@cobinar/dalus 0.1.8 → 0.1.11

package/src/forgers/{workers.js → workers.mjs}

@@ -1,85 +1,85 @@
-'use strict';
-const fs = require('fs');
-const readline = require('readline');
-
-function prompt(question) {
-  const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
-  return new Promise((resolve) => rl.question(question, (answer) => { rl.close(); resolve(answer); }));
-}
-
-/** Resolves { name, type: 'storage'|'database', resource } bindings from
- * config into the { resourceId } shape the API wants, by name-matching
- * against the owner's existing buckets/collections — bindings reference
- * resources by NAME in dalus config (portable across accounts/environments),
- * but the API itself keys them by id. */
-async function resolveBindingResourceId(api, binding) {
-  const listPath = binding.type === 'storage' ? '/storage/buckets' : '/database/collections';
-  const kindLabel = binding.type === 'storage' ? 'storage bucket' : 'Document DB collection';
-  const found = await api.findByName(listPath, binding.resource);
-  if (!found) {
-    throw new Error(`Binding "${binding.name}" references ${kindLabel} "${binding.resource}", which doesn't exist yet — forge that resource first (dalus forge --storage or --database).`);
-  }
-  return found.id;
-}
-
-async function syncBindings(api, log, serviceId, bindingsConfig) {
-  if (!bindingsConfig || bindingsConfig.length === 0) return;
-  const existing = await api.get(`/services/${serviceId}/bindings`);
-  for (const binding of bindingsConfig) {
-    if (existing.some((e) => e.bindingName === binding.name)) {
-      log(`    binding ${binding.name} already exists, skipping`);
-      continue;
-    }
-    const resourceId = await resolveBindingResourceId(api, binding);
-    await api.post(`/services/${serviceId}/bindings`, {
-      bindingName: binding.name,
-      resourceType: binding.type,
-      resourceId,
-      canWrite: !!binding.canWrite,
-    });
-    log(`    bound env.${binding.name} -> ${binding.type}:${binding.resource}${binding.canWrite ? ' (read/write)' : ''}`);
-  }
-}
-
-async function syncSecrets(api, log, serviceId, secretNames, { yes }) {
-  if (!secretNames || secretNames.length === 0) return;
-  for (const name of secretNames) {
-    let value = process.env[name];
-    if (!value) {
-      if (yes) {
-        log(`    skipping secret ${name} (no ${name} env var set, and --yes disables prompting)`);
-        continue;
-      }
-      value = await prompt(`    Enter value for secret ${name} (or press Enter to skip): `);
-      if (!value) { log(`    skipped ${name}`); continue; }
-    }
-    await api.post(`/services/${serviceId}/secrets`, { name, value });
-    log(`    set secret env.${name}`);
-  }
-}
-
-/** Deploys one Edge Compute service: find-or-create by name, upload its
- * code, then sync bindings and secrets. Bindings/secrets are synced
- * every run (idempotent — see syncBindings/syncSecrets above); the code
- * upload always overwrites, same as `wrangler deploy` always overwriting
- * a Worker's script. */
-async function forgeWorker(api, log, entry, opts) {
-  log(`Edge Compute: ${entry.name}`);
-  if (!fs.existsSync(entry.main)) throw new Error(`main file not found: ${entry.main}`);
-  const code = fs.readFileSync(entry.main, 'utf8');
-
-  let svc = await api.findByName('/services', entry.name);
-  if (!svc) {
-    log(`  creating service...`);
-    svc = await api.post('/services', { name: entry.name });
-  }
-  await api.put(`/services/${svc.id}/code`, { code });
-  log(`  code uploaded (${code.length} bytes)`);
-
-  await syncBindings(api, log, svc.id, entry.bindings);
-  await syncSecrets(api, log, svc.id, entry.secrets, opts);
-
-  log(`  done -> test at ${api.apiBase}/run/${entry.name}`);
