@weibaohui/dsh-git-server 0.1.0

package/server/dist/markup.js

@@ -0,0 +1,317 @@
+// Markup pipeline mirroring gogs internal/markup: markdown render → post
+// process (mentions, #123, sha links, relative URLs) → HTML sanitize
+// (bluemonday UGC-style whitelist).
+import { Marked } from 'marked';
+import { conf } from './conf.js';
+// 原 gotemplate/funcs.js 的 shortSHA1（3 行，内联以解除对模板 funcs 的依赖）
+function shortSHA1(sha) {
+    return String(sha).length > 10 ? String(sha).slice(0, 10) : String(sha);
+}
+const marked = new Marked({ gfm: true, breaks: false });
+export function isMarkdownFile(name) {
+    const lower = String(name).toLowerCase();
+    return conf.markdownFileExtensions.some((ext) => lower.endsWith(ext.toLowerCase()));
+}
+export function isReadmeFile(name) {
+    return String(name).toLowerCase().startsWith('readme');
+}
+export function isIPythonNotebook(name) {
+    return String(name).toLowerCase().endsWith('.ipynb');
+}
+function cutoutVerbosePrefix(urlPrefix) {
+    // gogs cutoutVerbosePrefix: keep 3+subpathDepth leading slashes worth of path
+    const count = 3 + conf.subpathDepth;
+    const parts = urlPrefix.split('/');
+    if (parts.length > count) {
+        return parts.slice(0, count).join('/');
+    }
+    return urlPrefix;
+}
+export function renderIssueIndexPattern(text, urlPrefix, metas) {
+    if (!metas || !metas['repoLink'])
+        return text;
+    const prefix = cutoutVerbosePrefix(urlPrefix);
+    if (metas['style'] === 'alphanumeric') {
+        return text.replace(/(\s|^|\W)([A-Z]{1,10}-\d+)/g, (m, pre, ref) => {
+            if (metas['format']) {
+                return `${pre}<a href="${metas['format'].replace('{user}', metas['user'] ?? '').replace('{repo}', metas['repo'] ?? '').replace('{index}', ref)}">${ref}</a>`;
+            }
+            return `${pre}<a href="${prefix}/issues/${ref}">${ref}</a>`;
+        });
+    }
+    return text.replace(/(\s|^|\W)#(\d+)\b/g, (m, pre, num) => {
+        if (metas['format']) {
+            return `${pre}<a href="${metas['format'].replace('{user}', metas['user'] ?? '').replace('{repo}', metas['repo'] ?? '').replace('{index}', num)}">#${num}</a>`;
+        }
+        return `${pre}<a href="${prefix}/issues/${num}">#${num}</a>`;
+    });
+}
+function renderSpecialLink(text, urlPrefix, metas) {
+    let out = text;
+    // @mention (only when viewing a repo context or site-wide: gogs uses subpath links)
+    out = out.replace(/(\s|^|\W)@([0-9a-zA-Z-_.]+)/g, (m, pre, user) => {
+        return `${pre}<a href="${conf.subpath}/${user}">@${user}</a>`;
+    });
+    out = renderIssueIndexPattern(out, urlPrefix, metas);
+    // cross-repo refs owner/repo#123
+    out = out.replace(/(\s|^|\W)([0-9a-zA-Z-_.]+)/, (m) => m); // keep (no-op, cross handled by issue pattern with full links)
+    // sha1 refs
+    if (metas && metas['repoLink']) {
+        out = out.replace(/\b[0-9a-f]{7,40}\b/g, (sha) => {
+            if (/^\d+$/.test(sha))
+                return sha;
+            return `<a href="${metas['repoLink']}/commit/${sha}"><code>${shortSHA1(sha)}</code></a>`;
+        });
+    }
+    return out;
+}
+const isAbsoluteURL = (u) => /^[a-zA-Z][a-zA-Z0-9+.-]*:\/\//.test(u) || u.startsWith('mailto:') || u.startsWith('#') || u.startsWith('data:');
+/** Post-process: relative link completion + special links in text nodes only. */
+export function postProcessHTML(html, urlPrefix, metas) {
+    urlPrefix = urlPrefix.replaceAll(' ', '%20').replace(/\/+$/, '');
+    const prefix = cutoutVerbosePrefix(urlPrefix);
+    const toks = [];
+    let i = 0;
+    while (i < html.length) {
+        const lt = html.indexOf('<', i);
+        if (lt < 0) {
+            toks.push({ kind: 'text', value: html.slice(i) });
