-```
-
-Or from source, for working on dalus itself:
-
 ```
 cd dalus
 npm install
 npm link   # makes the `dalus` command available globally
 ```
 
+(Not published to npm — this is source you own and can change.)
+
 ## Log in
 
 ```
-dalus login
+dalus login --api-base https://worker.lobby.cobinar.com --token <your bearer token>
 ```
 
-Opens your browser to sign in with Cobinar (the same sign-in every
-cobinar.com visitor uses — dalus doesn't have, and doesn't need, its own
-separate login), then stores what it gets back in
-`~/.dalus/credentials.json` (mode 0600), never inside a project
-directory. You'll also be asked for your dashboard-worker URL the first
-time — `dalus login --api-base <url>` to skip that prompt.
-
-Mechanically: dalus starts a one-shot local server on an ephemeral port,
-opens `https://cobinar.com/cli-login?port=<port>&ls=<random>`, and waits.
-That page runs the exact same auth.cobinar.com round trip as a normal
-sign-in; once it succeeds, cobinar.com's own `/auth/callback` page POSTs a
-short-lived, single-use code to dalus's local server (proving it's
-genuinely that page, not some other local process, via the `ls` value).
-dalus then redeems that code itself, directly against
-`cobinar-developers-worker`'s `/auth/redeem-code` (override with
-`--developers-base` for staging), which is what actually mints the
-signed token dashboard-worker checks — cobinar.com's callback never
-holds or sees that token, only the one-time code. No separate OAuth
-client, no manually copying anything out of a browser session.
-
-The stored token lasts 2 hours (`cobinar-developers-worker` sets that
-expiry) — `dalus login` again once a command starts failing with a
-session-expired error.
-
-`--token <token> [--api-base <url>]` is kept as a manual fallback for a
-CI runner or a headless box with no browser to open — get a token some
-other way and hand it to dalus directly, the same way `gh auth login
---with-token` works. A real headless flow (a one-time code, email
-verification) is planned but not built yet.
+dalus doesn't implement Cobinar's own signup/login flow — that lives in
+`cobinar-developers-worker`, a separate system. This command stores a
+token you've already obtained from wherever that flow gives you one, the
+same way `gh auth login --with-token` accepts a token instead of
+reimplementing GitHub's own login. Omit `--api-base`/`--token` to be
+prompted instead. Credentials are stored in `~/.dalus/credentials.json`
+(mode 0600), never inside a project directory.
 
 `dalus login --whoami` shows what's currently stored (token
 redacted). `dalus login --logout` clears it.

package/bin/dalus.js

@@ -8,18 +8,13 @@ const { initCommand } = require('../src/commands/init');
 const HELP = `dalus — deploy Cobinar projects from the command line
 
 Usage:
-  dalus login [--web-base <url>] [--api-base <url>]
-  dalus login --token <token> [--api-base <url>]
+  dalus login [--api-base <url>] [--token <token>]
   dalus login --whoami
   dalus login --logout
   dalus init [--force]
   dalus forge [--pages] [--workers] [--storage] [--database] [--vault]
               [--env <name>] [--name <resourceName>] [--yes]
 
-  Bare "dalus login" opens your browser to sign in with Cobinar and stores
-  what it gets back. --token accepts one you already have some other way
-  (CI, a headless box with no browser) instead.
-
   Bare "dalus forge" deploys every resource in dalus.jsonc / dalus.toml /
   dalus.json found in the current directory. Passing one or more of
   --pages/--workers/--storage/--database/--vault narrows it to just
@@ -60,10 +55,6 @@ async function main() {
 }
 
 main().catch((err) => {
-  if (err && err.status === 401) {
-    console.error('Your Cobinar session expired or was rejected. Run "dalus login" again.');
-  } else {
-    console.error(err.message || err);
-  }
+  console.error(err.message || err);
   process.exitCode = 1;
 });

package/package.json

@@ -1,12 +1,12 @@
 {
   "name": "@cobinar/dalus",
-  "version": "0.1.8",
-  "type": "commonjs",
+  "version": "0.1.10",
   "description": "Deploy Cobinar projects (Edge Compute, Static Hosting, Object Storage, Document DB, Vault) from the command line.",
   "bin": {
     "dalus": "./bin/dalus.js"
   },
   "main": "./src/index.js",
+  "type": "commonjs",
   "engines": {
     "node": ">=18.0.0"
   },

package/publish-dalus.bat

@@ -2,7 +2,7 @@
 echo 🚀 Preparing to publish new @cobinar/dalus version...
 