-}
-
-module.exports = { forgeWorker };
+'use strict';
+import fs from 'fs';
+import readline from 'readline';
+
+function prompt(question) {
+  const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+  return new Promise((resolve) => rl.question(question, (answer) => { rl.close(); resolve(answer); }));
+}
+
+/** Resolves { name, type: 'storage'|'database', resource } bindings from
+ * config into the { resourceId } shape the API wants, by name-matching
+ * against the owner's existing buckets/collections — bindings reference
+ * resources by NAME in dalus config (portable across accounts/environments),
+ * but the API itself keys them by id. */
+async function resolveBindingResourceId(api, binding) {
+  const listPath = binding.type === 'storage' ? '/storage/buckets' : '/database/collections';
+  const kindLabel = binding.type === 'storage' ? 'storage bucket' : 'Document DB collection';
+  const found = await api.findByName(listPath, binding.resource);
+  if (!found) {
+    throw new Error(`Binding "${binding.name}" references ${kindLabel} "${binding.resource}", which doesn't exist yet — forge that resource first (dalus forge --storage or --database).`);
+  }
+  return found.id;
+}
+
+async function syncBindings(api, log, serviceId, bindingsConfig) {
+  if (!bindingsConfig || bindingsConfig.length === 0) return;
+  const existing = await api.get(`/services/${serviceId}/bindings`);
+  for (const binding of bindingsConfig) {
+    if (existing.some((e) => e.bindingName === binding.name)) {
+      log(`    binding ${binding.name} already exists, skipping`);
+      continue;
+    }
+    const resourceId = await resolveBindingResourceId(api, binding);
+    await api.post(`/services/${serviceId}/bindings`, {
+      bindingName: binding.name,
+      resourceType: binding.type,
+      resourceId,
+      canWrite: !!binding.canWrite,
+    });
+    log(`    bound env.${binding.name} -> ${binding.type}:${binding.resource}${binding.canWrite ? ' (read/write)' : ''}`);
+  }
+}
+
+async function syncSecrets(api, log, serviceId, secretNames, { yes }) {
+  if (!secretNames || secretNames.length === 0) return;
+  for (const name of secretNames) {
+    let value = process.env[name];
+    if (!value) {
+      if (yes) {
+        log(`    skipping secret ${name} (no ${name} env var set, and --yes disables prompting)`);
+        continue;
+      }
+      value = await prompt(`    Enter value for secret ${name} (or press Enter to skip): `);
+      if (!value) { log(`    skipped ${name}`); continue; }
+    }
+    await api.post(`/services/${serviceId}/secrets`, { name, value });
+    log(`    set secret env.${name}`);
+  }
+}
+
+/** Deploys one Edge Compute service: find-or-create by name, upload its
+ * code, then sync bindings and secrets. Bindings/secrets are synced
+ * every run (idempotent — see syncBindings/syncSecrets above); the code
+ * upload always overwrites, same as `wrangler deploy` always overwriting
+ * a Worker's script. */
+async function forgeWorker(api, log, entry, opts) {
+  log(`Edge Compute: ${entry.name}`);
+  if (!fs.existsSync(entry.main)) throw new Error(`main file not found: ${entry.main}`);
+  const code = fs.readFileSync(entry.main, 'utf8');
+
+  let svc = await api.findByName('/services', entry.name);
+  if (!svc) {
+    log(`  creating service...`);
+    svc = await api.post('/services', { name: entry.name });
+  }
+  await api.put(`/services/${svc.id}/code`, { code });
+  log(`  code uploaded (${code.length} bytes)`);
+
+  await syncBindings(api, log, svc.id, entry.bindings);
+  await syncSecrets(api, log, svc.id, entry.secrets, opts);
+
+  log(`  done -> test at ${api.apiBase}/run/${entry.name}`);
+}
+
+export {  forgeWorker  };