+            break;
+        }
+        if (lt > i)
+            toks.push({ kind: 'text', value: html.slice(i, lt) });
+        // tag ends at next '>' respecting quoted attrs
+        let j = lt + 1;
+        let inQuote = null;
+        while (j < html.length) {
+            const ch = html[j];
+            if (inQuote) {
+                if (ch === inQuote)
+                    inQuote = null;
+            }
+            else if (ch === '"' || ch === "'") {
+                inQuote = ch;
+            }
+            else if (ch === '>')
+                break;
+            j++;
+        }
+        toks.push({ kind: 'tag', value: html.slice(lt, j + 1) });
+        i = j + 1;
+    }
+    let skipDepth = 0; // inside a/code/pre
+    const out = [];
+    const stack = [];
+    for (const tok of toks) {
+        if (tok.kind === 'tag') {
+            const m = /^<\s*(\/?)\s*([a-zA-Z0-9]+)/.exec(tok.value);
+            if (m) {
+                const closing = m[1] === '/';
+                const tag = m[2].toLowerCase();
+                if (!closing) {
+                    if (tag === 'a' || tag === 'code' || tag === 'pre')
+                        skipDepth++;
+                    // complete relative href/src; image src via /raw/
+                    if (tag === 'img') {
+                        tok.value = tok.value.replace(/src="([^"]*)"/g, (mm, src) => {
+                            if (isAbsoluteURL(src))
+                                return mm;
+                            const fixed = urlPrefix.replace('/src/', '/raw/') + '/' + src.replaceAll(' ', '%20');
+                            return `src="${fixed}"`;
+                        });
+                    }
+                    else if (tag === 'a') {
+                        tok.value = tok.value.replace(/href="([^"]*)"/g, (mm, href) => {
+                            if (isAbsoluteURL(href))
+                                return mm;
+                            return `href="${prefix}/${href}"`;
+                        });
+                    }
+                }
+                else {
+                    if (tag === 'a' || tag === 'code' || tag === 'pre')
+                        skipDepth = Math.max(0, skipDepth - 1);
+                }
+            }
+            out.push(tok.value);
+        }
+        else {
+            if (skipDepth > 0) {
+                out.push(tok.value);
+            }
+            else {
+                out.push(renderSpecialLink(tok.value, urlPrefix, metas));
+            }
+        }
+    }
+    return out.join('');
+}
+// ---------------------------------------------------------------- sanitizer
+const VOID_TAGS = new Set(['br', 'hr', 'img', 'input', 'col']);
+const ALLOWED_TAGS = new Set([
+    'a', 'abbr', 'acronym', 'b', 'blockquote', 'br', 'code', 'caption', 'col', 'colgroup',
+    'dd', 'del', 'details', 'dl', 'dt', 'em', 'h1', 'h2', 'h3', 'h4', 'h5', 'h6', 'hr',
+    'i', 'img', 'ins', 'kbd', 'li', 'mark', 'ol', 'p', 'pre', 'q', 's', 'samp', 'small',
+    'span', 'strike', 'strong', 'sub', 'summary', 'sup', 'table', 'tbody', 'td', 'tfoot',
+    'th', 'thead', 'tr', 'u', 'ul', 'var', 'figure', 'figcaption', 'input',
+]);
+const GLOBAL_ATTRS = new Set(['title']);
+const TAG_ATTRS = {
+    a: new Set(['href', 'rel']),
+    img: new Set(['src', 'alt', 'width', 'height']),
+    th: new Set(['align', 'colspan', 'rowspan']),
+    td: new Set(['align', 'colspan', 'rowspan']),
+    col: new Set(['align', 'span']),
+    input: new Set(['type', 'checked', 'disabled']),
+    code: new Set(['class']),
+    span: new Set(['class']),
+    details: new Set(['open']),
+    ol: new Set(['start']),
+};
+function escapeHTMLAttr(s) {
