From 50f668991e168686ca2deeb7ebefc12f76782e2d Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Tue, 24 Mar 2026 17:52:36 +0000
Subject: [PATCH 01/11] Initial plan


From cb1f0d60f7e1d6cd66bfc1848d7f819e10dad5c3 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Tue, 24 Mar 2026 17:58:09 +0000
Subject: [PATCH 02/11] Add Alpha One Labs logo from website repo to header and
 all logo places

Co-authored-by: A1L13N <193832434+A1L13N@users.noreply.github.com>
Agent-Logs-Url: https://github.com/alphaonelabs/learn/sessions/7e2e86c2-ca44-43eb-9ece-e502c7a54a9b
---
 public/admin.html      |   1 +
 public/course.html     |   3 ++-
 public/dashboard.html  |   3 ++-
 public/images/logo.png | Bin 0 -> 4048 bytes
 public/index.html      |   3 ++-
 public/login.html      |   3 ++-
 public/teach.html      |   3 ++-
 7 files changed, 11 insertions(+), 5 deletions(-)
 create mode 100644 public/images/logo.png

diff --git a/public/admin.html b/public/admin.html
index 41a3aa8..abf549f 100644
--- a/public/admin.html
+++ b/public/admin.html
@@ -4,6 +4,7 @@
   <meta charset="UTF-8" />
   <meta name="viewport" content="width=device-width, initial-scale=1.0" />
   <title>Alpha One Labs Admin</title>
+  <link rel="icon" type="image/png" href="/images/logo.png" />
   <script src="https://cdn.tailwindcss.com"></script>
   <style>
     :root {
diff --git a/public/course.html b/public/course.html
index e7e1789..fd3cbb6 100644
--- a/public/course.html
+++ b/public/course.html
@@ -4,6 +4,7 @@
   <meta charset="UTF-8" />
   <meta name="viewport" content="width=device-width, initial-scale=1.0" />
   <title>Activity - Alpha One Labs</title>
+  <link rel="icon" type="image/png" href="/images/logo.png" />
   <script src="https://cdn.tailwindcss.com"></script>
   <script>tailwind.config = { theme: { extend: { colors: { brand:{ DEFAULT:'#4F46E5', dark:'#3730A3' } } } } };</script>
   <style>
@@ -17,7 +18,7 @@
 <nav class="bg-white shadow-sm sticky top-0 z-50">
   <div class="max-w-7xl mx-auto px-4 sm:px-6 lg:px-8 flex items-center justify-between h-16">
     <a href="/" class="flex items-center gap-2">
-      <div class="w-8 h-8 rounded-lg gradient-hero flex items-center justify-center text-white font-bold text-sm">A</div>
+      <img src="/images/logo.png" alt="Alpha One Labs" class="h-8 w-auto" />
       <span class="font-bold text-xl text-slate-800">Alpha One Labs</span>
     </a>
     <div id="nav-auth" class="flex items-center gap-3"></div>
diff --git a/public/dashboard.html b/public/dashboard.html
index b42c562..47f2903 100644
--- a/public/dashboard.html
+++ b/public/dashboard.html
@@ -4,6 +4,7 @@
   <meta charset="UTF-8" />
   <meta name="viewport" content="width=device-width, initial-scale=1.0" />
   <title>Dashboard - Alpha One Labs</title>
+  <link rel="icon" type="image/png" href="/images/logo.png" />
   <script src="https://cdn.tailwindcss.com"></script>
   <script>tailwind.config = { theme: { extend: { colors: { brand: { DEFAULT:'#4F46E5', dark:'#3730A3' } } } } };</script>
   <style>
@@ -19,7 +20,7 @@
 <nav class="bg-white shadow-sm sticky top-0 z-50">
   <div class="max-w-7xl mx-auto px-4 sm:px-6 lg:px-8 flex items-center justify-between h-16">
     <a href="/" class="flex items-center gap-2">
-      <div class="w-8 h-8 rounded-lg gradient-hero flex items-center justify-center text-white font-bold text-sm">A</div>
+      <img src="/images/logo.png" alt="Alpha One Labs" class="h-8 w-auto" />
       <span class="font-bold text-xl text-slate-800">Alpha One Labs</span>
     </a>
     <div class="hidden md:flex items-center gap-6 text-sm font-medium text-slate-600">
diff --git a/public/images/logo.png b/public/images/logo.png
new file mode 100644
index 0000000000000000000000000000000000000000..29d0cbfe401f34fe01347175e218e5d8e1becf39
GIT binary patch
literal 4048
zcmV;>4=?bEP)<h;3K|Lk000e1NJLTq003kF003tQ1^@s6_IBs`00001b5ch_0Itp)
z=>Px#1ZP1_K>z@;j|==^1poj532;bRa{vGi!vFvd!vV){sAK>D02y>eSaefwW^{L9
za%BKeVQFr3E>1;MAa*k@H7+zhjm&lc01rS(L_t(|UhSO;P!wkt#}kuP<kqMNVu%`J
zG`hMmiDkBGqdCMJwHwzQWfD|CMh+bvxe*a0$;ORIjDUC_0R)swP}G=IZB<kdL@p6L
zg2-?whaeylmACJ;j5cH%rh9sZ8HTT_OUmi<{rda<?|sMXC!Wxu^6!P8$Y#x&ZKgxF
zWZ1Wom7N2JQ;$@Jgna3RU~CQB8anXwmo8t0nj1Hu?0Pwz{N>k@wQJY;AQ(FxxHZGP
z1p?yj>km%O%OLw)4pdcDLwfr05;r#w|BpWYbcA7Ar4OH)fH=D>2fPI^H#djHOP0cg
zqKk0rRwE=QAFgy*>=@XGw`X{lW&<H8v<)3P6uxj+0%tNZp|!OY;^Ge8UoG>JVpC>n
zcox#~6DtEkP@a79Nf<F=1bqI*VmNjB4BWg~3n_=w<iR1K<du!l@@*Q<<+y+-YRf|~
zBf;6(1<qz=Ls{8%IPvo@#r^?-o(N{F;aEybPud$01sM8w#K@80f_js4K9>>yBS+JV
zB@$O36#wB`y50VN89qQ1a7g@@Iyyno#bQSM6O)oj{QdjCwY2brLVzg1n3$NrlBJH2
zc{U50TUt6|W8>RV{8tQ!zZ&4w0iqE9kt0Vj?(&&48E^xG%;c2Rvh~3m$Sbo^<JS82
zP;cLWkI~iKJbU)vCu#Fe)CIy8e*)toS<VEQ*RGYp@e?PDeEkB*E7QL&nUlZ%PgYS`
z1&0z6Z!Y@mi?I3ceK1lRV8jB#7JmY>+|>>8^70w+Pfa^=5xq1|6n{%?Jd-HbARujb
z?*f&UmKKPLjsbjtuWfC|T8MH1j+1Bt$Yb%hV7g>37MDQ7ty_?gkW_)<@2kn@5$)V;
zAPf~Ot*v(;HZK0I`wHnd2xfw47h|1BlRy+2V`gRsj!w&%IOg{4=8glgacwC6ZaOXg
z%774*j*bqft*wQ$qv=&ErK`V1FjK??qiG;)jTvQSg<zZ^GxID|SJyyNa!P5?`VAfk
z##+p066IW6Koqs51OKS4t)uRXa(t-oQT(45<HFhk(gn;YD{yslX9CPp6#w*NCknlN
z{B+AJ>kWtk4E<YMR}b+A58eFa(?y$6{MCw*wGD(V{-Y3#o4W@T6kdQTtTFhq6)j!r
zBtz{q7vp79>l}Q5DBxf)2K#@CBJmFuD*k;5<dOJWSimwD2^5!Hf`*1$aPVM)9L3*D
zErY6iun-`Rz%;i23T3Oi$4c_b#`C!sT>zpGe~V5qS=r~Hv8kye=0I!<ioXOk#)Qu^
ziL$RcKosJC<K|8D`HxntSjl*0lU2DfT><h~V+O(K(bnL+Ou~3&6vrecCSM5(3L&p-
zv?|Xe%0B7>c_jX*{xo)xlzg}h`<cE)@$a$5=o%2V_*+?x1`m&wOn_NhdJT@IAJ6yn
z^wy47CKiyc;$KH`%#DQ~eexZOztR9xSAld9e{`3z)-yxPB>woaU2t$%B1P@g+z6&7
zfUq@Y@4o#c{=wLkb@5>I0f+()X^dpKE0kQi%!q$n{2>zmHKH_8-A|%PAP+SLpy~E)
zh&~Y8?B=nOys~k05BdZ|A^w)bhB19*)QO4XF%P1n4>Y0pJBup*ng;S%V>+Ow<_4ss
zrpeJO`|9$Q$Fok@&4jN1J!sG%u(q*bY7Bv?sI0_}*`!PBf`Z8_vr@a(XbT8i{K+e$
zSjN{s0EP@1!pu0)w~fa9t<Wo5DP08x1%>c?X(^-~NzawZJYCfSqirB;@vpCMfUS|+
zVd~Ur@buG9>m3xuOGI9obk%Amz$EccNK7ukp$reyPGjCRrZ0i8#eesneK2{-OF&J6
zzSWk;;%|u><IaeGJ&HdLEtjMCui^zo7l0@N%v+6(uw&;gc=grS^tQ%OQ#SmWXRxnq
z1)R${k6;=eL`B6kp!hFUN&IyM2wVKCs;e0=ue~-)Z^2MaA2VhQ(}_vF%W`=IeD$A=
zKlWN%bPY%suM8(Hghy<J=`&{NwfK*=wubBF6%es)$3eXX!WMt(k|8jpF;6}9lwN8K
z#a;adhyu>-=4RNrYY)6Qc?!+})-UnbIUvzdQ7~=lRL<>PdwX`J;QX70mKz!xAadId
znEA@9SYyO<m%}3>p{}lu*QTmRsB=K(qrv|&#E5e<GB$={?8H;G5SYrUDhA9e2u6%J
zh6dgE7QF;=4Wn4wvCsAhgkWv_<{M^m1)oCuSJ%|QmauS`Htnx4c<^As8e=d(_U+vZ
zLrqM31u|#O9GtFmn-7mJ``$qDCoq#Hy(lQaG#DVgHCKwJ%oOKQ6%`c;2ErD9ieo0d
zIGLCD8w8MM^o-0cEPJgT3MgNOhN=xj5&75QESZR{k?``&nJT%<1_9(ye7wpq2+I5K
zf51#>6|0cOR8&+x1oQID9>xE|1q&e{Fz8QPVp0m{?dX-Lx3{;0BQCJ%$-C<Q8;vy-
z78HoZ<I#Bt4E4mW4-Nq%BO_kIPpgHwie3SsH5<=9+q-ww9ZJ}iFwuc1PMCqyNzHLc
zR#ijNe*Ff>!8m@+l>&_Y{P}S2k3Td5#bALvc<=yM&^mKAS0<)rFxY6Q(%;9}j)k0a
z=LUd?X@T<V*O@?#OFuqav<Szh$0+@M$WUVl$9O^$#b9g5iQ~t?*i?BiNHyd1Z@<CZ
zxpO&z+0UD&2_9guKqSjtIE`&*XU7=(haZ0EvDqrSc1?6B1_`9Hq5@vRi3`e_E2<p<
z0RfDm&t_&aQ)-m$Hx!pX@5L?`v5P?hIdS3yXLN2kY&iUkzf&Pk%D#tQ;CUKowhR)8
zR4V0cuBJ_!25oJ39=-Vg-MA5(E#=+v=9ZSwh>JGGECvUJqVuU}bT02|_3Bk!?3<UD
zhqE+BaPGfn*Df)67@nvfOHT(2%VA0lY-Vl&$BrHAV&MAvdicj1Z*T%}a&m${L<|xQ
zu7-GddBI?gk-_OR{suKT#ix4-2@d82VuPYzg9A`v6@vpZe*Ab&<4Rmyl-iX#6HU#`
zIlZ#@xLC1x7*>;&mwO&4%2uWy#@JPI^5jXShHb<di?7dqofD*^qa)nAcTW^322(?*
zdpk6A1E*1GLiP2sGNnePW7n-)$9e3;7hZthuU;Jh!p8#Sp3a&zi`(6uJ{|o0{W-S}
zKU}~)BL!<+N(%QN5uf`sm>QCg?yIp16B+mnR<ZYWaB$#bcg}qc2FQkx5MCpLe8Eh`
zp5qF+Tx}=@0i+2<+1`G>MuE^oiPXb~2Y{$zfxO&Y7>W5q_`dag_jkb_WOa){)DY^A
z;%i(X`%j$s0yH%?sl}w<18KX{h67D+asru)vk~uN#yVBEBS+GhNeIe-QP)dyQsMxR
zo-B}^l?67qQb?Hrjf_noa_d%J2CT*j)HAS)g{ub1WHMgo>%McpuOZtaw}BBybWXZ*
zE<2mI0Vy))0y1I31h{|yKJRlX4(QiFD8hc{op(5mHygV{gcJ$_X?X${l+&k92{|ou
zOuq(lskj)dtd$SJ(opTDO`8N6?kaYZJpcSeP9QV{Ow){nlzt6_^nr9j*_%wcr!q4#
zgxHK(BO;MVdh8dYaTFn?UjupTO>XaM4o>l*(L<pnF(H9-Mhd+Irvx@z{T2u<Gob7^
zT<!eY&Y2}bfzY6o4aY<}x~9<c>pYOuBgfpEnwlQ)TuBB;)6!td<jG368Q8O%lanKq
z1#?_mTN}8$xp7{@8HaXT1uR<-0%XC$kC?Q7$~ILeZL7TKlNPdvMMSQ`?>?2Q)5NG{
zeJvg=1c<6e?`c0?KnTjlZ@)9f%>(mu6tuNH%mv>ci{1cHq<nC7Uum^#_dZw5Gnm_`
zX1|dx0?ovxhf?;5@z(P>2k#ovJqHJYIh2?z$;r*Tgt=^W(YAu_iP8-Q1O&pkapP55
zcgV-+qBdDvNl_4tNo;(A^QqGrP54<0VbPc%(`n`)N|#=X*&66m7Jit~juOLYBS)9o
zHAER86#q5Y2Fu&qHM6=&GYGn#l{Dm^|61^USol_XB_>Oz1)=@~1_N2KYJ;-#Xaq>7
z_?vF}ZnHG!eBK4chhVf}NU^R#K!QWRw#7uxrf<IWwshO}ofqg!3G|)BprBxQ?zwRq
z0i!V>Eb+JAv-c+t{DfV;K52{sh~hagZLRg9&p!9SHR}14Gx74}D>x--JuX(Y6SXPR
zI1m<?(FutuZs&9JuaIEsdg%^?1!lCfi^OgFj-6Miwoo=}FK=J4vwKby@z)v<78nwL
z$>}p0Ef`?(%OImgid;ZgU`#NZsN}~jVJ$anYdbFDM=X7O{D8hWLirSh>WtQbu$=%D
zf3M85**Yoyy#ZlA$K1Ex_QDJha{5w&9L3+)*AFNqtPm)D3Zzr~&A;EgMV6bFU!+Uo
z&j$!S2a3P>ym|9wJ9h0ZqHiS9*AmtSu49@qK4AJB2&*Zx*|$GRihh4#Q&Zn-3|}Cu
zrpyLEDK7mfI;N2F@|K_j5U@57#$p~YRpJ<(0mAmm5|UCpu*Q_)C+xJS8h?&M$nE6{
zgnRpc^2(OEEce*4b9ZTZxf}}dJ63DfcrhtNdP>l#b3j;NOi}#ZPM^ta!<A857k{BO
zq&p}CV~XPMh6&T!>gww|=nK}KUf#?%;FXEL&I0Ks{=R3k&Q)kL@)rw8H}Ut4+_t@f
zvJI7E!eno6pFfGeUI6J7f6L8VB0Tf*3og=RI!zZ%0O=He%Xi;<-*eZVy%(=x9CPLB
z@7N`?mI*LP{PhM1t0}YH9~C3RXt_w8yo<d7)f5nx_}e-xUMh=@i7mQ>Q9s2ozJC5t
zcD-D+M9RI1n6`h%-esG_<ik>|F=fs8Sw69grh%}%G8c)f6cay}$uYA9Ey+_Uv$eJj
zuIlv=42k~=99nM2hY?NuwFQI)hQxnGSa?Kx=+_$$sQUamy&p#Y{#n^MmF*&|SJyTW
zoi?mGH;3c>!^6TOeew$~6yLooe7@HJ5OpXhITo9;u~9Lxo)|3`Q*wU3WdMlCKv-Vc
zn55)XSzdmjyrrd8WiA6iGz6qu<S#`-<0^&TmnjSY(J+v1k$+%z&iNk2e*lOUfpkXx
zBO)TV`xjm)Dp4l>13<J4gw>SU#T<zD!DzXJCWb4@0FXWc!tRnuN=fy~FDR^RZN0;+
zpi-y%y^kNK|6Cs3WiyQYWn03xf~U8i;PDVKE%JY3n*S5^s^CZf0000<MNUMnLSTZA
CQkFOX

literal 0
HcmV?d00001

diff --git a/public/index.html b/public/index.html
index ab0f6e8..2ab457f 100644
--- a/public/index.html
+++ b/public/index.html
@@ -4,6 +4,7 @@
   <meta charset="UTF-8" />
   <meta name="viewport" content="width=device-width, initial-scale=1.0" />
   <title>Alpha One Labs – Discover Activities</title>
+  <link rel="icon" type="image/png" href="/images/logo.png" />
   <script src="https://cdn.tailwindcss.com"></script>
   <script>
     tailwind.config = {
@@ -32,7 +33,7 @@
 <nav class="bg-white shadow-sm sticky top-0 z-50">
   <div class="max-w-7xl mx-auto px-4 sm:px-6 lg:px-8 flex items-center justify-between h-16">
     <a href="/" class="flex items-center gap-2">
-      <div class="w-8 h-8 rounded-lg gradient-hero flex items-center justify-center text-white font-bold text-sm">A</div>
+      <img src="/images/logo.png" alt="Alpha One Labs" class="h-8 w-auto" />
       <span class="font-bold text-xl text-slate-800">Alpha One Labs</span>
     </a>
     <div class="hidden md:flex items-center gap-6 text-sm font-medium text-slate-600">
diff --git a/public/login.html b/public/login.html
index d897610..b7d8c23 100644
--- a/public/login.html
+++ b/public/login.html
@@ -4,6 +4,7 @@
   <meta charset="UTF-8" />
   <meta name="viewport" content="width=device-width, initial-scale=1.0" />
   <title>Login / Register - Alpha One Labs</title>
+  <link rel="icon" type="image/png" href="/images/logo.png" />
   <script src="https://cdn.tailwindcss.com"></script>
   <script>tailwind.config = { theme: { extend: { colors: { brand: { DEFAULT: '#4F46E5', dark: '#3730A3' } } } } };</script>
   <style>
@@ -16,7 +17,7 @@
 <div class="w-full max-w-md">
   <div class="text-center mb-8">
     <a href="/" class="inline-flex items-center gap-2">
-      <div class="w-10 h-10 rounded-xl gradient-hero flex items-center justify-center text-white font-bold">A</div>
+      <img src="/images/logo.png" alt="Alpha One Labs" class="h-10 w-auto" />
       <span class="font-bold text-2xl text-slate-800">Alpha One Labs</span>
     </a>
     <p class="text-slate-500 text-sm mt-2">All user data encrypted at rest - zero plaintext PII stored</p>
diff --git a/public/teach.html b/public/teach.html
index d6cc2ba..8c00bff 100644
--- a/public/teach.html
+++ b/public/teach.html
@@ -4,6 +4,7 @@
   <meta charset="UTF-8" />
   <meta name="viewport" content="width=device-width, initial-scale=1.0" />
   <title>Host Hub - Alpha One Labs</title>
+  <link rel="icon" type="image/png" href="/images/logo.png" />
   <script src="https://cdn.tailwindcss.com"></script>
   <script>tailwind.config = { theme: { extend: { colors: { brand:{ DEFAULT:'#4F46E5', dark:'#3730A3' } } } } };</script>
   <style>
@@ -17,7 +18,7 @@
 <nav class="bg-white shadow-sm sticky top-0 z-50">
   <div class="max-w-7xl mx-auto px-4 sm:px-6 lg:px-8 flex items-center justify-between h-16">
     <a href="/" class="flex items-center gap-2">
-      <div class="w-8 h-8 rounded-lg gradient-hero flex items-center justify-center text-white font-bold text-sm">A</div>
+      <img src="/images/logo.png" alt="Alpha One Labs" class="h-8 w-auto" />
       <span class="font-bold text-xl text-slate-800">Alpha One Labs</span>
     </a>
     <div class="hidden md:flex items-center gap-6 text-sm font-medium text-slate-600">

From 87bfd4822de749aef80ec332336f77ed3d421a39 Mon Sep 17 00:00:00 2001
From: shreycodes <shreymojidra06@gmail.com>
Date: Wed, 25 Mar 2026 00:28:52 +0530
Subject: [PATCH 03/11] Perfectly organized worker.py and other files

---
 src/api_handlers.py   |  555 ++++++++++++++++++++
 src/platform_utils.py |  431 ++++++++++++++++
 src/security_utils.py |  127 +++++
 src/worker.py         | 1127 ++---------------------------------------
 4 files changed, 1142 insertions(+), 1098 deletions(-)
 create mode 100644 src/api_handlers.py
 create mode 100644 src/platform_utils.py
 create mode 100644 src/security_utils.py