 :: Navigate to your exact project directory
-cd /d "D:\Downloads\Cobinar-Lobby + Dashboard  + Da;us CLI\dalus"
+cd /d "D:\Downloads\daluss"
 
 echo.
 echo 🔐 Checking npm authentication...

package/src/commands/login.js

@@ -10,7 +10,7 @@ const { saveCredentials, clearCredentials, loadCredentials, CREDENTIALS_PATH } =
 // That's the one, deliberately-fixed anchor point everything else in this
 // file is relative to; if IT ever needs to move, that's a cobinar.com
 // redeploy, not a new npm release everyone has to go update.
-const SERVICES_ENDPOINT = 'https://8bnk.dalus.cobinar.com';
+const SERVICES_ENDPOINT = 'https://cobinar.com/api/services';
 // Only used if the discovery call above fails outright (a network hiccup,
 // cobinar.com briefly unreachable) -- not the source of truth, just keeps
 // `dalus login` from being completely dead during a transient outage of

package/src/cors.js

@@ -1,34 +1,19 @@
-// src/cors.js
-
-export function getAllowedOrigins(env) {
-  return (env.ALLOWED_ORIGINS || '')
-    .split(/[,\n\r]+/)
-    .map((o) => o.trim())
-    .map((o) => o.replace(/[\r\n\t\x00-\x1F\x7F]/g, ''))
-    .filter((o) => /^https?:\/\/[a-zA-Z0-9.-]+(:\d+)?$/.test(o));
-}
-
-export function corsHeaders(env, requestOrigin = '') {
-  const allowed = getAllowedOrigins(env);
-  const origin = allowed.includes(requestOrigin) ? requestOrigin : allowed[0] || '';
-  const headers = {
-    'Access-Control-Allow-Methods': 'GET, POST, DELETE, OPTIONS',
-    'Access-Control-Allow-Headers': 'Content-Type, Authorization, X-Requested-With',
-    'Access-Control-Expose-Headers': 'X-Upload-Key, X-Served-By',
+// Minimal, self-contained — this worker doesn't import anything from
+// cobinar-main's project. The only cross-origin call this API ever needs to
+// allow is the browser's own /login/callback page posting to itself, which
+// is same-origin anyway; this exists mainly so a misconfigured or future
+// caller gets a clear CORS response instead of a silent browser block.
+export function corsHeaders(request) {
+  const origin = request.headers.get('Origin') || '';
+  const allowed = origin.endsWith('.cobinar.com') || origin === 'https://cobinar.com';
+  return {
+    'Access-Control-Allow-Origin': allowed ? origin : 'https://dalus.cobinar.com',
+    'Access-Control-Allow-Methods': 'GET, POST, OPTIONS',
+    'Access-Control-Allow-Headers': 'Content-Type',
     Vary: 'Origin',
   };
-  if (origin) {
-    headers['Access-Control-Allow-Origin'] = origin;
-    headers['Access-Control-Allow-Credentials'] = 'true';
-    headers['Access-Control-Max-Age'] = '86400';
-  }
-  return headers;
 }
 
-export function handleCors(request, env) {
-  const origin = request.headers.get('Origin') || '';
-  return new Response(null, {
-    status: 204,
-    headers: corsHeaders(env, origin),
-  });
+export function handleCors(request) {
+  return new Response(null, { status: 204, headers: corsHeaders(request) });
 }

package/src/forgers/storage.js

@@ -1,72 +1,39 @@
-// src/storage.js
-const { generateId } = require('./utils.js');
+'use strict';
+const fs = require('fs');
+const path = require('path');
+const { walkFiles, guessContentType } = require('../fs-utils');
 
