@cobinar/dalus 0.1.8 → 0.1.11

package/src/commands/index.js

@@ -1,115 +0,0 @@
-// ═══════════════════════════════════════════════════════════════════════════
-//  src/index.js — Cobinar R2 Worker · Entry Point
-//  Created by Marc-Arthur Samuel Dalus · Cobinar Systems
-//
-//  Routes:
-//    GET    /health              — Uptime check (no auth)
-//    GET    /assets/:key         — Stream public R2 asset (CDN fallback)
-//    POST   /api/auth/callback   — Cobinar Auth (OAuth) code exchange (public —
-//                                  this is how a visitor becomes authenticated)
-//    GET    /api/services         — where Cobinar's other workers currently
-//                                  live (public, read-only; see that
-//                                  handler for why this is KV-backed)
-//    POST   /api/upload          — Upload file to R2 (Firebase auth + admin only)
-//    DELETE /api/delete          — Delete R2 object (Firebase auth + admin only)
-//    (anything else)             — Delegated to env.ASSETS (the site in ./public)
-//
-//  assets.run_worker_first is set to `true` (unconditional) rather than a
-//  glob-pattern array scoped to /api/* — Cloudflare's asset-vs-worker
-//  precedence for that project turned out to return 405 for every method
-//  other than GET regardless of pattern, so this Worker now runs for every
-//  request and explicitly hands off anything it doesn't recognize to
-//  env.ASSETS.fetch(request) itself, rather than depending on that layer.
-//
-//  Bindings (wrangler.toml):
-//    COBINAR_R2          R2Bucket  — cobinar bucket
-//    FIREBASE_PROJECT_ID           — cobinar-prod
-//    ALLOWED_ORIGINS               — CORS allowlist
-//    WORKER_DOMAIN                 — worker.cobinar.com
-//    R2_PUBLIC_DOMAIN              — cdn.cobinar.com
-//    ADMIN_EMAIL                   — cobinar@cobinar.com
-//    MAX_UPLOAD_SIZE               — 104857600 (100 MB)
-//    COBINAR_AUTH_CLIENT_ID        — Cobinar Auth OAuth client id (public)
-//    COBINAR_AUTH_CLIENT_SECRET    — SECRET — set via `wrangler secret put`, never in this repo
-//    COBINAR_AUTH_BASE             — https://auth.cobinar.com
-//
-//  Folder layout in bucket:
-//    cobinar/posts/{postId}/{slot}-{uuid}.{ext}       ← post media
-//    cobinar/products/{productId}/{slot}-{uuid}.{ext} ← product images
-//    cobinar/projects/{projectId}/{slot}-{uuid}.{ext} ← project assets
-//    cobinar/images/{uuid}.{ext}                      ← flat image store
-//    cobinar/files/{uuid}.{ext}                       ← flat file store
-//
-//  CDN delivery (once cdn.cobinar.com R2 custom domain is configured):
-//    https://cdn.cobinar.com/{key}  →  direct R2 edge (zero Worker cost)
-// ═══════════════════════════════════════════════════════════════════════════
-
-import { handleCors, corsHeaders } from './cors.js';
-import { verifyFirebaseToken }     from './auth.js';
-import { handleUpload }            from './handlers/upload.js';
-import { handleDelete }            from './handlers/delete.js';
-import { handleServe }             from './handlers/serve.js';
-import { handleHealth }            from './handlers/health.js';
-import { handleAuthCallback }      from './handlers/auth-callback.js';
-import { handleServices }          from './handlers/services.js';
-
-export default {
-  async fetch(request, env, ctx) {
-    const url    = new URL(request.url);
-    const path   = url.pathname;
-    const method = request.method;
-
-    // ── CORS preflight ──────────────────────────────────────────────────────
-    if (method === 'OPTIONS') return handleCors(request, env);
-
-    // ── Health check (no auth) ──────────────────────────────────────────────
-    if (path === '/health' && method === 'GET') return handleHealth(request, env);
-
-    // ── Public asset serving — CDN fallback until cdn.cobinar.com is live ───
-    if (method === 'GET' && path.startsWith('/assets/')) {
-      return handleServe(request, env, path.slice('/assets/'.length));
-    }
-
-    // ── Cobinar Auth code exchange — public. A visitor has no session yet;
-    //    this is the one request that creates one, so it can't require one. ──