diff --git a/src/api_handlers.py b/src/api_handlers.py
new file mode 100644
index 0000000..624b8bc
--- /dev/null
+++ b/src/api_handlers.py
@@ -0,0 +1,555 @@
+from urllib.parse import parse_qs, urlparse
+
+from platform_utils import (
+    capture_exception,
+    err,
+    is_basic_auth_valid,
+    json_resp,
+    ok,
+    parse_json_object,
+    unauthorized_basic,
+)
+from security_utils import (
+    blind_index,
+    create_token,
+    decrypt,
+    encrypt,
+    hash_password,
+    new_id,
+    verify_password,
+    verify_token,
+)
+
+# ---------------------------------------------------------------------------
+# API handlers
+# ---------------------------------------------------------------------------
+
+async def api_register(req, env):
+    body, bad_resp = await parse_json_object(req)
+    if bad_resp:
+        return bad_resp
+
+    username = (body.get("username") or "").strip()
+    email    = (body.get("email")    or "").strip()
+    password = (body.get("password") or "")
+    name     = (body.get("name")     or username).strip()
+
+    if not username or not email or not password:
+        return err("username, email, and password are required")
+    if len(password) < 8:
+        return err("Password must be at least 8 characters")
+
+    role = "member"
+
+    enc = env.ENCRYPTION_KEY
+    uid = new_id()
+    try:
+        await env.DB.prepare(
+            "INSERT INTO users "
+            "(id,username_hash,email_hash,name,username,email,password_hash,role)"
+            " VALUES (?,?,?,?,?,?,?,?)"
+        ).bind(
+            uid,
+            blind_index(username, enc),
+            blind_index(email,    enc),
+            encrypt(name,     enc),
+            encrypt(username, enc),
+            encrypt(email,    enc),
+            hash_password(password, username),
+            encrypt(role, enc),
+        ).run()
+    except Exception as e:
+        if "UNIQUE" in str(e):
+            return err("Username or email already registered", 409)
+        capture_exception(e, req, env, "api_register.insert_user")
+        return err("Registration failed — please try again", 500)
+
+    token = create_token(uid, username, role, env.JWT_SECRET)
+    return ok(
+        {"token": token,
+         "user": {"id": uid, "username": username, "name": name, "role": role}},
+        "Registration successful",
+    )
+
+
+async def api_login(req, env):
+    body, bad_resp = await parse_json_object(req)
+    if bad_resp:
+        return bad_resp
+
+    username = (body.get("username") or "").strip()
+    password = (body.get("password") or "")
+
+    if not username or not password:
+        return err("username and password are required")
+
+    enc    = env.ENCRYPTION_KEY
+    u_hash = blind_index(username, enc)
+    row    = await env.DB.prepare(
+        "SELECT id,password_hash,role,name,username FROM users WHERE username_hash=?"
+    ).bind(u_hash).first()
+
+    if not row:
+        return err("Invalid username or password", 401)
+    
+    password_hash = row.password_hash
+    user_id = row.id
+    role_enc = row.role
+    name_enc = row.name
+    username_enc = row.username
+    stored_username = decrypt(username_enc, enc)
+
+    if not verify_password(password, password_hash, stored_username):
+        return err("Invalid username or password", 401)
+
+    real_role = decrypt(role_enc, enc)
+    real_name = decrypt(name_enc, enc)
+    token     = create_token(user_id, stored_username, real_role, env.JWT_SECRET)
+    return ok(
+        {"token": token,
+         "user": {"id": user_id, "username": stored_username,
+                  "name": real_name, "role": real_role}},
+        "Login successful",
+    )
+
+
+async def api_list_activities(req, env):
+    parsed = urlparse(req.url)
+    params = parse_qs(parsed.query)
+    atype  = (params.get("type")   or [None])[0]
+    fmt    = (params.get("format") or [None])[0]
+    search = (params.get("q")      or [None])[0]
+    tag    = (params.get("tag")    or [None])[0]
+    enc    = env.ENCRYPTION_KEY
+
+    base_q = (
+        "SELECT a.id,a.title,a.description,a.type,a.format,a.schedule_type,"
+        "a.created_at,u.name AS host_name_enc,"
+        "(SELECT COUNT(*) FROM enrollments WHERE activity_id=a.id AND status='active')"
+        " AS participant_count,"
+        "(SELECT COUNT(*) FROM sessions WHERE activity_id=a.id) AS session_count"
+        " FROM activities a JOIN users u ON a.host_id=u.id"
+    )
+
+    if tag:
+        tag_row = await env.DB.prepare(
+            "SELECT id FROM tags WHERE name=?"
+        ).bind(tag).first()
+        if not tag_row:
+            return json_resp({"activities": []})
+        res = await env.DB.prepare(
+            base_q
+            + " JOIN activity_tags at2 ON at2.activity_id=a.id"
+              " WHERE at2.tag_id=? ORDER BY a.created_at DESC"
+        ).bind(tag_row.id).all()
+    elif atype and fmt:
+        res = await env.DB.prepare(
+            base_q + " WHERE a.type=? AND a.format=? ORDER BY a.created_at DESC"
+        ).bind(atype, fmt).all()
+    elif atype:
+        res = await env.DB.prepare(
+            base_q + " WHERE a.type=? ORDER BY a.created_at DESC"
+        ).bind(atype).all()
+    elif fmt:
+        res = await env.DB.prepare(
+            base_q + " WHERE a.format=? ORDER BY a.created_at DESC"
+        ).bind(fmt).all()
+    else:
+        res = await env.DB.prepare(
+            base_q + " ORDER BY a.created_at DESC"
+        ).all()
+
+    activities = []
+    for row in res.results or []:
+        desc      = decrypt(row.description or "", enc)
+        host_name = decrypt(row.host_name_enc or "", enc)
+        if search and (
+            search.lower() not in row.title.lower()
+            and search.lower() not in desc.lower()
+        ):
+            continue
+
+        t_res = await env.DB.prepare(
+            "SELECT t.name FROM tags t"
+            " JOIN activity_tags at2 ON at2.tag_id=t.id"
+            " WHERE at2.activity_id=?"
+        ).bind(row.id).all()
+
+        activities.append({
+            "id":                row.id,
+            "title":             row.title,
+            "description":       desc,
+            "type":              row.type,
+            "format":            row.format,
+            "schedule_type":     row.schedule_type,
+            "host_name":         host_name,
+            "participant_count": row.participant_count,
+            "session_count":     row.session_count,
+            "tags":              [t.name for t in (t_res.results or [])],
+            "created_at":        row.created_at,
+        })
+
+    return json_resp({"activities": activities})
+
+
+async def api_create_activity(req, env):
+    user = verify_token(req.headers.get("Authorization"), env.JWT_SECRET)
+    if not user:
+        return err("Authentication required", 401)
+
+    body, bad_resp = await parse_json_object(req)
+    if bad_resp:
+        return bad_resp
+
+    title         = (body.get("title")         or "").strip()
+    description   = (body.get("description")   or "").strip()
+    atype         = (body.get("type")          or "course").strip()
+    fmt           = (body.get("format")        or "self_paced").strip()
+    schedule_type = (body.get("schedule_type") or "ongoing").strip()
+
+    if not title:
+        return err("title is required")
+    if atype not in ("course", "meetup", "workshop", "seminar", "other"):
+        atype = "course"
+    if fmt not in ("live", "self_paced", "hybrid"):
+        fmt = "self_paced"
+    if schedule_type not in ("one_time", "multi_session", "recurring", "ongoing"):
+        schedule_type = "ongoing"
+
+    enc    = env.ENCRYPTION_KEY
+    act_id = new_id()
+    try:
+        await env.DB.prepare(
+            "INSERT INTO activities "
+            "(id,title,description,type,format,schedule_type,host_id)"
+            " VALUES (?,?,?,?,?,?,?)"
+        ).bind(
+            act_id, title,
+            encrypt(description, enc) if description else "",
+            atype, fmt, schedule_type, user["id"]
+        ).run()
+    except Exception as e:
+        capture_exception(e, req, env, "api_create_activity.insert_activity")
+        return err("Failed to create activity — please try again", 500)
+
+    for tag_name in (body.get("tags") or []):
+        tag_name = tag_name.strip()
+        if not tag_name:
+            continue
+        t_row = await env.DB.prepare(
+            "SELECT id FROM tags WHERE name=?"
+        ).bind(tag_name).first()
+        if t_row:
+            tag_id = t_row.id
+        else:
+            tag_id = new_id()
+            try:
+                await env.DB.prepare(
+                    "INSERT INTO tags (id,name) VALUES (?,?)"
+                ).bind(tag_id, tag_name).run()
+            except Exception as e:
+                capture_exception(e, req, env, f"api_create_activity.insert_tag: tag_name={tag_name}, tag_id={tag_id}, act_id={act_id}")
+                continue
+        try:
+            await env.DB.prepare(
+                "INSERT OR IGNORE INTO activity_tags (activity_id,tag_id) VALUES (?,?)"
+            ).bind(act_id, tag_id).run()
+        except Exception as e:
+            capture_exception(e, req, env, f"api_create_activity.insert_activity_tags: tag_name={tag_name}, tag_id={tag_id}, act_id={act_id}")
+            pass
+
+    return ok({"id": act_id, "title": title}, "Activity created")
+
+
+async def api_get_activity(act_id: str, req, env):
+    user    = verify_token(req.headers.get("Authorization") or "", env.JWT_SECRET)
+    enc     = env.ENCRYPTION_KEY
+
+    act = await env.DB.prepare(
+        "SELECT a.*,u.name AS host_name_enc,u.id AS host_uid"
+        " FROM activities a JOIN users u ON a.host_id=u.id"
+        " WHERE a.id=?"
+    ).bind(act_id).first()
+    if not act:
+        return err("Activity not found", 404)
+
+    enrollment  = None
+    is_enrolled = False
+    if user:
+        enrollment  = await env.DB.prepare(
+            "SELECT id,role,status FROM enrollments"
+            " WHERE activity_id=? AND user_id=?"
+        ).bind(act_id, user["id"]).first()
+        is_enrolled = enrollment is not None
+
+    is_host = bool(user and act.host_uid == user["id"])
+
+    ses_res = await env.DB.prepare(
+        "SELECT id,title,description,start_time,end_time,location,created_at"
+        " FROM sessions WHERE activity_id=? ORDER BY start_time"
+    ).bind(act_id).all()
+
+    sessions = []
+    for s in ses_res.results or []:
+        sessions.append({
+            "id":          s.id,
+            "title":       s.title,
+            "description": decrypt(s.description or "", enc) if (is_enrolled or is_host) else None,
+            "start_time":  s.start_time,
+            "end_time":    s.end_time,
+            "location":    decrypt(s.location or "", enc) if (is_enrolled or is_host) else None,
+        })
+
+    t_res = await env.DB.prepare(
+        "SELECT t.name FROM tags t"
+        " JOIN activity_tags at2 ON at2.tag_id=t.id"
+        " WHERE at2.activity_id=?"
+    ).bind(act_id).all()
+
+    count_row = await env.DB.prepare(
+        "SELECT COUNT(*) AS cnt FROM enrollments WHERE activity_id=? AND status='active'"
+    ).bind(act_id).first()
+
+    return json_resp({
+        "activity": {
+            "id":                act.id,
+            "title":             act.title,
+            "description":       decrypt(act.description or "", enc),
+            "type":              act.type,
+            "format":            act.format,
+            "schedule_type":     act.schedule_type,
+            "host_name":         decrypt(act.host_name_enc or "", enc),
+            "participant_count": count_row.cnt if count_row else 0,
+            "tags":              [t.name for t in (t_res.results or [])],
+            "created_at":        act.created_at,
+        },
+        "sessions":    sessions,
+        "is_enrolled": is_enrolled,
+        "is_host":     is_host,
+        "enrollment":  {
+            "role":   enrollment.role,
+            "status": enrollment.status,
+        } if enrollment else None,
+    })
+
+
+async def api_join(req, env):
+    user = verify_token(req.headers.get("Authorization"), env.JWT_SECRET)
+    if not user:
+        return err("Authentication required", 401)
+
+    body, bad_resp = await parse_json_object(req)
+    if bad_resp:
+        return bad_resp
+
+    act_id = body.get("activity_id")
+    role   = (body.get("role") or "participant").strip()
+
+    if not act_id:
+        return err("activity_id is required")
+    if role not in ("participant", "instructor", "organizer"):
+        role = "participant"
+
+    act = await env.DB.prepare(
+        "SELECT id FROM activities WHERE id=?"
+    ).bind(act_id).first()
+    if not act:
+        return err("Activity not found", 404)
+
+    enr_id = new_id()
+    try:
+        await env.DB.prepare(
+            "INSERT OR IGNORE INTO enrollments (id,activity_id,user_id,role)"
+            " VALUES (?,?,?,?)"
+        ).bind(enr_id, act_id, user["id"], role).run()
+    except Exception as e:
+        capture_exception(e, req, env, "api_join.insert_enrollment")
+        return err("Failed to join activity — please try again", 500)
+
+    return ok(None, "Joined activity successfully")
+
+
+async def api_dashboard(req, env):
+    user = verify_token(req.headers.get("Authorization"), env.JWT_SECRET)
+    if not user:
+        return err("Authentication required", 401)
+
+    enc = env.ENCRYPTION_KEY
+
+    res = await env.DB.prepare(
+        "SELECT a.id,a.title,a.type,a.format,a.schedule_type,a.created_at,"
+        "(SELECT COUNT(*) FROM enrollments WHERE activity_id=a.id AND status='active')"
+        " AS participant_count,"
+        "(SELECT COUNT(*) FROM sessions WHERE activity_id=a.id) AS session_count"
+        " FROM activities a WHERE a.host_id=? ORDER BY a.created_at DESC"
+    ).bind(user["id"]).all()
+
+    hosted = []
+    for r in res.results or []:
+        t_res = await env.DB.prepare(
+            "SELECT t.name FROM tags t JOIN activity_tags at2 ON at2.tag_id=t.id"
+            " WHERE at2.activity_id=?"
+        ).bind(r.id).all()
+        hosted.append({
+            "id":                r.id,
+            "title":             r.title,
+            "type":              r.type,
+            "format":            r.format,
+            "schedule_type":     r.schedule_type,
+            "participant_count": r.participant_count,
+            "session_count":     r.session_count,
+            "tags":              [t.name for t in (t_res.results or [])],
+            "created_at":        r.created_at,
+        })
+
+    res2 = await env.DB.prepare(
+        "SELECT a.id,a.title,a.type,a.format,a.schedule_type,"
+        "e.role AS enr_role,e.status AS enr_status,e.created_at AS joined_at,"
+        "u.name AS host_name_enc"
+        " FROM enrollments e"
+        " JOIN activities a ON e.activity_id=a.id"
+        " JOIN users u ON a.host_id=u.id"
+        " WHERE e.user_id=? ORDER BY e.created_at DESC"
+    ).bind(user["id"]).all()
+
+    joined = []
+    for r in res2.results or []:
+        t_res = await env.DB.prepare(
+            "SELECT t.name FROM tags t JOIN activity_tags at2 ON at2.tag_id=t.id"
+            " WHERE at2.activity_id=?"
+        ).bind(r.id).all()
+        joined.append({
+            "id":            r.id,
+            "title":         r.title,
+            "type":          r.type,
+            "format":        r.format,
+            "schedule_type": r.schedule_type,
+            "enr_role":      r.enr_role,
+            "enr_status":    r.enr_status,
+            "host_name":     decrypt(r.host_name_enc or "", enc),
+            "tags":          [t.name for t in (t_res.results or [])],
+            "joined_at":     r.joined_at,
+        })
+
+    return json_resp({"user": user, "hosted_activities": hosted, "joined_activities": joined})
+
+
+async def api_create_session(req, env):
+    user = verify_token(req.headers.get("Authorization"), env.JWT_SECRET)
+    if not user:
+        return err("Authentication required", 401)
+
+    body, bad_resp = await parse_json_object(req)
+    if bad_resp:
+        return bad_resp
+
+    act_id      = body.get("activity_id")
+    title       = (body.get("title")       or "").strip()
+    description = (body.get("description") or "").strip()
+    start_time  = (body.get("start_time")  or "").strip()
+    end_time    = (body.get("end_time")    or "").strip()
+    location    = (body.get("location")    or "").strip()
+
+    if not act_id or not title:
+        return err("activity_id and title are required")
+
+    owned = await env.DB.prepare(
+        "SELECT id FROM activities WHERE id=? AND host_id=?"
+    ).bind(act_id, user["id"]).first()
+    if not owned:
+        return err("Activity not found or access denied", 404)
+
+    enc = env.ENCRYPTION_KEY
+    sid = new_id()
+    try:
+        await env.DB.prepare(
+            "INSERT INTO sessions "
+            "(id,activity_id,title,description,start_time,end_time,location)"
+            " VALUES (?,?,?,?,?,?,?)"
+        ).bind(
+            sid, act_id, title,
+            encrypt(description, enc) if description else "",
+            start_time, end_time,
+            encrypt(location, enc) if location else "",
+        ).run()
+    except Exception as e:
+        capture_exception(e, req, env, "api_create_session.insert_session")
+        return err("Failed to create session — please try again", 500)
+
+    return ok({"id": sid}, "Session created")
+
+
+async def api_list_tags(_req, env):
+    res  = await env.DB.prepare("SELECT id,name FROM tags ORDER BY name").all()
+    tags = [{"id": r.id, "name": r.name} for r in (res.results or [])]
+    return json_resp({"tags": tags})
+
+
+async def api_add_activity_tags(req, env):
+    user = verify_token(req.headers.get("Authorization"), env.JWT_SECRET)
+    if not user:
+        return err("Authentication required", 401)
+
+    body, bad_resp = await parse_json_object(req)
+    if bad_resp:
+        return bad_resp
+
+    act_id = body.get("activity_id")
+    tags   = body.get("tags") or []
+
+    if not act_id:
+        return err("activity_id is required")
+
+    owned = await env.DB.prepare(
+        "SELECT id FROM activities WHERE id=? AND host_id=?"
+    ).bind(act_id, user["id"]).first()
+    if not owned:
+        return err("Activity not found or access denied", 404)
+
+    for tag_name in tags:
+        tag_name = tag_name.strip()
+        if not tag_name:
+            continue
+        t_row = await env.DB.prepare(
+            "SELECT id FROM tags WHERE name=?"
+        ).bind(tag_name).first()
+        if t_row:
+            tag_id = t_row.id
+        else:
+            tag_id = new_id()
+            try:
+                await env.DB.prepare(
+                    "INSERT INTO tags (id,name) VALUES (?,?)"
+                ).bind(tag_id, tag_name).run()
+            except Exception as e:
+                capture_exception(e, req, env, f"api_add_activity_tags.insert_tag: tag_name={tag_name}, tag_id={tag_id}, act_id={act_id}")
+                continue
+        try:
+            await env.DB.prepare(
+                "INSERT OR IGNORE INTO activity_tags (activity_id,tag_id) VALUES (?,?)"
+            ).bind(act_id, tag_id).run()
+        except Exception as e:
+            capture_exception(e, req, env, f"api_add_activity_tags.insert_activity_tags: tag_name={tag_name}, tag_id={tag_id}, act_id={act_id}")
+            pass
+
+    return ok(None, "Tags updated")
+
+
+async def api_admin_table_counts(req, env):
+    if not is_basic_auth_valid(req, env):
+        return unauthorized_basic()
+
+    tables_res = await env.DB.prepare(
+        "SELECT name FROM sqlite_master WHERE type='table' AND name NOT LIKE 'sqlite_%' ORDER BY name"
+    ).all()
+
+    counts = []
+    for row in tables_res.results or []:
+        table_name = row.name
+        # Table names come from sqlite_master and are quoted to avoid SQL injection.
+        count_row = await env.DB.prepare(
+            f'SELECT COUNT(*) AS cnt FROM "{table_name.replace(chr(34), chr(34) + chr(34))}"'
+        ).first()
+        counts.append({"table": table_name, "count": count_row.cnt if count_row else 0})
+
+    return json_resp({"tables": counts})
diff --git a/src/platform_utils.py b/src/platform_utils.py
new file mode 100644
index 0000000..1f19a92
--- /dev/null
+++ b/src/platform_utils.py
@@ -0,0 +1,431 @@
+import base64
+import hmac as _hmac
+import json
+import re
+import traceback
+from urllib.parse import urlparse
+
+from workers import Response
+from security_utils import blind_index, encrypt, hash_password
+
+def capture_exception(exc: Exception, req=None, _env=None, where: str = ""):
+    """Best-effort exception logging with full traceback and request context."""
+    try:
+        payload = {
+            "level": "error",
+            "where": where or "unknown",
+            "error_type": type(exc).__name__,
+            "error": str(exc),
+            "traceback": "".join(traceback.format_exception(type(exc), exc, exc.__traceback__)),
+        }
+        if req:
+            payload["request"] = {
+                "method": req.method,
+                "url": req.url,
+                "path": urlparse(req.url).path,
+            }
+        print(json.dumps(payload))
+    except Exception:
+        pass
+
+
+_CORS = {
+    "Access-Control-Allow-Origin":  "*",
+    "Access-Control-Allow-Methods": "GET, POST, PUT, DELETE, OPTIONS",
+    "Access-Control-Allow-Headers": "Content-Type, Authorization",
+}
+
+
+def json_resp(data, status: int = 200):
+    return Response(
+        json.dumps(data),
+        status=status,
+        headers={"Content-Type": "application/json", **_CORS},
+    )
+
+
+def ok(data=None, msg: str = "OK"):
+    body = {"success": True, "message": msg}
+    if data is not None:
+        body["data"] = data
+    return json_resp(body, 200)
+
+
+def err(msg: str, status: int = 400):
+    return json_resp({"error": msg}, status)
+
+
+async def parse_json_object(req):
+    """Parse request JSON and ensure payload is an object/dict."""
+    try:
+        text = await req.text()
+        body = json.loads(text)
+    except Exception:
+        return None, err("Invalid JSON body")
+
+    if not isinstance(body, dict):
+        return None, err("JSON body must be an object", 400)
+
+    return body, None
+
+
+def clean_path(value: str, default: str = "/admin") -> str:
+    """Normalize an env-provided path into a safe absolute URL path."""
+    raw = (value or "").strip()
+    if not raw:
+        return default
+    parsed = urlparse(raw)
+    path = (parsed.path or raw).strip()
+    if not path.startswith("/"):
+        path = "/" + path
+    path = re.sub(r"/+", "/", path)
+    if len(path) > 1 and path.endswith("/"):
+        path = path[:-1]
+    return path or default
+
+
+def unauthorized_basic(realm: str = "Alpha One Labs Admin"):
+    return Response(
+        "Authentication required",
+        status=401,
+        headers={"WWW-Authenticate": f'Basic realm="{realm}"', **_CORS},
+    )
+
+
+def is_basic_auth_valid(req, env) -> bool:
+    username = (getattr(env, "ADMIN_BASIC_USER", "") or "").strip()
+    password = (getattr(env, "ADMIN_BASIC_PASS", "") or "").strip()
+    if not username or not password:
+        return False
+
+    auth = req.headers.get("Authorization") or ""
+    if not auth.lower().startswith("basic "):
+        return False
+
+    try:
+        raw = auth.split(" ", 1)[1].strip()
+        decoded = base64.b64decode(raw).decode("utf-8")
+        user, pwd = decoded.split(":", 1)
+    except Exception:
+        return False
+
+    return _hmac.compare_digest(user, username) and _hmac.compare_digest(pwd, password)
+
+
+# ---------------------------------------------------------------------------
+# DDL - full schema (mirrors schema.sql)
+# ---------------------------------------------------------------------------
+
+_DDL = [
+    # Users - all PII encrypted; HMAC blind indexes for O(1) lookups
+    """CREATE TABLE IF NOT EXISTS users (
+        id            TEXT PRIMARY KEY,
+        username_hash TEXT NOT NULL UNIQUE,
+        email_hash    TEXT NOT NULL UNIQUE,
+        name          TEXT NOT NULL,
+        username      TEXT NOT NULL,
+        email         TEXT NOT NULL,
+        password_hash TEXT NOT NULL,
+        role          TEXT NOT NULL,
+        created_at    TEXT NOT NULL DEFAULT (datetime('now'))
+    )""",
+    # Activities
+    """CREATE TABLE IF NOT EXISTS activities (
+        id            TEXT PRIMARY KEY,
+        title         TEXT NOT NULL,
+        description   TEXT,
+        type          TEXT NOT NULL DEFAULT 'course',
+        format        TEXT NOT NULL DEFAULT 'self_paced',
+        schedule_type TEXT NOT NULL DEFAULT 'ongoing',
+        host_id       TEXT NOT NULL,
+        created_at    TEXT NOT NULL DEFAULT (datetime('now')),
+        FOREIGN KEY (host_id) REFERENCES users(id)
+    )""",
+    # Sessions
+    """CREATE TABLE IF NOT EXISTS sessions (
+        id          TEXT PRIMARY KEY,
+        activity_id TEXT NOT NULL,
+        title       TEXT,
+        description TEXT,
+        start_time  TEXT,
+        end_time    TEXT,
+        location    TEXT,
+        created_at  TEXT NOT NULL DEFAULT (datetime('now')),
+        FOREIGN KEY (activity_id) REFERENCES activities(id)
+    )""",
+    # Enrollments
+    """CREATE TABLE IF NOT EXISTS enrollments (
+        id          TEXT PRIMARY KEY,
+        activity_id TEXT NOT NULL,
+        user_id     TEXT NOT NULL,
+        role        TEXT NOT NULL DEFAULT 'participant',
+        status      TEXT NOT NULL DEFAULT 'active',
+        created_at  TEXT NOT NULL DEFAULT (datetime('now')),
+        UNIQUE (activity_id, user_id),
+        FOREIGN KEY (activity_id) REFERENCES activities(id),
+        FOREIGN KEY (user_id)     REFERENCES users(id)
+    )""",
+    # Session attendance
+    """CREATE TABLE IF NOT EXISTS session_attendance (
+        id         TEXT PRIMARY KEY,
+        session_id TEXT NOT NULL,
+        user_id    TEXT NOT NULL,
+        status     TEXT NOT NULL DEFAULT 'registered',
+        created_at TEXT NOT NULL DEFAULT (datetime('now')),
+        UNIQUE (session_id, user_id),
+        FOREIGN KEY (session_id) REFERENCES sessions(id),
+        FOREIGN KEY (user_id)    REFERENCES users(id)
+    )""",
+    # Tags
+    """CREATE TABLE IF NOT EXISTS tags (
+        id   TEXT PRIMARY KEY,
+        name TEXT UNIQUE NOT NULL
+    )""",
+    # Activity-tag junction
+    """CREATE TABLE IF NOT EXISTS activity_tags (
+        activity_id TEXT NOT NULL,
+        tag_id      TEXT NOT NULL,
+        PRIMARY KEY (activity_id, tag_id),
+        FOREIGN KEY (activity_id) REFERENCES activities(id),
+        FOREIGN KEY (tag_id)      REFERENCES tags(id)
+    )""",
+    # Indexes
+    "CREATE INDEX IF NOT EXISTS idx_activities_host      ON activities(host_id)",
+    "CREATE INDEX IF NOT EXISTS idx_enrollments_activity ON enrollments(activity_id)",
+    "CREATE INDEX IF NOT EXISTS idx_enrollments_user     ON enrollments(user_id)",
+    "CREATE INDEX IF NOT EXISTS idx_sessions_activity    ON sessions(activity_id)",
+    "CREATE INDEX IF NOT EXISTS idx_sa_session           ON session_attendance(session_id)",
+    "CREATE INDEX IF NOT EXISTS idx_sa_user              ON session_attendance(user_id)",
+    "CREATE INDEX IF NOT EXISTS idx_at_activity          ON activity_tags(activity_id)",
+]
+
+
+async def init_db(env):
+    for sql in _DDL:
+        await env.DB.prepare(sql).run()
+
+
+# ---------------------------------------------------------------------------
+# Sample-data seeding
+# ---------------------------------------------------------------------------
+
+async def seed_db(env, enc_key: str):
+    # ---- users ---------------------------------------------------------------
+    seed_users = [
+        ("alice",   "alice@example.com",   "password123", "host",   "Alice Chen"),
+        ("bob",     "bob@example.com",     "password123", "host",   "Bob Martinez"),
+        ("charlie", "charlie@example.com", "password123", "member", "Charlie Kim"),
+        ("diana",   "diana@example.com",   "password123", "member", "Diana Patel"),
+    ]
+    uid_map = {}
+    for uname, email, pw, role, display in seed_users:
+        uid = f"usr-{uname}"
+        uid_map[uname] = uid
+        try:
+            await env.DB.prepare(
+                "INSERT INTO users "
+                "(id,username_hash,email_hash,name,username,email,password_hash,role)"
+                " VALUES (?,?,?,?,?,?,?,?)"
+            ).bind(
+                uid,
+                blind_index(uname, enc_key),
+                blind_index(email, enc_key),
+                encrypt(display,  enc_key),
+                encrypt(uname,    enc_key),
+                encrypt(email,    enc_key),
+                hash_password(pw, uname),
+                encrypt(role,     enc_key),
+            ).run()
+        except Exception:
+            pass  # already seeded
+
+    aid = uid_map["alice"]
+    bid = uid_map["bob"]
+    cid = uid_map["charlie"]
+    did = uid_map["diana"]
+
+    # ---- tags ----------------------------------------------------------------
+    tag_rows = [
+        ("tag-python", "Python"),
+        ("tag-js",     "JavaScript"),
+        ("tag-data",   "Data Science"),
+        ("tag-ml",     "Machine Learning"),
+        ("tag-webdev", "Web Development"),
+        ("tag-db",     "Databases"),
+        ("tag-cloud",  "Cloud"),
+    ]
+    for tid, tname in tag_rows:
+        try:
+            await env.DB.prepare(
+                "INSERT INTO tags (id,name) VALUES (?,?)"
+            ).bind(tid, tname).run()
+        except Exception:
+            pass
+
+    # ---- activities ----------------------------------------------------------
+    act_rows = [
+        (
+            "act-py-begin", "Python for Beginners",
+            "Learn Python programming from scratch. Master variables, loops, "
+            "functions, and object-oriented design in this hands-on course.",
+            "course", "self_paced", "ongoing", aid,
+            ["tag-python"],
+        ),
+        (
+            "act-js-meetup", "JavaScript Developers Meetup",
+            "Monthly meetup for JavaScript enthusiasts. Share projects, "
+            "discuss new frameworks, and network with fellow devs.",
+            "meetup", "live", "recurring", bid,
+            ["tag-js", "tag-webdev"],
+        ),
+        (
+            "act-ds-workshop", "Data Science Workshop",
+            "Hands-on workshop covering data wrangling with pandas, "
+            "visualisation with matplotlib, and intro to machine learning.",
+            "workshop", "live", "multi_session", aid,
+            ["tag-data", "tag-python"],
+        ),
+        (
+            "act-ml-study", "Machine Learning Study Group",
+            "Collaborative study group working through ML concepts, "
+            "reading papers, and implementing algorithms together.",
+            "course", "hybrid", "recurring", bid,
+            ["tag-ml", "tag-python"],
+        ),
+        (
+            "act-webdev", "Web Dev Fundamentals",
+            "Build modern responsive websites with HTML5, CSS3, and JavaScript. "
+            "Covers Flexbox, Grid, fetch API, and accessible design.",
+            "course", "self_paced", "ongoing", aid,
+            ["tag-webdev", "tag-js"],
+        ),
+        (
+            "act-db-design", "Database Design & SQL",
+            "Design normalised relational schemas, write complex SQL queries, "
+            "use indexes for speed, and understand transactions.",
+            "workshop", "live", "one_time", bid,
+            ["tag-db"],
+        ),
+    ]
+    for act_id, title, desc, atype, fmt, sched, host_id, tags in act_rows:
+        try:
+            await env.DB.prepare(
+                "INSERT INTO activities "
+                "(id,title,description,type,format,schedule_type,host_id)"
+                " VALUES (?,?,?,?,?,?,?)"
+            ).bind(
+                act_id, title, encrypt(desc, enc_key),
+                atype, fmt, sched, host_id
+            ).run()
+        except Exception:
+            pass
+        for tag_id in tags:
+            try:
+                await env.DB.prepare(
+                    "INSERT OR IGNORE INTO activity_tags (activity_id,tag_id)"
+                    " VALUES (?,?)"
+                ).bind(act_id, tag_id).run()
+            except Exception:
+                pass
+
+    # ---- sessions for live/recurring activities ------------------------------
+    ses_rows = [
+        ("ses-js-1", "act-js-meetup",
+         "April Meetup", "Q1 retro and React 19 deep-dive",
+         "2024-04-15 18:00", "2024-04-15 21:00", "Tech Hub, 123 Main St, SF"),
+        ("ses-js-2", "act-js-meetup",
+         "May Meetup", "TypeScript 5.4 and what's new in Node 22",
+         "2024-05-20 18:00", "2024-05-20 21:00", "Tech Hub, 123 Main St, SF"),
+        ("ses-ds-1", "act-ds-workshop",
+         "Session 1 - Data Wrangling",
+         "Introduction to pandas DataFrames and data cleaning",
+         "2024-06-01 10:00", "2024-06-01 14:00", "Online via Zoom"),
+        ("ses-ds-2", "act-ds-workshop",
+         "Session 2 - Visualisation",
+         "matplotlib, seaborn, and plotly for data storytelling",
+         "2024-06-08 10:00", "2024-06-08 14:00", "Online via Zoom"),
+        ("ses-ds-3", "act-ds-workshop",
+         "Session 3 - Intro to ML",
+         "scikit-learn: regression, classification, evaluation",
+         "2024-06-15 10:00", "2024-06-15 14:00", "Online via Zoom"),
+    ]
+    for sid, act_id, title, desc, start, end, loc in ses_rows:
+        try:
+            await env.DB.prepare(
+                "INSERT INTO sessions "
+                "(id,activity_id,title,description,start_time,end_time,location)"
+                " VALUES (?,?,?,?,?,?,?)"
+            ).bind(
+                sid, act_id, title,
+                encrypt(desc, enc_key),
+                start, end,
+                encrypt(loc, enc_key),
+            ).run()
+        except Exception:
+            pass
+
+    # ---- enrollments ---------------------------------------------------------
+    enr_rows = [
+        ("enr-c-py",     "act-py-begin",    cid, "participant"),
+        ("enr-c-js",     "act-js-meetup",   cid, "participant"),
+        ("enr-c-ds",     "act-ds-workshop", cid, "participant"),
+        ("enr-d-py",     "act-py-begin",    did, "participant"),
+        ("enr-d-webdev", "act-webdev",      did, "participant"),
+        ("enr-b-py",     "act-py-begin",    bid, "instructor"),
+    ]
+    for eid, act_id, uid, role in enr_rows:
+        try:
+            await env.DB.prepare(
+                "INSERT OR IGNORE INTO enrollments (id,activity_id,user_id,role)"
+                " VALUES (?,?,?,?)"
+            ).bind(eid, act_id, uid, role).run()
+        except Exception:
+            pass
+
+
+# ---------------------------------------------------------------------------
+# Static-asset serving  (Workers Sites / __STATIC_CONTENT KV)
+# ---------------------------------------------------------------------------
+
+_MIME = {
+    "html": "text/html; charset=utf-8",
+    "css":  "text/css; charset=utf-8",
+    "js":   "application/javascript; charset=utf-8",
+    "json": "application/json",
+    "png":  "image/png",
+    "jpg":  "image/jpeg",
+    "svg":  "image/svg+xml",
+    "ico":  "image/x-icon",
+}
+
+
+async def serve_static(path: str, env):
+    if path in ("/", ""):
+        key = "index.html"
+    else:
+        key = path.lstrip("/")
+        if "." not in key.split("/")[-1]:
+            key += ".html"
+
+    try:
+        content = await env.__STATIC_CONTENT.get(key, "text")
+    except Exception:
+        content = None
+
+    if content is None:
+        try:
+            content = await env.__STATIC_CONTENT.get("index.html", "text")
+        except Exception:
+            content = None
+
+    if content is None:
+        return Response(
+            "<h1>404 - Not Found</h1>",
+            status=404,
+            headers={"Content-Type": "text/html"},
+        )
+
+    ext  = key.rsplit(".", 1)[-1] if "." in key else "html"
+    mime = _MIME.get(ext, "text/plain")
+    return Response(content, headers={"Content-Type": mime, **_CORS})
+
diff --git a/src/security_utils.py b/src/security_utils.py
new file mode 100644
index 0000000..fef8fdd
--- /dev/null
+++ b/src/security_utils.py
@@ -0,0 +1,127 @@
+import base64
+import hashlib
+import hmac as _hmac
+import json
+import os
+
+def new_id() -> str:
+    """Generate a random UUID v4 using os.urandom."""
+    b = bytearray(os.urandom(16))
+    b[6] = (b[6] & 0x0F) | 0x40   # version 4
+    b[8] = (b[8] & 0x3F) | 0x80   # RFC 4122 variant
+    h = b.hex()
+    return f"{h[:8]}-{h[8:12]}-{h[12:16]}-{h[16:20]}-{h[20:]}"
+
+
+# ---------------------------------------------------------------------------
+# Encryption helpers
+# ---------------------------------------------------------------------------
+
+def _derive_key(secret: str) -> bytes:
+    """Derive a 32-byte key from an arbitrary secret string via SHA-256."""
+    return hashlib.sha256(secret.encode("utf-8")).digest()
+
+
+def encrypt(plaintext: str, secret: str) -> str:
+    """
+    XOR stream-cipher encryption.
+
+    Key is SHA-256 of secret, XOR'd byte-by-byte against plaintext.
+    Result is Base64-encoded for safe TEXT storage in D1.
+
+    XOR stream cipher - demonstration only. Replace with AES-GCM for production.
+    """
+    if not plaintext:
+        return ""
+    key  = _derive_key(secret)
+    data = plaintext.encode("utf-8")
+    ks   = (key * (len(data) // len(key) + 1))[: len(data)]
+    return base64.b64encode(bytes(a ^ b for a, b in zip(data, ks))).decode("ascii")
+
+
+def decrypt(ciphertext: str, secret: str) -> str:
+    """Reverse of encrypt(). XOR is self-inverse."""
+    if not ciphertext:
+        return ""
+    try:
+        key = _derive_key(secret)
+        raw = base64.b64decode(ciphertext)
+        ks  = (key * (len(raw) // len(key) + 1))[: len(raw)]
+        return bytes(a ^ b for a, b in zip(raw, ks)).decode("utf-8")
+    except Exception:
+        return "[decryption error]"
+
+
+def blind_index(value: str, secret: str) -> str:
+    """
+    HMAC-SHA256 deterministic hash of value used as a blind index.
+
+    Allows finding a row by plaintext value without decrypting every row.
+    The value is lower-cased before hashing so lookups are case-insensitive.
+    """
+    return _hmac.new(
+        secret.encode("utf-8"), value.lower().encode("utf-8"), hashlib.sha256
+    ).hexdigest()
+
+
+# ---------------------------------------------------------------------------
+# Password hashing
+# ---------------------------------------------------------------------------
+
+# ⚠️  For production, derive the pepper from a secret stored via
+#     `wrangler secret put PEPPER` and pass it to _user_salt() at runtime.
+#     Rotating the pepper requires re-hashing all stored passwords.
+_PEPPER    = b"edu-platform-cf-pepper-2024"
+_PBKDF2_IT = 100_000
+
+
+def _user_salt(username: str) -> bytes:
+    """Per-user PBKDF2 salt = SHA-256(pepper || username)."""
+    return hashlib.sha256(_PEPPER + username.encode("utf-8")).digest()
+
+
+def hash_password(password: str, username: str) -> str:
+    """PBKDF2-SHA256 with per-user derived salt."""
+    dk = hashlib.pbkdf2_hmac(
+        "sha256", password.encode("utf-8"), _user_salt(username), _PBKDF2_IT
+    )
+    return base64.b64encode(dk).decode("ascii")
+
+
+def verify_password(password: str, stored: str, username: str) -> bool:
+    return hash_password(password, username) == stored
+
+
+# ---------------------------------------------------------------------------
+# Auth tokens (HMAC-SHA256 signed, stateless JWT-lite)
+# ---------------------------------------------------------------------------
+
+def create_token(uid: str, username: str, role: str, secret: str) -> str:
+    payload = base64.b64encode(
+        json.dumps({"id": uid, "username": username, "role": role}).encode()
+    ).decode("ascii")
+    sig = _hmac.new(
+        secret.encode("utf-8"), payload.encode("utf-8"), hashlib.sha256
+    ).hexdigest()
+    return f"{payload}.{sig}"
+
+
+def verify_token(raw: str, secret: str):
+    """Return decoded payload dict or None if invalid/missing."""
+    if not raw:
+        return None
+    try:
+        token = raw.removeprefix("Bearer ").strip()
+        dot   = token.rfind(".")
+        if dot == -1:
+            return None
+        p, sig = token[:dot], token[dot + 1:]
+        exp = _hmac.new(
+            secret.encode("utf-8"), p.encode("utf-8"), hashlib.sha256
+        ).hexdigest()
+        if not _hmac.compare_digest(sig, exp):
+            return None
+        padding = (4 - len(p) % 4) % 4
+        return json.loads(base64.b64decode(p + "=" * padding).decode("utf-8"))
+    except Exception:
+        return None
diff --git a/src/worker.py b/src/worker.py
index 9656277..1cccfc6 100644
--- a/src/worker.py
+++ b/src/worker.py
@@ -29,1105 +29,36 @@
 Static HTML pages (public/) are served via Workers Sites (KV binding).
 """
 