+    return s.replaceAll('&', '&amp;').replaceAll('<', '&lt;').replaceAll('>', '&gt;').replaceAll('"', '&#34;').replaceAll("'", '&#39;');
+}
+function sanitizeText(s) {
+    return s.replaceAll('<', '&lt;').replaceAll('>', '&gt;');
+}
+function allowedDataImage(src) {
+    const m = /^data:image\/(png|jpeg|gif|webp|x-icon);/i.exec(src);
+    return !!m;
+}
+/** bluemonday UGCPolicy-equivalent whitelist sanitizer. */
+export function sanitizeHTML(html) {
+    // remove script/style blocks entirely (tags + content), like bluemonday
+    html = html.replace(/<script[\s\S]*?<\/script>/gi, '').replace(/<style[\s\S]*?<\/style>/gi, '');
+    let out = '';
+    let i = 0;
+    const stack = [];
+    while (i < html.length) {
+        const lt = html.indexOf('<', i);
+        if (lt < 0) {
+            out += sanitizeText(html.slice(i));
+            break;
+        }
+        out += sanitizeText(html.slice(i, lt));
+        let j = lt + 1;
+        let inQuote = null;
+        while (j < html.length) {
+            const ch = html[j];
+            if (inQuote) {
+                if (ch === inQuote)
+                    inQuote = null;
+            }
+            else if (ch === '"' || ch === "'") {
+                inQuote = ch;
+            }
+            else if (ch === '>')
+                break;
+            j++;
+        }
+        if (j >= html.length) {
+            // unterminated tag: escape rest
+            out += sanitizeText(html.slice(lt));
+            break;
+        }
+        const rawTag = html.slice(lt, j + 1);
+        out += sanitizeTag(rawTag, stack);
+        i = j + 1;
+    }
+    return out;
+    function sanitizeTag(tag, st) {
+        const m = /^<\s*(\/?)\s*([a-zA-Z0-9]+)([\s\S]*?)(\/?)\s*>$/.exec(tag);
+        if (!m)
+            return '';
+        const closing = m[1] === '/';
+        const name = m[2].toLowerCase();
+        if (!ALLOWED_TAGS.has(name))
+            return '';
+        if (closing) {
+            const idx = st.lastIndexOf(name);
+            if (idx >= 0) {
+                // close intermediate unclosed tags for well-formedness
+                let closed = '';
+                for (let k = st.length - 1; k >= idx; k--) {
+                    if (!VOID_TAGS.has(st[k]))
+                        closed += `</${st[k]}>`;
+                }
+                st.splice(idx);
+                return closed;
+            }
+            return '';
+        }
+        // attributes
+        const attrStr = m[3];
+        const allowedAttrs = new Set([...GLOBAL_ATTRS, ...(TAG_ATTRS[name] ?? [])]);
+        const attrRe = /([a-zA-Z-]+)\s*=\s*"([^"]*)"|([a-zA-Z-]+)\s*=\s*'([^']*)'|([a-zA-Z-]+)/g;
+        let am;
+        let attrs = '';
+        while ((am = attrRe.exec(attrStr))) {
+            const aname = (am[1] ?? am[3] ?? am[5] ?? '').toLowerCase();
+            const avalue = am[2] ?? am[4] ?? '';
+            if (!allowedAttrs.has(aname))
+                continue;
+            if (aname === 'href' || aname === 'src') {
+                const url = avalue.trim();
+                if (aname === 'src' && url.startsWith('data:')) {
+                    if (!allowedDataImage(url))
+                        continue;
+                }
+                else {
+                    const scheme = /^([a-zA-Z][a-zA-Z0-9+.-]*):/.exec(url);
+                    const allowedSchemes = new Set(['http', 'https', 'mailto', 'ftp', ...conf.customURLSchemes]);
+                    if (scheme && !allowedSchemes.has(scheme[1].toLowerCase()))
+                        continue;
+                    if (!scheme && url.startsWith('//'))
+                        continue;
+                    if (url.toLowerCase().startsWith('javascript:'))
+                        continue;