-    if (path === '/api/auth/callback' && method === 'POST') {
-      return handleAuthCallback(request, env);
-    }
-    if (path === '/api/services' && method === 'GET') {
-      return handleServices(request, env);
-    }
-
-    // ── Authenticated API routes ────────────────────────────────────────────
-    if (path.startsWith('/api/')) {
-      const token = (request.headers.get('Authorization') || '').replace(/^Bearer\s+/i, '').trim();
-      if (!token) return jsonError('Missing Authorization header', 401, env, request);
-
-      let claims;
-      try {
-        claims = await verifyFirebaseToken(token, env.FIREBASE_PROJECT_ID);
-      } catch (e) {
-        return jsonError('Invalid or expired token: ' + e.message, 401, env, request);
-      }
-
-      if (path === '/api/upload' && method === 'POST')   return handleUpload(request, env, claims);
-      if (path === '/api/delete' && method === 'DELETE') return handleDelete(request, env, claims);
-
-      return jsonError('Unknown API route', 404, env, request);
-    }
-
-    // ── Everything else: hand off to static assets (site pages, css, js, icons).
-    //    Explicit here rather than relying on Cloudflare's asset-vs-worker
-    //    precedence, since that's exactly the layer that's been unreliable. ──
-    return env.ASSETS.fetch(request);
-  },
-};
-
-function jsonError(message, status, env, request) {
-  const origin = request?.headers?.get('Origin') || '';
-  return new Response(JSON.stringify({ ok: false, error: message }), {
-    status,
-    headers: { 'Content-Type': 'application/json', ...corsHeaders(env, origin) },
-  });
-}
-//  Created by Marc-Arthur Samuel Dalus · Cobinar Systems
-//

package/src/commands/login.js

@@ -1,288 +0,0 @@
-'use strict';
-const http = require('http');
-const crypto = require('crypto');
-const readline = require('readline');
-const { execFile } = require('child_process');
-const { saveCredentials, clearCredentials, loadCredentials, CREDENTIALS_PATH } = require('../config');
-
-// Where dalus's OWN worker (the login page this opens) currently lives is
-// looked up here, not hardcoded — see cobinar's src/handlers/services.js.
-// That's the one, deliberately-fixed anchor point everything else in this
-// file is relative to; if IT ever needs to move, that's a cobinar.com
-// redeploy, not a new npm release everyone has to go update.
-const SERVICES_ENDPOINT = 'https://8bnk.dalus.cobinar.com';
-// Only used if the discovery call above fails outright (a network hiccup,
-// cobinar.com briefly unreachable) -- not the source of truth, just keeps
-// `dalus login` from being completely dead during a transient outage of
-// that one lookup. --web-base always wins over both.
-const FALLBACK_DALUS_BASE = 'https://8bnk.dalus.cobinar.com';
-// cobinar-developers-worker — mints the actual bearer token dashboard-worker
-// checks (a signed "workerToken"), from the one-time code dalus's own
-// worker hands us. Not the same thing as dalus.cobinar.com itself or as
-// auth.cobinar.com (Cobinar's general sign-in provider, which dalus's
-// worker is one client of) — those are three separate services. See the
-// comment on exchangeSsoCode below for the exact handoff.
-const DEFAULT_DEVELOPERS_BASE = 'https://worker.dashboard.cobinar.com';
-const LOGIN_TIMEOUT_MS = 5 * 60 * 1000;
-
-function ask(question) {
-  return new Promise((resolve) => {
-    const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
-    rl.question(question, (answer) => { rl.close(); resolve(answer.trim()); });
-  });
-}
-
-function openBrowser(url) {
-  // execFile, not exec — no shell involved for the process WE spawn. That
-  // alone isn't quite enough on Windows: `cmd /c start` hands its arguments
-  // to cmd.exe's OWN re-parsing of the whole line as a new command, where an
-  // unescaped "&" means "run two commands", not "a literal character in a
-  // URL" — which is exactly what truncated a real sign-in URL at its first
-  // "&" here before. rundll32 is a normal Win32 program, not a shell, so it
-  // never re-interprets "&" (or anything else) in its argument at all.