-import base64
-import hashlib
-import hmac as _hmac
-import json
-import os
 import re
-import traceback
-from urllib.parse import urlparse, parse_qs
+from urllib.parse import urlparse
 
 from workers import Response
 
-
-def capture_exception(exc: Exception, req=None, _env=None, where: str = ""):
-    """Best-effort exception logging with full traceback and request context."""
-    try:
-        payload = {
-            "level": "error",
-            "where": where or "unknown",
-            "error_type": type(exc).__name__,
-            "error": str(exc),
-            "traceback": "".join(traceback.format_exception(type(exc), exc, exc.__traceback__)),
-        }
-        if req:
-            payload["request"] = {
-                "method": req.method,
-                "url": req.url,
-                "path": urlparse(req.url).path,
-            }
-        print(json.dumps(payload))
-    except Exception:
-        pass
-
-
-# ---------------------------------------------------------------------------
-# ID generation
-# ---------------------------------------------------------------------------
-
-def new_id() -> str:
-    """Generate a random UUID v4 using os.urandom."""
-    b = bytearray(os.urandom(16))
-    b[6] = (b[6] & 0x0F) | 0x40   # version 4
-    b[8] = (b[8] & 0x3F) | 0x80   # RFC 4122 variant
-    h = b.hex()
-    return f"{h[:8]}-{h[8:12]}-{h[12:16]}-{h[16:20]}-{h[20:]}"
-
-
-# ---------------------------------------------------------------------------
-# Encryption helpers
-# ---------------------------------------------------------------------------
-
-def _derive_key(secret: str) -> bytes:
-    """Derive a 32-byte key from an arbitrary secret string via SHA-256."""
-    return hashlib.sha256(secret.encode("utf-8")).digest()
-
-
-def encrypt(plaintext: str, secret: str) -> str:
-    """
-    XOR stream-cipher encryption.
-
-    Key is SHA-256 of secret, XOR'd byte-by-byte against plaintext.
-    Result is Base64-encoded for safe TEXT storage in D1.
-
-    XOR stream cipher - demonstration only. Replace with AES-GCM for production.
-    """
-    if not plaintext:
-        return ""
-    key  = _derive_key(secret)
-    data = plaintext.encode("utf-8")
-    ks   = (key * (len(data) // len(key) + 1))[: len(data)]
-    return base64.b64encode(bytes(a ^ b for a, b in zip(data, ks))).decode("ascii")
-
-
-def decrypt(ciphertext: str, secret: str) -> str:
-    """Reverse of encrypt(). XOR is self-inverse."""
-    if not ciphertext:
-        return ""
-    try:
-        key = _derive_key(secret)
-        raw = base64.b64decode(ciphertext)
-        ks  = (key * (len(raw) // len(key) + 1))[: len(raw)]
-        return bytes(a ^ b for a, b in zip(raw, ks)).decode("utf-8")
-    except Exception:
-        return "[decryption error]"
-
-
-def blind_index(value: str, secret: str) -> str:
-    """
-    HMAC-SHA256 deterministic hash of value used as a blind index.
-
-    Allows finding a row by plaintext value without decrypting every row.
-    The value is lower-cased before hashing so lookups are case-insensitive.
-    """
-    return _hmac.new(
-        secret.encode("utf-8"), value.lower().encode("utf-8"), hashlib.sha256
-    ).hexdigest()
-
-
-# ---------------------------------------------------------------------------
-# Password hashing
-# ---------------------------------------------------------------------------
-
-# ⚠️  For production, derive the pepper from a secret stored via
-#     `wrangler secret put PEPPER` and pass it to _user_salt() at runtime.
-#     Rotating the pepper requires re-hashing all stored passwords.
-_PEPPER    = b"edu-platform-cf-pepper-2024"
-_PBKDF2_IT = 100_000
-
-
-def _user_salt(username: str) -> bytes:
-    """Per-user PBKDF2 salt = SHA-256(pepper || username)."""
-    return hashlib.sha256(_PEPPER + username.encode("utf-8")).digest()
-
-
-def hash_password(password: str, username: str) -> str:
-    """PBKDF2-SHA256 with per-user derived salt."""
-    dk = hashlib.pbkdf2_hmac(
-        "sha256", password.encode("utf-8"), _user_salt(username), _PBKDF2_IT
-    )
-    return base64.b64encode(dk).decode("ascii")
-
-
-def verify_password(password: str, stored: str, username: str) -> bool:
-    return hash_password(password, username) == stored
-
-
-# ---------------------------------------------------------------------------
-# Auth tokens (HMAC-SHA256 signed, stateless JWT-lite)
-# ---------------------------------------------------------------------------
-
-def create_token(uid: str, username: str, role: str, secret: str) -> str:
-    payload = base64.b64encode(
-        json.dumps({"id": uid, "username": username, "role": role}).encode()
-    ).decode("ascii")
-    sig = _hmac.new(
-        secret.encode("utf-8"), payload.encode("utf-8"), hashlib.sha256
-    ).hexdigest()
-    return f"{payload}.{sig}"
-
-
-def verify_token(raw: str, secret: str):
-    """Return decoded payload dict or None if invalid/missing."""
-    if not raw:
-        return None
-    try:
-        token = raw.removeprefix("Bearer ").strip()
-        dot   = token.rfind(".")
-        if dot == -1:
-            return None
-        p, sig = token[:dot], token[dot + 1:]
-        exp = _hmac.new(
-            secret.encode("utf-8"), p.encode("utf-8"), hashlib.sha256
-        ).hexdigest()
-        if not _hmac.compare_digest(sig, exp):
-            return None
-        padding = (4 - len(p) % 4) % 4
-        return json.loads(base64.b64decode(p + "=" * padding).decode("utf-8"))
-    except Exception:
-        return None
-
-
-# ---------------------------------------------------------------------------
-# Response helpers
-# ---------------------------------------------------------------------------
-
-_CORS = {
-    "Access-Control-Allow-Origin":  "*",
-    "Access-Control-Allow-Methods": "GET, POST, PUT, DELETE, OPTIONS",
-    "Access-Control-Allow-Headers": "Content-Type, Authorization",
-}
-
-
-def json_resp(data, status: int = 200):
-    return Response(
-        json.dumps(data),
-        status=status,
-        headers={"Content-Type": "application/json", **_CORS},
-    )
-
-
-def ok(data=None, msg: str = "OK"):
-    body = {"success": True, "message": msg}
-    if data is not None:
-        body["data"] = data
-    return json_resp(body, 200)
-
-
-def err(msg: str, status: int = 400):
-    return json_resp({"error": msg}, status)
-
-
-async def parse_json_object(req):
-    """Parse request JSON and ensure payload is an object/dict."""
-    try:
-        text = await req.text()
-        body = json.loads(text)
-    except Exception:
-        return None, err("Invalid JSON body")
-
-    if not isinstance(body, dict):
-        return None, err("JSON body must be an object", 400)
-
-    return body, None
-
-
-def _clean_path(value: str, default: str = "/admin") -> str:
-    """Normalize an env-provided path into a safe absolute URL path."""
-    raw = (value or "").strip()
-    if not raw:
-        return default
-    parsed = urlparse(raw)
-    path = (parsed.path or raw).strip()
-    if not path.startswith("/"):
-        path = "/" + path
-    path = re.sub(r"/+", "/", path)
-    if len(path) > 1 and path.endswith("/"):
-        path = path[:-1]
-    return path or default
-
-
-def _unauthorized_basic(realm: str = "Alpha One Labs Admin"):
-    return Response(
-        "Authentication required",
-        status=401,
-        headers={"WWW-Authenticate": f'Basic realm="{realm}"', **_CORS},
-    )
-
-
-def _is_basic_auth_valid(req, env) -> bool:
-    username = (getattr(env, "ADMIN_BASIC_USER", "") or "").strip()
-    password = (getattr(env, "ADMIN_BASIC_PASS", "") or "").strip()
-    if not username or not password:
-        return False
-
-    auth = req.headers.get("Authorization") or ""
-    if not auth.lower().startswith("basic "):
-        return False
-
-    try:
-        raw = auth.split(" ", 1)[1].strip()
-        decoded = base64.b64decode(raw).decode("utf-8")
-        user, pwd = decoded.split(":", 1)
-    except Exception:
-        return False
-
-    return _hmac.compare_digest(user, username) and _hmac.compare_digest(pwd, password)
-
-
-# ---------------------------------------------------------------------------
-# DDL - full schema (mirrors schema.sql)
-# ---------------------------------------------------------------------------
-
-_DDL = [
-    # Users - all PII encrypted; HMAC blind indexes for O(1) lookups
-    """CREATE TABLE IF NOT EXISTS users (
-        id            TEXT PRIMARY KEY,
-        username_hash TEXT NOT NULL UNIQUE,
-        email_hash    TEXT NOT NULL UNIQUE,
-        name          TEXT NOT NULL,
-        username      TEXT NOT NULL,
-        email         TEXT NOT NULL,
-        password_hash TEXT NOT NULL,
-        role          TEXT NOT NULL,
-        created_at    TEXT NOT NULL DEFAULT (datetime('now'))
-    )""",
-    # Activities
-    """CREATE TABLE IF NOT EXISTS activities (
-        id            TEXT PRIMARY KEY,
-        title         TEXT NOT NULL,
-        description   TEXT,
-        type          TEXT NOT NULL DEFAULT 'course',
-        format        TEXT NOT NULL DEFAULT 'self_paced',
-        schedule_type TEXT NOT NULL DEFAULT 'ongoing',
-        host_id       TEXT NOT NULL,
-        created_at    TEXT NOT NULL DEFAULT (datetime('now')),
-        FOREIGN KEY (host_id) REFERENCES users(id)
-    )""",
-    # Sessions
-    """CREATE TABLE IF NOT EXISTS sessions (
-        id          TEXT PRIMARY KEY,
-        activity_id TEXT NOT NULL,
-        title       TEXT,
-        description TEXT,
-        start_time  TEXT,
-        end_time    TEXT,
-        location    TEXT,
-        created_at  TEXT NOT NULL DEFAULT (datetime('now')),
-        FOREIGN KEY (activity_id) REFERENCES activities(id)
-    )""",
-    # Enrollments
-    """CREATE TABLE IF NOT EXISTS enrollments (
-        id          TEXT PRIMARY KEY,
-        activity_id TEXT NOT NULL,
-        user_id     TEXT NOT NULL,
-        role        TEXT NOT NULL DEFAULT 'participant',
-        status      TEXT NOT NULL DEFAULT 'active',
-        created_at  TEXT NOT NULL DEFAULT (datetime('now')),
-        UNIQUE (activity_id, user_id),
-        FOREIGN KEY (activity_id) REFERENCES activities(id),
-        FOREIGN KEY (user_id)     REFERENCES users(id)
-    )""",
-    # Session attendance
-    """CREATE TABLE IF NOT EXISTS session_attendance (
-        id         TEXT PRIMARY KEY,
-        session_id TEXT NOT NULL,
-        user_id    TEXT NOT NULL,
-        status     TEXT NOT NULL DEFAULT 'registered',
-        created_at TEXT NOT NULL DEFAULT (datetime('now')),
-        UNIQUE (session_id, user_id),
-        FOREIGN KEY (session_id) REFERENCES sessions(id),
-        FOREIGN KEY (user_id)    REFERENCES users(id)
-    )""",
-    # Tags
-    """CREATE TABLE IF NOT EXISTS tags (
-        id   TEXT PRIMARY KEY,
-        name TEXT UNIQUE NOT NULL
-    )""",
-    # Activity-tag junction
-    """CREATE TABLE IF NOT EXISTS activity_tags (
-        activity_id TEXT NOT NULL,
-        tag_id      TEXT NOT NULL,
-        PRIMARY KEY (activity_id, tag_id),
-        FOREIGN KEY (activity_id) REFERENCES activities(id),
-        FOREIGN KEY (tag_id)      REFERENCES tags(id)
-    )""",
-    # Indexes
-    "CREATE INDEX IF NOT EXISTS idx_activities_host      ON activities(host_id)",
-    "CREATE INDEX IF NOT EXISTS idx_enrollments_activity ON enrollments(activity_id)",
-    "CREATE INDEX IF NOT EXISTS idx_enrollments_user     ON enrollments(user_id)",
-    "CREATE INDEX IF NOT EXISTS idx_sessions_activity    ON sessions(activity_id)",
-    "CREATE INDEX IF NOT EXISTS idx_sa_session           ON session_attendance(session_id)",
-    "CREATE INDEX IF NOT EXISTS idx_sa_user              ON session_attendance(user_id)",
-    "CREATE INDEX IF NOT EXISTS idx_at_activity          ON activity_tags(activity_id)",
-]
-
-
-async def init_db(env):
-    for sql in _DDL:
-        await env.DB.prepare(sql).run()
-
-
-# ---------------------------------------------------------------------------
-# Sample-data seeding
-# ---------------------------------------------------------------------------
-
-async def seed_db(env, enc_key: str):
-    # ---- users ---------------------------------------------------------------
-    seed_users = [
-        ("alice",   "alice@example.com",   "password123", "host",   "Alice Chen"),
-        ("bob",     "bob@example.com",     "password123", "host",   "Bob Martinez"),
-        ("charlie", "charlie@example.com", "password123", "member", "Charlie Kim"),
-        ("diana",   "diana@example.com",   "password123", "member", "Diana Patel"),
-    ]
-    uid_map = {}
-    for uname, email, pw, role, display in seed_users:
-        uid = f"usr-{uname}"
-        uid_map[uname] = uid
-        try:
-            await env.DB.prepare(
-                "INSERT INTO users "
-                "(id,username_hash,email_hash,name,username,email,password_hash,role)"
-                " VALUES (?,?,?,?,?,?,?,?)"
-            ).bind(
-                uid,
-                blind_index(uname, enc_key),
-                blind_index(email, enc_key),
-                encrypt(display,  enc_key),
-                encrypt(uname,    enc_key),
-                encrypt(email,    enc_key),
-                hash_password(pw, uname),
-                encrypt(role,     enc_key),
-            ).run()
-        except Exception:
-            pass  # already seeded
-
-    aid = uid_map["alice"]
-    bid = uid_map["bob"]
-    cid = uid_map["charlie"]
-    did = uid_map["diana"]
-
-    # ---- tags ----------------------------------------------------------------
-    tag_rows = [
-        ("tag-python", "Python"),
-        ("tag-js",     "JavaScript"),
-        ("tag-data",   "Data Science"),
-        ("tag-ml",     "Machine Learning"),
-        ("tag-webdev", "Web Development"),
-        ("tag-db",     "Databases"),
-        ("tag-cloud",  "Cloud"),
-    ]
-    for tid, tname in tag_rows:
-        try:
-            await env.DB.prepare(
-                "INSERT INTO tags (id,name) VALUES (?,?)"
-            ).bind(tid, tname).run()
-        except Exception:
-            pass
-
-    # ---- activities ----------------------------------------------------------
-    act_rows = [
-        (
-            "act-py-begin", "Python for Beginners",
-            "Learn Python programming from scratch. Master variables, loops, "
-            "functions, and object-oriented design in this hands-on course.",
-            "course", "self_paced", "ongoing", aid,
-            ["tag-python"],
-        ),
-        (
-            "act-js-meetup", "JavaScript Developers Meetup",
-            "Monthly meetup for JavaScript enthusiasts. Share projects, "
-            "discuss new frameworks, and network with fellow devs.",
-            "meetup", "live", "recurring", bid,
-            ["tag-js", "tag-webdev"],
-        ),
-        (
-            "act-ds-workshop", "Data Science Workshop",
-            "Hands-on workshop covering data wrangling with pandas, "
-            "visualisation with matplotlib, and intro to machine learning.",
-            "workshop", "live", "multi_session", aid,
-            ["tag-data", "tag-python"],
-        ),
-        (
-            "act-ml-study", "Machine Learning Study Group",
-            "Collaborative study group working through ML concepts, "
-            "reading papers, and implementing algorithms together.",
-            "course", "hybrid", "recurring", bid,
-            ["tag-ml", "tag-python"],
-        ),
-        (
-            "act-webdev", "Web Dev Fundamentals",
-            "Build modern responsive websites with HTML5, CSS3, and JavaScript. "
-            "Covers Flexbox, Grid, fetch API, and accessible design.",
-            "course", "self_paced", "ongoing", aid,
-            ["tag-webdev", "tag-js"],
-        ),
-        (
-            "act-db-design", "Database Design & SQL",
-            "Design normalised relational schemas, write complex SQL queries, "
-            "use indexes for speed, and understand transactions.",
-            "workshop", "live", "one_time", bid,
-            ["tag-db"],
-        ),
-    ]
-    for act_id, title, desc, atype, fmt, sched, host_id, tags in act_rows:
-        try:
-            await env.DB.prepare(
-                "INSERT INTO activities "
-                "(id,title,description,type,format,schedule_type,host_id)"
-                " VALUES (?,?,?,?,?,?,?)"
-            ).bind(
-                act_id, title, encrypt(desc, enc_key),
-                atype, fmt, sched, host_id
-            ).run()
-        except Exception:
-            pass
-        for tag_id in tags:
-            try:
-                await env.DB.prepare(
-                    "INSERT OR IGNORE INTO activity_tags (activity_id,tag_id)"
-                    " VALUES (?,?)"
-                ).bind(act_id, tag_id).run()
-            except Exception:
-                pass
-
-    # ---- sessions for live/recurring activities ------------------------------
-    ses_rows = [
-        ("ses-js-1", "act-js-meetup",
-         "April Meetup", "Q1 retro and React 19 deep-dive",
-         "2024-04-15 18:00", "2024-04-15 21:00", "Tech Hub, 123 Main St, SF"),
-        ("ses-js-2", "act-js-meetup",
-         "May Meetup", "TypeScript 5.4 and what's new in Node 22",
-         "2024-05-20 18:00", "2024-05-20 21:00", "Tech Hub, 123 Main St, SF"),
-        ("ses-ds-1", "act-ds-workshop",
-         "Session 1 - Data Wrangling",
-         "Introduction to pandas DataFrames and data cleaning",
-         "2024-06-01 10:00", "2024-06-01 14:00", "Online via Zoom"),
-        ("ses-ds-2", "act-ds-workshop",
-         "Session 2 - Visualisation",
-         "matplotlib, seaborn, and plotly for data storytelling",
-         "2024-06-08 10:00", "2024-06-08 14:00", "Online via Zoom"),
-        ("ses-ds-3", "act-ds-workshop",
-         "Session 3 - Intro to ML",
-         "scikit-learn: regression, classification, evaluation",
-         "2024-06-15 10:00", "2024-06-15 14:00", "Online via Zoom"),
-    ]
-    for sid, act_id, title, desc, start, end, loc in ses_rows:
-        try:
-            await env.DB.prepare(
-                "INSERT INTO sessions "
-                "(id,activity_id,title,description,start_time,end_time,location)"
-                " VALUES (?,?,?,?,?,?,?)"
-            ).bind(
-                sid, act_id, title,
-                encrypt(desc, enc_key),
-                start, end,
-                encrypt(loc, enc_key),
-            ).run()
-        except Exception:
-            pass
-
-    # ---- enrollments ---------------------------------------------------------
-    enr_rows = [
-        ("enr-c-py",     "act-py-begin",    cid, "participant"),
-        ("enr-c-js",     "act-js-meetup",   cid, "participant"),
-        ("enr-c-ds",     "act-ds-workshop", cid, "participant"),
-        ("enr-d-py",     "act-py-begin",    did, "participant"),
-        ("enr-d-webdev", "act-webdev",      did, "participant"),
-        ("enr-b-py",     "act-py-begin",    bid, "instructor"),
-    ]
-    for eid, act_id, uid, role in enr_rows:
-        try:
-            await env.DB.prepare(
-                "INSERT OR IGNORE INTO enrollments (id,activity_id,user_id,role)"
-                " VALUES (?,?,?,?)"
-            ).bind(eid, act_id, uid, role).run()
-        except Exception:
-            pass
-
-
-# ---------------------------------------------------------------------------
-# API handlers
-# ---------------------------------------------------------------------------
-
-async def api_register(req, env):
-    body, bad_resp = await parse_json_object(req)
-    if bad_resp:
-        return bad_resp
-
-    username = (body.get("username") or "").strip()
-    email    = (body.get("email")    or "").strip()
-    password = (body.get("password") or "")
-    name     = (body.get("name")     or username).strip()
-
-    if not username or not email or not password:
-        return err("username, email, and password are required")
-    if len(password) < 8:
-        return err("Password must be at least 8 characters")
-
-    role = "member"
-
-    enc = env.ENCRYPTION_KEY
-    uid = new_id()
-    try:
-        await env.DB.prepare(
-            "INSERT INTO users "
-            "(id,username_hash,email_hash,name,username,email,password_hash,role)"
-            " VALUES (?,?,?,?,?,?,?,?)"
-        ).bind(
-            uid,
-            blind_index(username, enc),
-            blind_index(email,    enc),
-            encrypt(name,     enc),
-            encrypt(username, enc),
-            encrypt(email,    enc),
-            hash_password(password, username),
-            encrypt(role, enc),
-        ).run()
-    except Exception as e:
-        if "UNIQUE" in str(e):
-            return err("Username or email already registered", 409)
-        capture_exception(e, req, env, "api_register.insert_user")
-        return err("Registration failed — please try again", 500)
-
-    token = create_token(uid, username, role, env.JWT_SECRET)
-    return ok(
-        {"token": token,
-         "user": {"id": uid, "username": username, "name": name, "role": role}},
-        "Registration successful",
-    )
-
-
-async def api_login(req, env):
-    body, bad_resp = await parse_json_object(req)
-    if bad_resp:
-        return bad_resp
-
-    username = (body.get("username") or "").strip()
-    password = (body.get("password") or "")
-
-    if not username or not password:
-        return err("username and password are required")
-
-    enc    = env.ENCRYPTION_KEY
-    u_hash = blind_index(username, enc)
-    row    = await env.DB.prepare(
-        "SELECT id,password_hash,role,name,username FROM users WHERE username_hash=?"
-    ).bind(u_hash).first()
-
-    if not row:
-        return err("Invalid username or password", 401)
-    
-    password_hash = row.password_hash
-    user_id = row.id
-    role_enc = row.role
-    name_enc = row.name
-    username_enc = row.username
-    stored_username = decrypt(username_enc, enc)
-
-    if not verify_password(password, password_hash, stored_username):
-        return err("Invalid username or password", 401)
-
-    real_role = decrypt(role_enc, enc)
-    real_name = decrypt(name_enc, enc)
-    token     = create_token(user_id, stored_username, real_role, env.JWT_SECRET)
-    return ok(
-        {"token": token,
-         "user": {"id": user_id, "username": stored_username,
-                  "name": real_name, "role": real_role}},
-        "Login successful",
-    )
-
-
-async def api_list_activities(req, env):
-    parsed = urlparse(req.url)
-    params = parse_qs(parsed.query)
-    atype  = (params.get("type")   or [None])[0]
-    fmt    = (params.get("format") or [None])[0]
-    search = (params.get("q")      or [None])[0]
-    tag    = (params.get("tag")    or [None])[0]
-    enc    = env.ENCRYPTION_KEY
-
-    base_q = (
-        "SELECT a.id,a.title,a.description,a.type,a.format,a.schedule_type,"
-        "a.created_at,u.name AS host_name_enc,"
-        "(SELECT COUNT(*) FROM enrollments WHERE activity_id=a.id AND status='active')"
-        " AS participant_count,"
-        "(SELECT COUNT(*) FROM sessions WHERE activity_id=a.id) AS session_count"
-        " FROM activities a JOIN users u ON a.host_id=u.id"
-    )
-
-    if tag:
-        tag_row = await env.DB.prepare(
-            "SELECT id FROM tags WHERE name=?"
-        ).bind(tag).first()
-        if not tag_row:
-            return json_resp({"activities": []})
-        res = await env.DB.prepare(
-            base_q
-            + " JOIN activity_tags at2 ON at2.activity_id=a.id"
-              " WHERE at2.tag_id=? ORDER BY a.created_at DESC"
-        ).bind(tag_row.id).all()
-    elif atype and fmt:
-        res = await env.DB.prepare(
-            base_q + " WHERE a.type=? AND a.format=? ORDER BY a.created_at DESC"
-        ).bind(atype, fmt).all()
-    elif atype:
-        res = await env.DB.prepare(
-            base_q + " WHERE a.type=? ORDER BY a.created_at DESC"
-        ).bind(atype).all()
-    elif fmt:
-        res = await env.DB.prepare(
-            base_q + " WHERE a.format=? ORDER BY a.created_at DESC"
-        ).bind(fmt).all()
-    else:
-        res = await env.DB.prepare(
-            base_q + " ORDER BY a.created_at DESC"
-        ).all()
-
-    activities = []
-    for row in res.results or []:
-        desc      = decrypt(row.description or "", enc)
-        host_name = decrypt(row.host_name_enc or "", enc)
-        if search and (
-            search.lower() not in row.title.lower()
-            and search.lower() not in desc.lower()
-        ):
-            continue
-
-        t_res = await env.DB.prepare(
-            "SELECT t.name FROM tags t"
-            " JOIN activity_tags at2 ON at2.tag_id=t.id"
-            " WHERE at2.activity_id=?"
-        ).bind(row.id).all()
-
-        activities.append({
-            "id":                row.id,
-            "title":             row.title,
-            "description":       desc,
-            "type":              row.type,
-            "format":            row.format,
-            "schedule_type":     row.schedule_type,
-            "host_name":         host_name,
-            "participant_count": row.participant_count,
-            "session_count":     row.session_count,
-            "tags":              [t.name for t in (t_res.results or [])],
-            "created_at":        row.created_at,
-        })
-
-    return json_resp({"activities": activities})
-
-
-async def api_create_activity(req, env):
-    user = verify_token(req.headers.get("Authorization"), env.JWT_SECRET)
-    if not user:
-        return err("Authentication required", 401)
-
-    body, bad_resp = await parse_json_object(req)
-    if bad_resp:
-        return bad_resp
-
-    title         = (body.get("title")         or "").strip()
-    description   = (body.get("description")   or "").strip()
-    atype         = (body.get("type")          or "course").strip()
-    fmt           = (body.get("format")        or "self_paced").strip()
-    schedule_type = (body.get("schedule_type") or "ongoing").strip()
-
-    if not title:
-        return err("title is required")
-    if atype not in ("course", "meetup", "workshop", "seminar", "other"):
-        atype = "course"
-    if fmt not in ("live", "self_paced", "hybrid"):
-        fmt = "self_paced"
-    if schedule_type not in ("one_time", "multi_session", "recurring", "ongoing"):
-        schedule_type = "ongoing"
-
-    enc    = env.ENCRYPTION_KEY
-    act_id = new_id()
-    try:
-        await env.DB.prepare(
-            "INSERT INTO activities "
-            "(id,title,description,type,format,schedule_type,host_id)"
-            " VALUES (?,?,?,?,?,?,?)"
-        ).bind(
-            act_id, title,
-            encrypt(description, enc) if description else "",
-            atype, fmt, schedule_type, user["id"]
-        ).run()
-    except Exception as e:
-        capture_exception(e, req, env, "api_create_activity.insert_activity")
-        return err("Failed to create activity — please try again", 500)
-
-    for tag_name in (body.get("tags") or []):
-        tag_name = tag_name.strip()
-        if not tag_name:
-            continue
-        t_row = await env.DB.prepare(
-            "SELECT id FROM tags WHERE name=?"
-        ).bind(tag_name).first()
-        if t_row:
-            tag_id = t_row.id
-        else:
-            tag_id = new_id()
-            try:
-                await env.DB.prepare(
-                    "INSERT INTO tags (id,name) VALUES (?,?)"
-                ).bind(tag_id, tag_name).run()
-            except Exception as e:
-                capture_exception(e, req, env, f"api_create_activity.insert_tag: tag_name={tag_name}, tag_id={tag_id}, act_id={act_id}")
-                continue
-        try:
-            await env.DB.prepare(
-                "INSERT OR IGNORE INTO activity_tags (activity_id,tag_id) VALUES (?,?)"
-            ).bind(act_id, tag_id).run()
-        except Exception as e:
-            capture_exception(e, req, env, f"api_create_activity.insert_activity_tags: tag_name={tag_name}, tag_id={tag_id}, act_id={act_id}")
-            pass
-
-    return ok({"id": act_id, "title": title}, "Activity created")
-
-
-async def api_get_activity(act_id: str, req, env):
-    user    = verify_token(req.headers.get("Authorization") or "", env.JWT_SECRET)
-    enc     = env.ENCRYPTION_KEY
-
-    act = await env.DB.prepare(
-        "SELECT a.*,u.name AS host_name_enc,u.id AS host_uid"
-        " FROM activities a JOIN users u ON a.host_id=u.id"
-        " WHERE a.id=?"
-    ).bind(act_id).first()
-    if not act:
-        return err("Activity not found", 404)
-
-    enrollment  = None
-    is_enrolled = False
-    if user:
-        enrollment  = await env.DB.prepare(
-            "SELECT id,role,status FROM enrollments"
-            " WHERE activity_id=? AND user_id=?"
-        ).bind(act_id, user["id"]).first()
-        is_enrolled = enrollment is not None
-
-    is_host = bool(user and act.host_uid == user["id"])
-
-    ses_res = await env.DB.prepare(
-        "SELECT id,title,description,start_time,end_time,location,created_at"
-        " FROM sessions WHERE activity_id=? ORDER BY start_time"
-    ).bind(act_id).all()
-
-    sessions = []
-    for s in ses_res.results or []:
-        sessions.append({
-            "id":          s.id,
-            "title":       s.title,
-            "description": decrypt(s.description or "", enc) if (is_enrolled or is_host) else None,
-            "start_time":  s.start_time,
-            "end_time":    s.end_time,
-            "location":    decrypt(s.location or "", enc) if (is_enrolled or is_host) else None,
-        })
-
-    t_res = await env.DB.prepare(
-        "SELECT t.name FROM tags t"
-        " JOIN activity_tags at2 ON at2.tag_id=t.id"
-        " WHERE at2.activity_id=?"
-    ).bind(act_id).all()
-
-    count_row = await env.DB.prepare(
-        "SELECT COUNT(*) AS cnt FROM enrollments WHERE activity_id=? AND status='active'"
-    ).bind(act_id).first()
-
-    return json_resp({
-        "activity": {
-            "id":                act.id,
-            "title":             act.title,
-            "description":       decrypt(act.description or "", enc),
-            "type":              act.type,
-            "format":            act.format,
-            "schedule_type":     act.schedule_type,
-            "host_name":         decrypt(act.host_name_enc or "", enc),
-            "participant_count": count_row.cnt if count_row else 0,
-            "tags":              [t.name for t in (t_res.results or [])],
-            "created_at":        act.created_at,
-        },
-        "sessions":    sessions,
-        "is_enrolled": is_enrolled,
-        "is_host":     is_host,
-        "enrollment":  {
-            "role":   enrollment.role,
-            "status": enrollment.status,
-        } if enrollment else None,
-    })
-
-
-async def api_join(req, env):
-    user = verify_token(req.headers.get("Authorization"), env.JWT_SECRET)
-    if not user:
-        return err("Authentication required", 401)
-
-    body, bad_resp = await parse_json_object(req)
-    if bad_resp:
-        return bad_resp
-
-    act_id = body.get("activity_id")
-    role   = (body.get("role") or "participant").strip()
-
-    if not act_id:
-        return err("activity_id is required")
-    if role not in ("participant", "instructor", "organizer"):
-        role = "participant"
-
-    act = await env.DB.prepare(
-        "SELECT id FROM activities WHERE id=?"
-    ).bind(act_id).first()
-    if not act:
-        return err("Activity not found", 404)
-
-    enr_id = new_id()
-    try:
-        await env.DB.prepare(
-            "INSERT OR IGNORE INTO enrollments (id,activity_id,user_id,role)"
-            " VALUES (?,?,?,?)"
-        ).bind(enr_id, act_id, user["id"], role).run()
-    except Exception as e:
-        capture_exception(e, req, env, "api_join.insert_enrollment")
-        return err("Failed to join activity — please try again", 500)
-
-    return ok(None, "Joined activity successfully")
-
-
-async def api_dashboard(req, env):
-    user = verify_token(req.headers.get("Authorization"), env.JWT_SECRET)
-    if not user:
-        return err("Authentication required", 401)
-
-    enc = env.ENCRYPTION_KEY
-
-    res = await env.DB.prepare(
-        "SELECT a.id,a.title,a.type,a.format,a.schedule_type,a.created_at,"
-        "(SELECT COUNT(*) FROM enrollments WHERE activity_id=a.id AND status='active')"
-        " AS participant_count,"
-        "(SELECT COUNT(*) FROM sessions WHERE activity_id=a.id) AS session_count"
-        " FROM activities a WHERE a.host_id=? ORDER BY a.created_at DESC"
-    ).bind(user["id"]).all()
-
-    hosted = []
-    for r in res.results or []:
-        t_res = await env.DB.prepare(
-            "SELECT t.name FROM tags t JOIN activity_tags at2 ON at2.tag_id=t.id"
-            " WHERE at2.activity_id=?"
-        ).bind(r.id).all()
-        hosted.append({
-            "id":                r.id,
-            "title":             r.title,
-            "type":              r.type,
-            "format":            r.format,
-            "schedule_type":     r.schedule_type,
-            "participant_count": r.participant_count,
-            "session_count":     r.session_count,
-            "tags":              [t.name for t in (t_res.results or [])],
-            "created_at":        r.created_at,
-        })
-
-    res2 = await env.DB.prepare(
-        "SELECT a.id,a.title,a.type,a.format,a.schedule_type,"
-        "e.role AS enr_role,e.status AS enr_status,e.created_at AS joined_at,"
-        "u.name AS host_name_enc"
-        " FROM enrollments e"
-        " JOIN activities a ON e.activity_id=a.id"
-        " JOIN users u ON a.host_id=u.id"
-        " WHERE e.user_id=? ORDER BY e.created_at DESC"
-    ).bind(user["id"]).all()
-
-    joined = []
-    for r in res2.results or []:
-        t_res = await env.DB.prepare(
-            "SELECT t.name FROM tags t JOIN activity_tags at2 ON at2.tag_id=t.id"
-            " WHERE at2.activity_id=?"
-        ).bind(r.id).all()
-        joined.append({
-            "id":            r.id,
-            "title":         r.title,
-            "type":          r.type,
-            "format":        r.format,
-            "schedule_type": r.schedule_type,
-            "enr_role":      r.enr_role,
-            "enr_status":    r.enr_status,
-            "host_name":     decrypt(r.host_name_enc or "", enc),
-            "tags":          [t.name for t in (t_res.results or [])],
-            "joined_at":     r.joined_at,
-        })
-
-    return json_resp({"user": user, "hosted_activities": hosted, "joined_activities": joined})
-
-
-async def api_create_session(req, env):
-    user = verify_token(req.headers.get("Authorization"), env.JWT_SECRET)
-    if not user:
-        return err("Authentication required", 401)
-
-    body, bad_resp = await parse_json_object(req)
-    if bad_resp:
-        return bad_resp
-
-    act_id      = body.get("activity_id")
-    title       = (body.get("title")       or "").strip()
-    description = (body.get("description") or "").strip()
-    start_time  = (body.get("start_time")  or "").strip()
-    end_time    = (body.get("end_time")    or "").strip()
-    location    = (body.get("location")    or "").strip()
-
-    if not act_id or not title:
-        return err("activity_id and title are required")
-
-    owned = await env.DB.prepare(
-        "SELECT id FROM activities WHERE id=? AND host_id=?"
-    ).bind(act_id, user["id"]).first()
-    if not owned:
-        return err("Activity not found or access denied", 404)
-
-    enc = env.ENCRYPTION_KEY
-    sid = new_id()
-    try:
-        await env.DB.prepare(
-            "INSERT INTO sessions "
-            "(id,activity_id,title,description,start_time,end_time,location)"
-            " VALUES (?,?,?,?,?,?,?)"
-        ).bind(
-            sid, act_id, title,
-            encrypt(description, enc) if description else "",
-            start_time, end_time,
-            encrypt(location, enc) if location else "",
-        ).run()
-    except Exception as e:
-        capture_exception(e, req, env, "api_create_session.insert_session")
-        return err("Failed to create session — please try again", 500)
-
-    return ok({"id": sid}, "Session created")
-
-
-async def api_list_tags(_req, env):
-    res  = await env.DB.prepare("SELECT id,name FROM tags ORDER BY name").all()
-    tags = [{"id": r.id, "name": r.name} for r in (res.results or [])]
-    return json_resp({"tags": tags})
-
-
-async def api_add_activity_tags(req, env):
-    user = verify_token(req.headers.get("Authorization"), env.JWT_SECRET)
-    if not user:
-        return err("Authentication required", 401)
-
-    body, bad_resp = await parse_json_object(req)
-    if bad_resp:
-        return bad_resp
-
-    act_id = body.get("activity_id")
-    tags   = body.get("tags") or []
-
-    if not act_id:
-        return err("activity_id is required")
-
-    owned = await env.DB.prepare(
-        "SELECT id FROM activities WHERE id=? AND host_id=?"
-    ).bind(act_id, user["id"]).first()
-    if not owned:
-        return err("Activity not found or access denied", 404)
-
-    for tag_name in tags:
-        tag_name = tag_name.strip()
-        if not tag_name:
-            continue
-        t_row = await env.DB.prepare(
-            "SELECT id FROM tags WHERE name=?"
-        ).bind(tag_name).first()
-        if t_row:
-            tag_id = t_row.id
-        else:
-            tag_id = new_id()
-            try:
-                await env.DB.prepare(
-                    "INSERT INTO tags (id,name) VALUES (?,?)"
-                ).bind(tag_id, tag_name).run()
-            except Exception as e:
-                capture_exception(e, req, env, f"api_add_activity_tags.insert_tag: tag_name={tag_name}, tag_id={tag_id}, act_id={act_id}")
-                continue
-        try:
-            await env.DB.prepare(
-                "INSERT OR IGNORE INTO activity_tags (activity_id,tag_id) VALUES (?,?)"
-            ).bind(act_id, tag_id).run()
-        except Exception as e:
-            capture_exception(e, req, env, f"api_add_activity_tags.insert_activity_tags: tag_name={tag_name}, tag_id={tag_id}, act_id={act_id}")
-            pass
-
-    return ok(None, "Tags updated")
-
-
-async def api_admin_table_counts(req, env):
-    if not _is_basic_auth_valid(req, env):
-        return _unauthorized_basic()
-
-    tables_res = await env.DB.prepare(
-        "SELECT name FROM sqlite_master WHERE type='table' AND name NOT LIKE 'sqlite_%' ORDER BY name"
-    ).all()
-
-    counts = []
-    for row in tables_res.results or []:
-        table_name = row.name
-        # Table names come from sqlite_master and are quoted to avoid SQL injection.
-        count_row = await env.DB.prepare(
-            f'SELECT COUNT(*) AS cnt FROM "{table_name.replace(chr(34), chr(34) + chr(34))}"'
-        ).first()
-        counts.append({"table": table_name, "count": count_row.cnt if count_row else 0})
-
-    return json_resp({"tables": counts})
-
-
-# ---------------------------------------------------------------------------
-# Static-asset serving  (Workers Sites / __STATIC_CONTENT KV)
-# ---------------------------------------------------------------------------
-
-_MIME = {
-    "html": "text/html; charset=utf-8",
-    "css":  "text/css; charset=utf-8",
-    "js":   "application/javascript; charset=utf-8",
-    "json": "application/json",
-    "png":  "image/png",
-    "jpg":  "image/jpeg",
-    "svg":  "image/svg+xml",
-    "ico":  "image/x-icon",
-}
-
-
-async def serve_static(path: str, env):
-    if path in ("/", ""):
-        key = "index.html"
-    else:
-        key = path.lstrip("/")
-        if "." not in key.split("/")[-1]:
-            key += ".html"
-
-    try:
-        content = await env.__STATIC_CONTENT.get(key, "text")
-    except Exception:
-        content = None
-
-    if content is None:
-        try:
-            content = await env.__STATIC_CONTENT.get("index.html", "text")
-        except Exception:
-            content = None
-
-    if content is None:
-        return Response(
-            "<h1>404 - Not Found</h1>",
-            status=404,
-            headers={"Content-Type": "text/html"},
-        )
-
-    ext  = key.rsplit(".", 1)[-1] if "." in key else "html"
-    mime = _MIME.get(ext, "text/plain")
-    return Response(content, headers={"Content-Type": mime, **_CORS})
-
+from api_handlers import (
+    api_add_activity_tags,
+    api_admin_table_counts,
+    api_create_activity,
+    api_create_session,
+    api_dashboard,
+    api_get_activity,
+    api_join,
+    api_list_activities,
+    api_list_tags,
+    api_login,
+    api_register,
+)
+from platform_utils import (
+    _CORS,
+    capture_exception,
+    clean_path,
+    err,
+    init_db,
+    is_basic_auth_valid,
+    ok,
+    seed_db,
+    serve_static,
+    unauthorized_basic,
+)
 