package/src/{fs-utils.js → fs-utils.mjs}

@@ -1,36 +1,36 @@
-'use strict';
-const fs = require('fs');
-const path = require('path');
-
-/** Recursively lists every file under `dir`, returning paths relative to
- * `dir` with forward slashes (matching how the dashboard itself stores
- * Pages/Storage keys) — regardless of the host OS's own separator. */
-function walkFiles(dir) {
-  const out = [];
-  const walk = (current) => {
-    for (const entry of fs.readdirSync(current, { withFileTypes: true })) {
-      if (entry.name.startsWith('.')) continue; // .git, .DS_Store, etc.
-      const full = path.join(current, entry.name);
-      if (entry.isDirectory()) walk(full);
-      else out.push(path.relative(dir, full).split(path.sep).join('/'));
-    }
-  };
-  if (!fs.existsSync(dir)) throw new Error(`Directory not found: ${dir}`);
-  walk(dir);
-  return out;
-}
-
-const EXT_TO_CONTENT_TYPE = {
-  html: 'text/html', htm: 'text/html', css: 'text/css', js: 'application/javascript',
-  mjs: 'application/javascript', json: 'application/json', svg: 'image/svg+xml',
-  png: 'image/png', jpg: 'image/jpeg', jpeg: 'image/jpeg', gif: 'image/gif',
-  webp: 'image/webp', ico: 'image/x-icon', txt: 'text/plain', md: 'text/markdown',
-  xml: 'application/xml', pdf: 'application/pdf', woff: 'font/woff', woff2: 'font/woff2',
-};
-
-function guessContentType(filePath) {
-  const ext = path.extname(filePath).slice(1).toLowerCase();
-  return EXT_TO_CONTENT_TYPE[ext] || 'application/octet-stream';
-}
-
-module.exports = { walkFiles, guessContentType };
+'use strict';
+import fs from 'fs';
+import path from 'path';
+
+/** Recursively lists every file under `dir`, returning paths relative to
+ * `dir` with forward slashes (matching how the dashboard itself stores
+ * Pages/Storage keys) — regardless of the host OS's own separator. */
+function walkFiles(dir) {
+  const out = [];
+  const walk = (current) => {
+    for (const entry of fs.readdirSync(current, { withFileTypes: true })) {
+      if (entry.name.startsWith('.')) continue; // .git, .DS_Store, etc.
+      const full = path.join(current, entry.name);
+      if (entry.isDirectory()) walk(full);
+      else out.push(path.relative(dir, full).split(path.sep).join('/'));
+    }
+  };
+  if (!fs.existsSync(dir)) throw new Error(`Directory not found: ${dir}`);
+  walk(dir);
+  return out;
+}
+
+const EXT_TO_CONTENT_TYPE = {
+  html: 'text/html', htm: 'text/html', css: 'text/css', js: 'application/javascript',
+  mjs: 'application/javascript', json: 'application/json', svg: 'image/svg+xml',
+  png: 'image/png', jpg: 'image/jpeg', jpeg: 'image/jpeg', gif: 'image/gif',
+  webp: 'image/webp', ico: 'image/x-icon', txt: 'text/plain', md: 'text/markdown',
+  xml: 'application/xml', pdf: 'application/pdf', woff: 'font/woff', woff2: 'font/woff2',
+};
+
+function guessContentType(filePath) {
+  const ext = path.extname(filePath).slice(1).toLowerCase();
+  return EXT_TO_CONTENT_TYPE[ext] || 'application/octet-stream';
+}
+
+export {  walkFiles, guessContentType  };