+                }
+                attrs += ` ${aname}="${escapeHTMLAttr(avalue)}"`;
+            }
+            else if (aname === 'class') {
+                if (!/^language-[a-zA-Z0-9]+$/.test(avalue) && name === 'code')
+                    continue;
+                if (name === 'span' && !/^(language-[a-zA-Z0-9]+|math|mermaid)$/.test(avalue))
+                    continue;
+                attrs += ` class="${escapeHTMLAttr(avalue)}"`;
+            }
+            else if (aname === 'rel') {
+                continue; // rewritten below
+            }
+            else if (name === 'input') {
+                if (aname === 'type' && avalue !== 'checkbox')
+                    continue;
+                attrs += ` ${aname}="${escapeHTMLAttr(avalue)}"`;
+            }
+            else if (aname === 'checked' || aname === 'disabled' || aname === 'open') {
+                attrs += ` ${aname}`;
+            }
+            else {
+                attrs += ` ${aname}="${escapeHTMLAttr(avalue)}"`;
+            }
+        }
+        if (name === 'a')
+            attrs += ' rel="nofollow"';
+        if (VOID_TAGS.has(name)) {
+            return `<${name}${attrs}${name === 'input' ? (attrs.includes('checked') ? ' checked' : '') : ''} />`.replace(/ \/>$/, ' />');
+        }
+        st.push(name);
+        return `<${name}${attrs}>`;
+    }
+}
+// ---------------------------------------------------------------- entry points
+export function rawMarkdown(input, urlPrefix, metas) {
+    const html = marked.parse(input, { async: false });
+    return postProcessHTML(html, urlPrefix, metas);
+}
+export function markdown(input, urlPrefix, metas) {
+    const rendered = rawMarkdown(input, urlPrefix, metas);
+    return sanitizeHTML(rendered);
+}
+export function sanitizeBytes(input) {
+    return sanitizeHTML(input);
+}
+export function htmlEscape(s) {
+    return s.replaceAll('&', '&amp;').replaceAll("'", '&#39;').replaceAll('<', '&lt;').replaceAll('>', '&gt;').replaceAll('"', '&#34;');
+}
+//# sourceMappingURL=markup.js.map

package/server/dist/metrics.js

@@ -0,0 +1,18 @@
+// Prometheus metrics endpoint (/-/metrics), text format.
+import * as db from './db/db.js';
+import { conf } from './conf.js';
+export function renderMetrics() {
+    const g = (name, help, value) => `# HELP ${name} ${help}\n# TYPE ${name} gauge\n${name} ${value}\n`;
+    let out = '';
+    out += g('gogs_user_total', 'Number of users', db.db().prepare('SELECT COUNT(*) c FROM user WHERE type = 0').get().c);
+    out += g('gogs_org_total', 'Number of organizations', db.db().prepare('SELECT COUNT(*) c FROM user WHERE type = 1').get().c);
+    out += g('gogs_repo_total', 'Number of repositories', db.db().prepare('SELECT COUNT(*) c FROM repository').get().c);
+    out += g('gogs_issue_total', 'Number of issues', db.db().prepare('SELECT COUNT(*) c FROM issue').get().c);
+    out += g('gogs_comment_total', 'Number of comments', db.db().prepare('SELECT COUNT(*) c FROM comment').get().c);
+    out += g('gogs_action_total', 'Number of actions', db.db().prepare('SELECT COUNT(*) c FROM action').get().c);
+    out += g('gogs_webhook_total', 'Number of webhooks', db.db().prepare('SELECT COUNT(*) c FROM webhook').get().c);
+    out += g('gogs_process_uptime_seconds', 'Process uptime', Math.floor(process.uptime()));
+    out += `# HELP gogs_info Application info\n# TYPE gogs_info gauge\ngogs_info{version="${conf.version}",goversion="node-${process.version}"} 1\n`;
+    return out;
+}
+//# sourceMappingURL=metrics.js.map

package/server/dist/mirror.js

@@ -0,0 +1,203 @@
+// Mirror synchronization: periodic loop + on-demand sync, mirroring gogs
+// internal/database/mirror.go (git remote update + ref-change actions).