 # ---------------------------------------------------------------------------
 # Main dispatcher
@@ -1136,14 +67,14 @@ async def serve_static(path: str, env):
 async def _dispatch(request, env):
     path   = urlparse(request.url).path
     method = request.method.upper()
-    admin_path = _clean_path(getattr(env, "ADMIN_URL", ""))
+    admin_path = clean_path(getattr(env, "ADMIN_URL", ""))
 
     if method == "OPTIONS":
         return Response("", status=204, headers=_CORS)
 
     if path == admin_path and method == "GET":
-        if not _is_basic_auth_valid(request, env):
-            return _unauthorized_basic()
+        if not is_basic_auth_valid(request, env):
+            return unauthorized_basic()
         return await serve_static("/admin.html", env)
 
     if path.startswith("/api/"):

From 58ac310a6f1d73886c57ca4099b47ee05673a8bc Mon Sep 17 00:00:00 2001
From: shreycodes <shreymojidra06@gmail.com>
Date: Wed, 25 Mar 2026 01:34:53 +0530
Subject: [PATCH 04/11] More split

---
 src/{api_handlers.py => api_activities.py} | 139 +-----------------
 src/api_admin.py                           |  24 +++
 src/api_auth.py                            | 106 ++++++++++++++
 src/{platform_utils.py => db_utils.py}     | 162 +--------------------
 src/http_utils.py                          | 115 +++++++++++++++
 src/static_utils.py                        |  49 +++++++
 src/worker.py                              |  14 +-
 7 files changed, 310 insertions(+), 299 deletions(-)
 rename src/{api_handlers.py => api_activities.py} (76%)
 create mode 100644 src/api_admin.py
 create mode 100644 src/api_auth.py
 rename src/{platform_utils.py => db_utils.py} (69%)
 create mode 100644 src/http_utils.py
 create mode 100644 src/static_utils.py

diff --git a/src/api_handlers.py b/src/api_activities.py
similarity index 76%
rename from src/api_handlers.py
rename to src/api_activities.py
index 624b8bc..8314079 100644
--- a/src/api_handlers.py
+++ b/src/api_activities.py
@@ -1,116 +1,11 @@
-from urllib.parse import parse_qs, urlparse
-
-from platform_utils import (
-    capture_exception,
-    err,
-    is_basic_auth_valid,
-    json_resp,
-    ok,
-    parse_json_object,
-    unauthorized_basic,
-)
-from security_utils import (
-    blind_index,
-    create_token,
-    decrypt,
-    encrypt,
-    hash_password,
-    new_id,
-    verify_password,
-    verify_token,
-)
-
-# ---------------------------------------------------------------------------
-# API handlers
-# ---------------------------------------------------------------------------
-
-async def api_register(req, env):
-    body, bad_resp = await parse_json_object(req)
-    if bad_resp:
-        return bad_resp
-
-    username = (body.get("username") or "").strip()
-    email    = (body.get("email")    or "").strip()
-    password = (body.get("password") or "")
-    name     = (body.get("name")     or username).strip()
-
-    if not username or not email or not password:
-        return err("username, email, and password are required")
-    if len(password) < 8:
-        return err("Password must be at least 8 characters")
-
-    role = "member"
-
-    enc = env.ENCRYPTION_KEY
-    uid = new_id()
-    try:
-        await env.DB.prepare(
-            "INSERT INTO users "
-            "(id,username_hash,email_hash,name,username,email,password_hash,role)"
-            " VALUES (?,?,?,?,?,?,?,?)"
-        ).bind(
-            uid,
-            blind_index(username, enc),
-            blind_index(email,    enc),
-            encrypt(name,     enc),
-            encrypt(username, enc),
-            encrypt(email,    enc),
-            hash_password(password, username),
-            encrypt(role, enc),
-        ).run()
-    except Exception as e:
-        if "UNIQUE" in str(e):
-            return err("Username or email already registered", 409)
-        capture_exception(e, req, env, "api_register.insert_user")
-        return err("Registration failed — please try again", 500)
-
-    token = create_token(uid, username, role, env.JWT_SECRET)
-    return ok(
-        {"token": token,
-         "user": {"id": uid, "username": username, "name": name, "role": role}},
-        "Registration successful",
-    )
-
+"""
+Activity, enrollment, dashboard, session, and tag API handlers live here.
+"""
 
-async def api_login(req, env):
-    body, bad_resp = await parse_json_object(req)
-    if bad_resp:
-        return bad_resp
+from urllib.parse import parse_qs, urlparse
 
-    username = (body.get("username") or "").strip()
-    password = (body.get("password") or "")
-
-    if not username or not password:
-        return err("username and password are required")
-
-    enc    = env.ENCRYPTION_KEY
-    u_hash = blind_index(username, enc)
-    row    = await env.DB.prepare(
-        "SELECT id,password_hash,role,name,username FROM users WHERE username_hash=?"
-    ).bind(u_hash).first()
-
-    if not row:
-        return err("Invalid username or password", 401)
-    
-    password_hash = row.password_hash
-    user_id = row.id
-    role_enc = row.role
-    name_enc = row.name
-    username_enc = row.username
-    stored_username = decrypt(username_enc, enc)
-
-    if not verify_password(password, password_hash, stored_username):
-        return err("Invalid username or password", 401)
-
-    real_role = decrypt(role_enc, enc)
-    real_name = decrypt(name_enc, enc)
-    token     = create_token(user_id, stored_username, real_role, env.JWT_SECRET)
-    return ok(
-        {"token": token,
-         "user": {"id": user_id, "username": stored_username,
-                  "name": real_name, "role": real_role}},
-        "Login successful",
-    )
+from http_utils import capture_exception, err, json_resp, ok, parse_json_object
+from security_utils import decrypt, encrypt, new_id, verify_token
 
 
 async def api_list_activities(req, env):
@@ -532,24 +427,4 @@ async def api_add_activity_tags(req, env):
             capture_exception(e, req, env, f"api_add_activity_tags.insert_activity_tags: tag_name={tag_name}, tag_id={tag_id}, act_id={act_id}")
             pass
 
-    return ok(None, "Tags updated")
-
-
-async def api_admin_table_counts(req, env):
-    if not is_basic_auth_valid(req, env):
-        return unauthorized_basic()
-
-    tables_res = await env.DB.prepare(
-        "SELECT name FROM sqlite_master WHERE type='table' AND name NOT LIKE 'sqlite_%' ORDER BY name"
-    ).all()
-
-    counts = []
-    for row in tables_res.results or []:
-        table_name = row.name
-        # Table names come from sqlite_master and are quoted to avoid SQL injection.
-        count_row = await env.DB.prepare(
-            f'SELECT COUNT(*) AS cnt FROM "{table_name.replace(chr(34), chr(34) + chr(34))}"'
-        ).first()
-        counts.append({"table": table_name, "count": count_row.cnt if count_row else 0})
-
-    return json_resp({"tables": counts})
+    return ok(None, "Tags updated")
\ No newline at end of file
diff --git a/src/api_admin.py b/src/api_admin.py
new file mode 100644
index 0000000..4233f2a
--- /dev/null
+++ b/src/api_admin.py
@@ -0,0 +1,24 @@
+"""
+Admin-only API handlers live here.
+"""
+
+from http_utils import is_basic_auth_valid, json_resp, unauthorized_basic
+
+async def api_admin_table_counts(req, env):
+    if not is_basic_auth_valid(req, env):
+        return unauthorized_basic()
+
+    tables_res = await env.DB.prepare(
+        "SELECT name FROM sqlite_master WHERE type='table' AND name NOT LIKE 'sqlite_%' ORDER BY name"
+    ).all()
+
+    counts = []
+    for row in tables_res.results or []:
+        table_name = row.name
+        # Table names come from sqlite_master and are quoted to avoid SQL injection.
+        count_row = await env.DB.prepare(
+            f'SELECT COUNT(*) AS cnt FROM "{table_name.replace(chr(34), chr(34) + chr(34))}"'
+        ).first()
+        counts.append({"table": table_name, "count": count_row.cnt if count_row else 0})
+
+    return json_resp({"tables": counts})
\ No newline at end of file
diff --git a/src/api_auth.py b/src/api_auth.py
new file mode 100644
index 0000000..590561e
--- /dev/null
+++ b/src/api_auth.py
@@ -0,0 +1,106 @@
+"""
+Authentication-related API handlers live here.
+"""
+
+from http_utils import capture_exception, err, ok, parse_json_object
+from security_utils import (
+    blind_index,
+    create_token,
+    decrypt,
+    encrypt,
+    hash_password,
+    new_id,
+    verify_password,
+)
+
+# ---------------------------------------------------------------------------
+# API handlers
+# ---------------------------------------------------------------------------
+
+async def api_register(req, env):
+    body, bad_resp = await parse_json_object(req)
+    if bad_resp:
+        return bad_resp
+
+    username = (body.get("username") or "").strip()
+    email    = (body.get("email")    or "").strip()
+    password = (body.get("password") or "")
+    name     = (body.get("name")     or username).strip()
+
+    if not username or not email or not password:
+        return err("username, email, and password are required")
+    if len(password) < 8:
+        return err("Password must be at least 8 characters")
+
+    role = "member"
+
+    enc = env.ENCRYPTION_KEY
+    uid = new_id()
+    try:
+        await env.DB.prepare(
+            "INSERT INTO users "
+            "(id,username_hash,email_hash,name,username,email,password_hash,role)"
+            " VALUES (?,?,?,?,?,?,?,?)"
+        ).bind(
+            uid,
+            blind_index(username, enc),
+            blind_index(email,    enc),
+            encrypt(name,     enc),
+            encrypt(username, enc),
+            encrypt(email,    enc),
+            hash_password(password, username),
+            encrypt(role, enc),
+        ).run()
+    except Exception as e:
+        if "UNIQUE" in str(e):
+            return err("Username or email already registered", 409)
+        capture_exception(e, req, env, "api_register.insert_user")
+        return err("Registration failed — please try again", 500)
+
+    token = create_token(uid, username, role, env.JWT_SECRET)
+    return ok(
+        {"token": token,
+         "user": {"id": uid, "username": username, "name": name, "role": role}},
+        "Registration successful",
+    )
+
+
+async def api_login(req, env):
+    body, bad_resp = await parse_json_object(req)
+    if bad_resp:
+        return bad_resp
+
+    username = (body.get("username") or "").strip()
+    password = (body.get("password") or "")
+
+    if not username or not password:
+        return err("username and password are required")
+
+    enc    = env.ENCRYPTION_KEY
+    u_hash = blind_index(username, enc)
+    row    = await env.DB.prepare(
+        "SELECT id,password_hash,role,name,username FROM users WHERE username_hash=?"
+    ).bind(u_hash).first()
+
+    if not row:
+        return err("Invalid username or password", 401)
+    
+    password_hash = row.password_hash
+    user_id = row.id
+    role_enc = row.role
+    name_enc = row.name
+    username_enc = row.username
+    stored_username = decrypt(username_enc, enc)
+
+    if not verify_password(password, password_hash, stored_username):
+        return err("Invalid username or password", 401)
+
+    real_role = decrypt(role_enc, enc)
+    real_name = decrypt(name_enc, enc)
+    token     = create_token(user_id, stored_username, real_role, env.JWT_SECRET)
+    return ok(
+        {"token": token,
+         "user": {"id": user_id, "username": stored_username,
+                  "name": real_name, "role": real_role}},
+        "Login successful",
+    )
diff --git a/src/platform_utils.py b/src/db_utils.py
similarity index 69%
rename from src/platform_utils.py
rename to src/db_utils.py
index 1f19a92..479f20a 100644
--- a/src/platform_utils.py
+++ b/src/db_utils.py
@@ -1,117 +1,9 @@
-import base64
-import hmac as _hmac
-import json
-import re
-import traceback
-from urllib.parse import urlparse
+"""
+Database schema and seed helpers live here.
+"""
 
-from workers import Response
 from security_utils import blind_index, encrypt, hash_password
 
-def capture_exception(exc: Exception, req=None, _env=None, where: str = ""):
-    """Best-effort exception logging with full traceback and request context."""
-    try:
-        payload = {
-            "level": "error",
-            "where": where or "unknown",
-            "error_type": type(exc).__name__,
-            "error": str(exc),
-            "traceback": "".join(traceback.format_exception(type(exc), exc, exc.__traceback__)),
-        }
-        if req:
-            payload["request"] = {
-                "method": req.method,
-                "url": req.url,
-                "path": urlparse(req.url).path,
-            }
-        print(json.dumps(payload))
-    except Exception:
-        pass
-
-
-_CORS = {
-    "Access-Control-Allow-Origin":  "*",
-    "Access-Control-Allow-Methods": "GET, POST, PUT, DELETE, OPTIONS",
-    "Access-Control-Allow-Headers": "Content-Type, Authorization",
-}
-
-
-def json_resp(data, status: int = 200):
-    return Response(
-        json.dumps(data),
-        status=status,
-        headers={"Content-Type": "application/json", **_CORS},
-    )
-
-
-def ok(data=None, msg: str = "OK"):
-    body = {"success": True, "message": msg}
-    if data is not None:
-        body["data"] = data
-    return json_resp(body, 200)
-
-
-def err(msg: str, status: int = 400):
-    return json_resp({"error": msg}, status)
-
-
-async def parse_json_object(req):
-    """Parse request JSON and ensure payload is an object/dict."""
-    try:
-        text = await req.text()
-        body = json.loads(text)
-    except Exception:
-        return None, err("Invalid JSON body")
-
-    if not isinstance(body, dict):
-        return None, err("JSON body must be an object", 400)
-
-    return body, None
-
-
-def clean_path(value: str, default: str = "/admin") -> str:
-    """Normalize an env-provided path into a safe absolute URL path."""
-    raw = (value or "").strip()
-    if not raw:
-        return default
-    parsed = urlparse(raw)
-    path = (parsed.path or raw).strip()
-    if not path.startswith("/"):
-        path = "/" + path
-    path = re.sub(r"/+", "/", path)
-    if len(path) > 1 and path.endswith("/"):
-        path = path[:-1]
-    return path or default
-
-
-def unauthorized_basic(realm: str = "Alpha One Labs Admin"):
-    return Response(
-        "Authentication required",
-        status=401,
-        headers={"WWW-Authenticate": f'Basic realm="{realm}"', **_CORS},
-    )
-
-
-def is_basic_auth_valid(req, env) -> bool:
-    username = (getattr(env, "ADMIN_BASIC_USER", "") or "").strip()
-    password = (getattr(env, "ADMIN_BASIC_PASS", "") or "").strip()
-    if not username or not password:
-        return False
-
-    auth = req.headers.get("Authorization") or ""
-    if not auth.lower().startswith("basic "):
-        return False
-
-    try:
-        raw = auth.split(" ", 1)[1].strip()
-        decoded = base64.b64decode(raw).decode("utf-8")
-        user, pwd = decoded.split(":", 1)
-    except Exception:
-        return False
-
-    return _hmac.compare_digest(user, username) and _hmac.compare_digest(pwd, password)
-
-
 # ---------------------------------------------------------------------------
 # DDL - full schema (mirrors schema.sql)
 # ---------------------------------------------------------------------------
@@ -381,51 +273,3 @@ async def seed_db(env, enc_key: str):
             ).bind(eid, act_id, uid, role).run()
         except Exception:
             pass
-
-
-# ---------------------------------------------------------------------------
-# Static-asset serving  (Workers Sites / __STATIC_CONTENT KV)
-# ---------------------------------------------------------------------------
-
-_MIME = {
-    "html": "text/html; charset=utf-8",
-    "css":  "text/css; charset=utf-8",
-    "js":   "application/javascript; charset=utf-8",
-    "json": "application/json",
-    "png":  "image/png",
-    "jpg":  "image/jpeg",
-    "svg":  "image/svg+xml",
-    "ico":  "image/x-icon",
-}
-
-
-async def serve_static(path: str, env):
-    if path in ("/", ""):
-        key = "index.html"
-    else:
-        key = path.lstrip("/")
-        if "." not in key.split("/")[-1]:
-            key += ".html"
-
-    try:
-        content = await env.__STATIC_CONTENT.get(key, "text")
-    except Exception:
-        content = None
-
-    if content is None:
-        try:
-            content = await env.__STATIC_CONTENT.get("index.html", "text")
-        except Exception:
-            content = None
-
-    if content is None:
-        return Response(
-            "<h1>404 - Not Found</h1>",
-            status=404,
-            headers={"Content-Type": "text/html"},
-        )
-
-    ext  = key.rsplit(".", 1)[-1] if "." in key else "html"
-    mime = _MIME.get(ext, "text/plain")
-    return Response(content, headers={"Content-Type": mime, **_CORS})
-
diff --git a/src/http_utils.py b/src/http_utils.py
new file mode 100644
index 0000000..2283be4
--- /dev/null
+++ b/src/http_utils.py
@@ -0,0 +1,115 @@
+"""
+Shared HTTP helpers live here.
+"""
+
+import base64
+import hmac as _hmac
+import json
+import re
+import traceback
+from urllib.parse import urlparse
+
+from workers import Response
+
+def capture_exception(exc: Exception, req=None, _env=None, where: str = ""):
+    """Best-effort exception logging with full traceback and request context."""
+    try:
+        payload = {
+            "level": "error",
+            "where": where or "unknown",
+            "error_type": type(exc).__name__,
+            "error": str(exc),
+            "traceback": "".join(traceback.format_exception(type(exc), exc, exc.__traceback__)),
+        }
+        if req:
+            payload["request"] = {
+                "method": req.method,
+                "url": req.url,
+                "path": urlparse(req.url).path,
+            }
+        print(json.dumps(payload))
+    except Exception:
+        pass
+
+
+_CORS = {
+    "Access-Control-Allow-Origin":  "*",
+    "Access-Control-Allow-Methods": "GET, POST, PUT, DELETE, OPTIONS",
+    "Access-Control-Allow-Headers": "Content-Type, Authorization",
+}
+
+
+def json_resp(data, status: int = 200):
+    return Response(
+        json.dumps(data),
+        status=status,
+        headers={"Content-Type": "application/json", **_CORS},
+    )
+
+
+def ok(data=None, msg: str = "OK"):
+    body = {"success": True, "message": msg}
+    if data is not None:
+        body["data"] = data
+    return json_resp(body, 200)
+
+
+def err(msg: str, status: int = 400):
+    return json_resp({"error": msg}, status)
+
+
+async def parse_json_object(req):
+    """Parse request JSON and ensure payload is an object/dict."""
+    try:
+        text = await req.text()
+        body = json.loads(text)
+    except Exception:
+        return None, err("Invalid JSON body")
+
+    if not isinstance(body, dict):
+        return None, err("JSON body must be an object", 400)
+
+    return body, None
+
+
+def clean_path(value: str, default: str = "/admin") -> str:
+    """Normalize an env-provided path into a safe absolute URL path."""
+    raw = (value or "").strip()
+    if not raw:
+        return default
+    parsed = urlparse(raw)
+    path = (parsed.path or raw).strip()
+    if not path.startswith("/"):
+        path = "/" + path
+    path = re.sub(r"/+", "/", path)
+    if len(path) > 1 and path.endswith("/"):
+        path = path[:-1]
+    return path or default
+
+
+def unauthorized_basic(realm: str = "Alpha One Labs Admin"):
+    return Response(
+        "Authentication required",
+        status=401,
+        headers={"WWW-Authenticate": f'Basic realm="{realm}"', **_CORS},
+    )
+
+
+def is_basic_auth_valid(req, env) -> bool:
+    username = (getattr(env, "ADMIN_BASIC_USER", "") or "").strip()
+    password = (getattr(env, "ADMIN_BASIC_PASS", "") or "").strip()
+    if not username or not password:
+        return False
+
+    auth = req.headers.get("Authorization") or ""
+    if not auth.lower().startswith("basic "):
+        return False
+
+    try:
+        raw = auth.split(" ", 1)[1].strip()
+        decoded = base64.b64decode(raw).decode("utf-8")
+        user, pwd = decoded.split(":", 1)
+    except Exception:
+        return False
+
+    return _hmac.compare_digest(user, username) and _hmac.compare_digest(pwd, password)
diff --git a/src/static_utils.py b/src/static_utils.py
new file mode 100644
index 0000000..b63ee4e
--- /dev/null
+++ b/src/static_utils.py
@@ -0,0 +1,49 @@
+"""
+Static file serving helpers live here.
+"""
+
+from workers import Response
+
+from http_utils import _CORS
+
+_MIME = {
+    "html": "text/html; charset=utf-8",
+    "css":  "text/css; charset=utf-8",
+    "js":   "application/javascript; charset=utf-8",
+    "json": "application/json",
+    "png":  "image/png",
+    "jpg":  "image/jpeg",
+    "svg":  "image/svg+xml",
+    "ico":  "image/x-icon",
+}
+
+
+async def serve_static(path: str, env):
+    if path in ("/", ""):
+        key = "index.html"
+    else:
+        key = path.lstrip("/")
+        if "." not in key.split("/")[-1]:
+            key += ".html"
+
+    try:
+        content = await env.__STATIC_CONTENT.get(key, "text")
+    except Exception:
+        content = None
+
+    if content is None:
+        try:
+            content = await env.__STATIC_CONTENT.get("index.html", "text")
+        except Exception:
+            content = None
+
+    if content is None:
+        return Response(
+            "<h1>404 - Not Found</h1>",
+            status=404,
+            headers={"Content-Type": "text/html"},
+        )
+
+    ext  = key.rsplit(".", 1)[-1] if "." in key else "html"
+    mime = _MIME.get(ext, "text/plain")
+    return Response(content, headers={"Content-Type": mime, **_CORS})
diff --git a/src/worker.py b/src/worker.py
index 1cccfc6..9d20ad0 100644
--- a/src/worker.py
+++ b/src/worker.py
@@ -34,9 +34,8 @@
 
 from workers import Response
 
-from api_handlers import (
+from api_activities import (
     api_add_activity_tags,
-    api_admin_table_counts,
     api_create_activity,
     api_create_session,
     api_dashboard,
@@ -44,21 +43,20 @@
     api_join,
     api_list_activities,
     api_list_tags,
-    api_login,
-    api_register,
 )
-from platform_utils import (
+from api_admin import api_admin_table_counts
+from api_auth import api_login, api_register
+from db_utils import init_db, seed_db
+from http_utils import (
     _CORS,
     capture_exception,
     clean_path,
     err,
-    init_db,
     is_basic_auth_valid,
     ok,
-    seed_db,
-    serve_static,
     unauthorized_basic,
 )
+from static_utils import serve_static
 