-  const done = () => {}; // best-effort; the URL is always printed too
-  if (process.platform === 'darwin') execFile('open', [url], done);
-  else if (process.platform === 'win32') execFile('rundll32', ['url.dll,FileProtocolHandler', url], done);
-  else execFile('xdg-open', [url], done);
-}
-
-const REQUEST_TIMEOUT_MS = 8000;
-
-function getJson(urlString) {
-  return new Promise((resolve, reject) => {
-    const url = new URL(urlString);
-    const req = require(url.protocol === 'http:' ? 'http' : 'https')
-      .get(url, (res) => {
-        let out = '';
-        res.on('data', (c) => (out += c));
-        res.on('end', () => {
-          let parsed = null;
-          try { parsed = JSON.parse(out); } catch { /* leaves parsed null below */ }
-          resolve({ status: res.statusCode, json: parsed });
-        });
-      })
-      .on('error', reject);
-    req.setTimeout(REQUEST_TIMEOUT_MS, () => req.destroy(new Error('Request timed out')));
-  });
-}
-
-// The one lookup this whole file depends on: where does dalus's own worker
-// (the login page browserLogin below sends people to) currently live. See
-// SERVICES_ENDPOINT's comment above for why this is a runtime fetch and not
-// a constant.
-async function discoverDalusBase() {
-  try {
-    const { status, json } = await getJson(SERVICES_ENDPOINT);
-    if (status === 200 && json && typeof json.dalus === 'string' && json.dalus) {
-      return json.dalus;
-    }
-  } catch {
-    // Falls through to FALLBACK_DALUS_BASE below.
-  }
-  return FALLBACK_DALUS_BASE;
-}
-
-function postJson(urlString, body) {
-  return new Promise((resolve, reject) => {
-    const url = new URL(urlString);
-    const data = JSON.stringify(body);
-    const req = require(url.protocol === 'http:' ? 'http' : 'https').request(
-      {
-        hostname: url.hostname,
-        port: url.port || (url.protocol === 'http:' ? 80 : 443),
-        path: url.pathname + url.search,
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(data) },
-      },
-      (res) => {
-        let out = '';
-        res.on('data', (c) => (out += c));
-        res.on('end', () => {
-          let parsed = null;
-          try { parsed = JSON.parse(out); } catch { /* leaves parsed null below */ }
-          resolve({ status: res.statusCode, json: parsed });
-        });
-      },
-    );
-    req.on('error', reject);
-    req.setTimeout(REQUEST_TIMEOUT_MS, () => req.destroy(new Error('Request timed out')));
-    req.write(data);
-    req.end();
-  });
-}
-
-// The other half of cobinar-developers-worker's POST /auth/redeem-code:
-// cobinar.com's callback page writes { uid, email, name, picture } to a KV
-// namespace it shares with cobinar-developers-worker, keyed by a one-time
-// code, and hands US that code (over the loopback server below, once the
-// browser gets there). Redeeming it here — not on cobinar.com's server, and
-// not in the browser — is what actually mints the workerToken dashboard-
-// worker will accept; nothing before this point has needed dashboard-worker
-// to trust anything, since a workerToken is the first credential in this
-// whole flow it actually checks.
-async function exchangeSsoCode(developersBase, code) {
-  const { status, json } = await postJson(`${developersBase}/auth/redeem-code`, { code });
-  if (status !== 200 || !json || typeof json.workerToken !== 'string') {
-    const detail = json && json.error ? json.error : `HTTP ${status}`;
-    throw new Error(`Could not finish signing in (${detail}). Run "dalus login" again.`);
-  }
-  return json;
-}
-
-// Starts a one-shot local server, opens dalus's own worker (wherever
-// discoverDalusBase() says it currently lives) to sign in, and waits for
-// its /login/callback page to POST a one-time SSO code back here once the
-// auth.cobinar.com round trip finishes. dalus's worker has its own
-// client_id/secret, registered independently of cobinar.com's — see that
-// worker's public/login/index.html and public/login/callback.html for the
-// other half of this handshake, and exchangeSsoCode above for what happens
-// to the code once it arrives here.