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import { conf } from './conf.js';
+import * as db from './db/db.js';
+import * as git from './gitx/git.js';
+/** Address stored in the bare repo config remote "origin" (credentials stripped for display). */
+export function mirrorAddress(repoDir) {
+    try {
+        const cfg = fs.readFileSync(path.join(repoDir, 'config'), 'utf8');
+        const m = /remote "origin"[\s\S]*?url = (.+)/.exec(cfg);
+        if (m) {
+            // strip credentials for display
+            return m[1].replace(/^(https?:\/\/)([^@/]+)@/, '$1');
+        }
+    }
+    catch {
+        // ignore
+    }
+    return '';
+}
+function intervalSeconds(repoID) {
+    const row = db.db().prepare('SELECT interval FROM mirror WHERE repo_id = ?').get(repoID);
+    const hours = row?.interval > 0 ? row.interval : conf.defaultMirrorInterval;
+    return hours * 3600;
+}
+/** Parse `git remote update` stderr into ref changes like gogs parseRemoteUpdateOutput.
+ * Real output (space-aligned, no tabs):
+ *   ` * [new branch]      master     -> main`          (new)
+ *   ` - [deleted]         (none)     -> origin/x`      (delete)
+ *   `   cf1685c..4386276  main       -> main`          (update)
+ * For --mirror remotes the ref names stay fully qualified. */
+export function parseRemoteUpdateOutput(output) {
+    const refs = [];
+    const EMPTY = '0000000000000000000000000000000000000000';
+    for (const line of output.split('\n')) {
+        let m = /^ \* \[[^\]]+\]\s+(\S+)\s+->\s+(\S+)$/.exec(line);
+        if (m) {
+            const ref = m[2].startsWith('refs/') ? m[2] : 'refs/heads/' + m[2];
+            refs.push({ oldSha: EMPTY, newSha: '', ref });
+            continue;
+        }
+        m = /^ - \[[^\]]+\]\s+\S+\s+->\s+(\S+)$/.exec(line);
+        if (m) {
+            const ref = m[1].startsWith('refs/') ? m[1] : 'refs/heads/' + m[1];
+            refs.push({ oldSha: '', newSha: EMPTY, ref });
+            continue;
+        }
+        m = /^   ([0-9a-f]+)\.\.([0-9a-f]+)\s+(\S+)\s+->\s+(\S+)\s*$/.exec(line);
+        if (m) {
+            const ref = m[4].startsWith('refs/') ? m[4] : 'refs/heads/' + m[4];
+            refs.push({ oldSha: m[1], newSha: m[2], ref });
+            continue;
+        }
+    }
+    return refs;
+}
+async function fillNewSha(repoDir, change) {
+    if (change.newSha === '') {
+        const out = await git.gitOK(repoDir, 'rev-parse', '--verify', '--quiet', '--end-of-options', change.ref);
+        change.newSha = out?.toString().trim() ?? '';
+    }
+    if (change.oldSha === '') {
+        change.oldSha = '0000000000000000000000000000000000000000';
+    }
+}
+/** Sync one mirror repo now; fires mirror-sync actions and webhooks. */
+export async function syncMirror(repoID, doerID) {
+    const mirror = db.db().prepare('SELECT * FROM mirror WHERE repo_id = ?').get(repoID);
+    const repo = db.getRepoByID(repoID);
+    if (!mirror || !repo)
+        return;
+    const repoDir = repo.RepoPath();
+    const remoteArgs = ['remote', 'update'];
+    if (mirror.enable_prune)
+        remoteArgs.push('--prune');
+    const r = await git.runGit(repoDir, remoteArgs, conf.gitTimeoutMirror * 1000);
+    const refs = parseRemoteUpdateOutput(r.stderr);
+    const doer = db.getUserByID(doerID) ?? db.getUserByID(repo.owner_id);
+    if (!doer)
+        return;
+    const { ActionType } = await import('./db/actions.js');
+    for (const change of refs) {
+        await fillNewSha(repoDir, change);
+        const branch = change.ref.replace('refs/heads/', '');
+        const isTag = change.ref.startsWith('refs/tags/');
+        const newEmpty = change.newSha === '0000000000000000000000000000000000000000' || change.newSha === '';
+        const oldEmpty = change.oldSha === '0000000000000000000000000000000000000000' || change.oldSha === '';
+        try {
+            if (isTag) {
+                if (newEmpty) {
+                    await fire(doer, repo, ActionType.DELETE_TAG, '', JSON.stringify(branch));