 # ---------------------------------------------------------------------------
 # Main dispatcher

From 5bcb55cca931cecfc2a478b65c7fa7d3d43b5c9f Mon Sep 17 00:00:00 2001
From: shreycodes <shreymojidra06@gmail.com>
Date: Thu, 26 Mar 2026 14:31:31 +0530
Subject: [PATCH 05/11] resolving conversation

---
 src/http_utils.py   | 10 +++-------
 src/static_utils.py |  8 ++------
 src/worker.py       |  4 ++--
 3 files changed, 7 insertions(+), 15 deletions(-)

diff --git a/src/http_utils.py b/src/http_utils.py
index 2283be4..402aa72 100644
--- a/src/http_utils.py
+++ b/src/http_utils.py
@@ -1,7 +1,3 @@
-"""
-Shared HTTP helpers live here.
-"""
-
 import base64
 import hmac as _hmac
 import json
@@ -32,7 +28,7 @@ def capture_exception(exc: Exception, req=None, _env=None, where: str = ""):
         pass
 
 
-_CORS = {
+CORS = {
     "Access-Control-Allow-Origin":  "*",
     "Access-Control-Allow-Methods": "GET, POST, PUT, DELETE, OPTIONS",
     "Access-Control-Allow-Headers": "Content-Type, Authorization",
@@ -43,7 +39,7 @@ def json_resp(data, status: int = 200):
     return Response(
         json.dumps(data),
         status=status,
-        headers={"Content-Type": "application/json", **_CORS},
+        headers={"Content-Type": "application/json", **CORS},
     )
 
 
@@ -91,7 +87,7 @@ def unauthorized_basic(realm: str = "Alpha One Labs Admin"):
     return Response(
         "Authentication required",
         status=401,
-        headers={"WWW-Authenticate": f'Basic realm="{realm}"', **_CORS},
+        headers={"WWW-Authenticate": f'Basic realm="{realm}"', **CORS},
     )
 
 
diff --git a/src/static_utils.py b/src/static_utils.py
index b63ee4e..9807670 100644
--- a/src/static_utils.py
+++ b/src/static_utils.py
@@ -1,10 +1,6 @@
-"""
-Static file serving helpers live here.
-"""
-
 from workers import Response
 
-from http_utils import _CORS
+from http_utils import CORS
 
 _MIME = {
     "html": "text/html; charset=utf-8",
@@ -46,4 +42,4 @@ async def serve_static(path: str, env):
 
     ext  = key.rsplit(".", 1)[-1] if "." in key else "html"
     mime = _MIME.get(ext, "text/plain")
-    return Response(content, headers={"Content-Type": mime, **_CORS})
+    return Response(content, headers={"Content-Type": mime, **CORS})
diff --git a/src/worker.py b/src/worker.py
index 9d20ad0..cadd14c 100644
--- a/src/worker.py
+++ b/src/worker.py
@@ -48,7 +48,7 @@
 from api_auth import api_login, api_register
 from db_utils import init_db, seed_db
 from http_utils import (
-    _CORS,
+    CORS,
     capture_exception,
     clean_path,
     err,
@@ -68,7 +68,7 @@ async def _dispatch(request, env):
     admin_path = clean_path(getattr(env, "ADMIN_URL", ""))
 
     if method == "OPTIONS":
-        return Response("", status=204, headers=_CORS)
+        return Response("", status=204, headers=CORS)
 
     if path == admin_path and method == "GET":
         if not is_basic_auth_valid(request, env):

From e11bb0f3e075cd60c91751a2b418c537314bc6aa Mon Sep 17 00:00:00 2001
From: ayesha1145 <130880100+ayesha1145@users.noreply.github.com>
Date: Thu, 26 Mar 2026 03:08:19 +0000
Subject: [PATCH 06/11] feat: replace XOR cipher with AES-256-GCM encryption
 via Web Crypto API

---
 src/worker.py | 165 +++++++++++++++++++++++++++++++++++++++-----------
 1 file changed, 129 insertions(+), 36 deletions(-)

diff --git a/src/worker.py b/src/worker.py
index 9656277..a0296a6 100644
--- a/src/worker.py
+++ b/src/worker.py
@@ -16,15 +16,18 @@
   POST /api/activity-tags     – add tags to an activity      [host]
 
 Security model
-  * ALL user PII (username, email, display name, role) is encrypted with a
-    XOR stream-cipher (SHA-256 key expansion) before storage.
+  * ALL user PII (username, email, display name, role) is encrypted with
+    AES-256-GCM (via js.crypto.subtle) before storage.
   * HMAC-SHA256 blind indexes (username_hash, email_hash) allow O(1) row
     lookups without ever storing plaintext PII in an indexed column.
   * Activity descriptions and session locations/descriptions are encrypted.
   * Passwords: PBKDF2-SHA256, per-user derived salt (username + global pepper).
   * Auth tokens: HMAC-SHA256 signed, stateless (JWT-lite).
-  XOR stream cipher - demonstration only.  Replace encrypt()/decrypt()
-    with AES-GCM via js.crypto.subtle for a production deployment.
+  AES-256-GCM authenticated encryption via js.crypto.subtle.
+    96-bit random IV generated per encryption call.
+    128-bit GCM auth tag provides tamper detection.
+    Backward compatible: existing XOR-encrypted data decrypted transparently.
+    Legacy _encrypt_xor/_decrypt_xor retained for reading old stored data.
 
 Static HTML pages (public/) are served via Workers Sites (KV binding).
 """
@@ -79,20 +82,96 @@ def new_id() -> str:
 # Encryption helpers
 # ---------------------------------------------------------------------------
 
+# ---------------------------------------------------------------------------
+# Encryption helpers - AES-256-GCM via Web Crypto API (js.crypto.subtle)
+# ---------------------------------------------------------------------------
+# Replaces the XOR stream cipher with authenticated AES-256-GCM encryption.
+# - 256-bit key derived from secret via PBKDF2-SHA256 (100k iterations)
+# - 96-bit random IV prepended to ciphertext
+# - 128-bit GCM auth tag appended automatically by Web Crypto
+# - Output: base64(iv || ciphertext+tag) prefixed with "v1:" for D1 storage
+# - Backward compatible: no "v1:" prefix = legacy XOR, decrypted transparently
+
 def _derive_key(secret: str) -> bytes:
     """Derive a 32-byte key from an arbitrary secret string via SHA-256."""
     return hashlib.sha256(secret.encode("utf-8")).digest()
 
 
-def encrypt(plaintext: str, secret: str) -> str:
+def _derive_aes_key_bytes(secret: str) -> bytes:
+    """Derive a 32-byte AES-256 key via PBKDF2-SHA256 with a fixed domain salt.
+
+    Note: 100k iterations are intentional for key hardening. For high-throughput
+    paths, callers can cache the derived key bytes for the duration of a request.
     """
-    XOR stream-cipher encryption.
+    salt = hashlib.sha256(b"aol-edu-aes-salt-v1" + secret.encode()).digest()
+    return hashlib.pbkdf2_hmac("sha256", secret.encode("utf-8"), salt, 100_000)
+
+
+async def _import_aes_key(key_bytes: bytes) -> object:
+    """Import raw bytes as a Web Crypto AES-GCM CryptoKey."""
+    import js
+    from pyodide.ffi import to_js
+    key_buf = to_js(key_bytes, create_pyproxies=False)
+    algo    = to_js({"name": "AES-GCM"}, create_pyproxies=False)
+    usages  = to_js(["encrypt", "decrypt"], create_pyproxies=False)
+    return await js.crypto.subtle.importKey("raw", key_buf, algo, False, usages)
 
-    Key is SHA-256 of secret, XOR'd byte-by-byte against plaintext.
-    Result is Base64-encoded for safe TEXT storage in D1.
 
-    XOR stream cipher - demonstration only. Replace with AES-GCM for production.
+async def encrypt_aes(plaintext: str, secret: str) -> str:
     """
+    AES-256-GCM encryption using js.crypto.subtle (Web Crypto API).
+    Returns "v1:" + base64(iv || ciphertext+tag).
+    Raises RuntimeError on encryption failure — no silent XOR fallback.
+    """
+    if not plaintext:
+        return ""
+    try:
+        import js
+        from pyodide.ffi import to_js
+        key_bytes  = _derive_aes_key_bytes(secret)
+        crypto_key = await _import_aes_key(key_bytes)
+        iv         = bytes(js.crypto.getRandomValues(to_js(bytearray(12))))
+        algo       = to_js({"name": "AES-GCM", "iv": to_js(iv)}, create_pyproxies=False)
+        data       = to_js(plaintext.encode("utf-8"), create_pyproxies=False)
+        ct_buf     = await js.crypto.subtle.encrypt(algo, crypto_key, data)
+        ct         = bytes(js.Uint8Array.new(ct_buf))
+        return "v1:" + base64.b64encode(iv + ct).decode("ascii")
+    except Exception as exc:
+        capture_exception(exc, where="encrypt_aes")
+        raise RuntimeError(f"AES-256-GCM encryption failed: {exc}") from exc
+
+
+async def decrypt_aes(ciphertext: str, secret: str) -> str:
+    """
+    AES-256-GCM decryption. Handles both v1 (AES-GCM) and legacy (XOR) ciphertext.
+    """
+    if not ciphertext:
+        return ""
+    if not ciphertext.startswith("v1:"):
+        return _decrypt_xor(ciphertext, secret)
+    import js
+    from pyodide.ffi import to_js
+    try:
+        raw        = base64.b64decode(ciphertext[3:])
+        iv, ct     = raw[:12], raw[12:]
+    except Exception as exc:
+        capture_exception(exc, where="decrypt_aes.decode")
+        return "[decryption error]"
+    key_bytes  = _derive_aes_key_bytes(secret)
+    crypto_key = await _import_aes_key(key_bytes)
+    algo       = to_js({"name": "AES-GCM", "iv": to_js(iv)}, create_pyproxies=False)
+    data       = to_js(ct, create_pyproxies=False)
+    try:
+        pt_buf = await js.crypto.subtle.decrypt(algo, crypto_key, data)
+        return bytes(js.Uint8Array.new(pt_buf)).decode("utf-8")
+    except Exception as exc:
+        # Auth tag mismatch = tampered/corrupted ciphertext
+        capture_exception(exc, where="decrypt_aes.auth")
+        return "[decryption error]"
+
+
+def _encrypt_xor(plaintext: str, secret: str) -> str:
+    """Legacy XOR stream cipher — kept for backward compatibility only."""
     if not plaintext:
         return ""
     key  = _derive_key(secret)
@@ -101,8 +180,8 @@ def encrypt(plaintext: str, secret: str) -> str:
     return base64.b64encode(bytes(a ^ b for a, b in zip(data, ks))).decode("ascii")
 
 
-def decrypt(ciphertext: str, secret: str) -> str:
-    """Reverse of encrypt(). XOR is self-inverse."""
+def _decrypt_xor(ciphertext: str, secret: str) -> str:
+    """Legacy XOR stream cipher decryption — kept for backward compatibility."""
     if not ciphertext:
         return ""
     try:
@@ -114,6 +193,16 @@ def decrypt(ciphertext: str, secret: str) -> str:
         return "[decryption error]"
 
 
+# Synchronous shims — raise errors to force migration to async variants.
+def encrypt(plaintext: str, secret: str) -> str:
+    """Deprecated sync shim — raises to force migration to await encrypt_aes()."""
+    raise RuntimeError("encrypt() is deprecated — use await encrypt_aes() instead")
+
+
+def decrypt(ciphertext: str, secret: str) -> str:
+    """Deprecated sync shim — raises to force migration to await decrypt_aes()."""
+    raise RuntimeError("decrypt() is deprecated — use await decrypt_aes() instead")
+
 def blind_index(value: str, secret: str) -> str:
     """
     HMAC-SHA256 deterministic hash of value used as a blind index.
@@ -394,11 +483,11 @@ async def seed_db(env, enc_key: str):
                 uid,
                 blind_index(uname, enc_key),
                 blind_index(email, enc_key),
-                encrypt(display,  enc_key),
-                encrypt(uname,    enc_key),
-                encrypt(email,    enc_key),
+                await encrypt_aes(display,  enc_key),
+                await encrypt_aes(uname,    enc_key),
+                await encrypt_aes(email,    enc_key),
                 hash_password(pw, uname),
-                encrypt(role,     enc_key),
+                await encrypt_aes(role,     enc_key),
             ).run()
         except Exception:
             pass  # already seeded
@@ -478,7 +567,7 @@ async def seed_db(env, enc_key: str):
                 "(id,title,description,type,format,schedule_type,host_id)"
                 " VALUES (?,?,?,?,?,?,?)"
             ).bind(
-                act_id, title, encrypt(desc, enc_key),
+                act_id, title, await encrypt_aes(desc, enc_key),
                 atype, fmt, sched, host_id
             ).run()
         except Exception:
@@ -521,9 +610,9 @@ async def seed_db(env, enc_key: str):
                 " VALUES (?,?,?,?,?,?,?)"
             ).bind(
                 sid, act_id, title,
-                encrypt(desc, enc_key),
+                await encrypt_aes(desc, enc_key),
                 start, end,
-                encrypt(loc, enc_key),
+                await encrypt_aes(loc, enc_key),
             ).run()
         except Exception:
             pass
@@ -579,11 +668,11 @@ async def api_register(req, env):
             uid,
             blind_index(username, enc),
             blind_index(email,    enc),
-            encrypt(name,     enc),
-            encrypt(username, enc),
-            encrypt(email,    enc),
+            await encrypt_aes(name,     enc),
+            await encrypt_aes(username, enc),
+            await encrypt_aes(email,    enc),
             hash_password(password, username),
-            encrypt(role, enc),
+            await encrypt_aes(role, enc),
         ).run()
     except Exception as e:
         if "UNIQUE" in str(e):
@@ -624,13 +713,17 @@ async def api_login(req, env):
     role_enc = row.role
     name_enc = row.name
     username_enc = row.username
-    stored_username = decrypt(username_enc, enc)
+    stored_username = await decrypt_aes(username_enc, enc)
+    if not stored_username or stored_username == "[decryption error]":
+        return err("Invalid username or password", 401)
 
     if not verify_password(password, password_hash, stored_username):
         return err("Invalid username or password", 401)
 
-    real_role = decrypt(role_enc, enc)
-    real_name = decrypt(name_enc, enc)
+    real_role = await decrypt_aes(role_enc, enc)
+    real_name = await decrypt_aes(name_enc, enc)
+    if not real_role or real_role == "[decryption error]":
+        return err("Account data corrupted — please contact support", 500)
     token     = create_token(user_id, stored_username, real_role, env.JWT_SECRET)
     return ok(
         {"token": token,
@@ -688,8 +781,8 @@ async def api_list_activities(req, env):
 
     activities = []
     for row in res.results or []:
-        desc      = decrypt(row.description or "", enc)
-        host_name = decrypt(row.host_name_enc or "", enc)
+        desc      = await decrypt_aes(row.description or "", enc)
+        host_name = await decrypt_aes(row.host_name_enc or "", enc)
         if search and (
             search.lower() not in row.title.lower()
             and search.lower() not in desc.lower()
@@ -752,7 +845,7 @@ async def api_create_activity(req, env):
             " VALUES (?,?,?,?,?,?,?)"
         ).bind(
             act_id, title,
-            encrypt(description, enc) if description else "",
+            await encrypt_aes(description, enc) if description else "",
             atype, fmt, schedule_type, user["id"]
         ).run()
     except Exception as e:
@@ -821,10 +914,10 @@ async def api_get_activity(act_id: str, req, env):
         sessions.append({
             "id":          s.id,
             "title":       s.title,
-            "description": decrypt(s.description or "", enc) if (is_enrolled or is_host) else None,
+            "description": await decrypt_aes(s.description or "", enc) if (is_enrolled or is_host) else None,
             "start_time":  s.start_time,
             "end_time":    s.end_time,
-            "location":    decrypt(s.location or "", enc) if (is_enrolled or is_host) else None,
+            "location":    await decrypt_aes(s.location or "", enc) if (is_enrolled or is_host) else None,
         })
 
     t_res = await env.DB.prepare(
@@ -841,11 +934,11 @@ async def api_get_activity(act_id: str, req, env):
         "activity": {
             "id":                act.id,
             "title":             act.title,
-            "description":       decrypt(act.description or "", enc),
+            "description":       await decrypt_aes(act.description or "", enc),
             "type":              act.type,
             "format":            act.format,
             "schedule_type":     act.schedule_type,
-            "host_name":         decrypt(act.host_name_enc or "", enc),
+            "host_name":         await decrypt_aes(act.host_name_enc or "", enc),
             "participant_count": count_row.cnt if count_row else 0,
             "tags":              [t.name for t in (t_res.results or [])],
             "created_at":        act.created_at,
@@ -953,7 +1046,7 @@ async def api_dashboard(req, env):
             "schedule_type": r.schedule_type,
             "enr_role":      r.enr_role,
             "enr_status":    r.enr_status,
-            "host_name":     decrypt(r.host_name_enc or "", enc),
+            "host_name":     await decrypt_aes(r.host_name_enc or "", enc),
             "tags":          [t.name for t in (t_res.results or [])],
             "joined_at":     r.joined_at,
         })
@@ -995,9 +1088,9 @@ async def api_create_session(req, env):
             " VALUES (?,?,?,?,?,?,?)"
         ).bind(
             sid, act_id, title,
-            encrypt(description, enc) if description else "",
+            await encrypt_aes(description, enc) if description else "",
             start_time, end_time,
-            encrypt(location, enc) if location else "",
+            await encrypt_aes(location, enc) if location else "",
         ).run()
     except Exception as e:
         capture_exception(e, req, env, "api_create_session.insert_session")
@@ -1208,4 +1301,4 @@ async def on_fetch(request, env):
         return await _dispatch(request, env)
     except Exception as e:
         capture_exception(e, request, env, "on_fetch_unhandled")
-        return err("Internal server error", 500)
+        return err("Internal server error", 500)
\ No newline at end of file

From 21fc4f2b75575c0289ef92c63d5301dde92b4105 Mon Sep 17 00:00:00 2001
From: Shubhashish-Chakraborty <shubhashish147@gmail.com>
Date: Sat, 28 Mar 2026 01:08:01 +0530
Subject: [PATCH 07/11] fix: convert pyodide dicts to js objects for WC-aes-gcm

---
 src/worker.py | 26 ++++++++++++++++----------
 1 file changed, 16 insertions(+), 10 deletions(-)

diff --git a/src/worker.py b/src/worker.py
index a0296a6..8587ca4 100644
--- a/src/worker.py
+++ b/src/worker.py
@@ -112,8 +112,8 @@ async def _import_aes_key(key_bytes: bytes) -> object:
     import js
     from pyodide.ffi import to_js
     key_buf = to_js(key_bytes, create_pyproxies=False)
-    algo    = to_js({"name": "AES-GCM"}, create_pyproxies=False)
-    usages  = to_js(["encrypt", "decrypt"], create_pyproxies=False)
+    algo    = to_js({"name": "AES-GCM"}, dict_converter=js.Object.fromEntries)
+    usages  = to_js(["encrypt", "decrypt"])
     return await js.crypto.subtle.importKey("raw", key_buf, algo, False, usages)
 
 
@@ -130,9 +130,15 @@ async def encrypt_aes(plaintext: str, secret: str) -> str:
         from pyodide.ffi import to_js
         key_bytes  = _derive_aes_key_bytes(secret)
         crypto_key = await _import_aes_key(key_bytes)
-        iv         = bytes(js.crypto.getRandomValues(to_js(bytearray(12))))
-        algo       = to_js({"name": "AES-GCM", "iv": to_js(iv)}, create_pyproxies=False)
-        data       = to_js(plaintext.encode("utf-8"), create_pyproxies=False)
+
+        # Generate random IV directly into a JS Uint8Array for clean interop
+        iv_array   = js.Uint8Array.new(12)
+        js.crypto.getRandomValues(iv_array)
+        iv         = bytes(iv_array) # Extract back to python bytes for storage
+
+        # Using dict_converter ensures Web Crypto does not see "undefined" for the algo name
+        algo       = to_js({"name": "AES-GCM", "iv": iv_array}, dict_converter=js.Object.fromEntries)
+        data       = to_js(plaintext.encode("utf-8"))
         ct_buf     = await js.crypto.subtle.encrypt(algo, crypto_key, data)
         ct         = bytes(js.Uint8Array.new(ct_buf))
         return "v1:" + base64.b64encode(iv + ct).decode("ascii")
@@ -157,12 +163,12 @@ async def decrypt_aes(ciphertext: str, secret: str) -> str:
     except Exception as exc:
         capture_exception(exc, where="decrypt_aes.decode")
         return "[decryption error]"
-    key_bytes  = _derive_aes_key_bytes(secret)
-    crypto_key = await _import_aes_key(key_bytes)
-    algo       = to_js({"name": "AES-GCM", "iv": to_js(iv)}, create_pyproxies=False)
-    data       = to_js(ct, create_pyproxies=False)
     try:
-        pt_buf = await js.crypto.subtle.decrypt(algo, crypto_key, data)
+        key_bytes  = _derive_aes_key_bytes(secret)
+        crypto_key = await _import_aes_key(key_bytes)
+        algo       = to_js({"name": "AES-GCM", "iv": to_js(iv)}, dict_converter=js.Object.fromEntries)
+        data       = to_js(ct)
+        pt_buf     = await js.crypto.subtle.decrypt(algo, crypto_key, data)
         return bytes(js.Uint8Array.new(pt_buf)).decode("utf-8")
     except Exception as exc:
         # Auth tag mismatch = tampered/corrupted ciphertext

From da6f163b080832d358d621a7c213343beaf11072 Mon Sep 17 00:00:00 2001
From: Shubhashish-Chakraborty <shubhashish147@gmail.com>
Date: Sat, 28 Mar 2026 01:22:55 +0530
Subject: [PATCH 08/11] coderabbit done

---
 src/worker.py | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/src/worker.py b/src/worker.py
index 8587ca4..bb45b4f 100644
--- a/src/worker.py
+++ b/src/worker.py
@@ -166,7 +166,8 @@ async def decrypt_aes(ciphertext: str, secret: str) -> str:
     try:
         key_bytes  = _derive_aes_key_bytes(secret)
         crypto_key = await _import_aes_key(key_bytes)
-        algo       = to_js({"name": "AES-GCM", "iv": to_js(iv)}, dict_converter=js.Object.fromEntries)
+        iv_array   = to_js(iv)
+        algo       = to_js({"name": "AES-GCM", "iv": iv_array}, dict_converter=js.Object.fromEntries)
         data       = to_js(ct)
         pt_buf     = await js.crypto.subtle.decrypt(algo, crypto_key, data)
         return bytes(js.Uint8Array.new(pt_buf)).decode("utf-8")

From 2973098d7b423d55d11a7ca8bb97a866dccf1fcd Mon Sep 17 00:00:00 2001
From: Shubhashish-Chakraborty <shubhashish147@gmail.com>
Date: Sat, 28 Mar 2026 12:57:05 +0530
Subject: [PATCH 09/11] move imports to the top

---
 src/worker.py | 8 ++------
 1 file changed, 2 insertions(+), 6 deletions(-)

diff --git a/src/worker.py b/src/worker.py
index bb45b4f..764ff3d 100644
--- a/src/worker.py
+++ b/src/worker.py
@@ -43,6 +43,8 @@
 
 from workers import Response
 
+import js
+from pyodide.ffi import to_js
 
 def capture_exception(exc: Exception, req=None, _env=None, where: str = ""):
     """Best-effort exception logging with full traceback and request context."""
@@ -109,8 +111,6 @@ def _derive_aes_key_bytes(secret: str) -> bytes:
 
 async def _import_aes_key(key_bytes: bytes) -> object:
     """Import raw bytes as a Web Crypto AES-GCM CryptoKey."""
-    import js
-    from pyodide.ffi import to_js
     key_buf = to_js(key_bytes, create_pyproxies=False)
     algo    = to_js({"name": "AES-GCM"}, dict_converter=js.Object.fromEntries)
     usages  = to_js(["encrypt", "decrypt"])
@@ -126,8 +126,6 @@ async def encrypt_aes(plaintext: str, secret: str) -> str:
     if not plaintext:
         return ""
     try:
-        import js
-        from pyodide.ffi import to_js
         key_bytes  = _derive_aes_key_bytes(secret)
         crypto_key = await _import_aes_key(key_bytes)
 
@@ -155,8 +153,6 @@ async def decrypt_aes(ciphertext: str, secret: str) -> str:
         return ""
     if not ciphertext.startswith("v1:"):
         return _decrypt_xor(ciphertext, secret)
-    import js
-    from pyodide.ffi import to_js
     try:
         raw        = base64.b64decode(ciphertext[3:])
         iv, ct     = raw[:12], raw[12:]

From 2064901ece50e79ecf244a78a14418e78229fb1d Mon Sep 17 00:00:00 2001
From: shreycodes <shreymojidra06@gmail.com>
Date: Sun, 12 Apr 2026 18:52:41 +0530
Subject: [PATCH 10/11] Solving merge conflicts