-function browserLogin(webBase, developersBase) {
-  // "ls" (local state): proves the browser tab that finishes is the one
-  // THIS process opened, not some other local process guessing the port
-  // and racing it — the port alone isn't a secret (any local process can
-  // see what's listening), this is.
-  const ls = crypto.randomBytes(24).toString('hex');
-  const allowedOrigin = new URL(webBase).origin;
-
-  return new Promise((resolve, reject) => {
-    let settled = false;
-
-    const server = http.createServer((req, res) => {
-      const url = new URL(req.url, 'http://127.0.0.1');
-      res.setHeader('Access-Control-Allow-Origin', allowedOrigin);
-      res.setHeader('Access-Control-Allow-Methods', 'POST, OPTIONS');
-      res.setHeader('Access-Control-Allow-Headers', 'Content-Type');
-
-      if (req.method === 'OPTIONS') { res.writeHead(204); res.end(); return; }
-      if (url.pathname !== '/complete' || req.method !== 'POST') { res.writeHead(404); res.end(); return; }
-
-      let body = '';
-      req.on('data', (chunk) => {
-        body += chunk;
-        if (body.length > 1e6) req.destroy(); // this payload is a short code + a small profile, never anywhere near this size
-      });
-      req.on('end', async () => {
-        let parsed = null;
-        try { parsed = JSON.parse(body); } catch { /* falls through to the ok:false below */ }
-
-        if (!parsed || parsed.ls !== ls || typeof parsed.code !== 'string' || !parsed.code) {
-          res.writeHead(400, { 'Content-Type': 'application/json' });
-          res.end(JSON.stringify({ ok: false }));
-          return; // deliberately not finish()/reject() here — a stray or malicious request to this port shouldn't cancel a login still in progress
-        }
-
-        try {
-          const redeemed = await exchangeSsoCode(developersBase, parsed.code);
-          res.writeHead(200, { 'Content-Type': 'application/json' });
-          res.end(JSON.stringify({ ok: true }));
-          finish(null, {
-            token: redeemed.workerToken,
-            user: parsed.user || { email: redeemed.cobinarEmail, name: redeemed.displayName, picture: redeemed.photoURL },
-          });
-        } catch (err) {
-          res.writeHead(502, { 'Content-Type': 'application/json' });
-          res.end(JSON.stringify({ ok: false, error: err.message }));
-          finish(err);
-        }
-      });
-    });
-
-    function finish(err, result) {
-      if (settled) return;
-      settled = true;
-      clearTimeout(timer);
-      server.close();
-      if (err) reject(err); else resolve(result);
-    }
-
-    const timer = setTimeout(() => {
-      finish(new Error(`Timed out waiting for sign-in (${LOGIN_TIMEOUT_MS / 1000}s). Run "dalus login" again.`));
-    }, LOGIN_TIMEOUT_MS);
-
-    server.on('error', (err) => finish(err));
-
-    server.listen(0, '127.0.0.1', () => {
-      const port = server.address().port;
-      // port and ls travel together as one opaque value, not two params
-      // joined by "&" — see openBrowser's comment above for exactly why
-      // that character caused real trouble here. Neither value can ever
-      // contain a "." (port is digits, ls is hex), so joining/splitting on
-      // it is unambiguous. The trailing slash on /login/ is deliberate
-      // too: requesting the bare path and hoping a redirect adds the slash
-      // back is one more hop that could, in principle, drop the query
-      // string — this just starts at the real address.