+                }
+                else if (oldEmpty) {
+                    await fire(doer, repo, ActionType.PUSH_TAG, branch, '');
+                }
+                continue;
+            }
+            if (newEmpty) {
+                await fire(doer, repo, ActionType.MIRROR_SYNC_DELETE, branch, '');
+            }
+            else {
+                let commits = [];
+                if (oldEmpty) {
+                    const head = await git.catFileCommit(repoDir, change.newSha);
+                    const ancestors = await git.gitOK(repoDir, 'log', '--max-count=9', '--pretty=format:%H', '--end-of-options', change.newSha, '--');
+                    const shas = ancestors?.toString().trim().split('\n').filter(Boolean) ?? [];
+                    commits = [head, ...await Promise.all(shas.map((s) => git.catFileCommit(repoDir, s).catch(() => null)))];
+                    commits = commits.filter(Boolean);
+                    await fire(doer, repo, ActionType.MIRROR_SYNC_CREATE, branch, JSON.stringify({ Sha1: head?.id, Name: branch }));
+                }
+                else {
+                    commits = await git.commitsAfter(repoDir, change.oldSha, change.newSha);
+                }
+                await fire(doer, repo, ActionType.MIRROR_SYNC_PUSH, branch, JSON.stringify({
+                    TotalCommits: commits.length,
+                    Len: commits.length,
+                    Commits: commits.map((c) => ({ Sha1: c.id, Message: c.message, AuthorEmail: c.author.email })),
+                    Compares: commits.length > 0 ? [{ numCommits: commits.length }] : [],
+                }));
+            }
+        }
+        catch (e) {
+            console.error('[mirror] action error:', e);
+        }
+    }
+    await git.updateServerInfo(repoDir);
+    const { size } = await git.countObjects(repoDir);
+    db.updateRepoColumns(repoID, { size });
+    // also sync the wiki mirror when present
+    const wikiDir = repo.WikiPath();
+    if (fs.existsSync(wikiDir)) {
+        const wikiArgs = ['remote', 'update'];
+        if (mirror.enable_prune)
+            wikiArgs.push('--prune');
+        await git.gitOK(wikiDir, ...wikiArgs);
+    }
+    const now = Math.floor(Date.now() / 1000);
+    db.db()
+        .prepare('UPDATE mirror SET updated_unix = ?, next_update_unix = ? WHERE repo_id = ?')
+        .run(now, now + intervalSeconds(repoID), repoID);
+}
+async function fire(doer, repo, opType, refName, content) {
+    db.db()
+        .prepare(`INSERT INTO action (user_id, op_type, act_user_id, act_user_name, repo_id, repo_user_name, repo_name, ref_name, is_private, content, created_unix)
+              VALUES (?,?,?,?,?,?,?,?,?,?,?)`)
+        .run(repo.owner_id, opType, doer.id, doer.name, repo.id, repo.OwnerName(), repo.name, refName, repo.is_private ?? 0, content, Math.floor(Date.now() / 1000));
+    // mirror push actions carry a webhook payload like commitRepo
+    const actionsMod = await import('./db/actions.js');
+    if (opType === 20 && content.includes('Commits')) {
+        try {
+            const parsed = JSON.parse(content);
+            await actionsMod.mirrorSyncPushAction(doer, repo, 'refs/heads/' + refName, parsed);
+            return;
+        }
+        catch {
+            // fall through to generic create/delete events below
+        }
+    }
+    if (opType === 9)
+        await actionsMod.pushTagAction(doer, repo, refName);
+    else if (opType === 21)
+        await actionsMod.createBranchAction(doer, repo, refName);
+    else if (opType === 18 || opType === 22)
+        await actionsMod.deleteBranchAction(doer, repo, refName);
+}
+let loopStarted = false;
+/** Periodic mirror update loop (gogs InitSyncMirrors + cron.UPDATE_MIRRORS). */
+export function startMirrorLoop() {
+    if (loopStarted)
+        return;
+    loopStarted = true;
+    const tick = async () => {
+        try {
+            const due = db
+                .db()
+                .prepare('SELECT repo_id FROM mirror WHERE next_update_unix <= ?')