-const FOLDER_COLLECTIONS = new Set(['posts', 'products', 'projects']);
-const FLAT_COLLECTIONS = new Set(['images', 'files']);
-export const ALL_COLLECTIONS = new Set([...FOLDER_COLLECTIONS, ...FLAT_COLLECTIONS]);
-export { FOLDER_COLLECTIONS, FLAT_COLLECTIONS };
+/** Deploys one Object Storage bucket: find-or-create by name, flips
+ * public access if configured, then PUTs every file under `dir` as an
+ * object keyed by its relative path — same "re-upload everything every
+ * run" behavior as the Pages forger, for the same reason (matching a
+ * deploy tool's usual "this directory IS the desired state" model). */
+async function forgeStorage(api, log, entry) {
+  log(`Object Storage: ${entry.name}`);
 
-export function generateUploadPath(collection, entityId, ext, slot) {
-  const uid = generateId();
-  if (FLAT_COLLECTIONS.has(collection)) {
-    return `cobinar/${collection}/${uid}.${ext.toLowerCase()}`;
+  let bucket = await api.findByName('/storage/buckets', entry.name);
+  if (!bucket) {
+    log(`  creating bucket...`);
+    bucket = await api.post('/storage/buckets', { name: entry.name });
   }
-  const prefix = slot ? `${slot}-${uid}` : uid;
-  return `cobinar/${collection}/${entityId}/${prefix}.${ext.toLowerCase()}`;
-}
-
-export async function uploadFile(bucket, key, body, contentType, metadata = {}) {
-  await bucket.put(key, body, {
-    httpMetadata: {
-      contentType,
-      cacheControl: 'public, max-age=31536000, immutable',
-    },
-    customMetadata: {
-      uploadedAt: new Date().toISOString(),
-      ...sanitizeMetadata(metadata),
-    },
-  });
-  return { key };
-}
 
-export async function deleteFiles(bucket, keys) {
-  if (!keys || keys.length === 0) return;
-  await bucket.delete(keys);
-}
-
-export async function streamFile(bucket, key, extraHeaders = {}) {
-  const object = await bucket.get(key);
-  if (!object) {
-    return new Response(JSON.stringify({ ok: false, error: 'File not found' }), {
-      status: 404,
-      headers: { 'Content-Type': 'application/json' },
-    });
+  if (typeof entry.public === 'boolean' && entry.public !== bucket.publicEnabled) {
+    bucket = await api.patch(`/storage/buckets/${bucket.id}/public`, { enabled: entry.public });
+    log(`  public access -> ${entry.public}`);
   }
-  const headers = new Headers({
-    'Content-Type': object.httpMetadata?.contentType || 'application/octet-stream',
-    'Cache-Control': 'public, max-age=31536000, immutable',
-    ETag: object.etag,
-    'Last-Modified': object.uploaded?.toUTCString() || '',
-    'X-Served-By': 'cobinar-r2',
-    ...extraHeaders,
-  });
-  return new Response(object.body, { headers });
-}
 
-export function getPublicUrl(key, env) {
-  if (env.R2_PUBLIC_DOMAIN) {
-    return `https://${env.R2_PUBLIC_DOMAIN}/${key}`;
-  }
-  const domain = env.WORKER_DOMAIN || 'cobinar-r2.workers.dev';
-  return `https://${domain}/assets/${key}`;
-}
-
-function sanitizeMetadata(obj) {
-  const out = {};
-  for (const [k, v] of Object.entries(obj)) {
-    if (v !== null && v !== undefined) {
-      out[k] = String(v);
+  if (entry.dir) {
+    const files = walkFiles(entry.dir);
+    for (const relPath of files) {
+      const fullPath = path.join(entry.dir, relPath);
+      const contentType = guessContentType(relPath);
+      const body = fs.readFileSync(fullPath);
+      const result = await api.putRaw(`/storage/buckets/${bucket.id}/objects/${relPath}`, body, contentType);
+      log(`  uploaded ${relPath}${result && result.url ? ` -> ${result.url}` : ''}`);
     }
   }
-  return out;
+
+  log(`  done`);
 }
+
+module.exports = { forgeStorage };