-      const loginUrl = `${webBase}/login/?d=${port}.${ls}`;
-      console.log('Opening your browser to sign in with Cobinar...');
-      console.log(`If it doesn't open automatically, visit:\n  ${loginUrl}\n`);
-      openBrowser(loginUrl);
-    });
-  });
-}
-
-async function loginCommand(args) {
-  if (args.includes('--logout')) {
-    clearCredentials();
-    console.log('Logged out.');
-    return;
-  }
-  if (args.includes('--whoami')) {
-    const creds = loadCredentials();
-    if (!creds) { console.log('Not logged in.'); return; }
-    console.log(`API base: ${creds.apiBase}`);
-    if (creds.user && creds.user.email) console.log(`Signed in as: ${creds.user.email}`);
-    console.log(`Token:    ${creds.token.slice(0, 8)}...${creds.token.slice(-4)} (stored in ${CREDENTIALS_PATH})`);
-    console.log('Note: this token expires 2 hours after signing in — "dalus login" again once it does.');
-    return;
-  }
-
-  const tokenArgIdx = args.indexOf('--token');
-  const apiBaseArgIdx = args.indexOf('--api-base');
-
-  // --token stays as a manual escape hatch for CI/headless boxes that
-  // can't open a browser at all — not the default anymore, but not worth
-  // removing until there's a real headless flow (one-time code / email,
-  // planned later) to replace it with.
-  if (tokenArgIdx !== -1) {
-    const token = args[tokenArgIdx + 1];
-    const apiBase = apiBaseArgIdx !== -1 ? args[apiBaseArgIdx + 1] : await ask('Cobinar dashboard-worker URL: ');
-    if (!token || !apiBase) {
-      console.error('Both a worker URL and a token are required.');
-      process.exitCode = 1;
-      return;
-    }
-    saveCredentials({ apiBase: apiBase.replace(/\/$/, ''), token });
-    console.log(`Saved to ${CREDENTIALS_PATH}. Run "dalus forge" from a project directory to deploy.`);
-    return;
-  }
-
-  const webBaseArgIdx = args.indexOf('--web-base');
-  const webBase = (webBaseArgIdx !== -1 ? args[webBaseArgIdx + 1] : await discoverDalusBase()).replace(/\/$/, '');
-  const developersBaseArgIdx = args.indexOf('--developers-base');
-  const developersBase = (developersBaseArgIdx !== -1 ? args[developersBaseArgIdx + 1] : DEFAULT_DEVELOPERS_BASE).replace(/\/$/, '');
-
-  let result;
-  try {
-    result = await browserLogin(webBase, developersBase);
-  } catch (err) {
-    console.error(err.message);
-    process.exitCode = 1;
-    return;
-  }
-
-  const apiBase = apiBaseArgIdx !== -1
-    ? args[apiBaseArgIdx + 1]
-    : await ask('Cobinar dashboard-worker URL (e.g. https://worker.lobby.cobinar.com): ');
-  if (!apiBase) {
-    console.error('A dashboard-worker URL is required.');
-    process.exitCode = 1;
-    return;
-  }
-
-  saveCredentials({ apiBase: apiBase.replace(/\/$/, ''), token: result.token, user: result.user || null });
-  console.log(`Signed in${result.user && result.user.email ? ' as ' + result.user.email : ''}. Saved to ${CREDENTIALS_PATH}.`);
-  console.log('This session lasts 2 hours — "dalus login" again once it expires.');
-  console.log('Run "dalus forge" from a project directory to deploy.');
-}
-
-module.exports = { loginCommand, browserLogin, exchangeSsoCode, discoverDalusBase };

package/src/commands/storage.js

@@ -1,72 +0,0 @@
-// src/storage.js
-import { generateId } from './utils.js';
-
-const FOLDER_COLLECTIONS = new Set(['posts', 'products', 'projects']);
-const FLAT_COLLECTIONS = new Set(['images', 'files']);
-export const ALL_COLLECTIONS = new Set([...FOLDER_COLLECTIONS, ...FLAT_COLLECTIONS]);
-export { FOLDER_COLLECTIONS, FLAT_COLLECTIONS };