package/src/handlers/login-callback.mjs

@@ -0,0 +1,143 @@
+// ═══════════════════════════════════════════════════════════════════════════
+//  src/handlers/login-callback.js — dalus.cobinar.com's OAuth code exchange
+//
+//  Fully self-contained: this worker's own client_id/secret, its own copy of
+//  the couple of small helpers it needs, nothing imported from cobinar-main's
+//  project. The only thing shared with the rest of Cobinar Systems is the
+//  identity provider itself (auth.cobinar.com — same one every Cobinar
+//  product is a client of) and the SSO-code-handoff CONTRACT: the KV key
+//  format cobinar-developers-worker's own /auth/redeem-code expects. That
+//  contract is about whose identity just signed in, not which worker or
+//  which OAuth client asked, so it needs no changes to work from here.
+//
+//  Frontend contract:
+//    POST /api/login/callback
+//      { "code": "<authorization code from ?code=>",
+//        "redirect_uri": "<the exact redirect_uri used in /oauth/authorize>" }
+//    → 200 { ok:true, user:{ uid, email, name, picture }, ssoCode:"..." }
+//    → 4xx { ok:false, error:"human readable message" }
+//
+//  Required bindings (see wrangler.jsonc / .dev.vars.example):
+//    DALUS_AUTH_CLIENT_ID, DALUS_AUTH_CLIENT_SECRET, DALUS_AUTH_BASE, SSO_KV
+// ═══════════════════════════════════════════════════════════════════════════
+
+import { corsHeaders } from '../cors.mjs';
+
+const DEFAULT_AUTH_BASE = 'https://auth.cobinar.com';
+const SSO_CODE_TTL_SECONDS = 120;
+
+export async function handleLoginCallback(request, env) {
+  const headers = { 'Content-Type': 'application/json', ...corsHeaders(request) };
+  const fail = (message, status = 400) =>
+    new Response(JSON.stringify({ ok: false, error: message }), { status, headers });
+
+  const authBase = env.DALUS_AUTH_BASE || DEFAULT_AUTH_BASE;
+  const clientId = env.DALUS_AUTH_CLIENT_ID;
+  const clientSecret = env.DALUS_AUTH_CLIENT_SECRET;
+  if (!clientId || !clientSecret) {
+    return fail('Sign-in is not configured yet on the server.', 500);
+  }
+
+  let body;
+  try {
+    body = await request.json();
+  } catch {
+    return fail('Malformed request.');
+  }
+
+  const code = typeof body?.code === 'string' ? body.code.trim() : '';
+  if (!code) return fail('Missing authorization code.');
+
+  const redirectUri = typeof body?.redirect_uri === 'string' ? body.redirect_uri.trim() : '';
+  if (!/^https:\/\/[a-zA-Z0-9.-]+(\/[^\s]*)?$/.test(redirectUri)) {
+    return fail('Missing or invalid redirect_uri.');
+  }
+
+  // ── Step 1: exchange the code for tokens (server-side only) ───────────────
+  let tokenJson;
+  try {
+    const tokenRes = await fetch(`${authBase}/oauth/token`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({
+        grant_type: 'authorization_code',
+        code,
+        client_id: clientId,
+        client_secret: clientSecret,
+        redirect_uri: redirectUri,
+      }),
+    });
+    tokenJson = await safeJson(tokenRes);
+    if (!tokenRes.ok || !tokenJson?.access_token) {
+      console.error('[login-callback] token exchange rejected:', tokenRes.status, JSON.stringify(tokenJson), 'redirect_uri sent:', redirectUri);
+      return fail(friendlyOAuthError(tokenJson), tokenRes.status === 401 ? 401 : 400);
+    }
+  } catch (err) {
+    console.error('[login-callback] token fetch threw:', err?.name, err?.message);
+    return fail('Could not reach the sign-in service. Please try again.', 502);
+  }
+
+  // ── Step 2: fetch the signed-in user's profile ─────────────────────────────
+  let userInfo;
+  try {
+    const userRes = await fetch(`${authBase}/oauth/userinfo`, {
+      headers: { Authorization: `Bearer ${tokenJson.access_token}` },
+    });
+    userInfo = await safeJson(userRes);
+    if (!userRes.ok || !userInfo) {
+      console.error('[login-callback] userinfo rejected:', userRes.status, JSON.stringify(userInfo));
+      return fail('Signed in, but could not load your profile. Please try again.', 502);
+    }
+  } catch (err) {
+    console.error('[login-callback] userinfo fetch threw:', err?.name, err?.message);
+    return fail('Signed in, but could not load your profile. Please try again.', 502);
+  }
+
+  const user = {
+    uid: userInfo.uid || userInfo.sub || null,
+    email: userInfo.email || userInfo.cobinarEmail || null,
+    name: userInfo.name || null,
+    picture: userInfo.picture || null,
+  };
+  if (!user.uid || !user.email) {
+    return fail('Sign-in succeeded but the profile was incomplete.', 502);
+  }
+
+  // ── Step 3: hand off an SSO code — cobinar-developers-worker redeems this
+  //    for the workerToken dalus actually needs; this handler never mints
+  //    one itself. ─────────────────────────────────────────────────────────
+  const ssoCode = crypto.randomUUID().replace(/-/g, '');
+  try {
+    await env.SSO_KV.put(
+      `sso:${ssoCode}`,
+      JSON.stringify({ uid: user.uid, email: user.email, name: user.name, picture: user.picture }),
+      { expirationTtl: SSO_CODE_TTL_SECONDS },
+    );
+  } catch (err) {
+    console.error('[login-callback] SSO_KV write failed:', err?.name, err?.message);
+    return fail('Signed in, but could not finish preparing your credentials. Please try again.', 502);
+  }
+
+  return new Response(JSON.stringify({ ok: true, user, ssoCode }), { status: 200, headers });
+}
+
+async function safeJson(res) {
+  try {
+    return await res.json();
+  } catch {
+    return null;
+  }
+}
+
+function friendlyOAuthError(tokenJson) {
+  switch (tokenJson?.error || '') {
+    case 'invalid_grant':
+      return 'That sign-in link expired or was already used. Please sign in again.';
+    case 'invalid_client':
+      return 'Sign-in is misconfigured on our end. Please try again later.';
+    case 'access_denied':
+      return 'Sign-in was cancelled.';
+    default:
+      return 'Could not complete sign-in. Please try again.';
+  }
+}