package/src/handlers/login-callback.js

@@ -0,0 +1,143 @@
+// ═══════════════════════════════════════════════════════════════════════════
+//  src/handlers/login-callback.js — dalus.cobinar.com's OAuth code exchange
+//
+//  Fully self-contained: this worker's own client_id/secret, its own copy of
+//  the couple of small helpers it needs, nothing imported from cobinar-main's
+//  project. The only thing shared with the rest of Cobinar Systems is the
+//  identity provider itself (auth.cobinar.com — same one every Cobinar
+//  product is a client of) and the SSO-code-handoff CONTRACT: the KV key
+//  format cobinar-developers-worker's own /auth/redeem-code expects. That
+//  contract is about whose identity just signed in, not which worker or
+//  which OAuth client asked, so it needs no changes to work from here.
+//
+//  Frontend contract:
+//    POST /api/login/callback
+//      { "code": "<authorization code from ?code=>",
+//        "redirect_uri": "<the exact redirect_uri used in /oauth/authorize>" }
+//    → 200 { ok:true, user:{ uid, email, name, picture }, ssoCode:"..." }
+//    → 4xx { ok:false, error:"human readable message" }
+//
+//  Required bindings (see wrangler.jsonc / .dev.vars.example):
+//    DALUS_AUTH_CLIENT_ID, DALUS_AUTH_CLIENT_SECRET, DALUS_AUTH_BASE, SSO_KV
+// ═══════════════════════════════════════════════════════════════════════════
+
+import { corsHeaders } from '../cors.js';
+
+const DEFAULT_AUTH_BASE = 'https://auth.cobinar.com';
+const SSO_CODE_TTL_SECONDS = 120;
+
+export async function handleLoginCallback(request, env) {
+  const headers = { 'Content-Type': 'application/json', ...corsHeaders(request) };
+  const fail = (message, status = 400) =>
+    new Response(JSON.stringify({ ok: false, error: message }), { status, headers });
+
+  const authBase = env.DALUS_AUTH_BASE || DEFAULT_AUTH_BASE;
+  const clientId = env.DALUS_AUTH_CLIENT_ID;
+  const clientSecret = env.DALUS_AUTH_CLIENT_SECRET;
+  if (!clientId || !clientSecret) {
+    return fail('Sign-in is not configured yet on the server.', 500);
+  }
+
+  let body;
+  try {
+    body = await request.json();
+  } catch {
+    return fail('Malformed request.');
+  }
+
+  const code = typeof body?.code === 'string' ? body.code.trim() : '';
+  if (!code) return fail('Missing authorization code.');
+
+  const redirectUri = typeof body?.redirect_uri === 'string' ? body.redirect_uri.trim() : '';
+  if (!/^https:\/\/[a-zA-Z0-9.-]+(\/[^\s]*)?$/.test(redirectUri)) {
+    return fail('Missing or invalid redirect_uri.');
+  }
+
+  // ── Step 1: exchange the code for tokens (server-side only) ───────────────
+  let tokenJson;
+  try {
+    const tokenRes = await fetch(`${authBase}/oauth/token`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({
+        grant_type: 'authorization_code',
+        code,
+        client_id: clientId,
+        client_secret: clientSecret,
+        redirect_uri: redirectUri,
+      }),
+    });
+    tokenJson = await safeJson(tokenRes);
+    if (!tokenRes.ok || !tokenJson?.access_token) {
+      console.error('[login-callback] token exchange rejected:', tokenRes.status, JSON.stringify(tokenJson), 'redirect_uri sent:', redirectUri);
+      return fail(friendlyOAuthError(tokenJson), tokenRes.status === 401 ? 401 : 400);
+    }
+  } catch (err) {
+    console.error('[login-callback] token fetch threw:', err?.name, err?.message);
+    return fail('Could not reach the sign-in service. Please try again.', 502);
+  }
+
+  // ── Step 2: fetch the signed-in user's profile ─────────────────────────────
+  let userInfo;
+  try {
+    const userRes = await fetch(`${authBase}/oauth/userinfo`, {
+      headers: { Authorization: `Bearer ${tokenJson.access_token}` },
+    });
+    userInfo = await safeJson(userRes);
+    if (!userRes.ok || !userInfo) {
+      console.error('[login-callback] userinfo rejected:', userRes.status, JSON.stringify(userInfo));
+      return fail('Signed in, but could not load your profile. Please try again.', 502);
+    }
+  } catch (err) {
+    console.error('[login-callback] userinfo fetch threw:', err?.name, err?.message);
+    return fail('Signed in, but could not load your profile. Please try again.', 502);
+  }
+
+  const user = {
+    uid: userInfo.uid || userInfo.sub || null,
+    email: userInfo.email || userInfo.cobinarEmail || null,
+    name: userInfo.name || null,
+    picture: userInfo.picture || null,
+  };
+  if (!user.uid || !user.email) {
+    return fail('Sign-in succeeded but the profile was incomplete.', 502);
+  }
+
+  // ── Step 3: hand off an SSO code — cobinar-developers-worker redeems this
+  //    for the workerToken dalus actually needs; this handler never mints
+  //    one itself. ─────────────────────────────────────────────────────────
+  const ssoCode = crypto.randomUUID().replace(/-/g, '');
+  try {
+    await env.SSO_KV.put(
+      `sso:${ssoCode}`,
+      JSON.stringify({ uid: user.uid, email: user.email, name: user.name, picture: user.picture }),
+      { expirationTtl: SSO_CODE_TTL_SECONDS },
+    );
+  } catch (err) {
+    console.error('[login-callback] SSO_KV write failed:', err?.name, err?.message);
+    return fail('Signed in, but could not finish preparing your credentials. Please try again.', 502);
+  }
+
+  return new Response(JSON.stringify({ ok: true, user, ssoCode }), { status: 200, headers });
+}
+
+async function safeJson(res) {
+  try {
+    return await res.json();
+  } catch {
+    return null;
+  }
+}
+
+function friendlyOAuthError(tokenJson) {
+  switch (tokenJson?.error || '') {
+    case 'invalid_grant':
+      return 'That sign-in link expired or was already used. Please sign in again.';
+    case 'invalid_client':
+      return 'Sign-in is misconfigured on our end. Please try again later.';
+    case 'access_denied':
+      return 'Sign-in was cancelled.';
+    default:
+      return 'Could not complete sign-in. Please try again.';
+  }
+}