-
-export function generateUploadPath(collection, entityId, ext, slot) {
-  const uid = generateId();
-  if (FLAT_COLLECTIONS.has(collection)) {
-    return `cobinar/${collection}/${uid}.${ext.toLowerCase()}`;
-  }
-  const prefix = slot ? `${slot}-${uid}` : uid;
-  return `cobinar/${collection}/${entityId}/${prefix}.${ext.toLowerCase()}`;
-}
-
-export async function uploadFile(bucket, key, body, contentType, metadata = {}) {
-  await bucket.put(key, body, {
-    httpMetadata: {
-      contentType,
-      cacheControl: 'public, max-age=31536000, immutable',
-    },
-    customMetadata: {
-      uploadedAt: new Date().toISOString(),
-      ...sanitizeMetadata(metadata),
-    },
-  });
-  return { key };
-}
-
-export async function deleteFiles(bucket, keys) {
-  if (!keys || keys.length === 0) return;
-  await bucket.delete(keys);
-}
-
-export async function streamFile(bucket, key, extraHeaders = {}) {
-  const object = await bucket.get(key);
-  if (!object) {
-    return new Response(JSON.stringify({ ok: false, error: 'File not found' }), {
-      status: 404,
-      headers: { 'Content-Type': 'application/json' },
-    });
-  }
-  const headers = new Headers({
-    'Content-Type': object.httpMetadata?.contentType || 'application/octet-stream',
-    'Cache-Control': 'public, max-age=31536000, immutable',
-    ETag: object.etag,
-    'Last-Modified': object.uploaded?.toUTCString() || '',
-    'X-Served-By': 'cobinar-r2',
-    ...extraHeaders,
-  });
-  return new Response(object.body, { headers });
-}
-
-export function getPublicUrl(key, env) {
-  if (env.R2_PUBLIC_DOMAIN) {
-    return `https://${env.R2_PUBLIC_DOMAIN}/${key}`;
-  }
-  const domain = env.WORKER_DOMAIN || 'cobinar-r2.workers.dev';
-  return `https://${domain}/assets/${key}`;
-}
-
-function sanitizeMetadata(obj) {
-  const out = {};
-  for (const [k, v] of Object.entries(obj)) {
-    if (v !== null && v !== undefined) {
-      out[k] = String(v);
-    }
-  }
-  return out;
-}

package/src/commands/utils.js

@@ -1,7 +0,0 @@
-// src/utils.js
-
-export function generateId() {
-  const buf = new Uint8Array(8);
-  crypto.getRandomValues(buf);
-  return Array.from(buf, (b) => b.toString(16).padStart(2, '0')).join('').slice(0, 12);
-}

package/src/commands/validators.js

@@ -1,101 +0,0 @@
-// src/validators.js
-
-export const ALLOWED_TYPES = {
-  image: {
-    mimes: ['image/jpeg', 'image/png', 'image/webp', 'image/gif', 'image/avif', 'image/svg+xml'],
-    extensions: ['jpg', 'jpeg', 'png', 'webp', 'gif', 'avif', 'svg'],
-    maxBytes: 25 * 1024 * 1024,
-    label: 'Image',
-  },
-  projectImage: {
-    mimes: ['image/jpeg', 'image/png', 'image/webp', 'image/avif'],
-    extensions: ['jpg', 'jpeg', 'png', 'webp', 'avif'],
-    maxBytes: 10 * 1024 * 1024,
-    label: 'Project image',
-  },
-  productImage: {
-    mimes: ['image/jpeg', 'image/png', 'image/webp', 'image/avif'],
-    extensions: ['jpg', 'jpeg', 'png', 'webp', 'avif'],
-    maxBytes: 10 * 1024 * 1024,
-    label: 'Product image',
-  },
-  postMedia: {
-    mimes: [
-      'image/jpeg', 'image/png', 'image/webp', 'image/gif', 'image/avif',
-      'video/mp4', 'video/webm', 'video/quicktime', 'application/pdf',
-    ],
-    extensions: ['jpg', 'jpeg', 'png', 'webp', 'gif', 'avif', 'mp4', 'webm', 'mov', 'pdf'],
-    maxBytes: 50 * 1024 * 1024,
-    label: 'Post media',
-  },
-  file: {
-    mimes: [
-      'application/pdf', 'application/zip', 'application/x-zip-compressed',
-      'application/octet-stream', 'text/plain', 'text/csv',