package/src/handlers/services.mjs

@@ -0,0 +1,45 @@
+// ═══════════════════════════════════════════════════════════════════════════
+//  src/handlers/services.js — where do Cobinar's other workers live right now
+//
+//  One JSON endpoint, backed by KV instead of source code, specifically so
+//  a worker's public URL can change WITHOUT redeploying whatever reads it —
+//  today that's the dalus CLI (an npm package, the slowest thing in this
+//  whole system to get everyone to update), so it looks this up once at the
+//  start of `dalus login` instead of shipping a fixed URL in the package.
+//
+//  GET /api/services
+//    → 200 { "dalus": "https://8bnk.dalus.cobinar.com" }
+//
+//  Values live in SSO_KV under a `service:<name>` key (the same shared
+//  namespace this worker already uses for the SSO code hand-off — reused
+//  here for a second, unrelated-but-convenient purpose: a permanent value
+//  instead of the hand-off's short-TTL ones, so give it its own key prefix
+//  to keep the two apart). Set/update one with:
+//
+//    wrangler kv key put --binding=SSO_KV "service:dalus" "https://8bnk.dalus.cobinar.com"
+//
+//  No redeploy of THIS worker needed either when a URL changes — that's the
+//  whole point. FALLBACK below is only so this endpoint returns something
+//  sane before that command has ever been run once.
+// ═══════════════════════════════════════════════════════════════════════════
+
+const FALLBACK = {
+  dalus: 'https://8bnk.dalus.cobinar.com',
+};
+
+export async function handleServices(request, env) {
+  const headers = { 'Content-Type': 'application/json', 'Cache-Control': 'public, max-age=300' };
+
+  const result = {};
+  for (const name of Object.keys(FALLBACK)) {
+    let value = null;
+    try {
+      value = await env.SSO_KV.get(`service:${name}`);
+    } catch (err) {
+      console.error('[services] KV read failed for', name, ':', err?.message);
+    }
+    result[name] = value || FALLBACK[name];
+  }
+
+  return new Response(JSON.stringify(result), { status: 200, headers });
+}

package/src/index.mjs

@@ -0,0 +1,36 @@
+// ═══════════════════════════════════════════════════════════════════════════
+//  src/index.js — dalus.cobinar.com · Entry Point
+//
+//  Everything about the dalus CLI that lives on the web: the landing page,
+//  docs, and the browser-based sign-in flow it opens (see public/login/).
+//  A standalone Worker, independent of cobinar-main — the only thing it
+//  shares with the rest of Cobinar Systems is auth.cobinar.com (the identity
+//  provider every product is a client of) and the SSO_KV binding used to
+//  hand a signed-in identity off to cobinar-developers-worker.
+//
+//  Routes:
+//    POST   /api/login/callback   — OAuth code exchange (public — a visitor
+//                                    has no session yet, this is what
+//                                    creates the SSO code for one)
+//    (anything else)              — env.ASSETS (index.html, docs, login
+//                                    pages, css)
+// ═══════════════════════════════════════════════════════════════════════════
+
+import { handleCors } from './cors.mjs';
+import { handleLoginCallback } from './handlers/login-callback.mjs';
+
+export default {
+  async fetch(request, env) {
+    const url = new URL(request.url);
+    const { pathname } = url;
+    const { method } = request;
+
+    if (method === 'OPTIONS') return handleCors(request);
+
+    if (pathname === '/api/login/callback' && method === 'POST') {
+      return handleLoginCallback(request, env);
+    }
+
+    return env.ASSETS.fetch(request);
+  },
+};