+                .all(Math.floor(Date.now() / 1000));
+            for (const row of due) {
+                const repo = db.getRepoByID(row.repo_id);
+                if (!repo)
+                    continue;
+                console.log('[mirror] syncing', repo.FullName());
+                try {
+                    await syncMirror(row.repo_id, repo.owner_id);
+                }
+                catch (e) {
+                    console.error(`[mirror] sync failed for ${repo.FullName()}: ${e?.message ?? e}`);
+                    // push next attempt back
+                    const now = Math.floor(Date.now() / 1000);
+                    db.db().prepare('UPDATE mirror SET updated_unix = ?, next_update_unix = ? WHERE repo_id = ?').run(now, now + intervalSeconds(row.repo_id), row.repo_id);
+                }
+            }
+        }
+        catch (e) {
+            console.error('[mirror] loop error:', e);
+        }
+    };
+    setInterval(tick, 60 * 1000);
+    setTimeout(tick, 10 * 1000);
+}
+//# sourceMappingURL=mirror.js.map

package/server/dist/multipart.js

@@ -0,0 +1,33 @@
+// multipart/form-data parsing using busboy.
+import busboy from 'busboy';
+export async function parseMultipart(req, buf) {
+    return new Promise((resolve, reject) => {
+        const bb = busboy({ headers: req.headers });
+        const fields = {};
+        const files = [];
+        bb.on('field', (name, val) => {
+            if (fields[name] === undefined)
+                fields[name] = val;
+            else if (Array.isArray(fields[name]))
+                fields[name].push(val);
+            else
+                fields[name] = [fields[name], val];
+        });
+        bb.on('file', (name, stream, info) => {
+            const chunks = [];
+            stream.on('data', (d) => chunks.push(d));
+            stream.on('end', () => {
+                files.push({
+                    field: name,
+                    name: info.filename,
+                    mime: info.mimeType,
+                    buffer: Buffer.concat(chunks),
+                });
+            });
+        });
+        bb.on('error', reject);
+        bb.on('close', () => resolve({ fields, files }));
+        bb.end(buf);
+    });
+}
+//# sourceMappingURL=multipart.js.map

package/server/dist/repox.js

@@ -0,0 +1,99 @@
+// 仓库领域的活函数：从已裁撤的 routes/repo.ts（网页路由）中摘出，
+// 供 /api/v1 建仓与 /api/dsh PR 合并性检测使用。routes/ 死网页路由已整体删除。
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import { conf } from './conf.js';
+import * as db from './db/db.js';
+import { nowUnix } from './db/db.js';
+import * as git from './gitx/git.js';
+import * as svc from './gitx/service.js';
+import { createRepoAction } from './db/actions.js';
+/** 建仓：写 repository 记录 + 初始化裸仓 + 关注/动作。原 routes/repo.ts createRepositoryRecord。 */
+export async function createRepositoryRecord(doer, owner, opts) {
+    const now = nowUnix();
+    const info = db
+        .db()
+        .prepare(`INSERT INTO repository (owner_id, lower_name, name, description, website, default_branch,
+        is_private, is_bare, is_mirror, enable_wiki, enable_issues, enable_pulls,
+        num_watches, num_stars, num_forks, num_issues, num_closed_issues, num_pulls, num_closed_pulls,
+        num_milestones, num_closed_milestones, created_unix, updated_unix, size)
+       VALUES (?,?,?,?,?,?,?,?,?,1,1,1,0,0,0,0,0,0,0,0,0,?,?,0)`)
+        .run(owner.id, opts.name.toLowerCase(), opts.name, opts.description ?? '', opts.website ?? '', conf.defaultBranch, opts.private ? 1 : 0, opts.autoInit ? 0 : 1, opts.mirror ? 1 : 0, now, now);