-      'application/vnd.ms-excel',
-      'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet',
-      'application/msword',
-      'application/vnd.openxmlformats-officedocument.wordprocessingml.document',
-      'application/json',
-    ],
-    extensions: ['pdf', 'zip', 'txt', 'csv', 'xls', 'xlsx', 'doc', 'docx', 'json', 'bin'],
-    maxBytes: 100 * 1024 * 1024,
-    label: 'File',
-  },
-};
-
-export const DEFAULT_RULE = {
-  posts: 'postMedia',
-  products: 'productImage',
-  projects: 'projectImage',
-  images: 'image',
-  files: 'file',
-};
-
-export function validateFile(mimeType, sizeBytes, filename, ruleName) {
-  const rule = ALLOWED_TYPES[ruleName];
-  if (!rule) return { valid: false, error: `Unknown validation rule: "${ruleName}"` };
-
-  const baseMime = mimeType.split(';')[0].trim().toLowerCase();
-  if (!rule.mimes.includes(baseMime)) {
-    return { valid: false, error: `${rule.label} must be one of: ${rule.mimes.join(', ')}. Got: ${baseMime}` };
-  }
-
-  const rawExt = (filename.split('.').pop() || '').toLowerCase();
-  if (!rule.extensions.includes(rawExt)) {
-    return { valid: false, error: `${rule.label} extension must be .${rule.extensions.join(', .')}. Got: .${rawExt}` };
-  }
-
-  if (sizeBytes > rule.maxBytes) {
-    const maxMb = (rule.maxBytes / 1024 / 1024).toFixed(0);
-    const gotMb = (sizeBytes / 1024 / 1024).toFixed(1);
-    return { valid: false, error: `${rule.label} must be under ${maxMb} MB. Got: ${gotMb} MB` };
-  }
-
-  return { valid: true, ext: rawExt };
-}
-
-export function extFromMime(mimeType) {
-  const map = {
-    'image/jpeg': 'jpg',
-    'image/png': 'png',
-    'image/webp': 'webp',
-    'image/gif': 'gif',
-    'image/avif': 'avif',
-    'image/svg+xml': 'svg',
-    'video/mp4': 'mp4',
-    'video/webm': 'webm',
-    'video/quicktime': 'mov',
-    'application/pdf': 'pdf',
-    'application/zip': 'zip',
-    'application/x-zip-compressed': 'zip',
-    'text/plain': 'txt',
-    'text/csv': 'csv',
-    'application/vnd.ms-excel': 'xls',
-    'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet': 'xlsx',
-    'application/msword': 'doc',
-    'application/vnd.openxmlformats-officedocument.wordprocessingml.document': 'docx',
-    'application/json': 'json',
-  };
-  return map[mimeType.split(';')[0].trim().toLowerCase()] || 'bin';
-}

package/src/cors.js

@@ -1,34 +0,0 @@
-// src/cors.js
-
-export function getAllowedOrigins(env) {
-  return (env.ALLOWED_ORIGINS || '')
-    .split(/[,\n\r]+/)
-    .map((o) => o.trim())
-    .map((o) => o.replace(/[\r\n\t\x00-\x1F\x7F]/g, ''))
-    .filter((o) => /^https?:\/\/[a-zA-Z0-9.-]+(:\d+)?$/.test(o));
-}
-
-export function corsHeaders(env, requestOrigin = '') {
-  const allowed = getAllowedOrigins(env);
-  const origin = allowed.includes(requestOrigin) ? requestOrigin : allowed[0] || '';
-  const headers = {
-    'Access-Control-Allow-Methods': 'GET, POST, DELETE, OPTIONS',
-    'Access-Control-Allow-Headers': 'Content-Type, Authorization, X-Requested-With',
-    'Access-Control-Expose-Headers': 'X-Upload-Key, X-Served-By',
-    Vary: 'Origin',
-  };
-  if (origin) {
-    headers['Access-Control-Allow-Origin'] = origin;
-    headers['Access-Control-Allow-Credentials'] = 'true';
-    headers['Access-Control-Max-Age'] = '86400';
-  }
-  return headers;
-}
-
-export function handleCors(request, env) {
-  const origin = request.headers.get('Origin') || '';
-  return new Response(null, {
-    status: 204,
-    headers: corsHeaders(env, origin),
-  });
-}