package/src/auth.js

@@ -1,78 +0,0 @@
-// src/auth.js
-
-const GOOGLE_JWK_URL = 'https://www.googleapis.com/service_accounts/v1/jwk/securetoken@system.gserviceaccount.com';
-
-let _keyCache = null;
-let _cacheExpires = 0;
-
-async function getVerificationKeys() {
-  const now = Date.now();
-  if (_keyCache && now < _cacheExpires) return _keyCache;
-
-  const res = await fetch(GOOGLE_JWK_URL);
-  if (!res.ok) throw new Error('Failed to fetch Firebase JWKs');
-  const jwks = await res.json();
-
-  const cc = res.headers.get('Cache-Control') || '';
-  const maxAge = parseInt((cc.match(/max-age=(\d+)/) || [, '3600'])[1], 10);
-  _cacheExpires = now + maxAge * 1000;
-
-  _keyCache = new Map();
-  await Promise.all(
-    (jwks.keys || []).map(async (jwk) => {
-      const key = await crypto.subtle.importKey(
-        'jwk',
-        jwk,
-        { name: 'RSASSA-PKCS1-v1_5', hash: 'SHA-256' },
-        false,
-        ['verify'],
-      );
-      _keyCache.set(jwk.kid, key);
-    }),
-  );
-  return _keyCache;
-}
-
-function base64urlDecode(str) {
-  const b64 = str.replace(/-/g, '+').replace(/_/g, '/');
-  const padded = b64 + '='.repeat((4 - (b64.length % 4)) % 4);
-  return Uint8Array.from(atob(padded), (c) => c.charCodeAt(0));
-}
-
-function b64DecodeJson(b64url) {
-  return JSON.parse(new TextDecoder().decode(base64urlDecode(b64url)));
-}
-
-export async function verifyFirebaseToken(idToken, projectId) {
-  const parts = idToken.split('.');
-  if (parts.length !== 3) throw new Error('Malformed JWT: expected 3 segments');
-  const [headerB64, payloadB64, sigB64] = parts;
-
-  let header, payload;
-  try {
-    header = b64DecodeJson(headerB64);
-    payload = b64DecodeJson(payloadB64);
-  } catch {
-    throw new Error('Could not decode JWT segments');
-  }
-
-  const now = Math.floor(Date.now() / 1000);
-  if (header.alg !== 'RS256') throw new Error(`Unexpected algorithm: ${header.alg}`);
-  if (payload.aud !== projectId) throw new Error(`Invalid audience: expected "${projectId}", got "${payload.aud}"`);
-  if (payload.iss !== `https://securetoken.google.com/${projectId}`) throw new Error('Invalid issuer');
-  if (payload.exp < now) throw new Error('Token expired');
-  if (payload.iat > now + 60) throw new Error('Token issued in the future — clock skew too large');
-  if (!payload.sub) throw new Error('Missing subject claim');
-
-  const keys = await getVerificationKeys();
-  const key = keys.get(header.kid);
-  if (!key) throw new Error(`Unknown key ID: ${header.kid}`);
-
-  const signingInput = new TextEncoder().encode(`${headerB64}.${payloadB64}`);
-  const signature = base64urlDecode(sigB64);
-  const valid = await crypto.subtle.verify('RSASSA-PKCS1-v1_5', key, signature, signingInput);
-  if (!valid) throw new Error('Signature verification failed');
-
-  payload.uid = payload.sub || payload.user_id;
-  return payload;
-}