package/src/handlers/services.js

@@ -0,0 +1,45 @@
+// ═══════════════════════════════════════════════════════════════════════════
+//  src/handlers/services.js — where do Cobinar's other workers live right now
+//
+//  One JSON endpoint, backed by KV instead of source code, specifically so
+//  a worker's public URL can change WITHOUT redeploying whatever reads it —
+//  today that's the dalus CLI (an npm package, the slowest thing in this
+//  whole system to get everyone to update), so it looks this up once at the
+//  start of `dalus login` instead of shipping a fixed URL in the package.
+//
+//  GET /api/services
+//    → 200 { "dalus": "https://8bnk.dalus.cobinar.com" }
+//
+//  Values live in SSO_KV under a `service:<name>` key (the same shared
+//  namespace this worker already uses for the SSO code hand-off — reused
+//  here for a second, unrelated-but-convenient purpose: a permanent value
+//  instead of the hand-off's short-TTL ones, so give it its own key prefix
+//  to keep the two apart). Set/update one with:
+//
+//    wrangler kv key put --binding=SSO_KV "service:dalus" "https://8bnk.dalus.cobinar.com"
+//
+//  No redeploy of THIS worker needed either when a URL changes — that's the
+//  whole point. FALLBACK below is only so this endpoint returns something
+//  sane before that command has ever been run once.
+// ═══════════════════════════════════════════════════════════════════════════
+
+const FALLBACK = {
+  dalus: 'https://8bnk.dalus.cobinar.com',
+};
+
+export async function handleServices(request, env) {
+  const headers = { 'Content-Type': 'application/json', 'Cache-Control': 'public, max-age=300' };
+
+  const result = {};
+  for (const name of Object.keys(FALLBACK)) {
+    let value = null;
+    try {
+      value = await env.SSO_KV.get(`service:${name}`);
+    } catch (err) {
+      console.error('[services] KV read failed for', name, ':', err?.message);
+    }
+    result[name] = value || FALLBACK[name];
+  }
+
+  return new Response(JSON.stringify(result), { status: 200, headers });
+}