+    const repo = db.getRepoByID(Number(info.lastInsertRowid));
+    db.db().prepare('UPDATE user SET num_repos = num_repos + 1 WHERE id = ?').run(owner.id);
+    // owner watches own repo
+    db.watchRepo(doer.id, repo.id, true);
+    await svc.initRepository(repo, { autoInit: opts.autoInit, doer, readme: opts.readme, gitignores: opts.gitignores, license: opts.license });
+    createRepoAction(doer, repo);
+    return repo;
+}
+/** PR 合并性检测：clone 基线分支后 `git apply --check` 试套 patch。原 routes/repo.ts testPullRequestMergeable。 */
+export async function testPullRequestMergeable(repo, pr) {
+    const patchFile = path.join(conf.appDataPath, 'patches', String(repo.id), `${pr.index}.patch`);
+    if (!fs.existsSync(patchFile))
+        return pr.status ?? 0;
+    const tmpDir = path.join(conf.appDataPath, 'tmp', 'prtest-' + Date.now());
+    fs.mkdirSync(tmpDir, { recursive: true });
+    try {
+        const baseDir = repo.RepoPath();
+        await git.git(process.cwd(), 'clone', '-q', '-b', pr.base_branch, baseDir, tmpDir);
+        const wsFlag = repo.pulls_ignore_whitespace ? '--ignore-whitespace' : null;
+        const args = ['apply', '--check'];
+        if (wsFlag)
+            args.push(wsFlag);
+        args.push(patchFile);
+        const r = await git.gitOK(tmpDir, ...args);
+        return r !== null ? 2 : 0; // 2=mergeable 0=conflict
+    }
+    catch {
+        return 0;
+    }
+    finally {
+        fs.rmSync(tmpDir, { recursive: true, force: true });
+    }
+}
+/** wiki 写页：clone wiki 仓 → 写/删 .md → commit → push。原 routes/repo.ts writeWikiPage。 */
+export async function writeWikiPage(repo, title, content, doer, oldTitle, isDelete = false) {
+    const wikiDir = repo.WikiPath();
+    await svc.initWiki(wikiDir);
+    const tmpDir = path.join(conf.appDataPath, 'tmp', 'wiki-' + Date.now());
+    fs.mkdirSync(tmpDir, { recursive: true });
+    try {
+        const branch = svc.wikiBranch(wikiDir);
+        const hasBranch = await git.refExists(wikiDir, 'refs/heads/' + branch);
+        if (hasBranch) {
+            await git.git(process.cwd(), 'clone', wikiDir, tmpDir);
+        }
+        else {
+            await git.git(process.cwd(), 'clone', wikiDir, tmpDir);
+        }
+        const target = path.join(tmpDir, title + '.md');
+        if (isDelete) {
+            if (fs.existsSync(target))
+                fs.unlinkSync(target);
+            const symlink = target.endsWith('.md') ? target.slice(0, -3) : target;
+            if (fs.existsSync(symlink))
+                fs.unlinkSync(symlink);
+        }
+        else {
+            if (oldTitle && oldTitle !== title) {
+                const oldPath = path.join(tmpDir, oldTitle + '.md');
+                if (fs.existsSync(oldPath))
+                    fs.unlinkSync(oldPath);
+            }
+            if (!isDelete && fs.existsSync(target) && oldTitle === null) {
+                throw new Error('page already exists');
+            }
+            fs.writeFileSync(target, content);
+        }
+        const author = `${doer.name} <${doer.email}>`;
+        await git.git(tmpDir, 'add', '--all');
+        const msg = isDelete ? `Delete page '${title}'` : oldTitle ? `Update page '${title}'` : `Update page '${title}'`;
+        await git.git(tmpDir, 'commit', `--author=${author}`, '-m', msg);
+        await git.git(tmpDir, 'push', 'origin', `HEAD:refs/heads/${branch}`);
+    }
+    finally {
+        fs.rmSync(tmpDir, { recursive: true, force: true });
+    }
+}
+//# sourceMappingURL=repox.js.map