---
 src/api_activities.py |  398 +++++++++++++
 src/api_admin.py      |   20 +
 src/api_auth.py       |   98 ++++
 src/db_utils.py       |  204 +++++++
 src/http_utils.py     |  112 ++++
 src/security_utils.py |  170 ++++++
 src/static_utils.py   |   45 ++
 src/worker.py         | 1269 ++---------------------------------------
 8 files changed, 1083 insertions(+), 1233 deletions(-)
 create mode 100644 src/api_activities.py
 create mode 100644 src/api_admin.py
 create mode 100644 src/api_auth.py
 create mode 100644 src/db_utils.py
 create mode 100644 src/http_utils.py
 create mode 100644 src/security_utils.py
 create mode 100644 src/static_utils.py

diff --git a/src/api_activities.py b/src/api_activities.py
new file mode 100644
index 0000000..e54659f
--- /dev/null
+++ b/src/api_activities.py
@@ -0,0 +1,398 @@
+"""
+Activity, enrollment, dashboard, session, and tag API handlers live here.
+"""
+
+from urllib.parse import parse_qs, urlparse
+
+from http_utils import capture_exception, err, json_resp, ok, parse_json_object
+from security_utils import decrypt_aes, encrypt_aes, new_id, verify_token
+
+
+async def api_list_activities(req, env):
+    parsed = urlparse(req.url)
+    params = parse_qs(parsed.query)
+    atype = (params.get("type") or [None])[0]
+    fmt = (params.get("format") or [None])[0]
+    search = (params.get("q") or [None])[0]
+    tag = (params.get("tag") or [None])[0]
+    enc = env.ENCRYPTION_KEY
+
+    base_q = (
+        "SELECT a.id,a.title,a.description,a.type,a.format,a.schedule_type,"
+        "a.created_at,u.name AS host_name_enc,"
+        "(SELECT COUNT(*) FROM enrollments WHERE activity_id=a.id AND status='active') AS participant_count,"
+        "(SELECT COUNT(*) FROM sessions WHERE activity_id=a.id) AS session_count"
+        " FROM activities a JOIN users u ON a.host_id=u.id"
+    )
+
+    if tag:
+        tag_row = await env.DB.prepare("SELECT id FROM tags WHERE name=?").bind(tag).first()
+        if not tag_row:
+            return json_resp({"activities": []})
+        res = await env.DB.prepare(
+            base_q + " JOIN activity_tags at2 ON at2.activity_id=a.id WHERE at2.tag_id=? ORDER BY a.created_at DESC"
+        ).bind(tag_row.id).all()
+    elif atype and fmt:
+        res = await env.DB.prepare(base_q + " WHERE a.type=? AND a.format=? ORDER BY a.created_at DESC").bind(atype, fmt).all()
+    elif atype:
+        res = await env.DB.prepare(base_q + " WHERE a.type=? ORDER BY a.created_at DESC").bind(atype).all()
+    elif fmt:
+        res = await env.DB.prepare(base_q + " WHERE a.format=? ORDER BY a.created_at DESC").bind(fmt).all()
+    else:
+        res = await env.DB.prepare(base_q + " ORDER BY a.created_at DESC").all()
+
+    activities = []
+    for row in res.results or []:
+        desc = await decrypt_aes(row.description or "", enc)
+        host_name = await decrypt_aes(row.host_name_enc or "", enc)
+        if search and search.lower() not in row.title.lower() and search.lower() not in desc.lower():
+            continue
+
+        t_res = await env.DB.prepare(
+            "SELECT t.name FROM tags t JOIN activity_tags at2 ON at2.tag_id=t.id WHERE at2.activity_id=?"
+        ).bind(row.id).all()
+
+        activities.append(
+            {
+                "id": row.id,
+                "title": row.title,
+                "description": desc,
+                "type": row.type,
+                "format": row.format,
+                "schedule_type": row.schedule_type,
+                "host_name": host_name,
+                "participant_count": row.participant_count,
+                "session_count": row.session_count,
+                "tags": [t.name for t in (t_res.results or [])],
+                "created_at": row.created_at,
+            }
+        )
+
+    return json_resp({"activities": activities})
+
+
+async def api_create_activity(req, env):
+    user = verify_token(req.headers.get("Authorization"), env.JWT_SECRET)
+    if not user:
+        return err("Authentication required", 401)
+
+    body, bad_resp = await parse_json_object(req)
+    if bad_resp:
+        return bad_resp
+
+    title = (body.get("title") or "").strip()
+    description = (body.get("description") or "").strip()
+    atype = (body.get("type") or "course").strip()
+    fmt = (body.get("format") or "self_paced").strip()
+    schedule_type = (body.get("schedule_type") or "ongoing").strip()
+
+    if not title:
+        return err("title is required")
+    if atype not in ("course", "meetup", "workshop", "seminar", "other"):
+        atype = "course"
+    if fmt not in ("live", "self_paced", "hybrid"):
+        fmt = "self_paced"
+    if schedule_type not in ("one_time", "multi_session", "recurring", "ongoing"):
+        schedule_type = "ongoing"
+
+    enc = env.ENCRYPTION_KEY
+    act_id = new_id()
+    try:
+        await env.DB.prepare(
+            "INSERT INTO activities "
+            "(id,title,description,type,format,schedule_type,host_id)"
+            " VALUES (?,?,?,?,?,?,?)"
+        ).bind(
+            act_id,
+            title,
+            await encrypt_aes(description, enc) if description else "",
+            atype,
+            fmt,
+            schedule_type,
+            user["id"],
+        ).run()
+    except Exception as e:
+        capture_exception(e, req, env, "api_create_activity.insert_activity")
+        return err("Failed to create activity - please try again", 500)
+
+    for tag_name in (body.get("tags") or []):
+        tag_name = tag_name.strip()
+        if not tag_name:
+            continue
+        t_row = await env.DB.prepare("SELECT id FROM tags WHERE name=?").bind(tag_name).first()
+        if t_row:
+            tag_id = t_row.id
+        else:
+            tag_id = new_id()
+            try:
+                await env.DB.prepare("INSERT INTO tags (id,name) VALUES (?,?)").bind(tag_id, tag_name).run()
+            except Exception as e:
+                capture_exception(e, req, env, f"api_create_activity.insert_tag: tag_name={tag_name}, tag_id={tag_id}, act_id={act_id}")
+                continue
+        try:
+            await env.DB.prepare(
+                "INSERT OR IGNORE INTO activity_tags (activity_id,tag_id) VALUES (?,?)"
+            ).bind(act_id, tag_id).run()
+        except Exception as e:
+            capture_exception(e, req, env, f"api_create_activity.insert_activity_tags: tag_name={tag_name}, tag_id={tag_id}, act_id={act_id}")
+
+    return ok({"id": act_id, "title": title}, "Activity created")
+
+
+async def api_get_activity(act_id: str, req, env):
+    user = verify_token(req.headers.get("Authorization") or "", env.JWT_SECRET)
+    enc = env.ENCRYPTION_KEY
+
+    act = await env.DB.prepare(
+        "SELECT a.*,u.name AS host_name_enc,u.id AS host_uid"
+        " FROM activities a JOIN users u ON a.host_id=u.id"
+        " WHERE a.id=?"
+    ).bind(act_id).first()
+    if not act:
+        return err("Activity not found", 404)
+
+    enrollment = None
+    is_enrolled = False
+    if user:
+        enrollment = await env.DB.prepare(
+            "SELECT id,role,status FROM enrollments WHERE activity_id=? AND user_id=?"
+        ).bind(act_id, user["id"]).first()
+        is_enrolled = enrollment is not None
+
+    is_host = bool(user and act.host_uid == user["id"])
+
+    ses_res = await env.DB.prepare(
+        "SELECT id,title,description,start_time,end_time,location,created_at"
+        " FROM sessions WHERE activity_id=? ORDER BY start_time"
+    ).bind(act_id).all()
+
+    sessions = []
+    for s in ses_res.results or []:
+        sessions.append(
+            {
+                "id": s.id,
+                "title": s.title,
+                "description": await decrypt_aes(s.description or "", enc) if (is_enrolled or is_host) else None,
+                "start_time": s.start_time,
+                "end_time": s.end_time,
+                "location": await decrypt_aes(s.location or "", enc) if (is_enrolled or is_host) else None,
+            }
+        )
+
+    t_res = await env.DB.prepare(
+        "SELECT t.name FROM tags t JOIN activity_tags at2 ON at2.tag_id=t.id WHERE at2.activity_id=?"
+    ).bind(act_id).all()
+    count_row = await env.DB.prepare(
+        "SELECT COUNT(*) AS cnt FROM enrollments WHERE activity_id=? AND status='active'"
+    ).bind(act_id).first()
+
+    return json_resp(
+        {
+            "activity": {
+                "id": act.id,
+                "title": act.title,
+                "description": await decrypt_aes(act.description or "", enc),
+                "type": act.type,
+                "format": act.format,
+                "schedule_type": act.schedule_type,
+                "host_name": await decrypt_aes(act.host_name_enc or "", enc),
+                "participant_count": count_row.cnt if count_row else 0,
+                "tags": [t.name for t in (t_res.results or [])],
+                "created_at": act.created_at,
+            },
+            "sessions": sessions,
+            "is_enrolled": is_enrolled,
+            "is_host": is_host,
+            "enrollment": {"role": enrollment.role, "status": enrollment.status} if enrollment else None,
+        }
+    )
+
+
+async def api_join(req, env):
+    user = verify_token(req.headers.get("Authorization"), env.JWT_SECRET)
+    if not user:
+        return err("Authentication required", 401)
+
+    body, bad_resp = await parse_json_object(req)
+    if bad_resp:
+        return bad_resp
+
+    act_id = body.get("activity_id")
+    role = (body.get("role") or "participant").strip()
+    if not act_id:
+        return err("activity_id is required")
+    if role not in ("participant", "instructor", "organizer"):
+        role = "participant"
+
+    act = await env.DB.prepare("SELECT id FROM activities WHERE id=?").bind(act_id).first()
+    if not act:
+        return err("Activity not found", 404)
+
+    enr_id = new_id()
+    try:
+        await env.DB.prepare(
+            "INSERT OR IGNORE INTO enrollments (id,activity_id,user_id,role) VALUES (?,?,?,?)"
+        ).bind(enr_id, act_id, user["id"], role).run()
+    except Exception as e:
+        capture_exception(e, req, env, "api_join.insert_enrollment")
+        return err("Failed to join activity - please try again", 500)
+
+    return ok(None, "Joined activity successfully")
+
+
+async def api_dashboard(req, env):
+    user = verify_token(req.headers.get("Authorization"), env.JWT_SECRET)
+    if not user:
+        return err("Authentication required", 401)
+
+    enc = env.ENCRYPTION_KEY
+    res = await env.DB.prepare(
+        "SELECT a.id,a.title,a.type,a.format,a.schedule_type,a.created_at,"
+        "(SELECT COUNT(*) FROM enrollments WHERE activity_id=a.id AND status='active') AS participant_count,"
+        "(SELECT COUNT(*) FROM sessions WHERE activity_id=a.id) AS session_count"
+        " FROM activities a WHERE a.host_id=? ORDER BY a.created_at DESC"
+    ).bind(user["id"]).all()
+
+    hosted = []
+    for r in res.results or []:
+        t_res = await env.DB.prepare(
+            "SELECT t.name FROM tags t JOIN activity_tags at2 ON at2.tag_id=t.id WHERE at2.activity_id=?"
+        ).bind(r.id).all()
+        hosted.append(
+            {
+                "id": r.id,
+                "title": r.title,
+                "type": r.type,
+                "format": r.format,
+                "schedule_type": r.schedule_type,
+                "participant_count": r.participant_count,
+                "session_count": r.session_count,
+                "tags": [t.name for t in (t_res.results or [])],
+                "created_at": r.created_at,
+            }
+        )
+
+    res2 = await env.DB.prepare(
+        "SELECT a.id,a.title,a.type,a.format,a.schedule_type,"
+        "e.role AS enr_role,e.status AS enr_status,e.created_at AS joined_at,"
+        "u.name AS host_name_enc"
+        " FROM enrollments e"
+        " JOIN activities a ON e.activity_id=a.id"
+        " JOIN users u ON a.host_id=u.id"
+        " WHERE e.user_id=? ORDER BY e.created_at DESC"
+    ).bind(user["id"]).all()
+
+    joined = []
+    for r in res2.results or []:
+        t_res = await env.DB.prepare(
+            "SELECT t.name FROM tags t JOIN activity_tags at2 ON at2.tag_id=t.id WHERE at2.activity_id=?"
+        ).bind(r.id).all()
+        joined.append(
+            {
+                "id": r.id,
+                "title": r.title,
+                "type": r.type,
+                "format": r.format,
+                "schedule_type": r.schedule_type,
+                "enr_role": r.enr_role,
+                "enr_status": r.enr_status,
+                "host_name": await decrypt_aes(r.host_name_enc or "", enc),
+                "tags": [t.name for t in (t_res.results or [])],
+                "joined_at": r.joined_at,
+            }
+        )
+
+    return json_resp({"user": user, "hosted_activities": hosted, "joined_activities": joined})
+
+
+async def api_create_session(req, env):
+    user = verify_token(req.headers.get("Authorization"), env.JWT_SECRET)
+    if not user:
+        return err("Authentication required", 401)
+
+    body, bad_resp = await parse_json_object(req)
+    if bad_resp:
+        return bad_resp
+
+    act_id = body.get("activity_id")
+    title = (body.get("title") or "").strip()
+    description = (body.get("description") or "").strip()
+    start_time = (body.get("start_time") or "").strip()
+    end_time = (body.get("end_time") or "").strip()
+    location = (body.get("location") or "").strip()
+
+    if not act_id or not title:
+        return err("activity_id and title are required")
+
+    owned = await env.DB.prepare("SELECT id FROM activities WHERE id=? AND host_id=?").bind(act_id, user["id"]).first()
+    if not owned:
+        return err("Activity not found or access denied", 404)
+
+    enc = env.ENCRYPTION_KEY
+    sid = new_id()
+    try:
+        await env.DB.prepare(
+            "INSERT INTO sessions "
+            "(id,activity_id,title,description,start_time,end_time,location)"
+            " VALUES (?,?,?,?,?,?,?)"
+        ).bind(
+            sid,
+            act_id,
+            title,
+            await encrypt_aes(description, enc) if description else "",
+            start_time,
+            end_time,
+            await encrypt_aes(location, enc) if location else "",
+        ).run()
+    except Exception as e:
+        capture_exception(e, req, env, "api_create_session.insert_session")
+        return err("Failed to create session - please try again", 500)
+
+    return ok({"id": sid}, "Session created")
+
+
+async def api_list_tags(_req, env):
+    res = await env.DB.prepare("SELECT id,name FROM tags ORDER BY name").all()
+    return json_resp({"tags": [{"id": r.id, "name": r.name} for r in (res.results or [])]})
+
+
+async def api_add_activity_tags(req, env):
+    user = verify_token(req.headers.get("Authorization"), env.JWT_SECRET)
+    if not user:
+        return err("Authentication required", 401)
+
+    body, bad_resp = await parse_json_object(req)
+    if bad_resp:
+        return bad_resp
+
+    act_id = body.get("activity_id")
+    tags = body.get("tags") or []
+    if not act_id:
+        return err("activity_id is required")
+
+    owned = await env.DB.prepare("SELECT id FROM activities WHERE id=? AND host_id=?").bind(act_id, user["id"]).first()
+    if not owned:
+        return err("Activity not found or access denied", 404)
+
+    for tag_name in tags:
+        tag_name = tag_name.strip()
+        if not tag_name:
+            continue
+        t_row = await env.DB.prepare("SELECT id FROM tags WHERE name=?").bind(tag_name).first()
+        if t_row:
+            tag_id = t_row.id
+        else:
+            tag_id = new_id()
+            try:
+                await env.DB.prepare("INSERT INTO tags (id,name) VALUES (?,?)").bind(tag_id, tag_name).run()
+            except Exception as e:
+                capture_exception(e, req, env, f"api_add_activity_tags.insert_tag: tag_name={tag_name}, tag_id={tag_id}, act_id={act_id}")
+                continue
+        try:
+            await env.DB.prepare(
+                "INSERT OR IGNORE INTO activity_tags (activity_id,tag_id) VALUES (?,?)"
+            ).bind(act_id, tag_id).run()
+        except Exception as e:
+            capture_exception(e, req, env, f"api_add_activity_tags.insert_activity_tags: tag_name={tag_name}, tag_id={tag_id}, act_id={act_id}")
+
+    return ok(None, "Tags updated")
diff --git a/src/api_admin.py b/src/api_admin.py
new file mode 100644
index 0000000..4d02db9
--- /dev/null
+++ b/src/api_admin.py
@@ -0,0 +1,20 @@
+from http_utils import is_basic_auth_valid, json_resp, unauthorized_basic
+
+
+async def api_admin_table_counts(req, env):
+    if not is_basic_auth_valid(req, env):
+        return unauthorized_basic()
+
+    tables_res = await env.DB.prepare(
+        "SELECT name FROM sqlite_master WHERE type='table' AND name NOT LIKE 'sqlite_%' ORDER BY name"
+    ).all()
+
+    counts = []
+    for row in tables_res.results or []:
+        table_name = row.name
+        count_row = await env.DB.prepare(
+            f'SELECT COUNT(*) AS cnt FROM "{table_name.replace(chr(34), chr(34) + chr(34))}"'
+        ).first()
+        counts.append({"table": table_name, "count": count_row.cnt if count_row else 0})
+
+    return json_resp({"tables": counts})
diff --git a/src/api_auth.py b/src/api_auth.py
new file mode 100644
index 0000000..f3e924e
--- /dev/null
+++ b/src/api_auth.py
@@ -0,0 +1,98 @@
+"""
+Authentication-related API handlers live here.
+"""
+
+from http_utils import capture_exception, err, ok, parse_json_object
+from security_utils import (
+    blind_index,
+    create_token,
+    decrypt_aes,
+    encrypt_aes,
+    hash_password,
+    new_id,
+    verify_password,
+)
+
+
+async def api_register(req, env):
+    body, bad_resp = await parse_json_object(req)
+    if bad_resp:
+        return bad_resp
+
+    username = (body.get("username") or "").strip()
+    email = (body.get("email") or "").strip()
+    password = (body.get("password") or "")
+    name = (body.get("name") or username).strip()
+
+    if not username or not email or not password:
+        return err("username, email, and password are required")
+    if len(password) < 8:
+        return err("Password must be at least 8 characters")
+
+    role = "member"
+    enc = env.ENCRYPTION_KEY
+    uid = new_id()
+    try:
+        await env.DB.prepare(
+            "INSERT INTO users "
+            "(id,username_hash,email_hash,name,username,email,password_hash,role)"
+            " VALUES (?,?,?,?,?,?,?,?)"
+        ).bind(
+            uid,
+            blind_index(username, enc),
+            blind_index(email, enc),
+            await encrypt_aes(name, enc),
+            await encrypt_aes(username, enc),
+            await encrypt_aes(email, enc),
+            hash_password(password, username),
+            await encrypt_aes(role, enc),
+        ).run()
+    except Exception as e:
+        if "UNIQUE" in str(e):
+            return err("Username or email already registered", 409)
+        capture_exception(e, req, env, "api_register.insert_user")
+        return err("Registration failed - please try again", 500)
+
+    token = create_token(uid, username, role, env.JWT_SECRET)
+    return ok(
+        {"token": token, "user": {"id": uid, "username": username, "name": name, "role": role}},
+        "Registration successful",
+    )
+
+
+async def api_login(req, env):
+    body, bad_resp = await parse_json_object(req)
+    if bad_resp:
+        return bad_resp
+
+    username = (body.get("username") or "").strip()
+    password = (body.get("password") or "")
+
+    if not username or not password:
+        return err("username and password are required")
+
+    enc = env.ENCRYPTION_KEY
+    u_hash = blind_index(username, enc)
+    row = await env.DB.prepare(
+        "SELECT id,password_hash,role,name,username FROM users WHERE username_hash=?"
+    ).bind(u_hash).first()
+
+    if not row:
+        return err("Invalid username or password", 401)
+
+    stored_username = await decrypt_aes(row.username, enc)
+    if not stored_username or stored_username == "[decryption error]":
+        return err("Invalid username or password", 401)
+    if not verify_password(password, row.password_hash, stored_username):
+        return err("Invalid username or password", 401)
+
+    real_role = await decrypt_aes(row.role, enc)
+    real_name = await decrypt_aes(row.name, enc)
+    if not real_role or real_role == "[decryption error]":
+        return err("Account data corrupted - please contact support", 500)
+
+    token = create_token(row.id, stored_username, real_role, env.JWT_SECRET)
+    return ok(
+        {"token": token, "user": {"id": row.id, "username": stored_username, "name": real_name, "role": real_role}},
+        "Login successful",
+    )
diff --git a/src/db_utils.py b/src/db_utils.py
new file mode 100644
index 0000000..dce4fd8
--- /dev/null
+++ b/src/db_utils.py
@@ -0,0 +1,204 @@
+"""
+Database schema and seed helpers live here.
+"""
+
+from security_utils import blind_index, encrypt_aes, hash_password
+
+_DDL = [
+    """CREATE TABLE IF NOT EXISTS users (
+        id            TEXT PRIMARY KEY,
+        username_hash TEXT NOT NULL UNIQUE,
+        email_hash    TEXT NOT NULL UNIQUE,
+        name          TEXT NOT NULL,
+        username      TEXT NOT NULL,
+        email         TEXT NOT NULL,
+        password_hash TEXT NOT NULL,
+        role          TEXT NOT NULL,
+        created_at    TEXT NOT NULL DEFAULT (datetime('now'))
+    )""",
+    """CREATE TABLE IF NOT EXISTS activities (
+        id            TEXT PRIMARY KEY,
+        title         TEXT NOT NULL,
+        description   TEXT,
+        type          TEXT NOT NULL DEFAULT 'course',
+        format        TEXT NOT NULL DEFAULT 'self_paced',
+        schedule_type TEXT NOT NULL DEFAULT 'ongoing',
+        host_id       TEXT NOT NULL,
+        created_at    TEXT NOT NULL DEFAULT (datetime('now')),
+        FOREIGN KEY (host_id) REFERENCES users(id)
+    )""",
+    """CREATE TABLE IF NOT EXISTS sessions (
+        id          TEXT PRIMARY KEY,
+        activity_id TEXT NOT NULL,
+        title       TEXT,
+        description TEXT,
+        start_time  TEXT,
+        end_time    TEXT,
+        location    TEXT,
+        created_at  TEXT NOT NULL DEFAULT (datetime('now')),
+        FOREIGN KEY (activity_id) REFERENCES activities(id)
+    )""",
+    """CREATE TABLE IF NOT EXISTS enrollments (
+        id          TEXT PRIMARY KEY,
+        activity_id TEXT NOT NULL,
+        user_id     TEXT NOT NULL,
+        role        TEXT NOT NULL DEFAULT 'participant',
+        status      TEXT NOT NULL DEFAULT 'active',
+        created_at  TEXT NOT NULL DEFAULT (datetime('now')),
+        UNIQUE (activity_id, user_id),
+        FOREIGN KEY (activity_id) REFERENCES activities(id),
+        FOREIGN KEY (user_id)     REFERENCES users(id)
+    )""",
+    """CREATE TABLE IF NOT EXISTS session_attendance (
+        id         TEXT PRIMARY KEY,
+        session_id TEXT NOT NULL,
+        user_id    TEXT NOT NULL,
+        status     TEXT NOT NULL DEFAULT 'registered',
+        created_at TEXT NOT NULL DEFAULT (datetime('now')),
+        UNIQUE (session_id, user_id),
+        FOREIGN KEY (session_id) REFERENCES sessions(id),
+        FOREIGN KEY (user_id)    REFERENCES users(id)
+    )""",
+    """CREATE TABLE IF NOT EXISTS tags (
+        id   TEXT PRIMARY KEY,
+        name TEXT UNIQUE NOT NULL
+    )""",
+    """CREATE TABLE IF NOT EXISTS activity_tags (
+        activity_id TEXT NOT NULL,
+        tag_id      TEXT NOT NULL,
+        PRIMARY KEY (activity_id, tag_id),
+        FOREIGN KEY (activity_id) REFERENCES activities(id),
+        FOREIGN KEY (tag_id)      REFERENCES tags(id)
+    )""",
+    "CREATE INDEX IF NOT EXISTS idx_activities_host      ON activities(host_id)",
+    "CREATE INDEX IF NOT EXISTS idx_enrollments_activity ON enrollments(activity_id)",
+    "CREATE INDEX IF NOT EXISTS idx_enrollments_user     ON enrollments(user_id)",
+    "CREATE INDEX IF NOT EXISTS idx_sessions_activity    ON sessions(activity_id)",
+    "CREATE INDEX IF NOT EXISTS idx_sa_session           ON session_attendance(session_id)",
+    "CREATE INDEX IF NOT EXISTS idx_sa_user              ON session_attendance(user_id)",
+    "CREATE INDEX IF NOT EXISTS idx_at_activity          ON activity_tags(activity_id)",
+]
+
+
+async def init_db(env):
+    for sql in _DDL:
+        await env.DB.prepare(sql).run()
+
+
+async def seed_db(env, enc_key: str):
+    seed_users = [
+        ("alice", "alice@example.com", "password123", "host", "Alice Chen"),
+        ("bob", "bob@example.com", "password123", "host", "Bob Martinez"),
+        ("charlie", "charlie@example.com", "password123", "member", "Charlie Kim"),
+        ("diana", "diana@example.com", "password123", "member", "Diana Patel"),
+    ]
+    uid_map = {}
+    for uname, email, pw, role, display in seed_users:
+        uid = f"usr-{uname}"
+        uid_map[uname] = uid
+        try:
+            await env.DB.prepare(
+                "INSERT INTO users "
+                "(id,username_hash,email_hash,name,username,email,password_hash,role)"
+                " VALUES (?,?,?,?,?,?,?,?)"
+            ).bind(
+                uid,
+                blind_index(uname, enc_key),
+                blind_index(email, enc_key),
+                await encrypt_aes(display, enc_key),
+                await encrypt_aes(uname, enc_key),
+                await encrypt_aes(email, enc_key),
+                hash_password(pw, uname),
+                await encrypt_aes(role, enc_key),
+            ).run()
+        except Exception:
+            pass
+
+    aid = uid_map["alice"]
+    bid = uid_map["bob"]
+    cid = uid_map["charlie"]
+    did = uid_map["diana"]
+
+    tag_rows = [
+        ("tag-python", "Python"),
+        ("tag-js", "JavaScript"),
+        ("tag-data", "Data Science"),
+        ("tag-ml", "Machine Learning"),
+        ("tag-webdev", "Web Development"),
+        ("tag-db", "Databases"),
+        ("tag-cloud", "Cloud"),
+    ]
+    for tid, tname in tag_rows:
+        try:
+            await env.DB.prepare("INSERT INTO tags (id,name) VALUES (?,?)").bind(tid, tname).run()
+        except Exception:
+            pass
+
+    act_rows = [
+        ("act-py-begin", "Python for Beginners", "Learn Python programming from scratch. Master variables, loops, functions, and object-oriented design in this hands-on course.", "course", "self_paced", "ongoing", aid, ["tag-python"]),
+        ("act-js-meetup", "JavaScript Developers Meetup", "Monthly meetup for JavaScript enthusiasts. Share projects, discuss new frameworks, and network with fellow devs.", "meetup", "live", "recurring", bid, ["tag-js", "tag-webdev"]),
+        ("act-ds-workshop", "Data Science Workshop", "Hands-on workshop covering data wrangling with pandas, visualisation with matplotlib, and intro to machine learning.", "workshop", "live", "multi_session", aid, ["tag-data", "tag-python"]),
+        ("act-ml-study", "Machine Learning Study Group", "Collaborative study group working through ML concepts, reading papers, and implementing algorithms together.", "course", "hybrid", "recurring", bid, ["tag-ml", "tag-python"]),
+        ("act-webdev", "Web Dev Fundamentals", "Build modern responsive websites with HTML5, CSS3, and JavaScript. Covers Flexbox, Grid, fetch API, and accessible design.", "course", "self_paced", "ongoing", aid, ["tag-webdev", "tag-js"]),
+        ("act-db-design", "Database Design & SQL", "Design normalised relational schemas, write complex SQL queries, use indexes for speed, and understand transactions.", "workshop", "live", "one_time", bid, ["tag-db"]),
+    ]
+    for act_id, title, desc, atype, fmt, sched, host_id, tags in act_rows:
+        try:
+            await env.DB.prepare(
+                "INSERT INTO activities "
+                "(id,title,description,type,format,schedule_type,host_id)"
+                " VALUES (?,?,?,?,?,?,?)"
+            ).bind(
+                act_id, title, await encrypt_aes(desc, enc_key), atype, fmt, sched, host_id
+            ).run()
+        except Exception:
+            pass
+        for tag_id in tags:
+            try:
+                await env.DB.prepare(
+                    "INSERT OR IGNORE INTO activity_tags (activity_id,tag_id) VALUES (?,?)"
+                ).bind(act_id, tag_id).run()
+            except Exception:
+                pass
+
+    ses_rows = [
+        ("ses-js-1", "act-js-meetup", "April Meetup", "Q1 retro and React 19 deep-dive", "2024-04-15 18:00", "2024-04-15 21:00", "Tech Hub, 123 Main St, SF"),
+        ("ses-js-2", "act-js-meetup", "May Meetup", "TypeScript 5.4 and what's new in Node 22", "2024-05-20 18:00", "2024-05-20 21:00", "Tech Hub, 123 Main St, SF"),
+        ("ses-ds-1", "act-ds-workshop", "Session 1 - Data Wrangling", "Introduction to pandas DataFrames and data cleaning", "2024-06-01 10:00", "2024-06-01 14:00", "Online via Zoom"),
+        ("ses-ds-2", "act-ds-workshop", "Session 2 - Visualisation", "matplotlib, seaborn, and plotly for data storytelling", "2024-06-08 10:00", "2024-06-08 14:00", "Online via Zoom"),
+        ("ses-ds-3", "act-ds-workshop", "Session 3 - Intro to ML", "scikit-learn: regression, classification, evaluation", "2024-06-15 10:00", "2024-06-15 14:00", "Online via Zoom"),
+    ]
+    for sid, act_id, title, desc, start, end, loc in ses_rows:
+        try:
+            await env.DB.prepare(
+                "INSERT INTO sessions "
+                "(id,activity_id,title,description,start_time,end_time,location)"
+                " VALUES (?,?,?,?,?,?,?)"
+            ).bind(
+                sid,
+                act_id,
+                title,
+                await encrypt_aes(desc, enc_key),
+                start,
+                end,
+                await encrypt_aes(loc, enc_key),
+            ).run()
+        except Exception:
+            pass
+
+    enr_rows = [
+        ("enr-c-py", "act-py-begin", cid, "participant"),
+        ("enr-c-js", "act-js-meetup", cid, "participant"),
+        ("enr-c-ds", "act-ds-workshop", cid, "participant"),
+        ("enr-d-py", "act-py-begin", did, "participant"),
+        ("enr-d-webdev", "act-webdev", did, "participant"),
+        ("enr-b-py", "act-py-begin", bid, "instructor"),
+    ]
+    for eid, act_id, uid, role in enr_rows:
+        try:
+            await env.DB.prepare(
+                "INSERT OR IGNORE INTO enrollments (id,activity_id,user_id,role)"
+                " VALUES (?,?,?,?)"
+            ).bind(eid, act_id, uid, role).run()
+        except Exception:
+            pass
diff --git a/src/http_utils.py b/src/http_utils.py
new file mode 100644
index 0000000..4cfb408
--- /dev/null
+++ b/src/http_utils.py
@@ -0,0 +1,112 @@
+import base64
+import hmac as _hmac
+import json
+import re
+import traceback
+from urllib.parse import urlparse
+
+from workers import Response
+
+
+def capture_exception(exc: Exception, req=None, _env=None, where: str = ""):
+    """Best-effort exception logging with full traceback and request context."""
+    try:
+        payload = {
+            "level": "error",
+            "where": where or "unknown",
+            "error_type": type(exc).__name__,
+            "error": str(exc),
+            "traceback": "".join(traceback.format_exception(type(exc), exc, exc.__traceback__)),
+        }
+        if req:
+            payload["request"] = {
+                "method": req.method,
+                "url": req.url,
+                "path": urlparse(req.url).path,
+            }
+        print(json.dumps(payload))
+    except Exception:
+        pass
+
+
+CORS = {
+    "Access-Control-Allow-Origin": "*",
+    "Access-Control-Allow-Methods": "GET, POST, PUT, DELETE, OPTIONS",
+    "Access-Control-Allow-Headers": "Content-Type, Authorization",
+}
+
+
+def json_resp(data, status: int = 200):
+    return Response(
+        json.dumps(data),
+        status=status,
+        headers={"Content-Type": "application/json", **CORS},
+    )
+
+
+def ok(data=None, msg: str = "OK"):
+    body = {"success": True, "message": msg}
+    if data is not None:
+        body["data"] = data
+    return json_resp(body, 200)
+
+
+def err(msg: str, status: int = 400):
+    return json_resp({"error": msg}, status)
+
+
+async def parse_json_object(req):
+    """Parse request JSON and ensure payload is an object/dict."""
+    try:
+        text = await req.text()
+        body = json.loads(text)
+    except Exception:
+        return None, err("Invalid JSON body")
+
+    if not isinstance(body, dict):
+        return None, err("JSON body must be an object", 400)
+
+    return body, None
+
+
+def clean_path(value: str, default: str = "/admin") -> str:
+    """Normalize an env-provided path into a safe absolute URL path."""
+    raw = (value or "").strip()
+    if not raw:
+        return default
+    parsed = urlparse(raw)
+    path = (parsed.path or raw).strip()
+    if not path.startswith("/"):
+        path = "/" + path
+    path = re.sub(r"/+", "/", path)
+    if len(path) > 1 and path.endswith("/"):
+        path = path[:-1]
+    return path or default
+
+
+def unauthorized_basic(realm: str = "Alpha One Labs Admin"):
+    return Response(
+        "Authentication required",
+        status=401,
+        headers={"WWW-Authenticate": f'Basic realm="{realm}"', **CORS},
+    )
+
+
+def is_basic_auth_valid(req, env) -> bool:
+    username = (getattr(env, "ADMIN_BASIC_USER", "") or "").strip()
+    password = (getattr(env, "ADMIN_BASIC_PASS", "") or "").strip()
+    if not username or not password:
+        return False
+
+    auth = req.headers.get("Authorization") or ""
+    if not auth.lower().startswith("basic "):
+        return False
+
+    try:
+        raw = auth.split(" ", 1)[1].strip()
+        decoded = base64.b64decode(raw).decode("utf-8")
+        user, pwd = decoded.split(":", 1)
+    except Exception:
+        return False
+
+    return _hmac.compare_digest(user, username) and _hmac.compare_digest(pwd, password)
diff --git a/src/security_utils.py b/src/security_utils.py
new file mode 100644
index 0000000..837d24b
--- /dev/null
+++ b/src/security_utils.py
@@ -0,0 +1,170 @@
+import base64
+import hashlib
+import hmac as _hmac
+import json
+import os
+
+import js
+from pyodide.ffi import to_js
+
+from http_utils import capture_exception
+
+
+def new_id() -> str:
+    """Generate a random UUID v4 using os.urandom."""
+    b = bytearray(os.urandom(16))
+    b[6] = (b[6] & 0x0F) | 0x40
+    b[8] = (b[8] & 0x3F) | 0x80
+    h = b.hex()
+    return f"{h[:8]}-{h[8:12]}-{h[12:16]}-{h[16:20]}-{h[20:]}"
+
+
+def _derive_key(secret: str) -> bytes:
+    """Derive a 32-byte key from an arbitrary secret string via SHA-256."""
+    return hashlib.sha256(secret.encode("utf-8")).digest()
+
+
+def _derive_aes_key_bytes(secret: str) -> bytes:
+    """Derive a 32-byte AES-256 key via PBKDF2-SHA256 with a fixed domain salt."""
+    salt = hashlib.sha256(b"aol-edu-aes-salt-v1" + secret.encode()).digest()
+    return hashlib.pbkdf2_hmac("sha256", secret.encode("utf-8"), salt, 100_000)
+
+
+async def _import_aes_key(key_bytes: bytes) -> object:
+    """Import raw bytes as a Web Crypto AES-GCM CryptoKey."""
+    key_buf = to_js(key_bytes, create_pyproxies=False)
+    algo = to_js({"name": "AES-GCM"}, dict_converter=js.Object.fromEntries)
+    usages = to_js(["encrypt", "decrypt"])
+    return await js.crypto.subtle.importKey("raw", key_buf, algo, False, usages)
+
+
+async def encrypt_aes(plaintext: str, secret: str) -> str:
+    """
+    AES-256-GCM encryption using js.crypto.subtle (Web Crypto API).
+    Returns "v1:" + base64(iv || ciphertext+tag).
+    """
+    if not plaintext:
+        return ""
+    try:
+        key_bytes = _derive_aes_key_bytes(secret)
+        crypto_key = await _import_aes_key(key_bytes)
+
+        iv_array = js.Uint8Array.new(12)
+        js.crypto.getRandomValues(iv_array)
+        iv = bytes(iv_array)
+
+        algo = to_js({"name": "AES-GCM", "iv": iv_array}, dict_converter=js.Object.fromEntries)
+        data = to_js(plaintext.encode("utf-8"))
+        ct_buf = await js.crypto.subtle.encrypt(algo, crypto_key, data)
+        ct = bytes(js.Uint8Array.new(ct_buf))
+        return "v1:" + base64.b64encode(iv + ct).decode("ascii")
+    except Exception as exc:
+        capture_exception(exc, where="encrypt_aes")
+        raise RuntimeError(f"AES-256-GCM encryption failed: {exc}") from exc
+
+
+async def decrypt_aes(ciphertext: str, secret: str) -> str:
+    """AES-256-GCM decryption. Handles both v1 and legacy XOR ciphertext."""
+    if not ciphertext:
+        return ""
+    if not ciphertext.startswith("v1:"):
+        return _decrypt_xor(ciphertext, secret)
+    try:
+        raw = base64.b64decode(ciphertext[3:])
+        iv, ct = raw[:12], raw[12:]
+    except Exception as exc:
+        capture_exception(exc, where="decrypt_aes.decode")
+        return "[decryption error]"
+    try:
+        key_bytes = _derive_aes_key_bytes(secret)
+        crypto_key = await _import_aes_key(key_bytes)
+        iv_array = to_js(iv)
+        algo = to_js({"name": "AES-GCM", "iv": iv_array}, dict_converter=js.Object.fromEntries)
+        data = to_js(ct)
+        pt_buf = await js.crypto.subtle.decrypt(algo, crypto_key, data)
+        return bytes(js.Uint8Array.new(pt_buf)).decode("utf-8")
+    except Exception as exc:
+        capture_exception(exc, where="decrypt_aes.auth")
+        return "[decryption error]"
+
+
+def _encrypt_xor(plaintext: str, secret: str) -> str:
+    """Legacy XOR stream cipher kept for backward compatibility only."""
+    if not plaintext:
+        return ""
+    key = _derive_key(secret)
+    data = plaintext.encode("utf-8")
+    ks = (key * (len(data) // len(key) + 1))[: len(data)]
+    return base64.b64encode(bytes(a ^ b for a, b in zip(data, ks))).decode("ascii")
+
+
+def _decrypt_xor(ciphertext: str, secret: str) -> str:
+    """Legacy XOR stream cipher decryption kept for backward compatibility."""
+    if not ciphertext:
+        return ""
+    try:
+        key = _derive_key(secret)
+        raw = base64.b64decode(ciphertext)
+        ks = (key * (len(raw) // len(key) + 1))[: len(raw)]
+        return bytes(a ^ b for a, b in zip(raw, ks)).decode("utf-8")
+    except Exception:
+        return "[decryption error]"
+
+
+def blind_index(value: str, secret: str) -> str:
+    """HMAC-SHA256 deterministic hash used as a blind index."""
+    return _hmac.new(
+        secret.encode("utf-8"), value.lower().encode("utf-8"), hashlib.sha256
+    ).hexdigest()
+
+
+_PEPPER = b"edu-platform-cf-pepper-2024"
+_PBKDF2_IT = 100_000
+
+
+def _user_salt(username: str) -> bytes:
+    """Per-user PBKDF2 salt = SHA-256(pepper || username)."""
+    return hashlib.sha256(_PEPPER + username.encode("utf-8")).digest()
+
+
+def hash_password(password: str, username: str) -> str:
+    """PBKDF2-SHA256 with per-user derived salt."""
+    dk = hashlib.pbkdf2_hmac(
+        "sha256", password.encode("utf-8"), _user_salt(username), _PBKDF2_IT
+    )
+    return base64.b64encode(dk).decode("ascii")
+
+
+def verify_password(password: str, stored: str, username: str) -> bool:
+    return hash_password(password, username) == stored
+
+
+def create_token(uid: str, username: str, role: str, secret: str) -> str:
+    payload = base64.b64encode(
+        json.dumps({"id": uid, "username": username, "role": role}).encode()
+    ).decode("ascii")
+    sig = _hmac.new(
+        secret.encode("utf-8"), payload.encode("utf-8"), hashlib.sha256
+    ).hexdigest()
+    return f"{payload}.{sig}"
+
+
+def verify_token(raw: str, secret: str):
+    """Return decoded payload dict or None if invalid/missing."""
+    if not raw:
+        return None
+    try:
+        token = raw.removeprefix("Bearer ").strip()
+        dot = token.rfind(".")
+        if dot == -1:
+            return None
+        payload, sig = token[:dot], token[dot + 1:]
+        exp = _hmac.new(
+            secret.encode("utf-8"), payload.encode("utf-8"), hashlib.sha256
+        ).hexdigest()
+        if not _hmac.compare_digest(sig, exp):
+            return None
+        padding = (4 - len(payload) % 4) % 4
+        return json.loads(base64.b64decode(payload + "=" * padding).decode("utf-8"))
+    except Exception:
+        return None
diff --git a/src/static_utils.py b/src/static_utils.py
new file mode 100644
index 0000000..0a2cb22
--- /dev/null
+++ b/src/static_utils.py
@@ -0,0 +1,45 @@
+from workers import Response
+
+from http_utils import CORS
+
+_MIME = {
+    "html": "text/html; charset=utf-8",
+    "css": "text/css; charset=utf-8",
+    "js": "application/javascript; charset=utf-8",
+    "json": "application/json",
+    "png": "image/png",
+    "jpg": "image/jpeg",
+    "svg": "image/svg+xml",
+    "ico": "image/x-icon",
+}
+
+
+async def serve_static(path: str, env):
+    if path in ("/", ""):
+        key = "index.html"
+    else:
+        key = path.lstrip("/")
+        if "." not in key.split("/")[-1]:
+            key += ".html"
+
+    try:
+        content = await env.__STATIC_CONTENT.get(key, "text")
+    except Exception:
+        content = None
+
+    if content is None:
+        try:
+            content = await env.__STATIC_CONTENT.get("index.html", "text")
+        except Exception:
+            content = None
+
+    if content is None:
+        return Response(
+            "<h1>404 - Not Found</h1>",
+            status=404,
+            headers={"Content-Type": "text/html"},
+        )
+
+    ext = key.rsplit(".", 1)[-1] if "." in key else "html"
+    mime = _MIME.get(ext, "text/plain")
+    return Response(content, headers={"Content-Type": mime, **CORS})
diff --git a/src/worker.py b/src/worker.py
index 764ff3d..90b8b7d 100644
--- a/src/worker.py
+++ b/src/worker.py
@@ -1,1245 +1,48 @@
 """
-Alpha One Labs – Cloudflare Python Worker (Activities Model)
-=========================================================
-API Routes
-  POST /api/init              – initialise DB schema
-  POST /api/seed              – seed sample data
-  POST /api/register          – register a new user
-  POST /api/login             – authenticate -> signed token
-  GET  /api/activities        – list activities (?type=&format=&q=&tag=)
-  POST /api/activities        – create activity              [host]
-  GET  /api/activities/:id    – activity + sessions + state
-  POST /api/join              – join an activity
-  GET  /api/dashboard         – personal dashboard
-  POST /api/sessions          – add a session to activity    [host]
-  GET  /api/tags              – list all tags
-  POST /api/activity-tags     – add tags to an activity      [host]
-
-Security model
-  * ALL user PII (username, email, display name, role) is encrypted with
-    AES-256-GCM (via js.crypto.subtle) before storage.
-  * HMAC-SHA256 blind indexes (username_hash, email_hash) allow O(1) row
-    lookups without ever storing plaintext PII in an indexed column.
-  * Activity descriptions and session locations/descriptions are encrypted.
-  * Passwords: PBKDF2-SHA256, per-user derived salt (username + global pepper).
-  * Auth tokens: HMAC-SHA256 signed, stateless (JWT-lite).
-  AES-256-GCM authenticated encryption via js.crypto.subtle.
-    96-bit random IV generated per encryption call.
-    128-bit GCM auth tag provides tamper detection.
-    Backward compatible: existing XOR-encrypted data decrypted transparently.
-    Legacy _encrypt_xor/_decrypt_xor retained for reading old stored data.
-
-Static HTML pages (public/) are served via Workers Sites (KV binding).
+Alpha One Labs - Cloudflare Python Worker (Activities Model)
 """
 