package/src/index.js

@@ -1,115 +1,36 @@
 // ═══════════════════════════════════════════════════════════════════════════
-//  src/index.js — Cobinar R2 Worker · Entry Point
-//  Created by Marc-Arthur Samuel Dalus · Cobinar Systems
+//  src/index.js — dalus.cobinar.com · Entry Point
 //
-//  Routes:
-//    GET    /health              — Uptime check (no auth)
-//    GET    /assets/:key         — Stream public R2 asset (CDN fallback)
-//    POST   /api/auth/callback   — Cobinar Auth (OAuth) code exchange (public —
-//                                  this is how a visitor becomes authenticated)
-//    GET    /api/services         — where Cobinar's other workers currently
-//                                  live (public, read-only; see that
-//                                  handler for why this is KV-backed)
-//    POST   /api/upload          — Upload file to R2 (Firebase auth + admin only)
-//    DELETE /api/delete          — Delete R2 object (Firebase auth + admin only)
-//    (anything else)             — Delegated to env.ASSETS (the site in ./public)
-//
-//  assets.run_worker_first is set to `true` (unconditional) rather than a
-//  glob-pattern array scoped to /api/* — Cloudflare's asset-vs-worker
-//  precedence for that project turned out to return 405 for every method
-//  other than GET regardless of pattern, so this Worker now runs for every
-//  request and explicitly hands off anything it doesn't recognize to
-//  env.ASSETS.fetch(request) itself, rather than depending on that layer.
-//
-//  Bindings (wrangler.toml):
-//    COBINAR_R2          R2Bucket  — cobinar bucket
-//    FIREBASE_PROJECT_ID           — cobinar-prod
-//    ALLOWED_ORIGINS               — CORS allowlist
-//    WORKER_DOMAIN                 — worker.cobinar.com
-//    R2_PUBLIC_DOMAIN              — cdn.cobinar.com
-//    ADMIN_EMAIL                   — cobinar@cobinar.com
-//    MAX_UPLOAD_SIZE               — 104857600 (100 MB)
-//    COBINAR_AUTH_CLIENT_ID        — Cobinar Auth OAuth client id (public)
-//    COBINAR_AUTH_CLIENT_SECRET    — SECRET — set via `wrangler secret put`, never in this repo
-//    COBINAR_AUTH_BASE             — https://auth.cobinar.com
-//
-//  Folder layout in bucket:
-//    cobinar/posts/{postId}/{slot}-{uuid}.{ext}       ← post media
-//    cobinar/products/{productId}/{slot}-{uuid}.{ext} ← product images
-//    cobinar/projects/{projectId}/{slot}-{uuid}.{ext} ← project assets
-//    cobinar/images/{uuid}.{ext}                      ← flat image store
-//    cobinar/files/{uuid}.{ext}                       ← flat file store
+//  Everything about the dalus CLI that lives on the web: the landing page,
+//  docs, and the browser-based sign-in flow it opens (see public/login/).
+//  A standalone Worker, independent of cobinar-main — the only thing it
+//  shares with the rest of Cobinar Systems is auth.cobinar.com (the identity
+//  provider every product is a client of) and the SSO_KV binding used to
+//  hand a signed-in identity off to cobinar-developers-worker.
 //
-//  CDN delivery (once cdn.cobinar.com R2 custom domain is configured):
-//    https://cdn.cobinar.com/{key}  →  direct R2 edge (zero Worker cost)
+//  Routes:
+//    POST   /api/login/callback   — OAuth code exchange (public — a visitor
+//                                    has no session yet, this is what
+//                                    creates the SSO code for one)
+//    (anything else)              — env.ASSETS (index.html, docs, login
+//                                    pages, css)
 // ═══════════════════════════════════════════════════════════════════════════
 