package/src/commands/auth.js

@@ -1,78 +0,0 @@
-// src/auth.js
-
-const GOOGLE_JWK_URL = 'https://www.googleapis.com/service_accounts/v1/jwk/securetoken@system.gserviceaccount.com';
-
-let _keyCache = null;
-let _cacheExpires = 0;
-
-async function getVerificationKeys() {
-  const now = Date.now();
-  if (_keyCache && now < _cacheExpires) return _keyCache;
-
-  const res = await fetch(GOOGLE_JWK_URL);
-  if (!res.ok) throw new Error('Failed to fetch Firebase JWKs');
-  const jwks = await res.json();
-
-  const cc = res.headers.get('Cache-Control') || '';
-  const maxAge = parseInt((cc.match(/max-age=(\d+)/) || [, '3600'])[1], 10);
-  _cacheExpires = now + maxAge * 1000;
-
-  _keyCache = new Map();
-  await Promise.all(
-    (jwks.keys || []).map(async (jwk) => {
-      const key = await crypto.subtle.importKey(
-        'jwk',
-        jwk,
-        { name: 'RSASSA-PKCS1-v1_5', hash: 'SHA-256' },
-        false,
-        ['verify'],
-      );
-      _keyCache.set(jwk.kid, key);
-    }),
-  );
-  return _keyCache;
-}
-
-function base64urlDecode(str) {
-  const b64 = str.replace(/-/g, '+').replace(/_/g, '/');
-  const padded = b64 + '='.repeat((4 - (b64.length % 4)) % 4);
-  return Uint8Array.from(atob(padded), (c) => c.charCodeAt(0));
-}
-
-function b64DecodeJson(b64url) {
-  return JSON.parse(new TextDecoder().decode(base64urlDecode(b64url)));
-}
-
-export async function verifyFirebaseToken(idToken, projectId) {
-  const parts = idToken.split('.');
-  if (parts.length !== 3) throw new Error('Malformed JWT: expected 3 segments');
-  const [headerB64, payloadB64, sigB64] = parts;
-
-  let header, payload;
-  try {
-    header = b64DecodeJson(headerB64);
-    payload = b64DecodeJson(payloadB64);
-  } catch {
-    throw new Error('Could not decode JWT segments');
-  }
-
-  const now = Math.floor(Date.now() / 1000);
-  if (header.alg !== 'RS256') throw new Error(`Unexpected algorithm: ${header.alg}`);
-  if (payload.aud !== projectId) throw new Error(`Invalid audience: expected "${projectId}", got "${payload.aud}"`);
-  if (payload.iss !== `https://securetoken.google.com/${projectId}`) throw new Error('Invalid issuer');
-  if (payload.exp < now) throw new Error('Token expired');
-  if (payload.iat > now + 60) throw new Error('Token issued in the future — clock skew too large');
-  if (!payload.sub) throw new Error('Missing subject claim');
-
-  const keys = await getVerificationKeys();
-  const key = keys.get(header.kid);
-  if (!key) throw new Error(`Unknown key ID: ${header.kid}`);
-
-  const signingInput = new TextEncoder().encode(`${headerB64}.${payloadB64}`);
-  const signature = base64urlDecode(sigB64);
-  const valid = await crypto.subtle.verify('RSASSA-PKCS1-v1_5', key, signature, signingInput);
-  if (!valid) throw new Error('Signature verification failed');
-
-  payload.uid = payload.sub || payload.user_id;
-  return payload;
-}

package/src/commands/cors.js

@@ -1,34 +0,0 @@
-// src/cors.js
-
-export function getAllowedOrigins(env) {
-  return (env.ALLOWED_ORIGINS || '')
-    .split(/[,\n\r]+/)
-    .map((o) => o.trim())
-    .map((o) => o.replace(/[\r\n\t\x00-\x1F\x7F]/g, ''))
-    .filter((o) => /^https?:\/\/[a-zA-Z0-9.-]+(:\d+)?$/.test(o));
-}
-
-export function corsHeaders(env, requestOrigin = '') {
-  const allowed = getAllowedOrigins(env);
-  const origin = allowed.includes(requestOrigin) ? requestOrigin : allowed[0] || '';
-  const headers = {
-    'Access-Control-Allow-Methods': 'GET, POST, DELETE, OPTIONS',
-    'Access-Control-Allow-Headers': 'Content-Type, Authorization, X-Requested-With',
-    'Access-Control-Expose-Headers': 'X-Upload-Key, X-Served-By',
-    Vary: 'Origin',
-  };
-  if (origin) {
-    headers['Access-Control-Allow-Origin'] = origin;
-    headers['Access-Control-Allow-Credentials'] = 'true';
-    headers['Access-Control-Max-Age'] = '86400';
-  }
-  return headers;
-}
-
-export function handleCors(request, env) {
-  const origin = request.headers.get('Origin') || '';
-  return new Response(null, {
-    status: 204,
-    headers: corsHeaders(env, origin),
-  });
-}