-import base64
-import hashlib
-import hmac as _hmac
-import json
-import os
 import re
-import traceback
-from urllib.parse import urlparse, parse_qs
+from urllib.parse import urlparse
 
 from workers import Response
 
-import js
-from pyodide.ffi import to_js
-
-def capture_exception(exc: Exception, req=None, _env=None, where: str = ""):
-    """Best-effort exception logging with full traceback and request context."""
-    try:
-        payload = {
-            "level": "error",
-            "where": where or "unknown",
-            "error_type": type(exc).__name__,
-            "error": str(exc),
-            "traceback": "".join(traceback.format_exception(type(exc), exc, exc.__traceback__)),
-        }
-        if req:
-            payload["request"] = {
-                "method": req.method,
-                "url": req.url,
-                "path": urlparse(req.url).path,
-            }
-        print(json.dumps(payload))
-    except Exception:
-        pass
-
-
-# ---------------------------------------------------------------------------
-# ID generation
-# ---------------------------------------------------------------------------
-
-def new_id() -> str:
-    """Generate a random UUID v4 using os.urandom."""
-    b = bytearray(os.urandom(16))
-    b[6] = (b[6] & 0x0F) | 0x40   # version 4
-    b[8] = (b[8] & 0x3F) | 0x80   # RFC 4122 variant
-    h = b.hex()
-    return f"{h[:8]}-{h[8:12]}-{h[12:16]}-{h[16:20]}-{h[20:]}"
-
-
-# ---------------------------------------------------------------------------
-# Encryption helpers
-# ---------------------------------------------------------------------------
-
-# ---------------------------------------------------------------------------
-# Encryption helpers - AES-256-GCM via Web Crypto API (js.crypto.subtle)
-# ---------------------------------------------------------------------------
-# Replaces the XOR stream cipher with authenticated AES-256-GCM encryption.
-# - 256-bit key derived from secret via PBKDF2-SHA256 (100k iterations)
-# - 96-bit random IV prepended to ciphertext
-# - 128-bit GCM auth tag appended automatically by Web Crypto
-# - Output: base64(iv || ciphertext+tag) prefixed with "v1:" for D1 storage
-# - Backward compatible: no "v1:" prefix = legacy XOR, decrypted transparently
-
-def _derive_key(secret: str) -> bytes:
-    """Derive a 32-byte key from an arbitrary secret string via SHA-256."""
-    return hashlib.sha256(secret.encode("utf-8")).digest()
-
-
-def _derive_aes_key_bytes(secret: str) -> bytes:
-    """Derive a 32-byte AES-256 key via PBKDF2-SHA256 with a fixed domain salt.
-
-    Note: 100k iterations are intentional for key hardening. For high-throughput
-    paths, callers can cache the derived key bytes for the duration of a request.
-    """
-    salt = hashlib.sha256(b"aol-edu-aes-salt-v1" + secret.encode()).digest()
-    return hashlib.pbkdf2_hmac("sha256", secret.encode("utf-8"), salt, 100_000)
-
-
-async def _import_aes_key(key_bytes: bytes) -> object:
-    """Import raw bytes as a Web Crypto AES-GCM CryptoKey."""
-    key_buf = to_js(key_bytes, create_pyproxies=False)
-    algo    = to_js({"name": "AES-GCM"}, dict_converter=js.Object.fromEntries)
-    usages  = to_js(["encrypt", "decrypt"])
-    return await js.crypto.subtle.importKey("raw", key_buf, algo, False, usages)
-
-
-async def encrypt_aes(plaintext: str, secret: str) -> str:
-    """
-    AES-256-GCM encryption using js.crypto.subtle (Web Crypto API).
-    Returns "v1:" + base64(iv || ciphertext+tag).
-    Raises RuntimeError on encryption failure — no silent XOR fallback.
-    """
-    if not plaintext:
-        return ""
-    try:
-        key_bytes  = _derive_aes_key_bytes(secret)
-        crypto_key = await _import_aes_key(key_bytes)
-
-        # Generate random IV directly into a JS Uint8Array for clean interop
-        iv_array   = js.Uint8Array.new(12)
-        js.crypto.getRandomValues(iv_array)
-        iv         = bytes(iv_array) # Extract back to python bytes for storage
-
-        # Using dict_converter ensures Web Crypto does not see "undefined" for the algo name
-        algo       = to_js({"name": "AES-GCM", "iv": iv_array}, dict_converter=js.Object.fromEntries)
-        data       = to_js(plaintext.encode("utf-8"))
-        ct_buf     = await js.crypto.subtle.encrypt(algo, crypto_key, data)
-        ct         = bytes(js.Uint8Array.new(ct_buf))
-        return "v1:" + base64.b64encode(iv + ct).decode("ascii")
-    except Exception as exc:
-        capture_exception(exc, where="encrypt_aes")
-        raise RuntimeError(f"AES-256-GCM encryption failed: {exc}") from exc
-
-
-async def decrypt_aes(ciphertext: str, secret: str) -> str:
-    """
-    AES-256-GCM decryption. Handles both v1 (AES-GCM) and legacy (XOR) ciphertext.
-    """
-    if not ciphertext:
-        return ""
-    if not ciphertext.startswith("v1:"):
-        return _decrypt_xor(ciphertext, secret)
-    try:
-        raw        = base64.b64decode(ciphertext[3:])
-        iv, ct     = raw[:12], raw[12:]
-    except Exception as exc:
-        capture_exception(exc, where="decrypt_aes.decode")
-        return "[decryption error]"
-    try:
-        key_bytes  = _derive_aes_key_bytes(secret)
-        crypto_key = await _import_aes_key(key_bytes)
-        iv_array   = to_js(iv)
-        algo       = to_js({"name": "AES-GCM", "iv": iv_array}, dict_converter=js.Object.fromEntries)
-        data       = to_js(ct)
-        pt_buf     = await js.crypto.subtle.decrypt(algo, crypto_key, data)
-        return bytes(js.Uint8Array.new(pt_buf)).decode("utf-8")
-    except Exception as exc:
-        # Auth tag mismatch = tampered/corrupted ciphertext
-        capture_exception(exc, where="decrypt_aes.auth")
-        return "[decryption error]"
-
-
-def _encrypt_xor(plaintext: str, secret: str) -> str:
-    """Legacy XOR stream cipher — kept for backward compatibility only."""
-    if not plaintext:
-        return ""
-    key  = _derive_key(secret)
-    data = plaintext.encode("utf-8")
-    ks   = (key * (len(data) // len(key) + 1))[: len(data)]
-    return base64.b64encode(bytes(a ^ b for a, b in zip(data, ks))).decode("ascii")
-
-
-def _decrypt_xor(ciphertext: str, secret: str) -> str:
-    """Legacy XOR stream cipher decryption — kept for backward compatibility."""
-    if not ciphertext:
-        return ""
-    try:
-        key = _derive_key(secret)
-        raw = base64.b64decode(ciphertext)
-        ks  = (key * (len(raw) // len(key) + 1))[: len(raw)]
-        return bytes(a ^ b for a, b in zip(raw, ks)).decode("utf-8")
-    except Exception:
-        return "[decryption error]"
-
-
-# Synchronous shims — raise errors to force migration to async variants.
-def encrypt(plaintext: str, secret: str) -> str:
-    """Deprecated sync shim — raises to force migration to await encrypt_aes()."""
-    raise RuntimeError("encrypt() is deprecated — use await encrypt_aes() instead")
-
-
-def decrypt(ciphertext: str, secret: str) -> str:
-    """Deprecated sync shim — raises to force migration to await decrypt_aes()."""
-    raise RuntimeError("decrypt() is deprecated — use await decrypt_aes() instead")
-
-def blind_index(value: str, secret: str) -> str:
-    """
-    HMAC-SHA256 deterministic hash of value used as a blind index.
-
-    Allows finding a row by plaintext value without decrypting every row.
-    The value is lower-cased before hashing so lookups are case-insensitive.
-    """
-    return _hmac.new(
-        secret.encode("utf-8"), value.lower().encode("utf-8"), hashlib.sha256
-    ).hexdigest()
-
-
-# ---------------------------------------------------------------------------
-# Password hashing
-# ---------------------------------------------------------------------------
-
-# ⚠️  For production, derive the pepper from a secret stored via
-#     `wrangler secret put PEPPER` and pass it to _user_salt() at runtime.
-#     Rotating the pepper requires re-hashing all stored passwords.
-_PEPPER    = b"edu-platform-cf-pepper-2024"
-_PBKDF2_IT = 100_000
-
-
-def _user_salt(username: str) -> bytes:
-    """Per-user PBKDF2 salt = SHA-256(pepper || username)."""
-    return hashlib.sha256(_PEPPER + username.encode("utf-8")).digest()
-
-
-def hash_password(password: str, username: str) -> str:
-    """PBKDF2-SHA256 with per-user derived salt."""
-    dk = hashlib.pbkdf2_hmac(
-        "sha256", password.encode("utf-8"), _user_salt(username), _PBKDF2_IT
-    )
-    return base64.b64encode(dk).decode("ascii")
-
-
-def verify_password(password: str, stored: str, username: str) -> bool:
-    return hash_password(password, username) == stored
-
-
-# ---------------------------------------------------------------------------
-# Auth tokens (HMAC-SHA256 signed, stateless JWT-lite)
-# ---------------------------------------------------------------------------
-
-def create_token(uid: str, username: str, role: str, secret: str) -> str:
-    payload = base64.b64encode(
-        json.dumps({"id": uid, "username": username, "role": role}).encode()
-    ).decode("ascii")
-    sig = _hmac.new(
-        secret.encode("utf-8"), payload.encode("utf-8"), hashlib.sha256
-    ).hexdigest()
-    return f"{payload}.{sig}"
-
-
-def verify_token(raw: str, secret: str):
-    """Return decoded payload dict or None if invalid/missing."""
-    if not raw:
-        return None
-    try:
-        token = raw.removeprefix("Bearer ").strip()
-        dot   = token.rfind(".")
-        if dot == -1:
-            return None
-        p, sig = token[:dot], token[dot + 1:]
-        exp = _hmac.new(
-            secret.encode("utf-8"), p.encode("utf-8"), hashlib.sha256
-        ).hexdigest()
-        if not _hmac.compare_digest(sig, exp):
-            return None
-        padding = (4 - len(p) % 4) % 4
-        return json.loads(base64.b64decode(p + "=" * padding).decode("utf-8"))
-    except Exception:
-        return None
-
-
-# ---------------------------------------------------------------------------
-# Response helpers
-# ---------------------------------------------------------------------------
-
-_CORS = {
-    "Access-Control-Allow-Origin":  "*",
-    "Access-Control-Allow-Methods": "GET, POST, PUT, DELETE, OPTIONS",
-    "Access-Control-Allow-Headers": "Content-Type, Authorization",
-}
-
-
-def json_resp(data, status: int = 200):
-    return Response(
-        json.dumps(data),
-        status=status,
-        headers={"Content-Type": "application/json", **_CORS},
-    )
-
-
-def ok(data=None, msg: str = "OK"):
-    body = {"success": True, "message": msg}
-    if data is not None:
-        body["data"] = data
-    return json_resp(body, 200)
-
-
-def err(msg: str, status: int = 400):
-    return json_resp({"error": msg}, status)
-
-
-async def parse_json_object(req):
-    """Parse request JSON and ensure payload is an object/dict."""
-    try:
-        text = await req.text()
-        body = json.loads(text)
-    except Exception:
-        return None, err("Invalid JSON body")
-
-    if not isinstance(body, dict):
-        return None, err("JSON body must be an object", 400)
-
-    return body, None
-
-
-def _clean_path(value: str, default: str = "/admin") -> str:
-    """Normalize an env-provided path into a safe absolute URL path."""
-    raw = (value or "").strip()
-    if not raw:
-        return default
-    parsed = urlparse(raw)
-    path = (parsed.path or raw).strip()
-    if not path.startswith("/"):
-        path = "/" + path
-    path = re.sub(r"/+", "/", path)
-    if len(path) > 1 and path.endswith("/"):
-        path = path[:-1]
-    return path or default
-
-
-def _unauthorized_basic(realm: str = "Alpha One Labs Admin"):
-    return Response(
-        "Authentication required",
-        status=401,
-        headers={"WWW-Authenticate": f'Basic realm="{realm}"', **_CORS},
-    )
-
-
-def _is_basic_auth_valid(req, env) -> bool:
-    username = (getattr(env, "ADMIN_BASIC_USER", "") or "").strip()
-    password = (getattr(env, "ADMIN_BASIC_PASS", "") or "").strip()
-    if not username or not password:
-        return False
-
-    auth = req.headers.get("Authorization") or ""
-    if not auth.lower().startswith("basic "):
-        return False
-
-    try:
-        raw = auth.split(" ", 1)[1].strip()
-        decoded = base64.b64decode(raw).decode("utf-8")
-        user, pwd = decoded.split(":", 1)
-    except Exception:
-        return False
-
-    return _hmac.compare_digest(user, username) and _hmac.compare_digest(pwd, password)
-
-
-# ---------------------------------------------------------------------------
-# DDL - full schema (mirrors schema.sql)
-# ---------------------------------------------------------------------------
-
-_DDL = [
-    # Users - all PII encrypted; HMAC blind indexes for O(1) lookups
-    """CREATE TABLE IF NOT EXISTS users (
-        id            TEXT PRIMARY KEY,
-        username_hash TEXT NOT NULL UNIQUE,
-        email_hash    TEXT NOT NULL UNIQUE,
-        name          TEXT NOT NULL,
-        username      TEXT NOT NULL,
-        email         TEXT NOT NULL,
-        password_hash TEXT NOT NULL,
-        role          TEXT NOT NULL,
-        created_at    TEXT NOT NULL DEFAULT (datetime('now'))
-    )""",
-    # Activities
-    """CREATE TABLE IF NOT EXISTS activities (
-        id            TEXT PRIMARY KEY,
-        title         TEXT NOT NULL,
-        description   TEXT,
-        type          TEXT NOT NULL DEFAULT 'course',
-        format        TEXT NOT NULL DEFAULT 'self_paced',
-        schedule_type TEXT NOT NULL DEFAULT 'ongoing',
-        host_id       TEXT NOT NULL,
-        created_at    TEXT NOT NULL DEFAULT (datetime('now')),
-        FOREIGN KEY (host_id) REFERENCES users(id)
-    )""",
-    # Sessions
-    """CREATE TABLE IF NOT EXISTS sessions (
-        id          TEXT PRIMARY KEY,
-        activity_id TEXT NOT NULL,
-        title       TEXT,
-        description TEXT,
-        start_time  TEXT,
-        end_time    TEXT,
-        location    TEXT,
-        created_at  TEXT NOT NULL DEFAULT (datetime('now')),
-        FOREIGN KEY (activity_id) REFERENCES activities(id)
-    )""",
-    # Enrollments
-    """CREATE TABLE IF NOT EXISTS enrollments (
-        id          TEXT PRIMARY KEY,
-        activity_id TEXT NOT NULL,
-        user_id     TEXT NOT NULL,
-        role        TEXT NOT NULL DEFAULT 'participant',
-        status      TEXT NOT NULL DEFAULT 'active',
-        created_at  TEXT NOT NULL DEFAULT (datetime('now')),
-        UNIQUE (activity_id, user_id),
-        FOREIGN KEY (activity_id) REFERENCES activities(id),
-        FOREIGN KEY (user_id)     REFERENCES users(id)
-    )""",
-    # Session attendance
-    """CREATE TABLE IF NOT EXISTS session_attendance (
-        id         TEXT PRIMARY KEY,
-        session_id TEXT NOT NULL,
-        user_id    TEXT NOT NULL,
-        status     TEXT NOT NULL DEFAULT 'registered',
-        created_at TEXT NOT NULL DEFAULT (datetime('now')),
-        UNIQUE (session_id, user_id),
-        FOREIGN KEY (session_id) REFERENCES sessions(id),
-        FOREIGN KEY (user_id)    REFERENCES users(id)
-    )""",
-    # Tags
-    """CREATE TABLE IF NOT EXISTS tags (
-        id   TEXT PRIMARY KEY,
-        name TEXT UNIQUE NOT NULL
-    )""",
-    # Activity-tag junction
-    """CREATE TABLE IF NOT EXISTS activity_tags (
-        activity_id TEXT NOT NULL,
-        tag_id      TEXT NOT NULL,
-        PRIMARY KEY (activity_id, tag_id),
-        FOREIGN KEY (activity_id) REFERENCES activities(id),
-        FOREIGN KEY (tag_id)      REFERENCES tags(id)
-    )""",
-    # Indexes
-    "CREATE INDEX IF NOT EXISTS idx_activities_host      ON activities(host_id)",
-    "CREATE INDEX IF NOT EXISTS idx_enrollments_activity ON enrollments(activity_id)",
-    "CREATE INDEX IF NOT EXISTS idx_enrollments_user     ON enrollments(user_id)",
-    "CREATE INDEX IF NOT EXISTS idx_sessions_activity    ON sessions(activity_id)",
-    "CREATE INDEX IF NOT EXISTS idx_sa_session           ON session_attendance(session_id)",
-    "CREATE INDEX IF NOT EXISTS idx_sa_user              ON session_attendance(user_id)",
-    "CREATE INDEX IF NOT EXISTS idx_at_activity          ON activity_tags(activity_id)",
-]
-
-
-async def init_db(env):
-    for sql in _DDL:
-        await env.DB.prepare(sql).run()
-
-
-# ---------------------------------------------------------------------------
-# Sample-data seeding
-# ---------------------------------------------------------------------------
-
-async def seed_db(env, enc_key: str):
-    # ---- users ---------------------------------------------------------------
-    seed_users = [
-        ("alice",   "alice@example.com",   "password123", "host",   "Alice Chen"),
-        ("bob",     "bob@example.com",     "password123", "host",   "Bob Martinez"),
-        ("charlie", "charlie@example.com", "password123", "member", "Charlie Kim"),
-        ("diana",   "diana@example.com",   "password123", "member", "Diana Patel"),
-    ]
-    uid_map = {}
-    for uname, email, pw, role, display in seed_users:
-        uid = f"usr-{uname}"
-        uid_map[uname] = uid
-        try:
-            await env.DB.prepare(
-                "INSERT INTO users "
-                "(id,username_hash,email_hash,name,username,email,password_hash,role)"
-                " VALUES (?,?,?,?,?,?,?,?)"
-            ).bind(
-                uid,
-                blind_index(uname, enc_key),
-                blind_index(email, enc_key),
-                await encrypt_aes(display,  enc_key),
-                await encrypt_aes(uname,    enc_key),
-                await encrypt_aes(email,    enc_key),
-                hash_password(pw, uname),
-                await encrypt_aes(role,     enc_key),
-            ).run()
-        except Exception:
-            pass  # already seeded
-
-    aid = uid_map["alice"]
-    bid = uid_map["bob"]
-    cid = uid_map["charlie"]
-    did = uid_map["diana"]
-
-    # ---- tags ----------------------------------------------------------------
-    tag_rows = [
-        ("tag-python", "Python"),
-        ("tag-js",     "JavaScript"),
-        ("tag-data",   "Data Science"),
-        ("tag-ml",     "Machine Learning"),
-        ("tag-webdev", "Web Development"),
-        ("tag-db",     "Databases"),
-        ("tag-cloud",  "Cloud"),
-    ]
-    for tid, tname in tag_rows:
-        try:
-            await env.DB.prepare(
-                "INSERT INTO tags (id,name) VALUES (?,?)"
-            ).bind(tid, tname).run()
-        except Exception:
-            pass
-
-    # ---- activities ----------------------------------------------------------
-    act_rows = [
-        (
-            "act-py-begin", "Python for Beginners",
-            "Learn Python programming from scratch. Master variables, loops, "
-            "functions, and object-oriented design in this hands-on course.",
-            "course", "self_paced", "ongoing", aid,
-            ["tag-python"],
-        ),
-        (
-            "act-js-meetup", "JavaScript Developers Meetup",
-            "Monthly meetup for JavaScript enthusiasts. Share projects, "
-            "discuss new frameworks, and network with fellow devs.",
-            "meetup", "live", "recurring", bid,
-            ["tag-js", "tag-webdev"],
-        ),
-        (
-            "act-ds-workshop", "Data Science Workshop",
-            "Hands-on workshop covering data wrangling with pandas, "
-            "visualisation with matplotlib, and intro to machine learning.",
-            "workshop", "live", "multi_session", aid,
-            ["tag-data", "tag-python"],
-        ),
-        (
-            "act-ml-study", "Machine Learning Study Group",
-            "Collaborative study group working through ML concepts, "
-            "reading papers, and implementing algorithms together.",
-            "course", "hybrid", "recurring", bid,
-            ["tag-ml", "tag-python"],
-        ),
-        (
-            "act-webdev", "Web Dev Fundamentals",
-            "Build modern responsive websites with HTML5, CSS3, and JavaScript. "
-            "Covers Flexbox, Grid, fetch API, and accessible design.",
-            "course", "self_paced", "ongoing", aid,
-            ["tag-webdev", "tag-js"],
-        ),
-        (
-            "act-db-design", "Database Design & SQL",
-            "Design normalised relational schemas, write complex SQL queries, "
-            "use indexes for speed, and understand transactions.",
-            "workshop", "live", "one_time", bid,
-            ["tag-db"],
-        ),
-    ]
-    for act_id, title, desc, atype, fmt, sched, host_id, tags in act_rows:
-        try:
-            await env.DB.prepare(
-                "INSERT INTO activities "
-                "(id,title,description,type,format,schedule_type,host_id)"
-                " VALUES (?,?,?,?,?,?,?)"
-            ).bind(
-                act_id, title, await encrypt_aes(desc, enc_key),
-                atype, fmt, sched, host_id
-            ).run()
-        except Exception:
-            pass
-        for tag_id in tags:
-            try:
-                await env.DB.prepare(
-                    "INSERT OR IGNORE INTO activity_tags (activity_id,tag_id)"
-                    " VALUES (?,?)"
-                ).bind(act_id, tag_id).run()
-            except Exception:
-                pass
-
-    # ---- sessions for live/recurring activities ------------------------------
-    ses_rows = [
-        ("ses-js-1", "act-js-meetup",
-         "April Meetup", "Q1 retro and React 19 deep-dive",
-         "2024-04-15 18:00", "2024-04-15 21:00", "Tech Hub, 123 Main St, SF"),
-        ("ses-js-2", "act-js-meetup",
-         "May Meetup", "TypeScript 5.4 and what's new in Node 22",
-         "2024-05-20 18:00", "2024-05-20 21:00", "Tech Hub, 123 Main St, SF"),
-        ("ses-ds-1", "act-ds-workshop",
-         "Session 1 - Data Wrangling",
-         "Introduction to pandas DataFrames and data cleaning",
-         "2024-06-01 10:00", "2024-06-01 14:00", "Online via Zoom"),
-        ("ses-ds-2", "act-ds-workshop",
-         "Session 2 - Visualisation",
-         "matplotlib, seaborn, and plotly for data storytelling",
-         "2024-06-08 10:00", "2024-06-08 14:00", "Online via Zoom"),
-        ("ses-ds-3", "act-ds-workshop",
-         "Session 3 - Intro to ML",
-         "scikit-learn: regression, classification, evaluation",
-         "2024-06-15 10:00", "2024-06-15 14:00", "Online via Zoom"),
-    ]
-    for sid, act_id, title, desc, start, end, loc in ses_rows:
-        try:
-            await env.DB.prepare(
-                "INSERT INTO sessions "
-                "(id,activity_id,title,description,start_time,end_time,location)"
-                " VALUES (?,?,?,?,?,?,?)"
-            ).bind(
-                sid, act_id, title,
-                await encrypt_aes(desc, enc_key),
-                start, end,
-                await encrypt_aes(loc, enc_key),
-            ).run()
-        except Exception:
-            pass
-
-    # ---- enrollments ---------------------------------------------------------
-    enr_rows = [
-        ("enr-c-py",     "act-py-begin",    cid, "participant"),
-        ("enr-c-js",     "act-js-meetup",   cid, "participant"),
-        ("enr-c-ds",     "act-ds-workshop", cid, "participant"),
-        ("enr-d-py",     "act-py-begin",    did, "participant"),
-        ("enr-d-webdev", "act-webdev",      did, "participant"),
-        ("enr-b-py",     "act-py-begin",    bid, "instructor"),
-    ]
-    for eid, act_id, uid, role in enr_rows:
-        try:
-            await env.DB.prepare(
-                "INSERT OR IGNORE INTO enrollments (id,activity_id,user_id,role)"
-                " VALUES (?,?,?,?)"
-            ).bind(eid, act_id, uid, role).run()
-        except Exception:
-            pass
-
-
-# ---------------------------------------------------------------------------
-# API handlers
-# ---------------------------------------------------------------------------
-
-async def api_register(req, env):
-    body, bad_resp = await parse_json_object(req)
-    if bad_resp:
-        return bad_resp
-
-    username = (body.get("username") or "").strip()
-    email    = (body.get("email")    or "").strip()
-    password = (body.get("password") or "")
-    name     = (body.get("name")     or username).strip()
-
-    if not username or not email or not password:
-        return err("username, email, and password are required")
-    if len(password) < 8:
-        return err("Password must be at least 8 characters")
-
-    role = "member"
-
-    enc = env.ENCRYPTION_KEY
-    uid = new_id()
-    try:
-        await env.DB.prepare(
-            "INSERT INTO users "
-            "(id,username_hash,email_hash,name,username,email,password_hash,role)"
-            " VALUES (?,?,?,?,?,?,?,?)"
-        ).bind(
-            uid,
-            blind_index(username, enc),
-            blind_index(email,    enc),
-            await encrypt_aes(name,     enc),
-            await encrypt_aes(username, enc),
-            await encrypt_aes(email,    enc),
-            hash_password(password, username),