-import { handleCors, corsHeaders } from './cors.js';
-import { verifyFirebaseToken }     from './auth.js';
-import { handleUpload }            from './handlers/upload.js';
-import { handleDelete }            from './handlers/delete.js';
-import { handleServe }             from './handlers/serve.js';
-import { handleHealth }            from './handlers/health.js';
-import { handleAuthCallback }      from './handlers/auth-callback.js';
-import { handleServices }          from './handlers/services.js';
+import { handleCors } from './cors.js';
+import { handleLoginCallback } from './handlers/login-callback.js';
 
 export default {
-  async fetch(request, env, ctx) {
-    const url    = new URL(request.url);
-    const path   = url.pathname;
-    const method = request.method;
-
-    // ── CORS preflight ──────────────────────────────────────────────────────
-    if (method === 'OPTIONS') return handleCors(request, env);
-
-    // ── Health check (no auth) ──────────────────────────────────────────────
-    if (path === '/health' && method === 'GET') return handleHealth(request, env);
-
-    // ── Public asset serving — CDN fallback until cdn.cobinar.com is live ───
-    if (method === 'GET' && path.startsWith('/assets/')) {
-      return handleServe(request, env, path.slice('/assets/'.length));
-    }
-
-    // ── Cobinar Auth code exchange — public. A visitor has no session yet;
-    //    this is the one request that creates one, so it can't require one. ──
-    if (path === '/api/auth/callback' && method === 'POST') {
-      return handleAuthCallback(request, env);
-    }
-    if (path === '/api/services' && method === 'GET') {
-      return handleServices(request, env);
-    }
+  async fetch(request, env) {
+    const url = new URL(request.url);
+    const { pathname } = url;
+    const { method } = request;
 
-    // ── Authenticated API routes ────────────────────────────────────────────
-    if (path.startsWith('/api/')) {
-      const token = (request.headers.get('Authorization') || '').replace(/^Bearer\s+/i, '').trim();
-      if (!token) return jsonError('Missing Authorization header', 401, env, request);
+    if (method === 'OPTIONS') return handleCors(request);
 
-      let claims;
-      try {
-        claims = await verifyFirebaseToken(token, env.FIREBASE_PROJECT_ID);
-      } catch (e) {
-        return jsonError('Invalid or expired token: ' + e.message, 401, env, request);
-      }
-
-      if (path === '/api/upload' && method === 'POST')   return handleUpload(request, env, claims);
-      if (path === '/api/delete' && method === 'DELETE') return handleDelete(request, env, claims);
-
-      return jsonError('Unknown API route', 404, env, request);
+    if (pathname === '/api/login/callback' && method === 'POST') {
+      return handleLoginCallback(request, env);
     }
 
-    // ── Everything else: hand off to static assets (site pages, css, js, icons).
-    //    Explicit here rather than relying on Cloudflare's asset-vs-worker
-    //    precedence, since that's exactly the layer that's been unreliable. ──
     return env.ASSETS.fetch(request);
   },
 };
-
-function jsonError(message, status, env, request) {
-  const origin = request?.headers?.get('Origin') || '';
-  return new Response(JSON.stringify({ ok: false, error: message }), {
-    status,
-    headers: { 'Content-Type': 'application/json', ...corsHeaders(env, origin) },
-  });
-}
-//  Created by Marc-Arthur Samuel Dalus · Cobinar Systems
-//