-            await encrypt_aes(role, enc),
-        ).run()
-    except Exception as e:
-        if "UNIQUE" in str(e):
-            return err("Username or email already registered", 409)
-        capture_exception(e, req, env, "api_register.insert_user")
-        return err("Registration failed — please try again", 500)
-
-    token = create_token(uid, username, role, env.JWT_SECRET)
-    return ok(
-        {"token": token,
-         "user": {"id": uid, "username": username, "name": name, "role": role}},
-        "Registration successful",
-    )
-
-
-async def api_login(req, env):
-    body, bad_resp = await parse_json_object(req)
-    if bad_resp:
-        return bad_resp
-
-    username = (body.get("username") or "").strip()
-    password = (body.get("password") or "")
-
-    if not username or not password:
-        return err("username and password are required")
-
-    enc    = env.ENCRYPTION_KEY
-    u_hash = blind_index(username, enc)
-    row    = await env.DB.prepare(
-        "SELECT id,password_hash,role,name,username FROM users WHERE username_hash=?"
-    ).bind(u_hash).first()
-
-    if not row:
-        return err("Invalid username or password", 401)
-    
-    password_hash = row.password_hash
-    user_id = row.id
-    role_enc = row.role
-    name_enc = row.name
-    username_enc = row.username
-    stored_username = await decrypt_aes(username_enc, enc)
-    if not stored_username or stored_username == "[decryption error]":
-        return err("Invalid username or password", 401)
-
-    if not verify_password(password, password_hash, stored_username):
-        return err("Invalid username or password", 401)
-
-    real_role = await decrypt_aes(role_enc, enc)
-    real_name = await decrypt_aes(name_enc, enc)
-    if not real_role or real_role == "[decryption error]":
-        return err("Account data corrupted — please contact support", 500)
-    token     = create_token(user_id, stored_username, real_role, env.JWT_SECRET)
-    return ok(
-        {"token": token,
-         "user": {"id": user_id, "username": stored_username,
-                  "name": real_name, "role": real_role}},
-        "Login successful",
-    )
-
-
-async def api_list_activities(req, env):
-    parsed = urlparse(req.url)
-    params = parse_qs(parsed.query)
-    atype  = (params.get("type")   or [None])[0]
-    fmt    = (params.get("format") or [None])[0]
-    search = (params.get("q")      or [None])[0]
-    tag    = (params.get("tag")    or [None])[0]
-    enc    = env.ENCRYPTION_KEY
-
-    base_q = (
-        "SELECT a.id,a.title,a.description,a.type,a.format,a.schedule_type,"
-        "a.created_at,u.name AS host_name_enc,"
-        "(SELECT COUNT(*) FROM enrollments WHERE activity_id=a.id AND status='active')"
-        " AS participant_count,"
-        "(SELECT COUNT(*) FROM sessions WHERE activity_id=a.id) AS session_count"
-        " FROM activities a JOIN users u ON a.host_id=u.id"
-    )
-
-    if tag:
-        tag_row = await env.DB.prepare(
-            "SELECT id FROM tags WHERE name=?"
-        ).bind(tag).first()
-        if not tag_row:
-            return json_resp({"activities": []})
-        res = await env.DB.prepare(
-            base_q
-            + " JOIN activity_tags at2 ON at2.activity_id=a.id"
-              " WHERE at2.tag_id=? ORDER BY a.created_at DESC"
-        ).bind(tag_row.id).all()
-    elif atype and fmt:
-        res = await env.DB.prepare(
-            base_q + " WHERE a.type=? AND a.format=? ORDER BY a.created_at DESC"
-        ).bind(atype, fmt).all()
-    elif atype:
-        res = await env.DB.prepare(
-            base_q + " WHERE a.type=? ORDER BY a.created_at DESC"
-        ).bind(atype).all()
-    elif fmt:
-        res = await env.DB.prepare(
-            base_q + " WHERE a.format=? ORDER BY a.created_at DESC"
-        ).bind(fmt).all()
-    else:
-        res = await env.DB.prepare(
-            base_q + " ORDER BY a.created_at DESC"
-        ).all()
-
-    activities = []
-    for row in res.results or []:
-        desc      = await decrypt_aes(row.description or "", enc)
-        host_name = await decrypt_aes(row.host_name_enc or "", enc)
-        if search and (
-            search.lower() not in row.title.lower()
-            and search.lower() not in desc.lower()
-        ):
-            continue
-
-        t_res = await env.DB.prepare(
-            "SELECT t.name FROM tags t"
-            " JOIN activity_tags at2 ON at2.tag_id=t.id"
-            " WHERE at2.activity_id=?"
-        ).bind(row.id).all()
-
-        activities.append({
-            "id":                row.id,
-            "title":             row.title,
-            "description":       desc,
-            "type":              row.type,
-            "format":            row.format,
-            "schedule_type":     row.schedule_type,
-            "host_name":         host_name,
-            "participant_count": row.participant_count,
-            "session_count":     row.session_count,
-            "tags":              [t.name for t in (t_res.results or [])],
-            "created_at":        row.created_at,
-        })
-
-    return json_resp({"activities": activities})
-
-
-async def api_create_activity(req, env):
-    user = verify_token(req.headers.get("Authorization"), env.JWT_SECRET)
-    if not user:
-        return err("Authentication required", 401)
-
-    body, bad_resp = await parse_json_object(req)
-    if bad_resp:
-        return bad_resp
-
-    title         = (body.get("title")         or "").strip()
-    description   = (body.get("description")   or "").strip()
-    atype         = (body.get("type")          or "course").strip()
-    fmt           = (body.get("format")        or "self_paced").strip()
-    schedule_type = (body.get("schedule_type") or "ongoing").strip()
-
-    if not title:
-        return err("title is required")
-    if atype not in ("course", "meetup", "workshop", "seminar", "other"):
-        atype = "course"
-    if fmt not in ("live", "self_paced", "hybrid"):
-        fmt = "self_paced"
-    if schedule_type not in ("one_time", "multi_session", "recurring", "ongoing"):
-        schedule_type = "ongoing"
-
-    enc    = env.ENCRYPTION_KEY
-    act_id = new_id()
-    try:
-        await env.DB.prepare(
-            "INSERT INTO activities "
-            "(id,title,description,type,format,schedule_type,host_id)"
-            " VALUES (?,?,?,?,?,?,?)"
-        ).bind(
-            act_id, title,
-            await encrypt_aes(description, enc) if description else "",
-            atype, fmt, schedule_type, user["id"]
-        ).run()
-    except Exception as e:
-        capture_exception(e, req, env, "api_create_activity.insert_activity")
-        return err("Failed to create activity — please try again", 500)
-
-    for tag_name in (body.get("tags") or []):
-        tag_name = tag_name.strip()
-        if not tag_name:
-            continue
-        t_row = await env.DB.prepare(
-            "SELECT id FROM tags WHERE name=?"
-        ).bind(tag_name).first()
-        if t_row:
-            tag_id = t_row.id
-        else:
-            tag_id = new_id()
-            try:
-                await env.DB.prepare(
-                    "INSERT INTO tags (id,name) VALUES (?,?)"
-                ).bind(tag_id, tag_name).run()
-            except Exception as e:
-                capture_exception(e, req, env, f"api_create_activity.insert_tag: tag_name={tag_name}, tag_id={tag_id}, act_id={act_id}")
-                continue
-        try:
-            await env.DB.prepare(
-                "INSERT OR IGNORE INTO activity_tags (activity_id,tag_id) VALUES (?,?)"
-            ).bind(act_id, tag_id).run()
-        except Exception as e:
-            capture_exception(e, req, env, f"api_create_activity.insert_activity_tags: tag_name={tag_name}, tag_id={tag_id}, act_id={act_id}")
-            pass
-
-    return ok({"id": act_id, "title": title}, "Activity created")
-
-
-async def api_get_activity(act_id: str, req, env):
-    user    = verify_token(req.headers.get("Authorization") or "", env.JWT_SECRET)
-    enc     = env.ENCRYPTION_KEY
-
-    act = await env.DB.prepare(
-        "SELECT a.*,u.name AS host_name_enc,u.id AS host_uid"
-        " FROM activities a JOIN users u ON a.host_id=u.id"
-        " WHERE a.id=?"
-    ).bind(act_id).first()
-    if not act:
-        return err("Activity not found", 404)
-
-    enrollment  = None
-    is_enrolled = False
-    if user:
-        enrollment  = await env.DB.prepare(
-            "SELECT id,role,status FROM enrollments"
-            " WHERE activity_id=? AND user_id=?"
-        ).bind(act_id, user["id"]).first()
-        is_enrolled = enrollment is not None
-
-    is_host = bool(user and act.host_uid == user["id"])
-
-    ses_res = await env.DB.prepare(
-        "SELECT id,title,description,start_time,end_time,location,created_at"
-        " FROM sessions WHERE activity_id=? ORDER BY start_time"
-    ).bind(act_id).all()
-
-    sessions = []
-    for s in ses_res.results or []:
-        sessions.append({
-            "id":          s.id,
-            "title":       s.title,
-            "description": await decrypt_aes(s.description or "", enc) if (is_enrolled or is_host) else None,
-            "start_time":  s.start_time,
-            "end_time":    s.end_time,
-            "location":    await decrypt_aes(s.location or "", enc) if (is_enrolled or is_host) else None,
-        })
-
-    t_res = await env.DB.prepare(
-        "SELECT t.name FROM tags t"
-        " JOIN activity_tags at2 ON at2.tag_id=t.id"
-        " WHERE at2.activity_id=?"
-    ).bind(act_id).all()
-
-    count_row = await env.DB.prepare(
-        "SELECT COUNT(*) AS cnt FROM enrollments WHERE activity_id=? AND status='active'"
-    ).bind(act_id).first()
-
-    return json_resp({
-        "activity": {
-            "id":                act.id,
-            "title":             act.title,
-            "description":       await decrypt_aes(act.description or "", enc),
-            "type":              act.type,
-            "format":            act.format,
-            "schedule_type":     act.schedule_type,
-            "host_name":         await decrypt_aes(act.host_name_enc or "", enc),
-            "participant_count": count_row.cnt if count_row else 0,
-            "tags":              [t.name for t in (t_res.results or [])],
-            "created_at":        act.created_at,
-        },
-        "sessions":    sessions,
-        "is_enrolled": is_enrolled,
-        "is_host":     is_host,
-        "enrollment":  {
-            "role":   enrollment.role,
-            "status": enrollment.status,
-        } if enrollment else None,
-    })
-
-
-async def api_join(req, env):
-    user = verify_token(req.headers.get("Authorization"), env.JWT_SECRET)
-    if not user:
-        return err("Authentication required", 401)
-
-    body, bad_resp = await parse_json_object(req)
-    if bad_resp:
-        return bad_resp
-
-    act_id = body.get("activity_id")
-    role   = (body.get("role") or "participant").strip()
-
-    if not act_id:
-        return err("activity_id is required")
-    if role not in ("participant", "instructor", "organizer"):
-        role = "participant"
-
-    act = await env.DB.prepare(
-        "SELECT id FROM activities WHERE id=?"
-    ).bind(act_id).first()
-    if not act:
-        return err("Activity not found", 404)
-
-    enr_id = new_id()
-    try:
-        await env.DB.prepare(
-            "INSERT OR IGNORE INTO enrollments (id,activity_id,user_id,role)"
-            " VALUES (?,?,?,?)"
-        ).bind(enr_id, act_id, user["id"], role).run()
-    except Exception as e:
-        capture_exception(e, req, env, "api_join.insert_enrollment")
-        return err("Failed to join activity — please try again", 500)
-
-    return ok(None, "Joined activity successfully")
-
-
-async def api_dashboard(req, env):
-    user = verify_token(req.headers.get("Authorization"), env.JWT_SECRET)
-    if not user:
-        return err("Authentication required", 401)
-
-    enc = env.ENCRYPTION_KEY
-
-    res = await env.DB.prepare(
-        "SELECT a.id,a.title,a.type,a.format,a.schedule_type,a.created_at,"
-        "(SELECT COUNT(*) FROM enrollments WHERE activity_id=a.id AND status='active')"
-        " AS participant_count,"
-        "(SELECT COUNT(*) FROM sessions WHERE activity_id=a.id) AS session_count"
-        " FROM activities a WHERE a.host_id=? ORDER BY a.created_at DESC"
-    ).bind(user["id"]).all()
-
-    hosted = []
-    for r in res.results or []:
-        t_res = await env.DB.prepare(
-            "SELECT t.name FROM tags t JOIN activity_tags at2 ON at2.tag_id=t.id"
-            " WHERE at2.activity_id=?"
-        ).bind(r.id).all()
-        hosted.append({
-            "id":                r.id,
-            "title":             r.title,
-            "type":              r.type,
-            "format":            r.format,
-            "schedule_type":     r.schedule_type,
-            "participant_count": r.participant_count,
-            "session_count":     r.session_count,
-            "tags":              [t.name for t in (t_res.results or [])],
-            "created_at":        r.created_at,
-        })
-
-    res2 = await env.DB.prepare(
-        "SELECT a.id,a.title,a.type,a.format,a.schedule_type,"
-        "e.role AS enr_role,e.status AS enr_status,e.created_at AS joined_at,"
-        "u.name AS host_name_enc"
-        " FROM enrollments e"
-        " JOIN activities a ON e.activity_id=a.id"
-        " JOIN users u ON a.host_id=u.id"
-        " WHERE e.user_id=? ORDER BY e.created_at DESC"
-    ).bind(user["id"]).all()
-
-    joined = []
-    for r in res2.results or []:
-        t_res = await env.DB.prepare(
-            "SELECT t.name FROM tags t JOIN activity_tags at2 ON at2.tag_id=t.id"
-            " WHERE at2.activity_id=?"
-        ).bind(r.id).all()
-        joined.append({
-            "id":            r.id,
-            "title":         r.title,
-            "type":          r.type,
-            "format":        r.format,
-            "schedule_type": r.schedule_type,
-            "enr_role":      r.enr_role,
-            "enr_status":    r.enr_status,
-            "host_name":     await decrypt_aes(r.host_name_enc or "", enc),
-            "tags":          [t.name for t in (t_res.results or [])],
-            "joined_at":     r.joined_at,
-        })
-
-    return json_resp({"user": user, "hosted_activities": hosted, "joined_activities": joined})
-
-
-async def api_create_session(req, env):
-    user = verify_token(req.headers.get("Authorization"), env.JWT_SECRET)
-    if not user:
-        return err("Authentication required", 401)
-
-    body, bad_resp = await parse_json_object(req)
-    if bad_resp:
-        return bad_resp
-
-    act_id      = body.get("activity_id")
-    title       = (body.get("title")       or "").strip()
-    description = (body.get("description") or "").strip()
-    start_time  = (body.get("start_time")  or "").strip()
-    end_time    = (body.get("end_time")    or "").strip()
-    location    = (body.get("location")    or "").strip()
-
-    if not act_id or not title:
-        return err("activity_id and title are required")
-
-    owned = await env.DB.prepare(
-        "SELECT id FROM activities WHERE id=? AND host_id=?"
-    ).bind(act_id, user["id"]).first()
-    if not owned:
-        return err("Activity not found or access denied", 404)
-
-    enc = env.ENCRYPTION_KEY
-    sid = new_id()
-    try:
-        await env.DB.prepare(
-            "INSERT INTO sessions "
-            "(id,activity_id,title,description,start_time,end_time,location)"
-            " VALUES (?,?,?,?,?,?,?)"
-        ).bind(
-            sid, act_id, title,
-            await encrypt_aes(description, enc) if description else "",
-            start_time, end_time,
-            await encrypt_aes(location, enc) if location else "",
-        ).run()
-    except Exception as e:
-        capture_exception(e, req, env, "api_create_session.insert_session")
-        return err("Failed to create session — please try again", 500)
-
-    return ok({"id": sid}, "Session created")
-
-
-async def api_list_tags(_req, env):
-    res  = await env.DB.prepare("SELECT id,name FROM tags ORDER BY name").all()
-    tags = [{"id": r.id, "name": r.name} for r in (res.results or [])]
-    return json_resp({"tags": tags})
-
-
-async def api_add_activity_tags(req, env):
-    user = verify_token(req.headers.get("Authorization"), env.JWT_SECRET)
-    if not user:
-        return err("Authentication required", 401)
-
-    body, bad_resp = await parse_json_object(req)
-    if bad_resp:
-        return bad_resp
-
-    act_id = body.get("activity_id")
-    tags   = body.get("tags") or []
-
-    if not act_id:
-        return err("activity_id is required")
-
-    owned = await env.DB.prepare(
-        "SELECT id FROM activities WHERE id=? AND host_id=?"
-    ).bind(act_id, user["id"]).first()
-    if not owned:
-        return err("Activity not found or access denied", 404)
-
-    for tag_name in tags:
-        tag_name = tag_name.strip()
-        if not tag_name:
-            continue
-        t_row = await env.DB.prepare(
-            "SELECT id FROM tags WHERE name=?"
-        ).bind(tag_name).first()
-        if t_row:
-            tag_id = t_row.id
-        else:
-            tag_id = new_id()
-            try:
-                await env.DB.prepare(
-                    "INSERT INTO tags (id,name) VALUES (?,?)"
-                ).bind(tag_id, tag_name).run()
-            except Exception as e:
-                capture_exception(e, req, env, f"api_add_activity_tags.insert_tag: tag_name={tag_name}, tag_id={tag_id}, act_id={act_id}")
-                continue
-        try:
-            await env.DB.prepare(
-                "INSERT OR IGNORE INTO activity_tags (activity_id,tag_id) VALUES (?,?)"
-            ).bind(act_id, tag_id).run()
-        except Exception as e:
-            capture_exception(e, req, env, f"api_add_activity_tags.insert_activity_tags: tag_name={tag_name}, tag_id={tag_id}, act_id={act_id}")
-            pass
-
-    return ok(None, "Tags updated")
-
-
-async def api_admin_table_counts(req, env):
-    if not _is_basic_auth_valid(req, env):
-        return _unauthorized_basic()
-
-    tables_res = await env.DB.prepare(
-        "SELECT name FROM sqlite_master WHERE type='table' AND name NOT LIKE 'sqlite_%' ORDER BY name"
-    ).all()
-
-    counts = []
-    for row in tables_res.results or []:
-        table_name = row.name
-        # Table names come from sqlite_master and are quoted to avoid SQL injection.
-        count_row = await env.DB.prepare(
-            f'SELECT COUNT(*) AS cnt FROM "{table_name.replace(chr(34), chr(34) + chr(34))}"'
-        ).first()
-        counts.append({"table": table_name, "count": count_row.cnt if count_row else 0})
-
-    return json_resp({"tables": counts})
-
-
-# ---------------------------------------------------------------------------
-# Static-asset serving  (Workers Sites / __STATIC_CONTENT KV)
-# ---------------------------------------------------------------------------
-
-_MIME = {
-    "html": "text/html; charset=utf-8",
-    "css":  "text/css; charset=utf-8",
-    "js":   "application/javascript; charset=utf-8",
-    "json": "application/json",
-    "png":  "image/png",
-    "jpg":  "image/jpeg",
-    "svg":  "image/svg+xml",
-    "ico":  "image/x-icon",
-}
-
-
-async def serve_static(path: str, env):
-    if path in ("/", ""):
-        key = "index.html"
-    else:
-        key = path.lstrip("/")
-        if "." not in key.split("/")[-1]:
-            key += ".html"
-
-    try:
-        content = await env.__STATIC_CONTENT.get(key, "text")
-    except Exception:
-        content = None
-
-    if content is None:
-        try:
-            content = await env.__STATIC_CONTENT.get("index.html", "text")
-        except Exception:
-            content = None
-
-    if content is None:
-        return Response(
-            "<h1>404 - Not Found</h1>",
-            status=404,
-            headers={"Content-Type": "text/html"},
-        )
-
-    ext  = key.rsplit(".", 1)[-1] if "." in key else "html"
-    mime = _MIME.get(ext, "text/plain")
-    return Response(content, headers={"Content-Type": mime, **_CORS})
-
+from api_activities import (
+    api_add_activity_tags,
+    api_create_activity,
+    api_create_session,
+    api_dashboard,
+    api_get_activity,
+    api_join,
+    api_list_activities,
+    api_list_tags,
+)
+from api_admin import api_admin_table_counts
+from api_auth import api_login, api_register
+from db_utils import init_db, seed_db
+from http_utils import (
+    CORS,
+    capture_exception,
+    clean_path,
+    err,
+    is_basic_auth_valid,
+    ok,
+    unauthorized_basic,
+)
+from static_utils import serve_static
 
-# ---------------------------------------------------------------------------
-# Main dispatcher
-# ---------------------------------------------------------------------------
 
 async def _dispatch(request, env):
-    path   = urlparse(request.url).path
+    path = urlparse(request.url).path
     method = request.method.upper()
-    admin_path = _clean_path(getattr(env, "ADMIN_URL", ""))
+    admin_path = clean_path(getattr(env, "ADMIN_URL", ""))
 
     if method == "OPTIONS":
-        return Response("", status=204, headers=_CORS)
+        return Response("", status=204, headers=CORS)
 
     if path == admin_path and method == "GET":
-        if not _is_basic_auth_valid(request, env):
-            return _unauthorized_basic()
+        if not is_basic_auth_valid(request, env):
+            return unauthorized_basic()
         return await serve_static("/admin.html", env)
 
     if path.startswith("/api/"):
@@ -1249,7 +52,7 @@ async def _dispatch(request, env):
                 return ok(None, "Database initialised")
             except Exception as e:
                 capture_exception(e, request, env, "api_init")
-                return err("Database init failed — check D1 binding", 500)
+                return err("Database init failed - check D1 binding", 500)
 
         if path == "/api/seed" and method == "POST":
             try:
@@ -1258,7 +61,7 @@ async def _dispatch(request, env):
                 return ok(None, "Sample data seeded")
             except Exception as e:
                 capture_exception(e, request, env, "api_seed")
-                return err("Seed failed — check D1 binding and schema", 500)
+                return err("Seed failed - check D1 binding and schema", 500)
 
         if path == "/api/register" and method == "POST":
             return await api_register(request, env)
@@ -1272,9 +75,9 @@ async def _dispatch(request, env):
         if path == "/api/activities" and method == "POST":
             return await api_create_activity(request, env)
 
-        m = re.fullmatch(r"/api/activities/([A-Za-z0-9_-]+)", path)
-        if m and method == "GET":
-            return await api_get_activity(m.group(1), request, env)
+        match = re.fullmatch(r"/api/activities/([A-Za-z0-9_-]+)", path)
+        if match and method == "GET":
+            return await api_get_activity(match.group(1), request, env)
 
         if path == "/api/join" and method == "POST":
             return await api_join(request, env)
@@ -1304,4 +107,4 @@ async def on_fetch(request, env):
         return await _dispatch(request, env)
     except Exception as e:
         capture_exception(e, request, env, "on_fetch_unhandled")
-        return err("Internal server error", 500)
\ No newline at end of file
+        return err("Internal server error", 500)

From 80a303309c150056d0e46ab02f6ba6c31684871b Mon Sep 17 00:00:00 2001
From: shreycodes <shreymojidra06@gmail.com>
Date: Sun, 12 Apr 2026 19:44:05 +0530
Subject: [PATCH 11/11] Resolving Conversation

---
 src/api_auth.py       | 2 ++
 src/security_utils.py | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/src/api_auth.py b/src/api_auth.py
index f3e924e..022c906 100644
--- a/src/api_auth.py
+++ b/src/api_auth.py
@@ -90,6 +90,8 @@ async def api_login(req, env):
     real_name = await decrypt_aes(row.name, enc)
     if not real_role or real_role == "[decryption error]":
         return err("Account data corrupted - please contact support", 500)
+    if not real_name or real_name == "[decryption error]":
+        return err("Account data corrupted - please contact support", 500)
 
     token = create_token(row.id, stored_username, real_role, env.JWT_SECRET)
     return ok(
diff --git a/src/security_utils.py b/src/security_utils.py
index 02c96e7..0ba3282 100644
--- a/src/security_utils.py
+++ b/src/security_utils.py
@@ -124,7 +124,7 @@ def hash_password(password: str, username: str) -> str:
 
 
 def verify_password(password: str, stored: str, username: str) -> bool:
-    return hash_password(password, username) == stored
+    return _hmac.compare_digest(hash_password(password, username), stored)
 
 
 def create_token(uid: str, username: str, role: str, secret: str) -> str: